Irish state agencies use Passwork password software sharing codebase and updates with FSB-certified Russian firm
The passwords of Irish state agencies sit in software whose codebase and updates are shared with an FSB-certified Russian firm, an Irish Times and OCCRP investigation found. Spain-based Passwork is used by the OPW, consumer watchdog CCPC and the State Laboratory.
Three Irish state agencies have been managing their passwords in software with a direct line to Russia's security apparatus. A joint investigation by The Irish Times and OCCRP found that Passwork, a password manager marketed by a Spain-based company as entirely European, shares a common codebase origin, synchronized software updates and a near-identical user manual with a Russian sister product. The Irish users include the Office of Public Works, which manages government and Garda buildings, the Competition and Consumer Protection Commission, the State Laboratory, which provides chemical testing and scientific advice to government departments, and the Department of Culture, Communications and Sport. The Russian side of the operation is not a minor detail. Corporate records show the Russian co-founders own Passwork LLC, a company that uses an identical logo to the Spanish firm and lists missile manufacturers and other sanctioned Russian companies among its clients. It is certified by FSTEC, an agency under Russia's Ministry of Defense, and by the FSB, the country's main domestic intelligence service. The agencies involved said they were unaware of the Russian connections and had identified no security risks. After queries from The Irish Times, the CCPC engaged with Ireland's National Cyber Security Centre about its use of the product. A password manager sits at the most sensitive point of any organization's IT: it holds the credentials to everything else. Synchronized updates between a European product and a Russian sister firm mean the development pipeline itself crosses into a jurisdiction where intelligence services certify software vendors. For European procurement officers, the case shows that a Spanish registration and a European marketing pitch say little about where code is actually written and updated.