Foundation for Media Alternatives

More about our partner

Tracking the Global Response to COVID-19

See more examples

Civil society's Covid response

Date

Sunday, March 15, 2020

Content

Educational

Stories

An open letter to Google

tech-admin — Wed, 08 Jan 2020 15:19:16 +0000

Target Profile

Google

Audiences and Purpose

Influence key stakeholders

Change

We campaign for solutions

We are building a global movement

Content

Advocacy

Summary

Privacy International and over 50 other organisations have submitted a letter to Alphabet Inc. CEO Sundar Pichai asking Google to take action against exploitative pre-installed software on Android devices.

Media

Pi-Android-mock-up-3-1-photo correct.png

Key points

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

Note: This letter is also available in French and Spanish

Dear Mr. Pichai,

We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.

And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.

These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store.

These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.

We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.

The changes we believe are needed most urgently are as follows:

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.

We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

Yours sincerely,

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

The Association for Civil Rights (ADC) is a non-governmental organisation based in Buenos Aires that promotes civil and social rights in Argentina and other Latin American countries. It was founded in 1995 with the aim of fostering a legal and institutional culture to guarantee fundamental rights, based on respect for the constitution and democratic values.

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Coding Rights is a Brazilian-based think tank that aims to advance the enforcement of human rights in the digital world. Its goal is to ensure that policy-making affecting technological development and digital rights is informed by actual technological knowledge, and that technological development is guided by fundamental human rights.

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Digital Rights Foundation (DRF) is a research and advocacy NGO based in Pakistan that focuses on how Information and Communication Technologies (ICTs) can support human rights, democratic processes and digital governance. It works towards a world where all people, and especially women, are able to safely exercise their right of expression.

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

The Foundation for Media Alternatives (FMA) is a non-profit service institution that supports citizens and communities—in particular civil society organisations and other development stakeholders—in their strategic use of Information and Communication Technologies (ICTs). It was founded in 1987 and is based in Manila.

Country of Operation

Region of Operation

Website

FMA

Fundación Karisma

Founded in 2003, Fundación Karisma is a civil society organisation dedicated to supporting and disseminating the good use of technologies in digital environments, social processes and public policies in Colombia and the region, with a human rights focus. It also undertakes legal and technological activism in coalitionwith local, regional and international partners.

Country of Operation

Colombia

Region of Operation

Website

Fundación Karisma

Hiperderecho

Hiperderecho is a non-profit Peruvian organisation dedicated to facilitating public understanding and promoting respect for rights and freedoms in digital environments. It seeks to spread the liberating capacity of technology to develop or enhance digital spaces so that all Peruvians can exercise their rights and strengthen their citizenship.

Country of Operation

Peru

Region of Operation

Website

Hiperderecho

Red en Defensa de los Derechos Digitales

The Red en Defensa de los Derechos Digitales (R3D) is a Mexican organisation dedicated to the defence of human rights in the digital environment. It uses various legal and communication tools for policy research, strategic litigation, and advocacy and campaigns, with particular attention to freedom of expression, privacy, and access to knowledge.

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC) is a Paraguayan non-governmental organisation that develops open civic technology, supported by its work in communications and alternative advocacy. It also promotes and defends digital rights in favour of a free Internet culture, with the aim of establishing a collaborative society where digital rights are exercised and respected.

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

The Institute for Policy Research and Advocacy (ELSAM) is a civil society organisation that works to enhance the democratic political order in Indonesia by empowering civil society. Founded in 1993, it actively participates in efforts to promote human rights through policy and legal research, advocacy, and training.

Country of Operation

Indonesia

Region of Operation

Influence key stakeholders

Website

ELSAM

Unwanted Witness

Founded in 2012, Unwanted Witness is a Ugandan-based civil society organisation that seeks to create secure, uncensored online platforms for human rights activists. It aims to contribute to good governance through effective online activism, networking and capacity-building. It also advocates for the strengthening of mechanisms related to freedom of expression and accountability.

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

When you buy a brand new lower cost phone (like a Tecno Y2 or MYA 2 for example), it's likely to come pre-installed with insecure apps and an outdated operating system. What this means is that your or your loved ones could be left vulnerable to security risks or to having their data exploited.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Lettre ouverte à Google

tech-admin — Tue, 07 Jan 2020 15:23:23 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

We are building a global movement

Content

Advocacy

Summary

Privacy International et plus de 50 autres organisations ont soumis une lettre au PDG d'Alphabet Inc., Sundar Pichai, demandant à Google de prendre des mesures contre les logiciels préinstallés sur les appareils Android qui exploitent les données des utilisateurs.

Media

Pi-Android-mock-up-1-1-photo.png

Key points

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Vous pouvez trouver la lettre ci-dessous. Ajoutez votre voix à cette campagne en signant notre pétition si vous pensez qu'il est temps que Google cesse d'activer l'exploitation.

Ce contenu est également disponible en anglais et en espagnol.

Cher M. Pichai,

Nous, les organisations signataires, sommes d’accord avec vous :
la vie privée n’est pas un luxe, offert seulement à ceux qui en ont les moyens.

Pourtant, les « Android Partners » – qui utilisent la marque déposée Android – fabriquent des téléphones avec des applications préinstallées qui ne peuvent pas être supprimées (connues sous le nom de bloatware). Ces applis rendent les utilisateurs très vulnérables : leurs données sont collectées, partagées et exposées sans leur consentement ou même sans qu’ils en aient conscience.

Ces téléphones portent le label « Google Play Protect » alors qu’une étude montre que 91 % des applis préinstallées ne sont pas proposées sur Google Play – Google App Store.

Ces applis préinstallées peuvent avoir certaines autorisations du fabricant qui les laissent fonctionner en-dehors du système de sécurité Android. Ces autorisations, définies par l’appli elle-même (incluant l’accès au microphone, à la caméra et à la géolocalisation), ne déclenchent aucune notification d’alerte de sécurité d’Android. Les utilisateurs n’ont absolument pas connaissance de ces intrusions majeures.

Nous sommes préoccupés par le fait que les utilisateurs de téléphones bon marché sont livrés à ces pratiques commerciales inquiétantes dans le monde.

Les changements que nous demandons en urgence sont les suivants :

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Nous, les signataires, pensons que ces changements justes et raisonnables auraient un impact considérable pour des millions de personnes dans le monde, qui ne devraient pas avoir à renoncer à leur vie privée et à leur sécurité en achetant un smartphone.

Nous vous demandons, puisque vous êtes un acteur influent du système, de mieux protéger les personnes et d’empêcher les fabricants de les utiliser abusivement, dans cette course effrénée aux bas prix des smartphones.

Je vous prie d'agréer, Monsieur, l'expression de nos sentiments distingués.

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Buying a smart phone on the cheap? Privacy might be the price you have to pay

tech-admin — Fri, 20 Sep 2019 07:00:00 +0000

Buying a smart phone on the cheap? Privacy might be the price you have to pay tech-admin Friday, September 20, 2019

Last year, a Privacy International member of staff travelled alone to the Philippines to meet with the Foundation for Media Alternatives (FMA), one of our partner organisations. As she arrived in Manila, she realised her phone was broken - a fairly big problem for someone who's on their own, 6,666 miles from home. Her first stop, straight off the plane, was the closest shop to buy a cheap phone to tell her friends and loved ones she'd landed safely. That's how she ended up with a brand new MYA 2, a smart phone by MyPhone, a Filipino brand that cost no more than 19 USD at the time.

Over the past few years, smart phones have become incredibly inexpensive. Cheap smart phones are one of the reasons more than half the world's population is now online, very slowly closing the global digital divide. While growing connectivity is undeniably positive, some device vendors have recently come under scrutiny for siphoning user data and their invasive private data collection practices.

That's why we decided to take a closer look at the MYA 2, once our colleague returned back to the UK. We were particularly interested in the phone's pre-installed apps (often called 'bloatware'), what permissions these app make use of, and how they behave. Earlier this year, the first large-scale study of pre-installed software on Android devices - from more than 200 vendors - found harmful behaviours and backdoored access to sensitive data and services without user consent or awareness.

The basics

The first thing we noticed was that the phone was running on Android 6.0, an outdated version of the operating system Android, which was released in 2015. This is curious, given that the MyPhone is a "certified Android Partner", meaning the device has been tested for security and performance, comes with Google apps pre-installed, and is Play Protect certified. Since the phone is running outdated software, users are being exposed to known security vulnerabilities, which have been patched in more up to date versions of Android.

When bloatware gets political

Beside the "usual apps" (calculator, clock, Google services…), our MYA 2 came with the following apps pre-installed:

MyPhoneRegistration - an app for registering the device with the Manufacturer
Pinoy - a Portal app, providing various services, such as news, podcasts and well-being themed content
Facebook Lite - a slimmed version of the Facebook App
Brown Portal - a portal with a browser-like interface for MyPhone users

Additionally, the phone came with a number of pre-loaded apps, that existed in the phone's filesystem, but were not installed:

Baidu_Location – Location Service for Baidu Maps
Xender – A tool for file synchronisation and transmission

As these pre-loaded apps were not active on the device, we didn't test them. These apps are likely destined for MyPhone's alternative market, China, rather than the domestic market of the Philippines.

MyPhoneRegistration app

MyPhoneRegistration is an app that allows you to register your MyPhone device with MyPhone in order to make it easier for you to do things like access warranties or get software updates and for them to send you advertisements and promotional material. The app gets permissions to make and manage phone calls, to send and view SMS messages, and to access storage.

Pre-installed applications can be installed as "privileged apps", giving them far wider access to the phone than user permissions would give them. Also, because they're privileged, they often cannot be removed by the user. Since the app is not available on the Google Store, it cannot receive updates.

MyPhone have confirmed this with the following response to this article: "For the models we have launched before, we have lost access and support to update the apps we have pre-installed, but we remain committed to provide a secure platform to our new and upcoming devices by complying to the latest Google requirements to keep the devices secure."

Based on a network analysis we have conducted using our app testing environment, we have discovered that the app tries to contact the remote server without any security protocol (SSL/TLS). This means that personal information like your IMEI number (a unique number that identifies the device), name, date of birth and gender are shared without encryption with Zed (the company hosting MyPhoneRegistration’s server). It appears that this server is no longer at the path hardcoded into the app. As a result, the phone endlessly tries to transmit the details to the missing server, as the connection always fails. It does so insecurely, giving away the user's name, gender, data of birth and IMEI to any eavesdropper on any network that the user connects to, for example Wifi.

Screenshot from mitmproxy, showing personal data being transmitted unencrypted

We also identified vulnerabilities that could allow a malicious individual with physical access to the phone to run their own code in the MyPhoneRegistration app context, allowing them to execute code with the same privileges as the MyPhoneRegistration app. When combined with other known vulnerabilities within Android 6.x, this could compromise the device remotely. As this app cannot be updated or deleted by the user, this vulnerability threatens the user permanently.

Brown Portal app

Brown Portal, which is also not available on the Google Play Store, has permission to access the phone's storage, which means it has access to your photos and files. The pre-installed app, which can't be deleted, also gets access to your network information and has location permission, which means your location can be tracked at all times.

