This prompted National to believe that the Treasury and Finance Minister Grant Robertson already knew what had happened and who was behind it, and then smeared National by publicly calling it "systematic hacking" and linking it to the National Party.
The Treasury and Robertson have rejected that.
Bennett asked Barrington why the crisis committee ODESC wasn't convened, and found it "rather incredulous" that the Government wasn't taking it more seriously if it was in the dark about what had happened or who was behind it.
"Or was it actually that you all knew it was the National Party, you'd had a heads up about it from the GCSB (Government Communications Security Bureau), and that's why you were relatively relaxed about it?" Bennett asked.
Barrington rejected that and said he was focused on finding out how it had happened, not who was behind it.
"My conversations with senior officials, including at chief executive level, were precisely about that. The next morning, in my own department, I ensured that any sensitive material was taken off my website, because we simply did not know whether this was a systematic breach of the system. Things were being taken seriously."
Bennett: "With all due respect, how can you not be concerned about the 'who', when actually that is pivotal as to whether or not it is the National Party or .... an overseas player that could actually do damage to this country? The 'who' is vital."
Barrington: "No, no it's not. The 'who' is secondary, with all due respect. The primary question is, are the defences in good order such that they can withstand an unauthorised access from anybody. That's the question. What would the 'who' have told me?"
He said the matter of foreign interference had already been settled the previous evening, on Tuesday May 28, when Andrew Hampton, the head of the GCSB, had told him that it had not been a cyber intrusion.
"That essentially means it was not a foreign actor using cyber to get in."
He said Hampton had told him during that phone call that he could not definitively say what had happened, only that it was not a cyber intrusion.
Barrington said the "what" and "how" only became clear to him at 4.30pm on Wednesday May 29, during a meeting with Hampton and other public sector bosses.
Barrington then told Prime Minister Jacinda Ardern after the meeting concluded at just after 6pm, and the Treasury released a statement at 5am the following morning - 12 and a half hours after the meeting with Hampton.
Bennett said an open and transparent Government should not have waited such a long time to clarify matters.
Barrington said that was a question for the Treasury, which had put out the original statement and laid the police complaint, but it was "perfectly reasonable'" for the Treasury to consider its options.
"As a former diplomat, I am trained to be cautious and methodical. I am trained to wait for the evidence to present itself, to breathe deeply and to take the time to consider the facts that have been laid before me.
"And frankly that was my advice to the ninth floor, which was everybody just needs to look at the evidence, give the Treasury time to consider and reflect on its options, and to breathe deeply."
Bennett also said that when the GCSB told the Treasury it wasn't a hack, it preferred to call it an "information management issue".
This contrasts to Ardern's comments yesterday that the GCSB had preferred the term "unauthorised access".
Barrington said he was not aware of what the GCSB had told the Treasury, but added: "'Hack' is a term that has a great many meanings, none of them very precise."
Barrington said he expected to be interviewed today as part of the State Services Commission investigation into whether Makhlouf misled the Government.
Bennett has said that she and Bridges will also be interviewed.
