The SSC report (undertaken by Peter Hughes’s deputy) on Gabs Makhlouf’s conduct in the “Budget leak” affair late last month was finally released this morning, along with a statement from the State Services Commissioner himself, and a press conference (for which we appear to have to rely on media reports).  It was a very mixed bag but (remarkably) manages to show Gabs Makhlouf’s conduct and judgement in an even worse –  materially worse –  light than most would have expected, even having followed the media stories at the time and since.  Had it not been his last day in office anyway, his position would surely have been utterly untenable.

As it is, Peter Hughes appears to find himself betwixt and between.  He is clearly keen to distance himself from Makhlouf.  (As one small example, I was bemused that he had his comms person contact me last night to correct a mistake in my post yesterday, expressed thus: “in the current political climate, Peter feels it important to make clear that he did not reappoint Makhlouf” (previous Commissioner Iain Rennie had): not exactly standing behind your employee.)   And many of the words in his official statement, and (particularly) those reported from the press conference sound good, and pretty hardhitting.  From the official statement

“I have concluded that Mr Makhlouf failed to take personal responsibility for the Treasury security failure and his subsequent handling of the situation fell well short of my expectations.  Mr Makhlouf is accountable for that and I’m calling it out.”

and

At a press conference on the report, Hughes said his expectation of what chief executives should do when things go wrong was “very clear” and the chief executives knew it.

“They need to own it, fix it and learn from it. And I expect people to stand up and be accountable, and I am disappointed that Mr Makhlouf did not do that on this occasion,” Hughes said.

“The right thing to do here was to take personal responsibility for the failure, irrespective of the actions of others and to do so publicly. He did not do that.”

There were no hugs for Makhlouf (see Iain Rennie/Roger Sutton).  And yet that was it.  Hughes is reported as saying that were Makhlouf not leaving anyway he’d have looked at some formal reprimand (easy to say now, all hypothetical), and yet to do so now would be “cynical and meaningless”.  I don’t see anything cynical about it at all, and the meaning would be to show citizens and voters that there is at least some degree of formal accountability for people at the top.    Hughes went on to say that in these ‘big jobs” reputation is everything, and Gabs’s will have taken a big hit.  That is no doubt true, and as report makes clear it was entirely self-inflicted.  But what employers and governments can do is to make formally clear –  endorse the reputational hit – that conduct of this sort is utterly unacceptable, and judgement this poor would not be tolerated in very senior public servants.

And it got worse

“We can’t run the public service on the basis that you’re only as good as your last mistake. We can’t do that – that’s The Apprentice, it’s not Fair Go New Zealand. I have to look at this in the round, I have to look at this in terms of his eight years of service, and that’s what I’ve done…

What message does that send?  That really severe misjudgement by one of the most senior public servants in the end doesn’t matter that much, cos’ he’s a good bloke?  It is fine to talk in terms of learning from mistakes –  and just possibly, if this were a new Secretary to the Treasury one week into the job it might be applicable here –  but this was someone who had held top office for eight years and yet, when the heat really came on, performed very badly.  And, worse, as the report makes clear still today does not accept that he did anything wrong.  No “learnings” in that case.

And, of course, this was the same Peter Hughes who just two weeks ago at the gala farewell for Makhlouf, hosted by the Minister of Finance at the Beehive said

“Thank you from the people of New Zealand. Our country is a better place for your work.”

He said Makhlouf had brought “strong leadership and a great deal of personal integrity” to Treasury.

He had been “authentic and straight up” and had been calm and unflappable.

“I will certainly miss your calm authority,” Hughes said.

As I noted in a post at the time

In no conceivable universe (except perhaps some parallel one inhabited by SSC) could Makhlouf during that Budget episode be said to have displayed “calm and unflappable” leadership.  Had he done so, there’d have been no inquiry.

And the inquiry report demonstrates just how far from calm and unflappable Makhlouf’s conduct appears to have been, and how little “strong leadership” and “personal integrity” has been on display.    That gush, when Hughes must already have known much of what would be in the report –  a lot of it was in the media, some involved meetings he himself had attended –  seems both borderline dishonest, and if not then casting some doubt on the judgement of the State Services Commissioner himself.

It is perhaps worth noting too that the Minister of Finance has been playing the whole thing down even more than the Commissioner.  His statement makes no reference at all to the adverse findings in the Deputy Commissioner’s report (even though in my reading of the report, the Minister emerges not too badly –  recognising that the report dealt only with his, and his staff’s, interaction with officials).

