Commission on Elections data breach

Last updated
Commission on Elections
data breach
DateMarch 27, 2016 (2016-03-27)
Location Philippines
Type Cyber-attack
Participants Anonymous Philippines
LulzSec Pilipinas
Outcome
  • Around 55 million registered voters at risk
  • Biggest private data leak in Philippine history
ArrestsPaul Biteng (arrested on April 20)
Joenel de Asis (arrested on April 28)

On March 27, 2016, hackers under the banner "Anonymous Philippines" hacked into the website of the Philippine Commission on Elections (COMELEC) and defaced it. The hackers left a message calling for tighter security measures on the vote counting machines (VCM) to be used during the 2016 Philippine general election on May 9. [1] Within the day a separate group of hackers, LulzSec Pilipinas posted an online link to what it claims to be the entire database of COMELEC and updated the post to include three mirror link to the index of the database's downloadable files. [2] The leaked files by LulzSec Pilipinas amounts to 340 gigabytes. [3]

Contents

The COMELEC website returned to normal at 03:15 (PST) on 28 March 2016. COMELEC spokesperson, James Jimenez, stated on his Twitter account that, as they continue to scour the site, all databases would remain temporarily off. [4]

The incident was considered the biggest private data leak in the Philippine history and leaving millions of registered voters at risk. [5] [6]

55 million registered voters are at risk due to the data breach according to security firm, Trend Micro potentially surpassing the Office of Personnel Management data breach which affected 20 million people. [7]

A searchable website, called wehaveyourdata, was set up containing sensitive data on Filipino registered voters was set up as early as April 21. The website was taken down with the assistance of the U.S. Department of Justice since the domain of the website was bought from a US-based web hosting company. The website itself was found to be hosted in Russia. [8]

Extent of the breach

Trend Micro conducted its own investigation on the extent of the data breach. It found that 1.3 million records of Overseas Filipino voters, which included passport numbers and expiry dates were included in the data dumps by the hackers. The security firm found the breach as "alarming" since it said that the data are easily accessible to the public were in plain text. It also added that 15.8 million record of fingerprints along with a list of people who have run for office since the 2010 elections were found by the firm's investigation. [3]

The firm also found files concerning candidates running in the election with the filename "VOTESOBTAINED" which the firm infers to reflect the number of votes received by the particular candidates. It said that the figures of the "VOTESOBTAINED" files were set to NULL at the time Trend Micro conducted its investigation. [3]

The Commission on Elections chairman, Andres Bautista said that he was told that no confidential information was leaked, saying the breach would not affect the election body's preparation for the 2016 elections. [3] The commission also emphasized that the database on its website is accessible to the public and no sensitive information is hosted on the website. It said that the results website that the election body is planning will be hosted in a different website with a different and better set of security measures. [9] It further added that the database might be fake saying that no biometrics date were compromised by the hackers as opposed to Trend Micro's findings. COMELEC also noted that Trend Micro accessed the dumped data by hackers on its investigation and said that it has no capability of validating the data since it had no access to its original database. [10]

Perpetrators

On April 12, COMELEC announced that the National Bureau of Investigation had a "very good lead" regarding the hackers behind the breach. The perpetrators are to be charged of violations of the Cybercrime Prevention Act. [11]

On 20 April, the National Bureau of Investigation (NBI) apprehended one of the suspected hackers, later identified as Paul Biteng, [12] the 20-year-old IT graduate student, in his home in Sampaloc, Manila. The authorities took three weeks in order to track down the hacker. [13] The NBI confiscated Biteng's desktop computer, he used for hacking, for forensic examination. [14] Biteng, who is a member of the hacking group Anonymous Philippines, admitted that he defaced the COMELEC website, but denied the contribution in data leak. [15] [16] He also admitted that the hacking was intended to show how vulnerable of the COMELEC website is. [17] Possible cases against him include a violation of the Cybercrime Prevention Act of 2012. [15]

