THE NATIONAL Privacy Commission (NPC) on Thursday said it would look into a reported data breach of police records and information on people who work or applied for employment in law enforcement in the Philippines.

In a statement, the agency said it would meet with the Philippine National Police (PNP), National Bureau of Investigation (NBI), Bureau of Internal Revenue (BIR) and Civil Service Commission (CSC) on Thursday to discuss the data leak.

“As your data privacy authority, the NPC is fully committed to protecting personal information and assures the public that we will not leave a stone unturned in getting to the bottom of this alleged breach,” Privacy Commissioner John Henry Naga said.

“We would also like to have this opportunity to remind those who process personal data that they concomitantly have the duty to protect the data they collect.”

In a report posted on the vpnMentor website on Tuesday, cyber-security researcher Jeremiah Fowler said more than 1.2 million police records and 800 gigabytes of information on people who work or applied for employment in law enforcement in the Philippines were publicly available on a database.

He said government agencies should conduct a comprehensive forensic audit of the exposed data.

Albay Rep. and House ways and means committee chairman Jose Maria Clemente S. Salceda said the NBI should scrap the police clearance requirement after the data breach.

“If you are involved in some crime, we can probably get your data easily anyway,” he said in a statement on Thursday.

“Rather than putting ordinary law-abiding citizens through the hassle and expense of clearances, as well as the risk of data breach, why don’t we normalize due diligence among employers?”

In a separate statement, Internal Revenue Commissioner Romeo D. Lumagui, Jr. assured that there was no breach at the agency.

“The bureau has initiated response protocols to keep its database protected,” he said. “We are now in close coordination with the authorities and other government agencies to assist in mitigating the reported breach.”

The database also contained documents on tax identification numbers of law enforcers, which was available for at least six weeks, according to the report.

Mr. Fowler said exposed police records could allow criminals to blackmail members of law enforcement, among other criminal schemes. — 

In a report on April 17, global cyber-security firm Kaspersky said web attacks targeting entities in the Philippines rose to 492,567 in 2022 from 382,940 a year earlier.

The country placed third worldwide in ransomware payments in 2021, with local organizations spending an average of P1.6 million, according to cyber-security firm Sophos.

The Philippines ranked 23rd out of 250 countries that were most affected by data breaches, with 523,684 leaked accounts in the third quarter of 2022, virtual private network service provider Surfshark said in a report on Oct. 28.

In December, the Privacy Commission said it would work with the Cybercrime Investigation and Coordinating Center to come up with countermeasures to combat cyber-crime and data breaches.

“The NPC will continue to work closely with the PNP, NBI and other concerned agencies to ensure that appropriate actions are taken to prevent similar incidents from happening in the future,” it said.

Meanwhile, the Department of Information and Communications Technology (DICT) said it was doubling down on its investigation of the breach.

The National Computer Emergency Response Team (NCERT) started its probe after receiving links to an Azure blob storage containing sample photos of IDs, including PNP and NBI clearances, from a security researcher on Feb. 22, DICT said in a statement.

The security researcher did not disclose to the team the source of the data and what information asset had been compromised.

“The information sent by the security researcher is identical to what was reported by Jeremiah Fowler and which has since been credited by recent news reports,” DICT said.

The NCERT provided an incident report on the breach to both PNP and NBI on March 3 to 23, it added.

“The DICT considers the incident a grave concern that threatened the confidentiality, integrity and privacy of user data.,” it said. “The department assures the public that investigation on the matter is under way.”

“The department would like to remind all government agencies to increase their cyber-security measures and to coordinate with the DICT for further capacity building in this area,” it added. — John Victor D. Ordoñez

THE PHILIPPINE Bureau of Corrections (BuCor) on Thursday released 580 more inmates from the national penitentiary and local prisons as part of efforts to decongest the country’s jails.

At a livestreamed ceremony of their release, jail chief General Gregorio Pio P. Catapang said 353 of the inmates were released on parole, 61 were acquitted, while other inmates had completed their prison sentences.

He said the freed prisoners would be given certificates of discharge from the national penitentiary, grooming kits and transportation allowances.

“We have a nice future here at BuCor,” Mr. Catapang said in Filipino. “We can decongest our prisons in five years.”

Justice Secretary Jesus Crispin C. Remulla earlier told the United Nations Human Rights Council he seeks to release 5,000 inmates by June.

Many of the country’s jails fail to meet the UN’s minimum standards given inadequate food, poor nutrition and unsanitary conditions, according to Human Rights Watch

At the same event, Mr. Remulla said the government would continue prison reforms to allow ex-convicts to contribute to society.

He said recent reforms in criminal prosecution would help decongestion, such as ensuring that only cases with a reasonable certainty of conviction would be pursued by state prosecutors.

Last month, the Department of Justice (DoJ) lowered the bail for poor Filipinos to half of the recommended bail or P10,000, whichever is lower.

“We still have a lot of problems here at the DoJ and Bureau of Corrections, but we are fixing our justice system,” he said in Filipino.

Mr. Remulla told the United Nations (UN) Rights Council on March 1 the government had cut the number of inmates more than four times to about 50,000 last year from the 2021 level. He added the government had released 4,124 inmates since he assumed office on July 1.

“The approach of our new administration is a whole-nation, all-government solution to every step of the criminal justice process,” according to a copy of his UN speech sent by his office. “No longer shall our penal code be used, abused or weaponized.” — John Victor D. Ordoñez