‘Cyber warfare’

It was quite ironic that the Philippines is among countries with the strictest laws on data privacy rights but is also one of the most vulnerable to identity thieves, hackers, and other criminals in the cyber space. Much more ironic amid the seeming spread of digital-aided crimes, our government authorities have shifted priorities other than securing our country’s leaky cyber space.

This we have seen from the on-going congressional scrutiny of the proposed 2024 budget of the national government. The request of the Department of Information and Communications Technology (DICT) for P25 million in confidential/intelligence funds (CIF) is among the items recommended for re-alignment elsewhere in the proposed 2024 budget. 

Instead, the House special appropriations committee recommended to realign the P25-million CIF to the maintenance and other operating expenses of the DICT. If this will be spent for the hiring of additional IT experts, then it’s well and good.

The DICT is among the top five national government agencies with the biggest amount of underspending of its budget this year, according to Department of Budget and Management (DBM) report. This is measured in terms of the “obligation rate,” or obligations over allotments that consist of contracts ready and procured for. The DBM earlier called DICT attention to its very low 9.2 percent obligation rate.

But DICT Secretary Ivan John Uy begged to disagree. Uy even warned against the dire consequences of “zero” CIF for the agency mandated, among other things, to secure our country’s cyber space. The DICT was created in May 2016 after Congress spun it out from the Department of Transportations and Communications (DOTC).

Uy underscored the need to upgrade DICT equipment to the latest technology, including artificial intelligence (AI) and bots. If not, the DICT chief likened their fighting these cyber criminals with their hands tied behind their backs. 

“Cyber warfare is real and it is ongoing,” the DICT chief declared.

“And this clearly sends the wrong signal to the rest of the world that the Philippines basically will be open season, cyber criminals can do whatever they want. We will not have the capability to respond to them, to go after them, to arrest them, or to prevent it (attacks) from happening,” Uy bemoaned.

Uy echoed these fears with reporters at the sidelines of the Cybercrime Investigation and Coordinating Center’s National Cybercrime Hub held last Oct. 11 in Taguig City. “So we’ll still continue doing what we can with zero funds from the confidential (intelligence funds),” Uy sighed. 

It would seem Uy is merely being overly dramatizing to justify the DICT plight.

But for one, Uy raised a scenario of cyber attack that might cause another shutdown of the entire Ninoy Aquino International Airport (NAIA) complex like what happened last January 1 due to power overload glitch. The DICT chief foresees similar magnitude of the ensuing “chaos, the disruption, the economic damage, not to mention the reputational damage for the country.”

That said, Uy raised the specter of other potential targets of cyber attack on our power grid system, energy transmission, on telecommunications system, etc. etc. etc. “You can just imagine the scale of the damage and the disruption,” Uy warned.

“It’s not something in the future. It’s ongoing. And this is not only with respect to state-sponsored cyberwarfare, but with criminal syndicates that are operating with a lot of funding. Very technically, technologically advanced equipment, and hiring the best people that money can buy,” Uy pointed out.

The DICT chief cited Israel is very famous for their “CyberDome” that protects their systems against cyber attack. It is like the “Iron Dome” of Israel which is a mobile air defense system designed to protect against short-range rockets. Despite this, the Hamas succeeded in their bloody sneak attack against Israel. 

With the cyber space expanding exponentially, Uy said the Philippines is not spared from the intensifying cyber warfare around the world. Already, he cited as example, the biggest data heist involved 700 gigabytes of personal data/information of the more than 100 million members of the state-run Philippine Health Insurance Corp. (PhilHealth). A notorious Russian mafia was behind the Medusa ransomware attack on the PhilHealth digital data network last Sept. 22.

One after the other, the De La Salle University (DLSU)  “data security incident” of their website, affecting their online student and faculty portals and the Philippine Statistics Authority (PSA) suffered yet another successful attempt to mine their household data of Filipino families. 

And just last Friday, the Department of Science and Technology (DOST) confirmed a data breach that affected the One Expert website being operated by the DOST Region 6.

Although deeper investigations are still going on, the timeline of the cyber attack on PhilHealth took place when the agency licenses of its IT cyber security system for the firewall and anti virus expired last April this year. It was during this “gap between April to now,” Uy disclosed, that the Medusa ransomware attacked the PhilHealth IT system. 

The same facts reached Sen. Grace Poe, chairman of the Senate committee on public services, who got irked to the lack of due diligence of the PhilHealth top management. Already provided for in its 2023 budget, Sen. Poe blamed PhilHealth managers who failed to check on the renewal of their IT licenses ahead of the expiry date.  

Aside from the PhilHealth, Uy revealed several other government establishments and State entities have soon-to-expire IT licenses. “Wherever they see exposure, wherever they see vulnerability, wherever they see an opportunity to make money, they (cyber criminals) will attack,” Uy cited.

Already delayed by a decade-long tarrying in the past administrations, Uy vows to push harder the DICT in its catch up mode in the advances of modern technology. Or all of us Filipinos lose in the cyber warfare by default.