Treasury claims it has been 'deliberately and systemically hacked'

Police to investigate Treasury's claim it has been hacked ahead of Thursday's Budget; Finance Minister asks National to stop releasing potentially stolen information; National says it's been 'falsely smeared'

28th May 19, 8:50pm by Jenée Tibshraeny

Treasury claims its systems have been “deliberately and systemically hacked” ahead of Thursday’s Budget.

It has gone to the Police following the National Party throughout the day on Tuesday releasing documents allegedly revealing how funding will be allocated in the Budget, and claiming it has received a leak of the Government’s 2019 legislation programme.

Treasury Secretary Gabriel Makhlouf on Tuesday night said: “Following this morning’s media reports of a potential leak of Budget information, the Treasury has gathered sufficient evidence to indicate that its systems have been deliberately and systematically hacked.

“The Treasury has referred the matter to the Police on the advice of the National Cyber Security Centre.

“The Treasury takes the security of all the information it holds extremely seriously. It has taken immediate steps today to increase the security of all Budget-related information and will be undertaking a full review of information security processes.

“There is no evidence that any personal information held by the Treasury has been subject to this hacking.”

Finance Minister Grant Robertson said the Government had contacted the National Party to request it doesn’t release further information.

“This is extremely serious and is now a matter for the Police,” Robertson said.

“What New Zealanders care about are the issues that will be dealt with in the Wellbeing Budget on Thursday, and that is what we continue to be focussed on.”

National Leader Simon Bridges couldn't be contacted for comment, but will brief media on Wednesday morning. He tweeted:

The National Party has acted entirely appropriately. @grantrobertson1 has falsely smeared us to cover up his and The Treasury’s incompetence. When what has occurred is revealed, he will need to resign.
— Simon Bridges (@simonjbridges) May 28, 2019

We welcome your comments below. If you are not already registered, please register to comment

Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.

35 Comments

by GV 27 | 28th May 19, 8:55pm 1559033718

I'm guessing because now it's an active police matter, no one will be able to comment.

Funny that.

by areyouserious | 28th May 19, 9:22pm 1559035320

Well that escalated quickly. Ol' no Bridges really doesn't have a feel for these things.

by D581 | 28th May 19, 9:33pm 1559035982

Big if true. The National Party has been going full GOP in their tactics for a while now - the constant and deliberate obstruction of government by gumming up the works (the select committee walkouts, the thousands upon thousands of written PQs) courting religious fringe groups, now taking advantage of potentially hacked information to undermine a sitting Government.

Of course comparisons will be made to Dirty Politics and that this is the left getting some of its own medicine. However, with leaks there's always a public interest aspect to consider as well - is it really in the public interest to be releasing screeds of budget info a couple of days before it's all public anyway? All it seems to be doing is undermining and wrecking for the benefit of one party.

In any case, the 2020 election will not be pretty.

by Foyle | 28th May 19, 9:47pm 1559036823

The info would be out in 2 days, and so far there has been no commercially sensitive info on (eg) tax law changes etc all this does is mess with the coalition's huge spin machine. Spin is propagandising obfuscation, often parroted by overworked media. It is only of benefit to the coalition, not the people of NZ. So overall early release of this info is (IMHO) a public good. But certainly there will be lots of hurty feelings on the left, and an absence of reflection on their reaction to National's 2018 leaks.

by D581 | 28th May 19, 10:34pm 1559039643

I wouldn't imagine that simply damaging the Coalition would pass a public interest test. In any case, the Government's reaction the Jami-Lee Ross leaks was by in large to stay out of the fray and not comment on the infighting going on in another party, which I have to say, is far better than I'd expect out of National.

by CJ099 | 29th May 19, 6:49pm 1559112578

Yep that's pretty low of National we all know they're a very corrupt political party, but this just goes to show how desperate they are. Not sure that even the Boomers would be stupid enough to vote them back in come the next election. It's so obvious now how they did nothing when they were in government but sell this country off to foreign owners and did not give a rats ass about NZ citizens and residents, so long as they could line their own pockets.

by Fritz | 28th May 19, 9:33pm 1559036029

Weird.

by Foyle | 28th May 19, 9:37pm 1559036257

An explanation for Bridges comment would be that it was found unsecured online. Digital muppetry

by Foyle | 28th May 19, 11:24pm 1559042677

now seemingly confirmed: https://twitter.com/norightturnnz
How very embarrassing for the govt.

by Pragmatist | 28th May 19, 11:32pm 1559043159

Err, the tweet stream shows the exact opposite.
"Treasury spokeswoman tells me the figures "were never on the website."
"The documents weren't uploaded to a publicly available website and then removed."

