Comelec holds back P90-million payment to Smartmatic over alleged data breach

MANILA, Philippines — The Commission on Elections (Comelec) has withheld P90 million of payment to poll technology provider Smartmatic due to an alleged data breach connected to one of the company's contractual employees.

Last week, authorities raided the house of former Smartmatic employee Ricardo Argana in San Pedro, Laguna, who is a suspect in Smartmatic's security breach.

In a hearing on Tuesday, Comelec Commissioner Saidamen Pangarungan told lawmakers that he has not yet given the go-signal to release Smartmatic's payment due early March.  

"I have not signed the voucher for the payment to Smartmatic in the amount of P90 million pursuant to our contract because we want to clear this matter about this leakage by Mr. Argana of some data," he said. 

The Comelec is looking at four possible courses of action which it will take against Smartmatic if it is proven that the company violated its contract and/or the Data Privacy Act:

• Termination of the contract and possible blacklisting.
   
•  Forfeiture of performance security. 
   
• Filing of damages pursuant to the Data Privacy Act and the Civil Code of the Philippines
   
• Filing of criminal cases pursuant to the Data Privacy Act.

"So far we have not taken any of these [actions], except to withhold payment to Smartmatic...It is the recommendation of [our] law department to wait for the official investigation report of the NBI in order for the Commission to be in a better position to assess the extent of the breach and the probable course of action to take," he said. 

Pangarungan said they will only release the payment once Comelec is "convinced that Smartmatic is innocent about this leakage of data." He believes that his decision to not turn over the payment to Smartmatic will not cause undue delays in the polls. 

Smartmatic lawyer, Christian Robert Lim, who was present at the hearing, confirmed that they have not yet received the P90 million in payment, but promised to cooperate with the poll body in the investigation.

In a statement on March 21, Smartmatic said the alleged data breach will have no bearing on the national and local elections taking place in less than a month's time. "The 2022 Philippine National and Local Elections are 100% safe and secure, and remain unaffected despite the noise being generated by disinformation campaigns, non-verified sources, and even fabricated and manipulated information," it said. 

The information compromised in the breach involved "non-sensitive, day-to-day operational materials from a repository readily available to all Smartmatic staff", the company said. 

The Senate hearing on Tuesday was presided by Sen. Imee Marcos, who chairs the Electoral Reforms and People's Participation Committee. 

Marcos' brother Ferdinand "Bongbong" Marcos Jr. is among the presidential aspirants in the May 2022 elections, and is currently leading in the voters' preference polls as the survey frontrunner.

Former Smartmatic employee linked to breach offered up to P300,000

Victor Lorenzo, Chief of the NBI Cybercrime Division, said that Argana admitted during an adminstrative inquiry on January 12 that he allowed a third party to access his laptop in exchange for "some training materials."

However, he said later on that he was offered P50,000 to P300,000 to give the third party access to Smartmatic's facilities. 

Lorenzo said the NBI believes Argana "is not acting alone", as he was not as fluent in English as XSOX—the group believed to have access to the compromised files.

"We are also inclined to believe that he was not able to meet those people who convinced him to provide access to his laptop because they are only communicating via Facebook Messenger," he said.

Marcos earlier said that the alleged data leak compromises Smartmatic's operations, calling it a "very serious breach."

Meanwhile, Senate President Vicente "Tito" Sotto III, who is running for vice president in this year's elections alongside Sen. Panfilo "Ping" Lacson, previously said he is concerned that election gatekeepers lacked in ensuring the integrity of the polls. 

"The people’s right to an honest and credible election is enshrined in our Constitution and the Comelec is tasked to ensure that the results of the elections are not tainted with doubt and especially, that the conduct of the electoral exercise was not attended by anomalies,” Sotto said on March 17.