Palace: 'Unfair' to link govt. agencies to cyberattacks on alternative news sites pending probe

Metro Manila (CNN Philippines, June 24) — Malacañang vowed an investigation into reported attacks against alternative media sites, but emphasized it is “unfair” to link the supposed hits to government agencies without proof.

“It is a crime po, to launch a cyberattack pursuant to the Cybercrime [Prevention] Act,” said Presidential Spokesperson Harry Roque on Thursday. “It will be investigated and I will reiterate that it is unfair to link government offices to these cyberattacks pending investigation.”

Swedish digital forensics group Qurium earlier reported “brief but frequent” distributed denial of service (DDOS) attacks against news sites Bulatlat and Altermidya. DDOS attacks intend to overwhelm a target website with fake traffic, making it inaccessible to users.

“A machine from the Department of Science and Technology (PH) with IP address 202.90.137{.}42 launches a vulnerability scan against Bulatlat,” said Qurium on Tuesday, adding that it seemed to belong to the Philippine Research, Education, and Government Information Network (PREGINET). 

According to its website, PREGINET is the Philippines’ sole research and education network interlinking academic, research and government institutions. It also has links to international research and education networks (RENs), it added.

Qurium added that a closer look at the IP address and firewall likewise bared an email address with the @army.mil.ph domain server, also the website of the Philippine Army.

“Another interesting finding is that the attacker’s IP address is present in the Edits of the Wikipedia page for ‘Chief of Army (Philippines)’ and many other pages related to the Army,” said Qurium.

Bulatlat earlier said it was “not surprised” with the findings, noting that state agents have “consistently labeled us as communist fronts for pursuing journalism for the people.”

On Wednesday, the Philippine Army denied initiating such cyberattacks as it “will never infringe” on freedom of expression, as per policy.

“We take these accusation(s) of cyberattack seriously and we will not condone or tolerate it if such occurred against media entities,” it further explained, adding that it will look into the matter.

Meanwhile, the DICT called as “unfounded and patently false” its supposed involvement in the cyber hits.

“[T]he statement that DOST potentially took part in initiating the alleged cyberattacks is false. This statement was solely based on the tracked IP address and does not translate to the department’s involvement in the matter,” it added.

In a joint statement on Thursday, Altermidya and Bulatlat urged the DOST to conduct its own probe into the use of their IP, make their findings available to the public, and “do its part in stopping the cyberattacks apparently perpetrated by the Philippine Army.”

Both alternative sites also stood by Qurium’s findings, noting that the firm was “instrumental” in halting DDOS attacks they experienced in 2019.

Qurium also monitored the same IP adddress which carried out the hits on the websites on Wednesday, with “suspicious web traffic” also monitored by organizations Kodao and Pinoy Weekly at around the same time.

“We think this is part of systematic and orchestrated efforts in bringing down the websites of independent media,” concluded the statement.