Questions about the handling of the OCR leak issue aren’t going away.  Last Saturday, I posted some thoughts on some issues that the Reserve Bank and MediaWorks should be asked about, flowing from a careful rereading of the relevant documents.

Since then there has been a variety of articles –  especially focused on MediaWorks – in the mainstream media.   Jenny Ruth had a piece on the NBR website “Were there other MediaWorks leaks from Reserve Bank lockups”.  Hamish Rutherford has a substantial and useful piece in the Dominion-Post this morning “MediaWorks Owes an Explanation” (although I have considerably more readers than he reports) and John Drinnan’s media column in the Herald today is largely devoted to media aspects of the leak and its aftermath.

It is perhaps understandable that the mainstream media has focused mainly on the media dimensions –  many of them are grumpy at losing the opportunities previously afforded by the lockups (although others quietly acknowledge that the lockups were really products of a different technological age and probably had to go).  I don’t have much sympathy on that count, having called a month ago for the lockups to be scrapped.  But I do share the surprise that there has been no evident specific  sanctions meted out to MediaWorks, the chief culprits in the whole affair.  Various people have suggested that MediaWorks should have been banned from lock-ups, rather than ending the practice altogether.  Ending lock-ups was the right thing to do, but it is still surprising that there appear to be no other concrete consequences for MediaWorks’ flagrant breach of the rules (not reported to the Bank for weeks).   Then again, what other sanctions were available?  One might have been to deprive MediaWorks of, say, opportunities for any interviews with the Governor. But since he doesn’t give interviews, I guess that option wasn’t available.

There are questions for MediaWorks, but in the end they are a private company and have to make their own judgements about what to tell us.  It is disappointing that they have not been more open.  I’m not so much bothered about them not naming the person who sent the email from the lock-up, but about things like:

• had these sorts of leaks happened before by MediaWorks staff?
• why did it take more than three weeks for MediaWorks to acknowledge that its employees were responsible (including more than two weeks after the issue had extensive media coverage).

But, as I say, MediaWorks is a private organization.  The Reserve Bank, by contrast, is a powerful public body.  We should expect an open and transparent approach by public institutions when bad stuff happens, and the Bank is subject not just to the Official Information Act, but also to parliamentary scrutiny.  I think there is a range of questions to which the public deserves answers from the Bank:

• Did the Bank, or Deloitte, ask MediaWorks whether these sorts of breaches had occurred before.  If not, why not.  If so, what was the response?
• Why does the inquiry report not address issues around “the process for transmitting the Governor’s OCR decision to see if any improvements are needed”, even though the Bank had told me the Deloitte inquiry would cover such matters?
• Was MediaWorks given a chance to comment on the draft inquiry report, or the draft of the Reserve Bank news release of 14 April?
• Why does the Reserve Bank press release go out of its way to stress the cooperation of MediaWorks, when MediaWorks did not report the breach until more than three weeks after it occurred?
• Why does the news release not accept any responsibility for the Bank having run lock-ups with such lax security procedures that a breach of this sort could happen so easily?
• Have any Reserve Bank officials been disciplined or reprimanded for failing to update security procedures to reflect the advances of technology?

In support of seeking answers to these, and other, questions, I have lodged an Official Information Act request with the Reserve Bank.  It requests the following information:

Terms of reference

• Copies of the terms of reference for the Deloitte inquiry, including the TOR as at 15 March 2015 (the date of Nick McBride’s approach to me), and any subsequent variants, (formal or informal).
• Copies of any advice to or from the Board regarding the terms of reference

MediaWorks’ 5 April advice

• Copies of the initial MediaWorks advice to the Reserve Bank and Deloitte on 5 April (date as per the inquiry report).  In the event that the advice was oral, please provide copies of any filenotes or other records of conversations with MediaWorks.
• Copies of any follow-up requests for further information made to MediaWorks or its representatives by the Reserve Bank or the Deloitte inquiry team.

The Deloitte inquiry report

• Names of any person or organisation, beyond the Reserve Bank’s staff or Deloitte, invited to comment on the draft report.
• Copies of any advice provided to the Reserve Bank by non-executive members of the Reserve Bank Board on the draft report.

