The OCR leak: again/still

I’m heartily sick of the Reserve Bank leak story and hope that this is the last occasion I write about it.  But there were a few further points I wanted to make, partly in response to the coverage in the last 24 hours.

I would also add that despite several commenters on various stories having correctly noted that the longstanding system vulnerabilities mean that there may have been previous leaks over the years from people in the Reserve Bank’s media or analyst lock-ups, I’m not sure it would a wise use of time or resources now (or perhaps even possible) to attempt to prove it one way or the other.  But that is a matter for the Reserve Bank.

Much of the media commentary has been about the abolition of the Reserve Bank’s lock-ups.  The many good trustworthy people pay the price of one peripheral player cheating.  Worse, it will apparently be harder to get good reporting and consumers of news will suffer.  And, from some of the economists, a concern that financial markets might be more volatile for the “first few minutes” after the release while economists and traders try to digest what the Bank is saying.   I plead for some perspective.

All of this commentary loses sight of the simple point which I have made previously, and which the Reserve Bank statement yesterday also makes.  Other countries don’t do it the way we were.  No country that I’m aware of had provided advance lock-ups for economists and analysts for official interest rate announcements.  And the handful that do provide some tightly-controlled advance notice for a select group of journalists give them only a few minutes advance notification, not two hours.  Other countries’ central banks don’t provide their staff to provide private briefings to media or analysts in advance of release, in doing so providing different information to those inside those lock-ups than is available to those outside.     What the Reserve Bank wants to say  in its releases should be carefully drafted and refined, and then put in the official documents, and left to speak for itself.  Sometimes press conferences can be useful, but they should be viewable (as the Reserve Bank’s are) by everyone, not only by the select few.  If anything, under the new arrangements, the press conferences may even allow better scrutiny and more searching questioning of the Governor, since future press conferences will occur an hour after the release (rather than a few minutes after as has been the case until now).  That will allow journalists to talk to economists, politicians, sector group leaders etc before they pose their questions to the Governor.

It is worth remembering, again as I’ve pointed out previously, that half of each year’s OCR announcements have always taken place without benefit of lengthy explanatory lock-ups (or press conference).  The full scale lock-ups have been used for Monetary Policy Statements, but not for the other intervening OCR reviews.  I’m not sure there is any evidence that the market reaction to those one page statements has been any more difficult or volatile than for the MPS releases.

Nonetheless, I think there are still some aspects of the new regime that will require some bedding down, and perhaps later refinement.    I’ve long thought it was a mistake to release OCR announcements at exactly the same time as MPSs. A better model, in my view, would be to release the OCR decision as soon as it is made (further reducing another aspect of risk in the system) and then to release an MPS a few days later, as background analysis (looking forward, and providing ex post assessments).  In such a model, the MPS would be much less market sensitive (the main market-moving news is in the OCR announcement itself). For such a background document, there might be less harm (but less interest) in a lock-up to explore the technical detail of the forecasts.

More immediately, the Reserve Bank should consider adopting the idea proposed by former Czech central bank head of communications Marek Petrus (discussed on his Lombard Rates blog, and here on mine) that the Bank should host an analysts briefing later in the day of the MPS release.  In such a briefing,  analysts could ask questions of the Bank (in person or by phone –  akin to conference calls investment banks run), and the Bank  might also be able to use the occasion to resolve  openly any misinterpretations that had arisen over the day.  But the critical aspect of the arrangement is that the briefing would be webcast (as the press conferences are) so that everyone has the same information, whether in Wellington, Auckland, Singapore, or New York, whether economist or not.  A concern about the new system the Bank announced yesterday is that it will resolve one problem and open another.  The analysts lock-up (and the later economists’ lunch) has always had problems in that they sometimes provided information to attendees that wasn’t available to everyone else.  In the new world there is a risk that there will be high rewards for those – especially the Wellington-based – who, searching for nuance, secure coffee discussions with the Chief Economist or the Manager, Forecasting.

Somewhat surprisingly, even the Prime Minister has weighed in, calling for the Reserve Bank to reconsider, noting that Budget lock-ups had worked well.  I’m not sure whether The Treasury uses more robust systems to reduce the risk of leaks (perhaps they will be reviewing them in light of the Bank’s experience?), but even if they aren’t the case for a lock-up for Budget material is much stronger than for MPS.  First, there is typically a wide range of material across huge number of portfolio areas.  Second, often new initiatives are being announced, with technically complex details.  And third, not much about the Budget is typically very market-sensitive, especially as the Beehive typically provides strong hints (or more) on the juicy stuff in advance of Budget day.  By contrast, OCR announcements and MPS releases are really just the same old stuff over again (new data, new rate, but the same basic framework), but the bottom line is highly market sensitive, and there is no pre-briefing of selected journalists.