Brown Portal is part of the Brown and Proud movement, a campaign launched by MyPhone's parent company, Solid Group Inc. The campaign was designed to create smart phones and internet of things devices for the Philippines, that celebrate Filipino identity and empower consumers to become leaders. It's unclear what happened to the campaign, but Brown Portal is still included in recent MyPhone devices, at least as of September 2018.

Pinoy app

The Pinoy app is another app by MyPhone that comes pre-installed with every MyPhone device. Similar to Brown Portal, Pinoy – a nickname referring to Filipino people – alludes to a sense of national identity. The app offers a number of paid services, such as music or access to news and entertainment (jokes, horoscopes, "guidance", "experience", "advice"…) - much of which is religious or political.

The guidance section, for instance, suggests that users subscribe to a platform called Reform Ph "focusing on reforming the Philippines through improvement of the political systems". Users can also sign up to a service that sends them a "quote to brighten up their day" or to a daily SMS service that "focuses on the beauty of life and the goodness/faithfulness of our God" for just 2.50 Filipino pesos (Php) a day. Other paid services include Bible comics and Christian music, for Php 5 three times a week.

The Pinoy app also contains free services, such as "My Faith", a section that contains downloadable audio recording of Christian prayers, and “My Country”, a section that celebrates Filipino culture with a wide range of content, including a Filipino history book, recordings of famous movie lines, Filipino quotes, riddles, games and "pick-up lines".

Pinoy gets permission to access the phone's contacts, location, SMS, storage and make phone calls. The app cannot be deleted, and also communicates with Zed servers over an insecure channel. It isn't on the Google Play Store and therefore cannot receive updates.

Facebook Lite app

Facebook Lite, an Android app designed for low speed connections and low-cost phones, also come pre-installed with the phone. To function in those conditions, the app uses less RAM and CPU power than the regular Facebook app and is most popular in India and the United States. Lite exists so that Facebook users, who are using old phones that are not supported by the regular app, can still access Facebook.

The app gets permission to access your calendar, camera, contacts, location, microphone, phone, SMS and storage. Facebook Lite is available on the Google Store and can be updated, however when uninstalled through the Play Store, it just reverts to the pre-installed version, which still cannot be uninstalled. In other words, the app cannot be removed.

Facebook Lite was in the news earlier this year, when Facebook left between 200 and 600 million account passwords exposed to its 20,000 employees. The leak, which was revealed in 2019, had been happening since 2012, and affected users who had logged in at least once using Facebook Lite.

Data exploitation by design and by default

Our case study of a single low-cost smartphone shows how data exploitation and poor security is often built into the devices that people rely on as their only means of communication.

We discovered multiple security issues with pre-installed apps that can't be updated or deleted. Since the phone is shipped with an out-dated version of Android, it comes with known vulnerabilities that will not be patched and that can be exploited cheaply by anyone, from scammers to government agencies.

More fundamentally though, our findings raise the question of whether cheap phones are at least partially subsidised by exploitative data practices. Aside from Facebook Lite, the apps we highlighted above are all tied to the manufacturer, MyPhone. Some of them offer paid services, which means there will be extra revenue for MyPhone, others like Brown Portal are there to promote MyPhone as a brand and encourage the purchase of other devices. Since these apps make use of vast permissions, they also get access to a lot of user data. The fact that some apps contain religious and patriotic content, raises questions as to the potential for political parties to exploit cheap phones in countries with limited democratic accountability.

Privacy: a human right, not a luxury

Privacy is a fundamental right guaranteed under the Universal Declaration of Human Rights, at least in theory. In reality, there are stark contrasts between regions that uphold high standards of data protection, and places where users at the mercy of what we call the data wild west. In some places, like the Philippines, there might be a legal framework in place to regulate the processing of personal data, but the accountability and enforcement mechanisms remains a challenge.

For those who live in the data wild west and can only afford cheap phones as their sole way to access the internet, we're now also seeing that privacy is becoming a luxury that few can afford. While buying a recent Apple phone will guarantee you a secure Operating System (OS) and good encryption, buying a brand new MyPhone, like we did, will leave you with an OS with vulnerabilities left unpatched for years, and apps like MyPhoneRegistration that share your personal data in plain text. Even downloading apps that offer secure communications proved extremely difficult.

What Google and manufacturers should do

It is time for this double punishment to end. Being economically vulnerable should not mean losing your fundamental rights and companies have a responsibility to protect their consumers. In particular, it is time for Android to confront its duties and obligations: MyPhone is not a random company that happens to be using the open source Android OS, it’s an official Android certified partner.

Android claims that certified partners are "Play Protect certified Android devices [that] are tested for security and performance and pre-loaded with Google apps". The device we looked at is not only insecure, but it's also pre-loaded with apps that cannot be found on the Google Play Store. This, and the fact that the phone comes with an outdated version of Android, raises questions about the criteria Google applies to certify partners.

Ultimately, pre-installed apps undermine the Android brand, especially when certified partners pre-load their phones with insecure apps that scoop up large amounts of user data. It's up to Google to make sure that manufacturers using their trademarks don't sully their brand, and don't take advantage of customers who can only afford cheap phones.

Phone companies themselves, however, should not escape responsibility. While technology needs to be accessible to all, our human rights should not be the price we have to pay for it.

Jam Jacobs of the Foundation for Media Alternatives said the following about Privacy Internationals research:

That affordable technology is facilitated by compromised individual rights is far too common a phenomenon these days. And while, as a problem, the risks it poses are not restricted to global south jurisdictions like the Philippines, these regions’ populations remain the most vulnerable both in terms of protections and available legal remedies. This report by Privacy International highlights these points and more.

As a civil society organisation advocating for human rights in the digital realm, FMA echoes the call for private companies to take their responsibility of upholding customer rights more seriously. We would add that the government should also proactively take up the cudgels on behalf of its citizens most of whom find themselves beholden to the whims of big businesses. Regulators cannot expect the private sector to get things right all on their own. That would be a sure recipe for failure, and an abandonment of their clear mandate as public servants.

Google Play Protect is prominent on the phones packaging

In the creation of this report we contacted both MyPhone and Zed, highlighting our concerns. Zed didn't reply before publication. MyPhone sent the following statement via email on 17 September 2019:

"With our goal to deliver a unique experience to our end-users, we have pre-installed our in-house apps like Brown Portal, Pinoy and Registration, which bring contents based on their interest, promoting Pinoy culture, send them our latest product updates and services. In this way, we can continue to improve our future products and services we offer.

At the same time, as we value the privacy of our user base, we have now our Privacy Policy accessible in our latest and upcoming devices that covers the collection, use, disclosure, transfer, and storage of their personal information.

We hope that you will reconsider the messaging that you want to convey on your article. We at MyPhone value the privacy of our consumers as well as you are and we are dedicated to improve our privacy controls towards acceptable standards."

Learn more

Smartphones

Our fight

Challenging Corporate Data Exploitation

Location

More about our partner

Privacy shouldn't be a luxury

Our campaign

Target Profile

Google

Device

MyPhone MYA2

Change

We uncover and expose

Content

Media

DSC_4013.jpg

Summary

Research by Privacy International shows that cheap smartphones come with a hidden cost: pre-installed apps that can't be deleted and that leak your data.

#IWD2019 Online gender-based violence: a privacy matter?

staff — Thu, 07 Mar 2019 16:33:42 +0000

#IWD2019 Online gender-based violence: a privacy matter? staff Thursday, March 7, 2019

For International Women’s Day 2019, Privacy International looks at some of the key themes around the intersection of gender rights and the right to privacy and we review the work we and our partners have done on those topics.

When dealing with cases of non-consensual sharing of intimate images, often known as ‘revenge porn,’ or doxxing, where a person’s personal details are shared publicly, the link between privacy and online-gender-based violence is very clear. Privacy violations are used to oppress women and gender diverse people. But those cases are not the only way in which privacy and gender-based violence are linked.

Gender-based online violence: No place to hide

Survivors of online gender-based violence talking about their experience tend to describe a degree of abuse that becomes impossible to escape. In a world where technology has become inseparable from the physical world and we rely on it in our everyday lives, the abuse ends up impacting every aspect of our lives. This inescapability is key to understanding how the experience of harassment and online gender-based violence is related to privacy.

The right to privacy was first addressed as such in a legal context with American lawyers Samuel Warren and Louis Brandeis defining it as “the right to be let alone.” Online gender-based is an attempt by an abuser to never let their target alone, to deny them a private space, be it online or offline, to the extent that such a distinction is even still feasible.

And with the further development and roll out of connected devices, the future of online-gender-based violence will carry new opportunities for abuse. Interviewed in Privacy International’s report on Gender and Privacy, Leonie Tanczer, lecturer at UCL’s Department of Science, Technology, Engineering and Public Policy, told us: “While now harassment can take place on platforms such as Twitter or through the interference with very distinct devices such as my tablet, in the very near future one will be able to tamper with my connected driverless car, my smart lock, or just troll me through my dozen Internet-connected devices.”

Online-gender-based violence cannot be divorced from the social context in which it happens. It is now an isolated phenomenon happening online but the reflection of patriarchal structures that allow men (in most cases) to feel entitled to harass women and gender-diverse people online.

Online harassment targeting women and LGBTIQ persons

SMEX – our partner in Lebanon – have looked at the specific context of online harassment against women and LGBTIQ individuals in Lebanon. Their report highlights the adversarial role of the authorities, which are preventing survivors – in particular LGBTIQ individual – from handling online blackmail and privacy threats in a safe and sustainable way. But most of all their interviewees believed that “that the most effective long-term solutions to online privacy threats involves changing the current societal and legal landscape and promoting an environment that is safe and inclusive both offline and online, for women and members of the LGBTIQ communities.”

Legal frameworks restricting the expression of sexuality

The Foundation for Media Alternatives (FMA) – our partner in the Philippines – noted a similar trend with a legal framework that remained gender-insensitive, sometimes “restricting full expression of one’s sexuality” despite a rise in the number of privacy violations online that target women and LGBTQIA+ individuals in the Philippines. In their report, FMA demands and change and condemns “centuries-old cultural assimilation of a patriarchal worldview, further skewed by restrictions imposed by organized religion [that] has made Filipino notions and standards of privacy inherently unfair to women and the LGBTQIA+ community.”

The need for a principle and comprehensive approach

In Chile, our partner Datos Protegidos also noted the need for a change in the legal framework in their nine recommendations (in Spanish) for a safer internet for women and the LGBTIQ+ community in Chile. In particular, they propose to change to the Chilean cybercrime law, adding new penalties for non-consensual image sharing and compensations proportional to the abuse that survivors have experienced.

Datos Protegidos also stresses the need for trainings of law enforcement to insure they are qualified to adequately handle online-gender based violence. This is an issue that Privacy International has observed across the world: civil society organisations working on the issue of online-gender-based violence all raised the issue of law enforcement’s lack of familiarity and/or capacity when it comes to responding to survivors’ complaints.

