There is a sieve-like culture at the NZ Transport Agency, says the head of an inquiry, which has failed to identify the leaker of light rail documents.
An artist's impression of Auckland's Queen Street pedestrianised with light rail. Photo: Jasmax NZ
Investigating lawyer Mike Heron said in his 28-page report that "it was expressed to me many times, and often with regret, that NZTA has a culture of leaking information".
NZTA ordered the probe after multiple documents and letters about Labour's transit proposal were leaked to media a year ago.
Later, the agency admitted failing to do its job on light rail, frustrating ministers, and by mid-2020 any further work on light rail had been put off until after the election.
Heron's report was issued yesterday, a day after the leak of an NZTA report into mismanaged IT contracts was leaked to Newsroom.
Heron concluded only that it was a person - and not an IT security error - behind the light rail leak, though the IT forensics were inconclusive.
"The biggest risks appear to be of the human and/or cultural variety," Heron said.
Among his seven recommendations were: improving the agency's leaky culture and tightening IT access while possibly using IT tracking tools more, to discover how documents were used.
"Each person I spoke to professed their incredulity that the documents could have been leaked by anyone they knew."
Sensitive information shared in public interest - report
Despite this confidence in each other, interviewees thought the agency was leaky and "generally put this down to a cultural dynamic whereby highly skilled and passionate people would, on occasion, take it upon themselves to disclose sensitive information in circumstances where they considered that NZTA was not performing adequately or serving the public interest appropriately".
The board and management could address this by ensuring people could express their views and be heard, Heron said.
On the tech side, the agency's board used an electronic document control system called Diligent - but was mostly not using a feature that watermarked who had opened a document and when, and should turn it on, Heron said.
The ability to print and export from Diligent was turned off after the leak.
NZ Infra - a joint venture of NZ Superannuation Fund and Canadian institutional investors CDPQ Infra - said the leak was intended to undermine its light rail proposal.
"We are pleased Waka Kotahi has indicated its willingness to address these recommendations," a spokesperson said.
An artists' visualisation for Auckland Transport of light rail in Mt Roskill. Photo: Supplied / Auckland Transport
Data storage problem
The report reveals a data storage problem within NZTA, as its central InfoHub system was "'clunky' and difficult to navigate", Heron said.
Staff were meant to save all agency material to it, and it provided some information "quickly and efficiently".
But many people told him about its limits "and that for this reason people store documents in other places, including local hard drives or cloud storage".
"Although it is possible for NZTA to search for materials saved in such ways, it is harder to search across such accounts."
Preventing disclosure was one thing, but what to do about a leak that had occurred was another, he said.
One option for NZTA "was to make no comment and provide no information".
"Another might have been to discuss the article with Stuff and seek to prevent or limit publication.
"Another might have been to immediately adopt a reactionary public relations campaign to negate or critique what was published by Stuff."
An injunction to stop publication could also have been sought.
"In this case, the response from NZTA was reasonable in the circumstances (although some argue a stronger response was warranted)."