Questions about the handling of the OCR leak issue aren’t going away. Last Saturday, I posted some thoughts on some issues that the Reserve Bank and MediaWorks should be asked about, flowing from a careful rereading of the relevant documents.
Since then there has been a variety of articles – especially focused on MediaWorks – in the mainstream media. Jenny Ruth had a piece on the NBR website “Were there other MediaWorks leaks from Reserve Bank lockups”. Hamish Rutherford has a substantial and useful piece in the Dominion-Post this morning “MediaWorks Owes an Explanation” (although I have considerably more readers than he reports) and John Drinnan’s media column in the Herald today is largely devoted to media aspects of the leak and its aftermath.
It is perhaps understandable that the mainstream media has focused mainly on the media dimensions – many of them are grumpy at losing the opportunities previously afforded by the lockups (although others quietly acknowledge that the lockups were really products of a different technological age and probably had to go). I don’t have much sympathy on that count, having called a month ago for the lockups to be scrapped. But I do share the surprise that there has been no evident specific sanctions meted out to MediaWorks, the chief culprits in the whole affair. Various people have suggested that MediaWorks should have been banned from lock-ups, rather than ending the practice altogether. Ending lock-ups was the right thing to do, but it is still surprising that there appear to be no other concrete consequences for MediaWorks’ flagrant breach of the rules (not reported to the Bank for weeks). Then again, what other sanctions were available? One might have been to deprive MediaWorks of, say, opportunities for any interviews with the Governor. But since he doesn’t give interviews, I guess that option wasn’t available.
There are questions for MediaWorks, but in the end they are a private company and have to make their own judgements about what to tell us. It is disappointing that they have not been more open. I’m not so much bothered about them not naming the person who sent the email from the lock-up, but about things like:
- had these sorts of leaks happened before by MediaWorks staff?
- why did it take more than three weeks for MediaWorks to acknowledge that its employees were responsible (including more than two weeks after the issue had extensive media coverage).
But, as I say, MediaWorks is a private organization. The Reserve Bank, by contrast, is a powerful public body. We should expect an open and transparent approach by public institutions when bad stuff happens, and the Bank is subject not just to the Official Information Act, but also to parliamentary scrutiny. I think there is a range of questions to which the public deserves answers from the Bank:
- Did the Bank, or Deloitte, ask MediaWorks whether these sorts of breaches had occurred before. If not, why not. If so, what was the response?
- Why does the inquiry report not address issues around “the process for transmitting the Governor’s OCR decision to see if any improvements are needed”, even though the Bank had told me the Deloitte inquiry would cover such matters?
- Was MediaWorks given a chance to comment on the draft inquiry report, or the draft of the Reserve Bank news release of 14 April?
- Why does the Reserve Bank press release go out of its way to stress the cooperation of MediaWorks, when MediaWorks did not report the breach until more than three weeks after it occurred?
- Why does the news release not accept any responsibility for the Bank having run lock-ups with such lax security procedures that a breach of this sort could happen so easily?
- Have any Reserve Bank officials been disciplined or reprimanded for failing to update security procedures to reflect the advances of technology?
In support of seeking answers to these, and other, questions, I have lodged an Official Information Act request with the Reserve Bank. It requests the following information:
Terms of reference
- Copies of the terms of reference for the Deloitte inquiry, including the TOR as at 15 March 2015 (the date of Nick McBride’s approach to me), and any subsequent variants, (formal or informal).
- Copies of any advice to or from the Board regarding the terms of reference
MediaWorks’ 5 April advice
- Copies of the initial MediaWorks advice to the Reserve Bank and Deloitte on 5 April (date as per the inquiry report). In the event that the advice was oral, please provide copies of any filenotes or other records of conversations with MediaWorks.
- Copies of any follow-up requests for further information made to MediaWorks or its representatives by the Reserve Bank or the Deloitte inquiry team.
The Deloitte inquiry report
- Names of any person or organisation, beyond the Reserve Bank’s staff or Deloitte, invited to comment on the draft report.
- Copies of any advice provided to the Reserve Bank by non-executive members of the Reserve Bank Board on the draft report.
The Reserve Bank’s 14 April news release
- Copies of all drafts of the 14 April news release
- Names of any persons or organisation beyond the Reserve Bank’s staff or Deloitte, invited to comment on the draft news release.
- The time at which MediaWorks was given a copy of (a) the draft, and (b) the final news release.
- Copies of any comments made to the Bank by (a) MediaWorks and/or (b) non-executive Board members on the draft news release.
Internal Reserve Bank committees
- Copies of the relevant sections of the minutes of any meetings of (a) the Governing Committee, and (b) the Senior Management Group at which the (possible/actual) OCR leak, and/or the Reserve Bank’s response to it, were discussed.
I remain more than a little aggrieved, having brought the issue to light in the first place, at having my conduct described by the Governor as “irresponsible”, but I have addressed those issues in a separate letter to Governor.
croaking cassandra 
I think it’s worth paying some attention to this rather chilling line in John Drinnan’s piece.
