The price of liberty is eternal vigilance, said Thomas Jefferson so long ago. Today, we are reminded of this truism. Today, we were this close to allowing an intrusion into our privacy for what was nothing more than security theater. Today, even in the face of such full-throated bipartisan support for the passage of the SIM Card Registration Bill into law, the President vetoed it not only because the constitutional defects were glaring, but because the passage of this law posed a real and serious threat to our national security.

For this successful defense of our values and beliefs there are many who deserve thanks.

First, we thank the President for showing up at the front line of the defense of the Bill of Rights. We thank the hardworking persons in our government who work tirelessly to ensure that we do things the right way.

We thank those who have always led the way in defending our rights and freedoms, especially online. We thank the Foundation for Media Alternatives, Wiki Society of the Philippines, Data Ethics PH, Philippine Computer Emergency Response Team Coordinating Center, Computer Professionals Union, Testudo, Human Rights Online Philippines, Python Philippines, Blogwatch, Bicol IT, PHP Davao, Wordpress Iloilo, PWA Philippines, Philippine Information Technology Organization, Dakila, UP Internet Freedom Network, PizzaPy, UP College of Engineering Department of Computer Science, UP Visayas Komsai, Team Good Knight and other organizations who joined the call to petition the President to veto this bill.

We thank international organizations like Mozilla and Wikimedia Foundation for the solidarity they gave in calling the Philippine government to action.

We thank the more than 83,000 people that signed our petition on the Change website calling for the veto of this bill.

You all are instrumental in defending liberty.

Any attempt to redraw this law once more must return to the halls of Congress, which must be again chastened by the checks and balances so instituted to ensure that “we are a government of laws, not men.”

###

Introduction: On February 2, 2022, the Senate and House of Representatives passed a bill that seeks to send Filipinos to jail for a minimum of 6 years and/or pay up to a P200,000 fine for registering social media accounts under a fictitious name.

This bill will also force Philippine residents to hand over their phone numbers to social media providers. There are 2 ways of doing these: social media companies will be forced to collect users' government IDs, or the Philippine government creates a database of users' social media accounts. Effectively, this bill criminalizes the right to anonymity and pseudonymity on the Internet and is a violation of Filipinos' rights to privacy, freedom of speech, and freedom of association. Given tech company and Philippine government data leak track record, this is also cybersecurity disaster in the making. Victims of data leaks will be exposed to scammers and criminals, especially since phone numbers are now used for e-banking and financial transactions like G-cash and PayMaya. This bill is now just awaiting President Rodrigo Roa Duterte's signature and there may be less than 15 days before it becomes Philippine law.

To find out what you can do, scroll to the end.

[ Full text of the bill ]

Statement

We urge President Rodrigo Roa Duterte to veto the bill entitled "An Act Eradicating Mobile Phone, Internet or Electronic Communication-Aided Criminal Activities, Mandating For This Purpose Ownership Registration of All Subscriber Identity Module (SIM) Cards For Electronic Devices and Social Media Accounts", also known as the "Subscriber Identity Module (SIM) Card Registration Act" recently ratified by the Senate and House of Representatives of the Philippines.

The intent and purpose of trying to eliminate illegal activities enabled by mobile phones, the Internet, or other electronic communication-aided crimes is noble. However, the bill is deeply flawed. It contains provisions that are overly vague, violates constitutional guarantees of freedom of expression, freedom of association, personal privacy, and endangers the safety of Filipino citizens and children.

While the benefits of SIM card registration are still under debate, of utmost concern are the provisions on social media registration.

The law is overly vague. It does not provide the definition of "social media", which can include blogs, business networks, collaborative projects, forums, photo sharing services, product/service review platforms, social gaming, social networks, video sharing, and virtual worlds according to experts. It treats certain actions as if they were already crimes, such as "trolling", "hate speech", and "spread of digital disinformation or fake news", even though this currently finds no basis under existing Philippine laws, and then invokes them to justify the need for the law and its oppressive impositions.

It forbids the usage of fictitious identities when registering accounts, meting out the draconian punishment of a minimum of 6 years in prison and/or a fine of up to ₱200,000. Essentially, it criminalizes anonymity and pseudonymity on the Internet – legitimate norms used by individuals who wish for privacy, artists/writers who use pen and stage names, parody/entertainment accounts, activists, dissenters, human rights defenders, LGBTQI, victims of abuse and violence, witnesses, whistleblowers, investigative journalists, and legitimate cybersecurity research and law enforcement operations.

