Cybersecurity is not on top of PH priorities

“In light of the recent spate of hacking directed toward its websites, the government reiterated its support for the passage of the cybercrime and data privacy bills, saying they are not taking these attacks lightly.”

--- Read full story here c/o GMA News

Image from the movie "The Matrix" 
(Photo Credit: http://www.moviespictures.tk/the-matrix.html)

This only shows how backward PH is in terms of ICT development. First, the coding practices used by the Government and perhaps other institutions in the country are below standards, if not obsolete. Most of these did not undergo rigorous security testing, for the simple reason that the establishment of safeguards require a lot of technical and monetary resources -which is very limited in this part of the world. Not everyone can afford to hire a professional systems analyst, more so the government. Second, cybersecurity is not a priority in the government's budget.  This is understandable considering that there are more pressing matters at hand such as education, social welfare and servicing foreign debts. For a developing country, the development of it's websites is the least of its concerns.

At present, the cybercrime bill and the data privacy bill are already pending in Congress on different levels. While everyone is hoping that the enactment of these bills would solidify government policy regarding online security, they are not an assurance that internet crimes will stop. At most, they will provide a sense of security for the users and a deterrent for hackers and the goons of the internet. Furthermore, an effective enforcement mechanism is necessary in order to fully implement the laws.

Passing a law is not the solution, but only a part of it.  Website developers, system analysts, programmers, and all internet users in general have to do their share to ensure the integrity and safety of their data and transactions across the web.


Entry No. 8
Soleil Flores

Operation Shady RAT (Remote Access Control)

The internet is perhaps the most dangerous place on the planet. No one is safe. Not even the United Nations.

Photo Source: http://www.presstv.ir/detail/163926.html

Security company McAfee, discovered the biggest series of cyber attacks in the last 5 years which involved the the infiltration of the networks of 72 organizations including the United Nations, governments (US, Taiwan, India, South Korea, Vietnam and Canada) and companies around the world. It believed there was one "state actor" behind the attacks but declined to name it, though the evidence "allegedly" points to China. (Source: Reuters)

Cyber attacks are perhaps as old as the internet. However, what is alarming about this report is that a "state actor" is involved in the attacks against various governments of different countries. Should the "state actor" be proven, could such cyber attacks escalate to a dispute under the principles of international law?

In international law, the state is responsible for all actions of its officials and organs, even if the organ/actor/official is acting ultra vires. However, before a state can be held responsible for any action, it is necessary to prove a causal connection between the injury and an official act or omission attributable to the state alleged to be in breach of its obligations.

In the case at bar, it is not clear whether the "hacker-state-actor" owed an international obligation to the injured governments under either a treaty or customary law. So far, the only relevant document regarding the matter is the 2007 resolution passed by the UN Disarmament and International Security Committee related to IT security concerns related to organized crime, terrorism and politically motivated cyber attacks. Take note that this is not even the General Assembly or the Security Council, but a Committee. Hence, no "force" so to speak.

While the use of all the illegally obtained data is still largely an open question, the need for an international legal framework to combat malicious or illegal use of information technology is called for by many sectors around the world. After all, we live in the age where information is power ---political or economic.

Entry No. 7

Soleil Flores

The Attack of Philker Hackers

Hacking is old news. So old, that it is believed that hacking has been around pretty much since the development of the first electronic computers(1). Anyone with security vulnerabilities can be a target. No one is safe. Not even government websites. Last year isolated attacks were experienced in different government agencies particularly: Department of Social Welfare and Development (DSWD); TESDA; GSIS; National Disaster Coordinating Council (NDCC); and Philippine Information Agency (PIA) .

And you think they have learned their lesson? Well, not really.

Just recently, the latest Government web sites to join the ranks are:

• Department of Interior and Local Government (DILG) on May 31

• Philippine Nuclear Research Institute (PNRI) on June 13

• Bureau of Customs (BOC) on June 15

• Food and Drug Administration (FDA) on June 16

• Office of the Vice President (OVP) on June 20

• Department of Labor and Employment (DOLE) on June 23

What is alarming about the recent attacks is that there is one group who call themselves Philker Hackers, responsible for the attacks on the PNRI, FDA and OVP websites.

