Inconsistencies in Government policy on the use of social media apps on public service devices exposes government departments to cyberattacks, an expert has claimed.
The claim came from an information technology systems expert after concerns were raised by Social Democrats TD Catherine Murphy over different approaches taken by individual government departments on the management, barring and restriction of social media apps - including TikTok - from public service devices.
"It's a huge concern. It’s essential that right across Government and across all the civil service infrastructure that a consistent policy is applied," Dr Simon Woodworth, a lecturer in business information systems at Cork University Business School told the Morning Ireland radio programme on RTÉ Radio 1.
Dr Woodworth added the installation of apps on public service mobile devices, including mobile phones, "exposes a Government network or a departmental network to attack".
He also called for the Government to ban the video sharing app TikTok as a precautionary measure.
"We should, at least, as a precautionary measure, ban it for the moment and make that ban subject to review every six months as the situation becomes clearer," said Dr Woodworth.
"If there is any risk of data ending up in the hands of a foreign power then it's reasonable to, at least in the short term, ban the app that might be causing the problem."
Dr Woodworth's call came on the back of a series of parliamentary questions by Kildare North TD Catherine Murphy into the protocols and guidelines relating to the use of social media accounts by officials.
The written questions asked about social media restrictions on Government networks and whether the use of TikTok is barred.
The responses show some departments have banned or partially barred the use of TikTok from civil servants devices, while others have not.
Other departments are waiting for the National Cyber Security Centre (NCSC) to issue new guidance to Government departments on the use of social media apps on public service devices.
'Consistent and uniform approach'
Ms Murphy called for a "precautionary approach" by the Government on the installation of social media apps on public service devices.
She also criticised the Government for having a variety of approaches on the issue.
"I think the Government needs to take a consistent and uniform approach", she said.
She added there should be a ban on the TikTok app running on Government devices until assurances are given that social media apps are "not going to cause a problem".
Ms Murphy’s parliamentary questions follow a move by the European Commission to suspend the use of TikTok from its officials' work and personal devices at the start of this month.
It also follows moves in the UK and the Netherlands to restrict the use of TikTok on Government devices due to data protection and privacy concerns linked to the relationship between TikTok and the Chinese state.
A TikTok spokesperson told Morning Ireland "the Chinese Government has never made a request for data access" and that it has never shared data with the Chinese government and would never do so.
Read more:
TikTok to open second Irish data centre in Dublin
'Sensible' for Govt to seek security advice on TikTok, executive says
Departmental level
The written parliamentary responses show inconsistencies in social media policy across Government at departmental level, according to Ms Murphy.
- The Department of Education has barred TikTok.
"The TikTok app is not permitted to be used by officials for official business and is excluded from the work container of all Departmental corporate smart phones," the Minister for Education said in her written response.
- The Department for Public Expenditure; National Development Plan Delivery and Reform has restrictions in place.
- It has a system where apps like TikTok are containerised (or kept separate to) the part of the device used for 'official’ use.
In its response it states there are restrictions relating to TikTok.
It states: "The Department’s mobile phone handsets have a secure area 'containerised’ for official use, the application in question is not available to download in that secure containerised area."
It also states "assessing social media platforms on the network, ‘social networking’ is a category that is blocked on the Department’s network.
- The Department of Housing, Local Government and Heritage allows TikTok to be downloaded and used by its officials on their phones, according to the parliamentary question.
- The Department for the Environment; Climate and Communications has social media usage guidelines but is awaiting updated guidance from the NCSC.
- The Department of Justice has restricted access to social media on its network.
It is restricted to departmental officials who used it for business purposes.
It has a ‘Mobile Device Management’ system to secure and manage officially issued mobile devices.
Applications are used in a containerised system.
- The Department of Transport has bans on social networking sites.
However, staff who need access to them for an official purpose can get an exemption after getting a business case approved.
The latter exemptions are operated in other departments.
- The Department of Foreign Affairs has no bans and follows ‘the Civil Service Code of Conduct’.
- The Department of Social Protection only permits social media access where an approved business case is made.
- The Department for Further and Higher Education; Research; Innovation and Science is awaiting guidance from the NCSC.
- The Department for Agriculture; Food and the Marine follows the NCSC’s current guidelines.
- The Department for Rural and Community Affairs has an open policy on TikTok.
- The Minister states in its response "While the application the deputy refers to is not used in an official capacity by my Department, the application (TikTok) is not barred from use in phones issued by my Department".
- The Department of Enterprise, Trade and Employment has a social media policy, introduced in 2020.
Access to most social media channels - including TikTok - is "currently restricted by default for productivity reasons, except where there is a business case to support access".
However "Social media channels are not currently blocked from Departmental mobile phones".
"Social media is recognised as an important channel of communication, and as such has a role in many aspects of my Department’s work," the Minister of Enterprise, Trade and Employment said in response to the written parliamentary question.
"Access to most social media channels from the Department’s network, including the channel referenced by the Deputy, is currently restricted by default for productivity reasons, except where there is a business case to support access.
"Social media channels are not currently blocked from Departmental mobile phones.
"However, this is under review and further advice from the NCSC will be taken in to account."
- The Department of Health allows access to social media platforms on its network.
The department ‘sandboxes’ (another term for containerisation) all official applications on mobile devices and social media applications cannot be installed into these areas.
European Commission
European Commission spokesperson on digital policy Johannes Bahrke told Morning Ireland the Commission suspended the use of TikTok on its corporate devices and on personal devices because of cybersecurity concerns.
He added the Commission is not offering an advisory on the matter to other institutions or governments.
TikTok said in a statement that any suspension of TikTok is misguided and based on misconceptions.
It added it shares a common goal with the Irish government and is concerned about user privacy.
"We believe that any suspension of our platform is misguided and based on fundamental misconceptions," a TikTok spokesperson said.
"We share a common goal with the Irish Government and indeed all governments that are concerned about user privacy, but any bans are misguided and do nothing to further privacy or security.
"TikTok actively encourages transparent and communicative dialogue when concerns are expressed about our platform.
"We're continuing to enhance our approach to data security, including an update earlier this month where we intend to further strengthen our approach through Project Clover - and moving from meeting industry standards to setting a new standard altogether when it comes to data security.
"TikTok has never shared data with the Chinese government and would never do so."
It added the Chinese government has never made a request for data access.
Specifically on the European Commission, the TikTok spokesperson added: "We will be meeting with the European Commission but that's all we can comment on at this stage"
A spokesperson for the Department of the Environment, Climate and Communications said the National Cyber Security Centre does not comment on the specific technical measures in place to protect official devices.
The Department added that the NCSC has offered guidance on the security of mobile devices in the past but that "at the request of Government" it is conducting a review.
"NCSC security advice generally takes a vendor-neutral and technology-neutral approach, making security recommendations based on evidence and risk assessments," a spokesperson said.
"On the request of Government, the NCSC is conducting a review and developing further advice on the use of apps on mobile devices for the public service.
"All users of official communications devices are expected to exercise appropriate discretion in their use, and in relevant communications services in line with acceptable usage policies."
