Cork unit helping to keep public safe and secure from cyber crime

Headquartered in Dublin, the Garda National Cyber Crime Bureau (GNCCB) also has regional offices in Cork city, Galway, Mullingar and Wexford.

In Cork, the garda cyber unit team of seven is led by detective sergeant Michael Lynch and is based at Anglesea Street.

Helping to oversee the units in Cork and nationwide, along with keeping the public safe and secure from cybercrime, is Detective Superintendent Michael (Jock) Mullen of the GNCCB.

He’s been with the bureau since 2023, and enjoys his role working in the ever-evolving area of cyber crime.

He tells The Echo that the proliferation of technology and devices means they are connected to almost all crimes.

“Any crime in the country here, we’re always going to be part of it. So we’ve got a huge responsibility,” he explains.

Rebranded as GNCCB

Originally established in 1991, the cyber crime section was rebranded as the Garda National Cyber Crime Bureau (GNCCB) in 2017, with an expanded remit of providing a computer forensic service to all garda members and units.

Included in the work is seeing garda members carrying out forensically secure examinations of computer and mobile devices, that have been seized during any criminal investigations.

“If there is a serious crime anywhere here in Ireland and there are computers, phones, drones, smartwatch technology, those devices will come into our bureau for the purpose of examining, to identify evidence in relation to the crime,” says Mr Mullen.

“That’s first and foremost our main responsibility. But there’s another part which is called victim identification.”

In that regard, arguably one of the most emotionally challenging elements of the role carried out by the Garda cyber unit is the work undertaken in relation to the investigation of child sexual abuse material.

With many gardaí working on these type of crimes being parents of children themselves, looking at content such as this can be upsetting.

Gardaí working in cyber crime are only human at the end of the day, and looking after their mental wellbeing is an important part of Mr Mullen’s role.

“I’d like to acknowledge the work that the members do generally around the forensic examination of devices.

“But the work in relation to the investigation of child sexual abuse and exploitation is particularly challenging.

“Our members are subject to psychological counselling. So, every six months at least, our members will be part of that counselling service.

“In addition to that, we have lots of other health and wellbeing mechanisms. We have what we call wellness days, where we all go away to maybe some place in Kildare or Dublin and we do something as a team.

“Every six or eight weeks, I come down to Anglesea Street. As the superintendent, one of the things I discuss every time I do come down is the health and wellbeing of my members. Just to ask them how they are and if there’s any support they need.

“Policing is difficult enough as it is. But it’s a particularly difficult job when you are looking at child sexual abuse exploitation material.”

Another very important role is the investigation of cyber-dependent crime that targets significant or complex attacks on computer systems, corporate networks or critical national infrastructures.

Five years ago this month, the Health Service Executive (HSE) suffered a major ransomware attack that disrupted IT systems nationwide.

Mr Mullen says that was a gamechanger in terms of highlighting the importance having of robust cybersecurity measures in place.

“One of the things we talk a lot about is in-house training, whether you’re a small business somewhere in the country or you’re the HSE. I think it’s about awareness. A lot of people don’t like when you get the online or the training days in a business or a State body.

“I think it’s so important you have to have good sort of IT support, you have to have training in-house, you have to have penetration testing. If people fail that penetration test, there will be measures to try and bring them up to speed with cyber safety and security.”

Also covered by the GNCCB is the provision of cyber safety and prevention advice to all sectors of industry and the community, on the current and emerging risks to online activity.

This is done by gardaí liaising with law enforcement colleagues across the globe, academia and industry partners.

Cyber crime is constantly changing, with the likes of AI-generated attacks and deep fakes two examples of ever-evolving threats, and cyber crime is now the top financial crime threat in the country.

For the gardaí working in this area, Mr Mullen said that keeping abreast of all the latest emerging changes and threats is absolutely crucial. This includes collaborating with international policing colleagues through Europol, the EU law enforcement agency, and Interpol, the intergovernmental organisation that facilitates cooperation between the police forces of more than 180 countries.

“We have an intelligence unit within the bureau. So, their job is to keep up with those latest trends,” outlines Mr Mullen.

“They’d be talking on a very regular basis with other bureaus across the country here in Ireland. They’d be talking to the likes of Europol and Interpol on almost a daily basis. We have a very good relationship with our own National Cyber Security Centre, which deals with mostly critical national infrastructure. We also get information from external partners as well.

“Our intelligence unit third parties are looking at it every day and they are saying, ‘this is the current threat that we’re facing here’ and if there’s a need to communicate that to our members we’ll do that through bulletins that go out on a regular basis and send a more formal one out once a month.

“If there’s a need to alert the public as to a new scam or new online fraud type issue, we’ll go to our media department and we’ll agree a communication strategy, to make sure we tell the public that there is a new issue here in Ireland or elsewhere.”

Mr Mullen also feels that the threats and dangers posed by Artificial intelligence (AI) have evolved rapidly.

“Five or six years ago, if you didn’t have a technical background, you couldn’t commit a ransomware attack. Unfortunately, nowadays any average person can go online and probably learn very quickly, and actually deploy an attack just by following certain guidelines on the internet.

“AI has made it much easier for people to commit crimes anonymously.”

As a result, upskilling individual members of the Garda cyber crime bureau is something which needs to be done regularly.

“We attend courses. A lot of our courses are actually international. So there’ll be courses in forensics and things like cryptocurrency, and victim identification, which is identifying children who are subject of abuse and exploitation.

“We have actually run a course here in the last three years with Europol to upscale people internationally in relation to the investigation of child sexual abuse.

“In the last two years, we’ve brought across about 100 different police officers from about 30 or 40 different jurisdictions, people from New Zealand, Australia, Brazil, other places in South America.

“We brought them to Templemore and we have worked with Europol, our victim identification team over there, and we delivered a course to educate not just our members, but international members as well, in relation to investigating child sexual abuse material.”

Mr Mullen has advice for members of the public with regard to cyber crime prevention.

“The first thing is to slow down. So people, and I’ve done it myself, when they receive that text, they panic. So just slow down, take your time.

“People tend to panic. So the criminals do rely on panic, pressure and secrecy. I would say do not click links blindly. Do not move money under pressure. Use strong passwords and two-factor authentication. Keep your devices updated, talk to family members and report suspicious activity early.”

Finally, he says, the gardaí are there to help. “Whether it’s harassment, concerns around children, anything online, cyber-related, we’re here to help. Speak to a guard in the community, or go into your local garda station.”