“I understand one relatively junior staff member has since left the company.”
So someone who might reasonably have expected senior colleagues to watch out for her or him, and help to ensure that they don’t make mistakes, has paid for this with their livelihood.
LikeLike
I saw that too. A junior person making a rookie error? Either i) you make darn sure beforehand that they know the rules or ii) if they sent the email out early you deal with it. That’s even assuming it was that person of course. In either scenario, the supervising person needs to share some of the blame. Now, maybe protecting the name of the person so that they won’t be forever assigned to an instigator of a most unfortunate leak is the rationale behind the vagueness. I’d like to think it’s for good-hearted reasons. But maybe it was enough for the RBNZ to have seen that there was at least one sacrificial pawn here. Pawn being the operative word.
LikeLike
Yes, I was rather struck by that line as well.
LikeLiked by 2 people
No good deed goes unpunished these days
LikeLike
I cannot remember reading a Deloitte report re past investigations…. Do the State Services Commission have no Authority over the RBNZ?
LikeLike
No, generally not. This Deloitte report was directly commissioned by the RB
http://www.rbnz.govt.nz/-/media/ReserveBank/Files/News/2016/Investigation-into-leak-march-2016-OCR-announcement.pdf?la=en
LikeLike
Why don’t you ask by OIA what the scope was… 8)
LikeLike
Requests to Government Departments or State agencies for information are supposed to be answered within 20 working days.
If the RBNZ responds to OIA …. what was the State Services Commission not the agency asked to investigate the leak? I still dont understand why the RBNZ is not under the SSC but responds to OIA?
LikeLike
Why have a lock-up at all
In this technological age the RBNZ could and should have its own free-to-air TV broadcast studio from where it can broadcast to the nation all announcements – so every-one is treated equally
or
It could be a common-use studio available exclusively to RBNZ, Treasury and Statistics
LikeLike
Webcasts work as well surely?
LikeLike
YES of course
LikeLike
How would you deal with this
Bandwidth – a market-maker’s privilege.
Prime-brokers are moving their data-centres as close to the exchange as possible as speed is critical. Nano-seconds are vital. Network connections from the exchange are arteries with veins feeding off to data-vendors, brokers, traders etc. The main pipe (artery) or backbone is 100mb speed/bandwidth while distribution veins are 50mb speed/bandwith. Data is transmitted as packets down the main pipe. With natural latency, a 1mb connection at the front of the network has first access to data, while the furthest 500kb connection has last dig at the data. When dealing in nano-seconds, if the market-maker is at the front of the queue with a high speed connection, detects a sudden move in the underlying instrument, they, the market-maker is able to react and move their order away, or withdraw, before the last in the queue even knows about it. With any reticulation system, the further from the source, the service diminishes
LikeLike
Fortunate for the RBNZ that NZ is open for business and spewing out secrets when the key market makers are still asleep for another couple of hours so leaks tend not to have any immediacy in reaction time.
LikeLike
If you leak anything on Monday in NZ most markets are still closed because it is still Sunday for many countries.
LikeLike
You well and truly seem to have turned on mediaworks in these latest posts.
Let us not forget that you were prepared to protect mediaworks when the leak first emerged by not passing on the source of the leak to the bank or deloittes despite having every reason to suspect foul play on their part. You even went on a mediaworks radio interview shortly after the OCR release came out.
In these circumstances irresponsible is a lighter adjective than I would use. Bereft of integrity would be a better phrase. You emerge from this affair more than a little smelly and with your halo more than slightly askew.
LikeLike
As I say, until 14 April I was no better positioned than anyone to know whether a leak had occurred, let alone the circumstances. As time went it, it seemed more likely that there had been a leak of some sort. But I was surprised by the results of the Deloitte report, and by the evidence that MediaWorks had been sitting on the knowledge of its own leaking for several weeks.
Had I known there was a leak (eg the exch rate had moved) I would (I expect – who can say certainly with this much hindsight) have told the Bank where the email came from.
But, in any case, Wheeler’s attack on me was not for not naming the source (which Deloitte told me they full respected), but for not telling the RB in the first 45 minutes after seeing the first email with its hearsay report.
LikeLike
Sorry I think you are talking rubbish. You received an email from someone at mediaworks telling you the OCR was about to be cut. So logically mediaworks was either a third party to a (possible) leak or might have originated it. You should therefore have IMMEDIATELY identified the person from mediaworks who had sent you the email and told the authorities. That would have assisted the authorities to investigate it in a timely manner. At the very least you could have encouraged the person at mediaworks to contact the bank and explain how they had acquired the information but there is no evidence that you did so. In any case, given mediaworks reputation, you would have to have been extraordinarily naive not to have strongly suspected foul play on their part.
You are guilty of sins of omission.
LikeLike
Call me naïve if you like, but I was not (actually largely am not) aware of MediaWorks’ “reputation”. As I noted in a post last Saturday, I had had only good experiences with MediaWorks and interviews on Radio Live, which had provided a good opportunity for me to give greater exposure to my ideas on a number of issues.
