November 5 will test the next DICT chief

DECODED: TECH, TRUTH, AND THREATS

One of the first cybersecurity challenges awaiting the Department of Information and Communications Technology’s (DICT) incoming secretary may arrive on Nov. 5. The date is associated with the Million Mask March (MMM). The previous DICT leadership’s response to the events of Nov. 5, 2025, exposed what I consider serious incompetence in cybersecurity preparedness, technical judgment, and the handling of disruptions to government services.

MMM is an annual international protest associated with the Anonymous movement. Held on Nov. 5, it coincides with Guy Fawkes Day, which commemorates the failed 1605 Gunpowder Plot against England’s Parliament. Participants often wear the Guy Fawkes mask popularized by “V for Vendetta” to protest corruption, surveillance, abuses of power, and other grievances. Joining the march does not automatically make someone a hacker or a cybercriminal.

Threat actors, however, can exploit the occasion to publicize attacks. Let me be clear: no verified evidence suggests a coordinated cyberattack is scheduled for Nov. 5, 2026, but that is no reason for the incoming DICT leadership to be complacent.

The next secretary will inherit more than vulnerable systems. The position also comes with the responsibility to examine the questionable decisions and public explanations that characterized the previous leadership’s handling of cybersecurity incidents.

Ahead of Nov. 5, 2025, then-DICT Secretary Henry Aguda announced the activation of Oplan Cyberdome to protect government services and critical private infrastructure against possible distributed denial-of-service (DDoS) attacks. These attacks overwhelm websites with traffic, making them inaccessible to legitimate users.

Yet when Philippine National Police (PNP) websites became inaccessible, the police said DICT deliberately stopped their hosting as a preventive measure. The PNP attributed the resulting 502 gateway errors to that shutdown, rather than a successful attack. The main PNP website reportedly returned around noon on Nov. 6.

Five concerns arising from that response deserve the next DICT secretary’s attention.

First, the government accepted service denial as a defense against service denial.

The anticipated threat was that attackers would make websites unavailable. DICT’s preventive action made police websites unavailable anyway.

Taking systems offline can be justified when evidence indicates an imminent compromise or when isolation is necessary to prevent greater damage. But the public explanation did not establish why the shutdown was necessary or why other protections could not maintain service.

Citizens lost access regardless of who caused the outage. Leadership should have explained the threat, the alternatives considered, and the technical basis for the shutdown. Calling an action preventive does not, by itself, demonstrate sound cybersecurity judgment.

Second, Cyberdome was promoted without sufficient public evidence to support the protection it promised.

Aguda presented Oplan Cyberdome as an inter-agency mechanism for monitoring threats and coordinating responses. Coordination matters. But announcing an operation is not the same as demonstrating that it can keep government services running under attack.

An effective cybersecurity operation should be measured by the threats it contains, the services it preserves, and the time required to restore affected systems.

The concern resurfaced in September 2026, when DICT confirmed unauthorized access to the Department of Migrant Workers website and a defacement incident involving a Department of Labor and Employment web host. The government temporarily took affected services offline to contain the incidents, investigate, and address security concerns.

Those incidents involved detected intrusions, unlike the preventive PNP shutdown. Taking compromised systems offline can be legitimate containment. Still, they raise the question of whether government agencies have adequate protection, isolation capabilities, and continuity arrangements.

Cyberdome must protect services, not merely coordinate their shutdown. The previous DICT leadership owed the public clearer evidence of that capability.

Third, the previous leadership underestimated the consequences of unavailable public services.

At the Nov. 5, 2025 briefing, Aguda described the worst possible DDoS scenario as users being unable to access a website or application. He acknowledged that such disruption could cause serious inconvenience.

But the consequences can extend beyond inconvenience.

An unavailable government service can mean a failed transaction, a missed deadline, or delayed access to urgent information. As government agencies encourage citizens to depend on digital services, the obligation to maintain their availability becomes greater.

A secretary responsible for digital transformation should understand those consequences and plan around them. Citizens should not be expected to accept avoidable downtime simply because the government describes it as a precaution.

Fourth, public reassurance went beyond what the technical facts could establish.

Government advisories emphasized that DDoS attacks do not steal personal data, accounts, or money. That is technically correct when describing a DDoS attack itself. Such attacks primarily target availability, not information confidentiality. But identifying a DDoS attack does not rule out a separate intrusion occurring alongside it.

Attackers can also use disruptive activity to distract defenders from other malicious actions.

A responsible cybersecurity explanation should distinguish what investigators have confirmed from what remains under examination. Assuring citizens that a DDoS attack does not itself steal information is reasonable.

Implying that no other security risk exists without supporting evidence is not. Overconfident reassurance can damage public trust as much as an unexplained outage.

Fifth, error pages and competing claims were allowed to shape public understanding. While PNP websites were unavailable, HappyGoLuckyPH claimed to have compromised at least 68 police sites. The PNP disputed the claim, attributing the outage to DICT’s preventive shutdown.

The claim did not prove the websites were compromised. But the incident demonstrated how easily attackers can exploit an information gap. A competent response should include timely public notices, alternative service channels, estimated restoration periods when available, and regular updates.

When citizens encounter unexplained 502 errors, they cannot reasonably be expected to know whether a website is under attack, undergoing maintenance, or deliberately offline.

Public communication is part of incident management. It deserves the same preparation as the technical response. Taken together, these concerns expose a weakness in how the government has explained cybersecurity performance to the public. Cybersecurity is built around three essential objectives: confidentiality, integrity, and availability.

Protecting sensitive information is necessary. Preventing unauthorized changes to systems is equally important. But ensuring citizens can keep accessing essential services must not be an afterthought.

As a technology journalist and cybersecurity practitioner, I expect the next DICT chief to demand more than press releases, announcements, and assurances.

Government agencies need tested defenses against DDoS attacks, protected administrative accounts, reliable backups, effective monitoring, and rehearsed recovery procedures.

They also need continuity arrangements that keep essential services accessible while isolating affected components. The incoming leadership should commission a technical review of the November 2025 shutdown and examine the lessons from subsequent incidents.

The review should also determine whether agencies have tested alternatives to complete shutdowns and whether they are meeting recovery targets.

November 5 gives the next DICT secretary a chance to demonstrate better judgment. I understand that no one can guarantee that government websites will never be attacked or temporarily disrupted. The public can reasonably expect preparation, sound decisions, and honest explanations when services fail.

The public deserves functioning government services, credible protection, and explanations that withstand technical scrutiny. Cybersecurity cannot be considered successful merely because it kept attackers out.

The government must also account for the services citizens could not use. The standard should be simple: Keep essential services available, contain attacks quickly, and account for every disruption.

That is the competence the previous leadership failed to demonstrate convincingly.

However, one question remains unanswered: Who will be the next DICT secretary?