Perhaps calm down till the police investigation has some answers.

by dictator | 29th May 19, 7:52am 1559073136

We don't need the Police to confirm the stupidity of whoever put the documents up publicly. In fact it's the simplist and most likely answer. A pity the person who made the excuse to cover up their mistake didn't anticipate an investigation.

by Foyle | 29th May 19, 3:19pm 1559099943

So if that cached webpage was benign, and ready to go live in a day or two, then why did Treasury take it down after the leak was discovered? Kinda screams screwup doesn't it?

by Foyle | 28th May 19, 10:12pm 1559038351

by Yvil | 28th May 19, 10:49pm 1559040580

Reveals the incompetence of Treasury and current government. Just not good enough

by dictator | 29th May 19, 6:56am 1559069800

Treasury managed to determine that it was "hacked" very quickly. I doubt they have the expertise to make that determination in that time. What's more likely is this is an excuse by a Government employee to cover up their incompetence.

Note that they are now carrying out a fully security review. Apparently Treasury doesn't take security very seriously at all.

The fact that Simon Bridges hasn't taken this opportunity to further mock Treasury and the Government is because he has no idea what he is doing.

Always the same Government playbook, including Customs operating illegally to try to find out the title of Nicky Hager's new book.

by dictator | 29th May 19, 10:14am 1559081673

Something I want to point out is that Treasury claimed they were attacked 2000 times in 48 hours. In fact my router handles about 6000-8000 inappropriate log in attempts in the same time period (they are hilariously bad and entertaining to watch in real time). I seriously doubt the relevance or accuracy of this claim by Treasury.

by Berend de Boer | 29th May 19, 8:31am 1559075464

Let me make an informed guess: there was no hacking, someone just tried to guess the names of the documents, which were not properly secured, but just put on a public area of the site. Security relied on the fact nobody was going to guess the names, i.e. security by obscurity. Total fail.

Given this is a Drupal website, a common mistake made by those who don't completely understand the tech, even though Drupal supplies excellent features to properly secure the files.

by Berend de Boer | 29th May 19, 9:10am 1559077800

It get's even worse, it was cached by Google! https://twitter.com/norightturnnz/status/1133305324796952576

by Kate | 29th May 19, 8:33am 1559075601

Let's hope the Police get answers as a result of the investigation this time, we can't afford another 'no result' as per investigation of the theft of Anne-Marie Brady's information.

by redcows1 | 29th May 19, 8:35am 1559075730

Surely info like this would be held on a completely separate from the internet type network system. Or is that to easy

by Noncents | 29th May 19, 8:56am 1559077019

Treasury are probably attacked hundreds/thousands of times each and every day anyway. I think Mr Makhlouf. is trying to link these claims to the release to protect themselves.

Running to the police - well the Police will be able to show they were "hacked" but I doubt that is how the "leak" occurred.

Looks like individual parts were technically linked to in the public domain, albeit for a very limited time. But the full document was never published.

https://webcache.googleusercontent.com/search?q=cache:5tyYMfBP2xIJ:http…

by Kate | 29th May 19, 9:21am 1559078513

TSY Sec clarified this morning that headings were prepared but documents were not uploaded to those headings. At least that's what I got out of his interview.

by polygonalvector | 29th May 19, 8:59am 1559077175

Have to agree, this is by far the most plausible explanation - it was simply put on the Treasury website via incompetence.

This is supported by the fact that that said document was at some point crawled by Google - so the document was there at some point - and Google doesn't index stuff instantly - so it was likely there for at least a day - likely posted on Friday and indexed late Friday/early Saturday - then obtained, read and linked to National on Sat/Sun who then had time to get ducks in a row for Mon.

So no, that isn't hacking, it isn't illegal and it isn't even underhanded or un-ethical - it's simply using information that was provided publicly... that shouldn't have been.

