P90-M payment to Smartmatic withheld until data breach is resolved –Comelec chair

The Commission on Elections (Comelec) is withholding a P90-million payment to Smartmatic, the technology provider in the May 9 elections, until the firm has proven its innocence in the data leak issue, according to Chairman Saidamen Pangarungan on Tuesday.

During the Senate Committee on Electoral Reforms hearing, Pangarungan said the poll body’s courses of actions towards Smartmatic, if ever a violation of contract is proven, include termination of contract and possible blacklisting, forfeiture of performance security, damages pursuant to the Data Privacy Act and Civil Code of the Philippines, and the filing of criminal cases.

“So far, we have not put in any of these except to withhold payment to Smartmatic. I have not signed the voucher for the payment to Smartmatic in amount of P90 million pursuant to our contract because we want to clear this matter about this leakage... of some data,” he said.

He said the P90 million was supposed to be part of the third tranche of the Comelec’s payment to Smartmatic that was due in early March.

Asked by Senator Imee Marcos, who chairs the electoral reforms committee, on when would the amount be released and under which conditions, Pangarungan said, “Once we are convinced that Smartmatic is innocent about this leakage of the data.”

He said it was the recommendation of the Comelec Law Department to wait for the official investigation report of the National Bureau of Investigation (NBI) in order for the poll body to assess the extent of the alleged breach and the proper actions regarding the matter.

Former Comelec commissioner and now Smartmatic legal counsel Christian Robert Lim acknowledged the withholding of the payment, saying they are “cooperating in any way possible” with the Comelec.

Pangarungan, however, said they are not seeing any delays in the conduct of the May 9 elections because of the matter.

Marcos, sister of presidential candidate Ferdinand "Bongbong" Marcos Jr., then asked the Comelec if there is a need to amend the automated elections law to require Smartmatic to submit a report when a breach or system interference is observed within a predetermined period of time.

She said that Smartmatic should prove that its systems are safe and secure so that authorities and the public will be confident of the elections.

“We will study all these options,” Pangarungan answered. “As the elections are coming near, because of the proximity of the elections, it is not wise to take any drastic action against Smartmatic that might prejudice the conduct of the elections on May 9.”

NBI probe 

Last week, the NBI Cybercrime Division (CCD) conducted a search operation at the residence of Ricardo Argana, a former employee of Smartmatic.

Authorities found his smartphone and some SD cards hidden in the room’s ceiling during the search. They also dismantled the Wi-Fi router that Argana used to have access to gadgets of other five IT suspects for six days.

NBI-CCD chief Victor Lorenzo said Argana’s contract with Smartmatic was only for six months, but part of his job was to determine the possible glitches in the system.

Smartmatic’s laptop has been returned, but Argana already encrypted it so it won't be subject for forensic examination, according to the NBI.

During Tuesday's hearing, Lorenzo said the NBI believes that Argana was not acting alone as there were 726 logins recorded within six days in Smartmatic's system.

“We believe that he’s not acting alone because he is not that fluent in English and XSOS communicated with Smartmatic, if you see in the letter, that medyo articulate po sila [they are quite articulate]. Smartmatic was also able to retrieve 726 logins in six days, meaning it will be physically impossible for the former employee to navigate the control of environment for 726 times in a matter of six days,” he said.

In his presentation, Lorenzo said there was an “unusual traffic and downloads logged in SMMT Systems” recorded from December 28, 2021 to January 2, 2022.

Pangarungan earlier said that Smartmatic has confirmed that a “data leak” occurred in its system, but it was unrelated to the 2022 elections.

Marcos previously said the Smartmatic data breach, which included personal information, ledgers, office photos, contact persons in the Comelec, may have been the handiwork of a syndicate.

For their part, Smartmatic’s Lim said they have adopted a “more stringent approach” in terms of screening employees, and are now requiring them to leave their laptops in the offices.

Lim also said Smartmatic is now contemplating filing a civil case for damages against Argana.

NBI earlier said a total of 720 counts of unlawful access were filed against Argana, who is still at large. —KBK, GMA News