Briefing by Garda Siochana Ombudsman Commission to Minister for Justice
3
Garda mbudsm n HOUlkY I lf O I:: P[ t E HC I: I M tttt I At Briefing note t o the Minister f o r usti e and Equality 10 February 2014 This Commission was appoin ed on 12 December 2011. From a n ea rly stage, we ta lked about sec urity and risksto our buildin g. Evenbe foret his Com mission, security chec ks were co nducted byexternal specia lis t c ompanies for t he o rganisation. In the course of our operations, the Commission has always been cons cious of the need for approp riate confidentiality and proper levels of security. The Commission has brought to the attention of its staff the need to r espect confidentiality of investigations and only to make appropriat e cont ac twi th thi rd par ties. On 2 to 27 September 2013, in accordance with standard operating procedures, a securit y sweep was conducted of GSOC s Head Office. This was conducted by a UK security fi rm as the Iris h firm that had p reviously conducted such operations for G SOC had gone out of business. To ensure a signi ficant degree of independence , the Commission decided to co ntract a UK security firm (Verrimus) that had been r ecommended to us as having previously done work for a credible age ncy with w hich we have a wor king relationship. The o verall cost of t he security checks undertaken in late 2013 was just under €18,000 . As well a t he gene ral check o f our building, the Commiss ion al so sought expe rt advice on t he sorts of capa bilities that exist in rela tion to the interception of ICTcommunications (inclu din g tel eph one s) . Two potential threats were ident ified during t his security sweep o f 23 to 27 September 201 3 . Threat 1: a Wi-Fi device , located in the Boardroom (the Commission s conference room ), was found to have con nected to an external Wi-Fi network. Access to this Wi Fi device was protected by a password; absent this password, the device should not have been able to connect to that external Wi-Fi network. As GSOC does not have a Wi- Fi network, this device had never been activated by GSOC and its passw ord was unknown. Its connec tion to a n external network was , therefore , a c oncern. T his device , although Wi -Fi enable d , was unable to communicate with any of GSOC s data bases or electronic sy stems. Threat 2: as part of the security che cks, the conf er en ce call telepho ne unit located in the Chairman office was subjected to a number of tests . One of the tests involved sending an audio signal do wn the teleph one line ; this is k nown as an alerting test as it presents t he ossibility that a listener will hear this audio signal. Immediately fter the transmission of this audi o signal , the co nference phone line r ng The Ver rimus operator judged that the like li h ood of a wrong number being call ed a t that Page 1 of 3
-
Upload
tj-mcintyre -
Category
Documents
-
view
218 -
download
0
Transcript of Briefing by Garda Siochana Ombudsman Commission to Minister for Justice
8/13/2019 Briefing by Garda Siochana Ombudsman Commission to Minister for Justice
http://slidepdf.com/reader/full/briefing-by-garda-siochana-ombudsman-commission-to-minister-for-justice 1/3
Garda
mbudsm n H O U l k Y I lf O I::P [ t E H C I: I M tttt I At
Briefing note to the Minister for usti e and Equality10 February 2014
This Commission was appointed on 12 December 2011. From an early stage, wetalked about security and risks to our building. Even before this Commission, securitychecks were conducted by external specialist companies for the organisation.
In the course of our operations, the Commission has always been conscious of theneed for appropriate confidentiality and proper levels of security. The Commissionhas brought to the attention of its staff the need to respect confidentiality ofinvestigations and only to make appropriate contact with third parties.
On 23 to 27 September 2013, in accordance with standard operating procedures, asecurity sweep was conducted of GSOC s Head Office. This was conducted by a UKsecurity firm as the Irish firm that had previously conducted such operations forGSOC had gone out of business. To ensure a significant degree of independence,the Commission decided to contract a UK security firm (Verrimus) that had beenrecommended to us as having previously done work for a credible agency with whichwe have a working relationship.
The overall cost of the security checks undertaken in late 2013 was just under€18,000. As well as the general check of our building, the Commission also soughtexpert advice on the sorts of capabilities that exist in relation to the interception ofICT communications (including telephones).
Two potential threats were identified during this security sweep of 23 to 27September 2013.
Threat 1: a Wi-Fi device, located in the Boardroom (the Commission s conferenceroom), was found to have connected to an external Wi-Fi network. Access to thisWi
Fi device was protected by a password; absent this password, the device should nothave been able to connect to that external Wi-Fi network. As GSOC does not have aWi-Fi network, this device had never been activated by GSOC and its password wasunknown. Its connection to an external network was, therefore, a concern. Thisdevice, although Wi-Fi enabled, was unable to communicate with any of GSOC sdatabases or electronic systems.
