Oireachtas Joint and Select Committees
Wednesday, 23 February 2022
Joint Oireachtas Committee on Transport, Tourism and Sport
General Scheme of the Communications Regulation (Enforcement) Bill: Discussion
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Apologies have been received from Deputy Duncan Smith and Senator Jerry Buttimer. The purpose of the meeting today is to engage with officials from the Department of the Environment, Climate and Communications and representatives from the Commission for Communications Regulation, ComReg, as part of pre-legislative scrutiny of the general scheme of the communications regulation (enforcement) Bill. On behalf of the committee, I would like to welcome from the Department, Mr. Eamonn Confrey, principal officer, from the telecommunications and policy regulation division; Ms Megan Skelly, assistant principal, from the telecommunications and policy regulation division; Mr. Mervyn Hickey, seconded senior adviser, from the telecommunications and policy regulation division; and Mr. Joseph Stephens, principal officer and head of engagement, from the National Cyber Security Centre, NCSC. From ComReg, I welcome Mr. Robert Mourik, chairman and commissioner; commissioner Garrett Blaney, who is attending online; Ms Barbara Delaney, director of retail and consumer services; and Ms Caroline Dee-Brown, general counsel and director of legal services. Our witnesses are all very welcome and I apologise once again for the slight delay.
I will read a note on privilege. All witnesses are reminded of the long-standing parliamentary practice that they should not criticise or make charges against any person or entity by name or in such a way as to make him, her or it identifiable or otherwise engage in speech that might be regarded as damaging to the good name of the person or entity. Therefore, if their statements are potentially defamatory in relation to an identifiable person or entity, they will be directed to discontinue their remarks. It is imperative they comply with any such direction. For witnesses attending remotely from outside the Leinster House campus, there are some limitations to parliamentary privilege and, as such, they may not benefit from the same level of immunity from legal proceedings as a witness who is physically present does. Witnesses participating in this committee session from a jurisdiction outside the State are advised that they should be mindful of domestic law and how it may apply to the evidence they give.
Members are reminded of the long-standing parliamentary practice to the effect that they should not comment on, criticise or make charges against a person outside the Houses or an official either by name or in such a way as to make him or her identifiable.
I remind members of the constitutional requirement that members must be physically present within the confines of the Leinster House complex to participate in public meetings. I will not permit a member to participate where they are not adhering to this constitutional requirement. Therefore, any member who attempts to participate from outside the precincts of Leinster House will be asked reluctantly to leave the meeting. In this regard, I would ask any member partaking via MS Teams to confirm, prior to making his or her contribution to the meeting, that he or she is on the grounds of the Leinster House campus.
Members and all those in attendance in the committee room are asked to exercise personal responsibility in protecting themselves and others from the risk of contracting Covid-19. Masks should be worn at all times during the meeting, except when speaking.
I call Mr. Confrey to make his opening statement.
Mr. Eamonn Confrey:
I thank the Chair for inviting my colleagues and I to assist the committee in the pre-legislative scrutiny of the forthcoming communications regulation (enforcement) Bill. I am principal officer of the telecommunications policy and regulation division in the Department of the Environment, Climate and Communications. I am joined by my colleagues, Ms Megan Skelly and Mr. Mervyn Hickey, along with Mr. Joseph Stephens, head of engagement at the NCSC.
In my role as principal officer, I lead for the division with respect to the communications regulation (enforcement) Bill and the transposition of the European electronic communications code. My colleagues, Ms Megan Skelly and Mr. Mervyn Hickey, have led on the policy and development of the Bill since its inception in spring 2021 and on the transposition of the code more broadly. Mr. Joseph Stephens leads on the policy and development of the provisions of the Bill which concern network security, aligning with his broader role as part of the NCSC.
The communications regulation (enforcement) Bill, the general scheme of which was approved by the Government on 14 December 2021, aims to achieve five objectives. The first and primary aim of the Bill is to transpose the enforcement provisions of the European electronic communications code, hereafter referred to as “the code”. The code is a recast directive that will consolidate the framework directive, the authorisation directive, the access directive and the universal services directive, transposed into Irish legislation via the European Communities Act 1972. The code provides for a European framework for the regulation of the electronic communications sector. Key to its success will be its effective enforcement. Enforcement of the previous directives was provided for in secondary legislation. It had been the intention of the Department to replicate this approach to transposition for the code. However, in spring 2021, advice was received by the Department from the Office of the Attorney General that this was not permissible and that primary legislation would be required to transpose the enforcement provisions of the code and to designate ComReg as the body responsible for the code’s enforcement. This Bill will address the issues raised in the Attorney General’s advice.
The second aim to be achieved by the Bill is the updating and enhancement of ComReg’s enforcement powers. Providing ComReg with updated enforcement powers is a stated policy ambition of the Government and was included as a commitment in the 2020 programme for Government. The Bill will propose a new civil sanctioning regime for ComReg that will include the ability to find non-compliance and impose a range of penalties, including administrative financial sanctions up to a maximum of €5 million or 10% of annual turnover, compensation, refunds and the suspension and withdrawal of authorisations or rights of use, subject to court confirmation, as appropriate.
ComReg will also be permitted to enter into settlements and accept legally binding commitments from operators in lieu of progressing to adjudication.Providing ComReg with enhanced enforcement powers, particularly the power to find non-compliance and impose administrative financial sanctions, would bring the regulator further in line with many of its colleague regulators in the State. The Central Bank, the Data Protection Commissioner and the Commission for the Regulation of Utilities are among the sectoral regulators that have administrative financial sanctioning powers. The Online Safety and Media Regulation Bill and the Competition (Amendment) Bill, both currently progressing through the Oireachtas, will give similar powers to the new media commission and the Competition and Consumer Protection Commission, respectively. In 2018, the Law Reform Commission published its report on regulatory powers and corporate offences, in which it recommended that a suite of core powers be assigned to economic regulators such as ComReg, including the power to impose administrative financial sanctions. ComReg has also publicly advocated for its powers to be enhanced in this manner. At a European level, in the European Commission’s annual Digital Economy and Society Index reports of 2018, 2019 and 2020, reference was made to ComReg’s enforcement powers, most notably in the 2018 report, which stated:
ComReg is not vested with powers to impose fines, which is the courts’ prerogative, and ComReg is thus out of step with other NRAs with regard to timely and effective intervention.
The third aim of the Bill is the transposition of security provisions of the code and the provision of a legislative basis for the electronic communications security measures, ECSMs. These articles place general obligations on providers of electronic communications networks and services to take appropriate and proportionate security measures to manage the risks posed to their networks and services. Articles 40 and 41 also place obligations on providers to report significant security incidents to ComReg. The Bill proposes to allow the Minister to make regulations specifying the types of security measures that providers shall take, thus providing a statutory basis for ECSMs, which are a detailed set of technical security measures produced by the NCSC in consultation with ComReg and industry to secure the State’s electronic communications infrastructure. Finally, the security provisions provide additional supervisory and enforcement powers to ComReg to ensure compliance with the security provisions.
The fourth aim of the Bill is to provide for a limited number of new consumer protection provisions for the sector. The proposed alternative dispute resolution procedure, the publication of quality-of-service information and compensation for delays or abuses in the porting and switching process and missed installation appointments are all mandatory obligations in the code and must be implemented. Only two obligations are not required by the code and these are the ability to set minimum quality-of-service standards that operators must meet and the establishment of a customer charter to set out the standards a customer can expect from the service provider and other specified information. These provisions were developed in close co-operation with ComReg and seek to address identified customer service issues that routinely result in low customer satisfaction in the sector.
The fifth and final aim of the Bill is the updating of the Communications Regulation Act 2002, to align that Act with the code and make necessary amendments to ComReg’s current functions and powers, improving its functionality and complementing the new proposed enforcement regime. These will include,inter alia, a broadened information-gathering power, ability to reuse already gathered information, ability to better assist the Minister with policymaking and improvements to the notification, privilege and overcharging provisions.
By way of further background context to this Bill, two issues need to be mentioned: the infringement proceedings to which Ireland is currently subject for failure to transpose the code within the specified time; and the ongoing engagement with the Office of the Attorney General. In respect of the infringement proceedings, the code was required to be transposed by 21 December 2020. This was a complex project given the scale of the directive and Ireland, along with 24 other member states, failed to meet the deadline. Infringement proceedings commenced against Ireland with the issuing of a letter of formal notice on 2 February 2021. This was responded to on 7 April. A reasoned opinion was issued on 23 September and a response to this was issued yesterday. The reasoned opinion is the final pre-litigation stage in an infringement process, after which the Commission may seek to commence the litigation phase of the process, which can see member states subject to considerable fines and lump-sum penalties. Mitigating against further delay to the transposition is vital if substantial fines are to be avoided.