About eight days later, a second hacker, named Joenel de Asis — also a 23-year-old Computer Science graduate, apprehended by NBI at his house in Muntinlupa. [18] In a press conference held on April 29, COMELEC chairperson Andres D. Bautista identified de Asis as one of the ringleaders of the notorious hacker group, Lulzsec Pilipinas. [19] [20] Bautista said that de Asis admitted hacking the website and leaking the Comelec database. [20] He also admitted that he collaborated with Biteng in the hacking incident. Biteng breached the server of the Comelec website, while De Asis downloaded the 340 gigabyte voter database five days before the website was defaced on March 27. [21] While De Asis leaked the data though the Lulzsec Pilipinas website, he denied that their group created the website, wehaveyourdata. [22] [23] He assured that the data leak will not affect the upcoming elections as they did not hack Vote Counting Machines (VCMs) since it is connected to a different server. [24] [22]

The third hacker, which is yet to be identified, is still at large.

Measures

On April 21, COMELEC announced that they will be making consultations with Microsoft and other cybersecurity experts based in the United Kingdom, Singapore and the United States. A technical working group tasked to look on the issue of hacking was also formed which is to be led by Director James Jimenez of the Comelec Information and Education Department. [25] The website will be transferred to the Department of Science and Technology's server.

Charges

The National Privacy Commission decided on December 28, 2016 (case no. 16-001) said that the COMELEC found responsible for violating the Data Privacy Act of 2012 and the criminal prosecution of Chairman Andres Bautista is recommended. [26] [27]

See also

Related Research Articles

<span class="mw-page-title-main">Commission on Elections (Philippines)</span> Philippine independent constitutional commission

The Commission on Elections, abbreviated as COMELEC, is one of the three constitutional commissions of the Philippines. Its principal role is to enforce all laws and regulations relative to the conduct of elections in the Philippines.

<span class="mw-page-title-main">Timeline of Internet conflicts</span>

The Internet has a long history of turbulent relations, major maliciously designed disruptions, and other conflicts. This is a list of known and documented Internet, Usenet, virtual community and World Wide Web related conflicts, and of conflicts that touch on both offline and online worlds with possibly wider reaching implications.

<span class="mw-page-title-main">Andres D. Bautista</span> Filipino academic administrator

Juan Andres "Andy" Donato Bautista is the former chairman of the Commission on Elections (COMELEC) of the Philippines and former dean of the Institute of Law of the Far Eastern University, a private, non-sectarian university in Manila, Philippines.

<span class="mw-page-title-main">2013 Philippine general election</span> Election in the Philippines on 2013

A general election was held in the Philippines on May 13, 2013. It was a midterm election—the officials elected will be sworn in on June 30, 2013, midway through President Benigno Aquino III's term of office.

A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen, altered or used by an individual unauthorized to do so. Other terms are unintentional information disclosure, data leak, information leakage and data spill. Incidents range from concerted attacks by individuals who hack for personal gain or malice, organized crime, political activists or national governments, to poorly configured system security or careless disposal of used computer equipment or data storage media. Leaked information can range from matters compromising national security, to information on actions which a government or official considers embarrassing and wants to conceal. A deliberate data breach by a person privy to the information, typically for political purposes, is more often described as a "leak".

<span class="mw-page-title-main">2010 Philippine presidential election</span> 15th Philippine presidential election

The 2010 Philippine presidential and vice presidential elections were held on Monday, May 10, 2010. The ruling President of the Philippines, Gloria Macapagal Arroyo, was ineligible to seek re-election as per the 1987 Constitution, thus necessitating an election to select the 15th President.

Teamp0ison was a computer security research group consisting of 3 to 5 core members. The group gained notoriety in 2011/2012 for its blackhat hacking activities, which included attacks on the United Nations, NASA, NATO, Facebook, Minecraft Pocket Edition Forums, and several other large corporations and government entities. TeaMp0isoN disbanded in 2012 following the arrests of some of its core members, "TriCk", and "MLT".

Anonymous is a decentralized virtual community. They are commonly referred to as an internet-based collective of hacktivists whose goals, like its organization, are decentralized. Anonymous seeks mass awareness and revolution against what the organization perceives as corrupt entities, while attempting to maintain anonymity. Anonymous has had a hacktivist impact. This is a timeline of activities reported to be carried out by the group.

