Ossian Smyth (Dún Laoghaire, Green Party) | Oireachtas source

There definitely were people in the HSE who were working on cybersecurity. They were in a much stronger position a year ago than they were two years previously. They had been working closely with the NCSC to improve their security. They had been carrying out risk assessments. It is an enormous and complex organisation, however. There are 100,000 staff, one third of whom are contractors. The organisation consists of many independent bodies, health agencies and different levels of private and public medicine, brought together. By its nature, it is a complex organisation.

The healthcare sector is a uniquely difficult sector to protect. Part of the reason for that is that people who are working in healthcare are dealing with life-and-death situations all the time. It is hard to say to somebody who is trying to make a life-and-death decision with a patient that they need to have a better password in order to look at the patient's file. This is a problem with healthcare organisations around the world.

While it would be easy to criticise HSE, you have to look at the organisation at that time. Earlier this year, it was under enormous pressure, and not just from the pandemic. It was trying to get the vaccines out as quickly as possible. Its staff were working from home. Between those factors, it was in a uniquely vulnerable position. I can say that it has made enormous progress.

From the point of view the NCSC telling people about the risk. If one looks at the centre's website, on 30 October 2020, long before any attack like this, it issued a warning about the possibility of ransomware attacks on the Irish healthcare sector. That was based on information from the FBI. Again, that is not a secret. One can find it on the website if one looks at 30 October 2020 to see the release and what is stated. It gives recommendations for what should be done to protect against that kind of situation.