The Reserve Bank’s 14 April news release

• Copies of all drafts of the 14 April news release
• Names of any persons or organisation beyond the Reserve Bank’s staff or Deloitte, invited to comment on the draft news release.
• The time at which MediaWorks was given a copy of (a) the draft, and (b) the final news release.
• Copies of any comments made to the Bank by (a) MediaWorks and/or (b) non-executive Board members on the draft news release.

Internal Reserve Bank committees

• Copies of the relevant sections of the minutes of any meetings of (a) the Governing Committee, and (b) the Senior Management Group at which the (possible/actual) OCR leak, and/or the Reserve Bank’s response to it, were discussed.

I remain more than a little aggrieved, having brought the issue to light in the first place, at having my conduct described by the Governor as “irresponsible”, but I have addressed those issues in a separate letter to Governor.
 

I was re-reading the documents released on the OCR leak.  There are three of them: the Deloitte report, the Reserve Bank’s press release, and the MediaWorks press release.  The latter document doesn’t seem to be on the web (and certainly not with the company’s 2016 press releases), but someone did send me a copy.  This is the text

Mark Weldon, Group CEO, MediaWorks said:

“MediaWorks unreservedly apologises to the Reserve Bank for this incident. Once MediaWorks was aware a leak had taken place, it conducted its own investigation to determine whether the leak had come from within MediaWorks and self-reported that to the Reserve Bank.”

Regarding the specifics of the matter, Richard Sutherland, Acting Chief News Officer, said:

“The leak was caused by a failure within News to follow proper process and changes have already been made as a result. We are addressing the breach with those concerned and new policies and training will be implemented moving forward.”

I also compared the Deloitte report with what the Bank’s legal counsel, Nick McBride, told me about the scope of the enquiry – which they had already commissioned by then – when they asked for my assistance.  I included the whole email in yesterday’s post, but this was the bit I had in mind today

The Bank has appointed investigators from Deloitte to try and find out whether there was a breach in security and, if so, how it occurred. They will also review the process for transmitting the Governor’s OCR decision to see if any improvements are needed.

A number of things struck me:

• We have not seen the terms of reference for the Deloitte inquiry.  They are referred to in passing in the report, but are not attached.  That seems strange.
• The substance of the report is less than three pages of text.  A full page of that is devoted to me.  I don’t have too many problems with it, but I understood it was normal public sector practice when inquiries are done to give those affected by the inquiry an opportunity to see, and comment on, the report in draft before it was published.  That didn’t happen for me (but there must have been coordination with MediaWorks –  did they see the report before it was released?).  Had the draft report been shown to me, I would have requested some wording changes.
• Despite the comment in McBride’s email that the investigation would “review the process for transmitting the Governor’s OCR decision to see if any improvements are needed”, there is nothing at all on that topic in the published report.  I had offered some comments, in passing, on that matter when I met with the investigation team.  Were the terms of reference changed at a later date?  If so, why?
• The MediaWorks statement says that “once MediaWorks was aware a leak had taken place, it conducted its own investigation to determine whether the leak had come from within MediaWorks and self-reported that to the Reserve Bank”.  But that seems inconsistent with the Deloitte report, which says that the source was identified only after “communication that we initiated with the journalists”.  The inquiry report says it only focused on the media after my meeting with the inquiry on 18 March, and I wrote about the leak possibility for the second time that day (and I know various MediaWorks employees read my blog), and the mainstream media gave a lot of coverage to the story on 21 March.  So news of the possible leak was widespread by then at the latest.  And yet MediaWorks only self-reported the information about the leaker “to RBNZ and to us [Deloittes] on 5 April 2016”, more than two weeks later.  It doesn’t take two weeks for an organization to track something like this down internally – MediaWorks knew which of its employees had been in the lockup.   It seems more probable that MediaWorks acted only after the inquiry team requested a meeting with the staff who had been in the lockup.
• It is striking that the Deloitte report makes no attempt to assess whether what the MediaWorks person in the lock-up did on 10 March (file a draft story back to their office well before the embargo lifted) had been done before.  And the MediaWorks statement also does not address that issue.  There are various stories on the media grapevine that it was, in fact, established practice.  And while I have no way of knowing whether that is so, it is not inconsistent with the fact that the person who sent me the information presumably didn’t see anything extraordinary about doing so.   There is no suggestion in the report or statement(s) that the transmission from the lock-up was somehow accidental (inadvertently hit the wrong button, or somesuch), and if it wasn’t accidental perhaps it was customary.    It is unfortunate that the Reserve Bank’s inquiry does not appear to have attempted to assess whether that was the case, or even just note the possibility.
• The Reserve Bank’s own statement seems very supportive of the MediaWorks hierarchy, even though (a) people in that organization knew what had happened from the start, (b) must have known it was against the rules, even before I started to draw attention to the issue, and (c) the timing suggests that the management action (and formal internal investigation) was all rather belated, occurring when their people realise they would be interviewed by the inquiry and would have to provide an accurate factual account of what happened.

