The OCR leak: again/still

I’m heartily sick of the Reserve Bank leak story and hope that this is the last occasion I write about it.  But there were a few further points I wanted to make, partly in response to the coverage in the last 24 hours.

I would also add that despite several commenters on various stories having correctly noted that the longstanding system vulnerabilities mean that there may have been previous leaks over the years from people in the Reserve Bank’s media or analyst lock-ups, I’m not sure it would a wise use of time or resources now (or perhaps even possible) to attempt to prove it one way or the other.  But that is a matter for the Reserve Bank.

Much of the media commentary has been about the abolition of the Reserve Bank’s lock-ups.  The many good trustworthy people pay the price of one peripheral player cheating.  Worse, it will apparently be harder to get good reporting and consumers of news will suffer.  And, from some of the economists, a concern that financial markets might be more volatile for the “first few minutes” after the release while economists and traders try to digest what the Bank is saying.   I plead for some perspective.

All of this commentary loses sight of the simple point which I have made previously, and which the Reserve Bank statement yesterday also makes.  Other countries don’t do it the way we were.  No country that I’m aware of had provided advance lock-ups for economists and analysts for official interest rate announcements.  And the handful that do provide some tightly-controlled advance notice for a select group of journalists give them only a few minutes advance notification, not two hours.  Other countries’ central banks don’t provide their staff to provide private briefings to media or analysts in advance of release, in doing so providing different information to those inside those lock-ups than is available to those outside.     What the Reserve Bank wants to say  in its releases should be carefully drafted and refined, and then put in the official documents, and left to speak for itself.  Sometimes press conferences can be useful, but they should be viewable (as the Reserve Bank’s are) by everyone, not only by the select few.  If anything, under the new arrangements, the press conferences may even allow better scrutiny and more searching questioning of the Governor, since future press conferences will occur an hour after the release (rather than a few minutes after as has been the case until now).  That will allow journalists to talk to economists, politicians, sector group leaders etc before they pose their questions to the Governor.

It is worth remembering, again as I’ve pointed out previously, that half of each year’s OCR announcements have always taken place without benefit of lengthy explanatory lock-ups (or press conference).  The full scale lock-ups have been used for Monetary Policy Statements, but not for the other intervening OCR reviews.  I’m not sure there is any evidence that the market reaction to those one page statements has been any more difficult or volatile than for the MPS releases.

Nonetheless, I think there are still some aspects of the new regime that will require some bedding down, and perhaps later refinement.    I’ve long thought it was a mistake to release OCR announcements at exactly the same time as MPSs. A better model, in my view, would be to release the OCR decision as soon as it is made (further reducing another aspect of risk in the system) and then to release an MPS a few days later, as background analysis (looking forward, and providing ex post assessments).  In such a model, the MPS would be much less market sensitive (the main market-moving news is in the OCR announcement itself). For such a background document, there might be less harm (but less interest) in a lock-up to explore the technical detail of the forecasts.

More immediately, the Reserve Bank should consider adopting the idea proposed by former Czech central bank head of communications Marek Petrus (discussed on his Lombard Rates blog, and here on mine) that the Bank should host an analysts briefing later in the day of the MPS release.  In such a briefing,  analysts could ask questions of the Bank (in person or by phone –  akin to conference calls investment banks run), and the Bank  might also be able to use the occasion to resolve  openly any misinterpretations that had arisen over the day.  But the critical aspect of the arrangement is that the briefing would be webcast (as the press conferences are) so that everyone has the same information, whether in Wellington, Auckland, Singapore, or New York, whether economist or not.  A concern about the new system the Bank announced yesterday is that it will resolve one problem and open another.  The analysts lock-up (and the later economists’ lunch) has always had problems in that they sometimes provided information to attendees that wasn’t available to everyone else.  In the new world there is a risk that there will be high rewards for those – especially the Wellington-based – who, searching for nuance, secure coffee discussions with the Chief Economist or the Manager, Forecasting.