Ride sharing apps from a gender perspective

We highlighted earlier the new forms online-gender-based harassment will take, as we step into a world where the border between online and offline becomes blurry and the online/offline divide becomes irrelevant.

Our partner in Pakistan, the Digital Rights Foundation explore an aspect of this question in their report on ride-sharing apps. The report looks at the various forms of harassment consumers had experienced when using those apps and the complaint mechanisms in place. Based on surveys and interviews, the report found out complaint mechanism was the only recourse for women who feel unsafe on the apps.

The need for a gendered right to privacy

All of these cases show that with technologies transforming our experience of the world, we will need a right to privacy well suited to protect women and gender diverse people from new forms of abuses, which will keep emerging as long as the patriarchal structures that fuel gender-based violence remain unchallenged.

We want a right to privacy that will help deconstructing and smashing those structures and we are looking for your contribution to that fight, not just on women’s day, but for the years to come. Will you join us?

Learn more

Gender

Internet of Things

Our fight

Location

More about our partner

Digital Rights Foundation

SMEX

Our campaign

When Social Media makes you a target

Content

Social protection programmes

Data Privacy Week: Exposing Harms, Fighting Back

staff — Mon, 28 Jan 2019 08:04:15 +0000

Data Privacy Week: Exposing Harms, Fighting Back staff Monday, January 28, 2019

The Privacy International Network is celebrating Data Privacy Week, where we’ll be talking about how trends in surveillance and data exploitation are increasingly affecting our right to privacy. Join the conversation on Twitter using #dataprivacyweek.

It is often communities who are already the most marginalised who are at risk because of the privacy invasions of data-intensive systems. Across the globe, we see the dangers of identity systems; the harms of online violence against women and the LGBTQ+ community; and the threat of surveillance faced by activists and other communities.

But, as the Privacy International Network continues to uncover, campaign and advocate on these issues, it becomes clear that it is possible to begin to achieve change. The threats to the rights of individuals and communities are massive, and the forces against them from the public and private sectors can be immense. Yet, the efforts of civil society across the world can begin to make positive impacts on these issues.

Identity

The use of biometric technology in Peru has expanded, as revealed by Hiperderecho. Peru's National Registry of Identification and Civil Status (RENIEC) features biometric data including photographs and fingerprints. But the security of the system is at risk: in April 2018, Hiperderecho reported that the identity photographs of all Peruvians were left exposed. While the vulnerability was later fixed, it indicates how the security of these giant centralised biometric databases can put people at risk.

National ID cards continue to be promoted around the world. In the Philippines, a new ID system is coming into law, despite the concerns of several activists, including the Foundation for Media Alternatives (FMA). We also explored the issue in a podcast with two local transgender rights activists. Voter registration is another key aspect of debates on identity. An investigation by the Centre for Intellectual Property and Information Technology at Strathmore University revealed that there was a lack of sufficient controls to protect the data of voters in Kenya’s biometric voter registry. In our own research on the identity system in Chile, we highlighted challenges that migrants face in accessing healthcare, employment, and accommodation – all because they lack the Chilean ID card.

Gender

The issues surrounding privacy and gender have become an important field of study, with the online arena – while potentially providing a safe space for marginalised communities – also becoming a place for harassment and abuse. A report by SMEX revealed some of the online privacy threats that women and the LGBTQ+ community in Lebanon face, such as the non-consensual sharing of intimate images, blackmail and doxxing.

Online gender-based violence was also explored by the Chilean-based Datos Protegidos, who analysed the law and the experience of women activists and members of the LGBTQ + community online.

The importance of the impact of privacy issues upon gender has been developed in Privacy International’s own work on this topic.

Surveillance of activists

Government surveillance is often targeted at people who are campaigning for social change. A striking example is that of Operación Huracán (Operation Hurricane) in Chile, a case that, according to research by Derechos Digitales, involved alleged police interception of communications of Mapuche leaders (the major indigenous group in the country), which turned out to be an attempt to frame them as criminals.

The risks of surveillance are also deeply felt by activists in Kenya. A survey by the National Coalition of Human Rights Defenders found that increased digital-based media and online interactions have changed the perceived risks that human rights defenders face, causing them to fear surveillance and take measures to protect themselves.

Health and welfare

Healthcare, and welfare provision, are other areas where people can be placed in highly vulnerable situations. In Paraguay, as revealed by TEDIC, the social security system presents several privacy flaws. Issues surrounding the medical examination of workers, and who has access to their medical records and sensitive health data, including biometric information, creates the risk of discrimination in the workplace.

But change is possible. In a 2015 case explored by KELIN, plans were made to use biometric details as part of a study of people with HIV and key populations in Kenya. However, members of the community vocally objected to the use of biometrics in the study. They succeeded in achieving change and the biometric requirement was dropped. This case illustrates how unified coalitions, led by those most affected, can achieve change.

Learn more

LGBTIQ+

Biometrics

Communications Surveillance

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

ID, Identity and Identification

Realise Our Rights to Live with Dignity

Our fight

Location

More about our partner

Hiperderecho

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

SMEX

Derechos Digitales

Kenya Legal & Ethical Issues Network on HIV and AIDS

Our campaign

Demanding identity systems on our terms

Content

State of Privacy Philippines

tech-admin — Sat, 26 Jan 2019 15:47:46 +0000

State of Privacy Philippines tech-admin Saturday, January 26, 2019

Introduction
Right to Privacy
Communication Surveillance
Data Protection
Identification Schemes
Policies and Sectoral Initiatives

Introduction

Acknowledgement

The State of Privacy in the Philippines is the result of an ongoing collaboration by Privacy International and Foundation for Media Alternatives.

Key privacy facts

1. Constitutional privacy protection: The constitution contains an explicit protection of the right to privacy (Art. III, section 3).

2. Data protection law: The Philippines have a data protection law, the Data Privacy Act of 2012.

3. Data protection agency: The Philippines have a data protection agncy, the National Privacy Commission.

4. Recent data breach: In March 2016, the Philippines were targeted with what was dubbed at the time the biggest breach in history concerning government-held data. The personal information of over 55 million Filipino voters were leaked following a breach on the Commission on Elections' (COMELEC's) database.

5. ID regime: The Philippines is currently working on the implementation of a new ID system.

Right to Privacy

The constitution

Communications surveillance is embodied or dealt with in various laws and rules, mostly involving penal statutes or otherwise bearing upon the privacy of communication (or communication privacy) which is a distinct species of privacy recognized in Philippine jurisprudence.

The term “communications surveillance” is not (yet) defined in Philippine law. Nonetheless, it is generally regarded as an act or activity that is proscribed or restricted by law. Such a conception is derived from the express recognition of “the privacy of communication and correspondence” in the Bill of Rights or Article III of the 1987 Philippine Constitution. Under Section 3 of the Philippine Charter, communication privacy is inviolable except upon lawful order of the court, or when public safety or order, by law, requires otherwise. Evidence obtained outside of these procedures is inadmissible for any purpose.

Regional and international conventions

The Philippines government is a signatory to a number of international human rights instruments, including:

the Universal Declaration of Human Rights (UDHR);
the International Covenant on Civil and Political Rights (ICCPR);
the International Covenant on Economic, Social and Cultural Rights (ICESCR); and
the International Convention on the Elimination of All Forms of Racial Discrimination.

Communication Surveillance

Introduction

The Philippines has a total population of over 105, 500,000 people as of November 2017. The country had a national internet penetration figure of 43.5 % in 2016, according to Internet Live Stats. Overall, 45 million people are active Internet users, while 32 million are active mobile internet users. The country ranks first in terms of average number of hours (6.3) spent using the internet per day using a laptop or desktop, according to one study. When access is through a mobile device, Filipinos spend on average 3.3 hours online per day. This is still considered high considering the global median of 2.7 hours. The number of active internet users has grown by 27% over 2016.

Out of 119 million mobile phone subscriptions, 95% are prepaid and 55% have a mobile broadband subscriptions.

The top social platforms in the country are as follows:

Facebook (26%);
Facebook Messenger (23%);
Google+ (17%);
Skype (16%);
Viber (14%);
Twitter (13%);
Instagram (12%);
LinkedIn (11%);
Pinterest (9%) and
WeChat (9%)

The Philippines is the country where people spend the most time on social media (4 hours and 17 minutes).

Surveillance laws

Interception and surveillance

The protection of the privacy of correspondence is echoed in international human rights instruments like Article 12 of the Universal Declaration of Human Rights and the International Convenant on Civil and Political Rights (ratified by the Philippines in 1986), which form part of Philippine law by virtue of the doctrine of incorporation. According to Section 3, Article II of the Constitution, the Philippines “adopts the generally accepted principles of international law as part of the law of the land”. Privacy of communications would therefore fall within the ambit of the Constitution’s declaration that “the State values the dignity of every human person and guarantees full respect for human rights” (Section 11, Article II).

Communications surveillance, to the extent that it impinges on communications and its attendant rights, may also be limited by the Constitutional provision that directs the State to “provide the policy environment for… the emergence of communication structures suitable to the needs and aspirations of the nation and the balanced flow of information into, out of, and across the country, in accordance with a policy that respects the freedom of speech and of the press” (Section 10, Article XVI, Constitution).

Outside the principles and policy pronouncements in the Constitution, communications surveillance is tackled, explicitly or implicitly, in several statutes or Republic Acts (RA) (Laws enacted by the Philippine Legislature or Congress) that provide a cause of action or remedies for breaches of privacy.

Under the Civil Code of the Philippines (RA 386 (1949)), anyone who “obstructs, defeats, violates or in any manner impedes or impairs” the privacy of communication and correspondence is liable for damages (Article 32).

Elsewhere, communications surveillance may be penalized as a felony or crime. Article 290 of the Revised Penal Code (Act No. 3815 (1930)) punishes any person who seizes the papers or letters of another in order to discover his/her secrets (Art. 290). Under the Electronics Engineering Law of 2004 (RA 9292), any registered electronics engineer or technician may be punished with a fine and/or imprisonment for involvement in “illegal wire-tapping, cloning, hacking, cracking, piracy and/or other forms of unauthorized and malicious electronic eavesdropping and/or the use of any electronic devices in violation of the privacy of another or in disregard of the privilege of private communications” (Section 35).

The Anti-Wiretapping Act of 1965 (RA 4200, entitled “An Act to Prohibit and Penalize Wire Tapping and other Related Violations of the Privacy of Communication, and for other Purposes”) prohibits and penalises wire tapping done by any person to secretly overhear, intercept, or record any private communication or spoken word of another person or persons without the authorisation of all the parties to the communication. Those who knowingly possess, replay, or communicate recordings of wiretapped communications (section 1) as well as those who aid or permit wiretapping (section 2), are likewise held liable. However, RA 4200 provides an exception for instances where a law enforcement officer is authorized by a written order of the Court to perform wire-tapping “in cases involving the crimes of treason, espionage, provoking war and disloyalty in case of war, piracy, mutiny in the high seas, rebellion, conspiracy and proposal to commit rebellion, inciting to rebellion, sedition, conspiracy to commit sedition, inciting to sedition, kidnapping as defined by the Revised Penal Code, and violations of Commonwealth Act No. 616, punishing espionage and other offenses against national security,” provided that a number of stringent requirements are complied with (Section 3).