In respect of the ongoing engagement with the Office of the Attorney General, work is under way to progress the drafting of the Bill in a timely manner. We have been advised that certain legal constraints exist when developing an enforcement regime, given Ireland’s constitutional jurisprudence and, in particular, the recent Supreme Court judgment in the case of Zalewski v. Adjudication Officer & Ors. This results in limited scope for policy discretion in how enforcement regimes are developed. We have been advised that this will result in the Bill as published being further aligned with the forthcoming Competition (Amendment) Bill than is provided for in the general scheme approved by the Government. The extent of the divergence between the published Bill and the general scheme provided is still the subject of discussions between the Department and the Attorney General’s office. I thank the committee for its invitation to attend this afternoon and look forward to assisting in its pre-legislative scrutiny of this Bill.
Mr. Robert Mourik:
On behalf of ComReg, we are happy to appear before the committee to discuss the general scheme of the communications regulation (enforcement) Bill. I am joined by my fellow ComReg commissioner, Garrett Blaney, and by my colleagues, Ms Barbara Delaney, director of retail and consumer services, and Ms Caroline Dee-Brown, ComReg's general counsel.
ComReg is the national regulatory authority for electronic and postal communications. We promote competition and investment in the sector. We uphold end-user rights and manage the radio spectrum. As the pandemic clearly proved, electronic communications are a vital input in almost every economic activity across all sectors of the Irish economy. For individual consumers, access to high-quality connectivity is increasingly seen as essential, as it enables access to an increasingly wide range of services that are important for social and economic inclusion. As the national regulatory authority for electronic communications, ComReg has among its principal functions both ensuring compliance by undertakings with obligations in relation to the supply of and access to electronic communications networks and services, and ensuring compliance with the competition law regime in the electronic communications sector.
Many of ComReg’s activities are grounded in European legislation. The European electronic communications code from December 2018 introduces an enhanced regime for the regulation of electronic communications across the EU and repeals and replaces the 2002 regime. The electronic communications sector had seen rapid development in the years since the previous European regulatory framework was established and ensuring the code is properly transposed and the new regulatory framework in Ireland is fit for purpose is critical.
We understand that primary legislation is needed to give full effect to key aspects of the code and, thus, ComReg is happy to see the communications regulation (enforcement) Bill being discussed today. It should significantly enhance our enforcement powers and introduce a range of new consumer protection measures. Of course, the details of the Bill are important to ensure the desired outcomes for competition and consumers are achieved. The importance of effective legislation to enable ComReg to carry out its core functions has been widely recognised, including by the Department, as we just heard, but also by the OECD, the European Commission, industry representative associations such as Alternative Operators in the Irish Market, ALTO, and the Law Reform Commission. It is even mentioned in the programme for Government.
A key component of such legislation comprises effective, usable and robust enforcement provisions. ComReg welcomes the Bill on this front. We would like to see legislation introduced that will be not only robust to legal challenge but usable in practice and therefore genuinely effective. In this regard, ComReg notes that two other significant pieces of legislation that contain enhanced enforcement powers for regulators in other areas have recently been published, namely, the Competition (Amendment) Bill 2022 and the Online Safety and Media Regulation Bill 2022. ComReg notes that there are significant differences in the approaches of the Bills to certain aspects of enforcement. To be effective and efficient, ComReg favours what appears to be the less prescriptive, less cumbersome and more easily workable regime found in the Online Safety and Media Regulation Bill.
It is important to take into consideration the size and structure of ComReg and its current decision-making processes, which the general scheme of the Bill considers have worked well to date, when designing the best enforcement legislation. ComReg welcomes the proposed upper limit for financial sanctions on a body corporate at €5 million or 10% of annual turnover as proportionate, effective and dissuasive in the context of the electronic communications sector in Ireland, which as members know includes some of the largest utility operators in the State. However, the deterrent effect of financial sanctions only works if they can be applied by means of enforcement mechanisms that are timely, efficient, and legally robust. Strong deterrents are an important tool for ComReg to ensure industry complies with its regulatory obligations. This will achieve the desired results for competition and consumer protection.
The general scheme proposes improvements to our regulatory investigation powers, and we welcome these as they will improve our enforcement capabilities. ComReg also welcomes the introduction of the security provisions which have become ever more important as Irish society relies increasingly on secure networks. ComReg requires robust enforcement powers to be effective in managing its security and integrity remit for the sector and as a key input to the NCSC. Noting ComReg’s last appearance before this committee, ComReg welcomes the inclusion of a substantial number of new consumer protection measures in this Bill, including a customer charter, minimum quality of service standards, a new compensation scheme that will entitle consumers to compensation for failings by operators, and an enhanced alternative dispute resolution mechanism for consumers. On the basis of this scheme, Irish consumers of telecoms services should enjoy better protection and more choice going forward.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I thank Mr. Mourik. We move to members. Deputy Cathal Crowe is first.
Cathal Crowe (Clare, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I welcome the officials from the Department and ComReg and thank them for the presentation and the briefing notes that were emailed to us. This Bill hopes to achieve five strands but I will hone in on one of them. On Monday morning I was out doing my clinics in Clare and somebody gave me a volume of paperwork about mobile phone masts. I brushed it off and said we have been there and heard all of that. We have heard all the tinfoil hat people, heard all of that and we have rubbished it. I said I was not convinced by this. Nonetheless, I took a few pieces of paper and said I would bring them to the committee because they are from eminent sources. I said I am not into the hysterical stuff, only stuff that has come from eminent sources.
I refer the officials to Article 30(6) mentioned in the general scheme as I have a few points to make on it. This relates to breaches representing an "immediate and serious threat to public safety, public security or public health or risks creating serious economic or operational problems for other providers or users of [ECN, ECS] or other users of the radio spectrum". Essentially, there is a framework here that provides protection to ensure things are within compliance levels, certainly with respect to non-ionising radiation and all the outputs of these radio signals.
Going back to Monday, I was given a volume of paperwork. I chose to omit much of it. This lady is from the Chairman's constituency and might be in contact with him very shortly as well. I want to reference a few of these documents because about a decade ago we quite rightly eased most of the planning criteria required for mobile phone network infrastructure. We were right to do so. Every one of us has a mobile phone. We need them and need to be able to use them actively when we are on the move without networks crashing. I am glad there is an aim nationally to have all populated parts of Ireland receiving a 5G signal by 2030 and I hope we get to that point even sooner. In the rush to get to a low-regulation ending so we could fast-track delivery of this, certain things may have been surrendered. I put them as questions even though we may not have the answers to them in this meeting.
In June 2005 the Oireachtas Joint Committee on Communications, Marine and Natural Resources, a precursor to this one, submitted a report to the Government of the day. It said:
The Joint Committee makes the observation that the planning processes for the erection of masts would not appear to be an open and transparent procedure. The Joint Committee recommends that all planning guidelines and exemptions be re-examined with a view to ensuring that no ‘electromagnetic emitting’ or ‘radio frequency emitting’ equipment is sited near health centres, schools or other sensitive sites such as playgrounds or pitches etc.
That was 16 years ago. That no longer applies. The thrust of my contribution is while it is right to ease planning restrictions to allow infrastructure so critical to Ireland to exist and to do so in all parts of the country rather than just urban areas, at the same time, some of the prior health concerns need to remain under a lens of scrutiny.
The next item I will reference comes from the Parliamentary Assembly of the Council of Europe. It was published ten years ago. It states:
While electrical and electromagnetic fields in certain frequency bands have wholly beneficial effects which are applied in medicine, other non-ionising frequencies, whether from extremely low frequencies, power lines or certain high frequency waves used in the fields of radar, telecommunications and mobile telephony, appear to have more or less potentially harmful, non-thermal, biological effects on plants, insects and animals as well as the human body ...
I will stop there.
As I said, I was given this volume of evidence. I did not accept most of it but are were certain eminent reports that need to remain under scrutiny. I think the scientific debate on this was largely shut about ten years ago. I tell ComReg and the Department that it needs to remain. There needs to be a capacity here. It is not all about infrastructure and consumers. There needs to be a capacity to stay current with the technology and the potential health risks - which hopefully do not exist - that some eminent bodies, including the Irish Medical Organisation, IMO, have in the past identified. Have the officials' organisations the capacity to do that? Have they the public health capacity to make decisions and to monitor at this level? Without that, the legislation, when enacted, will be rather limp.
I have two further points and will then conclude. The principle of co-location also came in about a decade ago. It was a very good principle and ensured that in the part of County Clare I live in, which is similar to many parts of Ireland where there is a large population, companies had to work with each other and share space on a mast. We all want to see antennae that give us a good signal but we do not want to see all these ugly masts popping up here, there and everywhere. Proliferation of them certainly is not needed. That principle was largely followed a decade ago but has been largely abandoned in the last two or three years. Again, in my locality there are now about 18 antennae, masts and poles. When I leave Ennis and drive four or five miles west, there is nothing. There is disappearing infrastructure.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I remind the Deputy to leave time for a response.
