Senator Gerard Craughwell- speech from 22 Sep 2021

Thank you for being here today, Minister. At the outset, I want to compliment you for taking on board the issue of cyber security, but I believe that we need to start taking this from a much more macro perspective. We should compliment the Gardaí for reversing some of the damage that was done with the HSE. But, Minister, I want to put to you a few moments ago you said money was a bit of a red herring. I am absolutely appalled to hear you say that. I see Malta is scheduled to spend £1.9 billion on cyber security over the next six years. That is Malta, one of the smallest countries in the EU. So, to say that it is a red herring, I am afraid it really does not go down well with me. I want to compliment the Chairman and my colleagues for agreeing to bring in a human resource expert here. Because the money that you were offering for the director of cyber security that your department was offering was a joke. No serious professional would come anywhere near this country, which suggests to me that security, and I have said this many times, security in this country, whether it is cyber security or internal security or external attacks, it is a joke. We do not take it seriously. Now, you are trying to change that, but Minister, if you are going to change that, you are going to have to see a budget that will support it. 13.8 million between 2017 and 2021 on cyber security. Where are we going? At the end of the day, it is a joke. Now, as we move forward, we need, and I have said this a hundred times, we need an integrated intelligence agency under a director of intelligence that would bring together all of the different intelligence gathering agencies of the state. That includes Garthee, Defence Forces, Department of Social Protection and the Department of Communication. We need them all under one umbrella where they are sharing information and that we need to know what is happening. We take issues like cyber security with a grain of salt. We had, in the last few weeks, word of a minister's phone being hacked. It just sort of breezes past everybody. Church was nothing really to get too excited about. Are your phones, Minister, and maybe you cannot answer this today, but are your phones protected properly? Do you have encrypted telephones? If you do not, we should have encrypted telephones. We are a central location for foreign direct investment and we control some of the largest volumes of data in Europe. We are talking about 30 people in cyber security. There should be hundreds in cyber security working in cyber security. When you look at the United States with almost a million people working in cyber security. When you look at Estonia, which we would be looking down our nose at a few years ago as a much poorer country than Ireland, and their reputation in cyber security. My colleague, Deputy O'Muricu, spoke about the issue of defence forces and the issue of legislation. We see last night on the TV how the Graeme Dewire case may limit the capacity of the Gardaí to actually get involved in counter-espionage or counter-intelligence. That is outrageous. It is absolutely outrageous that that might happen. We see that we have ships sailing up and down the Atlantic coast coming very close to the 12-mine limit, where they are capable of intercepting data that is travelling from the United States into Ireland. Now, look, there are 3.5 million positions open in the world in cyber security. With 3.5 million positions open, Ireland is going to have to compete, and to compete we are going to have to put billions into cyber security. We will not have foreign direct investment here in a few years' time if we start seeing cyber security attacks. I cannot understand it, but I have my own beliefs on it. Since we all started to register for the pandemic and Covid on our mobile phones, we are inundated with attacks from all sorts of crazy... I get a dozen phone calls a week from the Department of Social Protection and I no longer answer them. I will not answer any number now where I do not recognise the caller because I am sick to the teeth of it. But, Minister, I want to ask you, you are going to be going in front of Minister McGrath and the Cabinet in the next few days. Do they fully understand the impact on foreign direct investment if they do not invest in cyber security? There is clearly a lack of understanding of what is required. In fairness to you, Minister, after you saw the HR expert Blonnet Carolyn talk about a salary structure of £220,000, you clearly fought the battle and got as close to that figure as you possibly could. And hopefully we will get somebody really good into it. The problem we have with 3.5 million vacancies in the world, are we going to become a training centre for people who are paid poor money, who will move to higher paying economies as soon as they are trained? I am really concerned about this. I know this committee has taken a huge amount of time to debate these things and I thank the chairman for it and I thank you for being here. Minister, is cyber security and security in general a joke? Would you agree with me that we need a director of intelligence and that we need one single intelligence agency? I am shocked to hear that we have only one Defence Force member in the National Cyber Security Centre. It should be run by the military like most cyber security organisations in the world. So, I will throw that over to your Minister and I might come back with one or two supplementaries. Thank you very much, Senator Crockwell. I will start by saying I am not aware of any cyber security centre in the world that is run by the military and ours is not run by the military, although it does have military assistance which is very valuable as input. The salary, I think, to talk about the director and is there enough money to pay the person. The director who is to be appointed on a salary of €184,000, that job is not directly equivalent to a chief information security officer working for a big tech company. It is a different job because