Digital Reality Bites: Alternative Media in the Crosshairs of Cyber Attacks

To mark World Day Against Cyber-Censorship, the Southeast Asia Press Alliance (SEAPA) recalls the specific incidents when target news sites were forced offline

Alternative news organizations play a crucial role in informing the people about issues and concerns of public interest that are usually overlooked by the mainstream media. They provide a platform for voices in society that are conveniently ignored, or worse muted, by state and non-state actors alike.

It is precisely this role that makes these segments of the media prone to digital attacks, leading to their sites’ take down. Often, not just once but repeatedly.

Fiercely independent BulatlatKodao ProductionsPinoy WeeklyAlterMidya, and the National Union of Journalists of the Philippines (NUJP) have found themselves in this conundrum, with little, if any, prospect of an end to their digital woes.

Cyber attacks have also targeted other news organizations, which are known for their independence and no-nonsense approach to their work, such as the Philippine Center for Investigative Journalism (PCIJ) and VERA Files since President Rodrigo Duterte took office, prompting suspicions that their stories deemed critical of the policies of the current administration have triggered the online assault.

Since 2016, when Duterte assumed office, at least 10 cases of cyber onslaught against select news outlets have been documented.

A form of censorship, such attacks make information inaccessible to the public, thus undermining freedom of expression and the people’s right to know.

What is a DDoS Attack?

There are various cyber attacks that can be perpetuated against groups or individuals online. A common attack deployed against alternative news websites in the Philippines recently is the distributed denial-of-service (DDoS) attack.

But what is a DDoS attack?

In a nutshell, DDoS attacks, according to the Electronic Frontier Foundation (EFF), “aim to make online resources temporarily or indefinitely unavailable by flooding them with so much traffic that their intended users cannot access or use them.”

Websites receive traffic from its users on a regular basis but DDoS attacks send unusual volume of traffic overwhelming its capacity until it can no longer be accessible.

“Attackers build their ‘army’ of computers by spreading malware through email, social media, and various websites. Once infected, these networks of computers (‘botnets’) are exploited without their owners’ knowledge to launch a DDoS attack against a target online service,” EFF said.

“DDoS attacks target a variety of services, ranging from banks and corporations to websites belonging to human rights organizations or political dissidents. As these attacks aim to prevent the publication of and access to information on target websites, they can constitute a form of censorship.”


SOURCE: “What is a DDoS attack?”, Electronic Frontier Foundation

Bulatlat, Pinoy Weekly, Kodao Productions websites down

The websites of Bulatlat, Kodao Productions, and Pinoy Weekly were inaccessible on 26 December 2018. (Alternative news sites down in cyber-attack, 28 December 2018)

Pinoy Weekly, in a Facebook post, said their server informed them that the website was “temporarily suspended” as the high volume of traffic on the website was affecting other sites.


Screenshot of Pinoy Weekly Facebook post. 

While Kodao’s website was back up evening of 26 December, it was again inaccessible two days later, with its home page flashing this message, “the account has been suspended.”

In a statement, AlterMidya (a portmanteau of the words alternative and media) said: “Their websites were evident targets of distributed denial of service or DDOS attacks, which made the websites inaccessible since December 26. The shutdown of these websites apparently happened after the news outfits posted articles about the Communist Party of the Philippines’ 50th anniversary.” (Alternative media under siege, 28 December 2018)

Kodao Productions website hacked

The December 2019 hacking incident was not a first for the website of Kodao Productions under the Duterte administration. It was hacked on 6 February 2018. (Kodao Productions Website Attacked, 6 February 2018)

Kodao Productions, in a Facebook post, said their website was down since midnight of 2 February 2018. They said their site admins could not access the website.

The website went back online on 28 March 2018, nearly two months since the attack. Kodao Productions said the website suffered a “‘code injection attack’ that wiped out its files and prevented its online managers from logging in …” (Kodao website is back online, 28 March 2018)

“Its last stories were about the arrest of National Democratic Front of the Philippines consultant Rafael Baylosis and companion in Quezon City before the attack.”

Bulatlat website attacked again

Bulatlat’s website went down again after receiving continuous DDoS attacks from 19 to 29 January 2019. ([Philippines] Cyber attacks continue against alternative news website, 30 January 2019)

“This is yet another attempt to infringe on press freedom and the people’s right to information,” Bulatlat said in a Facebook post.


