- Compile a masterlist of every document referenced in Hager’s book
- Sort them into groups – e-mails, faxes, etc
- For the e-mails record down when each e-mail was received, and when it was deleted if it was. This will provide a window of time as to when the theft occured.
- Also for each e-mail record who has access to it. Who was cc’d or bcc’d it. Who had access to a printed copy.
- Look for common patterns in access, to try and narrow down which e-mail account or accounts were probably accessed
- Look at the date of the final document used in the book. It is likely the theft took place soon after that.
- Obtain staff lists for National during that period. Look especially at anyone who joined just before the thefts occurred.
- Obtain swipe card records for the Leader’s Office for the period just after the final documents cited.
Tracy Watkins from the Dom Post reports that the Police appear to have reopened their investigation, which is an implicit acknowledgement of the failings of the original investigation:
Police have been interviewing parliamentary cleaners and security guards after reopening their investigation into the Don Brash email files.
A team of up to four police officers has been involved in the investigation which is understood to have been reopened several weeks ago after Police Commissioner Howard Broad put one of his top officers, assistant commissioner Steve Shortland, in charge of reviewing the Brash file.
MPs and parliamentary staffers are expected to be interviewed as well. It is understood the Independent Police Conduct Authority is also investigating after a complaint from Dr Brash.
I’m not sure whether the investigation will reach any conclusions, as the theft happened around four years ago, but it is pleasing to see they are at least trying.