Privacy Body Probing Massive Data Breach

The National Privacy Commission (NPC) has ordered an onsite investigation on the data processing system of the Philippine National Police (PNP) as it looks into the alleged leak of documents containing personal data involving law enforcement.

At the same time, a response team from the Department of Information and Communications Technology (DICT)’s Cybersecurity Bureau was “doubling down” on its probe into the reported breach of the databases storing National Bureau of Investigation (NBI) and police clearances.

On Thursday, April 20, the NPC called a meeting with concerned government agencies including the PNP, NBI, the Civil Service Commission (CSC) and the Bureau of Internal Revenue (BIR) to address the alleged leak of personal data.

“According to representatives of said agencies, after conducting their respective investigations and vulnerability tests, the NBI, CSC and BIR have confirmed that there were no breaches on their part and will release their respective statements to the public,” NPC Commissioner John Henry Naga said in a statement.

“However, the PNP requested for time to validate and review its systems for possible security compromise, considering that the police was highlighted in the report alleging the data leak,” he added.

To further investigate this matter, Naga said the NPC issued an order to conduct an onsite investigation on the concerned data processing system of the PNP on April 24, headed by the NPC’s Complaints and Investigation Division.

Similarly, Jeremiah Fowler, the cybersecurity researcher who published an article regarding this matter, was ordered to appear before the NPC today, April 21, to aid the commission in its investigation.

According to a recent report by an online news outlet, the document includes personal information such as names, addresses, contact details and even medical records of police officers, prosecutors and judges.

DICT probe

Meanwhile, the DICT said the Cybersecurity Bureau’s Philippine National Computer Emergency Response Team (NCERT) has also been investigating the alleged breach after receiving links to an Azure blob storage containing sample photos of IDs, including PNP and NBI clearances, from a security researcher last Feb. 22.

“The said security researcher did not disclose to NCERT the source of the data and what information asset was compromised. Further, the information sent by the security researcher is identical to what was reported by Mr. Jeremiah Fowler and which has since been credited by recent news reports,” the DICT said in a statement.

It said the NCERT provided an incident report regarding the alleged breach to both the PNP and the NBI for a period covering March 3 to 23, 2023.

“The DICT considers the incident as a grave concern that threatened the confidentiality, integrity and privacy of user data,” it said, adding that “investigation on the matter is underway.”

In a separate statement, the CSC assured the public that its system and database were not breached or attacked.

“As of 10 a.m. today (April 20), the Department of Information and Communications Technology (DICT) National Computer Emergency Response Team (NCERT) has informed the Civil Service Commission (CSC) Integrated Records Management Office that the CSC system and database were not breached or attacked,” it said in a statement.

PNP investigation

On Thursday, Gen. Rodolfo Azurin Jr., PNP chief, said their Anti-Cybercrime Group (ACG) is already investigating the alleged breach, but offered no update on the matter.

“We just have to wait (on) what happened… We are waiting on the report of our ACG pertaining to the data breach,” Azurin, speaking partly in Filipino, said.

Cybersecurity research firm VPNMentor reported on Tuesday, April 18, that the supposed breach exposed 817.54 gigabytes of data involving 1,279,4237 records, including redacted copies of documents that were allegedly compromised such as certification of board rating, national police clearance, certificate of tax and a BIR card, among others.
Sought for comment, PNP Public Information Office chief Col. Redrico Maranan released the statement given by ACG director, Brig. Gen. Sidney Hernia, on the issue.

“We are still conducting vulnerability assessment and penetration testing,” Hernia said. “We cannot categorically say at this time that there was a leaked applicant’s data.”

Hernia said his office had requested complete access logs from the PNP Recruitment and Selection Service for evaluation. 

‘No one immune’

For his part, Naga said these allegations of a data breach should serve as a reminder that no organization, not even the government, is immune to the threat of cyberattacks.

“I call on all government agencies and private sectors processing personal data to review the implementation of their data privacy and security measures. It is not enough to simply comply with existing regulations and standards; we must also proactively identify and address potential vulnerabilities,” he said.

Even as the investigation is underway, the NPC strongly demands of these government agencies, such as the PNP, to strictly comply with the Data Privacy Act of 2012, including the mandatory breach notification requirement under various NPC circulars.

In an earlier statement, Naga said the NPC is fully committed to protecting personal information and assures the public that “we will not leave a stone unturned in getting to the bottom of this alleged breach.

“We would also like to take this opportunity to remind those who process personal data that they concomitantly have the duty to protect the data they collect. Do not collect if you can’t protect,” he said.

The NPC also reminded the public that “the right to privacy is a fundamental human right that must be respected at all times.”

It added that it will continue to work closely with the PNP, NBI and other concerned agencies to ensure that appropriate actions are taken to prevent similar incidents from happening in the future.

‘Abolish need for clearances’

Amid the controversy, Albay Rep. Joey Salceda wants to abolish the practice of requiring job applicants to submit clearances from the NBI and PNP, especially since this is not the primary mandate of these law enforcement agencies.

“We can frankly abolish these clearances for most cases. You have below 100,000 crimes in the country every year. But 99.9 percent of the population has to get a clearance saying they do not have trouble with the law,” Salceda argued.

“If you’re involved in some crime, we can probably get your data easily anyway. Rather than putting ordinary law-abiding citizens through the hassle and expense of clearances, as well as the risk of data breach, why don’t we normalize due diligence among employers?” he asked.

“Otherwise, you have a system where no good deed goes unpunished. For following the law, you are hassled with having to prove it. That’s insane,” quipped Salceda, who chairs the House Committee on ways and means.

As authorities investigate the alleged data breach, Salceda called on the National Telecommunications Commission and the NPC to “ensure that all data collected under the SIM Card Registration Law should be well-guarded and secure.”

“SIM card registries will be the largest source of personal data in the country. So, they will be targets. I call on the NTC and the NPC to make the necessary reviews and proactive measures to ensure that a similar data breach will not take place in SIM registries,” he said.

“That probably means a periodic audit of privacy protocols of telecommunications companies by the NPC. And that has to be sooner rather than later,” he suggested. — Rainier Allan Ronda, Emmanuel Tupas, Elizabeth Marcelo, Delon Porcalla