OBR calls in cyber expert over botched release of Budget analysis

The Office for Budget Responsibility (OBR) has drafted in a leading cyber-security expert as it investigates how a document – containing key details of Wednesday’s Budget – went live too early.

Rachel Reeves’s statement was thrown into chaos after the OBR’s economic forecast appeared online around 40 minutes before she announced her policies.

Even though the document was not listed on the OBR website, journalists – including those at the BBC – were able to access by guessing its URL, which was very similar to one used in a previous official document.

OBR chairman Richard Hughes said he was “personally mortified” by what happened and the results of a “full investigation” would be reported to MPs.

Patrick Burgess, cyber-security expert with BCS, the Chartered Institute for IT, told the BBC that the incident “didn’t appear to be a cyber-attack” but instead “a straightforward data-handling mistake”.

He added that whilst a review of the OBR’s cyber-security could be “helpful”, the solution was to “normalise and randomise file names” so that unpublished material could not be discovered earlier than intended.

“This is a reminder that good cyber practice often starts with good digital housekeeping,” he said.

Details of the Budget are supposed to be kept under wraps until the chancellor announces them in the House of Commons, due to them being market-sensitive.

But early publication of the OBR’s report effectively confirmed a number of new measures, including a pay-per-mile charge on electric vehicles, and a three-year freeze on income tax and National Insurance thresholds.

The OBR quickly removed the forecast document from its website and apologised for the release, which it blamed on a “technical error”.

Speaking to BBC Radio 4’s Today programme on Thursday, Mr Hughes said the document was not published “on our web page itself”.

In other words, it was not linked to directly by the OBR website.

However, it had still been published online ahead of the Budget being announced.

“It appears there was a link that someone was able to access,” he said. “We need to get to the bottom of what exactly happened.”

Mr Hughes said Professor Ciaran Martin, a former head of the National Cyber Security Centre, would provide “expert input” for the OBR’s investigation.

The BBC was able to access the PDF version of the OBR’s key report at 11:45 on Wednesday by replacing the word ‘March’ with ‘November’ in the web address of a previous edition.

Five minutes earlier, the Reuters news agency had started sending out one-line news flashes summarising contents of the report.

This was followed by a brief spell of volatility in the UK bond and currency markets.

Gilt yields – which give an indication of government borrowing costs – fell sharply, before climbing back to above the level they had been at before the details were leaked.

Mr Hughes acknowledged the “deep disruption” caused, and said he took responsibility “on behalf of the OBR” for “inadvertently allowing” early access to document.

Asked on Wednesday if he would resign, he said: “I’ve given you a statement, that is all I have to say.”

Reacting to the leak in the Politics Live studio, BBC political editor Chris Mason said: “The sheer absurdity of reading out something the chancellor has not yet announced in the Commons is mind-blowing”.

BBC economics editor Faisal Islam said: “I think I need a red box, I can deliver the Budget now in the studio… It tells you all the measures, it tells you all the big stats we were just speculating over.”

The unexpected release caused a reaction in the Commons chamber as Prime Minister’s Questions (PMQs) started, with Reeves seen looking at her own phone with concern, before Treasury Minister Torsten Bell, who was sitting behind her, passed his mobile phone to her as the news broke.

Notes were being passed down the row of cabinet ministers before the Chief secretary to the Treasury James Murray held his phone in front of Reeves and she copied down some words onto the top of what seemed to be her Budget speech.

Conservative MPs quickly started posting pages of the document on social media and Tory frontbenchers, including shadow chancellor Mel Stride, were seen whispering and making notes.

Stride then called a point of order at the end of PMQs to demand an inquiry into the leak, saying: “It is utterly outrageous that this has happened and this leak may constitute a criminal act.”

There have already been weeks of leaks and speculation over policy to the media in the run-up to the Budget, which the chancellor was reprimanded for by deputy speaker Nus Ghani.

Although this is the first time the OBR has made this sort of mistake, it is not the first time parts of the Budget have leaked out before they should have done.

Back in 2013, the Evening Standard mistakenly published details of George Osborne’s Budget before he got to his feet in the Commons, including details of major announcements on tax.

The then-Labour leader Ed Miliband was reading a photocopy of the front page as Osborne spoke and said the chancellor “almost need not have bothered coming” to the Commons.

In 1996, the Daily Mirror was sent the full contents of Chancellor Ken Clarke’s Budget in advance of his speech.

Piers Morgan, who was the paper’s editor at the time, only published some details in the next day’s paper, sending the rest back to the Treasury.

At the time, prime minister John Major ordered a leak inquiry and the Metropolitan Police investigated, but no one was arrested.

In 1947, the Labour Chancellor Hugh Dalton was forced to resign after giving a journalist details of the Budget before making his statement.