Comelec on stolen computer: Data breach not yet confirmed

MANILA, Philippines – The Commission on Elections on Monday confirmed that a desktop computer of the Office of the Election Officer in Wao, Lanao del Sur was stolen but clarified that a data breach has yet to be confirmed.

The National Privacy Commission earlier ordered the poll body to take serious measures to address its data processing vulnerabilities after the computer containing data from the Voter Registration System, Voter Search applications, National List of Registered Voters and biometrics of registered voters in Wao, Lanao del Sur, was stolen last January 11.

Comelec Executive Director Jose Tolentino said the notice of the robbery was submitted to the NPC on January 28 and the theft is now being probed by the police.

The privacy watchdog said that it considers the stolen computer the “second large-scale data breach” of the Comelec in months but the poll agency says otherwise.

Comelec: Data is encrypted

“Data breach has not been confirmed. The possibility of such breach is remote since the data are encrypted using AES-256 encryption,” Comelec said.

Although the NPC expressed concern over the ongoing voter registration nationwide, Comelec said the NLRV contain demographics data only and no biometrics data were stored in the NLRV.

The poll body also clarified that the VRS is in no way connected to vote-counting machines. He said it will not affect election results.

According to Comelec, Wao has a total of 58, 364 registered of voters, 40,991 of which (as of Oct. 19, 2016) are for the Barangay elections, while 17,373 (as of Sept. 16 2016) are for the Sanggunian Kabataan (SK) elections.  

On the other hand 35, 491 of the Barangay elections data are active, while 5,500 are deactivated. For the SK elections, 17,336 are active records, while 37 are deactivated.

The NLRV contains approximately 75,898 records as of Oct 17, 2016 55,195,674 of which are active records, while 20,703,662 are deactivated.  

The poll body assured the public that personal information contained in the VRS and the NLRV have been encrypted with AES 256 encryption since Oct. 17, 2016

Due to the stolen computer, the NPC issued Compliance Order dated Feb. 13, 2017, directing the Comelec to erase all copies of the NLRV in the Comelec's computers in the different municipalities and cities  and inform all data subjects affected by the personal data breach within two weeks.

In response, Tolentino said the Comelec has approved changes in handling national voter records including a wipe out of NLRV in city or town offices. It also issued a memorandum prescribing interim security measures.

The Comelec issued a memorandum dated Jan. 23, 2017  recommending to the Commission En Banc, the installation of CCTV cameras in all field offices. It will include the hiring of a consultant for the Data Privacy Act compliance Procurement of the CCTV cameras will require public bidding since the total cost is estimated at P633,835,000.

The poll body also issued memorandum dated Feb. 1, 2017, addressed to all Regional Eelection Directors, field offices, prescribing the interim security measures and controls that will secure and prevent loss, destruction, unauthorized access and misuse of data pending issuance of the key policies related to data security, use, processing, storage and disposal

“The Comelec will abide by the Compliance Order issued by the NPC with respect to the notices to be given the affected data subjects,” Tolentino added.

He said the draft of said notice, both for personal delivery and for publication, have already been finalized and will be submitted to the Commission En Banc for approval in its regular meeting on Tuesday.

RELATED: Privacy commission probes Comelec over stolen computer, voter data