Will I come to regret this post? Probably not, but only time will tell. It also may not be of wide general interest, but that is fine.
Regular readers will recall that I got caught up in the Reserve Bank’s OCR leak. More specifically, gaping breaches in the Bank’s systems (a near-total reliance on trust) and an actual leak of the March OCR decision would not have come to their attention, and been addressed, if I had not passed on to them information that arrived unwanted in my email in-box on the morning of the release, which suggested the possibility of a leak. Frankly, if anyone was the innocent party in the whole episode it was me. I wasn’t the leaker, I wasn’t the major media organisation that failed to disclose the leak by its employees for several weeks, I didn’t even receive what information I had from the person who was the leaker, and I wasn’t the central bank that ran security systems that made such a leak astonishingly easy.
And so I was more than a little miffed to have the Governor of the Reserve Bank describe me and my conduct as irresponsible in his press release announcing the results of the inquiry – an inquiry that would never have taken place if it had not been for my initiative in alerting the Bank to the issue. What particularly irked me was that in the same statement the Governor (a) took no responsibility for the laxness of the Bank’s own systems, and (b) seemed to go out of his way to stress how helpful the media organisation, MediaWorks, had been. It also puzzled me a little that there seemed to be no sanctions imposed by the Bank on the leakers – MediaWorks and its staff.
That prompted me to lodge a series of requests for information – from the Bank itself, and from its Board (which is paid to operate at arms-length from the Bank to scrutinise the performance of the Governor and hold him to account). The Bank has actually responded to one other OIA request in this area: the Taxpayers’ Union asked about the cost of the Deloitte inquiry, and was told a few weeks ago that the cost was $58952.28 (plus GST). My OIA requests have been treated in a more typical Bank way – not just extended for one month, but all the way out to 1 July, with talk of the possibility of charging.
However, I also sought from the Bank under the Privacy Act material relating to me that was held by the Bank and generated or obtained between the morning of the MPS release on 10 March and the day I lodged the request. They didn’t respond in 20 working days, but it wasn’t that much after the initial deadline when I was sent a fairly large collection of material yesterday. I had kept the request quite focused – I wasn’t after copies of media reports, or out to embarrass junior people who were not involved in the leak investigation and might have been exchanging speculative emails. All the material I obtained was comments from people directly involved, mostly people from the senior management group including the Governor.
I have tossed up about whether to release this material, and am doing so for two reasons.
The first is that I think it does shed useful light on how the Bank went about dealing with the information I provided to them, and the priors and presuppositions of key people involved. It is only a partial view of course, and I hope in time the Official Information Act requests will provide some more clarity. Unfortunately, the Bank has deliberately stalled the release of that information (which it can be onerous neither to collect/collate nor to review).
The second is more personal. Various people wisely suggested that I separate my irritation at having been personally attacked by the Governor from the wider issues of how the Bank has dealt with the issues of the leak, MediaWorks involvement, lock-ups etc. Some experienced former colleagues had even got in touch to suggest I must be misinterpreting things, and the Governor’s statement about irresponsibility couldn’t have been meant to include me. And so I decided to write a private letter to the Governor, outlining my perspective on my involvement in the whole issue and, in light of those points, inviting him to explain, or reconsider, his public assertion that my conduct had been irresponsible. If possible, dealing with such issues privately is generally likely to be more constructive.
It wasn’t long before I got a very terse response from the Governor confirming that he did indeed regard me as having behaved irresponsibly. I didn’t do anything with that, other than to pass the message on to those optimistic former colleagues.
But then I received yesterday’s collection of documents. Publishing them, together with my letter to the Governor and his reply, will enable people to form their own views. I’m sure many will see what they want to see, and some of those inclined to support Graeme Wheeler more generally may agree with the views he, and his senior colleagues, expressed. Anyone is entitled to his or her own view.
As for me, I have to live with my own conscience. There would be nothing shameful in concluding that, with the benefit of hindsight, one might have done some things differently. After all, the Governor himself – who had much more time – has changed tack twice since the inquiry was released (from no penalties for MediaWorks to indefinite exclusion from press conferences, and from immediately discontinuing lock-ups to investigating the possibility of reinstating them). I have asked myself some of the questions others have posed, but reading the material I received yesterday led me to conclude more strongly than previously that I had done the right thing – not necessarily the things the Bank would have preferred, but those which best balanced the public interest and the protection of my own interests.
Here is the link to the material the Reserve Bank released.
OCR leak inquiry Privacy Act response from RB
My earlier posts on the leak and related issues are all here
And here is what I took from the newly-released material.
The first point I noted is that, with the exception of a brief email from John McDermott on the morning of the MPS release, in which he wrote to me “Thank you for letting me know”, no one (management or Board) seems to have considered, at any point in the subsequent six weeks, expressing appreciation to me for coming forward and passing on the information that I had. One doesn’t try to do the right thing in the hope of being thanked for it, but it is a telling omission nonetheless.
