The Department of Information and Communications Technology (DICT) on Thursday said it hopes the Cybersecurity Bill would be certified as urgent by President Ferdinand Marcos Jr. soon.

“Right now, nasa agenda siya ng Legislative-Executive Development Advisory Committee (LEDAC), chaired by the President himself… He is passionate about cybersecurity. He is very passionate about digitalization and he’s looking forward to ensuring that digitalization is not compromised with lack of security,” DICT Undersecretary Jeffrey Dy said at the sidelines of the CII Protection Summit in Parañaque. 

The proposed measure aims to require organizations operating Critical Information Infrastructure (CII) to report to the government when they are hit by cyber attacks.

DICT says monitors 2 million cyber threats per day

The private sector is currently not obligated to do so under current laws.

“Telecommunications companies, power generators, power distributors including NGCP (National Grid Corporation of the Philippines), yung transmission line operator, major transportation hubs, operators of water utilities— these are among the sectors that will be classified as CII. As well as very very large banks that when they fall, it will affect Philippine economics,” said Dy.

If not during this Congress, Dy is optimistic that the bill would be passed under the next or 20th Congress.

“Kung aabot siya sa third reading before Congress (adjourns) then it becomes faster for the next Congress kasi usually ang kanilang tradition… maca-carry over na nila. Magkakaroon lang ng manifestation sa committee level,” he said.

Other salient points of the bill include monetary and administrative penalties for non-compliant CII operators, and the forming of a cybersecurity regulatory body.

But Dy assured private firms running CIIs that they will be given enough time to comply with the new system, as talked about during initial consultations.

“After the bill is passed, we will identify who the CII operators are and they will be given 24 months to comply with all the requirements. They can also appeal the decision designating them as a CII,” he said.

DICT: 2TB of data affected in DOST cyberattack

Dy stressed the need for the measure, saying it is to prevent possible glitches or the breakdown of critical and essential services.

“We’ve heard a lot of stories about “computer glitches” na nangyari halimbawa sa power sector, sa ating mga airports, and we don’t even know, unless they volunteer that information,” he said.

Since the start of the year, Dy said the DICT’s National Computer Emergency Response Team has already dealt with more than 2,200 cybersecurity incidents targeting government agencies, state universities and colleges, as well as telcos.

He believes these threats are still underreported.

The Philippine government is also open to having public-private partnership projects for CII protection.

“Sa ngayon, wala pang naka-pipeline pero may mga offers na,” he said. 

The Japan International Cooperation Agency (JICA) said it is working with the DICT in terms of ICT training and education. 

DICT working with BOC to contain cyber attack and limit data breach  

“We are now dispatching many JICA, Japanese experts to come to DICT to share the knowledge in terms of capacity development of the DICT officers,” said JICA Representative to the Philippines Sakamoto Takema during the same event. 

He said JICA has also incorporated cybersecurity features in ongoing infrastructure projects it is helping to build in the country such as the Metro Manila Subway and the North South Commuter Railway. 

“For the operations of new railway projects here, we need the signaling and other information technology to ensure the safe operation of the trains,” he added.