PNP headquarters


Senator Ramon Bong Revilla, Jr. has filed Senate Resolution (SR) No.573 directing the appropriate Senate committees to conduct an inquiry into the alleged massive breaches in the databases of the Philippine National Police (PNP) and other government agencies recently. Revilla cited a report of VPNMentor, a leading cybersecurity research company, that records of a staggering 1,279,437 persons in the repository of law enforcement agencies, including sensitive police employee information, have been compromised in an unprecedented data breach. The voluminous data hack has exposed 817.54 gigabytes of both applicant and employee records under multiple state agencies, including the PNP, National Bureau of Investigation (NBI), Bureau of Internal Revenue (BIR), and Special Action Force (SAF). “Sobrang nakakabahala ang ulat na ito (This is a very alarming report).   Napaka-sensitive ng mga data na involved - mga fingerprint scans, tax identification numbers, birth certificates at ultimo mga kopya ng passport (Data breached are very sensitive- fingerprint scans, tax identification numbers, birth certificates and copies of passports). . Kung mapunta ito sa kamay ng mga masasamang tao, napakadali na sa kanila na gamitin ito sa panloloko at pag-access ng iba pang records katulad ng sa mga bangko (These data could be used by bad elements…to fool people and even bank records),” Revilla said. VPNMentor also disclosed that the alleged breached documents were stored in a database that was unsecured and non-password protected, making it highly vulnerable to cyberattacks and ransomware. "Repositories must be extra diligent in protecting these information," he stressed. Revilla said that data privacy and protection is a matter of national security and interest  and it is imperative that Congress immediately exercise its oversight powers to ensure that existing laws on data privacy are religiously being followed. “We have existing laws, especially Republic Act No. 10173, or the Data Privacy Act of 2012. Dapat nasusunod ito (This should be followed). May batas tayo eh (We have laws),” Revilla added. Section 2 of RA 10173 provides that, “The State recognizes the vital role of information and communications technology in nation-building and its inherent obligation to ensure that personal information in information and communications systems in the government and in the private sector are secured and protected.” Section 22 of the same law provides that “All sensitive personal information maintained by the government, its agencies and instrumentalities shall be secured, as far as practicable, with the use of the most appropriate standard recognized by the information and communications technology industry, and as recommended by the Commission.” Similar data breaches on government databases occurred in the past. In November 2021, the Department of Foreign Affairs (DFA) reported a data leak in their online passport tracking system. Just last year, the Commission on Elections (Comelec) revealed that around "60 gigabytes worth of sensitive voter information" and other data have been hacked. Before this, a group of hackers also downloaded the personal data records of some 54 million registered voters. ‘’I therefore call on my colleagues in the Senate to swiftly take action on this matter para hindi na muling mangyari ito (so this will not be repeated),” the veteran lawmaker emphasized.