Police waited for media to solve Brash's email leaks, report reveals

Don Brash. Photo / Doug Sherring

After finding no breaches of the Parliamentary server and so no threat to national security, police investigating the release of Don Brash's emails "sat back" and waited for the media to reveal the culprit.

That strategy was criticised yesterday in a review of the investigation which found there was a lack of urgency once questions over national security had been resolved.

"The plan was to then sit back and wait for what was considered to be an inevitable release in the media of the source of the Hager documentation," the review said. "This did not eventuate. Mr [blacked out] said the strategy had failed."

Investigators were also hoping the offender would be outed, saying charges were unlikely "unless admissions were made during interview".

The review is the final police investigation into emails published in the book The Hollow Men, by Nicky Hager.

Dr Brash, a former National Party leader, claimed they were stolen, but Hager said they were leaked from sources close to and inside the National Party.

Dr Brash resigned as National's leader after the book was published.

The review - which looked at the original investigation and a subsequent re-investigation - found the entire operation had been done competently.

The investigation appeared to favour the theory of an inside job.

An assessment of Parliamentary computer security from 2003 to 2005 found no evidence of any "hacking of any sort, no evidence of any interception or use of similar devices".

"No evidence of anything, really - in fact there was absolutely no trail to follow.

"While it is accepted by the experts interviewed that external hacking can never be fully eliminated, 'hacking' of the Parliamentary Services computer is not considered to be how the offence was committed," the investigation report stated.

It suggested two ways in which the emails might have been obtained - Dr Brash may have been using an "auto forward" function on his email accounts, or someone else had used computers or laptops that had access to them.

The investigation found gaps in security access to Parliament's third floor, meaning there were opportunities to grab sensitive documents in electronic or hard copy form.

It noted that Dr Brash printed documents at night to collect in the morning and left documents in his out-tray for shredding, which was not attended to regularly.

He and an associate, whose identity is protected in the report, left their laptops unattended while logged on.

The report quoted computer company Axon's service delivery manager, Deborah Clarke, as suggesting attitudes towards security in Parliament were too relaxed.

"They want all the security in the world but they're not prepared to live through the fundamentals of doing what you have to do to make sure you maintain security," she said. "So they don't let us implement complex passwords."

Hager was the only suspect. Police wanted to obtain a search warrant for his property, but legal advice was that it was unlikely to be granted.

Hager said any reasonable person would take the report as virtually proving the information had not been stolen.

But Dr Brash was yesterday still maintaining that the emails were stolen.

"It appears unlikely that the person who stole emails from my office will ever be identified, and I greatly regret that."

THE FINDINGS

Police investigation found:

* How and from whom the emails came to Nicky Hager had not been identified.
* Hacking of the Parliamentary server "highly unlikely".
* Documents obtained over a long period of time rather than in a one-off event.
* Security of access to offices and individual computers on the third floor of Parliament was inadequate.
* No evidence that Mr Hager committed a crime.