Photo Credit: http://www.techalang.com/

Philker Hackers, who are "proudly Filipino" claim that they are "white hats":

“WE ARE NOT TRYING TO DAMAGE YOU. WE ONLY WANT TO HELP PROTECT OUR COUNTRY’S CYBERSPACE BY DOING WHAT SEEMS TO BE THE MOST EFFICIENT WAY TO GET EVERYONE’S ATTENTION. MAY THIS DEFACE SERVE AS A REMINDER THAT YOU ALWAYS HAVE TO LOOK OUT FOR INTRUDERS. NO MATTER HOW INTELLIGENT AND COMPETENT YOUR COMPUTER PERSONNEL ARE, THERE WILL BE UNETHICAL HACKERS THAT ARE CONSTANTLY WORKING ON BREAKING IN YOUR SECURITY, WHETHER IT’S YOUR MONEY OR INFORMATION THEY ARE AFTER; IN THIS CASE, YOU ARE FORTUNATE THAT IT WAS US WHO HAS SUCCESSFULLY BROKEN IN. YOU ALSO HAVE TO UNDERSTAND THAT BOTH THE PRIVATE AND PUBLIC SECTORS ARE AT RISK HERE, THIEVES AND TERRORIST ARE ALL LURKING ONLINE POSSESSING THE SKILLS TO TAKE DOWN MULTIPLE NETWORKS AND ASSUME ACCESSIBILITY OVER ACCOUNTS, WATCHING OUT FOR THE MOST VULNERABLE TARGETS; TRUST US, WE’RE CUT FROM THE SAME CLOTH, THE DIFFERENCE IS THAT WE HAVE GOOD INTENTIONS. THEY DERIVE THEIR ENERGY FROM GREED. WE DERIVE OURS FROM OUR THIRST TO KEEP OUR COUNTRY’S CYBERSPACE SAFE. EXPECT MORE FROM US. WE ARE PHILKER.”

Philker Hackers allege that they are merely "protecting our country's cyberspace" yet under the Computer Misuse Act of 1990 in the United Kingdom, "unauthorized access even to expose vulnerabilities for the benefit of many is not legal." As Struan Robertson puts it, "There’s no defense in our hacking laws that your behavior is for the greater good. Even if it’s what you believe." (2)

Unfortunately, the current state of Philippine legislation does not offer the same protection.

Although hacking is nothing but universal occurrence nowadays, the recent events only demonstrates the quality of internet security we have in this country. It only shows how weak the Government's defenses are in terms of protecting themselves from online threats. The hacking incidents call not only for a major upgrade in the government measures regarding online data security but also a reflection on the country's current internet or cyber policies and ethics.

Entry #1

----------

Sources:

(1) Timeline: A 40-year history of hacking 

http://articles.cnn.com/2001-11-19/tech/hack.history.idg_1_phone-phreaks-chaos-computer-club-emmanuel-goldstein?_s=PM:TECH

(2) License to hack? - Ethical hacking

http://www.infosecurity-magazine.com/view/4611/license-to-hack-ethical-hacking/

(3) Photo Credit:  http://www.techalang.com/

(4) On the various articles related to the different attacks:

(a) http://www.gmanews.tv

(b) http://www.abs-cbnnews.com

(c) http://www.techie.com.ph

(d) http://newsinfo.inquirer.net

(e) http://www.techalang.com/

Social Media - A National Tool for Naming and Shaming

A retired archbishop goes on national television to insinuate that there are highly placed villains in government who are dabbling in the underground gambling world that the present administration has pledged to eradicate. A senate hearing is called almost immediately.

The spokesperson of the judiciary issues a media statement to the effect that it has no money and that the courts won’t survive if the budget isn’t increased post-haste. He threatens that if congress fails to remedy the deficiency, judges would go on mass leave. The media loves the story and has a field day. Hours later, the president sets a meeting with the chief justice.

