Neutrality is not a shield: Ireland is not ready for the next spy
Planning permission for a fourfold expansion of the Russian embassy's Orwell Road compound, underground element included, was granted in 2015. It was then revoked in 2020 by the housing minister, using national security legislation, on the grounds that the development was 'likely to be harmful to the security and defence of the State'. File picture: Brian Lawless/PA
When a civil servant was charged over an alleged leak of confidential material to a foreign intelligence service, the reaction was shock. It shouldn't have been.
Security and defence experts have long warned that Ireland's vetting, classification and counter-espionage law lag dangerously behind, and that this would eventually produce a headline.
This case, whatever the verdict, will not be the last. It may well not be the first either: they simply weren't caught with their hand in the cookie jar. Experts like Dr Ed Burke of UCD have been saying as much, and he was unsurprised by the allegation.
Across Europe, espionage linked to hostile states, Russia chief among them, has spiked sharply in recent years. Ireland, with its technology multinationals, intellectual property and seat at the EU table, is not a peripheral curiosity to a foreign intelligence service. It is a target of real and growing interest.
There is a comfortable myth here that neutrality offers some kind of shield. It doesn't. Even famously neutral Austria has seen its own sharp rise in espionage activity in recent years.
If anything, Irish neutrality functions less as protection than as a soft back door into the European Union: a state wrongly assumed low in intelligence value, sitting inside institutions watched far more closely. "Sure, who'd bother with us" is precisely the complacency that makes a country worth bothering with.
The legislative architecture meant to catch this kind of activity is not fit for purpose. The Official Secrets Act is decades old, and it is telling that the State's first instinct was to charge this case as computer misuse and fraud, only adding Official Secrets Act counts later, alongside a Data Protection Act breach and a corruption charge.
It looks like a scattergun approach, suggesting prosecutors themselves are unsure which law actually fits.
Communications interception law is similarly dated, though it is being updated. Less visible, but just as damaging, is the absence of any coherent system for classifying sensitive documents. Standards vary department to department, described by more than one observer as simply ad hoc.
Anyone who has served on a UN, EU or NATO mission, civilian or military, will recognise the contrast: proper classification from UNCLASSIFIED to TOP SECRET, and a hard air gap between mission networks and the open internet. In other words, you cannot send a classified document to your Gmail account.
But the deepest failure, and the one that ties everything else together, is vetting.
Ireland has been extraordinarily slow to build a modern vetting system for people with access to sensitive State material. What passes for vetting across most of the public service is a Garda PULSE check for a criminal record, a role at the bottom of a matured system, not a substitute for one.
The United Kingdom has operated a formal vetting regime for well over a century. Ireland has no equivalent; only the Defence Forces and Gardaí run anything like the intensive, background-and-pattern-of-life checks used elsewhere in Europe.
There is no centralised, Department of the Taoiseach-administered vetting process for the wider civil service, and no advanced vetting for Oireachtas members, unlike EU counterparts vetted specifically to sit on intelligence and other nationally or politically sensitive oversight committees.
When politicians suggested last year that this could be fixed within six months, the claim did not survive contact with how long other states have taken to build systems that work.
If it has taken the UK a century to arrive at where it is now, six months was never a serious estimate. It spoke to a failure of government to grasp the scale required, resourcing included.
The consequences of that failure are already visible. Ireland's international partners are, by several accounts, reluctant to share sensitive information even with senior officials, simply because they cannot be sure they've been vetted.
That produces a siloed relationship, trust built person by person, not institution by institution. The timing could hardly be worse as Ireland holds the EU presidency, with an unusually large volume of confidential material moving between Dublin and Brussels.
None of this happens in isolation. In conversation with Professor Andrew Mumford of the University of Nottingham, a similar picture emerges from a different angle.
Hostile states no longer treat espionage, disinformation, sabotage and cyber activity as separate operations; they run them as one co-ordinated hybrid-warfare campaign, pitched below the threshold that would trigger a formal response, reliant on ambiguity and deniability to avoid consequence and attribution.
Distance from Moscow matters little in this kind of contest. Ireland is targeted less for what it has done than as a pressure point in efforts to fracture EU and allied unity, and that will not change.
This is not abstract. Planning permission for a fourfold expansion of the Russian embassy's Orwell Road compound, underground element included, was granted in 2015. It was then revoked in 2020 by the housing minister, using national security legislation, on the grounds that the development was "likely to be harmful to the security and defence of the State".
At its peak, that embassy carried some 30 accredited diplomatic and administrative staff, including defence attachés. These are roles that sit close to the intelligence apparatus, not consular work.
Numbers have since fallen, but only because Dublin restricted visas, not because Moscow lost interest. The episode is a reminder that concerns about espionage in Ireland are neither new, nor unknown to Government.
The tradecraft here fits a wider shift: handling is moving from trained officers meeting contacts face to face toward encrypted apps and paid, disposable intermediaries, people with no record, no watch-list link, recruited on a gig-economy basis.
It is cheaper, harder to trace, and easier to deny. For a state with minimal vetting and no central oversight of who has access to what, that is close to an open invitation.
Resilience and deterrence are two sides of the same coin. Resilience helps a State absorb damage after the fact, whereas deterrence works to prevent the infiltration happening in the first place.
Ireland's instinct, where it has one, has been the reactive kind: responding to incidents once they surface rather than building the structures that would stop them occurring at all.
Building genuine deterrence means investment, legislation and, above all, leadership: a Department of the Taoiseach willing to take direct ownership of vetting and counter-espionage reform, rather than leaving it scattered across Justice, Defence and individual departments.
That call has been made before. It has not yet been answered. Yes, it is a whole-of-government problem, but the responsibility for making, implementing and enforcing that policy rests with one government department.
That leadership question matters because the single most urgent thing it could deliver is a vetting system, the very thing Ireland has never had.
Something one hears often from government is the idea that Ireland is simply not a military nation. That may be true as far as it goes, but it misses the more fundamental point: Ireland is not, at its core, a security-conscious nation, and that shows most clearly in the absence of anything resembling a vetting culture at the most basic level of the civil service and government itself.
No amount of new equipment or legislation would do as much for Irish security and defence as finally introducing a proper vetting system, of the kind that exists as a matter of course in other European countries. That alone would force the cultural shift needed, putting security at the centre of how the State operates rather than leaving it at the edge.
Ireland was not unlucky here. It was overdue. The real test now is not this case, but whether anyone in government is willing to own the fix.
The alternative is not another close call. It is one we don't catch in time.
- Tony Geraghty was a commander in the Irish Naval Service until his retirement in 2025
CONNECT WITH US TODAY
Be the first to know the latest news and updates