UGNazi is a hacker group. Composed of JoshTheGod, MrOsama, CyberZeist, .mp3, CosmoTheGod, and VariousLulz, The group conducted a series of cyberattacks, including social engineering, data breach, and denial-of-service attacks, on the websites of various organizations in 2012. Two members of UGNazi were arrested in June 2012; one was incarcerated. In December 2018, two members of UGNazi were arrested in connection with a murder in Manila.

<span class="mw-page-title-main">2016 Philippine general election</span> Election in the Philippines on 2016

A general election in the Philippines took place on May 9, 2016, for executive and legislative branches for all levels of government – national, provincial, and local, except for the barangay officials.

2016 in the Philippines details events that occurred in the Philippines in 2016.

<i>PiliPinas Debates 2016</i> Series of presidential debates in the Philippines

PiliPinas Debates 2016 is a debate series administered by the Commission on Elections (COMELEC) with the assistance of the Kapisanan ng mga Brodkaster ng Pilipinas in preparation for the May 9, 2016, general election. In January 2016, the Commission on Elections confirmed that they would hold three presidential debates and one vice presidential debate. This will be the first time that the COMELEC will host debates since the 1992 elections, with ABC-5 as the host network fresh from the launch of the recently restored broadcast network on February 21 of the same year, after a 20-year rest due to Martial Law. The debates were branded as PiliPinas Debates 2016. The first word is a portmanteau of Pili, Filipino for "choose" and Pinas, shortcut for the Philippines in Filipino.

The Luzon leg of the PiliPinas Debates 2016 is the third and final presidential debate of the 2016 Philippine elections, was held at the University of Pangasinan in Dagupan on April 24, 2016. It was organized by COMELEC and KBP with ABS-CBN, and Manila Bulletin as media partners.

The National Privacy Commission, or NPC, is an independent body created under Republic Act No. 10173 or the Data Privacy Act of 2012, mandated to administer and implement the provisions of the Act, and to monitor and ensure compliance of the country with international standards set for data protection. It is attached to the Philippines' Department of Information and Communications Technology (DICT) for purposes of policy coordination, but remains independent in the performance of its functions. The Commission safeguards the fundamental human right of every individual to privacy, particularly Information privacy while ensuring the free flow of information for innovation, growth, and national development.

2019 in the Philippines details events of note that have occurred in the Philippines in 2019.

<span class="mw-page-title-main">2019 Philippine general election</span> Election in the Philippines on 2019

The 2019 Philippine general election was conducted on May 13, 2019. A midterm election, those elected therein will take office on June 30, 2019, midway through the term of President Rodrigo Duterte.

<span class="mw-page-title-main">Partido Federal ng Pilipinas</span> Political party in the Philippines

Partido Federal ng Pilipinas is a national political party in the Philippines. It is chaired by Bongbong Marcos, president of the Philippines who won by a landslide in the 2022 election. During the run-up to the 2022 general election, the UniTeam Alliance was formed by the PFP, Lakas–CMD, HNP, and PMP, with guest candidates from other parties.

<span class="mw-page-title-main">2022 Philippine general election</span> National, provincial, and local elections in the country

The 2022 Philippine general election took place on May 9, 2022, for the executive and legislative branches of government at every level – national, provincial, and local – except for the barangay officials.

Francis Leo Marcos is a Filipino businessman, philanthropist and internet personality. He is known for popularizing the Mayaman Challenge social media trend and his 2022 Senate election bid. He claims familial ties with the Marcos political family which has been refuted by former First Lady Imelda Marcos.

