Govt pleads ‘no defence’ on #Irish #cybersecurity

This week’s Broadsheet.ie column revisits the issue of #CyberSecurity. In it I look at three specific aspects:

The gaps in Ireland’s cyber security strategy and
The critical role the Irish Defence Forces should play in delivering that strategy
The opportunity this presents for Ireland to be a centre of excellence within the EU on cybersecurity

Several times over the past few years I have written about the need for a mature and grown-up public debate on Irish security and defence policy.

It is why the recent initiative by the folks at Slándáil, headed by former Irish Army office, Dr Gerry Waldron is so welcome. Launched at the end of September, Slándáil has set itself the not unambitious task of generating and encourage such informed debate with a two-day policy forum/summit at DCU next February.

While the forum itself will look at a range of global and national factors from the implications of climate change to the future of the Defence Forces and of policing, much of the discussion will focus on contemporary cyber challenges, as Waldron explained in a recent interview with the Irish Times.

The pity is that this awareness of the cyber threat has not yet filtered through those with political responsibility for the defence agenda in government.

The State’s National Cyber Security Strategy is now two years out of date. It should have been updated in 2017. It wasn’t. The updated strategy is said to be ready and is only awaiting a launch date. If only it was a minor housing programme in one of the four by-election constituencies, then it would be besieged by hard-hatted ministers eager to unveil it.

As I pointed out here before, it takes “a rare political talent to make the Irish defence brief controversial, yet the hapless Paul Kehoe appears to have somehow managed it”.

A series of high-profile but exasperated interventions from Defence Forces representative organisations and an array of retired Defence Force officers have highlighted the ongoing deterioration in morale and actual capacity within the defence forces.

These public criticisms were uncharacteristic. They were not born of a desire to score points or make noise, but rather of a need to provoke the Minister and Department to act after years of exasperation at the unresponsiveness of pleas made through the usual channels.

It did appear, briefly, that their urgings were having some impact with word coming out that an inter-departmental working party including officials from the departments of Defence and Taoiseach – An Taoiseach also being Defence Minister – would be established to see examine how the chronic recruitment and retention problems besetting the Defence Forces could be tackled.

Result.?

Well… you’d like to think so, but so far it is looking like nothing has changed. The €32m “increase” in funding announced at the Budget has be viewed alongside the annual underspends of €20-25million per annum over the past few years, totalling some €140 million – most achieved by running the Defence Forces at well below their budgeted strength.

It is why no one who understands the chronic skills shortage within the Defence Forces was shocked when it was announced that the government was withdrawing the Air Corps operated air-ambulance service, based at Athlone, for 16 days between now and the end of February. The is being done for “training and staff shortage issues”. First the ships, now the aircraft.

In a rare public contribution in his other role as cabinet level Defence Minister, an Taoiseach dismissed any concerns over this cutback saying it was “only for the next four months” so that Air Corps air ambulance staff could come off service for four days per month to provide training for new cadet recruits.

This makes it sound like this is a problem born of progress, but it isn’t. There were local warnings of this happening as far back in April. The meagreness of the government’s response to the Athlone air ambulance crisis, as evidenced last week on RTE Radio 1’s Saturday with Cormac Ó hEadhra, is just one more symptom of years of political indifference on Defence.

It is an indifference that should not be measured in terms of inputs only. The solution to the current problems lie not just in simply spending more money on defence. More money will be needed, but first we need to make some decisions about the defence and security outputs we need.

The key question is what do we expect of our Defence Forces in 2020?

Ask most Oireachtas members this question and you get a long, rambling response that talks about the great role the Irish Defence Forces have played in UN peace support operations since 1958.

It is not that the answer is wrong, it is that this is only part of the answer. The Defence Forces indeed play a vital role in UN peacekeeping as leaders and participants in UN led and UN mandated missions.

We have the longest unbroken record of overseas service with the United Nations of any country. We currently have over 650 defence force personnel serving on overseas missions across 14 different countries. Given that personnel are on 4 or 6 monthly rotations that means that almost 1,700 Irish troops will serve on overseas missions this year. While this is down on the averages up to 2008, it is still a respectable figure for the Defence Forces’ off-island role.

The problem comes when you ask about the Defence Forces’ role on-island.

While these are still considerable, as evidenced by the 2018 year end report, the end of “the troubles” and development of various capacities within the Gardaí has somewhat reduced the calls on the Defence Forces to deliver its traditional ATCP (aid to the civil power) and ATCA (aid to the civil authority).

And – although units such as the Army Ranger Wing and the Ordnance (Bomb Disposal) Corps are world leaders, trained and equipped to the highest international standards – we still, in the words of UCD’s Prof Ben Tonra: “…lack the minimum conventional combat capability necessary to provide for any territorial defence based on credible deterrence.”

This is not something new and, despite my penchant for sticking it to Varadkar, not something that even I can blame on him. Successive governments have, based on the best available (military) intelligence and threat assessments, judged that we did not need fighter, attack or transport aircraft, combat tanks or heavy artillery to provide on-island defence.

Reasonable decisions, in hindsight, based on getting the greatest return on the money spent.

But what of the future?

Has the threat changed? In a word: yes.

Ireland is now strategically important to Europe’s digital economy. As I have said before, up to 40% of the EU’s personal data is stored here. This makes us an increasingly important target for a range of malign actors, state and non-state. We are now the sixth most cyber attacked country in the EU.

The presence of so many global IT giants here has put Ireland at the nexus of a cyber security threat, into which the Irish State is operating with virtually no virtual protection capacity of its own.

The tech corporations see the threat and prepare accordingly, but they protect themselves – the bits in between, the critical pieces of national infrastructure such as hospitals, transport and information systems are the responsibility of the State.

Last month’s World Economic Forum survey of global CEOs reported that cyberattacks are now seen as the second biggest global threat to business. Cyberattacks are the number-one risk for businesses in the US, Canada, the UK and Germany and have edged out all other risks in France and Italy to be their number one concern for the first time.

Meanwhile EU leaders, including Merkel, Juncker and Macron want the EU to develop its own data and cloud services to counter the US and China’s dominance of the global digital economy.

This would mean more business for Ireland, but with that business comes more risk – yet that risk comes, in turn, with huge potential for Ireland to be a world leader in cyber security, particularly in training the next generation of cyber security specialists.

The critical importance of the IT and digital sector to the Irish economy makes cyber security a national defence issue. The Defence Forces have a key role in delivering this key element of on-island defence, along with a range of other State agencies.

To do this they must have the resources and capacity and to achieve this they must have the policy framework and political leadership they have not been shown in almost a decade.