Relevant or not, it is probably worth adding that no one ever asked me to name the person who sent the email – not the Reserve Bank when I first told them about the episode, or later, or the Deloitte inquiry team. In fact, in the six weeks since the event happened you are the first person (publicly or privately) to suggest I should have. So you raise an interesting question that I haven’t given any recent thought to.
But you also write as if what happened here was some sort of criminal act (“told the authorities”). It was nothing of that sort. It was simply one entity which had had another entity pass on information when it had agreed not to do so – no different in principle than if, say, Fonterra or (say) one of the banks had run a lock-up to announce some sensitive news and someone had breached that. As it happened, the Reserve Bank was an entity with which I had some sympathy (thru long service etc) despite the obstructive approach they had taken to me over the last year. And MediaWorks had offered me opportunities, which I appreciated.
So my on-balance judgement was that the right thing to do was to alert the Reserve Bank to the email, and the possible vulnerability in its systems. I went as far as to tell them (a) the email hadn’t come from a staff member, or (b) anyone else in govt who might have known or surmised the OCR decision, and (c) that they should probably focus their attention on the media lock-up. I didn’t name the organisation/person, partly because I couldn’t quite believe it could be a real leak – 20 years as an insider, told that arrangements were secure does that to people – and if there wasn’t I didn’t want to make things unnecessarily awkward for the person who had emailed ((if that person had been simply big-noting and exaggerating their knowledge it would be very embarrassing to them). As it was, when i got the email it was a bit like one of those social faux pas that people sometimes make, where everyone just wants to look the other way and pretend the words were never said.
And although I was quoted in several media over the ensuing 24 hours on OCR issues, I assumed it would be pretty easy for the Bank to identify MediaWorks as one suspect – the RB pay for media monitoring etc, and it would have taken no effort to know that I had done quite a bit of commentary for them. Moreover, I deliberately wrote about the email on my blog a few hours later, knowing that the person who sent the email was a regular reader. If there was a real leak, I surmised, the fact that the sender knew that the RB knew of the email would prompt action on their part (and that of their organization) In fact, when MediaWorks asked for another on-air interview a couple of weeks later (much to my surprise), I assumed that if there was a real leak, it surely couldn’t have come from them.
Bear in mind too that, with the knowledge we now have, if the RB had asked all lock-ups participants to sign statutory declaration that they had not transmitted any info out of the lock-up, the culprit would have come to light very very quickly. Oddly, the inquiry report says they only focused on the media after my interview with the inquiry team (on the 18th), suggesting that the Bank had not passed on what I had already told the Bank on the 10th. Consistent with that, the Bank’s public comments (“allegations”) suggested that they never really believed there had been a real leak, but felt obliged to cover themselves by commissioning an investigation.
In a way, the details of this episode were complicated by the tense (lack of) relationship between me and the RB. Had I been sure that my approach would be greeted positively, whether or not they were cutting that morning, I might have tried to pass on the information about the email a few minutes earlier than I did. If the RB had taken the issue more seriously, they would have (a) announced publicly that morning that serious information had been received regarding a possible leak, (b) announced an inquiry, (c) sought statutory declarations from all participants, and (d) perhaps have had the Gov and Dep Govs ring the heads of each agency represented in the lock-ups to stress that the Bank expected full and immediate cooperation.
LikeLike
James Atkinson seems to be suggesting some novel principles for the media, which these days includes bloggers – that the media should never use leaked information (not that the blogger in question appears to have on this occasion); and when leaked information is received, the name of the source must immediately be reported to ‘the authorities’. Not sure those are principles that the New Zealand media will be in a rush to champion.
LikeLike
I am hoping that MediaWorks will be more open about about the acknowledged failure of its editorial systems that allowed this breach.
LikeLike
It makes one wonder if you are “really” expecting people to buy your untenable story. You can write 10 pages on it if you like but it is not convincing. You knew damn well that it was a leak but preferred to sit on the information for almost an hour. Irresponsible is indeed a lighter adjective.
LikeLike
If you aren’t convinced that is fine. But I didn’t know it was a leak then (not until 9am that morning did I even believe the RB was cutting), or until 14 April (altho as time went on it seemed more likely). The Reserve Bank’s reaction doesn’t seem to have been much different. They kept quiet about the matter for some time, and then when they finally talked openly – apparently only in response to pieces I had published, which finally sparked wider media interest – spoke only about “allegations”.
LikeLike
I do a media story – and I am planning to follow up on.
I gather you are not overly interested in the MediaWorks situation.
Ny own understanding is that thie yout woman passed this on to two senior editorial members, and that she was required to do so. A third person overheard and passed it on to you.
I’ve read your column and the main question in my mind is whether this has happened before – maybe with one of the analysts, rather than someone in the media..
It may be that Twitter DM is a better place to discuss.
>
LikeLike
[…] instructions to send draft stories from the lock-up (see John Drinnan’s comment at the end of this post). If a story was deliberately sent from the OCR lock-ups, might the same practice have […]
LikeLike