---

With these events in mind, I’d like to point out an obvious perplexity in national affairs: a communication gap exists between supposedly coordinate branches of government; between the civilian and relevant government agencies. And this abyss, this void of miscommunication, is filled by an unlikely hero, villain and observer: media. Pleas are brought to this ‘unbiased’ Fourth Estate, rather than the pertinent government agency involved, due to two contiguous theories: one, media is much more effective in shaming the agency into action; two, government enforcement is usually unavailing when the camera isn’t aimed at the would-be enforcers. Considering therefore that (a) attention on the individual or (b) national shame is required to enforce government action (perhaps as a cultural byproduct of our post-Iberian heritage), I propose that a national shaming mechanism be employed to spur government proactivity in order to supplement, and even validate, the actions of traditional media.

The “name and shame” strategy, utilized by the Human Rights Watch (but yet to be effectively used by the UN’s Human Rights Council), is presently international law’s solution to the enforcement of human rights norms. Coincidentally, this is the exact same strategy employed by Mon Tulfo’s radio show where complaints against local government officials and policemen are aired live, addressed, and resolved on a daily basis. Now that social media is becoming the norm in Philippine society, perhaps this, too, can be employed as a medium to “name and shame” public institutions and officials on a national scale. Truly, if a government requires national shame and attention in order for it to function properly, perhaps this need should be addressed by our own efforts through the veritable medium of social media. This push to “name and shame” would not simply be a matter of voluntary contributions on the part of individuals but rather a collective drive, enforced as a matter of sound national policy, spearheaded by NGOs in conjunction with social media outfits. I’m pretty sure that Facebook, YouTube and Twitter would enjoy the corresponding title of being ‘progenitors of third-world change.’ Think of the Pepsi Refresh Project, turned-upside-down, adapted by Filipinos for a truly Filipino cause. Perhaps, taken in this light, social media, in its proposed task of “naming and shaming” government ineptitude, might do some much-needed social good.

---

Please see all entries by the same author in this blog:

• #01, Telconopoly, June 16
• #02, Government 2.0, June 23
• #03, In Defense of Twitter, June 30
• #04, Google, Apple and Nokia, July 7
• #05, YouTube and Government, July 14
• #06, The Problem of ICT Quality Control, July 21
• #07, The Mac or the PC?, July 28
• #08, Kindle: Victor of the Ebook Wars, Aug. 2
• #09, Of Team Coco, Wowowee and Contracts, Aug. 12
• #10, Resuscitating Law Journals, Aug.14
• #11, Moot, Zuckerberg, et. al. v. The World, Aug. 19
• #12, Ground Zero of the Tech World, Sept. 1
• #13, Evolution, Sept. 9
• #14, Snapshots of Software as Intellectual Property, Sept. 13
• #15, The Smartphone OS Slugfest, Sept. 17
• #16, Social Media - A National Tool for Naming and Shaming, Sept. 21

The Mac or the PC?

A professor of this College has simple words to say about the immortal debate, which, for tech-enthusiasts anyway, rival the rhetorical question surrounding the age-old chicken and her egg: “Mars, once you go Mac, you never go back.” A recent convert of Apple’s growing cult, he excitedly slips into a discussion about its comparative ease of use, its architecture, and how he no longer has to concern himself with viruses. To hear him describe the experience, it would seem that Apple has heralded the dawn of tech civilization - a far cry from clunky, old-fashioned Windows with its once prominent ‘blue screen of death.’ I sit in the room amazed at how his assessment mimicked my own thoughts not too long ago when I first unboxed, held, and experienced the beauty obviously inherent in the Mac. The PC, I declared then, was a relic of an Age gone by. It was now Friendster of today’s Facebook. The girlfriend, a staunch devotee of the Cult, casually refers to Windows as “the dark side” of the Force. Though I find myself reassessing that statement today (for reasons which will require a separate paper altogether), I surprise myself in recommending the public sector’s wide-spread adoption of the Mac for the very reason that I’m starting to shy away from it.

