The Irish start-up tackling one of tech’s biggest legal grey areas – The Irish Times

Any TV crime series worth its salt these days has detectives routinely digging into people’s mobile phone records and bank accounts for evidence.

TV makes this access look easy. In reality it’s not, which is why Maureen King and Peter Kirwan founded iTrust 6A, a legal tech start-up that helps organisations manage requests from law enforcement for access to data relevant to their investigations.

“Commonly requested information includes subscriber data, communications metadata, location data, IP address information and financial records,” King says.

“Approximately 85 per cent of serious criminal investigations in the EU involve some form of digital evidence. This in turn generates hundreds of thousands of lawful data requests to service providers each year.

“In urgent situations, such as missing-person investigations or threats to life, disclosure decisions often need to be made within hours.

“As the volume of requests grows, organisations increasingly face legal complexity, regulatory scrutiny and the risk of significant fines, sanctions and even reputational damage if these requests are not handled correctly.”

Organisations generally have well-established protocols in place for protecting data. However, few have a similar framework to guide them when it comes to making and documenting access decisions.

“They typically rely on a combination of legal advice, internal policies, specialist resources, compliance tools and manual processes.

“This can result in different approaches to similar requests, making consistency and decision-making rationale difficult to defend,” King says. “We believe this gap needs to be filled with ‘lawful access infrastructure’ and this is where iTrust 6A fits in.

“Our proprietary software platform provides organisations with a structured, auditable workflow for managing lawful access requests from receipt through to disclosure while keeping the decision-making firmly in human hands,” she says.

“By standardising how requests are assessed, decisions are reasoned and outcomes are recorded, iTrust helps organisations make lawful, transparent and defensible decisions while balancing privacy rights, public safety and investigative needs.”

As former head of fraud and security at Meteor and later at Eir, King is no stranger to disclosure requests.

“I was responsible for assessing and authorising disclosures of telecommunications data. I also provided expert testimony in hundreds of serious criminal trials defending those decisions,” she says.

“My experience of defending these decisions under cross-examination, judicial review and regulatory scrutiny highlighted the need to me for a much more structured, rights-based and defensible approach to lawful data disclosure, and ultimately this is what led to the formation of iTrust 6A two years ago.”

When King left Eir in 2016, she joined forces with a former senior member of An Garda Síochána, Peter Kirwan, who was detective chief superintendent for security and intelligence. Together they set up a consultancy to provide disclosure advisory services to the corporate sector.

“We saw first-hand the challenges organisations face when balancing privacy rights, legal obligations and the needs of law enforcement against how crucial data can be in helping to locate missing children, protect vulnerable people and secure justice for victims,” King says.

We operate at the intersection of privacy, public safety and fundamental rights, where every decision can have real-world consequences

Seeing their clients face the same issues over and over again encouraged the cofounders to design a decision-making method their clients could use any time they received a disclosure or access request.

The methodology is based around six guiding principles (hence the 6A in the name): authentication, assurance, appropriateness, assessment, authorisation and accountability.

“Together these principles provide a structure for verifying requests, assessing legal authority, necessity and proportionality, documenting decisions, authorising disclosures and ensuring transparency and oversight, and from our combined experience of giving evidence at trials over many years we knew how we approached it was tried, tested and effective.”

The company’s potential customers include any organisation that gets access requests from law enforcement. However, the focus for now will be on those dealing with high volumes of requests, such as communications providers, online platforms and technology companies.

“We are also seeing strong demand from organisations that receive requests only occasionally and may lack dedicated legal, compliance or specialist resources,” King says.

“Our goal is to make specialist expertise accessible to organisations of all sizes in a way that helps them respond to requests confidently, consistently and compliantly. We are not really competing against any existing service providers. Rather, we’re challenging the way lawful access decisions have traditionally been made and managed.”

ITrust 6A is backed by Enterprise Ireland through its high-potential start-up fund, and investment to date between the State, the founders and private funding is about €750,000. Most of this investment has gone into developing the software.

It took more than a year to build the system, and during the development process, King says the company worked closely with a number of global tech service providers to test and refine its platform. iTrust will charge an annual subscription linked to the level of service a client requires.

For now the company’s focus is on disclosure for law enforcement purposes, but the system will work wherever access to people’s data is requested, including hotels, airlines, financial institutions, healthcare providers and utilities. iTrust will have its formal launch during the third quarter of this year, with hiring to build out the team scheduled for later this year.

The company is active in Ireland and across Europe, and King says its immediate focus is supporting organisations preparing for the EU’s upcoming e-Evidence Regulation and also helping companies to deal with the growing volume of cross-border law enforcement requests for access to data.

“In our experience one of the greatest strengths of the Irish start-up ecosystem is the willingness of founders to support and learn from one another. However, one area that deserves greater attention is founder wellbeing,” King says.

Entrepreneurship can be a rollercoaster, with long periods of uncertainty largely outside a founder’s control. Creating more space for honest conversations about resilience, balance and wellbeing would further strengthen the ecosystem.

“The hardest part of starting iTrust has been carrying the responsibility that comes with building a purpose-driven company,” she says.

“We operate at the intersection of privacy, public safety and fundamental rights, where every decision can have real-world consequences.

“Getting that balance right matters. At the same time, we are creating a new category, and much of our journey has involved demonstrating why lawful access decisions need the same consistency, transparency and accountability that organisations apply to other critical areas of governance.”