Even the leaders who shaped our nation’s identity made use of fictitious names to freely express themselves: Jose Rizal (Laong Laan, Dimasalang), Antonio Luna (Taga-Ilog), Marcelo H. del Pilar (Plaridel), Andres Bonifacio (Agapito Bagumbayan), Emilio Jacinto (Dimas-Ilaw, Pingkian), and many others. In essence, were our heroes alive today, the state would be branding them as criminals.

Moreover, the requirement that corporations like social media providers mandatorily collect real names and private phone numbers even when they are normally optional, puts Filipino citizens in jeopardy. From a cybersecurity perspective, the law is creating additional vulnerabilities for individuals because of the potential for data breaches. Even the most well-funded companies and institutions are not immune to hacking and data leaks, like what happened to Yahoo in 2013 and 2014 and Facebook in 2019 and 2021 where the names and personal phone numbers of users were spread on the Internet. Should these reoccur and citizens’ names and phone numbers leak, it will open them to harassment, identity theft, financial crime, and other forms of harm.

Aside from these, the bill poses a dire threat to children’s safety. Forcing children to register with their real names on social media like in online games or communities may expose their real names to complete strangers on the Internet, opening them to harassment, doxing, scams, kidnapping, and even child sexual predators.

Finally, the enumerated provisions will not achieve their intended goal of eliminating illegal activities due to numerous loopholes which can be exploited by bad actors. For example, the bill cannot penalize pre-existing accounts created with fictitious names, the same with accounts created by individuals outside the Philippines. Criminals may still use fake IDs to evade being caught. And even if lawmakers issue new rules, there is no guarantee platforms will follow them – like in the case of Telegram which has ignored German government requests as it operates outside of German jurisdiction.

We pray that our good president sees wisdom in these inputs and vetoes this dangerous bill.

As individuals, you can sign the petition at change.org/vetosocmedreg.
Yes, we realize the irony of signing with your name.
For organizations, institutions, or private companies, see instructions at the bottom of this page.

We will print the statement, along with our signatures, and physically send them to the Office of the President.

Frequently Asked Questions (FAQs)

Q: What is this all about? Where did it start?
A: In an effort to fight crimes committed with the aid of mobile phones, many iterations of the SIM Card Registration Act have been filed over the years. Last December 2021, a certain senator inserted Social Media provisions into the latest SIM Card Registration Act as a "quick-fix" to stop trolls and anonymity on the Internet. The bill was passed by both the Philippine Senate and House of Representatives and ratified around Feb. 2, 2022, in less than 2 months after these provisions were inserted, without sufficient consultation from industry and stakeholders.

Q: Why have I not heard of this before?
A: This is because the short name of the bill is the "SIM Card Registration Act", and it is how it is referred to by the media. In actuality, it should be the "SIM Card and Social Media Registration Act" because of the Social Media rider that was stealthily inserted in December and speedily passed with not enough consultation, discussion and deliberation. The full name of the bill is "An Act Eradicating Mobile Phone, Internet or Electronic Communication-Aided Criminal Activities, Mandating For This Purpose Ownership Registration of All Subscriber Identity Module (SIM) Cards For Electronic Devices and Social Media Accounts". This is also why we are raising awareness. Help us with the movement and share this to your friends and people you think would be affected. For purposes of tracking the online reactions, please use #VetoSocMedReg

Q: Where can I view the text of the bill? It is not available on the Senate or House of Representatives websites.
A: The latest version that is visible to the public as of this writing is Senate Bill No. 2395 (SBN-2395), but it is from September 13, 2021 when the Social Media provisions were not yet inserted. The final bill consolidated by the Philippine Senate and House of Representatives last February 2, 2022 may be viewed here.

Q What is the definition of social media?
A: The ratified bill does not define it, and it is not defined in Philippine law. If we take international definitions, it can be very broad and can include: blogs, business networks, collaborative projects, forums, photo sharing services, product/service review platforms, social gaming, social networks, video sharing, and virtual worlds. Source.

Q: How does this bill affect me, a normal citizen who uses social media?
A: If you create a new social media account using a fictitious name, you can go to jail for a minimum of 6 years and/or pay a fine up to P200,000. You are also required to hand over your phone number to the social media provider, even if it was originally just optional. The proposed law does not say what will happen to you if you do not provide your phone number.

