GCSB tried to stop Treasury boss Gabriel Makhlouf from saying website, Budget had been 'hacked'

L-R: Secretary to the Treasury Gabriel Makhlouf, Jacinda Ardern and Simon Bridges.

Exclusive: Political reporter Derek Cheng has uncovered new details of the hours leading up to Treasury boss Gabriel Makhlouf's claims that his department's website had been hacked for Budget details.

The Government's spy agency made urgent calls to the Beehive before Makhlouf's public statement - we reveal today what they told at least one senior Government Minister.

The new details come as Makhlouf faces a State Services Commission investigation over the way he handled claims the website had been hacked. It later transpired that Budget details could be uncovered using the Treasury's search engine.

GCSB director-general Andrew Hampton during a recent appearance at the intelligence and security committee at Parliament. Photo / Mark Mitchell

The Government Communications Security Bureau phoned the Beehive last week in a desperate 11th-hour bid to stop Treasury Secretary Gabriel Makhlouf from saying publicly that his department had been hacked, the Herald understands.

But it was too late.

The GCSB had already told the Treasury that it did not believe its computer system had been compromised.

The GCSB was sent a copy of Makhlouf's statement just before it was due to be released on Tuesday night last week.

It had already been a dramatic day that started with the National Party releasing Budget 2019 information two days ahead of Budget day, sending the Government scrambling to find out what had gone wrong.

Makhlouf released his statement just after 8pm, saying "the Treasury has gathered sufficient evidence to indicate that its systems have been deliberately and systematically hacked" and that he had referred the matter to the police on the advice of the GCSB.

Finance Minister Grant Robertson followed about 15 minutes later with his own statement which named the National Party and repeated Makhlouf's description of a "systematic hack".

Through a spokeswoman last night, Robertson denied any knowledge about the GCSB's concerns before he released his own statement.

The GCSB phone call, understood to have been between GCSB director-general Andrew Hampton and GCSB Minister Andrew Little, was made shortly before the statements were released.

Hampton informed the Beehive that the GCSB – through its National Cyber Security Centre - had specifically told the Treasury that it did not believe any hacking had taken place.

Neither the GCSB nor Little would comment on the latest developments.

GCSB Minister Andrew Little is understood to have taken a call too late in the day to stop the "hacking" statements. Photo / Mark Mitchell

The GCSB has previously confirmed it told Treasury on Tuesday May 28 that its computer network had not been compromised. But its alert to the Beehive has not been previously disclosed.

The fact that Makhlouf called it a systematic and deliberate hack after Treasury was advised it was no such thing is now the subject of an official investigation by the State Services Commission.

National has called for Makhlouf's resignation, but also for Robertson's, claiming that he must have known more than he was saying.

What is known is that Makhlouf met Robertson at 7pm on Tuesday in Robertson's Beehive office to tell him he had referred the "hacking" matter to police.

During that meeting, Robertson, and staff from his office and the Prime Minister's Office are understood to have grilled Makhlouf over his belief that the Treasury had been "hacked".

Makhlouf held his ground and insisted that "hacking" was the right description, the Herald has been told.

Robertson has previously said Makhlouf told him in the meeting that the Treasury had been "hacked", but that he could not tell him how it had happened or what material had been accessed.

According to accounts by Robertson, Makhlouf had also told him Treasury had sought advice from the GCSB, and he had followed that advice and referred the matter to the police.

But Makhlouf did not tell his minister that the GCSB had advised going to police because it wasn't hacking and was therefore not a matter for the GCSB.

National leader Simon Bridges holds a press conference on Budget day to explain how National got early access to confidential Budget information. Photo / Mark Mitchell

GCSB's previous statement put it like this: "The National Cyber Security Centre (NCSC) is part of the Government Communications Security Bureau. Our role is to help New Zealand's most significant public and private sector organisations to protect their information systems from advanced and high impact cyber-borne threats . On Tuesday evening a Treasury staff member described the incident to an NCSC responder and asked if this was a matter for the NCSC or Police. Given the incident did not involve a compromise of the Treasury computer network and was therefore not the type of incident the NCSC would normally respond to it was recommended that the matter be referred to Police for their assessment."

National leader Simon Bridges has accused Makhlouf and Robertson of both knowing that there was no hack all along but describing it in that way to smear the National Party.

Bridges has revealed that National Party staffers had been able to access Budget information simply by using the search function on the Treasury's website. Treasury had set up a clone system with Budget information that it had not realised was accessible.

Robertson has said he was "very disappointed" that the Treasury did not take further steps before calling in the police – which declared within 24 hours of the complaint there had been no unlawful access.

But Robertson has not apologised for calling it a "systemic hack", saying he was relying on Treasury advice.

Ardern has also defended Robertson, saying that ministers are only as good as the advice they receive.

Makhlouf has not commented on the unauthorised access to Budget information since he gave media interviews last Wednesday.

By that time, he had stopped using the term "hacked" and was instead using the term "unauthorised access" to Budget material.

The police informed Makhlouf on Wednesday evening that Treasury had not been subject to an unlawful hack. He informed Robertson that night and issued a press statement to that effect at 5am on Budget day, May 30.