Author: admin

The opening of a malicious Microsoft Excel file attached to a phishing email led to the cyber attack that crippled the national health service earlier this year, according to a report on the incident published on Friday.

The file was opened at a HSE workstation on March 18th, with the email having been sent to the “patient zero workstation” two days earlier.

Over the coming eight weeks, a number of “alerts” were raised within the health service that the IT system might be compromised, but the significance of the alerts was not identified at the time.

The ransomware that was introduced into the system was “detonated” on May 14th, leading to an immediate crisis across the health service.

At a press briefing prior to the publication of the report, HSE chief executive Paul Reid said a high proportion of the organisations that are subjected to a cyber attack are “re-hit” and that actions have and are being taken to mitigate the risk to the service.

The response to the alerts that were raised did not involve the response that should have occurred, he said.

The Department of Health, and an unidentified hospital, took steps prior to May 14th that mitigated the effect of the attack on their systems, the briefing was told.

‘Frail’ IT system
The report, commissioned by the HSE from PwC, identified the “frail” nature of the dispersed IT system used by the health service as a key weakness and recommends a multi-year programme of investment in IT and cybersecurity.

There was a “known low level of cybersecurity maturity” within the HSE and the connected national health network, and this weakness had “persisted”, the report said.

An extra €100 million is to be spent on this issue next year, Mr Reid said, and a business case for an as-yet-uncosted multi-year investment programme is being worked on.

A subcommittee of the HSE board should be set up and should ensure requests for funding to the Government for an IT upgrade “are clearly articulated and the risks associated with the lack of investment are communicated and understood,” the report said.

The report is to be shared with other State and non-State organisations to inform their future preparedness against cybercrime, which is “increasing in frequency, magnitude and sophistication, with cybercriminals operating across jurisdictions and country borders”.

Ransom
The report does not deal with the issues of a ransom or the location of the criminals behind the attack, but the Government said at the time no ransom would be paid, and a number of observers have said the criminal gang responsible is mostly likely based in Russia.

The report noted the staff in the health service showed “dedication and effort” in response to the crisis with individuals across the HSE and elsewhere in the health system responding in a way that illustrated they are “resilient, respond quickly, and have an ability to implement actions and workarounds” in times of emergency.

It noted the HSE is the largest employer in the State and uses more than 70,000 devices, such as personal computers and laptops.

When the Conti ransomware attack was launched early on Friday, May 14th, it resulted in healthcare professionals losing access to all HSE-provided IT systems.

“Healthcare services across the country were severely disrupted with real and immediate consequences for the thousands of people who require health services every day.”

At the press briefing Mr Reid said there was no indication that any patient had died as a result of the cyber attack, and that “great credit” was due to those in the health service for the way they had responded.

The report details how cybercriminals have been targeting healthcare providers and healthcare organisations in the United States, Australia and New Zealand, though Ireland was the first jurisdiction to suffer an attack on its national health service.

Last month much of the provincial healthcare system in Newfoundland was attacked.

The report said it appeared that the criminals used “relatively well-known techniques and software to execute their attack”.

Personal data
The report details how once the criminals had gained access to the health service system, they compromised and abused a significant number of accounts with high levels of privileges, compromised a significant number of servers, exfiltrated data, and moved their operation to statutory and voluntary hospitals.

At the press briefing, the HSE’s interim chief information officer, Fran Thompson, said the normal and the “dark” web were being monitored to ensure people’s data was not published.

The seriousness of the attack on the health service could have been greater, the report noted, “if there had been an intent by the attacker to target specific devices within the HSE environment, eg medical devices”; if the criminals had tried to destroy data at scale; or if they had interfered with the system used by the Covid-19 vaccination scheme.

It is likely that the time it took to recover from the attack would have been “considerably longer” if the criminals had not, on May 20th, posted a link to a key that decrypted files encrypted by the Conti ransomware.

The report noted the areas of the health service that were best equipped to maintain clinical services during the prolonged IT outage were those that rely on paper records for patient services.

It said the seriousness of the deficiencies in the health network system persist and require “transformational change”.

It is clear that very significant investment “on an immediate and sustained basis” will be required to improve the HSE’s IT system and its security.