As an underlying philosophy, the Mac favors the use of its own internal applications and discourages the user’s attempt at tinkering behind its custom-built operating system. As opposed to the PC’s open (even challenging) question of “What do you prefer?”, the Mac calmly says: “Use this. Look, it’s pretty. Don’t worry about anything else. See? It just works.” The PC, to use Justice Cardozo’s words, is simply “delegation running riot.” Considering that Juan de la Cruz has been using Windows since grade school, that he cares not a whit for government-owned property under his temporary stewardship (see the tragedy of the commons), and that there is an unrivaled selection of third-party applications in the PC ecosystem with its troubling deluge of viruses and malware, I posit that giving the public sector employee a PC is akin to giving him Pandora’s box.

In sum, the PC is open, the Mac is “closed.” The potential for harm, mismanagement and loss, therefore is more potent in the former rather than in the latter. I find it heartening then that Apple is making some headway in the mainstream with customers like my professor. Though the suggestion that the public sector utilize these for everyday tasks doesn’t seem likely considering the present state of government coffers, my opinion is that the eventual use of a custom-built system, one resembling Apple’s walled garden, would be best for government information systems. Until then, however, Steve Jobs will have to settle for ready and willing customers -people like the girlfriend and the professor who adore the simple intricacies of something that "just works."

YouTube and Government

premises and possibilities

The televised Fourth Estate in the RP is a proactive force to reckon with. No matter how much this government tries to assert itself through its own news agencies, its efforts are like pebbles in a pond, dwarfed by the massive boulders like ABS-CBN and GMA who, on a whim, can make or break a government’s success story or turn an innocent mistake into a living PR nightmare. Our press acts as a microphone which can be turned on or off depending on circumstances. We have nothing akin to (and probably will never have) the influential effect of government-sponsored BBC. Thus, ever since people power became the norm rather the exception, administrations have walked lightly, carefully watching its step in order to avoid stepping on the media’s shoes. And rightly so.

The question I ask, however, is that should government remain shackled by precaution? Should the metaphoric microphone remain the gatekeeper of information? YouTube would beg to differ. For one thing, the online tool is reshaping a paradigm in the United States where mere city mayors (not to mention state governors and its own President) can break their own stories without the need of a third-party amplifier.

One might argue that internet penetration in our own country is not as pervasive as the United States. The numbers today, however, show a strong pattern of change. At the very least, they no longer appear to be inconsequential. In October 2009, there was an estimate of over 6M people in the RP who were Facebook users. According to Facebook analytics today, there are now 14.6M people who live in the RP who use the same. If we have 94M in the country, one can infer that at least 15% of our residents are “connected.”

With this in mind, the ultimate issue boils down to the utility of YouTube as an effective tool for government. Considering that the present members of the newly formed cabinet are media-shy, the use of this online medium might prove to be a viable and worthy alternative. Mighty as it is, the Fourth Estate need not be the sole gatekeeper of newsworthy information. Should government finally decide to come out of its shell, it can change the whole ballgame with something as ubiquitous as an online channel. YouTube and Government might just become "Your Government" - a channel that is transparent, effective, and, above all else, free.

Twttrexecution

I was first introduced to Twitter by my friends a year ago. I don't have Facebook account, back then, so I was impressed with Twitter's usage of one-line status updates and its interactive reply features. I am quite fond of using one-liners so I immediately thought that it was a brilliant idea to have an account on the micro-blogging site. Unfortunately, my excitement was shortlived as I discovered that Facebook is like Twitter with more characters allowed (in its status updates) and more things and time-wasters to do (Mafia Wars, anyone?).

Last week, Prof. Quimbo touched on the subject of Twitter and its relevance to non-celebrities' lives. I immediately thought of this Japanese drama series I've chanced upon, about how Twitter brought a group of ordinary people together and helped them through a lot of tight spots. (Apparently, Twitter has this radar feature on mobile phones, allowing you to search Twitter users within your vicinity.)