it has different responsibilities. It will have a different day-to-day working and they are not directly equivalent. There are different benefits to that job and there are different responsibilities. Minister, just at that point, will you bring in experts in recruiting for people in cyber security to assist in the recruitment process? Thank you. Thank you. In short, we will bring in experts. That was the plan. We will bring in experts to this process and the Board itself also has expertise, but we will bring in external experts to that area. Can I go back to answering Senator Crockwell's question? Yes, absolutely. Senator Crockwell mentioned the idea that we should have some kind of overall head of all the different parts of cyber security, cyber defence across the different branches of the government, military, police and so on, and some kind of coordinating role. In fact, we do have that. It is called the National Security Analysis Centre and it is based in the Department of the Taoiseach. Let us see what else we have here. Senator Crockwell asked if my phone is encrypted. It is encrypted. I think that is a basic security measure to make sure that phones are encrypted, if they are stolen, that the data can be taken off. Can I interrupt you? If cabinet members' phones are encrypted and we have had one hacked, does that not create a massive national security question? We are talking here about the HSE for the last half an hour or thereabouts and the impact that has had. If you can hack a cabinet minister's phone, just think, off the top of your head, the number of people's telephone numbers you would have had. Not just nationally but internationally, the text messages that would be exchanged between cabinet members, the text messages that would be exchanged between ministers across the EU. I find it absolutely beyond belief that we have had a minister's phone hacked and that absolutely nobody seems to mind about it. It is grand. It is all fine. We take security as a joke in this country. Senator Crockwell, in terms of the security incident with Minister Coveney's phone, his phone was encrypted. The security incident was reported to the National Cyber Security Centre. I can assure you they took it extremely seriously as a matter of national security. Senator Crockwell, in terms of national security because he is the Minister for Foreign Affairs. In no regard was this treated as a trivial matter. All the correct statutory things were done to respond to that incident. I think that is all I have to say about that. I will move on to the question about the Graeme Dwyer case and the legal implications for intelligence gathering. Mr. Minister, just be careful about any live legal case, just in terms of your comments, just by way of observation. Thank you for the reminder, Chair. So just to say about that, that is, in fact what I was going to say, Chair, was that that is a live case and that the case has not yet been decided and the implications of it are unknown as yet. I can tell you that scenario planning is of course done, but it is a live case and I cannot comment on it. I do not know how it is going to turn out. It is the reality. In fairness, Minister, I was not asking you to comment on the Dwyer case. It was the concept that when we are talking about security, you will know this. For example, in the development of antivirus software, we are always chasing the criminal. In the interest of consistency, we are always chasing the criminal when it comes to any sort of criminal behaviour, just as we are chasing hardware when we are trying to develop the latest software. So these are serious, serious issues and things like ethical hacking and things like that need to be proactive in the country if we are to be sure and safe. That would apply to the schools my former colleague Deputy Crow was talking about. In the college I worked in, Black Rock, and I know you know the place well, we spent anything up to 100,000 a year on computer hardware, antivirus software, cyber security systems. I know every school would not have that advantage. By the way, mine was a VEC school, not a private school. From that point of view, look, I have taken enough time. No, no, it is just Minister, if you have concluding remarks for Senator Crockwell's questions. Yes, certainly. One of the questions that Senator Crockwell asked was whether the Cabinet understood the seriousness of cyber security with reference to FDI. And, you know, this is an issue that the American Chamber of Commerce and other lobby groups for multinationals bring up is that they want to have a secure environment in which to locate their data and do business. And so that that is that's completely understood. So, you know, in general, I want to say I think I think the gist of of what Senator Crockwell is saying is that he is concerned that cyber security is not being taken seriously, that there aren't adequate resources being given to us and that it isn't understood within government how important it is. And I am I'd like to reassure him that that none of that is true, that that everybody understands how incredibly important it is to protect our national assets and our critical infrastructure and that there are huge costs to being attacked and that we have to do everything we need to do to have the best in class of cyber security protection. Yeah, I think it might be to ministering that every part of that may happen and so on. It is doesn't national, obviously. That's got it. Not so much care. Pleasure! It has probably been totally cáracked through the warning of the security system of it that that nelle come up in that Pranoke communications at producing years, at sea, at other where it is about whatrick was included in the regular communication system in other的时候國家? We will not ד down sign up in the banking system from that. Very quickly. Give us a doubt to PPE in the kind. Yes, it well, thank you. Very quickly, very quickly Ruy. Memory, absolutely I think we'll do this for a large name in the campaign for country but that don't land because