'Privacy v safety' compete in battle against cyber peril

There are 500 cyber companies in Ireland with 730 offices, 398 in Dublin. In terms of population, there was a “very concentrated cluster” in Cork, with 131 offices, with 86 in Belfast, 38 in Galway and 31 in Limerick.

Trust and information-sharing between the State and industry is crucial in combating cyber crime — but data protection restrictions and security considerations pose limits to that cooperation, a cyber security conference has heard.

Research revealed at the conference, organised by Cyber Ireland, also shows there were around 500 cyber companies in the country, some five times more than some previous estimates.

The companies, around half of them Irish, had the largest presence, per head of population, in Cork with Dublin having the greatest number of such businesses.

Cyber chief at AIB, Nicola O’Connor, told the conference that collaboration was “key” and said Irish banks were at the early stages of setting up a platform to share data and information.

Steven Wilson, chief executive of Cyber Defence Alliance, which works with 12 UK and Irish banks, said the “big issues” in tackling the cyber threat were trust and information-sharing. He said law enforcement and industry each had “different pieces of the jigsaw” and he wanted to see them pooling data to maximise the number of jigsaw pieces.

Mr Wilson said data privacy was a big challenge and said there was a need to change the paradigm between privacy on one hand and safety and security on the other hand.

The former police officer added: “I'd like to see joint industry and law enforcement task forces to tackle the biggest [cyber] groups that are out there, to go after them, because we can’t continue to defend all the time.” 

Detective Chief Superintendent Paul Cleary of the Garda National Cyber Crime Bureau said collaboration with industry was very important to ensure the “consistent sharing” of the latest data threats and trends.

He said this had to involve “prompt reporting” by companies hit by a cyberattack and “prompt access” to evidence, adding that some companies didn’t report for reputational reasons.

He also said they “can’t go sharing information with everybody” as their job was criminal investigation and that some intelligence couldn't be shared. “At the moment our circle is fairly small," he said, "but we are available to help people.” 

Richard Browne, acting director of the National Cyber Security Centre, said they do live information-sharing “all the time” with companies.

“This is a team sport,” he said. “Unless we engage everyone, it won’t work.” 

But he too said the NCSC had to strike a “delicate balance” in terms of what it can, and cannot, share.

Mr Browne said data protection laws were “obviously an issue” and pointed out that a lot of threat intelligence includes an IP address (identifying a specific device), which, in some cases, can be considered personal data, meaning sharing it can be problematic

Sam Donaldson, director of Perspective Economics, said they had identified 500 cyber companies in Ireland, employing around 7,500 people 

He said these firms had 730 offices, 398 in Dublin. In terms of population, there was a “very concentrated cluster” in Cork, with 131 offices, with 86 in Belfast, 38 in Galway and 31 in Limerick.