The second point is that I was pleasantly surprised to learn that the Bank seemed to take the information seriously from the start. By 11:30am on 10 March, Deputy Governor Geoff Bascand had asked the senior manager responsible for risk and audit to undertake an inquiry, noting (page 2) “we cannot be sure it is a leak as opposed to speculation but need to enquire into it with diligence and urgency on the assumption it is”.
That was fine, and he even noted that “in the first instance, he [Michael] is the messenger”. But in the same email Bascand had already moved on to treating the information I had passed on as an “allegation”, and two of the three questions he expects answers to are about my conduct.
Somewhat surprisingly, in a world in which a “no surprises” policy is generally supposed to prevail between government agencies and the Minister’s office, it appears (page 4) that the Bank only decided to tell the Minister of Finance’s office about the possibility of a leak after I had made a brief mention of the information I received on my blog on the afternoon of the release (having advised the Bank some hours earlier that I was likely to mention it). That looks like poor political management, but also tends to confirm the unease I felt at the time, that the issue might be hushed up if at all possible.
Geoff Bascand’s biases become increasingly apparent in one of the unguarded emails that requests like this throw up. After they advised Bank staff of the situation late on 10 March, the head of HR emails Bascand with a brief expression of sympathy. Bascand’s response is nothing at all about the possible vulnerability in the Bank’s own systems (he being the senior manager responsible for the Communications functions), the possibility of an actual leak, or anything of the sort, but is all about the messenger.
By this time, and perhaps reflecting his biases, it is becoming clear that Bascand has trouble with the meaning of the word “allegation”. I have commented on this previously, but it is more stark in the light of the information in this release. In his message to all Bank staff (page 5) late on the afternoon of 10 March the heading is “Allegation of leak information”, and in a five line email the word “allegation” is used twice. Nowhere, by contrast, does he note something like “we have received information suggesting that information may have been leaked”. To repeat, allegations are claims are that are made, something that (at least according to my Oxford dictionary) involves “to assert without proof”.
To repeat, at no time between 10 March and 14 April (the release of the short-form inquiry report) did I make any “allegations”. All I did – and the emails are in this batch, on page 1 – was to pass on hard information that I had (an email) while stressing repeatedly that I had no idea whether it was the fruit of a leak, or something else. At the time, as I’ve said before, I struggled to believe a leak was possible.
It took a while for the leak inquiry to get going. I’ve covered previously the Bank’s approach to me to assist the inquiry – an approach which was extremely professional and which carefully referred only to the “possibility of a leak”. I talked to the Deloitte investigators a few days later. I gave them a copy of the text of the email I had received, and we had an amicable conversation in which, inter alia, they indicated that the Bank was very grateful to me for having come forward. At the time I took that at face value, and commented openly on my support for the process the Bank had put in place. It is worth noting – because it comes up later – that the Deloitte investigators did not ask me who sent the email to me, and indicated that they would not expect that I would tell them. I wrote a post following that meeting with the investigators, mentioning briefly the discussion we had had, but focusing mostly on structural changes that I thought were warranted (abandonment of lock-ups etc) regardless of whether or not there had been a leak on this occasion.
That post seemed to spark some media interest. The documents contain an email to Mike Hannah (RB Head of Communications) from Hamish Rutherford of Fairfax (someone else who appears to have had trouble with the meaning of the word “allegations”) and over the next couple of days there was a flurry of media coverage, here and abroad, and some clarificatory posts from me (partly annoyed at the continued public use of the term “allegations” by media and Bank representatives). That in turn sparked various emails among senior managers at the Bank.
Mike Hannah is the first (page 13). Interestingly, he claims that he would have picked up and responded quickly to any email I had sent before 9am on 10 March. If so, that is good to know now, although it wasn’t the impression I was under at the time. But he also notes that the Bank would not necessarily have done anything differently: “we’d have watched the markets very carefully , and might have had to consider going early if we saw action”. But as everyone recognises, there was nothing visible happening in markets.
Hannah also responds to my point that one reason I hadn’t contacted the Bank in the brief window before 9am was my unease about the Bank’s reaction if in fact it had not been cutting that morning. He considers it a “flimsy” story, but in fact the tone of the senior management comments – from him, Bascand and Wheeler – throughout these documents only confirms that was an entirely reasonable fear on my part. One thing that is striking in these documents is the apparent total inability of such senior people to imagine themselves in someone else’s position with someone else’s (lack of) information. They knew there was a cut coming. I didn’t.
