Comelec database hacking: Balloting, all voters imperiled

Filipinos this Election 2016 are choosing more seriously their Vice President. That’s why three VP contenders are tied at the top of the surveys: Chiz Escudero, Bongbong Marcos and Leni Robredo.

Before, voters selected the VP for check and balance. They’d pick a President, then pair him with the VP bet of the main rival party. Thus there were VPs Erap Estrada for Fidel Ramos, Gloria Arroyo for Estrada, and Jojo Binay for Noynoy Aquino.

It’s different this time. In mock elections and voter seminars, a new issue emerges: succession. The VP is seen not just as restrainer of but also ready replacement for the President.

Five factors cause the change. One is the sense that six years is too long to suffer a bad President. Another is that three Presidentiables, over 70 years old, might weaken from the gruelling work. Three, the need for a good option to 1 and 2. Then, five of six VP wannabees – Escudero and Robredo included – hail from once bloc voting Bicol, whose voters now are so fractious as to infect the rest of the land. Last is the aim of the People Power generation to prevent a Marcos return to Malacañang.

That last factor makes Robredo stand out. Tinged with activism at UP, she takes on the role of fighting Marcos’ historical revisionism. In campaign speeches she recounts her college awakening to the atrocities and plunder by Marcos’ father, the martial law dictator. Forget not the killings, tortures, and rapes of youth militants, she says. As well, the neglect of farm and fisher folk, crushing of civil rights, and kleptocracy during which the Marcoses stole $10 billion. For all those, she demands that Marcos apologize, instead of reinterpreting martial law as glory days of the Republic.

It helps that Robredo, before becoming a newbie congresswoman, was into free legal assistance to the rural poor, and promoting youth leadership and women’s rights.

* * *

Willie Nep’s “Pang-GULO ng Pilipinas,” the show that happens only once every six years, will be staged on Apr. 30, at the Music Museum, Greenhills Commercial Center, San Juan City. Watch it before you vote.

For reservations, call TicketWorld at (02) 8919999; or Music Museum, (02) 7216726.

* * *

We’re mostly techno-illiterate. We know computer or smartphone apps for work and leisure, but not much more. We email, Facebook, and Tweet, but ignore how they run. We use ATMs, broadcast our activities, buy online, but overlook the basic security of our sensitive personal info. After all, we think, we’re only customers or clerks, teachers or students, housewives or helpers; there are experts in charge of hi-tech.

Cybercriminals thus easily sting us. They steal our password to send fraudulent email to our contacts, or withdraw from our bank deposit. Recently was headlined the rape-murder of a housewife and her infant, by intruders who used the stolen identity of a wi-fi repairman. As well, an overseas worker whose PII (personally identifiable information) was filched and signature forged, for a huge bogus loan.

When the Comelec website was hacked last Mar. 27, we let the spokesman’s gobbledygook lull us into complacency. He belittled the online break-in: “The website’s interface changed. But for the most part, the database is intact. As a standard procedure with any intrusion, we are taking the time to make sure that we remove all the malware codes that were penetrated... The Comelec website has been available to the public [anyway] so if there are people who want to hack it, they have the opportunities to study its security features. We do not give high level of security in the website, even the Precinct Finder function, we have back up so it is protected.”

We now know better. Info-tech security giant Trend Micro says the Comelec database was stolen and dumped online. Cybercriminals may now feast on the PIIs of us 55 million voters (see Gotcha last Monday, http://www.philstar.com/opinion/2016/04/11/1571677/hacking-exposes-55-m-voters-identity-theft). Not only names, addresses and birth dates are publicized, but also fingerprints, signatures and photos. Most at risk of identity theft are 1.3 million overseas absentee voters, whose passport numbers and other entries also were taken. The election too is imperiled.

Trend Micro reports potential fraud against us voters, and cheating in the May 8 election: “There are discrepancies in the statements made (by the Comelec spokesman) and our findings. Comelec officials claimed there was no sensitive information stored in the database. However, our research showed that massive records of PII, including fingerprints, were leaked. Included in the data Comelec deemed public was a list of Comelec officials that have admin accounts (access).

“Based on our investigation, the data dumps include 1.3 million records of overseas Filipino voters, which included passport numbers and expiry dates. What is alarming is that this crucial data is just in plain text and accessible to everyone. Interestingly, we also found a whopping 15.8 million record of fingerprints and a list of people running for office since the 2010 elections.

“In addition, among the data leaked were files on all candidates running on the election with the filename VOTESOBTAINED. Based on the filename, it reflects the number of votes obtained by the candidate. Currently, all VOTESOBTAINED file are set to have NULL as figure.

“The Comelec website also shows real time ballot count during the actual elections. While Comelec claims that this function will be done using a different website, we can only speculate if actual data will be placed here during the elections and if tampering with the data would affect the ballot count.

“Every registered citizen at risk – Regardless whether the hacking could affect the elections, there is still the issue of all voter information that was leaked. Reports stated that while some of the data were encrypted, some fields were left wide open.

“Cybercriminals can choose from a wide range of activities to use the information gathered from the data breach to perform acts of extortion. In previous cases of data breach, stolen data has been used to access bank accounts, gather further information about specific persons, used as leverage for spear phishing emails or BEC (business email compromise) schemes, blackmail or extortion, and much more.”

* * *

Catch Sapol radio show, Saturdays, 8-10 a.m., DWIZ, (882-AM).

Gotcha archives on Facebook: https://www.facebook.com/pages/Jarius-Bondoc/1376602159218459, or The STAR website http://www.philstar.com/author/Jarius%20Bondoc/GOTCHA

E-mail: [email protected]