Changing tack, I have been a little surprised at how little of the media coverage has focused on the Reserve Bank’s weak systems.  Perhaps that is understandable: the media has the strongest interest in the story as it affects them (changes in lock-up arrangements), and the Reserve Bank is a powerful institution and most of them want to remain on good terms with the Bank (even while complaining quietly).  But what happened in this episode involved two things:

  • A MediaWorks staffer who breached his own express or implied commitments to the Reserve Bank (not to communicate the information before the embargo lifted)
  • A central bank that ran lock-ups that, it turns out, used no technological protections, and relied totally on trust to protect extremely sensitive information.

I was trying to explain the story to my children last night.  I told them that I had no reason to distrust the people who live on my street, but that nonetheless I would irresponsible if we went out and left the doors wide open, simply relying on trust that nothing bad would happen.   Most of the time, nothing bad would happen.  But if and when it did, people (including the insurance company) might reasonably talk of contributory negligence.

Managing highly sensitive information is not incidental to what the Reserve Bank does, but integral.  And yet they unnecessarily sit on the OCR decisions for six days, running risks of (inadvertent) release by someone inside the institution.  And they tell the Minister of Finance –  when he and his advisers will have their own agendas –  more than hour before the announcement.  And –  the focus of this episode –  they have dozens of people from the financial media and financial institution economists in lock-ups which were secured by no more than trust.    I don’t think I had realized until last night quite how bad the situation was.  On entering the lock-ups participants have to hand in their phones, but all continue to have access to their laptops with active internet connections throughout the lock-ups.  There was, apparently, no effort ever made to secure either individual laptops or the rooms where the lock-ups were held (to physically prevent transmission until the embargo is lifted).    In an earlier post, I touched on hypothetical risks –  the analysts lock-up used to be held in a room easily overseen from neighbouring apartments – but all the time anyone in the lock-ups could simply have emailed the news to anyone they chose.  It is staggeringly lax.  Mike Hannah, Head of Communications was quoted in yesterday’s press release on the new arrangements, but these previous lock-ups were his responsibility.  What were he, and his boss Deputy Governor, Geoff Bascand, doing in allowing such incredibly lax security?  They left the door wide open, and eventually (at least) one person walked through it.

As I noted yesterday, it is surprising that the Governor’s press release took no responsibility for any of this, and offered no apology for it.   I hope the Bank’s Board (and its audit or risk committee) is asking some hard questions.

Finally, I remain irked at being accused by the Governor of being “irresponsible”, for not passing on to the Bank the email I received (from someone not in the lock up) as soon as I received it.   As I have already noted, I had no relationship of trust with the Bank, owed them nothing, and in passing on the information at all –  acting with a sense of public responsibility, and a concern for the best interests of an organization I had worked for for decades –  I have probably jeopardised my future relationship with MediaWorks.  I am also irked that yesterday was the first time I had heard the Bank suggest that I was somehow to blame.  It has the feel of a line made up after the event, to distract attention from the real story: the Bank’s weak systems, and a security breach by a journalist who the Bank had allowed to participate in its lock-up.

 

Let me explain.  And if the detail is painstaking, feel free to stop here. This is for the record as much as anything.

 

As I have said previously, I received an email from a MediaWorks employee at 8:04am on the morning of 10 March.  It is reproduced in the Deloitte report.  It read.