The Governor responded to Hannah (at 1:48 am – perhaps he was travelling). From the tone of his email he seems to regard the whole exercise as a “quest for publicity” by me, adding that “my sense is that he is digging himself into a hole” – I’m still not sure, from context, how. He seems aggrieved (on which more later) that a former employee of the Bank would blog about the enquiry. It is really quite a weird reaction: one might hope that the Governor would have been most concerned about getting to the bottom of the substantive issue, and would expect considerable public scrutiny at even the possibility that an OCR decision had been leaked. Recall that by this point – objections to the misuse of “allegations” apart – I had been supportive – in public and in private – of the whole inquiry process the Bank had put in place.
The Governor forwarded that email to the chair of the Bank’s Board, Rod Carr. Instead of keeping an appropriate distance from management, Carr weighs in suggesting that perhaps I was now feeling guilty, that my actions were not a “sign of good citizenship”, and that somehow advising them a few minutes earlier – see Hannah’s comments above – might have protected “NZ’s reputation”. To his credit, Carr does flag the possible need to abolish lock-ups.
A few days later, Mike Hannah reports to the Governor on his approaches to the attendees at the media lock-up. Hannah remains reluctant to believe that any media person/body can be responsible – even though I had told him by inference (on the first day) and told the Deloitte team directly a week earlier that the email I received had come from a person in a media organisation. More generally, at this point, Hannah still seems reluctant to believe that there had been a leak at all – perhaps understandably given that he ran the lock-ups – noting of his conversations with journalists “it may all be humour, bluff, etc, but it may also reflect scepticism about Reddell’s credibility”. Given Hannah’s reluctance to accept the possibilities, the Bank’s in-house counsel (one of the few to emerge creditably from these documents) had to go back to Deloitte (page 16/17) to confirm that I had in fact said the email came from a person in a media organisation.
The Deloitte report indicated that, finally, on 5 April, MediaWorks owned up to the fact that there had been a leak, and that their staff had been responsible. Perhaps unsurprisingly, there is no email in the system from senior RB managers saying “gee, Michael’s information turned out to be about something real; just as well as he came forward”.
Instead, the documents skip forward to Sunday 10 April. By then, the Bank had the draft Deloitte report and was providing comments on it, and drafting press releases.
Geoff Bascand had sent out an email expressing surprise that no (MediaWorks) names were named in the Deloitte report – in particularly that the report did not name the person who had sent the email to me. Hannah responds identifying his suppositions about who it was, and he indicated that his draft press releases included the name of the person he suspected. He also noted that he had “not yet included Reddell’s name” – the operative word apparently being “yet”. Reflecting the Bank’s cast of mind, he noted that this was “not to save him” but simply because he still wanted more information. The next morning, Hannah emails senior colleagues indicating that the draft press release had been done by him and the Governor jointly. He urges that the Bank needs to get Deloitte to ask MediaWorks for the name of the person who emailed me (even if just to confirm that they would not provide the information).
In response, Nick McBride points out that he would not expect MediaWorks would provide anything more, and urged that the Bank should avoid focusing on individuals, stressing “it is MediaWorks that is responsible”. He goes on to note that “there is also a strong basis for speculating that a journalist emailing from the lock-up was normal behaviour, for Mediaworks at least”. Interesting, he notes that MediaWorks will be particularly reluctant “if it senses the Bank’s ‘no mercy’ approach and the lack of credit it is likely to get for its admission”. Given that there were no sanctions imposed on MediaWorks in the 14 April announcement, and the statement went out of its way to praise the cooperation of MediaWorks, something must have changed between then and 14 April.
That same day – Monday 11 April – also saw an odd email exchange between the Bank and Deloitte. The Bank asks for copies of all emails from MediaWorks, and in response is told that “the only other email correspondence that we had with MediaWorks was the email exchange about Mr Reddell’s phone number – now attached for your reference” [although for some reason not included in the material the Bank released]. My phone number isn’t exactly a secret – it is in the White Pages. But that same exchange also confirms that what the Bank released on 14 April is not, despite the impression given in the Bank’s statement, the full Deloitte report at all. Instead, it appears to be a “short form” “public version”. Someone should probably request the full report.
The Governor himself was engaged in providing comments on the draft report. His attitude is evident in the following exchange. A manager in the audit area of the Bank advises senior management that he has asked that Deloitte delete the word “all” from a description of how I had “cooperated with all our inquiries”, since I had declined to name my source (despite never being asked to, either by the Bank or Deloitte). Not content with that excision (which wouldn’t have bothered me) the Governor insists that they must delete “Mr Reddell cooperated with our enquiries”, noting “as he didn’t disclose everything that was necessary this therefore gives a misleading impression”. The fact that the inquiry would never have occurred at all without my original initiative clearly escaped him.