Improving the system – which “evolved” rather than having been designed, and which involves a cybersecurity risk that is common to all organisations connected to the national health network – will be a “complex programme”, the report said.

The vulnerabilities that are highlighted in the report are not unique to the HSE, the PwC report said, and all organisations therefore need to consider the extent to which they are protected from a major cyber incident.

“The HSE, the State, and non-State organisations, now have an opportunity to build a more robust and resilient cyber frontier nationally.”

https://www.irishtimes.com/news/crime-and-law/opening-of-email-attachment-led-to-hse-cyber-attack-report-finds-1.4752043

This year has seen a massive increase in the number of fraud incidents reported to gardaí, a trend driven largely by bank scams and unauthorised card transactions.

Fraud was up by 72 per cent in the 12 months to September 2021, compared with the previous 12-month period.

Quarter three of 2021 set a record for reported fraud incidents. Between July and September, 4,171 incidents were reported, more than double the amount reported in quarter three of 2020.

This was the highest quarterly total for fraud incidents since the Central Statistics Office (CSO) began compiling crime statistics in 2006.

Most other crime categories have seen a decrease this year. This is particularly the case for homicide offences (including murder, manslaughter and dangerous driving causing death).

Overall, homicides decreased by 49 per cent (from 82 to 42) in the annualised figures up to September 2021. This includes a 32 per cent decrease in murders, which went from 37 in the previous annual period to 25 this year.

However, sexual offending continued to rise this year, with 3,306 offences reported in the 12-month period up to September, a 9 per cent increase on the previous period and a 20 per cent increase since 2017.

While assaults and similar offences have fallen over the 12-month period, by 4.1 per cent, there was a spike in such incidents during quarter three of this year, which particularly affected younger men and older women.

There was an 11 per cent increase in assault-type offences in quarter three, compared with quarter three of 2020. Offences with a male victim aged 18 to 29 increased by 34 per cent to 896 incidents and offences against women over 60 increased by 68 per cent to 126 incidents.

Burglaries were down 36 per cent, thefts 20 per cent and robberies 18 per cent on an annual basis.

The CSO advised that the impact of Covid-19 restrictions during that period should be considered when looking at the figures.

It also reported that gardaí recorded 516 offences relating to breaches of Covid-19 regulations in quarter three of 2021. This figure was significantly lower that those recorded in any other quarter since restrictions were introduced. The CSO said this reflects “the relatively low level of Covid-19 restrictions compared to earlier quarters”.

Cancelled 999 calls
The improper cancellation of 999 calls by gardaí on the Computer Aided Dispatch (CAD) system, which resulted in some incidents not being recorded on the Pulse system, may have impacted the recording of crime statistics, the CSO warned.

“The CSO is awaiting clarification on the full impact of the issue from [the Garda], including the time periods involved [how far back this issue goes], the crime types impacted and, crucially, the estimated numbers of crimes which were not recorded on Pulse due to inappropriate cancellation of CAD calls, before it can determine the impact on recorded crime statistics,” CSO statistician Sam Scriven said.

CSO crime statistics continue to be published with the “under reservation” caveat. This caveat was first introduced following a Garda Inspectorate report in 2014 which found serious issues with how crime statistics were being recorded by gardaí.

“The statistics under reservation categorisation will remain in place until such time as the CSO is satisfied that the level of accuracy and completeness of the underlying data is of sufficient quality,” the CSO states on its website.

https://www.irishtimes.com/news/crime-and-law/fraud-offences-increase-by-72-this-year-driven-by-bank-scams-and-card-transactions-1.4761079

The High Court has refused an application by a hospital worker to quash a decision that prevented her from working from home. The applicant claimed that she was at high risk from Covid-19 due to her health history and that the hospital failed to comply with HSE requirements in making the decision.

Delivering judgment in the case, Ms Justice Miriam O’Regan held that the case arose solely from the individual contract of employment between the applicant and the hospital. As such, the court held that the case was a matter of private law and was not amenable to judicial review.

Background
The applicant worked for a hospital as an Attendant Team Leader. She retired from her position in October 2020 on her 65th birthday. However, she had not worked in the hospital since 2 April 2020, when she was advised that she was a close contact of a staff member who had tested positive for Covid-19.