We have just heard that the Reserve Bank is cutting by 25 basis points
I didn’t see the email straightaway  –  it is the sort of time my kids are getting ready to leave for school.  I saw it about 10 minutes after it arrived, and emailed back to the sender at 8:14
if true, that is very encouraging –  at last.  I  have thought it a bit more likely than the market pricing, but…one never quite knows
As I have noted all along, I had no way of knowing (until yesterday) if this was real information, or just the sender talking things up.     The tone of this email is not one suggesting I instantly believed there had been a genuine leak.
Various people have asked why the person sent the email to me in particular.  It had already been arranged that I was going to provide some on-air commentary on Radio Live later that morning on the OCR announcement.
I’ve gone through this stuff before, but in the following minutes various things went through my head.  I flicked onto the ANZ and Westpac exchange rate chart pages, half expecting, half fearing, to see a sudden movement in the exchange rate.  If there had been a genuine leak it seemed unlikely that I was going to be the only one to know, and in all my years at the Reserve Bank –  including running the Financial Markets Department –  our greatest fear had been market participants being able to profit from early access to such information.
At some point I thought about contacting the Reserve Bank.  That wouldn’t have been as easy as it sounds.  I’m not exactly persona grata at the Reserve Bank, I knew that key people would most likely actually be in the lockups, and I didn’t have their cellphone numbers.  Graeme Wheeler wasn’t in lock-ups, but he was hardly going to take my call.   I could have sent an email, but who was likely to be rushing to open emails from me in that dead half hour when their attentions were on the media and market lock-ups.   And, as I have noted previously, I didn’t know if the information was the result of a real leak.  If I’d passed it on to the Bank before 9am, and it turned out they weren’t cutting, what I could expect from them was not a “hey, thanks Michael, even though there clearly wasn’t a leak on this occasion, but we really appreciate you pro-actively coming forward” but more like “there he goes again, always willing to believe the worst, constantly undermining us”.   And so, since the market hadn’t moved, I kept the email myself for the remaining few minutes and as soon as I’d read and digested the key bits of the statement (my own priority), I sent this email through to John McDermott (Assistant Governor, and my former boss) and Mike Hannah, Head of Communications at 9:08am
Mike, John
For what it is worth, I received an email an hour ago from someone telling me that they had just heard that the Bank was going to cut by 25bps this morning.  I have no idea whether it was a well-sourced “leak” or just speculation, but I have no reason to doubt the person who told me, who in turn (as far as I’m aware) has no reason to pass on simple speculation.
Regards
Michael
As I’ve noted previously, there are no allegations in this email, simply information  –  information which I didn’t know what to make of, but which now at least seemed to warrant investigation.
I didn’t hear from them for a while (both were at the press conference).  Reflecting on it a bit further, at 9:47 I sent this follow-up
Just for the avoidance of doubt, the email did not come from anyone inside the Bank (or inside govt).
At 10:03 am I had this email from John McDermott, cc’ed to Mike Hannah

Hmm. Serious but this is very little information to go on. What time exactly did you get the email?

John

A couple of minutes later I responded

8:04am

And at 10:08 I sent this to Mike and John

and i’d be checking the media lock-up
At 10:29am I had this response from  McDermott

Thank you for letting me know. I am disappointed that somebody knew and thought it a good idea to spread the leak. Somebody with a decent character would have instead informed the Bank. You should let them know that for them to tell you puts you in a difficult place.

I had not noticed until now that McDermott even then apparently assumed there was a leak (“I am disappointed that somebody knew”).

And I responded at 10:37

No difficulty for me –  not as if I trade fx markets (or would ever use such information if I did). I did check the exch rate charts at the time, and had I seen any sudden move would have passed on the information before 9am.   I may mention the issue in my post on the MPS later in the day.
Regards
Michael
I did make mention of the issue some hours later in the my post on the MPS.   I noted, somewhat agnostically
And finally, as I have noted to them, the Reserve Bank might want look to the security of its systems.  I had an email out of the blue at around 8 this morning-  most definitely not from someone in the Bank –  telling me that the sender had just heard that the OCR was to be cut by 25 basis points.  I have no way of knowing if it was the fruit of a leak, or just inspired speculation, and was relieved to see the foreign exchange markets weren’t moving, but it wasn’t a good look.
And left it at that.
The next I heard was an email from Nick McBride, the Bank’s in-house lawyer, on 15 March

Michael

I think I saw you in Thorndon New World today when I was buying my lunch. Anyway, I am emailing you following your email to John McDermott and Mike Hannah at 9:08am Thursday 10 March alerting them to the possibility of a leak of the OCR decision. The Bank has appointed investigators from Deloitte to try and find out whether there was a breach in security and, if so, how it occurred. They will also review the process for transmitting the Governor’s OCR decision to see if any improvements are needed. I’m sure we both agree that it is the public interest to ensure the integrity of the process and tighten it as necessary.

As you are the person who has information that may indicate vulnerability in the process we would be grateful if the Deloitte investigators could talk to you about your email to John and Mike. We would suggest the meeting to discuss this take place at a convenient time for you at the Deloittes office here in Wellington (Level 16, 10 Brandon Street), ideally this week. If you could let me know the days and times you are available that would be appreciated. Deloitte should be able to fit in with you.

The lead from Deloitte is Ian Tuke and I have copied him on this email.

Thank you very much in advance for your cooperation. Feel free to contact me if you have any queries.

