Ossian Smyth (Dún Laoghaire, Green Party) | Oireachtas source

I thank the Deputy for his questions. I know that he has experience in this Ministry.

The first point I would make is that in respect of recruitment, the NCSC has told me that it has not had any difficulty in the past. It is recruiting both from the private and public sectors. There is an attraction to working in such an important and key role in defending the country in that way and defending our critical infrastructure. My impression, from working very closely with the staff over the last few weeks, is that they are very engaged, highly motivated, have good morale, are extremely skilled, and that we are not in a position of being under-resourced. However, demand for additional increase will, of course, increase over the coming years as the threat increases.

The Deputy also asked about private sector companies paying ransoms. That is what the criminals describe as their business model, but it is really an extortion racket. The idea is that a company is put in a position where it is faced with a choice of paying a ransom or going out of business because its reputation will be so badly damaged, it will not be able to find its customers or how much its customers owe it. It is an existential choice. It is not the same for a non-profit organisation or a Government. We will not go out of business if we do not pay the ransom. Therefore, it is a different situation. If people do not pay the ransom, then the criminals cannot continue and it is the end of their business. Of course, we want to find ways to ensure that people do not pay ransoms. However, I do understand that when a company is put in that position it is do or die. That is the situation with that issue. We have taken the right decision. Other Governments and private companies are supporting us in this and agree that if we were to pay the ransom it would attract more of the same.

On the data protection question, data protection comes under the remit of the Department of Justice. I cannot comment on what the Data Protection Commission will do. It has a statutory function and investigates when a data protection breach occurs. There has clearly been a huge breach in this case. I cannot comment on what the commission will do. However, I think we can all expect what is going to happen.