By Macon Araneta | FilAm Star Correspondent
HACKERS CALLING THEMSELVES LulzSec Pilipinas uploaded the personal information of some 56.7 million registered voters on their site hours after the National Bureau of Investigation (NBI) collared a suspect accused of defacing the Commission on Elections (Comelec) official website.
The site, named Philippines, we have your data, was uploaded after Comelec Chairman Andres Bautista announced the arrest of one of the three hackers, who is now in the custody of the NBI.
The site contains a search engine that enables visitors to find information of registered voters such as their home addresses and birthdates.
The data that have been accumulated from the Comelec website reportedly include birthdates, fingerprint data, names of relatives, home addresses, citizenship information, passport information, and other miscellaneous data.
“We thought that it would be fun to make a search engine over that data,” the hackers said on the website.
The group LulzSec accessed the data of the poll body’s website and posted it on-line.
“A great lol to Commission on Elections, here’s your whoooooole database,” LulzSec Pilipinas wrote in a Facebook post.
The hackers also posted three mirror links to an index of files that could be downloaded.
The files represent “the whole database leak of the Commission on Elections,” the hackers said.
“Some of the tables are encrypted by Comelec. (It has) the algo(rithms) to decrypt the data,” they added.
Comelec Spokesman James Jimenez urged, “We advise the public not to use the hacker website as it can be used by the hackers to steal your information and thus expose you even further to the dangers of identity theft.”
“We assure the public that the Comelec is doing everything we can to resolve this matter at the soonest possible time,” he said.
Former Comelec Commissioner and IT expert Gus Lagman criticized the poll body for putting sensitive personal information on its public website.
“The Comelec was wrong. Why put that on a website? Now the people have lost their privacy,” said Lagman. He raised the alarm that the information could be used for identity theft.
However, he ruled out the possibility that the compromised data could be used to manipulate the results of the May elections.
“The election is not an issue here. The biometrics that they alleged have are just photocopies. You need the original biometrics to rig the election result,” Lagman said.
He said he saw no way for the hackers to manipulate next month’s elections.
NBI Cybercrime Division chief Ronald Aguto said it took them about three weeks to find suspect Paul Biteng, a resident of Sampaloc, Manila. He said they were still tracking down two other hackers.
“He just wanted to demonstrate the vulnerability of the website,” Aguto said of the hacker’s motive.
Biteng was charged with violating Section 4a of the Cybercrime Prevention Act, which deals with confidentiality, integrity and availability of computer data and systems. He admitted to defacing the Comelec website but denied that he was the one who uploaded the data online.
Aguto said at least two more hackers were involved in the data dump. He said they will go after the two other hackers as well as any other individual who has physical possession of the data illegally uploaded online.
He said they are still identifying the specific affiliation of the hacker and that the investigation is ongoing.
Seized during the arrest was the computer used in hacking and defacing the Comelec website.
“There is an ongoing forensic investigation,” he said, adding that they could not say yet if the data accumulated were legitimate.
He also could not say whether the data they discovered came from the Comelec.
Bautista said the arrested hacker was cooperative.
“He told us he wanted to make sure that the security features of our vote counting machines were working,” he said in Tagalog.
“I told him that he didn’t need to (hack the website). If he just wrote us and addressed the letter to us we would have immediately addressed his concerns,” Bautista added.
In March, Anonymous Philippines defaced the official Comelec website, and posted a message demanding that the security features of the vote counting machines are turned on during Election Day.
“What happens when the electoral process is so mired with questions and controversies? Can the government still guarantee that the sovereignty of the people is upheld? We request the implementation of the security features on the PCOS (Precinct Count Optical Scan) machines,” the hacker named Anonymous wrote.
The message was accompanied by a threat to the commission that the group will be vigilant on how the Comelec will be running the forthcoming elections.
“Commission on Elections, we are watching! We are Anonymous. We are legion. We do not forgive. We do not forget. Expect us!” the hacker said.
Senatorial bet Richard Gordon called on the Comelec to ensure that all the hackers involved in the recent defacement and leak of data from the poll body’s official website are arrested.
He also urged the poll body to take extra precautions to assure the country that the results of the upcoming presidential elections will not be manipulated by hackers and cheaters.
He said it is important that the Comelec must be serious in making sure that they catch all these hackers. ” That the Comelec assures the country that there would be no cheating on May 9,” the former senator noted.
“The hacking itself is very disturbing but even more disturbing is the cavalier way the Comelec is treating it,” he said.
Gordon also expressed concern. “I hope the Comelec will stringently check its records because there are reports that some voters have already transferred their registrations but their registration in their old precincts have not been deleted,” he said.