Somewhat surprisingly, even the Prime Minister has weighed in, calling for the Reserve Bank to reconsider, noting that Budget lock-ups had worked well.  I’m not sure whether The Treasury uses more robust systems to reduce the risk of leaks (perhaps they will be reviewing them in light of the Bank’s experience?), but even if they aren’t the case for a lock-up for Budget material is much stronger than for MPS.  First, there is typically a wide range of material across huge number of portfolio areas.  Second, often new initiatives are being announced, with technically complex details.  And third, not much about the Budget is typically very market-sensitive, especially as the Beehive typically provides strong hints (or more) on the juicy stuff in advance of Budget day.  By contrast, OCR announcements and MPS releases are really just the same old stuff over again (new data, new rate, but the same basic framework), but the bottom line is highly market sensitive, and there is no pre-briefing of selected journalists.

Changing tack, I have been a little surprised at how little of the media coverage has focused on the Reserve Bank’s weak systems.  Perhaps that is understandable: the media has the strongest interest in the story as it affects them (changes in lock-up arrangements), and the Reserve Bank is a powerful institution and most of them want to remain on good terms with the Bank (even while complaining quietly).  But what happened in this episode involved two things:

  • A MediaWorks staffer who breached his own express or implied commitments to the Reserve Bank (not to communicate the information before the embargo lifted)
  • A central bank that ran lock-ups that, it turns out, used no technological protections, and relied totally on trust to protect extremely sensitive information.

I was trying to explain the story to my children last night.  I told them that I had no reason to distrust the people who live on my street, but that nonetheless I would irresponsible if we went out and left the doors wide open, simply relying on trust that nothing bad would happen.   Most of the time, nothing bad would happen.  But if and when it did, people (including the insurance company) might reasonably talk of contributory negligence.

Managing highly sensitive information is not incidental to what the Reserve Bank does, but integral.  And yet they unnecessarily sit on the OCR decisions for six days, running risks of (inadvertent) release by someone inside the institution.  And they tell the Minister of Finance –  when he and his advisers will have their own agendas –  more than hour before the announcement.  And –  the focus of this episode –  they have dozens of people from the financial media and financial institution economists in lock-ups which were secured by no more than trust.    I don’t think I had realized until last night quite how bad the situation was.  On entering the lock-ups participants have to hand in their phones, but all continue to have access to their laptops with active internet connections throughout the lock-ups.  There was, apparently, no effort ever made to secure either individual laptops or the rooms where the lock-ups were held (to physically prevent transmission until the embargo is lifted).    In an earlier post, I touched on hypothetical risks –  the analysts lock-up used to be held in a room easily overseen from neighbouring apartments – but all the time anyone in the lock-ups could simply have emailed the news to anyone they chose.  It is staggeringly lax.  Mike Hannah, Head of Communications was quoted in yesterday’s press release on the new arrangements, but these previous lock-ups were his responsibility.  What were he, and his boss Deputy Governor, Geoff Bascand, doing in allowing such incredibly lax security?  They left the door wide open, and eventually (at least) one person walked through it.

As I noted yesterday, it is surprising that the Governor’s press release took no responsibility for any of this, and offered no apology for it.   I hope the Bank’s Board (and its audit or risk committee) is asking some hard questions.

Finally, I remain irked at being accused by the Governor of being “irresponsible”, for not passing on to the Bank the email I received (from someone not in the lock up) as soon as I received it.   As I have already noted, I had no relationship of trust with the Bank, owed them nothing, and in passing on the information at all –  acting with a sense of public responsibility, and a concern for the best interests of an organization I had worked for for decades –  I have probably jeopardised my future relationship with MediaWorks.  I am also irked that yesterday was the first time I had heard the Bank suggest that I was somehow to blame.  It has the feel of a line made up after the event, to distract attention from the real story: the Bank’s weak systems, and a security breach by a journalist who the Bank had allowed to participate in its lock-up.


Let me explain.  And if the detail is painstaking, feel free to stop here. This is for the record as much as anything.


As I have said previously, I received an email from a MediaWorks employee at 8:04am on the morning of 10 March.  It is reproduced in the Deloitte report.  It read.