On the other hand, in other statutes, communications surveillance is sanctioned as a legitimate law enforcement activity. The Expanded Anti-Trafficking in Persons Act of 2012 (RA 9208, as amended by RA 10364) expressly mandates the Philippine National Police (PNP) and National Bureau of Investigation (NBI) to be the primary law enforcement agencies “to undertake surveillance, investigation and arrest of individuals or persons suspected to be engaged in trafficking” (Section 16(g), RA 9208, as amended by RA 10364. Emphasis added).

In October 2016, a bill to create the Expanded Anti-Wire Tapping Act of 2016 was presented at the Senate. The bill would include additional crimes for which wire-taping could be conducted and allow "law enforcement agencies and the military [...] to prevent and detect crimes by being able to intercept communications, conversations, discussions, data, information, messages in whatever form, kind or nature, spoken or written words through the use of electronic, mechanical or other equipment or device or technology now known or may hereafter be known to science." The bill is currently pending a second reading.

The Human Security Act of 2007 (RA 9372), entitled “An Act to Secure the State and Protect our People from Terrorism”, explicitly allows the surveillance of terrorism suspects and interception and recording of communications “between members of a judicially declared and outlawed terrorist organization, association, or group of persons or of any person charged with or suspected of the crime of terrorism or conspiracy to commit terrorism” upon a written order of the Court of Appeals (Sec. 7, RA 9372), even as it declares that in its implementation “the State shall uphold the basic rights and fundamental liberties of the people as enshrined in the Constitution” (Sec. 2, RA 9372). Similar to the Anti-Wire-Tapping Act, this law mandates compliance with many requirements, from applying for judicial authorization to the deposit and disposition of intercepted and recorded materials (see Sections 7-14, RA 9372). The Human Security Act also prohibits “the surveillance, interception and recording of communications between lawyers and clients, doctors and patients, journalists and their sources and confidential business correspondence”(Sec. 7, RA 9372).

The Anti-Child Pornography Act of 2009 (RA 9775) may be read as effectively facilitating communications surveillance by internet service providers (ISPs) – private entities – since this law requires ISPs, under pain of penalty, to: (1) notify the PNP or the NBI of facts and circumstances indicating that any form of child pornography is being committed using its server, (2) preserve evidence of the same for purpose of investigation and prosecution, and (3) install software to ensure that access to or transmittal of any form of child pornography will be blocked or filtered (Section 9, RA 9775). Ironically, the same provision states that “[n]othing in this section may be construed to require an ISP to engage in the monitoring of any user, subscriber or customer, or the content of any communication of any such person” (Section 9, RA 9775).

Data retention

Data retention is most clearly outlined in the Implementing Rules and Regulations of the Electronic Commerce Act (2000). The original act is intended to provide for the “recognition and use of electronic commercial and non-commercial transactions and documents, penalties for unlawful use thereof and for other purposes” Section 20 of its Implementing Rules and Regulations outlines appropriate forms of data retention and the mandate of “relevant government agencies” to impose regulations on data retention:

“ (a) The requirement in any provision of law that certain documents be retained in their original form is satisfied by retaining them in the form of an electronic data message or electronic document which:

(i) Remains accessible so as to be usable for subsequent reference;

(ii) Is retained in the format in which it was generated, sent or received, or in a format which can be demonstrated to accurately represent the electronic data message or electronic document generated, sent or received; and,

(iii) Where applicable, enables the identification of its originator and addressee, as well as the determination of the date and the time it was sent or received.

(b) The requirement referred to in paragraph (a) is satisfied by using the services of a third party, provided that the conditions set forth in subparagraphs (i), (ii) and (iii) of paragraph (a) are met.

(c) Relevant government agencies tasked with enforcing or implementing applicable laws relating to the retention of certain documents may, by appropriate issuances, impose regulations to ensure the integrity, reliability of such documents and the proper implementation of Section 13 of the Act.”

As part of its regulatory function, the National Telecommunications Commission released a memorandum (MC 04-06-2007) in June 2007 on the data log retention of telecommunications traffic. Section 1 states:

“PTEs shall retain the call data records on voice calls and similar records for non-voice traffic. on-voice traffic includes SMS, MMS and other similar telecommunications services.”

Section 2 states:

“Records indicating traffic data on the origin, destination, date, time, and duration of communications shall be retained within the following periods:

a) two (2) months for non-metered services with fixed monthly charges; b) four (4) months for other telecommunications services not covered in (a); or c) until excused by NTC for records requested in connection with pending complaints.”

A bill - entitled the Big Data Act of 2014 - proposed in June 2014 called for the "establishment of a Big Data Center where large volume of datasets used for research and development and other important purposes will be facilitated and protected." If the bill is passed, the Center would "develop a range of standards and use software and other tools for analytics on massive amounts of data being generated from the use of Internet and other technology." It would also be "responsible for disseminating the knowledge gained from its research activities to stakeholders in both the public and private sectors to strengthen policy making and industrial competitiveness." As of November 2017, the bill is still pending in the committee.

Surveillance Actors

Inteligence and Security Agencies

National Security Council

The National Security Council (NSC) is the lead government agency coordinating the formulation of policies relating to national security (Sec. 3, Chapter 2, Subtitle I, Title VIII, Book IV, Executive Order No. 292 (1987)). It was created through Executive Order No. 330 (s. 1950), and reorganized through Executive Order Nos. 115 (s. 1986), and 34 (s. 2001). Among other things, the Council advises the President on the integration of domestic, foreign, military, political, economic, social and educational policies relating to national security (Sec. 5(1), Chapter 2, Subtitle I, Title VIII, Book IV, Executive Order No. 292 (1987)). It also formulates government policies relating to national security and makes recommendations to the President regarding the same (Sec. 5(3), Chapter 2, Subtitle I, Title VIII, Book IV, Executive Order No. 292 (1987)). It has administrative supervision over the National Intelligence Coordinating Agency (NICA, discussed below), even as the latter may report directly to the President (Sec. 5, Executive Order No. 246 (s. 1987)). Apart from the NICA, the Council also provides guidance and direction to the operations of the Philippine Center on Transnational Crimes (PCTC), and coordinates, at the policy level, the fight against terrorism through the Anti-Terrorism Task Force.

Office of the National Security Adviser (ONSA)

The National Security Adviser is also referred to as the National Security Director (Sec. 8, Chapter 2, Subtitle I, Title VIII, Book IV, Executive Order No. 292 (1987)) or NSC Director General (Executive Order No. 69, s. 2002). As a member of both the NSC and the Council’s Executive Committee, the NSA advises the President on matters pertaining to national security and, when directed by the President, shall see to the implementation of decisions or policies that have a bearing on national security, as adopted by the President or the Council (Sec. 8, Chapter 2, Subtitle I, Title VIII, Book IV, Executive Order No. 292 (1987)). The NSA is also a member of the Presidential Anti-Organized Crime Commission (PAOCC), by virtue of Executive Order No. 8 (s. 1998) (Sec 5).

In 2006, through Executive Order No. 492, the ONSA was accorded the “principal authority to oversee and supervise the implementation of a program to build up, integrate and employ reconnaissance and surveillance capabilities of civilian agencies and armed services”. It was also made “principal adviser on national reconnaissance and surveillance activities” (Sec. 1, Executive Order No. 492, s. 2006). For this purpose, the NSA was tasked to carry out “measures to coordinate inter-agency requirements and supervise the acquisition of reconnaissance and surveillance equipment, including but not limited to unmanned aerial vehicles (UAVs) (Sec. 1, Executive Order No. 492, s. 2006). Accordingly, he was given the authority to coordinate the securing of funds necessary to acquire the required facilities and equipment (Sec. 1, Executive Order No. 492, s. 2006). The EO explicitly mandated the NSA to oversee the formulation of the terms of reference for the joint use of the UAVs, which shall enable the acquisition of the facilities and equipment by allocating the cost among the beneficiary agencies that will have actual use of such resources in their respective operations (Sec. 4, Executive Order No. 492, s. 2006; see also: Sec. 6, Executive Order No. 492, s. 2006).

Under the same EO, the Maritime Aerial Reconnaissance and Surveillance (MARS) Program was established (Sec. 3, Executive Order No. 492, s. 2006). The program is charged with the reconnaissance and surveillance of the country’s maritime zones and terrestrial/land areas, using “modern reconnaissance and surveillance systems” (Sec. 2, Executive Order No. 492, s. 2006). Its objective is “to enhance the national capability to gather near real-time video recording and information for decision-making needs” (Sec. 2, Executive Order No. 492, s. 2006), as well as to “provide law enforcement personnel and ground operators near real-time high accuracy, sustainable capability for reconnaissance and surveillance and dominant situational awareness to swiftly and effectively interdict when an illegal activity occurs” (Sec. 2, Executive Order No. 492, s. 2006). To facilitate the operations of the program, a National Maritime Aerial Reconnaissance and Surveillance Center (NMARSC) was established, through the efforts of the NICA (Sec. 3, Executive Order No. 492, s. 2006). As focal point for national reconnaissance and surveillance activities and operations, the NMARSC is under the supervision and control of the ONSA (Sec. 3, Executive Order No. 492, s. 2006).

In 2007, with the establishment of the National Security Clearance System for Government Personnel with Access to Classified Matters, the ONSA was charged with acting on the recommendations of the NICA as to who shall be granted security clearances (Sec. 2(b), Executive Order No. 608, s. 2007). Decisions by the ONSA in this regard may be appealed to the Office of the President (Sec. 3, Executive Order No. 608, s. 2007).

National Intelligence Coordinating Agency (NICA)

The National Intelligence Coordinating Agency (NICA) functions under the Office of the President, and is under the administrative supervision of the National Security Adviser (Executive Order No. 69, s. 2002; see also: Sec. 5, Administrative Order No. 68, s. 2003). Originally created in 1949 under then President Elpidio Quirino, its current mandate is to be “the focal point for the direction, coordination and integration of government activities involving intelligence, and the preparation of intelligence estimates of local and foreign situations for the formulation of national policies by the President" (Sec. 2, Executive Order No. 246, s. 1987).

In 2002, it was reorganized by then President Gloria Macapagal-Arroyo through Executive Order No. 69. The following year, its role and authority was further strengthened when, through Administrative Order No. 68, its Director General (DG-NICA) was assigned as principal adviser to the President on Intelligence (Sec. 1, Administrative Order No. 68, s. 2003). The DG was also tasked to establish the Directorate for Counterintelligence, which now serves as the focal point for the national government’s counterintelligence activities and operations. Three other offices were also created to further assist the NICA in its mandate:

the National Intelligence Committee, which serves as an advisory board to the DG (Sec. 2, Administrative Order No. 68, s. 2003);
the Counter-Terrorism Intelligence Center, a multi-agency body under the direct control of the DG, which provides “over-all coordination in the conduct of intelligence operations to facilitate gathering, processing, disseminating and sharing of intelligence on terrorism, especially on international terrorism”(Sec. 3, Administrative Order No. 68, s. 2003); and
Area Counter-Terrorism Intelligence Centers (Area CTICs), which are principally tasked to “capture and fuse at the operational and tactical levels the intelligence outputs, with emphasis on domestic and international terrorism, of all intelligence agencies-- civil, military and police-- in their respective areas of operations”(Sec. 3, Administrative Order No. 68, s. 2003).