But what of the Deputy State Service Commissioner’s report itself.   There was a great deal of interesting material, which puts Makhlouf in a very poor light, even though the standard Mr Ombler was asked to use was a fairly weak one, interpreted in ways that made it weaker still.   The standards he was asked to use were whether Makhlouf acted in “good faith”, “reasonably”, and “maintaining political neutrality”.   I didn’t have too much difficulty with how he interpreted good faith and the political neutrality (and as I’ve said before I thought most likely Gabs acted in good faith, and was not knowingly partisan), but here “reasonable” is defined as an action/decision that was “one that was open to be reached and is within the limits of reason”.   Either in how his mandate was written or how he interpreted it, there is no sense of a standard being whether actions/decisions were of a standard that might be reasonably expected from the most senior public servant in the land, who had held that high office for eight years.

And yet even on that rather generous standard, Mr Ombler still found that Makhlouf failed to act reasonably in three important respects.

Mr Makhlouf did not act reasonably in relation to:

• his use of the phrase “deliberate and systematically hacked” in his media statement issued at 8:02pm on Tuesday 28 May
• his use of the bolt analogy in media interviews on the morning of Wednesday, 29 May
• in his media statement on the morning of Thursday, 30 May, continuing to focus on the conduct of those searching the Treasury website rather than the Treasury failure to keep Budget material confidential.

Very little of what Makhlouf did during this period, after the first few hours, seems to meet a standard a fair-minded observer should expect from such a senior public servant.

Among the puzzles is just who Makhlouf was taking counsel from, if anyone, during this period.  Paragraph 10 of the report list the people Ombler talked to in the course of his investigation, but although various Treasury officials are listed, only one of Makhlouf’s second tier is mentioned (a new acting Chief Operating Officer on secondment from elsewhere in the public sector).  But none of the rest of his second tier –  the people he’d been working with for years, and who had a better sense of The Treasury, the Budget –  is mentioned. It is most unlikely –  in Budget week –  they were all away.  Did he really not talk at all to Struan Little, the Deputy Secretary responsible for the Budget, who takes over as Acting Secretary tomorrow.   Did people like him not take Gabs aside and suggest he was losing perspective?  If not –  based on all else in the report – that reflects poorly too.  We know that when Makhlouf decided –  late on the Tuesday night –  to do a round of media interviews the next morning, he explicitly rejected his Communications Manager’s offer to help him prepare lines/answers  (he went on to do those interviews with no outside prep, and not that much sleep apparently either).

What also becomes clear is that, although Treasury staff initially thought there had been a leak, by pretty early on (1pm on the Tuesday) they were converging towards recognising that the material may well have been taken from searches of their own website (all that clone site indexing stuff), and by 3pm that day they had turned off the function that was creating the snippets (of the sort that had been released earlier that morning).     They told Makhlouf this by 5pm, before Police, GCSB or anyone else was much involved (although one gap in the report is there is no discussion of contact between Treasury staff and the Minister’s office during the afternoon  – it is just impossible to believe there was none).

What is more, the report records that Makhlouf told the Minister of Finance (7;15pm on the Tuesday) that it was ‘very likely” that the information released had been accessed through deliberate searches on the website (all that clone indexing stuff again was explicitly mentioned).  Sure, they don’t seem to known that with certainty, but a calm chief executive would surely have taken it as the most likely explanation and tailored his actions and comments accordingly (while not closing down other lines of inquiry).

The timeline in the report has a lot of detail on the back and forth among Treasury, GCSB, and Police over this period.   GCSB seem to have made clear that it wasn’t a matter for them, and  –  since Treasury already knew the likely nature of the way the information had got out  –  to the extent there was anything for Police, it was already clear that it probably wasn’t about what had gone on, but on the narrower question of whether that activity had been illegal.

But none of that stopped Makhlouf.    At 8.02pm he had gone out with his, now infamous, “deliberate and systematic hacking” statement, and (by implication) associating GCSB with his statements/actions.  He had sufficiently little understanding himself that he told the Minister he didn’t know why GCSB weren’t investigating, and yet went on to tell the Minister he thought he (Makhouf) had to make a statement.  He read out the draft statement to the Minister –  hadn’t even given him a draft in advance to reflect on –  and at the same time said he wasn’t going to do media interviews. The report notes that the Minister’s staff who were in the meeting gained the impression that what had gone on was a far more serious computer system intrusion than what (Treasury staff already knew was most likely) the case.  It looks a lot like a chief executive, stung by the breaches on his watch, probably rather emotional, not turning to wise counsellors, and not ensuring that he had himself fully understood what staff were telling him.   Any statement should have been toning down the issue, accepting (probable) responsibility, not amping it up and (a key point in the SSC report) attempting to shift responsibility.