We have just heard that the Reserve Bank is cutting by 25 basis points
I didn’t see the email straightaway  –  it is the sort of time my kids are getting ready to leave for school.  I saw it about 10 minutes after it arrived, and emailed back to the sender at 8:14
if true, that is very encouraging –  at last.  I  have thought it a bit more likely than the market pricing, but…one never quite knows
As I have noted all along, I had no way of knowing (until yesterday) if this was real information, or just the sender talking things up.     The tone of this email is not one suggesting I instantly believed there had been a genuine leak.
Various people have asked why the person sent the email to me in particular.  It had already been arranged that I was going to provide some on-air commentary on Radio Live later that morning on the OCR announcement.
I’ve gone through this stuff before, but in the following minutes various things went through my head.  I flicked onto the ANZ and Westpac exchange rate chart pages, half expecting, half fearing, to see a sudden movement in the exchange rate.  If there had been a genuine leak it seemed unlikely that I was going to be the only one to know, and in all my years at the Reserve Bank –  including running the Financial Markets Department –  our greatest fear had been market participants being able to profit from early access to such information.
At some point I thought about contacting the Reserve Bank.  That wouldn’t have been as easy as it sounds.  I’m not exactly persona grata at the Reserve Bank, I knew that key people would most likely actually be in the lockups, and I didn’t have their cellphone numbers.  Graeme Wheeler wasn’t in lock-ups, but he was hardly going to take my call.   I could have sent an email, but who was likely to be rushing to open emails from me in that dead half hour when their attentions were on the media and market lock-ups.   And, as I have noted previously, I didn’t know if the information was the result of a real leak.  If I’d passed it on to the Bank before 9am, and it turned out they weren’t cutting, what I could expect from them was not a “hey, thanks Michael, even though there clearly wasn’t a leak on this occasion, but we really appreciate you pro-actively coming forward” but more like “there he goes again, always willing to believe the worst, constantly undermining us”.   And so, since the market hadn’t moved, I kept the email myself for the remaining few minutes and as soon as I’d read and digested the key bits of the statement (my own priority), I sent this email through to John McDermott (Assistant Governor, and my former boss) and Mike Hannah, Head of Communications at 9:08am
Mike, John
For what it is worth, I received an email an hour ago from someone telling me that they had just heard that the Bank was going to cut by 25bps this morning.  I have no idea whether it was a well-sourced “leak” or just speculation, but I have no reason to doubt the person who told me, who in turn (as far as I’m aware) has no reason to pass on simple speculation.
As I’ve noted previously, there are no allegations in this email, simply information  –  information which I didn’t know what to make of, but which now at least seemed to warrant investigation.
I didn’t hear from them for a while (both were at the press conference).  Reflecting on it a bit further, at 9:47 I sent this follow-up
Just for the avoidance of doubt, the email did not come from anyone inside the Bank (or inside govt).
At 10:03 am I had this email from John McDermott, cc’ed to Mike Hannah

Hmm. Serious but this is very little information to go on. What time exactly did you get the email?


A couple of minutes later I responded


And at 10:08 I sent this to Mike and John

and i’d be checking the media lock-up
At 10:29am I had this response from  McDermott

Thank you for letting me know. I am disappointed that somebody knew and thought it a good idea to spread the leak. Somebody with a decent character would have instead informed the Bank. You should let them know that for them to tell you puts you in a difficult place.

I had not noticed until now that McDermott even then apparently assumed there was a leak (“I am disappointed that somebody knew”).

And I responded at 10:37

No difficulty for me –  not as if I trade fx markets (or would ever use such information if I did). I did check the exch rate charts at the time, and had I seen any sudden move would have passed on the information before 9am.   I may mention the issue in my post on the MPS later in the day.
I did make mention of the issue some hours later in the my post on the MPS.   I noted, somewhat agnostically
And finally, as I have noted to them, the Reserve Bank might want look to the security of its systems.  I had an email out of the blue at around 8 this morning-  most definitely not from someone in the Bank –  telling me that the sender had just heard that the OCR was to be cut by 25 basis points.  I have no way of knowing if it was the fruit of a leak, or just inspired speculation, and was relieved to see the foreign exchange markets weren’t moving, but it wasn’t a good look.
And left it at that.
The next I heard was an email from Nick McBride, the Bank’s in-house lawyer, on 15 March


I think I saw you in Thorndon New World today when I was buying my lunch. Anyway, I am emailing you following your email to John McDermott and Mike Hannah at 9:08am Thursday 10 March alerting them to the possibility of a leak of the OCR decision. The Bank has appointed investigators from Deloitte to try and find out whether there was a breach in security and, if so, how it occurred. They will also review the process for transmitting the Governor’s OCR decision to see if any improvements are needed. I’m sure we both agree that it is the public interest to ensure the integrity of the process and tighten it as necessary.

