The Context
On 23 February 2026, a 72-year-old man, the UK’s former ambassador to the US, was arrested on suspicion of misconduct in public office. The Metropolitan Police executed search warrants at two properties. The trigger was evidence from the US Department of Justice’s release of the Epstein Files: approximately 3 million pages. Two specific emails are in evidence. On 13 June 2009, the subject forwarded internal Downing Street emails to the convicted sex offender, detailing tax policy and potential £20 billion asset sales. On 10 May 2010, he allegedly tipped off the same individual about the Prime Minister’s planned resignation hours before the public announcement. This is not an isolated lapse. It is a systemic breach.
The Risk
This is a textbook case of a senior officer failing in their duty of fidelity and good faith. For a New Zealand director, the parallels are stark. Under the Companies Act 1993, directors owe duties to act in good faith and in the best interests of the company, and to exercise reasonable care, diligence, and skill. Knowingly or recklessly disclosing confidential, market-sensitive information to a third party—particularly one with a criminal conviction—may constitute a flagrant breach of these duties. The Health and Safety at Work Act 2015 extends a duty of due diligence to officers, requiring proactive steps to manage risks. A culture that permits or ignores such elite misconduct creates a profound psychosocial risk to the organisation. Directors may be personally liable for penalties under these Acts if they fail to establish and enforce a governance framework that prevents such abuses of power and position. The maximum penalties are severe.
The Control
Governance must be weaponised against elite exceptionalism. The board must mandate and audit a strict, tiered information security protocol. This protocol must apply without exception, based on role and data sensitivity, not on seniority. Implement a ‘three lines’ model for integrity: first-line managers enforce policy, a dedicated internal audit function tests for breaches, and the board’s risk committee receives unfiltered reports. Treat confidential information as a controlled substance. Track its access and dissemination with the same rigour as financial assets.
The Challenge
These are the critical questions you should be raising at the board table:
| When was the last time our internal audit team conducted a forensic, privilege-agnostic review of all senior executive external communications for potential breaches of confidentiality or conflicts of interest? | |
| Does our directors’ and officers’ liability insurance policy contain specific exclusions for acts of misconduct, fraud, or deliberate breach of duty, and would it respond to a claim arising from the type of conduct alleged here? | |
| What concrete, auditable evidence can the executive team provide that our ‘speak-up’ culture is effective at the most senior levels, and that no individual is considered beyond the reach of our integrity policies? |