The State Services Commissioner, Peter Hughes, yesterday released the report into the actions of Treasury Secretary, Gabriel Makhlouf, over the National Party’s gaining of unauthorised access to budget material on the Treasury IT system.

Some key findings from the report of Deputy State Services Commissioner John Ombler

On what actually happened:

Mr Makhlouf told me that his view of the incident was that the persons undertaking the searches would have needed a degree of sophistication and knowledge of the Budget documentation and processes, that it was not random, and that it involved a series of patient and persistent searches over approximately two days. He said that the “snippets” returned in the search results then needed to be pieced together (like a jigsaw) in order to compile a coherent document. He considers that it was not a simple matter of searching for Budget 2019 and up popped the answer. I accept his view.

Treasury were shocked and confused. 

Overall, having undertaken the interviews and assessed the documents, I would describe the tone amongst the key people at Treasury involved in this incident as initially one of shock and confusion, but they maintained a clear focus on finding the source or sources and seeking to prevent further releases. I note that at least among some (including Mr Makhlouf) there was a clear view that it was ethically unacceptable for well-understood Budget confidentiality practices to be breached. This made them, in my view, focused on the actions of the person or persons who had accessed the material, rather than on the deficiencies in their own systems. This showed in Mr Makhlouf’s public statements. 

The report sets out in some detail the meeting between Makhlouf and Finance Minister Grant Robertson on the night of May 28.  Ombler said that the meeting agreed there as no evidence linking the attacks to the National Party. 

“Mr Makhlouf was asked if Treasury knew whether it could be an overseas attack and why GCSB was not investigating. He replied that, although Treasury has the IP addresses, it could not rule out foreign actors or whether a bot may have been involved. He said he did not know why the GCSB itself was not investigating the matter. “

The Minister’s office considered the possibility that the intrusion could have come from overseas.

“I gained the clear view from the two Minister’s office staff who I interviewed that they thought there was an intrusion into the cloned website that was a far more serious computer system intrusion (that is, not merely searches) than was actually the case.  


The Deputy Commissioner’s finding: 

“I conclude that, in providing advice to the Minister of Finance in relation to the Incident, Mr Makhlouf acted in good faith, reasonably and without political bias.”

The report finds that the decision to refer the matter to the Police was made in consultation with the Treasury’s office Solicitor and the GCSB responded to a telephone call from Treasury in which the incident was described and replied that it was a “`100% police matter.”

The Deputy Commissioner’s finding:

“Mr Makhlouf’s decision to refer the matter to Police was in good faith, reasonable and showed no evidence of political influence.”  

Ombler considered whether the choice of the phrase “deliberately and systematically hacked” for the draft of Makhlouf’s Tuesday 8:02 pm media statement was reasonable

“In my view, had further advice been sought from GCSB, a less ambiguous and negative phrase could have been chosen. I believe that it was not reasonable to use the phrase “deliberately and systematically hacked” in the final media statement because had Mr Makhlouf sought all of the appropriate advice before making the media statement, it is probable that this phrase would not have been chosen.”

However, overall Ombler found Makhlouf’s various media statements to be unreasonable. 

“In summary, I find that in relation to Mr Makhlouf’s written and oral media statements: a. Mr Makhlouf acted in good faith at all relevant times; Mr Makhlouf acted in a politically neutral manner at all relevant times, but  Mr Makhlouf did not act reasonably in relation to:

      • his use of the phrase “deliberately and systematically hacked” in his Tuesday evening media statement;
      • his use of the bolt analogy in his media interviews on Wednesday morning; and
      • in his media statement on Thursday morning, continuing to focus on the conduct of those searching the Treasury website rather than the Treasury failure to keep Budget material confidential.

In a brief statement last night, Makhlouf said: “I apologise that Budget information was not kept secure. The inquiry that I asked the SSC Commissioner to undertake will help us understand exactly how that happened and how to stop it happening again.

“The report confirms I acted at all times in good faith and with political neutrality. It also confirms that I acted reasonably, other than in my descriptions of the incident. I am pleased that my honesty and integrity are not in question.

“It has been my privilege to have had the opportunity to serve New Zealanders, and I’m very proud of what my Treasury team has achieved over the last eight years.” 

Makhlouf completed his term as Treasury Secretary yesterday.