OBR calls in cyber expert over botched release of Budget analysis

The Office for Budget Responsibility (OBR) has appointed a leading cyber security expert to investigate how a document containing key details of Wednesday's budget was released too early.

Rachel Reeves' announcement plunged chaos after the OBR's economic forecast appeared online about 40 minutes before she announced her policy.

Although the document was not listed on the OBR website, journalists, including BBC staff, were able to access it by guessing its URL, which was very similar to the one used in the previous white paper.

OBR chairman Richard Hughes said he was “personally saddened” by the incident and the results of a “full investigation” would be reported to MPs.

Patrick Burgess, a cyber security expert at BCS, the Chartered Institute of Information Technology, told the BBC that the incident “does not appear to have been a cyber attack” but rather a “simple data processing error”.

He added that while the OBR's cybersecurity review could be “useful”, the solution was to “normalize and randomize file names” so that unpublished material could not be discovered earlier than expected.

“This is a reminder that good cyber practices often start with good digital housekeeping,” he said.

Details of the Budget must be kept secret until the Chancellor announces them in the House of Commons because they are market sensitive.

But the early publication of the OBR report effectively confirmed a number of new measures, including a per-mile charge for electric cars, as well as a three-year freeze on income tax and national insurance thresholds.

The OBR quickly removed the forecast document from its website and apologized for the publication, blaming it on a “technical error”.

Speaking on BBC Radio 4's Today program on Thursday, Mr Hughes said the document was not published “on our web page itself”.

In other words, there was no direct link to it on the OBR website.

However, it was still published online before the budget announcement.

“It appears there was a link that someone was able to access,” he said. “We need to get to the bottom of what exactly happened.”

Mr Hughes said Professor Ciaran Martin, former head of the National Cyber ​​Security Centre, would provide “expert input” to the OBR investigation.

The BBC was able to access a PDF version of the OBR's main report on Wednesday at 11.45am by replacing the word 'March' with 'November' in the web address for the previous edition.

Five minutes earlier, the news agency Reuters began sending out one-line news bulletins summarizing the contents of the report.

This was followed by a brief period of volatility in the UK bond and currency markets.

Gold yields, which provide insight into the cost of government borrowing, fell sharply and then rose again above the level they had been at before details were leaked.

Mr Hughes acknowledged the “deep failure” caused and said he accepted responsibility “on behalf of the OBR” for “inadvertently allowing” early access to the document.

Asked on Wednesday whether he would resign, he said: “I made a statement to you, that's all I can say.”

Reacting to the leak in the Politics Live studio, BBC political editor Chris Mason said: “The sheer absurdity of reading out something that the Chancellor has not yet announced in the Commons is staggering.”

BBC economics editor Faisal Islam said: “I think I need a red box, I can present the budget right now in the studio… It has all the indicators, it has all the important statistics that we have just been thinking about.”

The surprise release sparked a reaction in the House of Commons as Prime Minister's Questions (PMQs) began, with Reeves looking at her phone with concern before Finance Minister Thorsten Bell, who was sitting behind her, handed her his mobile phone as the news broke.

The notes were passed around a number of cabinet ministers before Chief Secretary to the Treasury James Murray held his phone to Reeves and she wrote down a few words at the start of what appeared to be her budget speech.

Conservative MPs quickly began posting pages of the document on social media, with Tory party leaders, including shadow chancellor Mel Stride, whispering and taking notes.

Stride then called a point of order to demand an investigation into the leak, saying: “It is absolutely outrageous that this happened and this leak may constitute a criminal act.”

There have already been weeks of leaks and speculation about the policy in the media in the run-up to the budget, for which the chancellor was reprimanded by Deputy Speaker Nus Ghani.

While this is the first time the OBR has made a mistake like this, it is not the first time a portion of the budget has leaked out before it should have.

Back in 2013, the Evening Standard newspaper mistakenly published George Osborne's budget details before he found his feet in the House of Commons, including details of important tax announcements.

The then Labor leader Ed Miliband read a photocopy of the front page as Osborne spoke and said the chancellor “almost didn't have to bother coming” to the Commons.

In 1996, the Daily Mirror was sent the full contents of Chancellor Ken Clarke's budget ahead of his speech.

Piers Morgan, who was the newspaper's editor at the time, published only some of the details in the paper the next day and sent the rest back to the Treasury.

At the time, Prime Minister John Major ordered an investigation into the leak and the Metropolitan Police investigated, but no one was arrested.

In 1947, Labor Chancellor Hugh Dalton was forced to resign after giving details of the budget to a journalist before making his announcement.