Cathal Crowe (Clare, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Yes. I put it to the Department and ComReg we have a proliferation in populated areas because it makes economic sense and is lucrative, while we still have companies avoiding parts of west Clare and other areas. We have proliferation and abandonment. The two do not work. There has been lax enforcement in that regard as well. I will finish there. We need to keep some eye on the health risks, whether real or imagined. We need to keep current with technology as it moves and we also need to take companies to task so we do not have proliferation versus abandonment, which has been my experience in a rural county.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Who is the Deputy addressing his questions to?
Cathal Crowe (Clare, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
To ComReg and Mr. Mourik, to begin with.
Mr. Robert Mourik:
I thank the Deputy. I will give the floor to Mr. Blaney in a minute on this topic. Deputy Crowe raises mobile phone health issues and how to stay current. We are of course not a health regulator. We are not health experts. We do not know exactly how the impact of frequencies on human bodies works but there are experts around. The international body that deals with this is called the International Commission on Non-Ionizing Radiation Protection, ICNIRP. It is a body aligned to the UN and WHO. Every time a new mobile phone technology is invented, ICNIRP comes out with updated guidance on what the effects are and we take that into account. We demand from mobile operators that they adhere to the ICNIRP norms.
Every year, ComReg tests hundreds of masts around the country to check that they are below the norms. If they are not below the norms, the provisions of this legislation would kick in and we could take action.
Cathal Crowe (Clare, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I do not expect it today because I am just throwing it at Mr. Mourik but, on another day, could he supply us with some data on the level of breaches in the country last year?
Mr. Robert Mourik:
Absolutely. Before I hand over to Mr. Blaney on the other matters, I will say that we generally find that the mobile phone operators operate at around a single percentage point of the norm. There is a lot of headroom between the emissions of the mast and what is considered to be safe by the ICNIRP. In general, we can rest assured that in Ireland the emissions from the various masts are safe. I can supply the Deputy with that information separately. I will hand over to Mr. Blaney on the other points, including the matter of co-location.
Mr. Garrett Blaney:
With regard to co-location, it is not specific to this primary legislation but rather, as the Deputy mentioned, relates to one of the components of the supporting code Mr. Mourik talked about. There are new provisions in that code to encourage co-location. There is some level of co-location happening in the market. We will soon be making further spectrum available to the market through an auction. This will increase the volume of spectrum available by 46%. As part of that release, we will also be imposing, as part of the auction conditions, a requirement to have improved coverage. We hope those improved coverage obligations will make things better for people in remote locations. It should significantly improve their experience. I hope that covers the question on co-location and coverage.
Mr. Eamonn Confrey:
I thank the Deputy for the question. I will make a couple of points. The first thing to say is that the Department and Minister have no role in the individual roll-out plans of private operators with regard to masts or anything like that. Clearly, individual projects or applications will have to go through the planning process, as the Deputy will be aware. However, the Minister does have policy responsibility for matters pertaining to public exposure to non-ionizing radiation. Policy in this area is informed by a lot of internationally recognised scientific research and evidence. This includes guidelines set down by the ICNIRP. I understand they were revised in March 2020. Those guidelines provide scientifically based exposure limits that are applicable to both public and occupational exposure to electromagnetic fields, including from 5G. These guidelines are based on evidence gathered from a range of peer-reviewed scientific literature. Ireland has commissioned its own research into this with reports in 2007 and 2016 concluding that there is insufficient evidence to establish a causal relationship between exposure to low-frequency electromagnetic fields and adverse health effects. While there is insufficient evidence pointing to a causal link, this is obviously something that needs to be monitored continuously. In May 2019, the Minister assigned a new statutory function to the Environmental Protection Agency, EPA, to monitor scientific, technical and other developments on these matters and to advise the Minister accordingly. Clearly, the EPA is fairly proactive in providing information to the public. In fact, it commenced a national monitoring programme for electromagnetic fields in 2021. I understand a report on that was expected late last year.
Cathal Crowe (Clare, Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I will conclude by thanking the witnesses. They have largely echoed how I see things. It is very important that an empirical report from 2015 is not the end of this and that the matter stays current as technology changes. It is great technology that we all embrace. We want more of it in rural areas but we should keep it under a lens of scrutiny at all times to ensure it stays within safe operating levels.
Darren O'Rourke (Meath East, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I thank the witnesses for the presentations and updates. I have a couple of sets of questions. The first set of questions is for the Department. When the officials were in with us before, they indicated a timeline. Will they give us an update on their sense of the timeline and where we are in the preparation of the heads of this legislation with the Government? How does that relate to the potentially substantial fines they have mentioned? Will they explain further what is meant in the last paragraph of the opening statement which refers to new advice from the Attorney General and the implications of the Supreme Court judgment leading to a difference between the published Bill and the general scheme? How does that relate to the timeline and the types of consideration the Department has to undertake in that regard? We heard the representatives of ComReg indicate that it has a preference for the model of the Online Safety and Media Regulation Bill 2022. Does the Department support or agree with this or intend to incorporate it into the Bill?
My next questions are for ComReg. The witnesses have covered ComReg's perspective on the Bill in their opening statement. We have heard from them before with specific regard to customer service, response times and the quality of response, particularly from broadband and telecommunications providers. As it stands at this stage, the Bill would give ComReg additional powers to address those issues. What might customers expect in that regard? With regard to the nuisance calls people have been getting, which seem to have quietened down a little bit, what might customers expect from this legislation in practical terms if it is fully enacted?
Mr. Eamonn Confrey:
The first of the three questions related to the timeline. As I have indicated, the general scheme was approved in mid-December 2021. Since that time, and in advance of it, we have been engaged in intensive discussion with the Office of the Attorney General and others on the development of the scheme. I may be corrected by my colleagues on this but, at the moment, the legislation is on the Government's priority programme and we are working towards a timeline of early April for the expected publication of the Bill. That is certainly our understanding and expectation based on our interaction with the Attorney General's office. I assure the Deputy that the Bill is being given a very high priority. In fact, the Attorney General himself has been heavily involved in much of the discussion on this. It is worth saying that there are three pieces of legislation in this area moving through the Oireachtas at the moment: this Bill; the Online Safety and Media Regulation Bill 2022, which was published in January; and the Competition (Amendment) Bill 2022, which was published a number of weeks later and to which the Bill before us today is very closely aligned. It is a question for the Government and the Attorney General to make sure the regimes that are being introduced as are aligned as possible.
I will pass over to my colleague, Mr. Hickey, in a second to take the Deputy through the implications of the Zalewski case he mentioned. Making sure the regime being brought forward is legally robust and can withstand challenge is quite high in the Attorney General's mind. Reading into the Deputy's third point, on whether we support the request from ComReg, what we are ultimately seeking to achieve is a regime that is robust and enforceable but also workable and appropriate for the market that is being regulated. I will pass over to Mr. Hickey on the specifics of the Zalewski case.
Mr. Mervyn Hickey:
We have to look at administrative financial sanctioning regimes in the context of being pre or post the Zalewski case. There are many extant financial sanctioning regimes but, if they predate that decision, they must be looked at against that background. I will not go into any deep exploration of the case but the key takeaway for us and what has influenced what we are doing is that the regime of the Workplace Relations Commission, WRC, was challenged.
The Supreme Court concluded that what was being engaged in by the WRC was the administration of justice. There had been some doubts as to whether that would be the case but the Supreme Court has confirmed it is. Because it is the case, a limited exception is granted under Article 37.1 of the Constitution for judicial functions of a limited nature to be carried out by administrative regimes, such as in the case of the Bill that has been proposed and is before the committee today. If that is to be the case, however, those functions are now subject to many requirements for fair procedure, which may previously not have been clearly required but now are clearly required. The scheme we presented, therefore, had to undergo a rigorous analysis and continues to be rigorously analysed to ensure it is robust. The Competition (Amendment) Bill, which is further along, will show the signs of that development. We are engaging with the Office of the Attorney General on such matters that are common to our scheme and those requirements will have to apply.
Mr. Robert Mourik:
I will take the first of the Deputy's three sets of questions before handing over to my colleague to talk about the practical implications. Finally, I will address the question on nuisance calls.
