The net appears to be closing in on the National Party as the likely source of the leak of Simon Bridges' expenses to Newshub.
Newshub can reveal Parliament's Speaker ordered his own inquiry into the leaking of Mr Bridges' expenses to clear himself and his staff.
Speaker Trevor Mallard confirmed an IT expert and employment lawyer were brought in to forensically go through phone records, email records and printing activity of about 20 parliamentary staff, including Mr Mallard himself.
- Simon Bridges won't commit to sacking expenses leaker
- National's leak investigation widened to include staff
- 'Please tell me' who leaked my expenses - Simon Bridges
Newshub's political editor Tova O'Brien was leaked Mr Bridges' expenses. Newshub raised concerns with Mr Mallard about protecting sources and the privacy of journalists' communications.
In assuring Newshub there was no way O'Brien's texts or emails were caught up in the investigation, Mr Mallard confirmed he had conducted the separate investigation.
The Speaker cancelled an initial broad QC-led inquiry into the leak out of concern for the leaker's mental health, but pushed on with his own investigation following accusations from Mr Bridges that Mr Mallard was the source of the leak.
Simon Bridges also commissioned his own inquiry, PricewaterhouseCoopers (PwC) is investigating whether the leak came from within National's caucus or from a party staff member and is expected to report back this week or next.
Newshub has sought assurances from PwC that O'Brien's communications as a journalist would not be caught up in that investigation.
Mr Mallard's inquiry was conducted by major auditor KPMG and found "there is no evidence the expense document was sent to any unauthorised parties via email... That scanning, printing and photocopying logs confirm that there is no evidence of the expense document being printed.
"On the basis of this independent review there is no evidence that staff in the Office of the Speaker, Mr Speaker or Parliamentary Service finance and corporate staff released details of this quarterly expense disclosure report to any unauthorised parties."
Parliamentary Staff in National MPs' offices, including staff in the National leader's office and in Deputy Speaker Anne Tolley's office, were excluded from the investigation.
A privacy waiver signed by Mr Mallard shows emails containing keywords and phrases, or containing an attached Members expenditure file would be extracted and interrogated. The keywords the inquiry was sought were: 'Expense claims', 'Simon Bridges', 'Financials' and 'National Party'.
Text messages and calls to or from a certain number would also be collated, as well as logs of printing and photocopying activity.
Soon after the leak to Newshub in August, finger-pointing began - with National claiming the leak came from either the Speaker's office or Parliamentary services. The Speaker called for an inquiry, which was called off after Mr Mallard said evidence indicated it was a matter for the National Party.
A text sent to Mr Bridges, Mr Mallard and Newshub asked for the inquiry to be abandoned, citing ongoing mental health issues. The leaker's text provided three specific details of closed-door National Party caucus meetings, with the author saying "I am in your caucus" and "I can prove this".
It is entirely possible neither investigation will find the leaker.