Council put ring of e-steel on servers after €4m attack

PAUL MURPHY
The electronic attack on Meath County Council which resulted in more than €4m of its finances being transferred fraudulently to a Hong Kong bank and are now frozen there by police order has served as a reminder to all public authorities including Meath County Council of the need for ongoing vigilance in the face of the ever-increasing threat of cyber crime. That’s according to council chief executive Jackie Maguire who updated councillors this week on ongoing to efforts to see over €4m in council funds returned.

She said that unlike security threats, this was a relatively new security risk and as the dependency of organisations on ICT continued to grow, the need to be aware of, equipped and prepared for potential attacks needed to be kept under constant review to minimise the effect on operations. “It is also important that organisations share information on cyber attacks and that any incidents of cyber crime are treated as fraud and reported to An Garda Siochana for investigation at an early stage”, she said.

It emerged this week that as criminal investigations went on, the county council had considered various options for getting its funds back, including the putting in place a bank-to-bank indemnity between the Bank of Ireland and Standard Chartered Bank (Hong Kong) which would have required the council to provide an equivalent guarantee to Bank of Ireland.

The other option considered was to directly take legal proceedings to secure the necessary court orders in Hong Kong. Following extensive consultations with the council’s legal advisor, the Bank of Ireland, and Hong Kong police, the latter option was chosen.
The council hired an international law firm in Hong Kong with experience in cyber crime fraud and identity theft to pursue the recovery of the money.

Extensive affidavits and exhibits were prepared by council staff and a court order by means of an interim Mareva injunction (freezing assets) was obtained on 15th December in the High Court in Hong Kong.
A permanent injunction was obtained at a court hearing on 23rd December and civil proceedings are continuing to enable return of the money.

Since the incident, the council has carried out a review of its ICT systems in order to identify and reduce exposure to cyber threats, including the setting up of a ‘sender policy framework’ adding a layer of protection by defining the email servers that are allowed to send @meathcoco.ie emails; the council’s email filter provider has implemented a new check on all incoming emails to test the ‘from field’ that includes @meathcoco.ie
These check inserts a warning message at the top of the email advising the user to be cautious before taking any actions based on the email.

The council has also engaged an ICT consultant to conduct a high level information security assessment on the council's systems; and the council has engaged Price Waterhouse Cooper to carry out a high level review of its internal control environment to identify any deficiencies in the system and rectify the has.

- In this week's print edition of the Meath Chronicle (dated 14/1/17) we stated that 'half the county's bank balance' was frozen in a Hong Kong bank account. This was incorrect. We are happy to correct the matter.