Our general perspective on the Bill, which deals with two elements, is very positive. It will give ComReg both better enforcement powers and some additional powers in the area of consumer protection. These issues, in my view, go hand in hand. There can be many different powers - we have them, for example, in the competition area and we will also, we hope, get some additional ones in the consumer area - but we will not be able to apply them as effectively if we do not have good enforcement legislation as a counterbalance. In that sense, we are very happy with what the Bill aims to do. The devil, as always, is in the detail, and we have just heard a debate on the most effective way of implementing that enforcement legislation. All we ask of the Department and the Oireachtas is that they will come up with a regime that is legally robust but also workable for us. If it becomes too bureaucratic and long-winded, the goodness will go out of it and it will not be helpful.
Ms Barbara Delaney:
On what consumers can expect, at our previous appearance before the committee we were keen to ensure there would be additional powers or obligations on service providers regarding customer service standards. In tandem with the enforcement regime, there are new obligations and new rights for consumers that will be very positive, the first of them being a customer charter. That is the single place that customers of electronic communications providers should be able to go in order to understand what they can expect, and then compare the different service providers.
Similarly, the other complementary provisions are really important, such as the quality-of-service standards. A service provider can commit to a particular level of service, whether in regard to answering the phone or emails or whatever. The Bill will provide that if ComReg does not believe the provider is sufficient in making those commitments, it will be able to come onto the pitch and set minimum standards. Service providers can go beyond those minimum standards, but there will be a standard below which they cannot fall. I am just using the example of customer service but we would hope there will be other headings within the charter.
As for what would happen if providers fall below the standard, that is where the compensation scheme would come in. The proposal is to have a compensation scheme where compensation is given automatically where the provider falls below the minimum standard that was either set or committed to in the first instance. That would be something an individual customer could benefit from. We hope the regime will not only give benefits for consumers but drive the overall standards upwards, with competition in regard to the standards, which heretofore we have felt was lacking. Finally, the enforcement powers that will come in will allow us to take action not just from the consumer perspective of getting compensation but also by allowing us to take action if the provider has not implemented the charter or the standards.
In summary, the Bill will address the gap that was identified and highlighted by the committee. We are happy to see the proposals will go towards addressing that gap.
Mr. Robert Mourik:
The issue of nuisance communications is not, strictly speaking, part of network security or of the Bill, but I might give the committee an update on it. We have set up a task force with the industry on the matter and, at our initiative, it is looking at a number of ways in which we can address the issue of nuisance calls. It is not something we have the ambition to be able to resolve straight away, given that once we find one solution, fraudsters will find other ways around it. Nevertheless, we think we are looking, along with industry, at the most promising ways of reducing the number of nuisance calls and text messages. The task force meets monthly. It is, of course, up to operators to implement the measures, and after six months or a year, the task force will report back.
We have done much analysis with other regulators, both in the United States and in Europe, and we have been able to identify a number of pragmatic solutions that can be implemented quickly in order that, we hope, consumers in Ireland will see a reduction sooner rather than later. Many operators have started implementing a number of measures and the number of calls and text messages has fallen, although we hope to improve on that over the coming months.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I thank our guests for their opening statements and for the briefing document. Many of the points I had intended to raise have been covered. There was a reference to the transposing of the EU code and the updating of the 2002 Act. They are kind of background issues that the consumer will not really be concerned with. While they are important, they are quite technical and will not be very impactful on the ground. There is also the issue of sanctions. To clarify, ComReg deals with landline companies, mobile network companies and broadband provision, as well as text messages within the mobile network. I understand the Virgin Media provision of television services and cable television does not come under that. I wished to clarify that, given some of these providers also provide broadband and phone lines along with cable television and so on.
What will ComReg be able to do in future that it cannot do now? What will be the difference in the day-to-day operation of the regulator? Will it have sanctions it can issue or sanctions it can issue more quickly? I regularly hear the complaint, as I am sure most people do, that when a person calls Vodafone, for example, he or she must spend time waiting in a queue to get a response, and he or she will then be promised X but it does not happen. I have heard endless examples of people having just given up because they cannot spend 30, 40 or 50 minutes doing that. It seems to happen all the time, not just at 9 a.m. on a Monday. Will ComReg be able to set minimum standards such that a call must be dealt with within a certain period, such as five, seven or ten minutes? We all appreciate that call centres cannot be staffed with thousands of employees 24-7 and there will always be spikes where a network goes down and so on, but will ComReg be able to set minimum standards? Will it be able to insist, for example, that disputes must be resolved or brought to the next level within a certain period? Not every dispute will be resolved satisfactorily, but at least there could be some level of closure whereby there would be a response to say the reason it will not be resolved to the person's satisfaction relates to the fact that, say, the person failed to read the documentation, the contract or whatever the case may be. What will ComReg be able to do, thanks to this legislation, that it cannot do currently?
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
That they provide broadband and phones.
Ms Barbara Delaney:
Exactly. I did not want to give the impression they are outside the regime. The Senator spoke about the issue of customer service, which was highlighted at our last appearance. We have thought about and proposed the minimum quality-of-service standard and have talked to the Department about it in proposing this Bill. One example of that is how service providers interact with their subscribers, the experience Senator Horkan has talked about. This could be phone interactions, raising a complaint or an issue, or getting a bill sorted. We envisage that under the proposed legislation there would be a charter, which is like a commitment that has consequences.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
That is not there now.
Ms Barbara Delaney:
No. There is obviously more than the scenario we propose, but there would be a single charter for customers to look at. Customer service is hot on everybody's mind and was highlighted heretofore. We have proposed this approach which we think will be beneficial to consumers in their everyday dealings with their service provider and bring the standard of service, on many different aspects, upwards.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Will the companies create the customer charters?
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Will ComReg audit them to make sure they have certain minimums? Will it say companies must have X, Y and Z in their customer charters?
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
ComReg can insist that companies will not be able to say they will answer customer calls within an hour and then fail to comply with that.
Ms Barbara Delaney:
There are two levels. The proposal is that ComReg would set out what should be in the charter under various headings, including billing, refunds and customer service. We hope that this will drive industry to move their standards upwards and make commitments that are genuine, worthwhile and beneficial to their consumers. However, should that not be satisfactory, the proposal in the Bill is that ComReg would have the ability to step in to say what the minimum standard was.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
ComReg can impose standards, or it will be able to impose standards.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
How does ComReg propose the sanction regime will work? Is it like a planning permission with regard to non-compliance? Will it send out warning notices? Is that in the Bill? A penalty of €5 million or 10% of turnover can be a large amount and, obviously, it will not be for a small offence. Where does the proportionality regime kick in? If a consumer rings up and does not get a satisfactory answer, can he or she report it to ComReg and ask it to investigate? Does ComReg have to investigate within a certain period of time and come back to the consumer? Is that the way it works?
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
That includes the redress aspect.
Ms Barbara Delaney:
Absolutely. The customer has a charter with my service providers and is entitled to A, B and C, which has not happened. The proposal is to have a compensation scheme which means that if that did not happen, there is a financial incentive for the service provider, per customer, to make sure the standards are upheld. Then, the other-----
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Are those sanctioning capacities not there now?
Ms Barbara Delaney:
No. I will come back to the Senator on the other level, which is enforcement. The code brings in new compensation for the individual consumer, but the proposals are to look at other headings for that as well. That is definitely new. An enhanced dispute resolution is also proposed. If a consumer is not happy with a response from his or her service provider within ten working days, he or she can come to ComReg and, as an individual consumer, have that dispute adjudicated on. That is the proposal.
What if hundreds of consumers fall foul of the charter and all the rest? That is where enforcement action comes as a kind of wider deterrent. If the service provider is not serving its individual consumers who have rights and are getting compensation or whatever, ComReg can also take enforcement on a general level against the service provider for not upholding the obligations it is supposed to uphold. I do not know whether one of my colleagues wants to speak further on the enforcement regime but I want to get across the point that there is an individual redress for consumers and then a further ability to-----
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
It is fair to say that is not there now.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
On the "Prime Time" special, the chief executive of Eir stated the company had people in call centres working from home and while not saying "Tough luck", more or less said that people would have to put up with it. Is it the case that those operators will now face penalties, the consumer will be able to get both redress and compensation and the operator can be fined up to €5 million or 10% of turnover? Will the higher or lower of those two figures apply?
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Could it be more than €5 million or is €5 million the maximum?
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
It is important that the penalties are quite punitive because there is no point in having a slap on the wrist type of fine that is cheaper not to resolve than to resolve. Fines are needed that will incentivise companies that do not behave. We all know companies that behave. Every one of us has at least one mobile phone. We all use these companies and they are fine most of the time, but when things go wrong customers find it almost impossible in many cases. Customers end up talking to people such as us because they have been so frustrated by the process.