There seem to be quite a few more questions that should be asked of both the Reserve Bank and the MediaWorks management.

In passing, I would note that I have read and heard many dismissive comments in the last few days from other media people about MediaWorks, and their coverage of economics and monetary policy issues.  I don’t watch their TV channel, and am not a commercial radio listener.  Nonetheless, I had actually been quite impressed that Radio Live had been keen to run interviews with some one like me on such diverse topics as the OCR, US monetary policy, Kiwibank, the real exchange rate and economic performance, immigration policy and so on.  As I say, I don’t listen to commercial radio (my wife kept saying “but no one I know listens to Radio Live”), so I’m not sure how representative those sorts of interviews are. But my experience had been a wholly positive one –  intelligent interviewers, aiming at popular market no doubt, asking sensible well-researched questions, and not obviously pursuing “gotcha” moments (but then why would they with a middle-aged rather serious economist, talking mostly about rather geeky issues?).

Someone has, however, drawn to my attention an NBR story in which Rob Hosking reports  that

“Mr Reddell did not at the time ask how they knew of the decision an hour before it was announced-  an omission which has apparently caused some resentment within Mediaworks who feel he should have warned them about this”.

Yeah right.  The MediaWorks people knew very well that the information was not supposed to be outside the lock-up.  What was I supposed to do –  assuming I had believed it was the fruit of a real leak which, as I noted yesterday, I had no particular basis for doing (25 years of MPSs having gone by without one) ? I genuinely didn’t know what to make of it.   I suppose I could have said “you do know you aren’t supposed to have that information, assuming it is true, don’t you?”  But the sender, and the people that person apparently overheard, already knew that. The 9am release time is no secret.  It was no worse sending it on to me than it was for them to have had the information, in breach of their express commitments to the Reserve Bank, in the first place.  I had no ongoing or formal relationship with MediaWorks (I generally talk to any media –  or anyone else –  who asks), and I reported the matter to the Reserve Bank because if there had in fact been a leak, it was their information and systems that had been compromised.  The guilty people were hardly likely to own-up unprompted.

I’m heartily sick of the Reserve Bank leak story and hope that this is the last occasion I write about it.  But there were a few further points I wanted to make, partly in response to the coverage in the last 24 hours.

I would also add that despite several commenters on various stories having correctly noted that the longstanding system vulnerabilities mean that there may have been previous leaks over the years from people in the Reserve Bank’s media or analyst lock-ups, I’m not sure it would a wise use of time or resources now (or perhaps even possible) to attempt to prove it one way or the other.  But that is a matter for the Reserve Bank.

Much of the media commentary has been about the abolition of the Reserve Bank’s lock-ups.  The many good trustworthy people pay the price of one peripheral player cheating.  Worse, it will apparently be harder to get good reporting and consumers of news will suffer.  And, from some of the economists, a concern that financial markets might be more volatile for the “first few minutes” after the release while economists and traders try to digest what the Bank is saying.   I plead for some perspective.

