COLUMN-OPINION: OPINION ON PAGE ONE BY FRANCISCO TATAD – What if China’s declared purpose should change?

IN a recent column (“I’m a dictator, says DU30—is there any objection?”, The Manila Times, February 12, 2018), I wrote about President Rodrigo Duterte’s reported decision to allow Huawei, the leading Chinese information and communications technology solutions provider, to create a “facial recognition” surveillance system for the Philippine population.

This report has not been denied. To the contrary, many knowledgeable sources have tried to enrich the information while expressing serious concern about its broad national security implications.

I am not nearly half as technically capable as I would like to be, so I asked a competent analyst to give me an objective and unbiased assessment of the reported project. On condition of anonymity, he agreed to let me share his analysis with my readers. What follows is his brief.

The facial recognition system—how does it work?
Facial recognition typically works by comparing a face or picture of a face against a reference image. The reference image must usually be captured under specific conditions. Ears have to be visible. No eyeglasses can be worn. Photos taken for passports, visas, and some other photo-bearing cards (ID or credit) tend to follow these guidelines.

In a private or public security setting, cameras scan an area and an application looks for faces that are not recorded in an existing database. These aberrations trigger alerts that security services may decide to act on, or ignore, depending on their visual assessment of the situation.

If the DU30 administration intends to pursue a facial recognition project, this security application might be the declared justification. Given concerns like terrorism, insurgency, etc., this is not an objectionable application in itself.

What’s needed to make the project work
A network of cameras of sufficient resolution will serve as the data capture points. These are the eyes that see. The more areas one wishes to cover, the more cameras one will need.

On the back-end, there has to be an application (or software) of sufficient capability, run by computers with ample computing power, drawing from a properly populated database of facial information. This is what tells the eyes what to look for, and what alerts to trigger once the eyes see what the operators want the system to see.

Between these two points, a robust connectivity network must exist. A backbone of fiber optic cables serves as the main thoroughfares for information to travel from cameras/sensors to the back-end. The greater the scope of the project, the higher the overall connectivity requirement will be.

In areas where wired connections are difficult, costly, or tedious to employ, wireless connections may be used. The drawback here is that wireless connections are not as fast or secure as wired or closed networks.

What is Huawei?
Huawei is a Chinese firm founded by Ren Zhengfei. He graduated from the Chongqing University of Civil Engineering & Architecture, and then joined the People’s Liberation Army in the 1960s. He served, according to a 2012 Economist article, in the Engineering Corps’ information technology research unit, rising to the position of deputy director, but without holding military rank.

Huawei has grown to become one of the most dominant players in telecommunications equipment and technology. While its initial successes came from peripheral markets such as Africa, it now has a strong presence in countries like the United Kingdom and New Zealand. It has yet to penetrate the United States, owing to concerns that the Chinese government is funding Huawei, and that its technology might be used to either spy on people, or shut down communications infrastructure, should the Chinese wish to stage such an attack.

DU30’s initial project
In 2016, President DU30 wanted a hotline set up so that citizens could report crimes, calamities, and any incidents of graft and corruption. There were no appropriations for this project so the orders were to explore all other means to make this happen. Huawei, working through one of its Chinese partners, offered to set up a nationwide 8888 network (at an estimated cost of $250 million) for free. For unknown reasons, this prospect did not push through and the resulting shoestring hotline service was funded by other private entities.

The same Chinese partner, working through a Philippine partner, funded the construction of an operations center in Camp Aguinaldo for the National Disaster Risk Reduction & Management Council, under the Office of Civil Defense (OCD) of the Department of National Defense. This facility was intended to connect the 17 regions to the central offices of the NDRRMC. While a memorandum of agreement was entered into between the Philippine firm and the OCD, construction has yet to be completed and it is likely that the funds have been eroded by bureaucratic flux. It is likely that the funds for this initiative came from Huawei.

There is also the potential entry of China Telecom as a third player in the Philippine telecommunications industry. It is not certain if China Telecom will partner with a new local entity, or if it will invest in an existing firm such as Smart or Globe. Should China Telecom invest in Smart or Globe, Department of Information and Communication Technology Secretary Eliseo Rio, Jr. has stated that a new selection process will begin for a third player.

Reviving the broadband
It is highly possible that the entry of a third player might revive the national broadband network project (initiated and shut down during the Gloria Macapagal Arroyo administration). Part of the purpose of the NBN is to provide connectivity to all government offices. This would, theoretically, interconnect all computer networks across all government offices benefiting from the NBN.