Mr. Robert Mourik:
What we hope that this Bill will achieve is that the enforcement regime will be effective, proportionate and dissuasive; that when operators see the powers that we have, there will be a culture of compliance within the companies; the companies will proactively try to meet the standards they need to meet; and we will not have to resort as much to compliance action or use it as much as one thinks. We really want to drive forward that culture of compliance. It is not just about fines. This Bill gives us a bigger and better toolkit in general. There are prohibition notices, interim measures, settlements, etc. All that contributes to it being a more effective enforcement regime.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I have one final question. How is ComReg financed? Between the Department and ComReg, will it have enough resources to enforce and police all these extra sanctions and rules it will be given? ComReg obviously wants the powers. We have had representations from other people who are unhappy with the wholesale market. Operators rarely look for more rules, but they are looking for more rules to regulate their competitors. There was an article in the Irish Examineryesterday about how ComReg is dealing with Eir and challenges in respect of access to ducting and so on. How is ComReg funded? Will it have enough resources to use this regime when it is in place?
Mr. Robert Mourik:
I will ask my colleague, Mr. Blaney, to respond. It is important to understand that this enforcement regime is not just for the consumer powers Ms Delaney has just mentioned, but also for what we call the wholesale area of ComReg, such as the ducting of Eir. Mr. Blaney can probably answer on resources.
Mr. Garrett Blaney:
The Senator asked whether the fine of €5 million or 10% of turnover would apply. It is the higher amount. If €5 million is not enough and 10% of turnover is a higher amount, the 10% of turnover would apply.
With resources, it sort of comes down to how this is implemented. We are comfortable and confident that if we can get what we have asked for - a less prescriptive, less cumbersome and more workable regime - we will be able to operate within the current resources we have in the organisation. In some ways, it might make life easier for us because we might find that operators comply not just for consumers but also, as was rightly said, on the wholesale market. We are in the hands of the legislators in making sure we get this legislation workable from our point of view. Notwithstanding that there are legal dimensions to this, it also must be robust. We are clearly keen for something that is also workable.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
Who funds ComReg? This is just a final question. I asked it already, but I want an answer.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
We have to be fair and show respect.
Gerry Horkan (Fianna Fail)
Link to this: Individually | In context | Oireachtas source
I am only looking for the answer.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I know, but-----
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
We are here today because the Department came to us to say it would look for a waiver on pre-legislative scrutiny for this Bill. I have a couple of questions to clarify some things that are still not clear from the opening statement. When did this general scheme go to the Cabinet and when was it approved by the Cabinet?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
The case of Zalewski v. Adjudication Officer was decided on 12 July 2021, which was five months previously. In its opening statement, the Department said that the general scheme could be amended and that there could be a divergence between the published Bill, which is before us here, and the general scheme because of this particular adjudication. Why was the Bill brought to the Cabinet prior to looking at the implication of this particular Supreme Court case? We are considering here something that may actually change when the actual legislation itself is published.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
It is a fair question to ask. Why would the Department bring forward the general scheme of Bill and get it approved by the Cabinet when a Supreme Court case, which appears to be germane to this legislation, had yet to come? It is an issue I have for this committee. If we are doing pre-legislative scrutiny, we should be doing it in its totality. If we are doing pre-legislative scrutiny on a Bill that is fundamentally going to change when it comes to published legislation, it is not pre-legislative scrutiny in the round as far as I am concerned. I want to lay down that marker. It is hugely important. It is part of our role as a committee. Pre-legislative scrutiny was introduced so that committees would assist in the process of making legislation more robust. The general scheme of the legislation was approved in December by the Cabinet. If we are suddenly finding a situation where it is being said that the Zalewski Supreme Court case, which was decided five months earlier on 12 July 2021, may change what is published in the legislation, it is hard to see how we can be in a position to do proper pre-legislative scrutiny.
With regard to the legislation, the Department came to us about a waiver scheme because the Department said that the EU was looking for the legislation to be put in place. Where does that stand with the EU remit?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
When did the advice come from the Attorney General's office that it required primary legislation?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
That is nine months before it came to us as a committee. I take our role as a committee and our fiduciary duties very seriously. The Department was aware that it required primary legislation nine months previously and that there were deadlines with the European Union, and we were being told that a waiver for pre-legislative scrutiny was to be requested, and we are now finding that the legislation is still not going to be published until April. What is the interaction with the EU at this moment in time?
Mr. Eamonn Confrey:
I will ask my colleague Ms Skelly to come in on the timeline question to give the Chairman a bit more detail on the timeline and the situation with the EU. Ireland was subject to a letter of formal notice and subsequently a reasoned opinion. We responded to the reasoned opinion-----
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
When was the reasoned opinion? Was that in December or September?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What was said in that response?
Mr. Eamonn Confrey:
Essentially, we said that we have a well developed scheme at the moment but it is subject to discussion with the Office of the Attorney General. Our expectation is that by April, we will have a published scheme. We have made the point that it is difficult at this stage to give any huge degree of certainty on the passing of this legislation, but certainly from April onwards we would like to see that the legislation would be published.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Has the Department given any indication to the Commission around the deadline dates the Department has looked for to have the legislation published?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Are there fines currently running with regard to Ireland and this legislation?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What is the rush on the pre-legislative scrutiny if the legislation is not going to be ready until April and if the EU is not imposing fines? When will the EU start to impose fines?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
The committee was given the impression that there would be fines. Mr. Confrey is now telling me something different.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
There was a push on to get the pre-legislative scrutiny through on the basis that there could be fines. I put it to the Department that the committee values very seriously the work that we do here. We want to assist in making legislation robust. We will look at this and, as a committee, we will come back collectively on it.
Will Mr. Mourik indicate how many mobile phone and broadband companies ComReg has issued fines to in the past 12 months in respect of issues such as dealing with consumer complaints? I want to get to the heart of why this legislation is coming in, what powers the commission currently has and how many fines it has issued. What are the commission's powers? The key to this is that members of this committee have listened to programmes such as "Liveline" and other programmes on RTÉ. The constant complaint is that people are waiting an inordinate amount of time with any mobile phone or broadband provider, in many cases even to get to speak to someone on the phone. The commission is the regulator in this area. How many fines have been imposed?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Does regulator have the powers to impose fines at the moment?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
So, the regulator must take that to court.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Which court?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
In the last 12 months, how many cases has the regulator brought to the High Court?
Mr. Robert Mourik:
At the moment we have one case pending in the High Court. We have had a number of criminal investigations with regard to one mobile provider. We also had a number of criminal cases for another provider that messed up the introduction of new products.
In total, we have had about 12 to 15 cases but I can get the exact number.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
There is currently one.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
With all the complaints the public have in terms of dealing with mobile providers, phone providers and broadband providers, ComReg has only one complaint before the High Court. Is that because ComReg does not have the powers or what is the reason?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Does it have no powers at all?
Mr. Robert Mourik:
We cannot, for example, set minimum answer times or those sorts of things. There is nothing in the law that allows us to do this. What we do is far more direct, and we said that the last time we were before the committee. We have our own call centre, so we get complaints from customers and we mediate directly between customers and operators.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
That is on a non-statutory basis.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
There is no legislation to enforce that. ComReg cannot ring a mobile provider and say a person has been waiting for two hours. It cannot do anything bar give them a slap on the wrist and say it will get back to them.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
If this charter comes in, will it be a voluntary charter that the mobile providers provide or a legally binding charter?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Do they have to get that charter approved by ComReg? Is ComReg looking for that?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
If they do not abide by that charter, what can ComReg do and what would it like to be able to do under the legislation?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Is the fine for a corporate the higher of €5 million or 10% of the turnover, and for an individual the higher of €500,000 or 10% of annual income?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
The question for me is quite simple. Obviously, if the broadband providers, mobile providers and telephone providers do not have enough of a deterrent, they are going to let this run on and, every so often, they will be given a slap on the wrist. What is the draconian measure that can be brought in by ComReg to ensure that mobile providers, when they are sitting down and planning, will know they need to put additional staff in this area because the last thing they need is to have ComReg on their backs, costing them money and preventing them from doing their work? How do we get to that space? My worry is that they will bat away the compensation scheme and adjudicate it.
Mr. Mourik will appreciate our role, although I might have been a bit hard. Our role is to assist in getting robust legislation that will work in practice. I want a situation where the mobile provider is sitting down and saying, “We do not want those shaggers from ComReg harassing us because they are going to hit us with fines and stop us doing business.” When do we get to that space?
Mr. Robert Mourik:
That is exactly what the enforcement regime in this Bill is aiming to do. In my opening statement, I said there are two sides of this coin. We have the obligations - for example, the customer charter - but if that is not paired with a workable, dissuasive enforcement legislation piece, it will not work. The only way that operators are going to be proactively compliant with it is if they take that compliance regime that is in this Bill seriously.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
They will only take that seriously if it is going to hurt them in their pocket. They will not take it seriously if it is effectively a cross letter, a cross word or a slap on the wrist. The only way it hurts is if it costs money. Will this cost them and will it cost them quickly?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Are the Department and ComReg interacting on the structure of this Bill?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
How many staff does ComReg have at the moment?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
How many does it have to fill?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Why are they not filled?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What is ComReg's annual budget?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
If all of this area is going to increase and ComReg's interaction with the mobile providers, phone providers and broadband providers is going to escalate, as I believe it has to, has ComReg enough resources in both staffing and funding?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Who is ComReg funded by?
