Second Comelec hacker denies leaking voters’ data

One of the two suspected hackers of the Commission on Elections (Comelec) website has denied the allegations of the National Bureau of Investigation (NBI) that they downloaded and leaked the website data using a dummy account.

In his counter-affidavit filed before the Muntinlupa City assistant city prosecutor last week, Joenel de Asis said he is not in any way affiliated with hackers’ group LulzSec Pilipinas that published the leaked data using a fictitious Facebook account under LulzSec.

“It was alleged by the NBI that my cellphone unit disclosed relevant information about my group affiliations, but did not correlate the said group with the hacking or data leaking of the Comelec website,” he explained.

De Asis, 23, also denied using the username “sec. anon. ops,” one of the three usernames which appeared in the defaced homepage of the Comelec website at dawn of March 27.

He also noted that while the NBI forensic investigator used a software to display his activity on his personal computer, “what the forensic investigator had seen are the history of sites visited or browsed by my computer…It does not mean that the said computer was used for hacking” but for browsing the Internet only.

“If mere browsing of the Internet would be a violation, that would render nugatory the very purpose of the World Wide Web as an easy access of information,” he added. De Asis also noted that the NBI failed to present evidence that would link him to the defacement, hacking and leaking of Comelec website data.

“Besides, the Comelec made it easier to download their information in the ‘precinct finder’ application,” he added.

NBI agents nabbed De Asis in his house in Muntinlupa City on April 29.

Comelec Chairman Andres Bautista said De Asis had admitted to downloading 340 gigabytes of data from the website and leaking it through LulzSec’s Facebook account.

The NBI charged De Asis with illegal access, data interference and misuse of devices under the Cybercrime Prevention Act, and unauthorized access or intentional breach under the Data Privacy Act.