The State Services Commission is investigating whether Treasury Secretary Gabriel Makhlouf misled the Government. Photo / Greg Bowker
National leader Simon Bridges continues to allege that Finance Minister Grant Robertson is involved in a cover-up, and that seems to hinge on what took place at or before a crucial meeting at 7pm last Tuesday in the Beehive.
It had been a tumultuous day where, instead of making final preparations to deliver the world's first wellbeing Budget, the Government was forced on to the defensive after National released confidential Budget 2019 information two days before Budget day.
National Party staffers had been able to access the information by using a simple search function on the Treasury's website, and were trying to glean as much information as they could.
About 2pm, National staffers still trying to use the Treasury website search bar discovered that their access had been shut down.
That evening, before 6pm, a Treasury official called the National Cyber Security Centre (NCSC), an arm of the Government Communications Security Bureau, for advice.
The NCSC responded by saying the Treasury's website had not been compromised, and recommended calling in the police as it was not something the NCSC normally responded to.
The Treasury referred the matter to police about 6pm.
An hour later, Treasury Secretary Gabriel Makhlouf arrived at Robertson's office on the seventh floor of the Beehive.
He did not find Robertson there, but two members of Prime Minister Jacinda Ardern's staff; chief press secretary Andrew Campbell and deputy chief of staff Raj Nahna were waiting for Robertson for an update on what was going on.
The Government has said repeatedly that it was unclear to ministers at that stage how the Budget information had been accessed.
Robertson was helping to open Parliament's refurbished Rainbow Room on the ground floor of Parliament House. He returned immediately and entered his office with Makhlouf, and Campbell and Nahna went to Ardern's offices on the ninth floor.
"Mr Makhlouf came and gave me the advice on Tuesday night that he had referred to the police the fact that there had been around 2000 what he called 'hacks' into the Treasury system," Robertson said of the meeting.
Robertson said he asked if Makhlouf knew how it had happened, and was told that Makhlouf did not know at the time, nor did he know what information had been accessed.
After Makhlouf briefed Robertson and Robertson's staff, Campbell and Nahna were called back to the seventh floor and were briefed as well.
After the meeting, about 7.20pm, Robertson called Ardern to brief her on what Makhlouf had said.
Just after 8pm, Makhlouf released a statement saying that Treasury's website had been "deliberately and systematically hacked".
He cited NCSC advice in saying the police had been called in, but did not say that the NCSC - a unit with it the GCSB - found that the Treasury's website had not been compromised.
Makhlouf did not mention the National Party in his statement, but Robertson issued a statement a few minutes later that said he had asked National not to release any further Budget information because "the material is a result of a systematic hack".
Bridges responded on Twitter, saying when the truth comes out, Robertson will have to resign.
Makhlouf's references to the NCSC had already elevated the seriousness of the issue, but he reinforced that the following morning in media interviews when he said there had been 2000 attempts to access information in 48 hours.
He told Radio NZ it was as if the confidential information had been securely locked away, "but one of those bolts has a weakness, and someone who attacks that bolt - deliberately, persistently, repeatedly - finds that it breaks and they can enter and access the papers".
"It wasn't a case of someone stumbling into the room accidentally. It wasn't an instance of someone attacking the bolt and finding it broke immediately," Makhlouf said.
Bridges, however, later likened it to placing Budget documents out in the street with a sign on them saying "free to a good home".
Makhlouf did not say that National had hacked the Treasury, but he added that the information the party had released appeared to align with the material targeted on the Treasury website.
At the heart of National's claim of a cover-up is when Robertson or Ardern, or their offices, knew about the police referral or the GCSB advice that the Treasury's system had not been compromised.
They have repeatedly said the meeting was the first time they learned about the police referral.
They have not said when they were told about the GCSB advice, except to say it was not before the Tuesday meeting.
But National deputy leader Paula Bennett said it was "highly probable" that ministerial advisers were told about the police referral and the GCSB advice before the Tuesday meeting.
"I've been a minister and those advisers are in constant contact, particularly when things like this are happening," Bennett told the Herald.