An NBN would also create the backbone needed for a facial recognition project to build on. As Huawei remains one of the most dominant providers of telco equipment, any third player will likely be using Huawei appliances and technologies.

How will the facial recognition database be populated?
Normally, one has to register or have his/her data captured. If the government were to conduct a campaign to have everyone enrolled, it will take years before enough useful data is compiled for the system to work.

To get this initiative running as quickly as possible, it is reasonable to assume that existing information from government offices will be used to populate the facial recognition database. These would include passport data from the DFA, voter data from Comelec, members’ data from the SSS, GSIS, and Pag-ibig, and even Postal ID holders’ data from Philpost. Other possible sources include the LTO’s driver license database, the clearance/license databases of the PNP and the NBI, and OFW data stored by OWWA, Marina, and related agencies.

Not all of these databases may contain photographs that are acceptable for facial recognition applications. What they will certainly have is fingerprint information, addresses, email addresses, phone numbers, and family contacts.

It is worth noting that few agencies are open to sharing their data with other national or local offices. If all these databases were to be compiled and used, it would create one database that is more detailed than any maintained by a single Philippine government agency.

How else can this information be used?
Once all these databases are consolidated, other analytic systems can be used to extract information beyond just facial identities. With enough computing power, and sufficiently sophisticated software, detailed queries can be made. Some potential use cases would include:

Mapping out specific demographics against geographic areas: where do the bulk of male Quezon City high school students live; how many senior citizen live in barangay 701, Manila; where in Mandaluyong can you find families of OFWs deployed in Saudi Arabian petrochemical plants; how many people in Cebu City are employed by the AFP or PNP?

Drawing matrixes for specific persons: I want to know more about Juan de la Cruz 3rd. If I enter his name into the appropriate system, I can see his personal information, pictures and details of his residence and office, the real estate and personal vehicles he owns, his registered businesses, his professional registrations, his foreign travel habits, his spouse, his dependents and where they study, etc.

Control of a mobile phone network also allows other information to be derived. How many subscribers move through main highways at what times of the day? Where do the bulk of these commute from and which city do they travel to for work? With enough computing power, it is also possible to track movements of particular phones/numbers across the mobile phone network and compare this to geographical maps.

If local government units’ databases are exploited, detailed maps of businesses, electrical power networks, telephone and Internet lines, and cell sites can be readily laid out against a city’s topographical/cadastral data. The possibilities are limited only by the level of technology present, and the creativity of the specialists building the analytics software.

A lesson from Singapore
The Singaporean Armed Forces works on the principle that, “what we cannot defend, we do not own.” Given incidents like ComeLeak, it is crucial to ask if the Philippine government can actually secure any data or data sources that it intends to make available via an NBN infrastructure, or a security/facial recognition project. Huawei services the UK market, but their devices are screened by the British equivalent of the National Security Agency (GCHQ, or General Communications Headquarters) before these are authorized for use in Britain. Despite this, some telecommunications security experts still argue that absence of evidence does not necessarily mean evidence of absence. It is for this reason that Huawei and ZTE have yet to successfully penetrate the US market.

Will peaceful intentions not change?
Also, countries like Britain, Australia, Singapore, etc. have a robust and capable cyber security agency. In the Philippines, the Department of ICT and its attached agencies (National Telecommunications Commission, National Computer Center, etc.) should be assuming these roles but their capability is well below that of threats coming from China.

It is also vital to weigh the strategic value of consolidated databases against geopolitical realities. The Art of War underscores the need to “know your enemy.” Secret intelligence services and state surveillance technologies exist to obtain as much information as possible on countries of interest. In times of peace, such information can be used to gain both political and economic advantage. Should a state prepare for invasion, any military campaign will also hinge on the extent and accuracy of information available concerning its objective.

Given the Chinese expansion in contested areas like the Spratlys, placing such information within Chinese reach cannot be regarded as insignificant. Equally important, placing government operations in the hands of a Chinese broadband/mobile telephone network that we cannot fully vet or secure, renders these operations vulnerable to shutdown if the Chinese maintain backdoors to the network. Both scenarios provide the Chinese military with strong disruptive capabilities should China’s intentions shift from peaceful engagement to overt aggression.

[email protected]