The remaining emails relate to the period after the release of the (public version) of the inquiry report on 14 April. There is the gratuitously nasty one from someone outside the Bank (page 25) but my interest is mostly in the stance of the Bank’s senior management and Board.
According to Mike Hannah, in an email to the Governor and Board chair, by now I am “obviously smarting from a well-aimed and deserved reprimand”, and am “irresponsible again” for suggesting that the lock-ups had had lax security. Reading that did prompt me to wonder which senior manager oversaw the procedures for and administration of the lock-ups which had just been revealed to have been breached.
And then the ante starts getting raised further. According to Geoff Bascand,
“nothing will satisfy Michael. He is a deeply aggrieved person. Everything will be interpreted through his victim filter”.
I’m not sure where Bascand gets any of this from. And a simple apology from the Governor for publically tarring me as “irresponsible” would satisfy me. Bascand continues to seem to think I somehow regret leaving the Reserve Bank, when I had been quite clear for several years prior to doing so that I was keen to get out, and do as my mother had done for me, and be around for my growing children. That had only become financially feasible by late 2014, and by then the (personally) optimal thing was to stick around long enough to collect a looming redundancy cheque, which is currently helping pay for house alterations. As I said to John McDermott at the time, my only concern had been that the Bank might change its mind.
The Governor also weighs in (page 27) and we get here the fullest explanation of his view of my irresponsibility
I firmly believe Michaels behaviour was irresponsible in failing to inform the Bank immediately, in not informing Deloitte as to who contacted him and blogging continuously on the matter even when the investigation was underway. I believe the reasons he trotted out for his actions to Deloittes were extremely weak to say the least.
I also find all this rich from someone who worked in the Bank for a long time and I believe should have used much better judgement- also Michael has repeated denigrated the work of colleagues that he worked alongside for many years and I believe also he has been reckless in his criticism . I believe many of the points he makes are misplaced and can readily be countered by a competent economist.
Some of this was familiar ground (see his brief letter below), but much was not. The suggestion that I – or presumably others – should not have written about the matter while his investigation was underway almost beggars belief. His internal inquiry about a possible failure of internal process is not exactly on a par with a matter that might be sub judice because it is being dealt with in a court of law. This is a (potential and actual) systems breach in high profile powerful public agency.
Unfortunately, the Governor seems to have allowed his judgement on the specifics of the (possible) leak issue to have become clouded by his irritation at the scrutiny and challenges that I have posed to the Bank, and him in particular, over the previous year or so. And the substance of his point seems wrong – I have tried to be very careful, when being critical, to focus responsibility on the Governor (as the law does) and his senior managers, and not on the many able staff who work in the organisation. I’m quite relaxed about the idea that the Governor will often disagree with my points of view – that is hardly surprising, and not really that different than it was when I was inside the organisation – and, yes, reasonable people (including some other “competent economists”) will differ on many of these issues. But none of that is, or should be, germane to the specific issue of the leak that (a) occurred on his watch, and (b) would not have come to light without my help.
Since I was interested in lowering the temperature on the personal aspects of this, I approached a friend of mine who is on the Board seeking some sense from him as to why the Governor’s stance towards me on this issue was reasonable. Perhaps he was in an awkward position, but I was largely fobbed off with a “circle the wagons in defence of the Governor” attitude. And so I wrote to the Governor, copied to the Board.
That letter is here.
Letter to Graeme Wheeler OCR leak press release
The Governor’s very brief response is here.
Graeme Wheeler Ltr to M Reddell April 2016
The final email in the set of documents that the Bank released is an email from the Governor to his senior colleagues and the Board chair, forwarding them a copy of the letter, with the terse observation “I find this letter quite extraordinary”.
Some readers will get to the end of all this and perhaps still think the issue at stake is that I should have got in touch with the Bank a little earlier than I did on 10 March. A few commenters on earlier posts have argued that.
Contrary to the sense that pervades many of these emails among Reserve Bank senior managers and Board members, I owed the Reserve Bank nothing. But I do feel some sense of residual loyalty to the organisation and so I did what I reasonably could, in a way that directly helped them uncover a serious leak (and subsequently amend their own procedures). If anyone reading these emails thinks that, in my shoes, they’d have rushed to tell the Bank earlier, at risk of being scoffed at and ridiculed had the Bank not in fact been cutting that morning, well all I can say is that they have a thicker skin than I do. Bascand and Wheeler would no doubt have been poised with some barbed turn of phrase about “there goes Michael again”, ready to tell others the story the next time I ran a post they disliked.
At one level, the attitudes in these emails don’t surprise me greatly – although perhaps I’m a little surprised that despite the OIA and the Privacy Act they wrote these things down. And I’m a little relieved that none of them are from my own two previous bosses. I don’t think they reflect well on the Bank, or its Board, but that is also something for others to judge.
croaking cassandra 