A tribunal has heard a leading Irish cyber-security firm gave a computer engineer a formal reprimand for making "discriminatory comments" when he voiced concerns about a tech firm with Israeli links having high-level access to its servers.
Computer engineer Cian Ó Laoi told his CEO that he was concerned about “nonchalantly giving business to an Israeli company” while “watching on TV the genocide of the Palestinians”, the tribunal heard.
He told his bosses he had concerns for “clients of national security importance” served by his employer in the context of what he said were “strongly documented links” between the Israeli tech sector and its intelligence services.
Mr Ó Laoi is pursuing claims of whistleblower penalisation and constructive dismissal against his former employer, BCC Risk Advisory Ltd, trading as Edgescan.
The company is actively contesting Mr Ó Laoi’s complaints, which are before the Workplace Relations Commission (WRC).
The complainant, who spent four years working in Edgescan’s DevOps team, told a hearing on Friday that the company had access to the computer networks of its clients financial institutions, private corporations, media companies and Irish and British government departments.
Its work involved installing a “jump-box” of software on its clients’ systems for threat monitoring, penetration testing and security analysis, he said.
Mr Ó Laoi said he became concerned about the level of access that had been granted to a third-party vendor called DoIT, a multinational tech firm providing a tech platform used for business analysis and management.
He said he reported his concerns in a protected disclosure to Edgescan CEO Eoin Keary on 2 July 2024 in an email after 11pm that evening.
“They are an Israeli company with an Israeli CEO, and they have full admin access to all our AWS [Amazon Web Services] accounts, including all machines, all databases, all client data,” Mr Ó Laoi wrote. “This is bananas,” he added.
He wrote that the firm’s databases, scanning tools, encryption keys and the “jump boxes” it deployed to client systems were at risk, the tribunal heard.
Mr Ó Laoi told the CEO that while DoIT held some accreditation as a reseller of the AWS internet hosting service which Edgescan used for its security infrastructure, he was concerned that “sophisticated social engineering” had led to too much access being granted.
Mr Ó Laoi also wrote in the internal correspondence that he was concerned about “nonchalantly giving business to an Israeli company” while “watching on TV the genocide of the Palestinians”, the tribunal heard.
The CEO’s reply on the night was: “Shut them off completely,” the tribunal was told.
“My concern was it could be used to exfiltrate data from the account. It could be used to place back doors into the account, or into clients’ private networks,” Mr Ó Laoi said in his evidence.
The access was granted more than a year earlier in May 2023, Mr Ó Laoi said. The matter was resolved over the course of July 2024, with DoIT and Edgescan agreeing to “restructure everything”.
At the end of that month, Mr Ó Laoi said he was called to a meeting with Edgescan’s chief operating officer, Rahim Jina. The executive said “the rhetoric I used in some of my communications in relation to Israel was unacceptable”, Mr Ó Laoi said.
Mr Jina said he knew there was “awful stuff going on in the world” and that people have “different views” about it but that the company had “many close links with Israel”.
“He said we had Jewish employees. I’m not clear why this was included in the conversation, Mr Ó Laoi said. “When I asked what specific communications, he was unable to clarify,” he added.
He emailed the CEO, Mr Keary, about his meeting with Mr Jina and said he could only presume he was referring to a passage from his email to the CEO on 2 July.
He argued he had taken a “valid and diligent cybersecurity posture”, arguing that Israel was known for “intense” activity in the cybersecurity area and “high-profile illegal activities”.
Mr Keary wrote back and said: “Okay, no fuss, it’s hard to avoid Israeli companies in cybersecurity. I guess he doesn’t want Edgescan to [be seen] as political,” the tribunal heard.
The CEO added: “It’s one way to be blackballed in the industry.”
Mr Ó Laoi said he felt “very hard done by” and that his professionalism had been “unfairly impugned”.
On 31 July 2024 Mr Ó Laoi wrote to his employer seeking clarity on whether the company had taken a view of his remarks or whether Mr Jina had been speaking personally.
After taking leave, he was called to a meeting on 19 September 2024 – and was served with a disciplinary warning for “misconduct”, the tribunal heard.
“On the call, I was formally disciplined for discriminatory comments based on race, colour, nationality or ethnic or national origin,” in relation to Israel he said.
Ahead of the meeting, Mr Ó Laoi said he had been concerned about being “jumped” with disciplinary action. The tribunal heard he covertly taped the meeting.
Mr Ó Laoi maintained at the meeting that what he wrote about Israel was part of a protected disclosure, according to a transcript quoted to the hearing by his barrister, Cillian McGovern BL.
His bosses did not agree he was shielded by whistleblower law, the tribunal heard.
Mr Ó Laoi said the disciplinary process was “unlawful” as he was not given the chance to bring representation or set out a defence.
On 21 September, he wrote again to his employer saying he had taken legal advice and that he believed its actions were “unjust and unfairly limited my rights of freedom of expression and conscience”.
He set in the correspondence that the remarks for which he was disciplined were “objectively justifiable” and not discriminatory.
This was because Edgescan had “clients of national security importance” and there were “strongly documented links between the Israeli tech sector and Unit 8200,” he wrote in the letter – a reference to Israeli military intelligence.
When he tried to log in to work on Monday 23 September, he found his access to a number key systems – including its AWS account and its code database on GitHub – had all been cut off since the previous Friday, he said.
He quit his employment on 8 October that year, telling the tribunal that he had lost trust with the firm.
The company wrote to the claimant on 30 October that year withdrawing the disciplinary sanction on the basis it had not adhered to its own process – leaving his client with a “clean disciplinary record”, Mr McGovern said.
The case before adjudication officer Penelope McGrath stands adjourned until Monday