The Prime Minister's office has revealed Treasury knew for certain it had not been hacked for about 12 hours before it issued a public statement to clarify.
It follows the National Party accusing the Beehive of misleading the country by allowing New Zealanders to think the Treasury had been hacked, despite its spy agency advising otherwise.
- Government provides Budget 2019 leak timeline to quash scandal
- Simon Bridges calls for Grant Robertson and Gabriel Makhlouf to resign
- Jacinda Ardern denies GCSB warned Beehive before Treasury 'hack' statement
Brook Barrington, chief executive of the Department of the Prime Minister and Cabinet (DPMC), confirmed on Wednesday the Beehive and Treasury "could definitively say what had occurred" at 4:30pm on May 29.
But it wasn't until 5:05am the next day - May 30, the day Budget 2019 was released - that Treasury issued a statement to say it hadn't been "hacked" - after sitting on the information for about 12 hours.
What exactly happened?
Barrington said he spoke to Andrew Hampton, director-general of the Government Communications Security Bureau (GCSB) at 8:45pm on May 28 - about 45 minutes after Treasury issued its "hack" statement at 8:03pm.
He said Hampton was "not able to definitively say what had occurred until 4:30pm on Wednesday afternoon [May 30]. I remember that absolutely precisely".
Barrington said senior officials did not meet on May 28, but the State Services Commissioner, the Treasury secretary, Barrington, Hampton, and Paul James, who looks after government information systems, met on May 29 at 1:30pm.
Another meeting that day at 4:30pm with the same membership was when Hampton could "definitely advise" that Treasury had not been hacked. Treasury then waited about 12 hours before releasing its statement to say it hadn't been hacked.
Barrington revealed the new information during the Governance and Administration Select Committee on Wednesday, which allowed the Opposition to ask him specific questions.
Paula Bennett, deputy leader of the National Party, grilled Barrington about when the Beehive was informed of the breach in Treasury's website.
Barrington told Bennett he was at home on May 28, the day National leader Simon Bridges released Wellbeing Budget information two days before its official release.
He said he received a call from Treasury secretary Gabriel Makhlouf at 7:37pm that day, when Makhlouf told him he believed Treasury had been hacked and that police had been contacted.
Bennett asked Barrington if the Prime Minister's office was informed before then, to which he replied "no". He said Prime Minister Jacinda Ardern was informed: "immediately thereafter".
"I said to the Prime Minister that my primary concern, as it was for the rest of that night and for much of the following day, was the security of the Government's information systems."
He said he conveyed to the Prime Minister that his main concern was around how the firewall in a department of state and cyber protections had been breached.
Bennett asked Barrington why - if on May 28 there were concerns that Treasury's systems had been hacked - the prospect of a foreign actor trying to infiltrate the Government's systems wasn't considered.
"The 'who' was secondary to the 'how'. The first question we needed to determine was how there had been a cyber-intrusion," Barrington said.
"In a sense, it doesn't matter whether that intrusion was happening domestically or whether it was an act of foreign interference - the 'who' of it might've taken a very long time to consider - my primary task was to determine whether Government systems had been breached."
Bennett asked Barrington why - if it was determined at 4:30pm on May 29 that Treasury hadn't been hacked - it took about 12 hours to issue a statement on May 30 to confirm it.
"That's a question for the Treasury," he said, adding that it was "perfectly reasonable for them to consider their options" and that "they needed time to consider all of their options".
Barrington's account follows clarification in Parliament on Tuesday from Acting GCSB Minister David Parker, who was filling in for Andrew Little.
The GCSB Minister was accused of not telling the Prime Minister or the Finance Minister that the GCSB did not think Treasury had been hacked, before it issued its statement on May 28.
Parker said it was 8:43pm on May 28 when Little's office was contacted by the GCSB, and it wasn't until 9:43pm that Little actually spoke to the spy agency - before Treasury issued its statement at 8:03pm.
Ardern said in Parliament the Beehive acknowledged the GCSB's warning, and that's why henceforth the term "unauthorised access" was used instead of "hack", until the Government could determine exactly what had happened.
The debacle has sparked an investigation by the State Services Commission looking into whether Treasury misled the Finance Minister before he issued his public statement echoing Treasury's statement saying it had been hacked.
Barrington & Beehive's timeline
May 28
- 7:37pm - Barrington spoke to Treasury secretary
- 8:02pm - Treasury issues "hack" statement
- 8:43pm - Andrew Little's office contacted by GCSB (he was in a meeting)
- 8:45pm - Barrington spoke to GCSB
- 9:43pm - Andrew Little spoke to the GCSB
- 9:52pm - Prime Minister's office informed
- 10:25pm - Finance Minister's office informed
May 29
- 1:30pm - Officials meet to discuss the situation
- 4:30pm - Officials meet again, Hampton confirms no hack occurred
- 5:05am - Treasury issues statement saying it wasn't hacked
Newshub.
