Tag Archives: MOZILLA FIREFOX

Philippine Cyber Lawbytes 210: Why Data Security Matters: Attention to the National Privacy Commission: The CBPRS website is Not Safe Nor Secure According to Four Web Browsers!

Posted by thecyberlawyer on

In February 11, 2022, the Legal Management Council of the Philippines (LMCP) and the UP Institute of Administration of Justice (UP IAJ) invited me to give a three (3) hour Mandatory Continuing Legal Education (MCLE) lecture on Data Privacy. The LMCP is a prestigious organization comprised of legal executives and managers of top law firms and Fortune 500/2000 companies in the Philippines. For this engagement, I decided to do a full lecture on the important intersections between “Data Privacy” and “Data Security” which had not been emphasized or even done in any MCLE lecture on data privacy in the Philippines.

The whole point of my lecture is that data privacy is not achievable without data security. Data security is the most vital requirement and prerequisite to data privacy, not the other way around. Thus, the legal importance given to data privacy, without any equal emphasis on the legal significance of data security is misplaced and is rife with grave repercussions. I illustrated this by giving detailed case studies, culled from the cases I have handled, and from my research.

One of the most important developments in the field of data privacy as far as the Philippines is concerned is being accepted as one of the members of the APEC Cross-Border Privacy Rules System (CBPRS).  Endorsed by APEC Leaders in 2011, this is a voluntary, accountability-based system that facilitates privacy-respecting data flows among APEC economies. It provides the recognition criteria for organizations, or countries, wishing to become an APEC CBPR System certified Accountability Agent. It establishes a regulatory cooperative arrangement to ensure that each of the APEC CBPR system program requirements can be enforced by participating APEC economies.

In order to join this system, applicant countries or organizations must fill-up an intake questionnaire, and their responses will be evaluated based on assessment criteria. The current nine participating APEC CBPR system economies: USA, Mexico, Japan, Canada, Singapore, the Republic of Korea, Australia, Chinese Taipei, and the Philippines. The website itself contains all the documentary submissions officially submitted by the member countries.

As is part of my due diligence tests for every website I visit, critique, document and present in my research and presentations, the CBPRS website failed that one vital requirement that all websites dedicated to data privacy must have: data security. According to these four web browsers I used, the CBPRS website is NOT SECURE and UNSAFE, even DANGEROUS. Please take note of the yellow marker encircling the areas where these warnings and indications are visible. The web browsers all note the insecurity of these websites even today, February 19, 2022.

1. MOZILLA FIREFOX

2. GOOGLE CHROME

3. MICROSOFT BING

4. OPERA

THE NATIONAL PRIVACY COMMISSION WEBSITE

In contrast, the National Privacy Commission’s website, in all four web browsers tested safe and secure. I will just give one example, the following were screenshots from the web browser Mozilla Firefox:

IMPLICATIONS:

The CBPRS.org does not have the “https” or “hypertext transfer protocol secure” protocol. This shows that the CBPRS.org site is not encrypted via the Transport Layer Security (TLS) encryption. TLS encryption protects all information that passes through the browser to the server, including logins and passwords, and even the web administration credentials. With the four web browsers’ warning of the website being “Not Secure”, it means that all transfer of information to and from this website, cannot be trusted.

The security warnings of the four web browsers show that the identity of CBPRS.org had not been validated by a legitimate 3rd party source. According to the Opera Guidelines, the “best guarantee of a website’s identity is provided by Extended Validation (EV) certificates. Extended Validation means that the details of the organization buying the certificate have been audited by an accountable, third-party entity, who can therefore verify that the certificate owner is who it claims to be. EV websites are indicated by a black  security badge with a padlock in the address field”.

In contrast to all these, the NPC website follows the “https” encryption protocol and it is verified by Cloudflare Inc.

The non-encrypted state and non-secure state of the CBPRS website entails it is more prone to viruses and hacking attacks. A TSL Certificate provides an additional barrier that can prevent malicious actors from gaining access to the  information in this site, for example, by introducing fake documents, or uploading malicious scripts on the site. This is all the more pressing because the Philippines’ official documents submitted by the NPC, and all the other documents of the 8 member economies, which are retrievable from this site, are not secured.

Moreover, the “Not Secure” warnings also means that anyone that visits this site does not have any privacy while browsing. There will always be a risk of local attackers, users on other computers of the same network, to be able to monitor, view the pages that the viewer is browsing as well as the information s/he is sending or receiving. It does not provide trust or security to the viewing experience.

Unlike the NPC website, the CBPRS website is not privacy compliant at all. It is all the more baffling considering that the CBPRS website should be a paragon of data privacy standards for a website, given the fact that it houses the official documentations submitted by its member countries.