Nick

I thought this was a thoroughly professional approach, was relieved to hear about the inquiry, and we set up a time to meet.  There was no suggestion in Nick’s email, or in any of the earlier comments from McDermott, that I had done anything inappropriate.

A couple of days later I had a meeting with the Deloittes people conducting the inquiry.  I don’t have word for word what the senior guy said, but it was along the lines that the Bank had been very appreciative of me coming forward.  We had a good discussion, I gave them the original MediaWorks email (sender redacted) and I came away pretty content with how the Bank seemed to be handling the issue.

On 21 March, the following Monday, the media appeared to finally take some interest in the possibility of the leak.  Hamish Rutherford wrote a story on Stuff, in which he had sought comment from the Reserve Bank.   This is where I started to get a little annoyed with the Bank

The Reserve Bank has confirmed that following an allegation, it had launched an investigation.

“We are aware of an allegation that information may have been leaked ahead of the OCR announcement on 10 March,” a spokesman of the bank said.

While we have no evidence at this stage that any information was leaked, we take the integrity and security of market-sensitive information very seriously and have initiated an external investigation into the allegation.”

Note the repeated use of the word “allegation” –  a word, or idea, which had not appeared at all in Nick McBride’s email above (which simply talked of investigating the “possibility of a leak”).  As I have said repeatedly, I made no allegation: I passed on information, which appeared to raise some questions, and left it to the Reserve Bank to make what, if anything, it could of that information.

And then I heard nothing more of the matter until yesterday afternoon’s release.

The Bank has also taken to running the line that if only I had told them earlier, they would have avoided risks by bringing forward the release of the MPS (perhaps from 9am to 8:45am).  I’ve already touched yesterday on the implausibility of the idea that this would have solved their problems.  Graeme Wheeler should engage it a bit of introspection and ask himself just what his reaction would have been if somehow I had got hold of him or his advisers by 8:30 and told them what I in fact told them just after 9am.   After all, what I was passing was only hearsay (a solid report of what someone else had heard) at that point –  I didn’t know there had been a real leak, and so the Bank couldn’t be sure either.  And, frankly, the messenger would have mattered –  and I daresay Graeme would have been less inclined to react positively to hearing it from me, than from one of his admirers.  In reality, they would have debated the matter among themselves –  after it had taken perhaps five minutes to get the key people in the same room –  been not sure what to make of it, especially after checking the exchange rate screens.  Probably they would have waited it out til 9am.  Partly because if they hadn’t, and had released at 8:45, it would have created mayhem –  the markets moving suddenly with people still away from desks and screens, and the Bank could only have said something like “we received information, from a source we aren’t sure we trust, which suggested that there might have been a leak”.  I’m not sure how that would have made their position, then or now, any better.   Those who lost money would have been even more vociferous than usual (and understandably so).

In  conclusion to what has been a long post, I am sufficiently riled by the gratuitous attack that I am considering raising the matter with the Reserve Bank Board.  Are such ad hominem attacks on someone public-spiritedly providing (possibly at some cost to myself) information that enabled the Reserve Bank to (a) identify an actual leak, and (b) identify serious weaknesses in their systems, the sort of behaviour they expect or tolerate from their employee the Governor? I sincerely hope not.

 

12 thoughts on “The OCR leak: again/still

  1. Hello Michael,

    I’m please I did pursue your piece to its conclusion. The approach taken by the RB beggars belief, a classic example of how not to engage with their well-intentioned supporters. I sympathise with your stance. Leads me to conclude “another great reason not to assist City Hall, let them stew”.

    Kind regards………..

    Andrew Strother

    Liked by 1 person

  2. Yes, you are right. Then again, I wasn’t a whistleblower in any traditional sense, just a (now) outsider who happened to get some information passed to him that should never have been outside the Bank at that time, and made the effort to alert the Bank to it.

    But discontent does seem to be brewing, and finally beginning to spill into the open

    http://www.bloomberg.com/news/articles/2016-04-14/rbnz-s-wheeler-finds-wellington-a-tougher-crowd-than-washington

    Like

  3. Michael

    Because I have not been criticising the RB Governor’s policies over the past year, I have not had my antennae on the alert for a riposte of the kind you felt he gave in his press release on announcing the fact of a leak, where you think he bundled you up with Mediaworks journalists and called you ‘irresponsible’, along with them:

    “The fact that several people outside the Bank, who had access to the information improperly, failed to alert the Bank immediately, was irresponsible and left open a significant risk that the Bank could have closed down quickly with an immediate official release.”