Screenshot of a Bulatlat Facebook post.

Bulatlat has received support from the Sweden-based group Qurium Media Foundation, which has been helping alternative news organizations monitor and mitigate the attacks. (Alternative news agency from Philippines ‘Bulatlat’ under denial of service attack)

AlterMidya website down after DDoS Attack

AlterMidya (People’s Alternative Media Network), “a network of independent and progressive media outfits, institutions, and individuals,” in a Facebook post on 8 February 2019, said “AlterMidya website down. We admins say this is caused by DDoS attacks similar to what Bulatlat and Kodao Productions experienced in past weeks.”


Screenshot of AlterMidya Facebook post.

Qurium Media Foundation confirmed through a Twitter post the cyber attack against AlterMidya:


Screenshot of Qurium Media Twitter post.

NUJP Website Attacked

The National Union of Journalists of the Philippines (NUJP) has also been the subject of cyber attacks under the Duterte administration. On 9 January 2017, NUJP’s website was inaccessible due to a “massive denial of service” attack. (NUJP Website Attacked, 10 January 2017)

NUJP said “whoever are responsible for this attack are enemies of press freedom and of free expression.”

Its website was again briefly inaccessible twice on 8 February 2019 following a DDoS attack that  happened at 6 a.m. and 6 p.m. The site was back up later, at 8:30 p.m.

“We believe the attack on NUJP site is related to the ones launched against Bulatlat and alternative news sites Kodao Productions and AlterMidya, all of which host NUJP chapters,” NUJP said in a statement. (Cyberattack downs NUJP website twice, 11 February 2019)

On 11 February 2019, NUJP’s website was down twice again after it was hit by DDoS attacks. The first one was recorded between 8 a.m. and 10 a.m., and was restored that same morning. Another attack was recorded mid-afternoon; the website was back online at 4:15 p.m. (DDoS attacks on NUJP, alternative media continue, 11 February 2019)

“According to the initial report of our security auditors, the attackers’ most requested URL path is https://nujp.org/?s=duterte, a page that appears when keyword ‘Duterte’ is searched on the website,” NUJP said.

“We strongly believe this is part of an orchestrated campaign to silence critical outfits and organizations … (it) has also targeted alternative news sites such as those of our affiliates, Bulatlat, Kodao Productions, AlterMidya, and its latest target, Pinoy Weekly,” NUJP said.

PCIJ Website Hacked

The Philippine Center for Investigative Journalism (PCIJ) said in a 29 July 2016 Facebook note that their website (http://pcij.org) and blog site (http://pcij.org/blog) were hacked and were thus inaccessible. (PCIJ Websites Attacked, 29 July 2016)

“The attack follows the publication of PCIJ reports on the drug war of the Duterte administration, and our ‘Know Your Rights’ advisories for citizens,” PCIJ said.


Screenshot of PCIJ Facebook note.

The hacking of PCIJ’s website is the first recorded news website attack under the Duterte administration.

VERA Files Website Down

The website of VERA Files was down twice shortly after it published on 21 January 2018 a report about the failure of Duterte and his daughter Davao City Mayor Sara Duterte-Carpio to declare their alleged investments worth millions in their statement of assets, liabilities and net worth. (Cyberattack downs VERA Files website after report on Duterte, Sara’s allegedly undeclared millions, 23 January 2018)

VERA Files said their website was hit by a DDoS attack 30 minutes after publishing the story. It went back up around 2 a.m. the next day and was attacked again at 6 a.m. The site went back up before noon. (Vera Files reports cyberattack after publishing story critical of Duterte, 23 January 2018)

What Now?

Bulatlat and other alternative media organizations is set to hold a protest action on Tuesday, 12 March 2019, World Day Against Cyber Censorship, in front of the National Computer Emergency Response Team ( NCERT) unit of the Department of Information and Communications Technology (DICT) office C.P. Garcia, Quezon City in the Philippines at 10 a.m.

Qurium has called on NCERT to investigate the DDoS attacks against the alternative news sites but NCERT has yet to respond. Bulatlat said they will file a civil action case against IT companies where the attacks are being launched. #