It was shortly after midnight on August 20 when a former submariner turned political staffer stood in an Adelaide office and scanned copied pages of classified Indian submarine plans.
A little over a week later, details of the leak were splashed across the front page of a national newspaper, triggering an international furore that embarrassed India and the French government-owned submarine builder DCNS. It also sparked questions in Australia about whether our $50 billion submarine building program could be fully secure under its partnership with DCNS.
Fairfax Media can now reveal the man who triggered the storm was Rex Patrick, an adviser to the powerful South Australian crossbench senator Nick Xenophon. It can also be revealed the Senate kingmaker knew what his staffer was doing and supported him.
The leak of thousands of pages of information about the Indian Scorpene submarines included stealth capabilities and sensitive data related to diving, sonar, noise and the combat system. The plans had been swiped from Paris in 2011 by a contractor before making their way to Australia via Mr Patrick.
A Fairfax Media investigation has also discovered Mr Patrick tried to tell the Department of Defence in 2013 that DCNS had suffered the major data breach, but the senior navy officer he spoke to did not act on the information. It is understood Mr Patrick spoke to the officer for about five minutes in an office in Parliament House and even showed him some of the files on a computer disk.
That disclosure is likely to cause considerable concern in Paris and New Delhi, both of which remained ignorant of the 22,000-page data breach for three years until The Australian published news of its existence. DCNS did not know one of its own contractors had, without authorisation, walked out with the classified documents, while the Indian government remained unaware that sensitive blueprints for its future undersea capability were roaming the world and vulnerable to rival governments.
Mr Patrick's eventual decision – announcing to the world via a newspaper leak that one of the world's premier makers of cutting-edge submarines had suffered a massive data breach – has sparked a major investigation to find out how the episode unfolded, who was behind it and what their motives were.
Mr Patrick declined to comment to Fairfax Media. Senator Xenophon said he was made aware of the classified documents "only several days" before news of the leak was published.
"I believe it was very much in the public interest that the data breach be revealed publicly ... I consider the person who disclosed the existence of the data breach to have behaved, in all circumstances, in a highly ethical and appropriate manner and in the public interest," he said.
Mr Patrick did not leak the 22,000 pages of documents to The Australian, but alerted the media organisation to its existence along with a few redacted sample pages to prove the breach was real.
Metadata on one of the redacted documents posted as a PDF file on the paper's website lists the creator's username as "patrickr". The metadata also shows the documents were sent from an office in Adelaide, which Fairfax Media believes is Senator Xenophon's electorate office.
Senator Xenophon came out the day after the leak story caused a political furore and called on the government to consider "suspending negotiations" with DCNS until the breach could be fully investigated.
The Indian Scorpene submarine files marked "Restricted" appear to have originally been taken from DCNS in France in 2011 by a former French naval officer who was working for the firm as a contractor. The assumption is that he and a French colleague then took a contract with the Kuala Lumpur firm Quantum Ark Technologies to train the Malaysian Navy.
But the Frenchmen fell out with their firm's owner and they were locked out of the company's premises and unable to retrieve their work possessions, including the Scorpene files.
It is those two men who will be the main targets of the French investigation and could face prosecution and jail. Their whereabouts are unknown. Nor is it clear whether Quantum Ark Technologies knew at any stage they had stolen classified documents on their premises.
The firm refused to comment.
Mr Patrick took over the training contract with Quantum Ark Technologies in 2013 and effectively inherited the Frenchmen's office, including a disk with the classified files.
Despite knowing that he was in possession of stolen classified material, he did not try to alert DCNS directly or return the files to the company. Then working for shadow defence minister David Johnston, Mr Patrick did, however, give a visiting senior navy officer in Senator Johnston's parliamentary office a basic briefing on the material. Somehow, Mr Patrick was not clear or forceful enough to convince the officer – who was not working on the future submarine program but is understood to have had knowledge about submarines – of the significance of the material.
Mr Patrick followed up with a brief inquiry with the officer as to whether he would grant Mr Patrick's requested anonymity in taking the matter forward but nothing further came of it. Fairfax Media understands the naval officer volunteered the information he had been told of the documents three years ago after the news reports broke in August.
It remains unclear why Mr Patrick did not pursue the issue harder with Defence in 2013, or why, when he decided to revive the matter in 2016, he went anonymously to a newspaper rather than having Senator Xenophon go public with proof that Australia's new submarine partner has had data security problems in the past. Senator Xenophon declined to answer specific questions on these matters.
One question that has lingered is whether other forces have been at play to undermine DCNS. French authorities are understood to believe there were other interests exerting an influence. The company's global head, Herve Guillou, has suggested commercial rivals had a hand, calling the leak "economic warfare".
Several sources have told Fairfax Media that Germany's TKMS – which lost to DCNS in the Australian bid – has been carrying out its own investigation.
Intriguingly, the metadata on one of the PDFs that Mr Patrick created on a Konica Minolta printer in Adelaide shows that a little after that document was created, it was altered in Europe before being sent back to Australia. The time stamp is GMT+2, which is the time during summer months in both France and Germany.
Former Indian Navy officer and now defence scholar with the Observer Research Foundation, Abhijit Singh, said Indian officials have concluded the material isn't as incendiary as they first thought and relations between India and France were robust enough to get past the embarrassing episode. But he said it could help kill off New Delhi's plans to buy three more Scorpenes at a cost of about $2 billion.
Mr Patrick is not being investigated by Australian authorities. It is understood he has not been stripped of his security clearance with Defence, which he has held as a contractor and navy reservist.