Alternative news websites hit by alleged state-backed cyberattacks: digital forensics

Jauhn Etienne Villaruel, ABS-CBN News

<div class='embed-wrap'><figure data-feedback='fb:likes,fb:comments'><img src='http://sa.kapamilya.com/absnews/abscbnnews/media/2021/news/06/24/sites.jpg' ><figcaption>Altermidya and Bulatlat condemned the cyberattacks traced by a Sweden-based digital forensics group to the Philippine Army and DOST.</figcaption></figure></div>MANILA (2ND UPDATE) — Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/spotlight/04/23/19/are-ph-journalists-facing-increasing-level-of-intimidation-disinformation'>Are PH journalists facing increasing level of intimidation, disinformation?</a></li></ul>Qurium Media Foundation <a href='https://www.qurium.org/alerts/philippines/attacks-against-media-in-the-philippines-continue/'>reported</a> Tuesday that it recorded in the past months "brief but frequent denial attacks against" websites bulatlat.com, altermidya.org, as well as karapatan.org.Notably, on June 5, Qurium said a machine from the Department of Science and Technology (DOST) launched a vulnerability scan against Bulatlat. The National Union of Journalists of the Philippines (NUJP) described a vulnerability scan as an "automated, high level test that creates an inventory of all known and potential weaknesses in a network," adding such test is "highly irregular" when done without permission from the system owner.<blockquote class='twitter-tweet'>Qurium Media Foundation said several IP addresses linked to the DOST and the military have launched a series of attacks in the past two months against the websites of Bulatlat and Altermidya and human rights group Karapatan <a href='https://t.co/5jilCkQtBe'>pic.twitter.com/5jilCkQtBe</a>— NUJP (@nujp) <a href='https://twitter.com/nujp/status/1407287498036846592?ref_src=twsrc%5Etfw'>June 22, 2021</a></blockquote><script async src='https://platform.twitter.com/widgets.js' charset='utf-8' type='text/javascript'></script>Looking closely at the IP address and firewall, Qurium extracted the email address "acepcionecjr@army.mil.ph." The URL "https://army.mil.ph" is the official website of the Philippine Army."Another interesting finding was to find the attacker IP in the Edits of Wikipedia for the article 'Chief of Army (Philippines)' and many others related to the Army," Qurium reported.UNFAIR, SAYS PALACE<figure class='op-interactive'><iframe allow='autoplay; fullscreen' frameborder='0' height='100%' id='ivsplayer01' scrolling='no' src='https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&key=e8c22c015ca9eafa76f1e3edfa03c603&spid=3001339&vid=1713174' width='100%'></iframe></figure><div class='iwantbar'>Video courtesy of PTV</div>Launching a cyber attack "is a crime," noted Malacañang spokesman Harry Roque. "It will be investigated, and I will reiterate that it is unfair to link government officers to these cyber attacks, pending investigation," he said in a press briefing. He added that he was not familiar with the Qurium group. "At hindi ko po alam kung talagang competent siyang magbigay ng testimonya dito sa ating bansa," said the Palace official. (And I do not know if this group really has competence to give testimony here in our country.) 'NOT SURPRISED'In separate statements, Altermidya and Bulatlat condemned the cyberattacks. "We are not surprised by the results of the recent digital forensic… Still, we are angered that taxpayers’ money is being spent to bring down our website, and to deny our readers access to our reportage,” Bulatlat said Wednesday in a series of tweets. Bulatlat emphasized that the cyberattacks happened in light of the red tagging by the National Task Force to End Local Communist Armed Conflict (NTF-ELCAC) and other "state agents.""We enjoin our colleagues in the Philippine media, and our audience to continue asserting press freedom," Bulatlat said.Altermidya, for its part, said it "condemns these cyberattacks on our websites, as well as those against other progressive groups."DOST EXPLAINS In a statement Thursday, DOST said accusations it was behind cyberattacks against the news websites were "unfounded and patently false.""The implication of DOST’s involvement in said cyber-attacks is unfounded and patently false."The agency said part of its mandate was to "assist other government agencies by allowing the use of some of its IP addresses in the local networks of other government agencies.""This statement [of Qurium] was solely based on the tracked IP address and does not translate to the Department’s involvement in the matter. DOST remains committed to working towards a progressive Philippines, with science in full service of the Filipino people," it added. ARMY 'TO LOOK INTO IT'Philippine Army spokesperson Col. Ramon Zagala on Wednesday told ABS-CBN News they "respect" freedom of expression and will not tolerate such attacks. "The Philippine Army respects freedom of expression and per policy, will never infringe [on] that freedom. We take these accusations of cyberattack seriously and we will not condone or tolerate it if such occurred against media entities. Rest assured we are servants of the people and protector of freedom of expression," Zagala said.Asked if the Army will investigate the matter, Zagala said "we will look into it."Last September, Facebook removed pages, accounts, groups and Instagram profiles of two unnamed networks, with one linked to individuals associated with the Philippine military and police, due to "coordinated inauthentic behavior" or manipulation campaigns on the platform.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/business/09/23/20/facebook-removes-china-based-ph-military-and-police-linked-networks-for-coordinated-inauthentic-behavior'>Facebook removes China-based, PH military and police-linked networks for ‘coordinated inauthentic behavior’</a></li></ul>'DAMNING EVIDENCE'According to Bayan Muna Rep. Ferdinand Gaite, Quirium's report was "damning evidence" of the government's agenda to silence the press."This is damning evidence that the government is out to silence the press, and belies the administration's repeated claims that they are not attacking press freedom. Malinaw na malinaw ito, the cyberattacks were traced back to the government, which means it is an official policy of this administration to attack media organizations," Gaite said in a statement.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/news/05/13/20/social-media-platforms-need-to-do-more-to-combat-disinformation-press-freedom-advocates-say'>Social media platforms need to do more to combat disinformation, press freedom advocates say</a></li></ul>He added that the report proves the Duterte administration is "indeed operating troll farms" to attack government critics."Kailangan na talaga isapubliko ang mga impormasyong una nang nilantad ni Sen. Lacson patungkol sa troll farms ng gobyerno. Our taxes are funding these illegal operations, these operations that are meant to attack our country's democracy," said Gaite.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/news/01/20/21/meme-accounts-could-be-disinformation-actors-warns-prof'>Meme accounts could be 'disinformation actors,' warns prof</a></li></ul>Gaite was referring to Sen. Panfilo Lacson's exposé that an "undersecretary" is assembling "2 troll farms each" in every province ahead of the 2022 national elections, possibly using public funds.Lacson has yet to identify the official but said he would do so if his whistleblower agrees. <ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/news/06/10/21/lacson-seeking-whistleblowers-nod-to-name-usec-assembling-troll-farms'>Lacson seeking whistleblower's nod to name 'Usec' assembling troll farms</a></li></ul>RELATED VIDEO<figure class='op-interactive'><iframe allow='autoplay; fullscreen' frameborder='0' height='100%' id='ivsplayer01' scrolling='no' src='https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&key=e8c22c015ca9eafa76f1e3edfa03c603&spid=3001339&vid=1708820' width='100%'></iframe></figure><div class='iwantbar'>Watch more in <a href='//www.iwantv.com.ph/'>iWantv</a> or <a href='//tfc.tv/'>TFC.tv</a></div>— With a report from Jamaine Punzalan, ABS-CBN News

