Ss
Republic of the Philippines ey BAS
HOUSE OF REPRESENTATIVES RECEIVED <\
Quezon City pare’. JUN 105
TWENTIETH CONGRESS
First Regular Session

House ert no. 660

Introduced by: Hon. Keith Micah “Atty. Mike” D.L. Tan

AN ACT
INSTITUTIONALIZING POLICIES FOR A SECURE, TRUSTED, AND RELIABLE CYBERSPACE,
STRENGTHENING THE GOVERNANCE OF CYBERSECURITY, ESTABLISHING FOR THE
PURPOSE THE PHILIPPINE CYBERSECURITY COUNCIL, AND APPROPRIATING FUNDS
THEREFOR

EXPLANATORY NOTE

The 1987 Constitution provides that "the maintenance of peace and order, the protection of life,
liberty and property and the promotion of the general welfare are essential for the enjoyment of the
people of all the blessings of democracy” (Article II, Section 5).

Towards this end, the Philippine Development Plan (PDP) seexs to ensure peace and security of
the Filipinos amid the rapid growth and increased sophistication of cybercrimes and cyberattacks that
made data, structures, and our people vulnerable. This is in the face of accelerating tempo of progress
and technology, which have placed the country and the rest of the world at the crossroads of change
where opportunities ana threats diverge.

The Philippines, as it seeks to position itself to become a pivotal player in this digital age, is
vulnerable to attacks.

The Russian cybersecurity firm Kaspersky, in 2022, came up with a global ranking of countries
with most online threats detected where the Philippines moved up to 4th place from Sth in 2020. A total
of 50,544,908 web threats were detected by Kaspersky in the Philippines in 2021 alone.

Kaspersky data also shows that web threat attempts against Filipino users of Kaspersky software
grew 432.75% from 9,487,775 in 2017 to 50,544,908 in 2021. During the COVID-19 pandemic, the
overall cyber-attacks versus local businesses rose by 141% from 2019 with 2,549,698 cyberattacks to
2021 with 6,150,891.

The Philippine NCERT monitored 57,400 cybersecurity threats, and handled 3,470 incidents from
2021 to February 28, 2023. The top three cybersecurity incidents were: (1) malware/maliciaus code at
48.9%, (2) Data Leakage (12.5%), and (3) Compromised Websites (12.4%). An overwhelming majority
of these incidents targeted government emergency response systems (61%), the academe (13%), and
the telecommunications sector (8%).?

In order to enhance our cybersecurity capabilities, institutionalizing the existing policies on
cybersecurity is indispensable, particularly the current National Cybersecurity Plan, which echoes the
need to strengthen the country's policy framework on cybersecurity to promote peace and security
alongside economic growth and development.

As the most pivotal pillar of cybersecurity strategy, the creation of the proper policy framework
in the face of misaligned incentives, asymmetric information, and externalities is urgently needed,
especially because certain cybersecurity policies under the National Cybersecurity Plan require legislation.
This will help set societal standards and norms at all levels of government, lay down the foundation for
executive action, and secure the cooperation of the public.

"hups. ems-cdne.gov.ph DICT pdf NCSP-2023-2028-FINAL-DIC E.pdt


Further, the International Telecommunications Union's 2024 Global Cybersecurity Index (GCI)
gave the Philippines a Tier 2 score, given to countries obtaining an overall score of at least 85 to 94 out
of 100, by demonstrating a strong cybersecurity commitment through coordinated and government-
driven actions that encompass evaluating, establishing or implementing certain generally accepted
cybersecurity measures, Thus, this proposed "Cybersecurity Act” is a huge and tangible leap in support
of such commitment.

Among its salient features include the institutionalization of the Philippine Cybersecurity Council
(PCSC), which shall be an inter-agency body administratively attached to the Office of the President and
headed by the Director-General of the National Intelligence Coordinating Agency (NICA) and co-chaired
by the Executive Secretary and the Secretary of the Department of Information and Communications
Technology (DICT), as well as the formulation of a National Cybersecurity Plan (NCP) to strengthen the
country’s institutional capacity to protect systems, networks, and programs from digital attacks and
promote security and resilience of the Philippine cyberspace.

