Dr. Richard Browne:

It is much more complex than that. I will explain in slightly more detail. In the first instance, the recourse under international law is usually against states, not individuals. Therefore, if an individual happens to be in a state, the action is usually criminal. It is an extradition-type process. Obtaining sufficient proof and identifying individuals in these cases is extremely difficult. This is a criminal matter for the Garda. The Garda has had some success in taking down a domain used by the attackers and has traced some of the route of the data as they made their way out of HSE systems and, presumably, back to the systems of the threat actor. All of that gets you only so far. If the host nation is not willing to play ball on a law enforcement basis - and in this case the Russian state does not have a very positive history of engagement with criminal investigations in this way - then one is relatively limited in what one can do in that regard. That is not to say nothing can be done. That is a really important point. We have joined an international counter-ransomware initiative run by the National Security Council, NSC, in the White House. We engage very closely with our European and international colleagues on incident response and investigations - not law enforcement investigations as that is a criminal issue, but in the cybersecurity world. That is to understand exactly who these people are individually, what tools they use, how to better defend against them and how to ensure that, in due course, albeit maybe not this year, somebody will be able to put a finger on them and arrest them or whatever. That is a long process but, similarly, there is a long history of cybersecurity actors and criminals being picked up and arrested in international airports after multi-annual, multinational investigations. That is how you get these guys: not with a solo run by any individual but with a collective effort.