Notably, on June 5, Qurium said a machine from the Department of Science and Technology (DOST) launched a vulnerability scan against Bulatlat. The National Union of Journalists of the Philippines (NUJP) described a vulnerability scan as an "automated, high level test that creates an inventory of all known and potential weaknesses in a network," adding such test is "highly irregular" when done without permission from the system owner.<blockquote class='twitter-tweet'>Qurium Media Foundation said several IP addresses linked to the DOST and the military have launched a series of attacks in the past two months against the websites of Bulatlat and Altermidya and human rights group Karapatan <a href='https://t.co/5jilCkQtBe'>pic.twitter.com/5jilCkQtBe</a>— NUJP (@nujp) <a href='https://twitter.com/nujp/status/1407287498036846592?ref_src=twsrc%5Etfw'>June 22, 2021</a></blockquote><script async src='https://platform.twitter.com/widgets.js' charset='utf-8' type='text/javascript'></script>Looking closely at the IP address and firewall, Qurium extracted the email address "acepcionecjr@army.mil.ph." The URL "https://army.mil.ph" is the official website of the Philippine Army."Another interesting finding was to find the attacker IP in the Edits of Wikipedia for the article 'Chief of Army (Philippines)' and many others related to the Army," Qurium reported.UNFAIR, SAYS PALACE<figure class='op-interactive'><iframe allow='autoplay; fullscreen' frameborder='0' height='100%' id='ivsplayer01' scrolling='no' src='https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&key=e8c22c015ca9eafa76f1e3edfa03c603&spid=3001339&vid=1713174' width='100%'></iframe></figure><div class='iwantbar'>Video courtesy of PTV</div>Launching a cyber attack "is a crime," noted Malacañang spokesman Harry Roque. "It will be investigated, and I will reiterate that it is unfair to link government officers to these cyber attacks, pending investigation," he said in a press briefing. He added that he was not familiar with the Qurium group. "At hindi ko po alam kung talagang competent siyang magbigay ng testimonya dito sa ating bansa," said the Palace official. (And I do not know if this group really has competence to give testimony here in our country.) 'NOT SURPRISED'In separate statements, Altermidya and Bulatlat condemned the cyberattacks. "We are not surprised by the results of the recent digital forensic… Still, we are angered that taxpayers’ money is being spent to bring down our website, and to deny our readers access to our reportage,” Bulatlat said Wednesday in a series of tweets. Bulatlat emphasized that the cyberattacks happened in light of the red tagging by the National Task Force to End Local Communist Armed Conflict (NTF-ELCAC) and other "state agents.""We enjoin our colleagues in the Philippine media, and our audience to continue asserting press freedom," Bulatlat said.Altermidya, for its part, said it "condemns these cyberattacks on our websites, as well as those against other progressive groups."DOST EXPLAINS In a statement Thursday, DOST said accusations it was behind cyberattacks against the news websites were "unfounded and patently false.""The implication of DOST’s involvement in said cyber-attacks is unfounded and patently false."The agency said part of its mandate was to "assist other government agencies by allowing the use of some of its IP addresses in the local networks of other government agencies.""This statement [of Qurium] was solely based on the tracked IP address and does not translate to the Department’s involvement in the matter. DOST remains committed to working towards a progressive Philippines, with science in full service of the Filipino people," it added. ARMY 'TO LOOK INTO IT'Philippine Army spokesperson Col. Ramon Zagala on Wednesday told ABS-CBN News they "respect" freedom of expression and will not tolerate such attacks. "The Philippine Army respects freedom of expression and per policy, will never infringe [on] that freedom. We take these accusations of cyberattack seriously and we will not condone or tolerate it if such occurred against media entities. Rest assured we are servants of the people and protector of freedom of expression," Zagala said.Asked if the Army will investigate the matter, Zagala said "we will look into it."Last September, Facebook removed pages, accounts, groups and Instagram profiles of two unnamed networks, with one linked to individuals associated with the Philippine military and police, due to "coordinated inauthentic behavior" or manipulation campaigns on the platform.