The message from Little to Robertson said that GCSB boss Andrew Hampton had advised that "what happened to Treasury's website was not a hack in the commonly understood sense".
"To cut to the chase, for your interviews tomorrow it would be best to refer to it as unauthorised access (it was a deliberate effort to get access to information that the person wasn't entitled to). In terms of reference to the police, you will need to say it is for the police to decide whether this unauthorised access constitutes a potential criminal offence."
By the morning of May 30, Budget day, National leader Simon Bridges revealed that staffers had gleaned information from the Treasury's website by using the website's search function.
This is despite the website being tested by Lateral Security on May 23 this year - five days before National released some Budget 2019 information, and seven days before Budget day.
In answers to written questions from National's finance spokeswoman Amy Adams, Robertson said the Treasury website was given a "Technology Risk Management Internal Audit" by Ernst & Young in February 2018.
"As part of Treasury's C+A (certification and accreditation) process, all public internet facing systems and websites are independently penetration tested before they are authorised to operate," Robertson said.
Penetration testing was completed for all of the websites hosted by the Treasury during 2016 and 2017, and the Treasury's public website was tested again in April 2018 and May 2019.
Other answers to written questions show that State Services Minister Chris Hipkins met State Services Commissioner Peter Hughes on May 28 at 4pm, about six hours after National released its Budget information and just before the Treasury called in the police to investigate.
Hipkins also talked to Hughes on the phone at 7.48pm that day, about 15 minutes before Makhlouf put out his statement about the Treasury being systematically hacked, and again at 9.17pm, about 30 minutes after the GCSB had alerted the Beehive to its objections over the use of the term "hacking".
Other answers about what the GCSB told the Treasury or police, and when, or what Makhlouf told Robertson before his "hacking" statement was released were not answered because of the State Services Commission investigation into whether Makhlouf misled Robertson.
Asked whether he had confidence in Makhlouf, who is leaving on June 27 to take up a position as head of the Irish Central Bank, Robertson said last week that he did in relation to the work on the Wellbeing Budget.
"On the matters that are under investigation, I will wait for the outcome of the investigation," Robertson said.
The written answers show that Robertson replied to Little's text message on May 28, telling him that Makhlouf was doing media interviews the following morning, not Robertson.
In those interviews on Breakfast, the AM Show and Radio New Zealand, Makhlouf described what had happened as someone "deliberately, persistently, repeatedly" attacking a bolt to gain access to secure information.
But he did call it "hacking" one time during his interview on the AM Show.
Ministers in the House during Question the next day, on May 29, did not refer to it as "hacking", but said that the Treasury website had been attacked.
However the Government has been criticised for not releasing the GCSB advice during the 33 hours between Makhlouf's May 28 statement and a media release from the Treasury at 5am on May 30 that nothing illegal appeared to have happened.
Ardern and Robertson have defended staying tight-lipped about the GCSB advice, saying that police were investigating and the whole picture had not emerged.
The Treasury website was exploited because staff had begun uploading some Budget information on to the clone site.
Although not publicly accessible, some information could be seen when a search was made on the website.
The whole picture eventually emerged at 4.30pm on May 29, 12 and a half hours before the Treasury's 5am release.
Asked about why during Question Time last week, Robertson said: "They [National] didn't want me to interfere in anything that the Treasury did; now they want me to interfere in exactly what the Treasury did. On the evening of Wednesday, 29 May, I practised my speech once, and then twice again. I went to bed that night believing that this Wellbeing Budget would be a good thing for New Zealand."
Timeline (updates in bold)
Tuesday, May 28
• 10.01am: In a press release, National publishes what it claims to be details of the 2019 Budget.
• 10.35am - 11am: Jacinda Ardern and Grant Robertson exchange eight text messages as they try to determine the nature of the information obtained by National.
• 11:30am: Grant Robertson confirms some of the details in National's release are from Budget 2019.
• Afternoon: National releases more Budget details.
• 2pm: National says its method of accessing the Budget information on the Treasury website is closed down.
• Before 6pm: The Treasury asks the cybersecurity unit of the Government Communications Security Bureau about how confidential information on its website was accessed. The GCSB says the Treasury's computer network was not compromised, and the matter should be referred to the police, given that it's not what the GCSB normally responds to.
• 6.15pm: Treasury Secretary Gabriel Makhlouf refers the matter to the police.