The NICA may detail “liaison officers” to other government offices both inside and outside the country (Sec. 3, Administrative Order No. 68, s. 2003). In fact, as regards its foreign liaison program, it coordinates the same with other government agencies that regularly post representatives overseas (Sec. 4, Administrative Order No. 68, s. 2003). At the same time, through its DG, it is also expected to establish and strengthen liaison work between the agency and its foreign counterpart intelligence and security organizations (Sec. 4, Administrative Order No. 68, s. 2003).

In 2006, the NICA was designated as the technical operator of the Maritime Aerial Reconnaissance and Surveillance (MARS) Program (Sec. 3, Executive Order No. 492, s. 2006). This authorized the Agency to “procure UAVs or enter into lease agreements governing such vehicles” (Sec. 3, Executive Order No. 492, s. 2006).

The following year, the NICA was tasked to formulate the Implementing Rules and Regulations of Executive Order No. 608, which provided for the establishment of a national security clearance system for all government personnel with access to classified materials. Under the EO, the Agency was tasked to receive the names of personnel granted by their respective agencies Interim Security Clearances (Sec. 2(a), Executive Order No. 608, s. 2007). From the list of names, it was expected to recommend to the ONSA who among the individuals shall ultimately be given Security Clearances (Sec. 2(b), Executive Order No. 608, s. 2007). For this purpose, the Agency was authorized to conduct further background investigation on the personnel involved, on its own or by acting upon a request (Sec. 2(a), Executive Order No. 608, s. 2007).

In 2011, The DG of the NICA was made a member of the Presidential Anti-Organized Crime Commission (PAOCC), by virtue of EO No. 46 (s. 2011), which amended EO No. 799 (s. 2009) (Sec. 1).

National Intelligence Committee (NIC)

The NIC is an advisory body to the DG-NICA for the “coordination, integration and fusion of all intelligence activities relating to the preparation of the National Intelligence Estimate (NIE) and in addressing other issues of national intelligence concern” (Sec. 2, AO No. 68 (s. 2003)).

With the DG-NICA as Chair, its membership include: (1) Undersecretary for Policy, Department of Foreign Affairs; (2) Director, National Bureau of Investigation; (3) Commissioner, Bureau of Customs; (4) Commissioner, Bureau of Immigration; (5) Deputy Chief of Staff for Intelligence, J2, Armed Forces of the Philippines; (6) Director for Intelligence, Philippine National Police; and the (7) Commanding Officer, Presidential Security Group (Sec. 2, AO No. 68 (s. 2003)).

The NICA is assisted by Regional Intelligence Committees (RICs), whose mandate is to coordinate the efforts of all government intelligence units and agencies at the regional and local levels to ensure the integration and fusion of all information of national intelligence concern gathered at the aforesaid levels.

National Intelligence Board (NIB)

The NIB is another advisory body to the DG-NICA for the coordination and integration of intelligence activities in the Government (Sec. 6, EO No. 246 (s. 1987); see also: Sec. 5, AO 217 (s. 1991)). Its members are appointed by the President, although the National Security Director/Adviser may sit in all meetings of the Board (Sec. 6, EO No. 246 (s. 1987); see also: Sec. 5, AO 217 (s. 1991)). Through Administrative Order No. 217 (s. 1991), the membership of the NIB was expanded to include twelve (12) civilian agencies and seven (7) military offices (Sec.1).

As in the case of the NIC, the DG-NICA is also the Chairperson of the NIB (Sec. 3, AO 217 (s. 1991)). The presence of the National Security Adviser/Director in all meetings of the Board is mandatory Sec. 4, AO 217 (s. 1991)).

In relation to the NIC, the Board shall utilize the NIC as its principal arm for purposes of “providing direction and control of intelligence operations and activities of NIB members, departments, agencies, and offices (Sec. 5, AO 217 (s. 1991)).

Intelligence Service, Armed Forces of the Philippines (ISAFP)

The ISAFP is one of the AFP-Wide Support and Separate Units (AFP-WSSU).

A “New Agency”

In April 2014, some reports revealed a purported plan by the government to create a new intelligence agency akin to that of the U.S. Defense Intelligence Agency. This new spy institution will supposedly incorporate the ISAFP, effectively making the unit an integral part of the defense department. It will engage in the “gathering and analysis of security-related foreign, domestic, political and economic, industrial, geographic, military and civilian intelligence data.” Sources privy to the matter have recently indicated that this plan has been scuttled because of fundamental differences between the merging institutions.

Law Enforcement

Directorate for Intelligence (Directorial Staff), Philippine National Police

Little is known about this Directorate.

Police Intelligence Group (Operational Support Unit) Philippine National Police

The Police Intelligence Unit is one of several operational support units of the PNP (Sec. 2, AO No. 68 (s. 2003); Sec. 35, Republic Act No. 697). Headed by a Director with a rank of chief superintendent, the PIU serves as the intelligence and counterintelligence operating unit of the PNP (Sec. 35(b)(2), Republic Act No. 6975). According to at least two news reports, this unit (specifically, its counter-intelligence component) is also charged with providing physical security to police camps, as well as official documents of the PNP; it also monitors the illegal activities of certain police officers.

Philippine National Police

The Anti-Cybercrime Group (ACG) was activated in March 2013, pursuant to Section 10 of the Cybercrime Prevention Act, which provides that the PNP, along with the National Bureau of Investigation (NBI), shall “organize a cybercrime unit or center manned by special investigators to exclusively handle cases involving violations” of the law. Today, it serves as the primary police unit responsible for the implementation of pertinent laws on cybercrimes and anti-cybercrime campaigns of the PNP and the national government. The Group focuses on cybercrime offenses, computer-related offenses, and other content-related offenses such as cybersex, child pornography, unsolicited commercial communication, and other related offenses.

Office of the Deputy Director for Intelligence Services, National Bureau of Investigation

The Intelligence Services units falling under this Office include: (1) Counter Intelligence Division (CID); (2) Criminal Investigation Division (CRID); and the Technical Intelligence Division (TID).

Cyber Crime Division (CCD), National Bureau of Investigation

The CCD falls under the Office of the Deputy Director for Investigation Services. Presumably, the establishment of this division was also brought about by the need to comply with Sec. 10 of the Cybercrime Prevention Act.

Surveillance capabilities

IMSI Catchers

In April 2014, The Tribune reported that the Philippine government Department of National Defense (DND) had acquired a 135 million peso (US$ 3.4 million) surveillance equipment surfaced. Supposedly covered by a 26 October 2011 purchase request, the device was described as a “Radio Frequency Test Equipment” (RFTE) provided by Rohde & Schwarz (R&S), an electronic surveillance company based in Germany. Rohde & Schwarz specializes in military and dual-use equipment, including spectrum analysers and encrupted communications systems.

According to media reports, the equipment would have the capability to hone in on and intercept calls and text messages sent within a 500-metre radius of the device. The revelation prompted concerns by opposition groups that the government would use the technology to spy on them. The government denied these claims.

According to documents obtained by Privacy International, a UK-based company sought two export licenses for “telecommunications interception equipment”, most likely for IMSI catchers, to the Philippines in 2015. An IMSI Catcher is a phone monitoring kit that provides active intercept capabilities. Traditionally, IMSI Catchers (or Stingrays as they are known in the US) can capture a number of different pieces of identifiable information including the IMEI and the IMSI: identifiers for your phone and SIM card respectively. IMSI Catchers can also record voice and message data as they travel through mobile networks.

In February 2018, it was revealed that the UK had sold £150,000 worth of spying equipment, including IMSI catchers in 2016.

Intrusion Malware

The Philippines government reportedly sought to acquire an intrusion malware tool, the Remote Control System, from Italian surveillance company Hacking Team. RCS is used to monitor a particular device through the direct installation of a malicious program on a target's device, usually by way of fallacious updates, fake websites, or false documents that a target is encouraged to download, inadvertently allowing the RCS tool to infect his or her device.

Documents leaked from Hacking Team in 2015 revealed a significant amount of interest from several parties purporting to represent different agencies of the Philippine government.

On 13 March 2011, an individual claiming to belong to the National Bureau of Investigation’s (NBI) Cyber Center, working under of the Office of the Director, reached out to the company seeking a proposed solution to a potential “cyber attack offensive”, similar to what was then a common occurrence in Australia. Hacking Team responded to this request by outlining the salient features of the RCS.

FMA reported that in January 2013, an individual named “Gadburt Mercado” began communicating with Daniel Maglietta, Chief of HT’s Singapore Representative Office, to set up a product demonstration meeting between HT executives and Mr. Mercado’s supposed principal, Col. Manuel Lucban, Chief of Police of Makati City. Spanning a period of more than a year, the email thread suggests that no actual meeting took place during such time due to the conflicting schedules of the parties.

In March 2015, a person claiming to be an officer of the Intelligence Services of the Armed Forces of the Philippines (ISAFP) relayed his unit’s interest in the capabilities of HT’s Galileo Remote Control System. He requested additional information from the company, as well as a product demonstration.

US government surveillance

The US government conducts extensive surveillance activities in and around the Philippines that it justifies in part in relation to its activities against Islamist militant groups in the “war on terror”. These include joint military exercises with the Philippine military. A downed US military surveillance drone was discovered in the Philippines' restive Quezon province in early 2015, according to the Philippines Daily Inquirer. The embassy responded that the drone was an “expended” aerial target launched during military exercises,during September 2014 off the coast of Guam.

The US has also been conducting large-scale interception of communications in and out of the Philippines. Documents released by Edward Snowden in May 2014 show that the US National Security Agency (NSA) had "access via DSD asset in a Philippine provider site. Collects Philippine GSM, short message service (SMS) and Call Detail Records.” This, the NSA predicted “[w]ill soon become a source of lucrative intelligence for terrorist activities in Southern Philippines.” The 2013 project codenamed MYSTIC, involved the interception of large amounts of the communications of five countries, including the Philippines, from undersea cables.

Surveillance oversight, checks and balances

In addition to the safeguards apparently built in the abovementioned laws, there are other laws and rules that can serve to counter or check the conduct of communications surveillance permitted by the foregoing.

The Rule on the Writ of Habeas Data (A.M. No. 08-1-16-SC) issued by the Supreme Court in 2008 provides the writ as a remedy available to persons whose right to privacy in life, liberty, or security is violated or threatened by an unlawful act or omission of a public official or employee, or of a private individual or entity engaged in the gathering, collecting, or storage of data or information regarding his person, family, home, and/or correspondence (Sec. 1, A. M. No. 08-1-16-SC). The writ of habeas data basically enables people to find out what information is being collated about them by law enforcement agencies as well as by private entities, and the use and purpose of collecting it. The petitioner may then seek such reliefs as the updating, rectification, suppression, or destruction of the database or information or files kept by the erring party, or, in the case of threats, an order enjoining the act that is the subject of the complaint (Sec. 6, Sec. 1, A. M. No. 08-1-16-SC).