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/business/09/23/20/facebook-removes-china-based-ph-military-and-police-linked-networks-for-coordinated-inauthentic-behavior'>Facebook removes China-based, PH military and police-linked networks for ‘coordinated inauthentic behavior’</a></li></ul>'DAMNING EVIDENCE'According to Bayan Muna Rep. Ferdinand Gaite, Quirium's report was "damning evidence" of the government's agenda to silence the press."This is damning evidence that the government is out to silence the press, and belies the administration's repeated claims that they are not attacking press freedom. Malinaw na malinaw ito, the cyberattacks were traced back to the government, which means it is an official policy of this administration to attack media organizations," Gaite said in a statement.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/news/05/13/20/social-media-platforms-need-to-do-more-to-combat-disinformation-press-freedom-advocates-say'>Social media platforms need to do more to combat disinformation, press freedom advocates say</a></li></ul>He added that the report proves the Duterte administration is "indeed operating troll farms" to attack government critics."Kailangan na talaga isapubliko ang mga impormasyong una nang nilantad ni Sen. Lacson patungkol sa troll farms ng gobyerno. Our taxes are funding these illegal operations, these operations that are meant to attack our country's democracy," said Gaite.<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/news/01/20/21/meme-accounts-could-be-disinformation-actors-warns-prof'>Meme accounts could be 'disinformation actors,' warns prof</a></li></ul>Gaite was referring to Sen. Panfilo Lacson's exposé that an "undersecretary" is assembling "2 troll farms each" in every province ahead of the 2022 national elections, possibly using public funds.Lacson has yet to identify the official but said he would do so if his whistleblower agrees. <ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/news/06/10/21/lacson-seeking-whistleblowers-nod-to-name-usec-assembling-troll-farms'>Lacson seeking whistleblower's nod to name 'Usec' assembling troll farms</a></li></ul>RELATED VIDEO<figure class='op-interactive'><iframe allow='autoplay; fullscreen' frameborder='0' height='100%' id='ivsplayer01' scrolling='no' src='https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&key=e8c22c015ca9eafa76f1e3edfa03c603&spid=3001339&vid=1708820' width='100%'></iframe></figure><div class='iwantbar'>Watch more in <a href='//www.iwantv.com.ph/'>iWantv</a> or <a href='//tfc.tv/'>TFC.tv</a></div>— With a report from Jamaine Punzalan, ABS-CBN News

<ul class='op-related-articles'>	<li><a href='https://news.abs-cbn.com/spotlight/04/23/19/are-ph-journalists-facing-increasing-level-of-intimidation-disinformation'>Are PH journalists facing increasing level of intimidation, disinformation?</a></li></ul>Qurium Media Foundation <a href='https://www.qurium.org/alerts/philippines/attacks-against-media-in-the-philippines-continue/'>reported</a> Tuesday that it recorded in the past months "brief but frequent denial attacks against" websites bulatlat.com, altermidya.org, as well as karapatan.org.

<div class='embed-wrap'><figure data-feedback='fb:likes,fb:comments'><img src='http://sa.kapamilya.com/absnews/abscbnnews/media/2021/news/06/24/sites.jpg' ><figcaption>Altermidya and Bulatlat condemned the cyberattacks traced by a Sweden-based digital forensics group to the Philippine Army and DOST.</figcaption></figure></div>MANILA (2ND UPDATE) — Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.

Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.

Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.

Alternative news websites hit by alleged state-backed cyberattacks: digital forensics | ABS-CBN News

News

News

Alternative news websites hit by alleged state-backed cyberattacks: digital forensics

Alternative news websites hit by alleged state-backed cyberattacks: digital forensics