LAST UPDATE | 25 May 2021

THE NEW DIRECTOR of the National Cyber Security Centre should be paid a salary of between €220,000 and €290,000, an Oireachtas committee has heard. 

Four leading cyber security experts spoke to the Oireachtas Committee on Communications about Ireland’s latest cyber attacks on the HSE and Department of Health, detailing the skills needed to ensure breaches do not happen again. 

The National Cyber Security Centre (NCSC), an inter-agency body which involves among other experts the Defence Forces and the gardaí, has been the lead agency on identifying who launched the attack. 

The role of director at the NCSC is currently vacant. 

Speaking to the committee this morning, cybersecurity recruitment specialist Blathnaid Carolan said the “seniority and accountability” of the director position “cannot be understated”. 

“This role demands the best in class hire, meaning we must provide every opportunity to the National Cyber Security Centre to hire the very best, most qualified proven candidate or one who’s capable to deliver on an international level,” Carolan said. 

She outlined that the role should be benchmarked with the private sector and should see a salary of between €220,000 and €290,000, with an additional benefits package ranging between €150,000 and €200,000 per annum.

“Everything hinges on getting this hire right to ensure a sustainable and secure success of the National Cyber Security Centre,” Carolan added. 

The government has come in for criticism since the attack on the HSE over its record on protection from cyber attacks, which Aontú leader Peadar Toibin last week said was “shockingly poor”. 

Speaking at Leaders’ Questions last Tuesday, Toibin criticism the €5 million budget given to the NCSC last year. 

In a statement before today’s committee, O’Donnell said the recent cyber attacks on the HSE and the Department of Health were an unprecedented assault on our public services and a threat to Ireland’s national security.

“It is critical that we understand how these attackers gained access to the HSE systems so that our national cyber security experts can develop the skills and tools needed to ensure such breaches cannot occur again,” he said.

He added that members look forward to gaining some insight from the experts in the field about the nature of the threats we face and what can be done to secure other government departments and state agencies from similar cyber attacks in the future.

Speaking yesterday, Taoiseach Micheál Martin said there is no evidence yet of the mass dumping of information, but he said the gardaí, the cyber-security teams and the HSE are working together and scouring for any evidence of the leaked information. 

Related Reads

Gardaí urging people to contact them if they believe their data was shared online in HSE hack

Explainer: What is a decryption tool and why would hackers hand it over without receiving a ransom?

He said the authorities are monitoring it all “very, very closely”.

Martin said if anybody has any suspicions or if anybody comes across any data, they shouldn’t share it but should report it to gardaí.

Last week, the HSE obtained a high court injunction which means it is a criminal offence to share or redistribute HSE patient data. 

The Taoiseach said he did not know why the government was given the decryption key that has unlocked and allowed a number of health services to resume.

He reiterated that a ransom would not be paid, but added that the hackers may not have realised that they had taken on an entire State or government or health service, adding that the data is “perhaps where they see some value”. 

“These are criminals who will seek to exploit this data, but again, we’ve had very good cooperation with social media companies who’ve been very proactive with the government in relation to this and have agreed to shut down anything and take it down as quickly as they see anything,” said the Taoiseach.

With reporting by Hayley Halpin