All of this commentary loses sight of the simple point which I have made previously, and which the Reserve Bank statement yesterday also makes.  Other countries don’t do it the way we were.  No country that I’m aware of had provided advance lock-ups for economists and analysts for official interest rate announcements.  And the handful that do provide some tightly-controlled advance notice for a select group of journalists give them only a few minutes advance notification, not two hours.  Other countries’ central banks don’t provide their staff to provide private briefings to media or analysts in advance of release, in doing so providing different information to those inside those lock-ups than is available to those outside.     What the Reserve Bank wants to say  in its releases should be carefully drafted and refined, and then put in the official documents, and left to speak for itself.  Sometimes press conferences can be useful, but they should be viewable (as the Reserve Bank’s are) by everyone, not only by the select few.  If anything, under the new arrangements, the press conferences may even allow better scrutiny and more searching questioning of the Governor, since future press conferences will occur an hour after the release (rather than a few minutes after as has been the case until now).  That will allow journalists to talk to economists, politicians, sector group leaders etc before they pose their questions to the Governor.

It is worth remembering, again as I’ve pointed out previously, that half of each year’s OCR announcements have always taken place without benefit of lengthy explanatory lock-ups (or press conference).  The full scale lock-ups have been used for Monetary Policy Statements, but not for the other intervening OCR reviews.  I’m not sure there is any evidence that the market reaction to those one page statements has been any more difficult or volatile than for the MPS releases.

Nonetheless, I think there are still some aspects of the new regime that will require some bedding down, and perhaps later refinement.    I’ve long thought it was a mistake to release OCR announcements at exactly the same time as MPSs. A better model, in my view, would be to release the OCR decision as soon as it is made (further reducing another aspect of risk in the system) and then to release an MPS a few days later, as background analysis (looking forward, and providing ex post assessments).  In such a model, the MPS would be much less market sensitive (the main market-moving news is in the OCR announcement itself). For such a background document, there might be less harm (but less interest) in a lock-up to explore the technical detail of the forecasts.

More immediately, the Reserve Bank should consider adopting the idea proposed by former Czech central bank head of communications Marek Petrus (discussed on his Lombard Rates blog, and here on mine) that the Bank should host an analysts briefing later in the day of the MPS release.  In such a briefing,  analysts could ask questions of the Bank (in person or by phone –  akin to conference calls investment banks run), and the Bank  might also be able to use the occasion to resolve  openly any misinterpretations that had arisen over the day.  But the critical aspect of the arrangement is that the briefing would be webcast (as the press conferences are) so that everyone has the same information, whether in Wellington, Auckland, Singapore, or New York, whether economist or not.  A concern about the new system the Bank announced yesterday is that it will resolve one problem and open another.  The analysts lock-up (and the later economists’ lunch) has always had problems in that they sometimes provided information to attendees that wasn’t available to everyone else.  In the new world there is a risk that there will be high rewards for those – especially the Wellington-based – who, searching for nuance, secure coffee discussions with the Chief Economist or the Manager, Forecasting.

Somewhat surprisingly, even the Prime Minister has weighed in, calling for the Reserve Bank to reconsider, noting that Budget lock-ups had worked well.  I’m not sure whether The Treasury uses more robust systems to reduce the risk of leaks (perhaps they will be reviewing them in light of the Bank’s experience?), but even if they aren’t the case for a lock-up for Budget material is much stronger than for MPS.  First, there is typically a wide range of material across huge number of portfolio areas.  Second, often new initiatives are being announced, with technically complex details.  And third, not much about the Budget is typically very market-sensitive, especially as the Beehive typically provides strong hints (or more) on the juicy stuff in advance of Budget day.  By contrast, OCR announcements and MPS releases are really just the same old stuff over again (new data, new rate, but the same basic framework), but the bottom line is highly market sensitive, and there is no pre-briefing of selected journalists.

Changing tack, I have been a little surprised at how little of the media coverage has focused on the Reserve Bank’s weak systems.  Perhaps that is understandable: the media has the strongest interest in the story as it affects them (changes in lock-up arrangements), and the Reserve Bank is a powerful institution and most of them want to remain on good terms with the Bank (even while complaining quietly).  But what happened in this episode involved two things:

• A MediaWorks staffer who breached his own express or implied commitments to the Reserve Bank (not to communicate the information before the embargo lifted)
• A central bank that ran lock-ups that, it turns out, used no technological protections, and relied totally on trust to protect extremely sensitive information.

I was trying to explain the story to my children last night.  I told them that I had no reason to distrust the people who live on my street, but that nonetheless I would irresponsible if we went out and left the doors wide open, simply relying on trust that nothing bad would happen.   Most of the time, nothing bad would happen.  But if and when it did, people (including the insurance company) might reasonably talk of contributory negligence.

