Police say that budget leaks not unlawful

Police have conformed what has been widely claimed already about the budget leak – they say the information was obtained by ‘exploiting a bug’.  What? Online viruses exploit bugs, but that doesn’t make them lawful.

Whatever the law says on this, questions about the ethics of National publicising the material they obtained remain. As has been pointed out, they could have highlighted the flaws in information security without abusing the budget process.

Stuff:  Budget leaks ‘not unlawful’, no further police action

In a statement ahead of Thursday’s budget and an expected press conference from the National Party where leader Simon Bridges was to explain how he got his hands on budget information early this week, the Treasury said that police had advised that “an unknown person or persons appear to have exploited a feature in the website search tool” – but that this “does not appear to be unlawful”.

Police are therefore not planning further action, but the State Services Commission will undertake an inquiry into the issue.

The Treasury said it and and the GCSB’s National Cyber Security Centre has been working on establishing the facts.

“As part of its preparation for Budget 2019, the Treasury developed a clone of its website. Budget information was added to the clone website as and when each Budget document was finalised,” it said in a statement.

“On Budget Day, the Treasury intended to swap the clone website to the live website so that the Budget 2019 information was available online. The clone website was not publically accessible.

“As part of the search function on the website, content is indexed to make the search faster. Search results can be presented with the text in the document that surrounds the search phrase.

“The clone also copies all settings for the website including where the index resides. This led to the index on the live site also containing entries for content that was published only on the clone site.

“As a result, a specifically-worded search would be able to surface small amounts of content from the 2019/20 Estimates documents.

“A large number (approx. 2000) of search terms were placed into the search bar looking for specific information on the 2019 Budget.

“The searches used phrases from the 2018 Budget that were followed by the ‘Summary’ of each Vote. This would return a few sentences – that included the headlines for each Vote paper – but the search would not return the whole document.

“At no point were any full 2019/20 documents accessible outside of the Treasury network.”

The Treasury said the evidence shows “deliberate, systematic and persistent searching of a website that was clearly not intended to be public”.

So there seem to be problems that need resolving.

But what about what National did with the information they obtained?

Lawyer Stephen Price yesterday – Budget leak: Nats’ behaviour “entirely appropriate”?

I’ve just been listening to Simon Bridges’ press conference at Parliament about the budget leak. His main point was to deny that the leaked budget material was a result of a hack. But he made the broader claim that the Nats’ behaviour throughout was “entirely appropriate”. He said there had been “nothing illegal or anything approaching that from the National Party.” He denied that their conduct was at any point unlawful.

I think he’s wrong. I think the Nats have probably engaged in  unlawful behaviour from the get-go. That’s regardless of whether the budget material they released was hacked. The Nats have broken the law relating to Breach of Confidence.

That’s not a crime. It’s a civil claim, like defamation or negligence. But it is the law.

If information is confidential in nature – that is, not in the public domain – and was created and shared in circumstances in which those possessing it knew is was supposed to be confidential, and was then disclosed without permission, that’s a breach of confidence. That obligation of confidence will usually bind anyone else who comes into possession of the information.

There is a public interest defence. That’s what usually protects the media when they receive leaks. Otherwise, as you might have noticed, almost all leaks to the media (especially from employees with clear obligations of confidentiality) fall foul of this law. But usually, there will be some substantial justification the media can use. They will be able to point to some significant way the public is being served by the release of the information that would otherwise be protected by the obligation of confidence.

Is there public interest here? I can’t see it. The information was to be publicly released in two days. The National Party could freely criticise it then. How are the public really made better off by learning of these criticisms two days in advance? Is there really any benefit to a matter of legitimate public concern that overrides the obvious – and perhaps even constitutional – confidentiality that attaches to budget papers?

Nor can National argue that it needed to release the information to hold the government to account for its bungling in allowing the leak. It could have made that case without actually releasing the data.

I think there is a better argument that it was against the public interest for National to have publicised the budget information they obtained.

What could National argue? The best I can come up with is: “We felt it was in the public interest to prick the balloon of spin that the government was floating about the budget being a ‘wellbeing’ budget, and itself revealing bits of it in advance, by providing the public with information that revealed these claims to be misleading. In this we were fulfilling our constitutional duty to hold the government to account. And we didn’t release any market sensitive information.”

I don’t think that works. They could make those arguments in two days time and the public would be no worse off. I also note that it turns on the accuracy of the criticism. If the numbers are wrong, or taken out of context, or do not really reveal any misleading government behaviour, that would undermine any attempt to say that the releases were in the public interest. Finally, the fact that the National Party was drip-feeding the leaks tells against any claim that the public needed to have the information urgently and couldn’t wait two days for the budget.

Treasury has been embarrassed by the leak of budget information, whether it was obtained legally or not.

I think that National could have acted with integrity in pointing out the flaw, but they went much further than this by playing politics – they acted on heir own interests rather than public interests. Except that if the public doesn’t like the way they have done things it may not be in their own interests.

I don’t think it enhances Simon Bridges’ leadership credentials. If he wanted to prove himself as a responsible leader he would have highlighted the bug without exploiting it for some short term (two day) political gain.