The bill seeks to transform key policy reforms recommended under the National Cybersecurity
Plan into laws e.g., information sharing and mandatory disclosure of cybersecurity incidents, mandatory
notification by internet service providers (ISPs) for malware infection and Internet of Things (IoT)
botnets, and adoption and implementation of standards to protect inter-domain internet protocols (IP)
routing protocols, among others.

In line with the directive of President Ferdinand R. Marcos Jr. to adopt and implement the National
Cybersecurity Plan 2023-2028 to strengthen the security and resilience. of Philippine cyberspace under
Executive Order (EO) No. 58 and in light of the imperative to legislate measures to strengthen
cybersecurity, immediate approval of this bill is earnestly sought.

KeithMicah waar Fe D.L. Tan

4th District, Quezon


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

TWENTIETH CONGRESS
First Regular Session

HOUSE BILL NO. 660

“Introduced by: Hon. Keith Micah “Atty. Mike” D.L. Tan

AN ACT
INSTITUTIONALIZING POLICIES FOR A SECURE, TRUSTED, AND RELIABLE CYBERSPACE,
STRENGTHENING THE GOVERNANCE OF CYBERSECURITY, ESTABLISHING FOR THE
PURPOSE THE PHILIPPINE CYBERSECURITY COUNCIL, AND APPROPRIATING FUNDS
THEREFOR

Be it enacted by the Senate and the House of Representatives of the Philippines in Congress assembled:
SECTION 1. Short Title. - This Act shall be known as the "Cybersecurity Act."

SEC 2. Declaration of Policy. - The State recognizes the vital role of communication and
information in nation building. The State also recognizes its inherent obligation to ensure that personal
data information and communications systems in the government and the private sector are secured and
protected. Towards this end, the State shall provide Filipinos a secure, reliable, and trusted cyberspace
through the formulation and enforcement of effective cybersecurity policies, and establishment of a
governance framework that shall efficiently coordinate government agencies and relevant sectors in the
preparation of proactive, timely, and appropriate response against cybersecurity threats.

SEC. 3. Definition of Terms. -

(a) Botnet or "robot network”refers to a network of computers infected by malware that is under

the control of a single attacking party;

Cybersecurity refers to the organization and collection of resources, processes, and structures

to preserve Confidentiality, Integrity, Availability, Non-Repudiation, Authenticity, Privacy and

Safety (CIANA-PS) in cyberspace;

Cybersecurity governance refers to the strategic approach that governs the implementation

and maintenance of cybersecurity measures, which are intended to protect information and

digital assets from cyber threats and unauthorized access;

(d) Cyberspace refers to complex environment resulting from the interaction of people or

software and services on the internet by means of technology devices and networks

connected to it, which does not exist in any physical form;

Distributed denial of service (DDoS) attack refets to a variant of a denial of service (DoS)

attack that employs very large numbers of attacking computers to overwhelm the target with

bogus traffic;

(f)_ Internet of Things (IoT) botnets refer to a network of compromised or infected Internet of
Things devices that can be remotely controlled by cybercriminals for malicious purposes;

(9) Malware refers a file or code, typically delivered over a network, that infects, explores, steals

or conducts virtually any behavior an attacker wants; and

National cybersecurity plan refers to the security policies, procedures, and controls required

to protect the country against threats and risk.

(b}

(

(e

(h

SEC. 4. National Cybersecurity Plan. - A National Cybersecurity Plan (NCSP) shall be formulated
to strengthen the country's institutional capacity to protect systems, networks, and programs from digital
attacks and promote security and resilience of the Philippine cyberspace.

SEC. 5. Philippine Cybersecurity Council. - The Philippine Cybersecurity Council (PCSC) is hereby
established, which shall be an inter-agency body administratively attached to the Office of the President.


The Council shall be headed by the Director-General of the National Intelligence Coordinating
Agency (NICA) and co-chaired by the Executive Secretary and the Secretary of the Department of
Information and Communications Technology (DICT). It shali be composed of the following officials as
members:

(a) Secretary of the Department of Foreign Affairs (DFA);

(b) Secretary of the Department of Finance (DOF);

(c) Secretary of the Department of Science and Technology (DOST);

(d) Secretary of the Department of Interior and Local Government (DILG);

(e) Secretary of the Department of Justice (DOJ);

(F) Secretary of the Department of Energy (DOE);

(g) Secretary of the Department of National Defense (DND);

(h) Secretary of the Department of Transportation (DOTr);

(i) Secretary of the Presidential Communication Operations Office (PCOO);

