National finance spokesman Paul Goldsmith and deputy leader Paula Bennett during their press conference over the State Services Commission's report into Gabriel Makhlouf. Photo / Mark Mitchell
National finance spokesman Paul Goldsmith and deputy leader Paula Bennett during their press conference over the State Services Commission's report into Gabriel Makhlouf. Photo / Mark Mitchell
National deputy leader Paula Bennett says that outgoing Treasury boss Gabriel Makhlouf is incompetent and should apologise for his "Mickey Mouse" handling of the so-called Budget hack that wasn't a hack.
Her comments follow the release this morning of a State Services Commission investigation into Makhlouf, which found that he had acted in good faith and without political bias, but he had failed to meet the standards expected of a public service chief executive.
The report found that Makhlouf's statements to media before Budget day were unreasonable, and he should have consulted more and taken greater personal responsibility - and should have done so publicly.
Makhlouf has remained defiant, telling his employer State Services Commissioner Peter Hughes that he had done nothing wrong.
Bennett said that wasn't good enough, and Makhlouf needed to step up and take responsibility for his "Mickey Mouse operation".
"The level of incompetence right across, and it more being about butt-covering and trying to throw other people under the bus instead of standing up and taking personal responsibility ... is something I haven't seen in the public service for a very long time," Bennett said.
"The very least we should be expecting is an apology to the New Zealand public for the incompetence that's been shown throughout this whole episode.
National's finance spokesman Paul Goldsmith said the criticisms of Makhlouf applied equally to Finance Minister Grant Robertson.
"Fundamentally, the buck stops with him in terms of accountability for Budget secrecy."
Goldsmith said that Robertson should have offered his resignation and, asked if he should now, he said: "I don't think he will now, but he should have."
Bennett accepted the report's findings that Makhlouf had not deliberately misled Finance Minister Grant Robertson, nor had he orchestrated a hit job on the National Party or showed any political bias.
But she said that Robertson, whose conduct the commission has no jurisdiction over, had been wrong to say that the "hacking" of the Treasury was linked to the confidential Budget 2019 information that the National Party had already released.
The commission's report showed that Robertson called Makhlouf an hour after he put out his statement to ask whether there was any evidence that the National Party was involved.
Makhlouf told him there was none.
Robertson should have cleared that up the following day, Goldsmith said.
"He did nothing on Wednesday to correct that - that is where I think he is most culpable."
Robertson released a statement today repeating his disappointment that the Treasury website had been used to access confidential information.
Bennett said she stood by National's previous comments that the Government had "sat on a lie" by not correcting the statement about the Treasury had been systematically hacked, even after advice from the Government Communications Security Bureau's cybersecurity unit that there was no hack.
The commission's report said it was reasonable for the Treasury to take its time to put out a statement , but Bennett said that was unacceptable.
"Not in any way, shape or form. They sat on it for more than 30 hours, knowing exactly what the truth was and deciding not to release it.
"Tuesday even they knew it wasn't a hack ... we had the Finance Minister himself link it to the National Party, and all day Wednesday right through to 5am on Thursday morning, they sat knowing it wasn't a hack."
Today is Makhlouf's last day working at the Treasury before he takes up a position as head of Ireland's Central Bank.
A spokesperson at the Treasury said Makhlouf would be releasing a statement later today.
State Services Commissioner Peter Hughes and Deputy Commissioner John Ombler releasing the findings of the investigation into Treasury Secretary Gabriel Makhlouf. Photo / Mark Mitchell
Timeline
Tuesday, May 28
• 10:01am: In a press release, National publishes what it claims to be details of the 2019 Budget.
• 11:30am: Finance Minister Grant Robertson confirms some of the details in National's release are from Budget 2019.
• 1.04pm: Treasury official texts Treasury boss Gabriel Makhlouf to say that the information may have come from the Treasury website.
• 1:51pm: Treasury IT team starts making changes to prevent search snippets from the clone site showing on the live site.
• 2pm: National says its method of accessing the Budget information on the Treasury website is closed down.
• 6pm: The Treasury asks the cybersecurity unit of the Government Communications Security Bureau about how confidential information on its website was accessed.
• 6.06pm: GCSB cybersecurity unit phones Police Detective Sergeant, says it is not GCSB's remit. Suggests police contact Treasury.
• 6.14pm: Police contacts Treasury. This is when the matter is officially referred to the police.
• 7:15pm: Makhlouf meets Robertson in his Beehive office and tells him that he has called police. Robertson says that Makhlouf described it as 2000 attempts to "hack" the system. Meeting is later attended by Jacinda Ardern's chief press secretary Andrew Campbell and deputy chief of staff Raj Nahna.
• 7:35pm Police media team contact Treasury the liaise about media statement.
• 7:36pm: GCSB cybersecurity unit phones Police Detective Sergeant, who says he is unsure whether this is an offence.
• 8:02pm: The Treasury issues a press release saying it has "sufficient evidence" that it had been "deliberately and systematically hacked". It cites the GCSB advice in saying it has been referred to police.
• 8:19pm: Robertson issues a press release, asking National not to release any further information because "the material is a result of a systematic hack".
• 8:25pm: Head of GCSB Andrew Hampton calls Brook Barrington, the head of the Department of PM and Cabinet, to say there was no compromise of the Treasury website, and this was not a "hack" but an information management issue.
• 9.02pm: Hampton texts Makhlouf to say this is not a "hack" and they need to correct.
• 9:13pm: GCSB contacts the Treasury to discuss concern with word "hack" and lack of consultation on media statement.
• 9:14pm: Makhlouf phones Hampton, discusses different point of views over the word "hack".
• 9.22pm: Makhlouf returns Robertson's call, says there is no evidence of National Party involvement.
Wednesday May 29
• 7:04am: Makhlouf tells media there had been 2000 attempts to access the Treasury's system in 48 hours. He refers to it once as a hack in another media interview.
• 9am: Simon Bridges strongly denies the information released by National came into its possession unlawfully, but refuses to say how it was obtained. Says it is a "lie" to say the Treasury was hacked.
• 1.40pm: Police advise the Treasury that nothing illegal appears to have taken place
• 4.30pm: How the information breach occurred becomes clear and public sector bosses and Robertson are told. Ardern is told about 6pm.
Thursday May 30
• Thursday, 5am: Treasury releases police advice. State Services Commission, at Makhlouf's invitation, launches inquiry into how the Treasury's Budget information was accessed.
• 8:45am: Simon Bridges fronts a press conference where he outlines how National used a simple search function to get the info. He says the Treasury has "sat on a lie" and calls for Makhlouf and Robertson to resign for smearing the National Party.
• Paula Bennett writes to SSC, asking for it to investigate Makhlouf and Robertson and whether they have acted appropriately.
Tuesday June 4
• 4:30pm: State Services Commissioner Peter Hughes announces new investigation into whether Makhlouf misled the Government, to be conducted by Deputy State Services Commissioner John Ombler.
Friday June 7
• Herald reveals that the GCSB urgently contacted the Beehive to object to the language being used to describe what happened as "systematic hacking".
• Ardern says that no ministers learned about the GCSB advice until after the statements about hacking had been released on May 28. National says that ministers still spent 33 hours "sitting on a lie" and should have released the GCSB advice as soon as they were told about it. Ardern says it was appropriate not to as police were looking into the incident at the time, and a full picture of what had happened did not emerge until later.
Thursday June 27
• Ombler report critical of Makhlouf is released, though his actions are not deemed sackable. It is Makhlouf's last day at the Treasury before he leaves to take up a position as head of the Irish Central Bank.
