An independent investigation has failed to find who leaked a Budget document to RNZ earlier this year.
The $20,000 inquiry followed an injunction preventing RNZ from publishing any details of the Education Ministry document titled “Budget 25 Initiative Themes” and dated 29 April 2025
In a summary report published Tuesday, Michael Heron KC said he could not rule out an accidental disclosure but concluded it was likely made deliberately by one or more ministry personnel.
“Based on his review of access to the Budget Report, the Investigator identified individuals of particular interest. However, despite extensive digital forensic analysis, no conclusive evidence was found linking any Ministry personnel to the disclosure to Radio New Zealand,” the report said.
“The forensic analysis did identify some instances of poor document-handling practices, such as emails containing Budget-sensitive information that did not include any endorsement or information classification marking in the email subject line, but none that could be definitively connected to the unauthorised disclosure.”
The full report was withheld, but the summary indicated an extensive hunt for the source of the leak.
“The Investigation involved comprehensive interviews with Ministry personnel, digital forensic analysis conducted by the Ministry’s Cyber Security Centre, and detailed review of document management systems and security protocols,” it said.
It said the investigator interviewed more than 40 people including those who accessed the Budget report “via SharePoint”, received a copy of the report as an email attachment, or had printed it.
“This involved current and former Ministry personnel, including the Ministry’s cybersecurity team, the Budget team within Te Pou Kaupapahere/Policy, and members of relevant shared mailboxes.”
The report said the were three versions of the document: a Word version, a clean PDF version, and a signed and hand-annotated PDF version.
“It was unclear which version the reporter had seen”.
The report noted that RNZ refused to assist with the investigation.
“The Investigator asked to speak to the Radio New Zealand reporter about the Incident, on the basis that this would not require him to identify the individual who had disclosed the Budget Report, but to discuss matters such as the file format and version of the Budget Report disclosed to him. The reporter and Radio New Zealand via its legal representation declined to do so.”
The report identified shortcomings in the ministry’s security arrangements as well as failure to comply with its security protocols.
They included overly broad distribution lists, widespread use of insecure email attachments instead of controlled links, and failing to fully mark the report protectively or handle it on a need-to-know basis
It said there was “a gap between Ministry policies and actual operational practices, due to either limited knowledge of existing security protocols, or inconsistent practices – a culture where documents were shared without adequate consideration for security protocols”.
The report said the ministry had already acted to address the problems.
