Release of the report relating to the unauthorised disclosure of the Patten report

8 November 2018

The Department of Internal Affairs has today released the investigation report into the unauthorised disclosure of the Patten report to a media outlet.

The Patten report looked into the incident involving Hon Meka Whaitiri and a staff member.

The Department commissioned Deloitte to conduct an independent, thorough forensic investigation. Deloitte found no evidence that any Department of Internal Affairs staff member leaked the report to the New Zealand Herald in September, and could not identify any specific individual responsible for the unauthorised disclosure.

However, investigators highlighted poor information management practices in the Department’s handling of the Patten report. This included inadequate information security and access controls of the electronic copy of the report, and a deficient redaction process.

“The Department has robust information security and management policies in place, but in this instance we fell short of our own standards. We did not maintain adequate security controls over the report,” says Paul James, Chief Executive of the Department of Internal Affairs.

“We will strengthen staff training and awareness of our robust information management policies. This will include a strong focus on information security practices.”

Investigators from Deloitte interviewed a number of Department staff and external parties, and conducted a forensic examination of internal files and email systems.

The redacted public version of the investigation report is available on the Department’s website - www.dia.govt.nz/Proactive-Releases

Paul James, Chief Executive of the Department of Internal Affairs, is available for comment.

Background information

• The Department of Internal Affairs commissioned Deloitte to conduct the detailed investigation. The Department allocated $65,000 + GST for this investigation, as it required specialist skills to forensically examine a significant amount of data.
• The investigation was limited to the Department’s staff and processes. Eight external parties have also consented to contribute to the investigation.
• The investigation took around four weeks. The final report was delivered to the Department on 31 October 2018.