• 7:15pm: Makhlouf meets Robertson in his Beehive office and tells him that he has called in the police. Robertson says that Makhlouf described it as 2000 attempts to "hack" the system. Meeting is later attended by Jacinda Ardern's chief press secretary Andrew Campbell and deputy chief of staff Raj Nahna.
• 7:27pm: Robertson calls Ardern to inform her of latest developments.
• 7.47pm: Grant Robertson briefs Winston Peters in Peters' office.
• 7.48pm: State Services Minister Chris Hipkins discusses the issue with State Services Commissioner Peter Hughes on the phone
• 8:02pm: The Treasury issues a press release saying it has "sufficient evidence" that it had been "deliberately and systematically hacked". It cites the GCSB advice in saying it has been referred to the police.
• 8:18pm: Robertson issues a press release, asking National not to release any further information because "the material is a result of a systematic hack".
• 8.25pm: Robertson tells GCSB Minister Andrew Little about the media releases.
• 8:43pm: The GCSB contacts Little's office to say it doesn't believe any systematic hacking took place. Little is in a meeting. The GCSB contacts the Department of Prime Minister and Cabinet to pass on its concerns, and Ardern is told soon afterwards.
• 9.17pm: Hipkins and Hughes discuss the issue on the phone again
• 9.23pm: Call between Ardern, Robertson, Campbell and Nahna
• 9:43pm: Little speaks with GCSB boss Andrew Hampton and then tries to call Robertson. The call is not answered as Robertson is on a call with Ardern, Campbell and Nahna.
• 9.52pm: Little contacts Nahna in Ardern's office to pass on the GCSB's concerns.
• 10.25pm: Little texts Robertson about the GCSB's concerns, says to call it "unauthorised access" and not "hacking". Robertson responds that Makhlouf is doing media interviews the following morning.
• 10.33pm: Robertson calls Ardern to further discuss the situation
Wednesday May 29
• 7:04am: Makhlouf tells media there had been 2000 attempts to access the Treasury's system in 48 hours.
• 9am: Simon Bridges strongly denies the information released by National came into its possession unlawfully, but refuses to say how it was obtained. Says it is a "lie" to say the Treasury was hacked.
• Afternoon: Winston Peters says National has acted illegally.
• 4.30pm: Hampton tells public sector bosses in a meeting how the Treasury website was "exploited".
• 4.40pm: Robertson's office is informed of Hampton's briefing.
• About 6pm: Ardern is informed that police have advised the Treasury that nothing illegal appears to have happened, and a statement will be released in the morning.
• 6.44pm: Ardern, Robertson and Nahna discuss the matter on the phone
Thursday May 30
• Thursday, 5am: Treasury releases police advice. State Services Commission, at Makhlouf's invitation, launches inquiry into how the Treasury's Budget information was accessed.
• 8:45am: Simon Bridges fronts a press conference where he outlines how National used a simple search function to get the info. He says the Treasury has "sat on a lie" and calls for Makhlouf and Robertson to resign for smearing the National Party, and for Peters to apologise.
• Afternoon: Peters stands by his earlier comments and won't apologise. Says lawyers, such as himself, would know what constitutes illegal activity better than the police.
Friday May 31
• Paula Bennett writes to SSC, asking for it to investigate Makhlouf and Robertson and whether they have acted appropriately.
Tuesday June 4
• 3pm: Ardern says she expects the commission to look into the quality of advice that Treasury provided to ministers.
• 4:30pm: State Services Commissioner Peter Hughes announces new investigation into whether Makhlouf misled the Government, to be conducted by Deputy State Services Commissioner John Ombler.
Friday June 7
• Herald reveals that the GCSB urgently contacted the Beehive to object to the language being used to describe what happened as "systematic hacking". Robertson says he did not have that information when he released his statement about hacking on May 28.
Monday June 10
• Ardern says that no Ministers learned about the GCSB advice until after the statements about hacking had been released on May 28. National says that Ministers still spent 33 hours "sitting on a lie" and should have released the GCSB advice as soon as they were told about it. Ardern says it was appropriate not to as police were looking into the incident at the time, and a full picture of what had happened did not emerge until later.
Tuesday June 11
• Acting GCSB Minister David Parker, during Question Time, releases the timeline of the GCSB efforts to warn the Beehive about using the term "hacking".
