Outgoing Treasury secretary Gabriel Makhlouf was "clumsy", unreasonable and fell "well short" of expectations in his handling of the Budget data breach, a government report has found.
Gabriel Makhlouf (file) Photo: RNZ / Rebekah Parsons-King
The State Services Commission report was ordered in the fallout of Mr Makhlouf claiming Treasury's website had been "deliberately and systematically hacked" and referring the matter to police.
Police quickly concluded nothing illegal had happened and soon after it was revealed the National Party had uncovered sensitive Budget information by using the website's search bar.
The Commission's report - released today - said Mr Makhlouf did not act reasonably in his description of the breach or his subsequent explanations to media.
That included the use of a "bolt analogy" in an interview with RNZ's Morning Report.
State Services Commissioner Peter Hughes said Mr Makhlouf should have publicly taken responsibility for the failure rather than focusing on the searchers of the website.
"The breach of security around the Budget documents should never have happened, under any circumstances," Mr Hughes said.
"The right thing to do here was to take personal responsibility for the failure irrespective of the actions of others and to do so publicly. He did not do that."
State Services Commissioner Peter Hughes Photo: RNZ / Dom Thomas
The investigation found Mr Makhlouf acted in good faith and without political bias when he notified Finance Minister Grant Robertson and police.
But Mr Hughes said, regardless, Mr Makhlouf's actions fell well short of his expectations.
The Treasury secretary should have sought more advice before issuing a media statement about the referral, he said.
"In my view, it was not managed well by Mr Makhlouf," Mr Hughes said. "It was a clumsy response to a serious issue and is not what I expect of an experienced chief executive."
Mr Hughes said he had sought advice from Crown Law which concluded the actions were not a sackable offence.
But he was constrained in taking any other action because it was Mr Makhlouf's last day as chief executive, he said.
Mr Makhlouf is finishing up at Treasury after eight years in the job. He has been appointed to the role of governor of the Central Bank of Ireland.
Mr Hughes was asked repeatedly whether Mr Makhlouf should have offered his resignation, and said no offer was forthcoming. "He was aware of his choices and that's that", Mr Hughes said.
Other than offering his resignation he would expect Mr Makhlouf to "have owned what had happened on the Treasury side, to have done that publicly, and to have at least publicly expressed significant regret for that".
Mr Hughes was pushed on why there would be no formal sanction or any other action against Mr Makhlouf.
"Short of putting Mr Makhlouf in the village stocks I'm doing what I can do here...we are where we are, I'm doing what I can do."
The National Party says the outgoing Treasury Secretary should offer his resignation, or at least apologise.
National's Paula Bennett said Mr Makhlouf and Mr Robertson should be held to account for not correcting claims of a hack earlier.
"They were very quick to blame, very quick to bring in the police, but very slow to correct it when they knew mistakes had been made."
Mrs Bennett said this was not about the actions of the National Party, but about government incompetence.
Finance Minister Grant Robertson said the report confirmed the government's description of events.
He said he was disappointed the Treasury's system was able to be acccessed, and was looking forward to the outcome of a separate inquiry into how it was able to occur.
'He believes he acted reasonably'
Report author John Ombler said Mr Makhlouf had made it clear he disagreed with the critical findings.
"He does have a different view of the matter. He believes he acted in good faith, without political bias, and reasonably at all times."
Mr Hughes was asked whether that denial should have prompted stronger action from him.
"I do have to be fair, you can't run the public service on the basis that you're only as good as your last mistake - that's The Apprentice, that's not 'fair go' New Zealand", he replied.
He said the incident had "significantly damaged [Mr Makhlouf's] reputation ... and I know that weighs very heavily on him."
Mr Makhlouf personally sees his own reputation as being paramount to him as he heads overseas to take up another position, Mr Hughes said.
"That has taken a major hit here - and he will have to live with the consequences of that, and you can see that working out already in the international media."
Issuing a formal reprimand to Mr Makhlouf on his last day would "look cynical" and be "meaningless", he said.
"What's most important to him right now is his reputation and me sitting here right now saying the things I'm saying to you in an open media conference is not going to do that very much good at all, and is going to be a real burden for him."
The report detailed interactions between Treasury, Mr Makhlouf and the office of Finance Minister Grant Robertson but drew no conclusions about the action of the minister or his staff.
A separate inquiry is investigating how the breach took place and the adequacy of Treasury's information security.
Mr Makhlouf's replacement was this week announced as Dr Caralee McLiesh, a former deputy secretary of the New South Wales Treasury.