Q: Why are you scared of losing anonymity or pseudonymity? Are you a criminal?
A: No, we are not criminals. We are merely defending our constitutionally protected rights. There are many valid reasons why one would desire anonymity or use an alias when using the Internet and social media such as: desiring privacy, artists/writers who use pen and stage names, parody/entertainment accounts, activists, dissenters, human rights defenders, LGBTQI, victims of abuse and violence, witnesses, whistleblowers, investigative journalists, and legitimate cybersecurity research and law enforcement operations. This bill will turn all of those use case scenarios criminal.

Q: I am none of the above, nor do I need those use case scenarios. Why should I care?
A: That is like saying "Why should I care about the Filipinos devastated by Typhoon Yolanda when I am safe and snug in Metro Manila?" Moreover, the bill poses many dangers to Filipino citizens.

Q: Why is this bill dangerous?
A: Hackers are very creative and data on the Internet can leak. If a company like Facebook which has billions of dollars at its disposal was not able to sufficiently secure the data of its users in 2019/2021, resulting in the release of full names and phone numbers of users on the Internet, what more smaller companies (or the Philippine government) with lesser cybersecurity budgets? This bill mandates that social media providers collect sensitive information like full names and phone numbers whether the providers want to or not. Saying "companies should just improve their cybersecurity, that will fix this" will not magically make it happen. By forcing users to hand over their sensitive information to socmed providers, they are being forced by the Philippine government to expose themselves to risk instead of them assessing the situation and registering voluntarily.

Q: Why should people care about revealing their real names on the Internet?
A: One does not normally go walking down the street with their full name plastered in front of them. In your everyday interaction with strangers, you do not normally tell them your full name for privacy reasons. Anonymity is the norm in the physical world. It should be too in cyberspace, which is full of strangers. The bill also does not specify age of the user, so minors may be included. Are you really going to let complete strangers know the real names of your children when they interact online? Always remember, our rights offline are our rights online. Privacy is our constitutionally-protected right.

Q: Why should I care if my phone number is leaked on the Internet?
A: Today, our online financial transactions are linked to our mobile phones whether through e-banking, or services like Paymaya and G-Cash. Moreover, there has been a 15-fold rise in SIM-swapping attacks over the past 2 years wherein criminals persuade, bribe or trick telco carrier support staff into transferring phone numbers from a victim's mobile SIM card to a SIM card in their possession. When this happens, victims' calls, texts (like OTPs - one time passwords) and other data are diverted to the criminal's device. Thus, if an attacker gets hold of your phone number combined with your real name, you can be financially crippled. There are a multitude of attacks that can also be orchestrated once this combination is learned by malicious parties: harassment, budol-budol/dugo-dugo scams, and possibly even kidnapping by luring a victim to a particular location via phone call.

Q: Can't we just wait until the bill gets signed into law and fix it in the IRRs?
A: No, because the bill is too defective. As the great Ateneo Law School Dean Emeritus Father Joaquin G. Bernas, S.J. said of the Cybercrime Prevention Act of 2012: "It will not do to say that whatever shortcomings there are in RA 10175 will be remedied by its IRR (implementing rules and regulations). Rules and regulations cannot cure defects in a law." According to Professor of Law in Media Law at the Ateneo Law School and the Immediate Past President (2021) of the Philippine Bar Associate (PBA) Rico V. Domingo: "There is a principle in administrative law which in laymanized phraseology says: 'The spring cannot rise higher than the sea.' Stated otherwise, the IRR cannot alter, modify, supersede, etc. the underlying law itself."

* Note: Above answers above are by no means exhaustive. Select issues have been chosen for the sake of brevity.

What can you do?

Share this page (democracy.net.ph/vetosocmedreg) to your social media circles to raise awareness. Be creative.

Use the hashtag #VetoSocMedReg.

Sign this petition at change.org/vetosocmedreg.

Call and/or e-mail your lawmakers. Your senators may be contacted here. Your House representatives may be contacted here.
Tag them on social media. Ask them to urge our president to veto the bill.

Call and/or e-mail the Office of the President of the Philippines here.

Contact/mention the Presidential Communications Operations Office (PCOO), on Twitter leave messages at their Facebook page, and e-mail them at [email protected].

Remember to be polite and always be respectful.

Monitor this page and our twitter account @phnetdems for updates.

We may have less than 15 days before this bill becomes Philippine law.

If we make enough noise, our president may listen to us and veto the bill.

SIGNATORIES

Individual signatories may sign at change.org/vetosocmedreg