Managing highly sensitive information is not incidental to what the Reserve Bank does, but integral.  And yet they unnecessarily sit on the OCR decisions for six days, running risks of (inadvertent) release by someone inside the institution.  And they tell the Minister of Finance –  when he and his advisers will have their own agendas –  more than hour before the announcement.  And –  the focus of this episode –  they have dozens of people from the financial media and financial institution economists in lock-ups which were secured by no more than trust.    I don’t think I had realized until last night quite how bad the situation was.  On entering the lock-ups participants have to hand in their phones, but all continue to have access to their laptops with active internet connections throughout the lock-ups.  There was, apparently, no effort ever made to secure either individual laptops or the rooms where the lock-ups were held (to physically prevent transmission until the embargo is lifted).    In an earlier post, I touched on hypothetical risks –  the analysts lock-up used to be held in a room easily overseen from neighbouring apartments – but all the time anyone in the lock-ups could simply have emailed the news to anyone they chose.  It is staggeringly lax.  Mike Hannah, Head of Communications was quoted in yesterday’s press release on the new arrangements, but these previous lock-ups were his responsibility.  What were he, and his boss Deputy Governor, Geoff Bascand, doing in allowing such incredibly lax security?  They left the door wide open, and eventually (at least) one person walked through it.

As I noted yesterday, it is surprising that the Governor’s press release took no responsibility for any of this, and offered no apology for it.   I hope the Bank’s Board (and its audit or risk committee) is asking some hard questions.

Finally, I remain irked at being accused by the Governor of being “irresponsible”, for not passing on to the Bank the email I received (from someone not in the lock up) as soon as I received it.   As I have already noted, I had no relationship of trust with the Bank, owed them nothing, and in passing on the information at all –  acting with a sense of public responsibility, and a concern for the best interests of an organization I had worked for for decades –  I have probably jeopardised my future relationship with MediaWorks.  I am also irked that yesterday was the first time I had heard the Bank suggest that I was somehow to blame.  It has the feel of a line made up after the event, to distract attention from the real story: the Bank’s weak systems, and a security breach by a journalist who the Bank had allowed to participate in its lock-up.

Let me explain.  And if the detail is painstaking, feel free to stop here. This is for the record as much as anything.

As I have said previously, I received an email from a MediaWorks employee at 8:04am on the morning of 10 March.  It is reproduced in the Deloitte report.  It read.

if true, that is very encouraging –  at last.  I  have thought it a bit more likely than the market pricing, but…one never quite knows

Just for the avoidance of doubt, the email did not come from anyone inside the Bank (or inside govt).

And finally, as I have noted to them, the Reserve Bank might want look to the security of its systems.  I had an email out of the blue at around 8 this morning-  most definitely not from someone in the Bank –  telling me that the sender had just heard that the OCR was to be cut by 25 basis points.  I have no way of knowing if it was the fruit of a leak, or just inspired speculation, and was relieved to see the foreign exchange markets weren’t moving, but it wasn’t a good look.

The Reserve Bank has this afternoon released the Deloitte report into the possible leak of the OCR on 10 March, and a press statement from the Governor.

I have given comments to various media outlets, but thought I should set down my assessment for the record.

It is extremely disappointing that it has now been confirmed that there was a leak.  One MediaWorks employee in the media lock-up apparently emailed several of his colleagues outside the lock-up.  My involvement in this unfortunate episode arose because a MediaWorks employee sent me the email that is reproduced in the Deloitte report.

It is unfortunate that the Deloitte report does not (and probably was not asked to) look into how it was that the Reserve Bank’s systems for managing lock-ups for incredibly sensitive information were as insecure as they proved to be.  From the Deloitte report it seems that no underhand technology or secret signaling was involved; simply someone emailing from their laptop.  I’m no technology expert, but I’m staggered that such an easy breach could have occurred.  When systems are weak, sooner or later they will result in a breach, by accident or deliberately.   It is also unfortunate that the Governor’s press release does not address this issue.