Treasury F-up - no question about it in my mind. Either an over-zealous comms person, or some web admin person who thought they knew stuff (my experience of web-content folk working in Government tells me they don't) or they have some automated publishing setup from their document management system and simply configured/categorised the document incorrectly.

I stand to be corrected, but I would be very very surprised if this is an actual 'hack' by any reasonable definition. It's an attempt at political ass-covery - that is politically expedient for both Treasury and the Coalition government.

And when all's said and done, its information that would have been public within a week so it's a storm in a teacup imo.

by Foyle | 29th May 19, 3:15pm 1559099732

I think the fact it was taken down by Treasury is very telling. Why bother if it was harmless?

by powerdownkiwi | 29th May 19, 9:28am 1559078905

If you wanted to 'spoil' the launch of a wellbeing budget, you couldn't do much better. And if you could sink Robertson collaterally, so much the betterer.

Now who would want to do that?

by Kate | 29th May 19, 9:31am 1559079117

The obvious answer is National but I think they are the patsy.

by sharetrader | 29th May 19, 9:40am 1559079605

most likely one of nationals attack dogs, BUT treasury made it easy for them to find it so for me the blame goes back to the goverment department
our goverment departments would be searched daily for holes and leaks from all around the world so they need to make sure they are secure

by Kate | 29th May 19, 10:07am 1559081265

Thing is, Bridges is adamant that in obtaining the information there was no hack. The implication being, whomever he got it from might have told him it was simply in the public domain - a matter of incompetence - which is what his present line is. My guess is he's telling the truth as he knows it, but he's been set up, i.e., the patsy.

by powerdownkiwi | 29th May 19, 10:53am 1559083984

It would be funny if it was a reverse set-up. But it doesn't look like that.

And they're still carrying baggage like 'the mine looked like a good thing to me' Curran.
https://www.odt.co.nz/opinion/clarity-hard-find-shadows

"When an industrial opportunity of this scale is offered by a foreign company to elected representatives, before writing letters of support, basic business practice would expect a reasonable level of due diligence be undertaken".

There's a lot across the House about the same level......

by dmitri | 29th May 19, 10:55am 1559084152

If there wasn't wrongdoing, how is it 'setup'? I get it you don't like Bridges. But what is your logic?

by Kate | 29th May 19, 6:36pm 1559111801

I think Makhlouf is telling the truth and the information released by Bridges likely came from that breach of TSY's system. But whomever Bridges got it from said it was obtained legally, perhaps he was told that TSY hadn't secured it - it was public but not 'live'.

So, Bridges is telling the truth as he knows it, and is blaming TSY as being "incompetent" (those were his words). Hence, Bridges was made a patsy.

by Kate | 29th May 19, 7:39pm 1559115575

This explains it better;

https://www.rnz.co.nz/news/on-the-inside/390817/only-option-for-clarity…

Is this the first public evidence of that level of attack? Who knows, at this point. The police, along with the GCSB will be investigating and nobody is saying quite what the state of play is yet.

And if it was a state-sector actor, as the author suggests, I'm guessing we'll never know, because how do you come out internationally and say the leader of the opposition was duped?

by ddporter | 29th May 19, 10:51am 1559083902

There are far more important issues for NZ than this, Teachers pay, the Health system, getting better access to world markets etc, wages falling behind making NZ slowly third world

by dmitri | 29th May 19, 10:57am 1559084243

See it did work! Diversion

by andyb | 29th May 19, 11:17am 1559085476

Regardless of how National obtained the details I think they have gone about it the wrong way. I think they should have:

1, taken the opportunity to truly attack and pull apart the budget when officially released. Calling it a Winston Budget upon release would have been much more effective than now... that title has been lost already.

2, Advise Robertson that some or all of the details are in the public domain and given its sensitivity needs to release the budget immediately. Then advise every media outlet of their advice to Robertson. It would have conveyed an air of an experienced hand guiding the completely incompetent government on how to manage their own affairs. The CoL would have been scrambling and no doubt completely unprepared (as would markets and media) to cover a budget that had to be released early.

I agree it doesn't look good for the Government... I just think National could have got a lot more mileage out of this.