‘SAFE, UNCRACKABLE’: City reconfigures contact tracing system, assures data security

By Joseph B.A. Marzan

 

The Iloilo City Government has suspended its online contact tracing system just three days after going live on the web, due to an influx of applications which are still being validated.

The Quick-Response (QR) code-based Uswag Tracer, which was launched on Monday, Nov. 16, 2020, became inaccessible to the public since Thursday.

The temporary rollback was confirmed by Iloilo City Mayor Jerry Treñas in an interview with Aksyon Radyo Iloilo on Friday.

Treñas said that the city government was “cleansing” the system because “people were registering twice or thrice”.

The mayor also stated that there is already a draft ordinance in the city to fully implement the contact tracing system.

Treñas executive assistant for information technology, Francis Cruz, told Daily Guardian via phone interview that they were still validating around 40,000 applications for a Quick Response (QR) code.

Cruz said part of the process was to send an email to the users applying which would request for a government-issued ID and a self-portrait of the user holding the said government-issued ID.

The city government only has four personnel conducting the validation according to Cruz.

He added that they put off the individual registrations for the meantime and focus on private and government offices which will also be using the system.

“We decided to put it off for a while, and concentrate on private businesses and government offices, because they will be the ones scanning the employees and visitors, so there is no point to put individuals first while we haven’t set up the places they would be going to,” Cruz said in a phone interview.

He also said they were doing technical reconfigurations for the registration process, such as the possible uploading of the users’ IDs and self-portraits directly on the website, instead of waiting for requesting emails.

He said that they are looking to re-open the website in between 10 to 12 days, or between the end of November or early December.

 

 

SECURITY, FUNDING CONCERNS

Cruz also responded to security concerns on the Uswag Tracer raised by various IT professionals.

One IT professional told Daily Guardian on Wednesday about the accessibility of the control panel or “Cpanel” to servers outside of the city hall, which would make it possible for hackers to obtain and control users’ information.

Cruz expressed confidence in the servers used by the city government, saying that they have measures in place to ensure the safety of users’ data.

He assured that the “ports” which were revealed to be available to Internet Protocol (IP) addresses outside of the city government are already private.

He likewise assured that the Cpanel will not be susceptible to “brute-forcing”, or the use of different username and password combinations to log into the system.

Daily Guardian found out that the Cpanel’s login page is still available using a home-based Wireless Fidelity (WiFi) connection after this interview was conducted.

The library and assets, which were still available for public view as of Wednesday, are no longer available.

“We have been receiving emails from IT professionals giving us advice. Our hosting is an international hosting and we are confident on the servers that we are using. The security and the firewalls and all the necessary measures for the integrity of the data is in place,” said Cruz.

About the funding and procurement processes of the contact tracing site, Cruz clarified that the site was an “in-house development” within the city government.

The website uses the “.com” top-level domain (TLD), instead of the “.gov.ph” being used by websites in national and local governments.

Cruz confirmed that he used his personal money to pay for the domain, not from the funds of the city government, due to time constraints.

“We have put [.com] temporarily. I am the one paying for that. We are rushing this, so that is temporary. [The city government] is not spending anything,” he said.