Questions about the handling of the OCR leak issue aren’t going away. Last Saturday, I posted some thoughts on some issues that the Reserve Bank and MediaWorks should be asked about, flowing from a careful rereading of the relevant documents.
Since then there has been a variety of articles – especially focused on MediaWorks – in the mainstream media. Jenny Ruth had a piece on the NBR website “Were there other MediaWorks leaks from Reserve Bank lockups”. Hamish Rutherford has a substantial and useful piece in the Dominion-Post this morning “MediaWorks Owes an Explanation” (although I have considerably more readers than he reports) and John Drinnan’s media column in the Herald today is largely devoted to media aspects of the leak and its aftermath.
It is perhaps understandable that the mainstream media has focused mainly on the media dimensions – many of them are grumpy at losing the opportunities previously afforded by the lockups (although others quietly acknowledge that the lockups were really products of a different technological age and probably had to go). I don’t have much sympathy on that count, having called a month ago for the lockups to be scrapped. But I do share the surprise that there has been no evident specific sanctions meted out to MediaWorks, the chief culprits in the whole affair. Various people have suggested that MediaWorks should have been banned from lock-ups, rather than ending the practice altogether. Ending lock-ups was the right thing to do, but it is still surprising that there appear to be no other concrete consequences for MediaWorks’ flagrant breach of the rules (not reported to the Bank for weeks). Then again, what other sanctions were available? One might have been to deprive MediaWorks of, say, opportunities for any interviews with the Governor. But since he doesn’t give interviews, I guess that option wasn’t available.
There are questions for MediaWorks, but in the end they are a private company and have to make their own judgements about what to tell us. It is disappointing that they have not been more open. I’m not so much bothered about them not naming the person who sent the email from the lock-up, but about things like:
- had these sorts of leaks happened before by MediaWorks staff?
- why did it take more than three weeks for MediaWorks to acknowledge that its employees were responsible (including more than two weeks after the issue had extensive media coverage).
But, as I say, MediaWorks is a private organization. The Reserve Bank, by contrast, is a powerful public body. We should expect an open and transparent approach by public institutions when bad stuff happens, and the Bank is subject not just to the Official Information Act, but also to parliamentary scrutiny. I think there is a range of questions to which the public deserves answers from the Bank:
- Did the Bank, or Deloitte, ask MediaWorks whether these sorts of breaches had occurred before. If not, why not. If so, what was the response?
- Why does the inquiry report not address issues around “the process for transmitting the Governor’s OCR decision to see if any improvements are needed”, even though the Bank had told me the Deloitte inquiry would cover such matters?
- Was MediaWorks given a chance to comment on the draft inquiry report, or the draft of the Reserve Bank news release of 14 April?
- Why does the Reserve Bank press release go out of its way to stress the cooperation of MediaWorks, when MediaWorks did not report the breach until more than three weeks after it occurred?
- Why does the news release not accept any responsibility for the Bank having run lock-ups with such lax security procedures that a breach of this sort could happen so easily?
- Have any Reserve Bank officials been disciplined or reprimanded for failing to update security procedures to reflect the advances of technology?
In support of seeking answers to these, and other, questions, I have lodged an Official Information Act request with the Reserve Bank. It requests the following information:
Terms of reference
- Copies of the terms of reference for the Deloitte inquiry, including the TOR as at 15 March 2015 (the date of Nick McBride’s approach to me), and any subsequent variants, (formal or informal).
- Copies of any advice to or from the Board regarding the terms of reference
MediaWorks’ 5 April advice
- Copies of the initial MediaWorks advice to the Reserve Bank and Deloitte on 5 April (date as per the inquiry report). In the event that the advice was oral, please provide copies of any filenotes or other records of conversations with MediaWorks.
- Copies of any follow-up requests for further information made to MediaWorks or its representatives by the Reserve Bank or the Deloitte inquiry team.
The Deloitte inquiry report
- Names of any person or organisation, beyond the Reserve Bank’s staff or Deloitte, invited to comment on the draft report.
- Copies of any advice provided to the Reserve Bank by non-executive members of the Reserve Bank Board on the draft report.
The Reserve Bank’s 14 April news release
- Copies of all drafts of the 14 April news release
- Names of any persons or organisation beyond the Reserve Bank’s staff or Deloitte, invited to comment on the draft news release.
- The time at which MediaWorks was given a copy of (a) the draft, and (b) the final news release.
- Copies of any comments made to the Bank by (a) MediaWorks and/or (b) non-executive Board members on the draft news release.
Internal Reserve Bank committees
- Copies of the relevant sections of the minutes of any meetings of (a) the Governing Committee, and (b) the Senior Management Group at which the (possible/actual) OCR leak, and/or the Reserve Bank’s response to it, were discussed.
I remain more than a little aggrieved, having brought the issue to light in the first place, at having my conduct described by the Governor as “irresponsible”, but I have addressed those issues in a separate letter to Governor.