The Reserve Bank has this afternoon released the Deloitte report into the possible leak of the OCR on 10 March, and a press statement from the Governor.
I have given comments to various media outlets, but thought I should set down my assessment for the record.
It is extremely disappointing that it has now been confirmed that there was a leak. One MediaWorks employee in the media lock-up apparently emailed several of his colleagues outside the lock-up. My involvement in this unfortunate episode arose because a MediaWorks employee sent me the email that is reproduced in the Deloitte report.
It is unfortunate that the Deloitte report does not (and probably was not asked to) look into how it was that the Reserve Bank’s systems for managing lock-ups for incredibly sensitive information were as insecure as they proved to be. From the Deloitte report it seems that no underhand technology or secret signaling was involved; simply someone emailing from their laptop. I’m no technology expert, but I’m staggered that such an easy breach could have occurred. When systems are weak, sooner or later they will result in a breach, by accident or deliberately. It is also unfortunate that the Governor’s press release does not address this issue.
The Reserve Bank’s overall response to the confirmation of the leak is the right one. Ending media and analyst lock-ups is a step I recommended in a post several weeks ago, reflecting the vulnerability of such events (especially as technology has advanced), the fact that few or no other central banks provide any advance information in lock-ups, and the fact that such lock-ups have at times meant people inside the lock-ups have better information on the Bank’s interpretation of the documents than people who do not attend such events. The new model will bring the Reserve Bank into line with standard international practice. It is a model that would, I hope, have been adopted even if it had been confirmed that on this particular occasion no leak had occurred.
There are further steps that should still be adopted to minimize the risks of inadvertent early releases of the OCR. For example, the lengthy lag between taking the OCR decision and releasing it should be shortened. I was also surprised to learn from the Deloitte report that the Minister of Finance had been aware of the decision before 8:04am on the morning of the release. When the OCR system was established in 1999, the practice was to advise the Minister only 10 minutes or so before the announcement. If the Minister needs to know at all (and it isn’t clear why), 10 minutes notice should be an ample courtesy.
The Governor’s press release was disappointing on several counts.
First, it took no responsibility at all for the Bank having run systems and procedures that allowed this leak to have happened. Of course, the leaker should not have leaked, but the Reserve Bank should have managed its procedures in a much more robust way to ensure that the leak could simply not have happened (especially in the easy way it appears to have).
Second, I was struck by the grudging gracelessness of the statement. This inquiry, the associated discovery, and the subsequent change of procedures, would not have happened if I had not, at my own voluntary initiative, informed the Bank of the information I received. It is as simple as that. Unlike those in the lock-up and their employers, I am in no relationship of trust with the Bank, owe nothing in particular to them, and had actually valued the outlet that MediaWorks from time to time had provided for my commentaries and views. And yet the statement offers not a word of appreciation or thanks to me; instead it criticizes me for not telling them about the information earlier.
“The fact that several people outside the Bank, who had access to the information improperly, failed to alert the Bank immediately, was irresponsible and left open a significant risk that the Bank could have closed down quickly with an immediate official release.”
As I have been clear all along, I never knew (until today) whether there had been a leak, or whether someone was just engaging in some big talk. And the fact that there had been no market movement made me reluctant to believe there was a real leak – as did the fact that I had worked at senior levels at the Bank for many years, and been under the impression that security at the lock-ups was fairly water-tight.
Moreover, as readers know, the Bank’s attitude towards me over the last year has not exactly been positive and cooperative. Perhaps I could have gone to them at 8:20 and said “someone just told me you are cutting this morning”. In fact, the thought didn’t cross my mind initially. But when it did, my reaction was “what if they aren’t cutting. They will simply scoff, and say “there goes Michael again””. And so I kept the email to myself – still not sure whether it was real news or not – until I knew the Bank had cut, whereupon I passed the information on to the Assistant Governor and the Head of Communications.
I gather this “Michael was at fault” line is now part of their stock response (someone this afternoon told me that John McDermott had run that line to him previously).
MediaWorks people were at fault, and the Bank had weak systems that allowed a serious leak to occur. Had I been less professional and more opportunistic, I could have put the text of the email on my blog as soon as I found it. After all, I was in no relationship of trust with the Reserve Bank. Unsure whether it was for real or not, I reckon I still have enough credibility that doing so would have created a lot of damage. But I didn’t do that: I kept it to myself and instead I told the Bank about it as soon as I was sure I was not going to look stupid. I was simply caught in the middle of this – and have spent several weeks with people suggesting or implying that I had made it all up, was making allegations etc
The Governor is also misleading to suggest that even if I had alerted them earlier they could have avoided problems by immediately releasing the information themselves. That might have been their reaction – although they would surely have had to ask how seriously to take my information – but it wouldn’t saved chaos, and might only have made things worse. The hour before the OCR is released is a dead zone in New Zealand markets. Many people abroad focus on New Zealand again just a few minutes before the scheduled time of the release. To have released at 8:35. generating huge market movements, when they couldn’t even be sure that a leak had occurred (a week later they were still just talking of me making “allegations”) would have made life a lot harder for them, with plenty of aggrieved and vocal offshore people.
I guess I wouldn’t really have expected gratitude, but the graceless (and blame-shifting) tone of the Governor’s statement is really something that should have been beneath the dignity of someone so senior.