() Secretary of the Presidential Communications Development and Strategic Planning Office
(PCDSPO)

(k) Commissioner of the National Telecommunications Commission (NTC);

(I) Director of the National Bureau of Investigation (NBI);

(m)Chief of the Philippine National Police (PNP);

(n) Chief of Staff of the Armed Forces of the Philippines;

(0) Chairman of the National Privacy Commission (NPC);

(p) Executive Director of the Anti-Terrorism Council-Program Management Center

(ATM-PMC);

(q) Executive Director of the Cybercrime Investigation and Coordinating Center

(CICC); and

(r) Governor of the Bangko Sentral ng Pilipinas (BSP) as members.

The Office of the Deputy Director General (ODDG) for Cyber and Emerging Threats established
under NICA shall serve as Secretariat to the Council.

The Council may invite concerned public and private agencies or entities to participate,
complement, and assist in the performance of its functions.

The Council shall collaborate with the Anti-Terrorism Council (ATC) on matters relating to cyber-
terrorism,

SEC. 6. Powers and Functions. - The Council shail be the primary authority to exercise powers
and functions that would address all cybersecurity related matters. It shall perform the following
functions:

(a) Assess the vulnerabilities of the country's cybersecurity;

(b) Capacity building for the purpose of responding to cybersecurity threats and emergencies;

(©) Issue updated security protocols to all government employees in the storage, handling and
distribution of all forms of documents and communications based on the best practices and
update the same as necessary;

(d) Enhance the public-private partnership in the field of information sharing involving
cyberattacks, threats and vulnerabilities to cyber threats;

(e) Conduct periodic strategic planning and workshop activities that will reduce the country's
vulnerabilities to cyber threats;

(f) Direct its member agencies and appropriate agencies to implement cybersecurity measures
as may be required by the situation;

(g) Serve as the country’s coordinating arm on domestic, international, and transnational efforts
pertaining to cybersecurity;

(h) Make such recommendations and/or such other reports as the president may from time to
time require; and

(i) Perform such other functions as may be necessary.

SEC. 7. Meetings of the Council. - The Council shall hold regular meeting every quarter and such
special meetings as may be necessary upon the request of the chairman or upon the request of at least


two (2) of its members.

SEC. 8. Reportorial Requirement - The Council snail submit quarterly report, or as often as may
be necessary, to the President of the Philippines and to Congress on the state of cybersecurity threats
and other related information.

SEC. 9. Cybersecurity Bureau. - The DICT shall develop an effective and efficient cybersecurity
organization and structure to strengthen its Cybersecurity Bureau (CSB). It shall expand the operations
of the National Computer Emergency Response Team (NCERT), which shall be tasked to respond on
cybersecurity incidents and conduct investigations; and the National Security Operations Center (NSOC),
which shall be primarily responsible in monitoring critical information assets in cyberspace, perform
vulnerability assessment and penetration testing (VAPT) services, and conduct baseline assessment of
cybersecurity posture of agencies of government.

The NCERT and the NSOC shall be operated and staffed on a twenty-four (24) hour basis under
the CSB.

SEC. 10. Modernization Program. - The Council shall, in consultation with the relevant agencies
of government, develop a modernization program that will strengthen the monitoring of cybersecurity of
national government agencies and local government units (LGUs). The modernization program shall
include the provision of a centralized incident response system for government that allows the delegation
of incident tickets to government agencies and LGUs to monitor their progress and ensure a single view
of all cybersecurity incidents.

SEC. 11. Reporting of Data Breach. - Government institutions, agencies, instrumentalities,
including government owned and controlled corporations, private corporations, companies and business
establishments, operating wholly or partly in the Philippines, are required to report to the Council, within
a reasonable period of time, all kinds of data breach occurring in their jurisdiction. The Council shall
conduct trainings on cybersecurity to all stakeholders for the effective implementation of this provision.

SEC. 12. Mandatory Notification by Internet Service Providers for Malware Infection and Internet
of Things (IoT) Botnets. - To mitigate the threat of malware and botnets in the country, all internet
service providers (ISPs) shall be required to implement a malware notification scheme, including internet
of things (IoT) Botnets, and immediate performance of a cleanup of malwares detected.