With the good, also come the bad. Two weeks ago, I've come across a news article regarding how the Attorney-General of the State of Utah "tweeted" the execution (by firing squad) of a certain Ronnie Lee Gardner. Another news article even reported that the said officer followed-up on this tweet and said, "We will be streaming live my press conference as soon as I'm told Gardner is dead. Watch it at www.attorneygeneral.Utah.gov/live.html".

As aptly described by one Twitter user in one of the articles, I believe that the said tweet "will probably go down in history as the dumbest, most disgusting use of Twitter ever."

Government 2.0

initiating a paradigm shift from within

Print media is dying in the western world. The calling card, the scrapbook, and the diary have evolved; they’re now collectively known as Facebook. Politics and big business have started to tweet. The word 'tweet' itself, like 'google' of yesteryears, is in the process of becoming part of this generation’s lingua franca. We’re seeing a titanic shift in the way information is being shared. And the government of this Republic, based on the numbers below, should either adjust accordingly or lie forever trapped in it’s self-made quagmire of technological anachronism.

Most of our government websites today use technology that was considered state of the art in the late nineties. Considering that we’re still using boats and planes from WWII, this is not very surprising. Unlike these multi-million dollar acquisitions however, developing and improving our online assets is a much cheaper endeavor, produces immediate results, and, when properly utilized, can be more effective in delivering government services to perhaps 11.4 million RP citizens on Facebook alone. Note that this online Filipino demographic is, in all probability, the same community that actually pays for everything that government does anyway.

Big business has already taken its initial steps in engaging consumers via web services and social media. Bringing government into the picture should not be difficult considering that it already has a willing and ready audience. Imagine the BIR answering questions in Facebook regarding the process of paying capital gains tax. Imagine the Province of Palawan doling out cheap promos for both foreign and local tourists on Twitter. Imagine avoiding EDSA traffic via a Google-MMDA partnership that provides real-time updates of the metropolis in transit. Imagine filling up a government form online and this being processed so that all you have to do when you get to the agency’s office is pay and sign for the transaction.

The possibilities are endless. The costs, relatively negligible. The efficiency and time saved, unmatched. The will and the initiative to jumpstart a paradigm shift that will eventually modernize the bureaucracy? Maybe after we buy another chopper. A newer one, of course. One that saw action during the Vietnam war.

Operation Crackdown of Web Dissenters

To what extent shall the national government, in its desperate attempt to curtail people’s liberty and right to freedom of expression, silence those who dare speak out against its depravity and inadequacies? Unfortunately, this question has remained throughout the history of the Filipino’s struggle for genuine democracy and even in this modern day where they say that liberty has never been more protected and speech never more free, such a question will perceptibly remain for as far as we can foresee in time.

End archaic language portion.

A few days back, a friend of mine posted on Twitter how, for no apparent reason, his blog site disappeared. Initially, of course, I dismissed his situation as one of those random internet glitches which would have to happen to some unlucky person, and unfortunately for him, considering that bloggers out there must number in millions, that had to happen to him. He insisted however that he may have been hacked by some government agent or government-hired professional hacker, who then worked the sudden crashing of his site, because of his endless criticisms against the current administration and his very strong and harsh, albeit well-written and rather articulate, opinions about the way the government is being run.

Again, I just thought he was being a blowhard, giving himself that much importance to actually think that the government would be doing a crackdown against him for his statements. What a friend right? But anyway, I mean of the million bloggers out there, at least a good 20% is all about bashing the government and espousing a critical view of the government, or if not, even a revolutionary position. Why would he be singled out?

After reading all the Tweets that he…twitted, and some rethinking on my part, I realized that maybe he does have a point. He is after all a very well-read blogger and a rather staunch activist as it can be gleaned from all the things he’s written. And besides, this government is so paranoid anyway they won’t stop at anything to make sure that all possible dissenters are suppressed from trying to influence other people to make a stand against that moral, social, and economic corruption embodied as the government.

But then, it may have just been a glitch.