New Zealand’s recently departed Treasury secretary, Gabriel Makhlouf, acted in good faith and did not unfairly malign the National Party opposition in addressing his department’s dramatic failure to maintain budget confidentiality this year, but he did go a bit overboard in blaming others for the incident, the State Services Commission has ruled.
In his investigation report, deputy state services commissioner John Ombler provides a detailed, blow-by-blow analysis of how the secretary handled the crisis of finding out the opposition had obtained confidential budget information before its public release.
The investigation followed serious complaints from the National Party that the secretary’s public descriptions of the incident as deliberate and systematic hacking of the department’s website and his referral of the matter to the police had cast unfair aspersions on the opposition. It turned out the National Party’s sneak peak at the budget came from the lawful exploitation of departmental IT blundering.
A website configuration mistake meant the live Treasury website’s search engine displayed snippets of budget information that was supposed to remain out of the public domain, on an offline version of the site.
The full documents remained offline but someone realised the search engine was displaying small excerpts in the results, and set about conducting over 2000 searches in about two days, allowing some of the budget information to be pieced together and then criticised by the opposition before it was publicly released.
The police found this was not illegal. The primary cause was the department’s mistake, but it took quite a bit of work to exploit the mistake.
“Mr Makhlouf told me that his view of the Incident was that the persons undertaking the searches would have needed a degree of sophistication and knowledge of the Budget documentation and processes, that it was not random, and that it involved a series of patient and persistent searches over approximately two days,” Ombler writes in his report.
“He said that the ‘snippets’ returned in the search results then needed to be pieced together (like a jigsaw) in order to compile a coherent document. He considers that it was not a simple matter of searching for Budget 2019 and up popped the answer. I accept his view.”
Ombler analysed Makhlouf’s decision making — at times in the heat of the moment and in the early hours of the morning with little advice or administrative support — in terms of three criteria: did he act reasonably, and in good faith, while remaining politically neutral? Two out of three was the verdict.
Most media reports have typically focused on the most negative findings in the report, despite it clearing the Treasury chief of the most serious criticisms levelled at him over the incident. Ombler found he remained apolitical — he even “went out of his way to ensure that he was not implicating the National Party in his media statements and interviews” — and acted in good faith at all relevant times, meaning the views he formed about what was going on, as it unfolded, were sincerely held.
Honest mistakes aside, a failure to maintain budget confidentiality is obviously not a good look for a Treasury chief and the finding that Makhlouf did too little to accept his own responsibility for the department’s mistake has been reported far and wide. It is causing some political problems for him and the government in Ireland, where he has been selected as the next central bank governor.
Another formal inquiry is looking into how the breach happened, but the investigation into the secretary’s actions as an employee of the state service had to be completed before Thursday, June 28, when Makhlouf’s term in the role ended. In September, he will be replaced by the current managing director of TAFE NSW, Caralee McLiesh.
Three PR mistakes in the heat of a crisis
The deputy commissioner found that only three specific aspects of Makhlouf’s many public statements were not reasonable; otherwise, his many other actions and statements were reasonable in the circumstances.
The secretary initially claimed the website was “deliberately and systematically hacked” but Ombler found this was over-egging the pudding. The departmental crisis management team had discussed whether “hacking” was the appropriate term, based on its somewhat amorphous definition from the Oxford dictionary, but did not consider that combining it with “deliberately and systematically” made the conduct sound far more nefarious. The investigation found this phrase was a fine starting point in a draft press release, but should have been walked back for the final version.
“I believe that it was not reasonable to use the phrase ‘deliberately and systematically hacked’ in the final media statement because, had Mr Makhlouf sought all of the appropriate advice before making the media statement, it is probable that this phrase would not have been chosen (that is, it would no longer have been a statement available to Mr Makhlouf to use; it would have been outside the limits of reason),” Ombler states.
“My finding is supported by Mr Makhlouf’s change in wording choice (from ‘hacking’ to ‘unauthorised access’) between the Tuesday night media statement and his Wednesday morning interviews.”
Further, the report found the secretary went too far with an analogy in media interviews. He told television viewers the information was “bolted down” and the method of obtaining it was like “someone who attacks that bolt deliberately, persistently, repeatedly, finds that it breaks and they can enter and access those papers” but really, Treasury had accidentally left open a window and nobody broke into anything. Ombler reports:
“In my view, the bolt analogy implied a degree of force to enter the cloned website and that it took multiple attempts to enter the secure part of the website. That was not the case. In fact, multiple searches on Treasury’s public website were undertaken to piece together information from the cloned website.”
He found this was an unreasonable analogy but still made in good faith and not with any intent to politically damage the opposition. Makhlouf told the investigator he rose at 4.30am to deal with the incident and thought up the analogy on his own, and did not have the opportunity to run it by other staff at that hour of the morning. Ombler accepted his evidence that he wanted to get across the point that someone had to chip away relentlessly to piece together some information the department believed was confidential.
Ombler also found fault in the emphasis of Makhlouf’s early morning statement issued at 5.05am on Thursday, May 30, because the secretary was “continuing to focus on the conduct of those searching the Treasury website rather than the Treasury failure to keep Budget material confidential”.
In a related finding, the report suggests the secretary misunderstood the concept of budget secrecy, giving it far too much importance outside of the government and believing it should apply universally when legally speaking it only applies to ministers and public servants. He “erred in believing that the public should be held to the same standard” in Ombler’s view.