Mr. Robert Mourik:
We are funded by fees from industry and by levies. We normally feed money back to the Exchequer so the problem is not the funding. The way we see it, we have two compliance teams in ComReg already and this Bill will allow them to work more efficiently. We will recruit if we need more compliance staff but we think we can manage that and we will see that as the Bill comes in.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
To turn it on its head, the good provider is the provider who is engaging with the consumers, taking their calls when they ring and addressing their issues when they arise. Has ComReg considered a headline scorecard on its website to say that these companies are meeting certain targets within certain periods of time? I do not want to brand all service providers as being in any way not customer friendly, although some are, and there will be certain reasons for that. Is there a way to reward the good service provider?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
On a question to Mr. Confrey, for me the issue on the legislation is quite simple. We want to assist. The worry for us, as a committee, is that we have been asked to comment in pre-legislative scrutiny on certain items that have yet to be clarified. When will the Attorney General give the Department the updated advice on the Supreme Court case and the impact it might have on the legislation? When will the Department know that?
Mr. Eamonn Confrey:
As late as earlier this week, we have been in intensive engagement with the Office of the Attorney General. It is drafting at speed the provisions which, as I said, are aligned very closely with the competition (amendment) Bill, which is slightly ahead of us. As I said, it is a priority for the Attorney General and it is certainly a priority for the Government.
With regard to the infringement proceedings, we are technically in infringement at the moment because that commenced with a formal notice in February 2021. The reasoned opinion came in on 23 September and, as I said, we issued that response yesterday. The reasoned opinion is the final pre-litigation stage in an infringement process, so, essentially, the clock is ticking for us in the sense that the Commission may commence that litigation phase now.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Mr. Confrey will appreciate that we are being asked legally, as a committee, to do pre-legislative scrutiny and we have been asked to respond on the Bill. A lot of what is being proposed here is very welcome, but it is only welcome if it benefits the consumer and benefits the good providers. The legislation will not be published until April. I would expect that as part of our deliberations, once the Department has got the update from the Attorney General, it would advise us on whether changes are being proposed in the legislation, so we can, in the round, do a complete review of pre-legislative scrutiny.
As a committee, we have to be in command of all the facts when we are doing it. Otherwise, it is not pre-legislative scrutiny as it was intended. Is there anything within the legislation that ComReg feels is not being provided that it is looking for at the moment? Are the heads of Bill, as currently proposed, inadequate in any way, in terms of ComReg's dealings with the consumer side and others, in particular?
Mr. Robert Mourik:
We are very happy with it. I must say that these are not the only consumer-related provisions that are being introduced. There is secondary legislation coming in that implements the European code, which also updates the framework. There is also consumer legislation that is separately undergoing legislative scrutiny at the moment.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Once this legislation comes in, will ComReg be fit to take on the battle for consumer rights in terms of dealing with all the service providers?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I call Deputy Ó Murchú, who has seven minutes.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
In fairness, the Chairman has dealt with a fair amount of the questions I may have had.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I doubt the Deputy will improve on them.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
It would be a first, if I did. Am I right in saying that ComReg has not seen the legislation at this stage? It has obviously been involved in a significant amount of engagement, but has it seen the legislation? No. When I came in to the meeting, I had in mind to ask one question, namely, whether this legislation is going to be good enough. To a degree, that question has been answered. Mr. Mourik has stated that it will be good enough, if it is what is promised. We will definitely have to see if there are any changes to ensure that happens. In relation to what is proposed in this legislation, how do the representatives of ComReg see it working and how does it need to work? The witnesses previously stated that it will work if it is not overly bureaucratic. I ask the witnesses to go briefly through an example. We have all used the example of Eir in respect of the system that existed before. I ask the witnesses to go through an example of how the system will operate, the powers ComReg will have and where the blockages do not need to be.
Mr. Robert Mourik:
I will defer to Mr. Blaney later to add to my response. What currently happens with a compliance case is that there are a number of stages. First, ComReg will investigate a particular matter where we think there is an issue, or perhaps if somebody has told us that there is an issue. We open an investigation. The investigatory team will form a preliminary view of whether there has been a regulatory breach or not. It will either dismiss the case or bring the matter to the commissioners' attention. If the team recommends the finding of a breach and a penalty, according to the new legislation as it is described here, the case will be referred to an adjudication panel. That adjudication panel will then consider all the evidence and the recommendations and decide whether a penalty should be imposed. In this case, the adjudication panel will be ruling on behalf of ComReg, so it is basically a case of ComReg ruling, for example, that there has been a breach and imposing a fine. Before that penalty becomes final-----
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
So, it bypasses what previously would have gone through the court system.
Mr. Robert Mourik:
Going through the court system would mean we take that report to the High Court. Now, it is a decision that is made by ComReg itself. That is a big difference. The High Court is still involved in the sense that it gives its blessing to what we have decided. It is a subtle, but important, difference that under the new legislation we will make that decision ourselves. It makes it a much stronger and potent enforcement mechanism.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Obviously, even though the procedure will need to be fair, ComReg will be able to do this in a timely manner, unless there are obstacles that we cannot foresee in the legislation.
Mr. Robert Mourik:
Sure. I am sure the Deputy can understand that if we can figure out the best procedures within ComReg, we will be able to do that relatively quickly, but we will do it with all the necessary checks and balances that are required. These things do take some time, because we want to be utterly sure that we are doing the right thing. At the end of it all, the operator can go to court and----
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Of course. I think we all accept that there needs to be fairness.
Mr. Robert Mourik:
In a nutshell, that is what this general scheme describes. We like the difference of the court not making the decision on the fine, for example, because the court then needs to take our advice on what the level of the fine should be. The court also looks at many other things whereas ComReg, as an expert regulator in the field, can determine quite well the most proportionate fine in a particular case.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Yes. We do not want to be pushing cases through what is an already clogged court system.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
All of that makes sense. There should not be any obstacles in this legislation in relation to how ComReg operates. It needs to see-----
Mr. Robert Mourik:
I am not an expert in the Zalewski case or all the legal problems on which the Attorney General has provided advice. All I can say is that we hope that the final set up that emerges from the legislation, and what the Bill will say, means that we will continue to have a very robust but relatively workable solution so that we can make those sorts of decisions quickly.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Obviously, the Department has the intent of delivering on this. It is just about making sure that we get that added information if anything has changed.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
That is brilliant. ComReg is going to have greater powers, such as "a broadened information gathering power, ability to reuse already gathered information, ability to better assist the Minister with policy making and improvements to the notification, privilege and overcharging provisions." What is that extra power exactly in relation to how ComReg is handling the information?
Ms Caroline Dee-Brown:
In essence, there is a need to ensure that we provide relevant information to assist in policymaking, but confidentiality is key. Having a legislative provision for allowing the sharing of that information or the reuse of it, but while ensuring that confidentiality is maintained, is crucial. From our perspective, to ensure that is managed properly, we want these legislative provisions to make it copper-fastened, so to speak.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
That makes complete sense. Mr. Mourik talked about other legislation and secondary legislation that will be passed to give ComReg greater powers. I ask Mr. Mourik to outline them. I will leave my other questions for the moment.
Ms Barbara Delaney:
The code covers every aspect of the regime, including wholesale provisions and so on, but I will focus on the consumer provisions. With the code, there are enhanced rights for consumers, for example, in terms of switching, getting an end-of-contract notice, getting best tariff advice at the end of a contract and getting a contract summary template so that a consumer can quickly compare like terms when they are shopping around. There are enhanced powers as part of that.
Those enhanced powers did not directly cover customer service, as we talked about, and that is why the enhanced powers under the code and the complementary pieces under the Bill-----
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Where is the line between consumer rights and the code? Will Ms Delaney outline that distinction?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Those are consumer rights as well.
Ms Barbara Delaney:
They absolutely are consumer rights. The difference as I would see it is that those are the rights that come from Europe around electronic communications providers. However, there are also general consumer rights in Ireland that also come from Europe and so on. These are sector-specific rights that we think are important.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
The current code covers electronic communications.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Why does the code not extend to interactions with customers? If I am a customer ringing a mobile service provider, I can be kept on the hook for three hours.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Why is that not covered under the code if it deals with electronic communications?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What does Ms Delaney mean when she says "publication"?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Has the fact that it cannot be done under the code been legally road-tested?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
In essence, those providers can be given a slap on the wrist and told they have been bad boys or girls but ComReg has no power to penalise them. Are the providers legally obliged to have a charter in place?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
At this stage, ComReg is, dare I say it, toothless in that area?