References

  1. ↑ "Massive data breach exposes all Philippines voters". Telecom Asia. 12 April 2016. Retrieved 21 April 2016.
  2. ↑ Bueza, Michael; Manuel, Wayne (2 April 2016). "Experts fear identity theft, scams due to Comelec leak". Rappler. Retrieved 21 April 2016.
  3. 1 2 3 4 Malig, Jojo (7 April 2016). "Comelec hacking threatens security of voters: Trend Micro". ABS-CBN News . Retrieved 21 April 2016.
  4. ↑ "Comelec website back to normal after hacking". GMA News. 28 March 2016. Retrieved 29 March 2016.
  5. ↑ "Experts fear identity theft, scams due to Comelec leak". 1 April 2016. Retrieved 21 April 2016.
  6. ↑ "'COMELEAKS' Lawmakers: Voter database breach compromises May 9 elections; PNP joins probe". Interaksyon. 22 April 2016. Archived from the original on 23 April 2016. Retrieved 22 April 2016.
  7. ↑ Kennedy, John (11 April 2016). "Every one of the Philippines' 55m voters could be in danger of fraud". Silicon Republic. Retrieved 21 April 2016.
  8. ↑ "Searchable website with hacked data taken down – Comelec". CNN Philippines. 22 April 2016. Archived from the original on 23 April 2016. Retrieved 22 April 2016.
  9. ↑ Santos, Tina (29 March 2016). "Comelec shrugs off hacking". Philippine Daily Inquirer. Retrieved 21 April 2016.
  10. ↑ Gotinga, JC (12 April 2016). "Comelec: No biometrics in leaked data". CNN Philippines. Archived from the original on 6 May 2016. Retrieved 21 April 2016.
  11. ↑ Santos, Tina (12 April 2016). "NBI finds lead on hackers who defaced Comelec website". Philippine Daily Inquirer. Retrieved 21 April 2016.
  12. ↑ "NBI releases suspected Comelec hacker's mugshot". 21 April 2016. Retrieved 21 April 2016.
  13. ↑ Cimpanu, Catalin (22 April 2016). "Anonymous Member Arrested for the COMELEC Hack". Softpedia . Retrieved 23 April 2016.
  14. ↑ "Comelec hacker arrested, asks NBI chief for a selfie". Philippine Daily Inquirer. 22 April 2016. Retrieved 22 April 2016.
  15. 1 2 "Fresh grad, 23, admits hacking Comelec site". 21 April 2016. Retrieved 21 April 2016.
  16. ↑ "NBI arrests hacker of Comelec website". 21 April 2016. Retrieved 21 April 2016.
  17. ↑ "Comelec hacker arrested". Manila Bulletin. 22 April 2016. Retrieved 23 April 2016.
  18. ↑ "NBI arrests 2nd Comelec hacker". The Philippine Star. 29 April 2016. Retrieved 29 April 2016.
  19. ↑ Murdock, Jason (29 April 2016). "Philippines election hackers taunt 'find us if you can' as second suspect is arrested". International Business Times. Retrieved 29 April 2016.
  20. 1 2 "NBI arrests 2nd hacker in Comelec data breach". ABS-CBN News. 29 April 2016. Retrieved 29 April 2016.
  21. ↑ Geducos, Argyll Cyrus (30 April 2016). "Second Comelec hacker arrested". ‘Comeleak’ won’t affect May 9 polls. Retrieved 2 May 2016.
  22. 1 2 "Comelec data leak has no effect on elections, says hacker". Manila Bulletin. 29 April 2016. Retrieved 29 April 2016.
  23. ↑ "Second Comelec hacker arrested". The Standard. 30 April 2016. Archived from the original on 30 April 2016. Retrieved 30 April 2016.
  24. ↑ "Hacker who allegedly leaked Comelec data now in NBI custody". CNN Philippines. 29 April 2016. Archived from the original on 13 May 2016. Retrieved 29 April 2016.
  25. ↑ "Comelec taps cybersecurity experts". The Manila Times. 21 April 2016. Archived from the original on 22 April 2016. Retrieved 21 April 2016.
  26. ↑ "'Comeleak': Poll chief rapped for data breach". Manila Standard. Archived from the original on 2017-01-06. Retrieved 2017-01-06.
  27. ↑ "Comelec's Bautista faces criminal raps over massive data leak". ABS-CBN News.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.