The Reserve Bank’s overall response to the confirmation of the leak is the right one.  Ending media and analyst lock-ups is a step I recommended in a post several weeks ago, reflecting the vulnerability of such events (especially as technology has advanced), the fact that few or no other central banks provide any advance information in lock-ups, and the fact that such lock-ups have at times meant people inside the lock-ups have better information on the Bank’s interpretation of the documents than people who do not attend such events.    The new model will bring the Reserve Bank into line with standard international practice.  It is a model that would, I hope, have been adopted even if it had been confirmed that on this particular occasion no leak had occurred.

There are further steps that should still be adopted to minimize the risks of inadvertent early releases of the OCR.  For example, the lengthy lag between taking the OCR decision and releasing it should be shortened.  I was also surprised to learn from the Deloitte report that the Minister of Finance had been aware of the decision before 8:04am on the morning of the release.  When the OCR system was established in 1999, the practice was to advise the Minister only 10 minutes or so before the announcement.  If the Minister needs to know at all (and it isn’t clear why), 10 minutes notice should be an ample courtesy.

The Governor’s press release was disappointing on several counts.

First, it took no responsibility at all for the Bank having run systems and procedures that allowed this leak to have happened.  Of course, the leaker should not have leaked, but the Reserve Bank should have managed its procedures in a much more robust way to ensure that the leak could simply not have happened (especially in the easy way it appears to have).

Second, I was struck by the grudging gracelessness of the statement.  This inquiry, the associated discovery, and the subsequent change of procedures, would not have happened if I had not, at my own voluntary initiative, informed the Bank of the information I received.  It is as simple as that.  Unlike those in the lock-up and their employers, I am in no relationship of trust with the Bank, owe nothing in particular to them, and had actually valued the outlet that MediaWorks from time to time had provided for my commentaries and views.  And yet the statement offers not a word of appreciation or thanks to me; instead it criticizes me for not telling them about the information earlier.

“The fact that several people outside the Bank, who had access to the information improperly, failed to alert the Bank immediately, was irresponsible and left open a significant risk that the Bank could have closed down quickly with an immediate official release.”

As I have been clear all along, I never knew (until today) whether there had been a leak, or whether someone was just engaging in some big talk.   And the fact that there had been no market movement made me reluctant to believe there was a real leak –  as did the fact that I had worked at senior levels at the Bank for many years, and been under the impression that security at the lock-ups was fairly water-tight.

Moreover, as readers know, the Bank’s attitude towards me over the last year has not exactly been positive and cooperative.  Perhaps I could have gone to them at 8:20 and said “someone just told me you are cutting this morning”.  In fact, the thought didn’t cross my mind initially.  But when it did, my reaction was “what if they aren’t cutting.  They will simply scoff, and say “there goes Michael again””.  And so I kept the email to myself –  still not sure whether it was real news or not –  until I knew the Bank had cut, whereupon I passed the information on to the Assistant Governor and the Head of Communications.

I gather this “Michael was at fault” line is now part of their stock response (someone this afternoon told me that John McDermott had run that line to him previously).

MediaWorks people were at fault, and the Bank had weak systems that allowed a serious leak to occur.  Had I been less professional and more opportunistic, I could have put the text of the email on my blog as soon as I found it. After all, I was in no relationship of trust with the Reserve Bank.  Unsure whether it was for real or not, I reckon I still have enough credibility that doing so would have created a lot of damage.  But I didn’t do that: I kept it to myself and instead I told the Bank about it as soon as I was sure I was not going to look stupid.  I was simply caught in the middle of this – and have spent several weeks with people suggesting or implying that I had made it all up, was making allegations etc

The Governor is also misleading to suggest that even if I had alerted them earlier they could have avoided problems by immediately releasing the information themselves.  That might have been their reaction –  although they would surely have had to ask how seriously to take my information –  but it wouldn’t saved chaos, and might only have made things worse.  The hour before the OCR is released is a dead zone in New Zealand markets.  Many people abroad focus on New Zealand again just a few minutes before the scheduled time of the release.  To have released at 8:35. generating huge market movements, when they couldn’t even be sure that a leak had occurred (a week later they were still just talking of me making “allegations”) would have made life a lot harder for them, with plenty of aggrieved and vocal offshore people.

I guess I wouldn’t really have expected gratitude, but the graceless (and blame-shifting)  tone of the Governor’s statement is really something that should have been beneath the dignity of someone so senior.