Departing Treasury boss Gabriel Makhlouf acted unreasonably when he described a leak of Budget information as being “deliberately and systematically hacked”, a State Services Commission investigation has found.
The SSC report also criticised Makhlouf’s failure to take responsibility for the security flaws which led to the breach, with State Services Commissioner Peter Hughes saying he focused more on the actions of the National Party than his own accountability.
However, the Treasury Secretary will not face any formal action despite the stinging criticisms, with Hughes suggesting his hands were tied given Makhlouf’s imminent departure.
The inquiry, which has been released on the Treasury Secretary’s last day in the job before heading to a new role in Ireland, followed an embarrassing leak of information on the eve of the Government’s first Wellbeing Budget.
The National Party trumpeted figures it had been able to obtain from the Government’s Budget appropriations online.
Makhlouf initially told media the Treasury had been “deliberately and systematically hacked”, adding he had referred the matter to police, with Finance Minister Grant Robertson asking National to stop its releases after receiving advice from Makhlouf.
National leader Simon Bridges later confirmed his party had obtained the data from searching the Treasury’s website, leading to widespread criticism of Makhlouf.
Deputy State Services Commissioner John Ombler, who conducted the investigation, found Makhlouf had acted in good faith, reasonably and without political bias in the advice he gave to Robertson, as well as in referring the issue to police.
However, he did not act reasonably in using the phrase “deliberately and systematically hacked”, as well in giving subsequent media interviews where he likened the actions of the “hackers” to repeatedly attacking the bolt of a locked room until it weakened and broke.
While Makhlouf’s use of the words deliberate and systematic were “literally correct”, when coupled with the use of the term hack it gave an inaccurate sense of what had occurred.
“It’s [hack] an unuseful word to use, and I think it was unreasonable in that if he had sought further advice I think it highly probable he would not have used it.”
Ombler also said Makhlouf should have sought advice from the GCSB before releasing his media statement, as it was “highly likely” the phrase would not have been used following a discussion and debate of the terminology.
Hughes said he was disappointed by Makhlouf’s actions, which fell short of his expectations for chief executives.
“They are all very very clear, very clear, that when things go wrong I don’t want ducking, diving, running for cover, spinning. I want people to stand up, own it, fix it, learn from it and be accountable.”
Instead of taking personal responsibility, Makhlouf “focused more on the actions of the searchers of the Treasury website” rather than his own accountability for the Treasury’s failures.
While the Treasury Secretary’s decision to refer the issue to police was reasonable and not politically influenced, Hughes said he should have taken more advice before issuing a media statement about the referral.
“It was a clumsy response to a serious issue and is not what I expected of an experienced chief executive.”
“We can’t run the public service on the basis that you’re only as good as your last mistake. We can’t do that – that’s The Apprentice, it’s not Fair Go New Zealand.”
However, Hughes said both Crown Law and former Solicitor General Mike Heron had advised him Makhlouf’s conduct was not a sackable offence, while other action such as an official warning would be “meaningless and cynical” given his imminent departure.
“We can’t run the public service on the basis that you’re only as good as your last mistake. We can’t do that – that’s The Apprentice, it’s not Fair Go New Zealand. I have to look at this in the round, I have to look at this in terms of his eight years of service, and that’s what I’ve done…
“What is most important to people doing these big roles like Mr Makhlouf’s is their professional and personal reputation, and that has taken a major hit here.”
Hughes would not comment on whether he would have accepted Makhlouf’s resignation had it been offered, saying only that “none has been offered”, although he confirmed he would expect an offer of resignation for major failures.
National deputy leader Paula Bennett said Makhlouf should have offered his resignation and needed to at least apologise for his handling of the saga, while Robertson also had questions to answer about his actions.
“He is ultimately responsible for the Treasury and the Budget, and the buck stops with him,” Bennett said.
“It’s clear he did not ask the right questions of Mr Makhlouf and only heard what he wanted to hear – which was that the National Party was engaged in systematic hacking.”