"Robertson could be dancing on the head of a pin [about] what was said at that meeting, but had his office had any other contact?
"Are you going to tell me that their advisers weren't constantly on the phone, trying to get to the bottom of what exactly was going on? They would have been highly concerned and demanding answers constantly."
She said it seemed odd for Makhlouf to tell Robertson it was a hack and then tell him he didn't know how it happened.
"And they had closed down that loophole in the system a couple of hours earlier, about 2pm that afternoon. So they did know how it was happening. They also had the GCSB say to them they didn't believe it was a hack."
Bennett said she understood that the State Services Commission did not have jurisdiction over ministers, and National would pursue communications in and out of ministers' offices through Parliamentary questions and Official Information Act requests.
Robertson has also told Radio NZ he would be happy to hand over his office's communications to the State Services Commission inquiry, if requested.
By Wednesday evening, police came back to the Treasury to say nothing unlawful appeared to have happened.
Treasury informed Robertson late on Wednesday night, and the Treasury issued a statement at 5am the next morning about the "unauthorised access" to Budget information.
The word "hack" was noticeably absent.
• Last Tuesday, 10:01am: In a press release, National publishes what it claims to be details of the 2019 Budget
• Tuesday, 11:30am: Finance Minister Grant Robertson confirms some of the details in National's release are from Budget 2019
• Tuesday afternoon: National releases more Budget details
• Tuesday, 2pm: National says its method of accessing the Budget information on the Treasury website is closed down.
• Tuesday before 6pm: The Treasury asks the National Cyber Security Centre (NCSC) about how confidential information on its website was accessed. The NCSC says the Treasury's computer network was not compromised, and the matter should be referred to the police, given that it's not what the NCSC normally responds to
• Tuesday, 6pm: Treasury Secretary Gabriel Makhlouf refers the matter to the police
• Tuesday, 7pm to 7:15pm: Makhlouf meets Robertson in his Beehive office and tells him that he has called in the police. Robertson says that Makhlouf described it as 2000 attempts to "hack" the system, but did not know at the time how it happened. Meeting is later attended by Jacinda Ardern's chief press secretary Andrew Campbell and deputy chief of staff Raj Nahna
• Tuesday, 7:20pm: Robertson calls Ardern to inform her of latest developments
• Tuesday, 8:02pm: The Treasury issues a press release saying it has "sufficient evidence" that it had been "deliberately and systematically hacked". It cites the NCSC advice in saying it has been referred to the police
• Tuesday, 8:19pm: Robertson issues a press release, asking National not to release any further information because "the material is a result of a systematic hack".
• Wednesday, 7:04am: Makhlouf tells media there had been 2000 attempts to hack the system in 48 hours
• Wednesday, 9am: Simon Bridges strongly denies the information released by National came into its possession unlawfully, but refuses to say how it was obtained.
• Wednesday afternoon: Deputy Prime Minister Winston Peters says National has acted illegally.
• Wednesday night: Makhlouf informs Robertson that police have advised that nothing illegal appears to have happened, and a statement will be released in the morning.
• Thursday, 5am: Treasury releases police advice. State Services Commission, at Makhlouf's invitation, launches inquiry into how the Treasury's Budget information was accessed.
• Thursday, 8:45am: Simon Bridges fronts a press conference where he outlines how National used a simple search function to get the info. He says the Treasury has "sat on a lie" and calls for Makhlouf and Robertson to resign, and for Peters to apologise.
• Thursday afternoon: Peters stands by his earlier comments and won't apologise. Says lawyers, such as himself, would know what constitutes illegal activity better than the police.
• Friday: Paula Bennett writes to SSC, asking for it to investigate Makhlouf and Robertson and whether they have acted appropriately.
• Tuesday 3pm: Ardern says she expects the commission to look into the quality of advice that Treasury provided to ministers.
• Tuesday 4:30pm: State Services Commissioner Peter Hughes announces new investigation into whether Makhlouf misled the Government, to be conducted by deputy state services commissioner John Ombler
It's understood a NZDF aircraft and multiple helicopters are involved.