I therefore respectfully request for the NPC, as the representative of the Philippine economy in APEC to notify the CBPRS body about their website’s insecurity, and the probable consequences if this is not addressed. It behooves the NPC to inform the CBPRS organization about its website’s insecurity and unencrypted state, for it is truly horrendous and unexcusable that a website devoted to data privacy, can violate security standards, potentially breach the privacy of internet viewers, and be open for possible defacement, and even the deletion or alteration of the official public documents submitted by APEC member economies.

Philippine Lawbytes 141: A Critical Encounter with the Philippine SEC Personnel, the Insecurity of the SEC Website, and Comments on the SEC ICO Draft Rules (Copyright by Dr. Atty. Noel G. Ramiscal)

Posted by thecyberlawyer on

In August 14, 2019, I had the opportunity to have an audience with the Philippine Securities Exchange Commission (SEC) personnel who attended the SEC-UPIGLR professional development course training. Since my lecture was all about “Developments in Cybercrime, Security and Cryptocurrencies”, I took upon myself the task of giving them a taste of my criticisms of the SEC Draft Rules on Initial Coin Offerings (ICOs), and other matters, after I went through my usual discussion on the current trends in cybercrime cases, data privacy and data security.

Dr. Atty. Noel G. Ramiscal, in his lecture for the SEC people, on Cybercrime, Security and Cryptocurrencies, August 14, 2019

Dr. Atty. Noel G. Ramiscal, in his lecture for the SEC people, on Cybercrime, Security and Cryptocurrencies, August 14, 2019

First off, I pointed out that the SEC website has been insecure for quite some time. I showed them evidence of screen shots from three popular web browsers in the Philippines: Google Chrome, Internet Explorer/Microsoft Edge, and Mozilla Firefox. The implications of their website’s insecurity are significant considering the SEC website gathers and contains the sensitive and often confidential personal information of data subjects all over the Philippines.

Dr. Atty. Noel G. Ramiscal, in his lecture for the SEC people, on Cybercrime, Security and Cryptocurrencies, August 14, 2019

Dr. Atty. Noel G. Ramiscal, in his lecture for the SEC people, on Cybercrime, Security and Cryptocurrencies, August 14, 2019

I enlightened them about the National Privacy Commission decision concerning the COMELEC e-leaks and how potentially grave the criminal consequences are for the officers and employees of this Commission, if the personal information of data subjects contained in their databases would be hacked and published like what happened to the Philippine voters’ e-data. Unfortunately, even at the day when I published (October 13, 2019) and amended (October 15, 2019) this article, the SEC website is still insecure!

Screen shot of SEC website home page. on October 15, 2019, the day this article was amended, showing the website's insecurity using the Google Chrome browser

Screen shot of SEC website home page. on October 15, 2019, the day this article was amended, showing the website’s insecurity using the Google Chrome browser

Since 2018, when the SEC released its ICO Draft Rules, I have been critical of several essential provisions and important gaps in these rules. One of the significant and less known implication of the Draft Rules’ scope is that they are not applicable to any effectively and actually decentralized blockchain cryptocurrency like Bitcoin that is not totally represented nor centrally governed by any corporation or organization anywhere.

The “sandbox” approach by the SEC, while quite well intentioned also does two things which might be deemed anti-competitive. Since it does not apply to already existing cryptocurrencies like Bitcoin, its regulatory provisions would not cover the purveyors of these cryptocurrencies and would not protect Philippine investors. Second, since its regulatory provisions would only apply to cryptocurrencies that are going to be part of the ICOs which will fall directly in the Rules’ scope once they are approved, the purveyors of these cryptocurrencies would not be granted the essential leeway or governmental non-intervention that Bitcoin had enjoyed which resulted in its phenomenal global success.

I brought to the attention of these personnel, some of whom belong to the enforcement division of the SEC, how the SEC had utilized the current Securities Regulation Code extraterritorially with no adequate basis in going after promoters of cryptocoins offered in different jurisdictions, just because these offerings were accessible to Philippine investors, via the Internet.

While the Draft ICO Rules have provisions for the source code review of the software and the ensuing hardware to be utilized in rolling out the cryptocoins, the Draft rules apparently has the perspective that these cryptocoins would remain stable, codewise, and otherwise. This is evidenced by the fact that there are no provisions in the Draft Rules that address the consequences of hacking, and even forking, which are systemic risks of putting and investing e-assets in the block chain. As a parting shot, I also brought to the attention of the attendees of the real impending threat posed by advances in cryptanalysis that could render some forms of cryptography utilized by blockchains useless or vulnerable to hacking.

As always, I had hoped that by bringing these to their attention, they would act accordingly. That remains to be seen.