Examples of surveillance

The most controversial case of communications surveillance in the Philippines to date is the “Hello Garci” scandal which involved former President Gloria-Macapagal Arroyo and one election commissioner. The wiretapped conversation concerned an electoral fraud in favor of Arroyo which was purportedly committed during the 2004 Presidential Elections.

The source of the copy of the wiretapped conversation never became clear. Several personalities, both from the administration and the opposition, presented their own copy of the record but no one claimed actual ownership. An agent of the Intelligence Service of the Armed Forces of the Philippines (ISAFP) admitted his involvement in the surveillance operation dubbed “Project Lighthouse” and pointed the Military Intelligence Group 21 of the AFP as the unit that carried out the activity. An employee of a local telecommunications company was also implicated in the wiretapping. However, the company denied its knowledge of the operation.

Another former President became subject to at least two surveillance-related incidents. In 1986, during her visit to the U.S., Corazon Aquino’s conversation with two Cabinet members regarding the impact of the new constitution was recorded. The conversation reflected the concerns of the administration regarding the impact of the ban of nuclear weapons on the existence of U.S. military bases in the country. The transcript of the recording was leaked by the opposition days before the ratification of the new constitution.

The second incident was in 2007 wherein a surveillance equipment was found near her private residence. The police and again, the ISAFP and another telco employee were implicated in the illegal activity, but they denied their involvement. No clear reason was given for the intercept.

Another confirmed wiretapping incident occurred in 2008, when the phone conversation between two witnesses to a graft-laden, albeit botched, government project with China was captured on record. While no one admitted to carrying out the surveillance operation, a copy of the recording wound up in the hands of the chairman of the elections commission, who was then being implicated in the controversial project. The witnesses accused the official of attempting to dissuade them from testifying by threatening to make public their private conversation. As they went ahead with their exposé, the recording ended up being posted online in YouTube.

Guillermo Luz, a prominent business executive and a known critic of the administration, filed petitions for the writs of Habeas Data and Amparo with the Supreme Court in order to stop the government from conducting state-sponsored military surveillance he believed he was then subject to. His cases were granted but brought to the appellate court for hearing. The case closed after the AFP declared that he was not under any surveillance or case-building activity.

Other reported cases of wiretapping were false alarms. In one case, a legislator was accused of having violated the law after recording an executive session of a Congressional committee. In another, a government executive filed charges against a well-known Filipino journalist for allegedly recording their phone conversation without her consent. Both incidents were eventually resolved, with no case being filed against the legislator, while that filed against the journalist was later dropped, after prior consent of the complainant was properly established.

Data Protection

Data protection laws

The Data Privacy Act of 2012 (RA 10173) (“DPA”) is another potential source of legal remedies against communications surveillance. It is not primarily concerned with communication privacy, let alone, communication surveillance, dealing, as it does, with data privacy which is a distinct category of privacy. However, the law includes in its scope privileged information, a term it defines as “any and all forms of data which under the Rules of Court and other pertinent laws constitute privileged communication"(Sec. 3(k), Republic Act No. 10173. Emphasis supplied). As a result, any Philippine legal regime purporting to govern communication privacy (and communication surveillance, by extension) must include the DPA as a component.

The DPA establishes the general rule that the processing of privileged information (i.e., privileged communication) is a prohibited activity (Processing is defined as referring to “any operation/set of operations performed upon personal information including, but not limited to, the collection, recording, organization, storage, updating, or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data” (Sec. 3 (j), RA 10173). It does, however, provide certain exceptions (Sec. 13, Republic Act No. 10173):

when all the parties to the exchange have given their consent prior to the processing;
when the processing is authorized by existing laws and regulation, provided that:
1. the authorizing law/regulation guarantees the protection of the privileged information, and
2. the authorizing law/regulation itself does not require the consent of the parties to the exchange
when the processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations, provided that all of the following conditions are present:
1. the processing is limited to the members of the public organization/association involved;
2. the sensitive personal information is not transferred to third parties; and
3. the consent of the data subject is secured
when the processing is necessary for purposes of medical treatment, which is carried out by a medical practitioner or a medical treatment institution, and the processing ensures an adequate level of protection
when the processing concerns sensitive personal information which is necessary for (a) the protection of lawful rights and interests of natural and legal persons in court proceedings, or (b) the establishment, exercise or defense of legal claims
when the sensitive personal information is to be provided to the government or a public authority

Notwithstanding these exceptions, the law does grant personal information controllers the ability to invoke the “principle of privileged communication” over the privileged information that they have in their lawful control or possession. Presumably, this would render the privileged information inadmissible as evidence in any court or legal proceeding wherein they may be presented (Sec. 15, Republic Act No. 10173).

It is also important to note that the DPA expressly amends Section 7 of the Human Security Act which authorizes the surveillance of terrorism suspects (discussed above) (SEC. 44. Repealing Clause. – The provision of Section 7 of Republic Act No. 9372, otherwise known as the “Human Security Act of 2007", is hereby amended. Except as otherwise expressly provided in this Act, all other laws, decrees, executive orders, proclamations and administrative regulations or parts thereof inconsistent herewith are hereby repealed or modified accordingly).

In August 2016, the National Privacy Commission (NPC) published the Implementing Rules and Regulations of the DPA, after several months of public consultation, involving the Foundation for Media Alternatives. The Rules aim to “enforce the Data Privacy Act and adopt generally accepted international principles and standards for personal data protection.” The Rules are written for both private companies handling personal data but also for the state.

In October 2017, the NPC published its first two memorandum circulars. The first one was on the Security of Personal Data in Government. It defines the duties and responsibilities of government bodies that process personal data. Among those responsibilities is the designation of a Data Protection Officer in charge of conducting Privacy Impact Assessment.

The second circular is on Data Sharing Agreements Involving Government Agencies. It defines data-sharing safeguard that personal information controllers will have to implement for data to be transfer among government bodies.

Examples of data breaches

In March 2016, the Philippines fell prey to what has been dubbed as the biggest breach in history concerning government-held data when the personal information of over 55 million registered Filipino voters were leaked following a breach on the Commission on Elections' (COMELEC's) database. This incident shed light on and directed attention to the extent of personal information being collected and held by government authorities, as well as their capabilities (or the lack thereof) in securing such information. It caused a stir in both local and global news and has developed into the first case for the NPC.

In September 2016, the NPC concluded that:

There was a security breach that provided access to the COMELEC database that contained both personal and sensitive information, and other information that may be used to enable identity fraud. The personal data included in the compromised database contained passport information, tax identification numbers, names of firearm owners and information about their firearms, e-mail addresses, among others; and
In addition to the defacement of the COMELEC website on the evening of 27 March 2016, it is reasonably established that access to the database containing personal data occurred in the week before the defacement, from around eight different networks, over four to five days.

A preliminary report identifies two indicators of negligence on behalf of COMELEC:

The lack of a clear data governance policy, particularly in collecting and further processing of personal data, unnecessarily exposed personal and sensitive information of millions of Filipinos to unlawful access; and
The vulnerabilities in the website, and failure to monitor regularly for security breaches allowed unlawful access to the COMELEC website.

Accountability Mecanism

i. Freedom of Information

There is currently no FOI law in the Philippines. A consolidated bill was approved by the public information panel and is now with the Committee on Appropriations. It is pending a second reading but has not been included in the Common Legislative Agenda for the 17th Congress.

However, following his election president Duterte signed an Executive Order on FOI. Executive Orders mean FOI requests can only pertain to the work of the executives, and can be ended at any point. The Order contained 11 pages of exceptions.

Identification Schemes

ID cards and databases

The Philippines currently has no national ID card system. However, the National ID bill (House Bill 6221) was approved on third reading by the House of Representatives in September 2017. In October 2018 the Philippine Statistics Authority finalised the implementing rules and regulations for the national ID.

Voter registration

Pursuant to Republic Act No. 10367, voters are required to have their biometrics data (i.e., fingerprints, photograph, and digital signature) captured by the COMELEC before they are allowed to vote. The law considers the absence of biometrics in a voter’s registration record as a ground for the deactivation of an individual as a registered voter. To register to vote, a person has to first establish his or her identity by presenting a valid ID, which may be any of the following:

Employee’s identification card, with the signature of the employer or an authorized representative;
Postal ID;
Person with Disability (PWD) Discount ID;
Student’s ID or library card, signed by the school authority;
Senior Citizen’s ID;
Driver’s license;
NBI clearance;
Passport;
SSS/GSIS ID;
Integrated Bar of the Philippines (IBP) ID;
License issued by the Professional Regulatory Commission (PRC);
Certificate of Confirmation issued by the National Commission on Indigenous Peoples (NCIP) in case of members of ICCs or IPs; or
Any other valid ID.

Absent these, an applicant may be identified under oath by any registered voter of the precinct where he/she intends to be registered, or by any of his/her relatives within the fourth civil degree of consanguinity or affinity. A registered voter shall only be allowed to identify up to three applicants.

SIM card registration

There is currently a total of 12 bills in the House of Representatives (including House Bill No 5231) and seven bills in the Senate (including Senate Bill No 105) on SIM card registration. The technical Working Group at the House of Rep has consolidated those bills. As of November 2017, the draft has not been publicly released.

Policies and Sectoral Initiatives

Cybersecurity policy

We are not aware of any specific cybersecurity policy in the Philippines. Please send any tips or information to: research@privacyinternational.org

Cybercrime

Section 12 of the Cybercrime Prevention Act of 2012 (RA 10175) originally authorized law enforcers, “with due cause… to collect or record by technical or electronic means traffic data in real-time associated with specified communications transmitted by means of a computer system,"until this provision, among others, was declared void for being unconstitutional by the Philippine Supreme Court in 2014 (see: Disini, et al. v. Secretary of Justice, et al., G.R. No. 203335 (11 February 2014)).

This Decision ruled upon 15 consolidated petitions seeking to declare several provisions of RA 10175 unconstitutional and void. The Court said that “[t]he authority that Section 12 gives law enforcement agencies is too sweeping and lacks restraint”.) Despite the nullification, however, this law still allows the interception (Interception refers to listening to, recording, monitoring or surveillance of the content of communications, including procuring of the content of data, either directly, through access and use of a computer system or indirectly, through the use of electronic eavesdropping or tapping devices, at the same time that the communication is occurring (Sec. 3(m), RA 10175) of communications and the disclosure (Sec. 14, RA 10175) and preservation (Sec. 13, RA 10175) of computer data (defined in Sec. 3(e), RA 10175.), provided certain requirements are complied with.