The applicant had previously been diagnosed and treated for breast cancer in 2016 and also suffered from diabetes. As such, she argued that she did not wish to physically return to work and wanted to work from home.

A doctor in the hospital’s Occupational Health department deemed the applicant as fit to return to work in the hospital. The doctor took the view that the applicant did not qualify as at “very high risk” from the virus and that she did not need to cocoon.

The hospital argued that it had put in place adequate precautions for employees who had to work in person. The hospital stated that the applicant was only at “high risk” rather than “very high risk” of Covid-19 and therefore was required to attend work.

The applicant filed a grievance with the hospital HR department in July 2020. The applicant complained that the hospital was not complying with HR Circular 34/2020, which she said gave rise to a duty of care. Further, she provided two expert reports which supported her request to work from home.

The applicant and a SIPTU representative met with a hospital representative in October 2020. A month later, the decision-maker wrote to the applicant, stating that there was no suitable, alternative employment available to her during the relevant period. Further, the decision-maker said that the doctor in the Occupational Health department had considered the applicant’s medical reports but did not think that cocooning was warranted.

The decision-maker concluded that the applicant’s health status was “appropriately and professionally reviewed” and the grievance was not upheld. Subsequently, the applicant issued judicial review proceedings against the HSE and the hospital, claiming that the decision was irrational, that she had not been given adequate reasons for the decision and that the hospital failed to comply with HSE requirements.

The respondents defended the proceedings on the basis that the matter related to the private employment dispute and, accordingly, the case was not amenable to judicial review. The respondents also contested the merits of the application and submitted that the hospital was correct to not allow the applicant to work from home.

High Court
The court began by considering whether the case was appropriate for judicial review. The court outlined the well-established principle that private law matters are generally not amenable to judicial review (Beirne v. The Commissioner of An Garda Síochána [1993] ILRM; Geoghegan v. Institute of Chartered Accountants in Ireland [1995] 3 IR 86). Ordinarily, a decision-maker must exercise a public statutory function in order for judicial review to apply to their decisions.

The court also considered Bloxham v. Irish Stock Exchange [2013] IEHC 301, and held that: “Judicial review remedies are addressed to persons or bodies who can be held answerable in respect of the performance of their duty or function, the origins of such function, jurisdiction or authority deriving directly or indirectly from the State.”

In O’Donnell v. Tipperary (South Riding) County Council [2005] IESC 18, it was noted that the burden was on a respondent to prove that a case was a private law matter and that a court would exclude judicial review only if the case arose “solely and exclusively from the individual contract and private law.”

Additionally, Ms Justice O’Regan held that the wider consequences of a decision were important factors to be taken into account (Kelly v. Board of Management of St. Joseph’s National School [2013] IEHC 392).

Having considered the case law, the court was satisfied that the matter was not amenable to judicial review. The court held that the case was not a disciplinary matter and clearly related to the individual working conditions of the applicant. The court noted that the employment was governed by contract rather than by statute. As such, the court held that the respondents had discharged the burden of proof that the case related to a private law matter.

The court also went on to consider the merits of the application and held that the applicant would have failed on this issue as well. The court held that the applicant failed to demonstrate a breach of fair procedures. It was appropriate for the hospital to seek the views that it did and the applicant was given an opportunity to present her position on the matter.

Further, the court held that the medical reports relied on by the applicant did not appear to recommend cocooning. The oncological expert stated that the applicant’s exposure to Covid-19 should be minimised and that “everything should be done to avoid possible contact with the virus at work”.

Similarly, the endocrine expert stated that the applicant should “continue to self-isolate as much as possible in order to avoid contact as her immune status is compromised by her condition”.

The court held that the applicant failed to establish that the reports required her to cocoon or self-isolate. Further, the reports did not establish that the applicant was at “very high risk” of Covid-19. Accordingly, the decision of the hospital was not irrational or unreasonable.

Conclusion
The court refused to grant the reliefs sought.

https://www.irishlegal.com/articles/high-court-worker-fails-to-quash-hospitals-refusal-to-let-her-to-work-from-home