Ms Barbara Delaney:
It is important to say that ComReg has been taking action against service providers with the powers we have. I want to make sure that the committee understands we are ready to take action in that regard, and we will. Using the powers we have, numerous cases in the District Court have arisen since we were last before the committee. We can supply a list of those cases. The Chairman has talked about consumers who have had issues and directly because of the actions of ComReg, approximately 5.5 million refunds have gone to consumers. We want to redress the balance so that when we take action, it is effective, the root cause is eliminated and the same action does not have to be taken again.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Mr. Mourik said there is only one case pending before the courts.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
We are talking about the same actions.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Ordinary consumers are looking at ComReg. They are on the phone night and day. Joe Duffy's "Liveline" programme on RTÉ has spent hours on the issue. Consumers will look with incredulity on the fact that the body that regulates the area has only one case pending. I assume that case is against a mobile service provider. Is it?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Is that case against a mobile service provider? No. Is it against a telephone provider?
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Are we playing 20 questions?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
In essence, there is no case of any kind before the courts at the moment that ComReg, the regulator, has taken against any mobile service provider when the issue is taking up enormous amounts of man-hours on various programmes, including Joe Duffy's programme? Mr. Mourik would have to admit we have a problem.
Mr. Robert Mourik:
There are multiple investigations going on and settlements are also being made. The Chairman asked why the European framework does not extend to interactions with consumers. The philosophy behind the European legislation, and I make no comment on whether it is good or bad, is that once there are multiple providers and competition in a market, operators will compete on service and, therefore, like any other market, they will improve. That is the philosophy behind it. That is why if Ireland transposes the code, nothing in that transposition will state that providers must meet specific qualities of standards. If Ireland wants to tackle that, it must be done through primary legislation and that is what this Bill is about. I am just trying to explain.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I am saying to Mr. Confrey that we want more information for the Attorney General. We want to see this legislation enacted overnight but we obviously want it to be robust. The quicker the advice comes back, the quicker everyone can move on. I apologise to Deputy Ó Murchú.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
In fairness, the Chairman got to the crux of the matter. In fairness to ComReg, when its representatives were previously before the committee, they said they did not have the tools required to do business, to do right by the consumer and to put pressure on mobile phone providers and others. We hope this legislation will provide those tools. We have a piece of work to do in that regard.
Our guests have dealt with the other pieces of secondary legislation. There was mention of the task force around nuisance scam calls. I recently got a call from New Zealand that was legitimate but I did not answer it. The person calling sent me a text message that said he cannot get anybody to answer his call because that is the way it is. I rang him back, our guests will be pleased to know. Who is on the task force? Our guests have give the general timeline for it and said there are already a number of options on the table that they are considering enacting. What are those options? Can our guests go into that detail?
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
That is fair enough.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
There is then a counter strategy.
Mr. Robert Mourik:
----that is tipping off the fraudsters about what we are doing. I would prefer to keep that quiet. All the main telecom operators will included on the task force, as will the NCSC and the Department. We are also working with the Garda, etc. It is a real national task force that will look at the most pragmatic and best solutions.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Does it also deal with international stakeholders?
Mr. Robert Mourik:
We are keeping in touch with international stakeholders. What we have learned from our fellow regulators in other countries is that there are all sorts of measures out there. The Federal Communications Commission, FCC, has been dealing with this for the past ten years. We are trying to look at the most pragmatic solutions that will make the biggest difference most quickly rather than trying to solve the problem with investments over the next ten years.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I accept that. I understand ComReg has to keep watching the situation. Could the committee at some stage get a private briefing?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Will the legislation that is coming forward in any way assist ComReg in the task of dealing with the scam callers who are rampant at the moment?
Mr. Robert Mourik:
In principle, we hope that the task force will work together in order to come up with the right technical solutions. If that requires forcing an operator to do something, which I do not expect, we could use those powers. I think the operators are well convinced of the need to do something because those scam calls undermine the whole industry.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
When does Mr. Mourik expect the report to be published?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Mr. Stephens is here from the NCSC. Are there security implications for the State from these scam calls?
Mr. Joseph Stephens:
There are national security issues resulting from some of the scam calls. I will make particular mention of a malware called FluBot, which had the potential to overload some of the networks because of how it was proliferating. If it got onto one person's phone, it went to everybody in his or her phone book and so on. We worked closely with the operators and the regulator so that the operators could take action by providing threat intelligence, blocking numbers and dealing with our international partners. The computer security incident response team, CSIRT, is a network across Europe that has been set up well. We are a part of that network which shares that type of intelligence so that we can proactively stamp out that activity.
We are working on the practical solutions to this.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Has anything developed or come about since the Department started the work on it? When did Mr. Mourik say the task force commenced?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
It only commenced in the last week.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Has anything happened over the last number of months? Has something has been done that is in some way counteracting these scammers? They have become a serious virus. I put it to Mr. Stephens that one would have to worry about the security of the State in terms of the implications of these scammers. Have the officials been able to do anything of a technical nature to address that, even prior to the task force being established? I ask Mr. Stephens to respond first, then Mr. Mourik.
Mr. Joseph Stephens:
I will not go into the details but there has been one technical solution to address one part of the scam texts. That would be the most malicious type where you have your phone and it comes in and appears to come from a legitimate source like, say, a bank, and so on. We have technical solutions in place now. They are not 100% perfect. No solution ever will be but there are now solutions that try to stop that. We have signed up with a number of different entities in the State, have seen extremely promising results and have very good evidence that it is working well.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Are there any scammers out there at the moment that are a threat to the State? I mean ones that are active at the moment.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Mr. Stephens already mentioned one scammer. What did he call it?
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I apologise but was the concern with that one that it would overload the system?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Does Mr. Stephens know where that originated from, where it is being operated from or who would have come up with it?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What does Mr. Mourik have to say?
Mr. Robert Mourik:
Over the last number of months we have seen individual operators taking measures in their own networks. They were not always co-ordinated but they have taken measures. Hundreds of thousands of scam calls have been blocked already by individual operators, so operators are already doing things. Now we are trying to see what the learnings are from that. Perhaps what operator A does can be replicated by operator B as well. We are trying to------
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
An Garda Síochána is involved with this as well.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
It is probably something we will follow up on as a committee. Deputy Matthews is due to speak next.
Steven Matthews (Wicklow, Green Party)
Link to this: Individually | In context | Oireachtas source
I apologise to the Chairman. I have just returned to the meeting so I do not have any questions at this point.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Okay. I move to Senator Dooley. He does not seem to be available.
I might go through some points until Deputy Matthews gathers his thoughts. The .ie domain for websites is coming up with us. Do the bodies represented have any role in regulating the domain?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Who regulates that area?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What is the small role ComReg has?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I might ask the Department. It has come up. It is a bit abstract, but it is hugely important. What is the Department's understanding of who regulates that area? Does it propose to bring in any legislation that would reform or enhance regulation of that area? Things are evolving at such a pace.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Go ahead Mr. Stephens.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Yes.
Mr. Joseph Stephens:
We do not have a formal role in managing how domains are registered and that system, but we have a statutory role in regulating the security of the .ie namespace. Through a directive that came down from Europe called the network and information systems directive, domain registrars and registries like .ie are formally designated. In this country we have an oversight function. They have to take a minimum level of security measures. We have a compliance team that works with them to ensure they-----
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Is that under the NCSC?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I do not really understand ComReg's role in this.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Yes. Returning to Mr. Stephens, does he see further developments with how the regulation of this area is going to evolve?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What would be the timeframe? Would that be implemented here by way of a statutory instrument or will it require primary legislation?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
At that point you would not be aware of whether it would be by way of secondary legislation, such as a statutory instrument, or------
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Obviously, at committees we want to deal with things that are relevant to people's daily lives. We have covered that we want to see legislation coming in as quickly as possible and being robust. Given our role, if there are going to be changes I ask that the officials try to get back to us as quickly as possible so we can assist in expediting the pre-legislative scrutiny.
Remaining with Mr. Stephens, I wish to return to the scams. Most people have had some of these messages coming up on their mobile, via text or whatever. On the work that has been done, An Garda Síochána has been out publicly on it. What has been learned from the profile? I include Mr. Mourik in this as well. Where it is coming from? I ask the witnesses to elaborate a bit more on the implications for State security. Is there interaction with Europe on how it is going to be dealt with, or maybe even at a world level? I ask the witnesses to give us an overall flavour. Have the bodies represented got the powers? Are there penalties? These scammers are operating in an almost completely virtual world. Where does this stand at the moment? When did it come to Mr. Stephens's attention? I ask him to give us a general outline.
