GCHQ offers help to embryonic Irish cyber security organisation

The head of the UK’s National Cyber Security Centre (NCSC), Ciaran Martin, spent much of last week in a very public barnstorming of Ireland’s nascent cyber security institutions.

Speaking to a forum at the Irish International and European Affairs Institute in Dublin, he said: “We are trying to work out cooperation at all ends – the most serious threats to the state, the most serious criminal conspiracies, and then more general harm to society.”

Martin, who comes from Northern Ireland, also saw Irish defence chiefs in private to discuss how best to assist their security build up. This is rumoured to include an offer of more than €5m to beef up the Irish national Cyber Security Centre.

The Irish national Cyber Security Centre is currently based in University College Dublin under the aegis of the civilian Department of Communications, and has only 14 staff. Martin said the UK equivalent, the NCSC, has more than 850 staff and a budget of £250m. He did not mention GCHQ, with its 5,800 staff and £2.6bn-plus budget.

Despite the disparity in resources, Martin was talking to the converted. Two different Irish Government reports, one from the Policing Commission and the other from the Comptroller and Auditor General, recently recommended that the Republic of Ireland – which will remain in the EU when the UK leaves next year – should develop its capacity, both with the Gardaí (police) and the Irish National Cyber Security Centre.

The report from the Policing Commission warned that Irish Governmental institutions infrastructure and companies are “all at risk” from cyber attacks, as are “the many foreign tech firms based here that are important to the economy”. Ireland has benefited enormously as companies, especially American companies, shy away from Brexit London and set up in Dublin.

Dublin Docklands is dominated by the huge Google building, and Facebook is expanding its large Dublin HQ close by. The Irish high-tech sector currently has 12,000 vacancies for highly trained staff, and unemployment in Dublin is virtually non-existent – however, there is a big shortage of houses for the new arrivals.

The Policing Commission also recommended the appointment of a new Irish national security co-ordinator, and said that a comprehensive national cyber security strategy should be published.

The Comptroller and Auditor General report noted that the top-level government committee tasked with developing cyber security policy “had not met since July 2015”.

Less openly discussed during Martin’s visit were the number of supercomputers in Ireland, all in private companies. With seven supercomputers, Ireland ranks 9^th in the top 500 list of countries with the most advanced computers, ahead (at least officially) of both Russia and Saudi Arabia, each with a mere 4 ranking supercomputers. Five of Ireland’s clutch of seven machines are Chinese Lenovo products.

When warning of the danger of cyber attacks from Russia, Martin was careful to avoid mentioning China. The build up of Chinese machines so close to the UK will have interested Martin’s bosses at GCHQ, where he is a board director of the larger body. 

Cormac O’Keefe, the security correspondent at Irish national newspaper The Examiner, covered Ciaran Martin’s visit, and the paper enthusiastically endorsed the proposed link up. 

In a statement to Computer Weekly, the Irish Defence Department said: “The NCSC, like other similar bodies, has a number of roles with regard to industry in general, such as implementing the European Union’s Network and Information Systems Directive, which among other things provides for a special security regime for so called digital service providers (or DSPs).

“These include online sales platforms, search engines and cloud computing companies, which are designated by definition under the directive, and subject to a set of security measures set out in a separate EU Implementing Act. The NCSC is finalising regulations to ensure these obligations are met.”

The Irish Defence Department added: “No offer of funding had ever been made by any such entity [UK NCSC] and the NCSC remains entirely funded by the Irish Exchequer.”

The sum of this seems to be that Ireland is sticking with the EU and will keep the UK NCSC at arm’s length, particularly when the UK leaves the EU next year.

In the UK, GCHQ is the core of the three UK intelligence and security organisations – the other two being M16, which deals with UK foreign intelligence, and M15, which deals with internal UK security. All three have had sometimes tense relations with the Irish Republic, having been involved in activities in Northern Ireland during the Troubles.

The Republic itself has just one very small intelligence organisation, J2, which is based at the Department of Defence, but works closely with and is a joint structure with the Gardaí. Martin saw the current head of J2 as well as Gardaí chiefs during his visit.

Behind the scenes, there was also tensions over American mass surveillance in Ireland. While Martin was in Dublin, the Supreme Court was examining a bid by Facebook to get off the hook of an Irish High Court finding that Facebook engaged in “mass and indiscriminate surveillance” in the Republic of Ireland and the EU. Facebook was found to be acting as an agent for the US National Security Agency, which is a close partner of GCHQ.  

Earlier this year, the Irish Government was forced to remove the Irish mass surveillance act from the statute book, following a critical report from the former chief justice of Ireland, judge John Murray. He had condemned the act, placed on the statute book under intense American pressure, for innumerable breaches of the European Convention of Human Rights, to which both the Republic of Ireland and the UK are signatories as members of the Council of Europe, which is not part of the EU.