Dear The Treasury,

At 8.02 pm on Tuesday 28 May, the Treasury issued a media statement entitled “Further statement from Gabriel Makhlouf”. Among other things, the statement said that “the Treasury has gathered sufficient evidence to indicate that its systems have been deliberately and systematically hacked”. It said the matter had been referred to the Police “on the advice of the [GCSB]’s National Cyber Security Centre”. It can be found at https://treasury.govt.nz/news-and-events...

The issuing of the statement has created enormous controversy. On the face of it, it suggested that all information held by arguably the most sensitive government department had potentially been obtained by an unknown criminal hacker. In the context of events earlier in the day, it can also reasonably be read as suggesting that the Opposition was in receipt of and using politically information that may have been obtained by an unknown criminal hacker. An even wider context is recent allegations of Russian interference in western political processes and allegations of Chinese hacking activities against western interests.

It has turned out the statement and any such imputations were false. As well as the public interest in it coming to light why this particular statement was issued, there is even greater public interest in maintaining domestic and international confidence that the accuracy of public statements made by the Treasury. This is therefore enormous public interest in it becoming known how such a false public statement came to be issued, especially as it was issued under the name of the Secretary.

Adding to this public interest, this morning Richard Harman has reported in his highly regarded Politik newsletter that “[your] use of the phrase ‘systematic and deliberate hack’ appears to have been guesswork”. Mr Harman’s article can be found at http://politik.co.nz/en/content/politics...(POLITIKToday_07_10_2016_10_6_2016_COPY_01)&mc_cid=9aabd7970f&mc_eid=d195fad3e0

Under the Official Information Act, I therefore ask for the following documents:

1) All drafts of the media statement referred to above, whether electronic or on paper, including all amendments and comments made on them by any individual or organisation whatsoever, including the identification of that individual and organisation and when those amendments and comments were made
2) Any other draft media statements, talking points or internal Q&As prepared by the Treasury on this matter on Tuesday 28 May or Wednesday 29 May for use by the Treasury, the Prime Minister or Ministers
3) All formal written advice provided by the Treasury on the alleged IT breach to the Prime Minister or Ministers on Tuesday 28 May or Wednesday 29 May

In addition, I seek the following non-documentary information:

4) When and buy whom was it first proposed that a media statement should be issued on this matter at or around 8.02pm on Tuesday 28 May?
5) With whom and when was this proposal discussed?
6) What was the objective of issuing such a media statement?
7) Which individuals and organisations were given prior notice of the intention to issue the media statement at or around 8.02pm on Tuesday 28 May, and when?
8) Which individuals and organisations were given a draft or final version of the media statement, and when?
9) What opportunity were Treasury IT staff given to check the accuracy of and provide feedback on the statement prior to release?
10) What opportunity were those named in the media statement – namely the Police and the GCSB and its National Cyber Security Centre – given to check the accuracy of and provide feedback on the statement prior to release?
11) What opportunity were those publicly known to be potentially associated with matters discussed in the media statement – namely the Opposition – given to check the accuracy of and provide feedback on the statement prior to release?
12) Prior to release, what consideration was given to the impact of an announcement that the Treasury had been “deliberately and systematically hacked” on external stakeholders such as the financial markets and foreign governments, and what measures were taken to manage these impacts?
13) If Treasury did not know what information may have been obtained by the Opposition or the “hacker”, what consideration was given to publicly issuing market-sensitive information held by the Treasury, and why was it decided not to take this step?
14) If Treasury did know what information may have been obtained by the Opposition or the “hacker”, how did it not know how the information had been obtained?

Thank you for your attention to this request. Given the enormous public interest in this matter, as discussed at the outset above, I asked both that you treat it as urgent and also that, even if good reasons are identified for withholding the information, you nevertheless decide to release it given the matters discussed above render it highly desirable, in the public interest, that the information be made available.

Kind regards

Matthew Hooton