P90-million payment to Smartmatic held back by Comelec over alleged data breach

MANILA, Philippines, April 20 ------ The Commission on Elections (Comelec) has withheld P90 million of payment to poll technology provider Smartmatic due to an alleged data breach associated to one of the company's contractual employees. Last week, authorities raided the house of former Smartmatic employee Ricardo Argana in San Pedro, Laguna, who is a suspect in Smartmatic's security breach.

In a hearing on April 19, Comelec Commissioner Saidamen Pangarungan told lawmakers that he has not yet given the go-signal to release Smartmatic's payment due early March. "I have not signed the voucher for the payment to Smartmatic in the amount of P90 million pursuant to our contract because we want to clear this matter about this leakage by Mr. Argana of some data," he said. If it is proven that the company violated its contract and/or the Data Privacy Act, the Comelec aims to terminate their contract and possibly blacklist their company, forfeit their performance security and/or file damages and criminal cases pursuant to the Data Privacy Act and the Civil Code of the Philippines.

"So far we have not taken any of these actions, except to withhold payment to Smartmatic. It is the recommendation of our law department to wait for the official investigation report of the NBI in order for the Commission to be in a better position to assess the extent of the breach and the probable course of action to take," he said. Pangarungan said they will only release the payment once Comelec is "convinced that Smartmatic is innocent about this leakage of data." Smartmatic lawyer, Christian Robert Lim, who was present at the hearing, confirmed that they have not yet received the P90 million in payment, but promised to cooperate with the poll body in the investigation.

In a statement on March 21, Smartmatic said the alleged data breach will have no bearing on the national and local elections taking place in less than a month's time. "The 2022 Philippine National and Local Elections are 100% safe and secure, and remain unaffected despite the noise being generated by disinformation campaigns, non-verified sources, and even fabricated and manipulated information," it said. The information compromised in the breach involved "non-sensitive, day-to-day operational materials from a repository readily available to all Smartmatic staff", the company added.

Victor Lorenzo, Chief of the NBI Cybercrime Division, said that Argana admitted during an adminstrative inquiry on January 12 that he allowed a third party to access his laptop in exchange for "some training materials." However, he said later on that he was offered P50,000 to P300,000 to give the third party access to Smartmatic's facilities. He added that the NBI believes Argana "is not acting alone", as he was not as fluent in English as XSOX—the group believed to have access to the compromised files.

Source: philstar.com