Under this law, the disclosure of computer data, that is, an order by law enforcement authorities requiring a person or service provider (defined in Sec. 3(n), RA 10175) to disclose or submit subscriber’s information (defined in Sec. 3(o), RA 10175), traffic data (defined in Sec. 3(p), RA 10175) or other data in his/its possession or control must be: (1) based on a court warrant secured for this purpose; (2) in relation to a valid complaint officially docketed and assigned for investigation; and (3) necessary and relevant for the purpose of investigation (Sec. 14, RA 10175). It must be pointed out, however, that there appears to be no provision for the requirements for the issuance of a court warrant. Requirements for the issuance of a court warrant could originally be found in the last paragraph of Section 12 which was nullified by the Supreme Court in the Disini case.

On the other hand, RA 10175 requires the preservation of data (i.e. traffic data and subscriber information) for a minimum period of six months from the date of the transaction (Sec. 13, RA 10175). Similarly, content data—not specifically defined by the law—shall be preserved for six months from the receipt of an order from law enforcement authorities requiring its preservation (Sec. 13, RA 10175). The law also allows law enforcement authorities to order a one-time extension for another six months, except that once computer data stored by a service provider are used as evidence in a case, the mere furnishing to such service provider of the transmittal document to the Office of the Prosecutor shall be deemed a notification to preserve the computer data until the termination of the case (Sec. 13, RA 10175). Furthermore, the service provider ordered to preserve computer data is directed to keep the order and its compliance confidential (Sec. 13, RA 10175). Again, as in the case of a court warrant, the law does not appear to state any prerequisites for the issuance of the aforementioned orders by law enforcement authorities.

Licensing of industry

Regulatory Bodies

The National Telecommunications Commission is the local telecommunications industry’s regulatory body. Its legal mandate consists of the following:

Regulation of the installation, operation and maintenance of radio stations both for private and public use;
Regulation and supervision of the provision of public telecommunications services;
Management of the radio spectrum; and
Regulation and supervision of radio and television broadcast stations, cable televisions and pay television.

In pursuit of such objectives, it performs the following functions:

Granting certificates of Public convenience and Necessity/Provisional Authority to install, operate and maintain telecommunications, broadcast and CATV services;
Granting licenses to install, operate and maintain radio stations;
Allocating/sub-allocating and assigning the use of radio frequencies;
Type-approving/type-accepting all radio communications, broadcast and customer premises equipment;
Conducting radio communications examination and issue radio operators certificate;
Preparing, planning and conducting studies for policy and regulatory purposes;
Monitoring the operation of all telecommunications and broadcast activities;
Enforcing applicable domestic and international laws, rules and regulations, prosecuting violations thereof, and imposing appropriate penalties/sanctions;
Issuing licenses to operate land, maritime, aeronautical and safety devices; and
Performing such other telecommunications/broadcast-related activities as may be necessary in the interest of public service.

Communications Service Providers

Only two companies control the telecommunications industry in the Philippines, Globe Telecoms (Globe) and Smart/Philippine Long Distance Telephone (PLDT).

Globe is the nation's predominant phone service provider with 65.5 million subscribers of a total population of approximately 100 million, as reported in October 2015. Smart, an operator fully owned by PLDT, has approximately 54.5 million subscribers.

E-governance/digital agenda

In 2012, the Data Privacy Act was signed into law, thereby putting into place several data protection standards. The Act applies to “personal information” One of the exemptions cited in the law pertains to “information necessary in order to carry out the functions of public authority which includes the processing of personal data for the performance by the independent, central monetary authority and law enforcement and regulatory agencies of their constitutionally and statutorily mandated functions.”

Nevertheless, the law also contains several provisions that explicitly concern government agencies. For example, it provides the following functions to the Commission: “(d) Compel or petition any entity, government agency or instrumentality to abide by its orders or take action on a matter affecting data privacy; (e) Monitor the compliance of other government agencies or instrumentalities on their security and technical measures and recommend the necessary action in order to meet minimum standards for protection of personal information pursuant to this Act; (f) Coordinate with other government agencies […] on efforts to formulate and implement plans and policies to strengthen the protection of personal information in the country;” The law also contains an entire chapter dedicated to Security of Sensitive Personal Information in Government.

Health sector and e-health

In January 2016, the Department of Health, Department of Science and Technology, and Philippine Health Insurance Corporation signed Joint Administrative Order No. 2016-0002, or the Privacy Guidelines for the Implementation of the Philippine Health Information Exchange (PHIE). The PHIE allows participating health care providers to share health information and harmonizes health data from various electronic medical record (EMR) and hospital information systems. Given that the data collected and processed in the PHIE is both personal and sensitive information, the Privacy Guidelines complement the Data Privacy Act of 2012 and other specific legislation on health privacy in ensuring that the implementation of the PHIE is in line with data protection and privacy principles.

Smart policing

There has been no news regarding the use (or planned use) of predictive policing in the Philippines. Nevertheless, the Philippine National Police currently uses an automated fingerprint identification system (AFIS), which includes the use of a central comprehensive database for criminal identification. The AFIS enables the police to compare fingerprints recovered in a crime scene against those stored in an existing database of both identified and unidentified prints. As of June 2015, the PNP crime laboratory’s database already contained more than 761,000 records.

If you know more about smart policing in the Philippines, please send any tips or information to: research@privacyinternational.org

Transport

Since 2015, the Philippines is now among the few Asian countries that use a smart transportation card. Although less widespread than its contemporaries, the beep™ card is gradually becoming a central and necessary transportation device in Metro Manila. The system first went live for LRT2 in May 2015, shortly followed by MRT3 and LRT1. At present, beep™ cards may also be used in the HM Transport Airport Loop buses and in BGC Buses. Like with many other “smart cards” such as Oyster cards in the UK , the extent of personal information collected, held, and used by these systems makes for a crucial privacy issue. As of this writing, however, beep™ card registration is not yet available, and users are not required to register their cards or submit personal information to be able to avail of the system. An exemption is in case of the issuance of a Concessionary beep™ card, for which some personal data may be required. The card’s Privacy Policy does not provide a comprehensive list of such data.

According to the beep™ website, the personal data of users may be used to comply with legal requirements, processes, and obligations, or to prevent imminent harm to public security, safety, or order. Their Privacy Policy also states that the “[p]rocessing of beep™ holder’s personal data may be outsourced to third parties, such as but not limited to, the Transport Establishments, vendors, service providers, partners or other agents, to fulfill any of the above purposes. They may have access to beep™ holder’s personal data for a limited time under reasonable contractual and technical safeguards to limit their use of such information.”

Smart cities

Most smart city initiatives in the Philippines have been implemented by the private sector, sometimes in cooperation with local government units. For instance, the Davao City government tapped IBM Philippines to provide an Intelligent Operations Center platform, which became operational in 2015. The platform “allows the authorized government bodies (including multiple local government agencies such as police, fire, and anti-terrorism task force) to use analytics software and monitor events and operations in real-time.” At the capital, the Metro Manila Development Authority (MMDA) collects and processes traffic data through its Traffic Signalization System (TSS). The TSS uses a monitoring network that initially involved 150 CCTVs in 25 video surveillance locations in Metro Manila. The MMDA also has a mobile application that lets users view real-time traffic information in major roads. A quick look at the app’s download page shows that it requires access to the user’s location.

Migration

High-security passports

The Presidential Communications Operations Office (PCOO) has announced that starting 15 August 2016, the Philippines started issuing new “high-security passports” through an expedited process. PCO Secretary Martin Andanar said that the new passport will include security features and qualities that would prevent incidents of fraud. One such feature is a microchip that contains personal data of the passport holder. There have been no reports, however, as to what types of personal data will be stored in the microchip.

Biometric data

In 2015, FMA reported that the Philippines government was considering adopting PISCES, a US-government developed biometric identification technology at its border points (including the Ninoy Aquino International Airport), as indicated in certain classified documents acquired by privacy activists. PISCES is the acronym for "Personal Identification Secure Comparison and Evaluation System," a customizable software application that provides border control officials with information that allows them to identify and detain or track individuals of interest. The system can be used to quickly retrieve information on persons entering or leaving a particular country.

The US introduced the software in 1997 through its Terrorist Interdiction Program (TIP) “a highly effective, low-cost proven tool in the global fight against terrorism.... [which] ...provides participant countries with the ability to collect, compare and analyze traveler data to assist the country in securing its borders and, if necessary, detain individuals of interest."

In 2004, a local paper quoted a Bureau of Immigration officer stationed at the NAIA making a remark about an impending upgrade of the PISCES program they were then using in the facility. Thus, it is likely that the 2015 document represents either an upgrade of an existing program, or a reintroduction of the program (if its use was discontinued at some point in the past).

Emergency response

On 1 August 2016, 911 was launched as the Philippines’ national emergency hotline. The Department of Interior and Local Government (DILG) said that calling the hotline will connect the caller to emergency, rescue, police, or fire services. The two telecommunications giants in the country have also expressed their support for the initiative.

As of this writing, there has been no information as to how the response center processes and protects the data collected from these calls. Meanwhile, a DILG official has stated plans to include in the emergency response system CCTV that will monitor public places.

Humanitarian and development programmes

One of the more prominent uses of biometric technology in the Philippines is in the welfare services, particularly in the government's Pantawid Pamilyang Pilipino Program. The Department of Social Welfare and Development (DSWD) first launched a biometric payout system for the Program in 2012.

Social media

In 2015, FMA reported capacities that the Philippines government was considering adopting Signal, a software used for large-scale social media analysis, as part of its emergency management and policing.

Initially developed by the New Zealand Police as part of its security measures during the Rugby World Cup hosted by the country in 2011, the application later underwent significant enhancements, owing to the Police’s subsequent partnership with Intergen and Microsoft. Among others, all information gathered by the application are now funneled into a single platform known as Real-Time Intelligence for Operational Deployment (RIOD). This platform is based on Microsoft SharePoint and allows for improved collaboration, process optimization and information discovery. Meanwhile, the Microsoft Azure cloud platform is used to secure real-time intelligence and provide situational awareness on specific incidents.

List Icon (DO NOT USE)

List Image (DO NOT USE)

Location

Related learning resources

State of Privacy

More about our partner

Content

8 March: Meet Maritza from Venezuela
9 March: Meet Jen from the United Kingdom
10 March: Meet Mercy from Kenya
11 March: Meet Naomi from the Philippines
12 March: Meet Carolina from Chile
13 March: Meet Camille from France
14 March: Meet Catalina from Colombia

Change

We uncover and expose

Summary

A study of privacy and surveillance issues in Philippines. The State of Privacy project was last updated on January 2019, unless otherwise provided on specific pages.

International Women's Day 2018 - A Day in the Life of Women, As Told by Their Data

melissab — Tue, 13 Mar 2018 15:53:24 +0000

International Women's Day 2018 - A Day in the Life of Women, As Told by Their Data melissab Tuesday, March 13, 2018

To mark International Women’s Day 2018, Privacy International and some of our partner organisations - Datos Protegidos, Derechos Digitales, the National Coalition for Human Rights Defenders-Kenya, the Karisma Foundation, and the Foundation for Media Alternatives – are telling the stories of women across the world as told by their data over the next seven days (for us, it’s International Women’s Week!).