As you are the person who has information that may indicate vulnerability in the process we would be grateful if the Deloitte investigators could talk to you about your email to John and Mike. We would suggest the meeting to discuss this take place at a convenient time for you at the Deloittes office here in Wellington (Level 16, 10 Brandon Street), ideally this week. If you could let me know the days and times you are available that would be appreciated. Deloitte should be able to fit in with you.

The lead from Deloitte is Ian Tuke and I have copied him on this email.

Thank you very much in advance for your cooperation. Feel free to contact me if you have any queries.


I thought this was a thoroughly professional approach, was relieved to hear about the inquiry, and we set up a time to meet.  There was no suggestion in Nick’s email, or in any of the earlier comments from McDermott, that I had done anything inappropriate.

A couple of days later I had a meeting with the Deloittes people conducting the inquiry.  I don’t have word for word what the senior guy said, but it was along the lines that the Bank had been very appreciative of me coming forward.  We had a good discussion, I gave them the original MediaWorks email (sender redacted) and I came away pretty content with how the Bank seemed to be handling the issue.

On 21 March, the following Monday, the media appeared to finally take some interest in the possibility of the leak.  Hamish Rutherford wrote a story on Stuff, in which he had sought comment from the Reserve Bank.   This is where I started to get a little annoyed with the Bank

The Reserve Bank has confirmed that following an allegation, it had launched an investigation.

“We are aware of an allegation that information may have been leaked ahead of the OCR announcement on 10 March,” a spokesman of the bank said.

While we have no evidence at this stage that any information was leaked, we take the integrity and security of market-sensitive information very seriously and have initiated an external investigation into the allegation.”

Note the repeated use of the word “allegation” –  a word, or idea, which had not appeared at all in Nick McBride’s email above (which simply talked of investigating the “possibility of a leak”).  As I have said repeatedly, I made no allegation: I passed on information, which appeared to raise some questions, and left it to the Reserve Bank to make what, if anything, it could of that information.

And then I heard nothing more of the matter until yesterday afternoon’s release.

The Bank has also taken to running the line that if only I had told them earlier, they would have avoided risks by bringing forward the release of the MPS (perhaps from 9am to 8:45am).  I’ve already touched yesterday on the implausibility of the idea that this would have solved their problems.  Graeme Wheeler should engage it a bit of introspection and ask himself just what his reaction would have been if somehow I had got hold of him or his advisers by 8:30 and told them what I in fact told them just after 9am.   After all, what I was passing was only hearsay (a solid report of what someone else had heard) at that point –  I didn’t know there had been a real leak, and so the Bank couldn’t be sure either.  And, frankly, the messenger would have mattered –  and I daresay Graeme would have been less inclined to react positively to hearing it from me, than from one of his admirers.  In reality, they would have debated the matter among themselves –  after it had taken perhaps five minutes to get the key people in the same room –  been not sure what to make of it, especially after checking the exchange rate screens.  Probably they would have waited it out til 9am.  Partly because if they hadn’t, and had released at 8:45, it would have created mayhem –  the markets moving suddenly with people still away from desks and screens, and the Bank could only have said something like “we received information, from a source we aren’t sure we trust, which suggested that there might have been a leak”.  I’m not sure how that would have made their position, then or now, any better.   Those who lost money would have been even more vociferous than usual (and understandably so).

In  conclusion to what has been a long post, I am sufficiently riled by the gratuitous attack that I am considering raising the matter with the Reserve Bank Board.  Are such ad hominem attacks on someone public-spiritedly providing (possibly at some cost to myself) information that enabled the Reserve Bank to (a) identify an actual leak, and (b) identify serious weaknesses in their systems, the sort of behaviour they expect or tolerate from their employee the Governor? I sincerely hope not.