ISPs are mandated to conduct effective countermeasures including, but not limited, to the
following:

(a) Performing cybersecurity hygiene in their Customer Premise Equipment (CPE) such as
changing the CPE default password, disabling unused ports, and other hardening measures
for CPE;

(b) Notifying those infected by malware and providing clear but concise instructions on how to
clean their devices; and

(c) Complying with requests for quarantining network segments which are attempting a
distributed denial of service (DDoS) attack or identified as part of a command and control
structure of a ransomware, malware, or botnet.

SEC. 13. Threats and Baseline Assessments of Government Cyberspace Assets. - The Council shall
develop capability to automatically scan all government and critical information infrastructure assets
exposed in the internet for their vulnerabilities, and provide a risk score to these scanned threats. The
scores and vulnerabilities scanned shall be kept confidentially and shall be provided to the owners of the
scanned cybersecurity assets. Owners of these compromised assets shall report to the Council how
vulnerabilities were mitigated.

The Council shall develop and/or acquire the necessary tools to ensure that the assessments are
stored and disseminated to all government agencies. Private security research shall be allowed to report
their own findings subject to the necessary guidelines that the Council shall issue for responsible
disclosure of vulnerabilities. Legal protection shali be provided to any security researcher disclosing any
vulnerability found in any cyberspace asset.


SEC. 14. National Cybersecurity Threat Database. - The Council shall develop a national
cybersecurity threat database, which shall be accessible to the public. The list of threats shall be curated
based on the category of the threat and the type of the threat based on their common vulnerability
scoring system (CVSS), category and type. The threat database shall be updated regularly.

The Council shall develop and maintain a website to inform the public of the latest trends in
cybersecurity and to issue advisories.

SEC. 15. Standards to Protect Inter-Domain Internet Protocol (IP) Routing Protocol. - The Council
shall, in consultation with the NTC, DICT, DOST, and telecommunications providers, adopt and implement
standards for securing inter-domain internet protocol (IP) routing protocol, particularly Border Gateway
Protocol (BGP) to attain national compliance for securing inter-domain routing.

SEC. 16. Partnership with Digital Online Platforms, - The Council shall initiate robust and
meaningful partnerships with digital online and social media platforms to create 2 mutually acceptable
protocol for reporting, correcting and mitigating misinformation, and online harms in line with the need
to regulate digital online platforms, including social media platforms.

SEC. 17. Multi-Disciplinary Approach. - All government agencies, including LGUs, are enjoined to
improve and develop their own cybersecurity strategies, sub-plans, and teams consistent with the
provisions of this Act.

SEC. 18. Declaring the Month of October as Cybersecurity Awareness Month. - The month of
October of every year is hereby declared as “National Cybersecurity Awareness Month”.

Pursuant to the observance of National Cybersecurity Awareness Month, an annual program of
activities shall be prepared and implemented, with the NICA and the DICT as lead agencies. They are
authorized to call upon any department, bureau, office, agency, or instrumentality of the government,
including government-owned or -controlled corporations, for any assistance as may be needed.

The Philippine Information Agency, in coordination with the NICA and the DICT shall ensure the
effective information dissemination pursuant to this provision.

All LGUs and private organizations including the civil society organizations, private enterprises,
and non-government organizations, civic, and people's organizations, are encouraged to observe National
Cybersecurity Awareness Month in simple rites and participate in the activities.

SEC. 19. Penal Provisions. - Any violation under Sections 11 and 12 of this Act, after due notice
and hearing, shall be penalized with imprisonment of not less than six (6) months but not more than two
(2) years or a fine of not more than One (1) million pesos, or both at the discretion of the court.

SEC. 20. Appropriations. - The amount of necessary to carry out its functions shall be included in
the annual General Appropriations Act.

SEC. 21. Jmplementing Rules and Regulations. - The NICA and DICT, in consultation with relevant
agencies, shall jointly formulate the necessary rules and regulations within ninety (90) days from approval
of this Act.

SEC. 22. Separability Clause. - If any provision of this Act is held invalid, the other provisions not
affected shall remain in full force and effect.

SEC. 23. Repealing Clause. - All laws, decrees, orders, rules and regulations or other issuances
or parts thereof inconsistent with the provisions of this Act are hereby repealed or modified accordingly.

SEC. 24. Effectivity. - This Act shall take effect fifteen (15) days after its publication in the Official
Gazette or in any two (2) newspapers of general circulation in the Philippines.

Approved,