Gender inequality has many complex dimensions and data exploitation is yet another. While all of us live in a world where data is constantly generated, collected and analysed to draw assumptions about us, there is a uniqueness to the female experience of data exploitation. Gender is almost always one of the first data points to build the profile of an individual, often with a binary choice “male/female.”

Being ‘female’ becomes a tag assigned to us by companies we interact with but also data brokers and advertisers. The reality of this imposed female identity is an environment that reinforces the patriarchal inequalities women have always been confronted with: they are for instance expected to pay more for products targeted at them, they are less likely to see qualified jobs advertised and they see their bodies becoming once again objectified to derive profit from.

Indeed, from menstruation apps to connected sex toys, many companies try to jump on the bandwagon of women liberation while in fact perpetuating an ever-present model: the commoditisation of female bodies.

To illustrate this new reality we have chosen to tell the stories of women in seven different countries: Chile, Colombia, France, Kenya, the Philippines, the UK and Venezuela. Six of those women are fictional but in the Philippines, the Foundation for Media Alternatives has chosen to tell us the story of a real woman, Naomi Fontanos, a trans activist and feminist living in Manila. We follow these women for a day and watch how the generation, collection and analysis of their data are affecting them.

The case studies we have chosen do not reflect the experience and diversity of all women but we hope it will be the starting point for a reflection on the particular dangers that data exploitation, inadequate or non-existent data protection legislation and vulnerable devices have on the lives of women.

If reading those stories have left you wanting to do more, join us and sign up to our mailing list, you can also check out our educational content or consider making a donation.

Learn more

Data Intensive Systems

Gender

What PI is fighting for

Expose Data Exploitation: Data, Profiling, and Decision Making

Expose Invisible Data Placed Beyond Our Control

Realise Our Rights to Live with Dignity

Our fight

Location

More about our partner

Derechos Digitales

Fundación Karisma

Content

Expose Data Exploitation: Data, Profiling, and Decision Making

A day in the life of Naomi Fontanos, a trans woman living in Manila

melissab — Wed, 07 Mar 2018 17:38:28 +0000

Language English

Written by the Foundation for Media Alternatives

7:01: Naomi wakes up and gets ready for the day.

7:58: Naomi books an Uber ride to Bonifacio Global City (BGC), where she has a meeting. She pays with her credit card. While Naomi is waiting for her Uber, she googles restaurant options for her dinner meeting in Ortigas.

9:00: While her Uber ride is stuck in traffic on EDSA (a limited access highway circling Manilla), Naomi’s phone automatically connects to the free WiFi offered by the Department of Information and Communications Technology (DICT) under their project Pipol Konek: Free Wi-Fi Internet Access in Public Places. The free Instant Access is very slow, and when Naomi tries to connect to the slightly faster Registered Access, the system requires her to create an account using the following information:

Email Address
First Name
Middle Name
Last Name
ID Number and Type of Government-Issued ID
Password

Naomi opts for Instant Access instead.

9:10: Taking advantage of being at a standstill in EDSA traffic, Naomi uses the free WiFi access to check Facebook and Twitter, where she notices a sudden slew of advertisements for properties in the Ortigas area.

10:05: Naomi finally arrives at BGC. From the moment she gets out of her Uber, her every move is captured by the many CCTV cameras in the area. BGC is reported to be the first Huawei Safe City in the Philippines. This means that the BGC area is equipped with “IP-based cameras with Wi-Fi backhaul installed across major grids of the city and connected to a command center, complete with video analytics” technology, provided by China-based tech firm Huawei.

11:54: After the meeting, Naomi gets lunch at one of the restaurants on Bonifacio High Street, which she pays for with PayMaya, a cashless mobile payment system that is a subsidiary of Voyager Innovations, which, in turn, is the digital innovations company of Smart-PLDT, one of the two major telcos in the Philippines. While at the restaurant Naomi’s phone automatically connects to GoWIFI, a “free” public WiFi provided by Globe, the other major telco, at Ayala malls all over the country. However, to be able to use the free access, Naomi has to submit her mobile number.

12.55: Failing to book any Uber or Grab ride, Naomi boards the BGC bus to Ayala and the MRT from Ayala to Ortigas, using her Beep card for both.

13.58: Naomi arrives in Ortigas, where she is interviewed by an online news platform on the state of LGBTIQ rights in the Duterte regime. During the interview, Naomi shares her work as a feminist and trans activist. The interview is streamed live in the new platform’s various digital channels and it is also live-tweeted.

15.50: After the interview, Naomi hangs out at the nearby Starbucks and uses her Rewards card. While having coffee, she checks her social media and finds a handful of notifications on Twitter. Because her Twitter account was mentioned during the interview, she finds a lot of tweets calling her “yellowtard” or attacking her because of her comments on the Duterte administration.

18:06 pm: Naomi settles into a dinner meeting. Her phone is stashed away in her purse, with tweets from radical Duterte supporters, Facebook advertisements for condo units in Ortigas, and promotional texts from both Smart and Globe still pouring in.

Large Image (DO NOT USE)

List Image (DO NOT USE)

List Icon (DO NOT USE)

What PI is fighting for

Expose Invisible Data Placed Beyond Our Control

Realise Our Rights to Live with Dignity

Learn more

LGBTIQ+

Gender

Data Intensive Systems

Location

Global South

Our fight

More about our partner

Communications Surveillance

Target Profile

Huawei

State of Surveillance in the Philippines

staff — Tue, 29 Mar 2016 09:12:58 +0000

State of Surveillance in the Philippines staff Tuesday, March 29, 2016

This guest piece was written by Jessamine Pacis of the Foundation for Media Alternatives. It does not necessarily reflect the views or position of Privacy International.

Introduction

With a history immersed in years of colonialism and tainted by martial law, Philippine society is no stranger to surveillance. Even now, tales of past regimes tracking their citizens’ every move find their way into people’s everyday conversations. This, for the most part, has kept Filipinos vigilant over their hard-earned right to privacy and freedom of expression.

However, it is difficult to gauge how much this level of awareness has influenced the population’s view of the slew of surveillance incidents that have occurred in recent years.

The Philippines has emerged, and is steadily retaining its place, as one of the biggest users of mobile and internet in Southeast Asia. In this era of increased connectivity, policies and regulating bodies on communication technologies are becoming more critical, as demonstrated by very recent developments such as the long-delayed creation of the National Privacy Commission.

The Past

Several prominent cases have directed the spotlight towards the prevalence of communications surveillance in the country. The most controversial incident to date remains the “Hello Garci” scandal, in which a wiretapped conversation between former President Gloria Macapagal-Arroyo and an election commissioner exposed what appeared to be an electoral fraud scheme favoring Arroyo during the 2004 presidential elections. Other notable incidents include a leaked recorded conversation between former President Corazon Aquino and two Cabinet members regarding the impact of the then-new Constitution on U.S. military bases in the country.

The Present

The current internet penetration rate and use in the Philippines is remarkably high, especially considering the country’s dismal internet speed. One global study also ranked the country as being first in daily internet use (in terms of number of hours spent online), with an average of 6.3 hours of computer use per day and 3.3 hours per day if mobile device owners(the global median is 2.7 hours). Social media use is also popular, with the country taking credit for 30 million Facebook accounts in 2013. Such high levels of usage are puzzling given the country’s average internet connection speed of 2.5 Mbps compared tothe global rate, which is 4.5 Mbps.

The Philippine legal framework generally frowns upon communication surveillance. Although the term has yet to be defined under domestic law, few would contest the fact that it is proscribed or restricted. This view proceeds mainly from the Constitutional guarantee of “the privacy of communication and correspondence,” and the number of international conventions on privacy and human rights the country subscribes to, namely: the Universal Declaration on Human Rights (UDHR), the International Covenant on Economic, Social and Cultural Rights (ICESCR), and the International Convention on the Elimination of All Forms of Racial Discrimination. Communications surveillance is also considered a felony or crime in certain cases, as can be gleaned from the following statutes: the Revised Penal Code, the Electronics Engineering Law of 2004, and the Anti-Wiretapping Act of 1965. Nevertheless, other laws sanction the activity as a legitimate law enforcement measure for specific purposes, such as in the Expanded Anti-Trafficking in Persons Act of 2012, the Human Security Act of 2007, and the Anti-Child Pornography Act of 2009.

At present, the two most important statutes concerning digital privacy and surveillance are the Cybercrime Prevention Act (CPA) of 2012 (RA 10175) and the Data Privacy Act (DPA) of 2012 (RA 10173). Regarding the former, it is worth noting that although the Supreme Court has already struck down a provision that would have allowed law enforcement authorities to collect or record traffic data through electronic means in real-time without the need for judicial authori s ation, the law still allows the interception of communications and the disclosure and preservation of computer data in specific conditions. RA 10173, on the other hand, provides possible legal remedies against communication surveillance. It establishes the general rule that the processing of privileged information is a prohibited activity, subject to certain exceptions.

However, while the CPA and the DPA have laid the groundwork for a comprehensive legal regime on privacy, implementation is taking longer to fully take off. In fact, although both laws were enacted in 2012, the implementing rules and regulations for the CPA were published only in 2015, whereas the National Privacy Commission, tasked to implement the rules for the DPA were appointed only in March 2016.

The Future

Numerous reports suggest that the Philippine government has acquired, or has been planning to acquire, various surveillance technologies, which include: (1) P I S C E S, a US government-developed biometric identification technology used for border control; (2) IMSI catchers, or phone monitoring kits that provide active intercept capabilities; (3) Galileo Remote Control System, an intrusion malware tool; and (4) Signal, a New Zealand-manufactured software for large-scale social media analysis. The Philippine government’s interaction with its U.S. counterpart is particularly significant, considering that the latter has constantly been accused of engaging in surveillance activities within the country’s borders. In early 2015, for instance, a downed US military surveillance drone was discovered in the Quezon province. Documents leaked by former US National Security Agency (NSA) contractor Edward Snowden in May 2014 also revealed that the NSA “had access via DSD asset in a Philippine provider site” and “collects Philippine GSM, short message service (SMS), and Call Detail Records.”

There is some degree of consolation in a recent development. In March 2016, almost four years after the DPA mandated the creation of the National Privacy Commission (NPC), the first NPC commissioner and deputy commissioners were finally appointed. The NPC is tasked to develop the implementing rules and regulations of the DPA—a massive undertaking that could dictate the future of privacy and surveillance in the Philippines. Given the breakneck speed with which new technologies are developed, the Commission needs to take into account not only the issues and mechanisms that are currently in place, but also those proposed measures that might eventually affect the people’s right to privacy. Chief among these are the persistent attempts to require the registration of SIM cards and establish a national identification system. Both policy proposals involve the acquisition and use of sensitive information such as biometric data.

With all the privacy-related issues that confront the Philippines and the rest of the world today, the NPC is certain to have their hands full. Should they do their mandates justice, they may very well set the proper tone for the country’s approach to privacy in the decades to come.

Learn more

Interception of Communications

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

Modernise the Rule of Law and Strengthen Surveillance Safeguards

Our fight

Location