Threat 2: as part of the security checks, the conference call telephone unit located inthe Chairman s office was subjected to a number of tests. One of the tests involvedsending an audio signal down the telephone line; this is known as an alerting testas it presents the possibility that a listener will hear this audio signal. Immediately
after the transmission of this audio signal, the conference phone line r ng TheVerrimus operator judged that the likelihood of a wrong number being called at that
Page 1 of 3
8/13/2019 Briefing by Garda Siochana Ombudsman Commission to Minister for Justice
http://slidepdf.com/reader/full/briefing-by-garda-siochana-ombudsman-commission-to-minister-for-justice 2/3
time, to that exact unknown number, at the time of an alerting test, was so small asto be at virtually zero. GSOC conducted a number of telecoms checks to seek toestablish the source of this telephone call but was unable to do so. Further checksrevealed no additional anomalies or matters of concern.
On 7 October 2013, after confirmation paperwork was received from the specialistfirm, the investigation team assessed these two threats . On 8 October 2013, a publicinterest investigation was launched pursuant to section 102(4) of the GardaSlochana Act, 2005. The investigation was launched on the basis that the ActingDirector of Investigations was of the opinion that, to the extent that these threatscould be proven, section 102(4) engaged - that is to say that such surveillance mayhave originated with AGS and, if so, a member of AGS may have committed anoffence or behaved in a manner that justified disciplinary proceedings. Theinvestigation was launched in the public interest to ensure that the objectives ofGSOC, as set out in section 67(1) of the Act, were not compromised or impugned.
As part of that investigation , the specialist firm was re-engaged and a number ofsteps were undertaken, including accessing retained telecommunications. During thecourse of the investigation, the specialists advised regarding the risks of interceptionto mobile telephony. The Commission established that commercial products wereavailable that could - for example - intercept mobile phones, take them over, sendand delete texts from them, etc.
hreat 3: during a visit by the specialist firm on 19 and 20 October 2013, it detecteda UK 3G network. UK networks do not operate within Ireland except in Border areas.They advised that such a network can only be simulated through a device called an IMSI catcher . An IMSI catcher, in simulating a UK mobile phone network, will pick
up UK phones registered to that network. Once a phone has been connected to theIMSI catcher, it can be forced to disable call encryption making the call datavulnerable to interception and recording. The specialist firm indicated that this levelof technology is only available to Government agencies.
reliminary Results:Analysis of these threats was inconclusive . GSOC was operating at the limits of itstechnical knowledge and on information from security professionals. TheCommission did not rule out that there could be reasonable explanations for any/allof these issues, e.g.:
• connection by the Wi-Fi device in the conference room with an external Wi-Finetwork was occurring randomly and with no discernible pattern or agentapparent.
• the anomaly in the telephone unit in the Chairman s office could not berepeated - the Commission could not rule out the possibility that an innocentcall was made to the office at 1am. Telecoms data could not identify anumber from which the call originated or even that a call had been made.
• concerning the IMSI catcher, the Commission could not rule out that such adevice was being lawfully used in the vicinity of Capel Street to, for example,counter subversion or organised crime.
Page 2 of 3
8/13/2019 Briefing by Garda Siochana Ombudsman Commission to Minister for Justice
http://slidepdf.com/reader/full/briefing-by-garda-siochana-ombudsman-commission-to-minister-for-justice 3/3
Final Test:Absent any further clarification the Commission could not simply proceed on thebasis that these issues were purely innocent or coincidental. Accordingly theCommission conducted a specific operational test on 19 November 2013; this wascoordinated by the security firm and involved a GSOC investigation team and the
three Commissioners to test these issues. This operational test yielded no resultsand added no clarity to the threats identified above.
on lusio n:The investigation was completed on 17 December 2013 and concluded that nodefinitive evidence of unauthorised technical or electronic surveillance was found. Itdid however confirm the existence of the three technical and electronic anomaliesset out above that could not - and still cannot - be explained. These raised concernsamong the investigation team in terms of the integrity of GSOC s security.
A Designated Officer furnished the closing report on 17 December 2013.
On the basis of that report it was decided that no further action was necessary orreasonably practicable. The investigation was discontinued.
GSOC suspects that this investigation report may be with the journalist who firstreported the matter. If it is there is an inaccuracy referenced in three places in thereport as to the commencement of the investigation. The Commission is undertakingan inquiry into any possible leak that may have occurred.
Since the investigation concluded GSOC has been working to review and enhanceour security systems in the light what the investigation revealed. There are still some
inconclusive issues in relation to the outcome of this investigation. The identifiedongoing risks to our ICT security are being addressed.
The Commission has not reported this investigation more widely. We clearly want tomaintain public confidence. We regret that decision; it was made with the very bestof intentions.
Garda Siochana Ombudsman Commission
Page 3 of 3
