The Public Accounts Committee is to consider conducting a review into financial exchanges related to the cyberattack that brought down the Government’s IT systems in 2023, its chairman has said.

Douglas De Couto said he will raise the issue with members of the committee, which is tasked with examining sums granted by the legislature.

The joint select committee on the cyberattack submitted a report to Parliament last week that said a payment of $4.4 million of government funds may have covered ransom to the perpetrators.

Download PDF File

JSC Cycerattack Report.pdf

Lawrence Scott, the chairman of the JSC, said the committee recommended that the PAC, a parliamentary, bipartisan group, continue investigations using its specific expertise in public financing.

Mr Scott confirmed yesterday that he will send the official recommendation to the PAC either at or before the next sitting of Parliament, scheduled for early September.

However, despite all the powers and tools available to the PAC, Dr De Couto made clear that it is not a criminal investigation body and expertise from a relevant organisation such as the police would be required to potentially track down the criminals responsible.

Meanwhile, the Government has said it was premature to comment publicly on the JSC report.

Dr De Couto told The Royal Gazette: “The committee could conduct the review if it has the desire. I think it will.

“I will take the report to the PAC, we will review it and take a decision. The committee has to reach an agreement to go ahead.”

The PAC chairman can use formal powers to summons individuals to attend committee hearings under the Parliament Act 1957. Failure to attend a hearing is contempt of Parliament and the witness’s conduct is reported to the House.

Dr De Couto added: “The committee can send summons for data and have people come to testify.

“We could identify what payments were made to where and how, in my opinion, for example, bank transfers or purchase of a crypto currency, and who authorised and actioned those.

“If it was something like a crypto currency, you would likely have no idea who was receiving it.

“Not all payments may be traceable purely from the payment information, so extra investigation on top of that would be out of the PAC’s remit, in my view, and more suitable for a police investigation or other relevant authority.”

The JSC report made numerous recommendations including the PAC review with an implementation road map. It recommended that expenditure be transferred to the PAC within zero to 90 days.

A spokeswoman for the Government said: “Given the significance and scope of the report, it would be premature to comment in detail on specific findings or recommendations at this stage.

“However, the Government of Bermuda acknowledges the tabling of the independent cyber incident report in the House of Assembly on July 20.

“The report contains a number of findings and recommendations that require careful review and consideration.

“As with any report of this nature, the recommendations and observations will be reviewed through the appropriate governance and oversight processes.

“Any decisions regarding further reviews, including parliamentary or committee processes, are matters for the relevant authorities and established procedures.”

The JSC report made clear that payments were made, referring to figures in the 2023-24 Budget showing an allocation of $3.09 million for the cyber incident from the Ministry of Finance headquarters and approximately $1.32 million from Information and Digital Technologies, for a total of about $4.41 million.

It recommended that an investigation by the PAC look into who was paid, for what purpose and value, and with whose approval.

The JSC made a number of other findings including that an assessment four months before the attack warned the Government that the island’s cybersecurity risk was “critical”.

The report also said that hackers had infiltrated government systems ten days before being detected.

Lawrence Scott told the Gazette previously that it was unlikely the criminals would be caught but did not rule out that they could be.

Download PDF File

PAC members manual.pdf

The PAC’s remit includes holding the executive to account for the use of public funds and identifying waste within government departments.

It also aims to improve transparency of operations within departments and ensure that relevant policies, laws and statutes are implemented and observed.

An inquiry can be initiated by PAC members or referred by the House of Assembly.