EDITORIAL - Protecting data privacy

The National Bureau of Investigation and the Bureau of Internal Revenue have both denied reports of a data breach in their systems. But the Philippine National Police is currently working with the National Privacy Commission and the Department of Information and Communications Technology to establish the extent of the breach, which was reported by international cyber security firm vpnMentor.

The VPN or virtual private network is supposed to provide a protected connection when accessing government digital networks, such as when filing tax returns online, applying for police or NBI clearances, or using public WiFi hotspots. It protects privacy while using the internet.

Hackers, however, do not take a rest, especially when the data they steal can be used for profit or for sabotage and mischief. Earlier, vpnMentor said an estimated 1.2 million records of employees and people applying for official documents from the PNP, NBI and BIR had been leaked online.

Apart from information for law enforcement clearances, the 817.54 gigabytes of leaked data included information on passports, birth and marriage certificates, driver’s license and academic transcripts, and even character references from judicial courts and municipal mayor’s offices, according to vpnMentor.

Filipinos are no strangers to cyber attacks, identity theft and online financial fraud, so the report has raised alarm bells. Yesterday, the National Privacy Commission began looking into the reported data breach in coordination with the PNP and BIR. The NPC is empowered to impose fines and recommend the criminal prosecution of anyone found to have compromised the personal data of the general public.

The DICT, for its part, said it had been looking into a possible data breach since February after receiving a link to a site showing sample ID photos as well as PNP and NBI clearances. The DICT said its Philippine National Computer Emergency Response Team had identified several government digital systems that might have been compromised.

From most indications, the data breach seems real. The safety of personal data is just as important as physical safety. “Individuals whose data is exposed could be potential victims of identity theft, phishing attacks, and a range of other malicious activities,” vpnMentor warned in its report. “It would be easy for criminals to apply for loans, credit, or other financial crimes using the identity of these individuals and supporting documents.”

The task is challenging, but the government will have to ensure that it is staying one step ahead of hackers.