    My take on this Press release sentence from the Governor when I first saw it was that it was aimed at the Mediaworks editors/journalists to whom the ‘information’ (the original copy from the lockup) was sent by e-mail. It did not occur to me that it was aimed also at you as a second-hand recipient of an e-mail that simply said “We have just heard that the Reserve Bank is cutting by 25 basis points”. Strictly construed, surely that is not ‘access to information’ but, as you state, simply a report the accuracy of which you could not establish.

    I think that it is quite possible that the Governor, like Nick McBride and the Deloitte people, is grateful to you, as he would even-handedly be to anyone, for reporting the possibility of a leak after 9am. I also don’t think you had access to this information improperly, and I think this qualified phrasing in the Governor’s release, and the associated appreciative exchanges with Bank staff you have otherwise reported, suggest you were not the target of the ‘irresponsible’ charge.

    Secondly, to allege something, as you know, is to ‘confirm without proof’, or to ‘assert’ something, which you did not do, and that is why you are stung. But here I think you attribute too much skill with English to the RB staffer who provided you with the quotes via the journalist, which you have bolded today. As a retired RB staffer who worried about its use of language in some of its releases and publications (not those edited by you!), I think this is just sloppy English. For anyone but you as the interested party, it would be hardly registered as a slur or misrepresentation of what you had done, especially since this was made clearer elsewhere, and by you directly.

    So with these two alternative takes on the RB’s press release language, I can’t see any reason for you to take offence. It seems to me that you are working a bit hard to do so, perhaps because you are so bound up in a give and take series of exchanges with the RB over so long a period, to your evident frustration with respect to OIA releases especially.

    I would leave the Board alone on this issue myself, and keep my powder dry for the more substantive ones you have been pursuing lately.

    cheers
    Clive

    Like

    • Thanks Clive. It is a possible alternative interpretation (and in respect of the “allegation” word one I have wondered about myself).

      Counting against your interpretation are really two things. First, most other people appear to have read it my way (and disapproved). In fact, I first saw the RB statement when a senior economist I respect a lot rang me to say “did you see how Graeme has treated you in the statement?”. Second, if they didn’t mean to include me, it would be quite easy for them to have said so – I’m no more than an email or phone call away.

      I certainly wish your interpretation were the correct one, and I will happily report a clarification if you should prove to be correct.

      Michael

      Like

  4. If Nick did see you at the Thorndon New World, he should have approached for a good old chat over respectively held views on ‘the leak’. Perhaps a minor lesson here is to always make time for cuppa….

    Like

    • We did see each other passing in the supermarket. Nick is their expert/ deviser of ingenious reponses on the OIA so altho we do agree on some things – we both used to be fairly stringent questioners in the Bank’s financial regulatory committee – I’d probably happily stick to the professional exchange in writing that we had!

      Like

  5. Below are three comments from the RBNZ press release: –
    The blogger only alerted the Bank to the leak after the MPS was officially released.
    “The leak is a serious and disappointing breach … I am extremely disappointed…”.
    “The fact that several people outside the Bank … failed to alert the Bank immediately, was irresponsible…”

    1) I think the use of the world “only” in the first can not be intended in a positive way.
    2) The leak itself was “serious” and “disappointing”, to me that doesn’t sound quite as bad as “irresponsible”, and makes it sound like they are less concerned about the leak than they are about not being told about it.

    It is possible that it is just a poor choice of words. But given these comments, similar comments in the Deloitte report, the lack of a formal acknowledgement from RBNZ, arguably, even referring to you as a blogger rather than former staff member, the use of the word “allegation”, to me they all stack up on the negative side of the ledger, with nothing on the positive side. I think it indicates you aren’t their favourite person, to say the least.

    Having said that, is it worth pursuing? I doubt it. I can’t see the RBNZ board responding positively, they have to back their man. Any response would probably just cause you more frustration.

    On the whole matter of how they would’ve responded to an earlier communication. I wonder what would’ve happened if you’d tried to report it by ringing their main phone number to report it at 0814? I wasn’t able to see any guidance on the website, so I don’t know how I am supposed to let them know if I receive a leak. Or for a bit of fun send in an OIA request for their procedure on how they deal with leaks of OCR announcements. 20 days to decline access to something they don’t have?

    PS. Your comment “people might reasonably talk of contributory negligence” gave me an image of an adult using that phrase while tucking a couple of toddlers into bed, and the subsequent look on the children’s faces.

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s