Finance Minister Grant Robertson says he is disappointed after Treasury admitted sensitive Budget information could be accessed on its website via the search function.
On Thursday, Treasury released a statement saying that Budget information had not been accessed on its website through a cyber attack - as it claimed on Tuesday - but by someone simply using the search function.
- Budget leak: Simon Bridges accuses Grant Robertson of smear job
- National leader Simon Bridges drops more Wellbeing Budget details
- Budget 2019 eclipsed by allegations Treasury was hacked
In a press conference, National leader Simon Bridges said that is exactly how the party accessed the information, demonstrating for media by typing "2019 2020" into the Treasury website's search bar.
"Any member of the New Zealand public could have done this if they had an interest in the Budget. From your grandson to your grandma."
Robertson said, on Budget day, it was disappointing the country's Treasury had such a hole.
"I'm very disappointed that confidential Budget information was able to be accessed in this way."
In its statement, Treasury explained how this enabled people to access the Budget information.
It said that as part of its preparation for the Budget, it had developed a clone of its website and Budget information was added to the cloned website "as and when each Budget document was finalised".
"On Budget Day, the Treasury intended to swap the clone website to the live website so that the Budget 2019 information was available online".
The cloned website had not been publicly accessible, Treasure claimed.
"As part of the search function on the website, content is indexed to make the search faster. Search results can be presented with the text in the document that surrounds the search phrase.
"The clone also copies all settings for the website including where the index resides. This led to the index on the live site also containing entries for content that was published only on the clone site."
The statement said as a result, a specifically-worded search would be able to surface "small amounts of content from the 2019/20 Estimates documents".
It comes after Treasury said on Tuesday that it had evidence it had been "deliberately and systematically hacked". Secretary Gabriel Makhlouf said there had been 2000 attacks within 48 hours.
But cyber experts questioned this, saying that for hackers to get through a protection layer can take hundreds of thousands of attempts. They believed access to the Budget information more likely came as a result of human error.
Fielding questions over whether it was ethical to have exploited the hole in the website, Bridges said it was the Opposition's duty to show the Government's incompetence.
"The only wrongful behaviour we have seen is from the Treasury, Grant Robertson and other Ministers such as Winston Peters."
Bridges calls for heads to roll
Bridges said Treasury's admission on Thursday that no hacking occurred was embarrassing and mocked the agency for referring the alleged hacking to police when only the search function was to blame.
"Treasury has known since Tuesday exactly what happened and they covered it up to cover their incompetence," Bridges said.
"With precision, they made the changes that were necessary on Tuesday... they knew they were sitting on the lie.
"If I hadn't called this press conference to reveal how we had done this, would they still be sitting on the lie? Of course they would."
Robertson admitted on Thursday that Treasury should have sought out more information before going to police.
"I am also very disappointed that the Treasury did not seek to find more information as to how this happened before referring the matter to the Police."
Bridges called onl Makhlouf to resign as well as Robertson for making a statement on Tuesday that Bridges said implied National received hacked material.
On Tuesday, Robertson called on the National Party to not release any more Budget material "given that the Treasury said they have sufficient evidence that indicates the material is a result of a systematic hack and is not subject to a Police investigation".
Bridges said Robertson can't distance himself from the Treasury.
"You'd have to have been born yesterday to believe that a deeply political Minister like Grant Robertson wasn't donkey-deep in this and briefed by his Treasury about exactly what was going on.
"He does not have the moral authority to deliver the Government's Budget today."
Bridges also expects an apology from Deputy Prime Minister Winston Peters.
"He went out to the Press Gallery and he made quite clear in his words that he knew what happened, that it was illegal, and that I needed to go," Bridges said.
Newshub.