It got worse.  Treasury hadn’t shown GCSB their draft statement (with the word “hack”) and when Andrew Hampton saw it he texted Makhlouf and said Treasury needed to correct the statement (Hampton’s comms adviser then lodged a complaint with Treasury at not being shown the draft statement –  as would be conventional when one government department refers to another in a statement).  Makhlouf and Hampton talked and Makhlouf simply rejected the advice (even though GCSB is a key adviser on cybersecurity threats etc).

Earlier in the evening, Makhlouf hadn’t intended to do media interviews.  That was about his last good call in the whole affair.  But late in the evening, the Minister’s press secretary rang to ask him to do so, and Makhlouf agreed.  He seems to have taken no advice, including on possible responses, and instead got up at 4:30 on the Wednesday morning to prepare himself, where he came up with the infamous and highly misleading bolt analogy.

According to the report, by about 1:40pm on the Wednesday Treasury not only had a high degree of confidence that the “leaks” had simply involved systematic searches, but they had been told Police weren’t taking the matter any further.   Makhlouf told the Minister this at about 5:30 on the Wednesday.  He said he would make a media statement (and a parallel one from SSC) but thought it could wait until Friday, after the Budget was out of the way.  It was just another in a series of extraordinary lapses of judgement.    Wisely, the Minister’s office got back to Makhlouf shortly thereafter to indicate the statement should go out before the Budget.  (Presumably it was about this time the National Party had indicated they would hold a briefing in the morning to reveal how they got the information.   The report is endlessly cute on this point –  despite the fact that Treasury had a near-certain view of how the information had been found, we are expected to believe that they had no strong sense, even quite late in the piece, that National staffers had done the searching).

A reasonable person might have supposed that, having amped the issue up in his press release on Tuesday night, raised the stakes further in the media interviews on Wednesday, and (as background noise) having had senior ministers alleging all sort of impropriety, that a statement would be rushed out just as soon as it could possibly be got together (perhaps even a press conference with Makhlouf and his head of IT).  But no.  And Ombler concludes that this was all quite reasonable because “it takes time to draft an appropriate media statment and to appropriately consult other agencies”.    Except that the decision to do a press statement had been done by 6pm, the draft was sent off to various agencies –  including SSC (who thus saw the draft of the statement they now rightly criticise Makhlouf for) –  at about 8pm, the Minister’s office had it by 8.53pm, and the whole thing was finalised and sent out to various officials under embargo just after 9:30,    There was no reason why it could not have gone public then, not released into the dead of dawn, at 5am the following day.

Except, of course, that the statement was not well done.   As the report concludes, Makhlouf ended up focusing more on the people who had found the information than on the failures of The Treasury itself, and played up an extraordinary interpretation of Budget confidentiality conventions that surely no one else would have regarded as reasonable –  and which Ombler decisively picks apart.  Such conventions bind ministers and public servants, not people who find information through weaknesses in your website.  According to the report, Makhlouf even now rejects this interpretation.

The report suggests that Treasury staff themselves seem to have got caught up in a similar defensive mindset. In a way that is understandable: the “leak” would have been deeply embarrassing, but it was Makhlouf’s job to lead the organisation above the embarrassment and to do the right thing.  He simply didn’t do that, and no one else –  in his department or elsewhere in the public sector (the very top tier of public servants) – was willing or able to stop him.  Where, for example, was his employer –  Peter Hughes – after the first statement, after the interviews, or when he got the draft of Thursday’s statement (and the timeline records he was in two meetings with Makhlouf on the Wednesday afternoon, but the report tells us nothing about what he said or did with those opportunities).

Bottom line seems to be that Makhlouf does not regard himself as having done anything wrong.  Even with the benefit of hindsight, the report contains no sense of Makhlouf looking back with regret or wishing some things had been done differently (and he had a draft of the report, so had the opportunity to inject such perspectives if Ombler had missed them).  Consistent with that there was no contrition or apology at the time, and not a word from Makhlouf since.  He deliberately avoided parliamentary scrutiny at FEC the other day, and there has been not a word from him today.   And at the close of business today he is off, no longer accountable to anyone in New Zealand at all.  It is a shockingly poor standard of conduct on display.  He could not have survived in office –  with these findings and no contrition –  had it not been his final day.  It must be a tough day for Treasury staff, many of whom will probably be going out of their way to stay clear of Makhlouf (even those who otherwise have good impressions of him).

We –  citizens –  deserve much better.  We deserve more answers from SSC themselves.  And, one would have to say, the people of Ireland –  and of Europe –  deserve much better: if this is how their new Governor (and ECB Governing Board member) reacts under pressure when something goes wrong on his watch, it is a real worry as economic and financial pressures and tensions build.    And it is a reminder of how utterly crucial it is for anyone near the top to have at least one person they trust who is willing to tell them to their face when the top person has stuffed up, lost perspective, got it wrong.  If Gabs had such a person, they were missing in action in Budget week.