Mr. Joseph Stephens:
I suppose scams have been around as long as there have been scammers. As long as I have worked in the NCSC, scams conducted over the Internet have been a concern of ours. On what we have learned, one of the most important things is that these scammers do not respect the way we are broken down as a State between different regulatory authorities, different agencies, different laws and so on. We must have a joined-up approach. That is why something like the task force that has been established-----
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Who is on the task force? Obviously, there is the NCSC, ComReg and An Garda Síochána. Who else is on it?
Mr. Joseph Stephens:
The task force initially has a focus just on industry. It is on ComReg and the industry, and they are dealing bilaterally with the outside agencies. We have very close working relationships. The initial intention is that the industry and ComReg will focus on what technically can be done and then-----
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I have seen An Garda Síochána on RTÉ news about it.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
It is a joint task force between ComReg and the National Cyber Security Centre, NCSC.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Who is on the task force?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Why is the National Cyber Security Centre not on it, as it could have implications for State security?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Is NCSC brought in for technical advice?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Will you elaborate on what you mean when you said that the scammers do not respect, in any form, our current structures?
Mr. Joseph Stephens:
What I mean is that, although this may appear to a consumer or any of us that this is a single issue, it affects all various agencies in the State. The collaboration and information sharing between us, which is quite good in practice, is the important thing. There is no simple solution. The technical solutions being worked on are very important, as is public awareness and making sure that everybody knows about these scams and understands how to differentiate between them. Legislation is important so that if somebody is not pulling their weight, there can be enforcement. These tools need to be used to combat it. That is what I mean in saying it does not respect boundaries.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Does the task force have the legislative tools necessary? We respect that it has to be careful in terms of public utterances it makes on this area. Will Mr. Mourik elaborate on how he finds the task force generally? What timeframe would allow it to get to grips with the situation? Has the task force been able to deal with it in recent months?
Mr. Robert Mourik:
I will stick to a very high level and try to explain it in a non-technical way. From an international point of view, English and French speaking countries tend to have a bigger problem compared with countries with a less common language because they tend to have former colonies where that language is spoken, where a lot of the scams originate from. Based on what we have seen, many of the scams originate from outside the State, although not exclusively. I refer to where they originate from within a state. The United States has seen that once it tried to tackle the problem from within the United States, the scammers moved to countries in the Far East, for example. It is not easy to tackle it, but it is more prevalent in English and French speaking countries.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
English speaking countries, like ours, are being attacked the most by the scammers.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Is the task force able to identify where they are coming from?
Mr. Robert Mourik:
To some extent we can, but that is almost irrelevant. What we have been able to do is determine, to some extent, what technical loopholes they make use of. I will not go into too much detail, but part of the problem is that in the past the telephone system was a closed system. There was a monopoly in every country and it was based on technology that only a few trusted operators had access to. Nowadays, the telephone system is far more open and it is linked to the Internet, and there are newer standards. As a result of that, some fraudsters, many of whom are very well informed about what the technical capabilities are, can come up with those scam calls. What we are trying to do is to look at that to see what we can put in place in order to stop it.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Is there a European dimension to this?
Mr. Robert Mourik:
To some extent there is. ComReg is part of the Body of European Regulators for Electronic Communications, BEREC, which is the European organisation of regulators, and we do an awful lot of information sharing. One sees that it is prevalent in some countries but not in others. The flubot problem that Mr. Stephens mentioned is the only issue that, for example, the Belgian regulator is dealing with, but it is not dealing with other technical scam calls. We are definitely co-ordinating internationally.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Ireland's exposure as an English speaking country is very high.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
What is the timeframe on this to get to a point where ComReg will have whatever equipment is required? Is there any legislation to tackle this?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Does the task force report formally to the Minister with responsibility for communications in six months time?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
Who has commissioned the report?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
It is an area we may come back to. I call Deputy Ó Murchú who will ask the final questions and then we will conclude.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
We might have gone off on a tangent, but sometimes that can be very useful. Can we deal with the National Cyber Security Centre, NCSC? Obviously, it became an overnight sensation after the attack on the HSE. Every expert we spoke to who came before this committee and in other fora stated that they did not believe the NCSC had the resources that were required. We have seen a reasonable increase in resources, such as money, people and buildings etc. Does Mr. Stephens believe the NCSC is in the place it needs to be to do the job it has to do, in the context of dealing directly with major infrastructural companies and ensuring they carry out best practice as regards protecting us?
My second question is about the risk we are facing. We believed at the time that the HSE attack was carried out by subcontractors who come from a part of the world that is currently in the news. We are talking about hacker teams that operate as subcontractors. They may operate privately but certain states can avail of them when necessary. It is obviously a huge risk.
Mr. Joseph Stephens:
In terms of the first questions on our capabilities, the Government made a decision in July 2021 to increase the capacity of the NCSC. It was a five-year plan to increase our numbers by the end of this year to approximately 45 people from our initial base of 25 people. We launched a number of recruitment competitions, which included a permanent director. Mr. Richard Browne is now in that position. We also launched a number of competitions at principal officer level on the technical and the management sides. This is in addition to a number of senior management positions as well as cybersecurity specialists. We have a lot of recruitment going on and we are ramping up in terms of capacity. As for resourcing, we received the funding we requested. I would say we are in as good a place as we have ever been in terms of our ability to respond.
I can speak a bit about the HSE attack, which the Deputy mentioned. Essentially, how these groups operate is that they have what are known as "affiliates". They are almost like franchisees who will carry out the attack for a larger group, and then the larger group will deploy the malware. As was said, they can be hired on dark web forums or through direct connections.
The Deputy raised the rising tensions in Europe.
We are currently operating at a heightened state of preparedness. As a result of the recent incidents the Deputy has mentioned and ongoing tensions in eastern Europe, we have contingency plans in place. We have also issued a number of guidance documents and supports to industry over the past number of weeks.
Over the weekend, we issued an advisory on the rising tensions and an assessment of how it could impact the State and some advice to our constituents, including a document called the cyber vitals, which contains the key measures organisations should be taking when there is this heightened cyberthreat. I think that has answered the questions the Deputy had asked. Did I miss anything?
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Does Mr. Stephens think the NCSC has the required resources to do the business it needs to do?
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
Is Mr. Stephens relatively happy, after the interaction the NCSC has had with some of these possible target companies and whatever else, that they are doing what they need to do?
Mr. Joseph Stephens:
We have very close working relationships with what we would call the core critical infrastructure operators. We have direct relations with them where we can contact them out of hours, if necessary. We can also conduct briefings of those organisations to ensure they are in a good place to respond in the worst-case scenario.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
It is obviously very reassuring that actions are being taken on basis of the issue we have with Russia and Ukraine. During an attack, there are attempts to disrupt. I accept that some of this stuff could relate to the Defence Forces, rather than NCSC, but some of the experts we had before us talked about almost a counter-strike capacity. What would the NCSC and CSIRT do? What is disrupting an attack? Does that involve some element of what I think it does?
Mr. Joseph Stephens:
The NCSC is a defensive organisation. We are about understanding what is happening on the networks, blocking attacks before they happen or helping organisations to recover from attacks. I am not sure exactly what a counter-strike would mean but if it is a kind of offensive cyber capability, one is definitely-----
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I imagine, in real terms, that would relate to the Defence Forces. While under attack, sometimes, one counterattacks in order to disrupt. The NCSC is involved when an attack is on. I assume some of it means there is some sort of over and back.
Mr. Joseph Stephens:
Not necessarily, in practical terms. It is more about blocking off the entry points for attackers. In the instance of the HSE, the entire network is then taken offline in order that it has no connection to the Internet and there is no way for attackers to control any malware they have in. It is then a kind of methodical process of clearing the network.
Ruairi Ó Murchú (Louth, Sinn Fein)
Link to this: Individually | In context | Oireachtas source
I accept that and I assume the NCSC is obviously within the American defence set-up. It probably does engage in some of this, especially when certain players come on the attack.
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
I thank the officials from the Department of the Environment, Climate and Communications and ComReg for coming today. We want to see the legislation come through as quickly as possible. Obviously, it has to be robust and there is the Attorney General's advice. I ask the witnesses to advise us on any changes in order that we can come back with pre-legislative scrutiny as quickly as possible. I want to see ComReg having the powers, as we discussed previously, but the powers must be effective and the operators genuinely afraid of them. Otherwise, it is impossible to see them operating in practice. We will do a further body of work on the scams. We wish the witnesses in the deliberations. When does Mr. Mourik think we will see action by ComReg, that it will make known publicly, on the scammers?
Kieran O'Donnell (Limerick City, Fine Gael)
Link to this: Individually | In context | Oireachtas source
This is not really a task force. It is as an implementation report.