Entrepreneurs, Entrepreneurship, Founders, Philippines, Startups, Uncategorized

The Honest Guide to Startup Fundraising in the Philippines , Part 1 of 2

“At some point, everything’s gonna go south on you. And you say to yourself, ‘This is it. This is how I end.’  Now you can either accept that or you can get to work. That’s all it is.

You just begin. You do the math. You solve one problem. Then you solve the next. And if you solve enough problems, you get to come home.” – The Martian

**************

“Just close it down,” said my Dad, in no uncertain terms.

In the first quarter of 2015, my startup was dead in the water. We only had 3 months left of cash in the bank.

My father knew how to cut his losses. A serial entrepreneur, he’s tried many businesses over the years. And he wasn’t afraid to pull the plug when things weren’t going as planned.

Some context is in order. In the 2nd half of 2012, I raised a seed round of a few hundred thousand dollars. The objective was to grow a Gilt-style flash sales site. At that point, the startup was doing seven-digit revenues with profitable unit economics. It took about 6 months – fundraising in the Philippines is like our internet speed, slow AF – but it was easy to do. Valuation math is a breeze when you can divide percentages in your head.

But I made the mistake of listening to early advice to be lean, raise less now, and go for a bigger round in a year or two. I knew empirically that e-commerce – especially in infrastructure-void Philippines – needed immense scale. And scale required capital upfront.

That’s the first lesson of fundraising: never listen to advice that asks you to raise less than what you need. You know your business best, and investors have an incentive to doll out this advice – to cut your valuation, conserve their checkbook, etc.

Armed with our little funds, we adapted to the ruthless Darwinism of the free market: focusing on Metro Manila, building a brand, targeting the premium segment of the market that wasn’t price-sensitive (credit cards were 80% of our transactions, a rare outcome in this country), and hired 20 people. As a result, we grew gross revenue 6x in 2013.

Then the world changed. The flash sales model soon fizzled out as inventory ran dry. Though we had enough funds to cover overhead and customer acquisition, running lean meant we didn’t have enough to invest in inventory, R&D, logistics, and warehousing.

Merchandise revenue, which I forecasted to double in 2014, contracted by 10%. Normally, this wouldn’t be a disaster. But in e-commerce, growth is everything.

By the time 2015 hit, we had to move out of our office because we couldn’t afford the rent. I slashed my salary by 60% to make sure our employees made 100% of theirs. The COO I hired to help professionalize the business turned out to be a poor fit. Our CTO, who’s been with us from the start, had left. Morale sank.

I can’t say I wasn’t tempted to abandon the sinking ship. I had lots of other startup ideas. There’s been standing job invitations from a telco and a private equity firm, not to mention the constant inbound recruiting emails from Rocket Internet and Uber. I said no to all of them.

And as impossible as this situation sounds, it’s actually nothing out of the ordinary. 80% of startups fail within 3 years.

It was one of our customers that helped us out of the slump. It turns out that Kim Jones, before she became the huge brand ambassador she is today, was a customer. She loved our products, and one conversation led to another. In the middle of 2015, we launched her private label collection.

Remember that story about Airbnb’s founders selling cereal to make ends meet? Well, we did something similar too. It turns out our team was one of the few in town who actually had experience in building an end-to-end e-commerce platform from scratch. IT dev shops only knew the tech. Ad agencies only knew the marketing. We did everything. Our business experience allowed us to charge a premium. So a small side project for a brand turned into a multi-million deal that essentially saved the company. We were the cereal.

The rest of 2015 turned out to be a tumultuous year. There was acquisition talk with a prospective buyer, but we couldn’t agree on the price. A huge foreign e-commerce company offered a term sheet to lead a series-A, but freaked out when they faced massive foreign ownership restrictions in mass media and retail. The founder wanted to take his private jet and fly here to Manila, but was advised by his security team not to. Besides, that pretty young starlet he was dating kept him busy. Then, our original investor invested in the competition instead. Another local angel wanted to invest, but I no longer wanted to take capital if it was in small amounts.

All this was a distraction: each had no meaningful contribution to the goal of building a business.

As we entered 2016, there was only one move left to make: make the venture cash-flow positive. It was time to take our destiny into our own hands.

We launched another site, cut non-performing staff, and built an enterprise business doing digital strategy, e-commerce, and content, with local and international partners. By the end of 2016, our business turned cash flow positive after 2 consecutive years of steady growth. By 2017, we had more cash in the bank than when we started.

Meanwhile, it was a bloodbath in the local e-commerce market, as several local sites collapsed, among them well-funded international players. Only the biggest, most-capitalized foreign players, or well-run local sites remained.

There was immense joy in finding a win in a no-win situation. You will never have an experience as meaningful and gratifying as facing the brink of the abyss and coming out alive, middle finger raised to the air.

And when word quietly got around that we were one of the few profitable ventures in town, we started getting inbound emails from random investors, including some who had rejected us before. Some clients offered to invest. I politely declined all of them.

This story is relevant because in a recent survey, 94% of PH startups see themselves raising funding in the next three years. Most will fail.

They’ll all go through the same journey we did, more or less. The excitement of a small group of friends wanting to conquer the world. The euphoria of winning a pitching competition and attracting media attention. Launching product. Getting your first few customers. And the brutal counterpunch of reality. Just another day in startup land.

The startup scene in the Philippines is like masturbation – lots of fantasizing, ego-stroking, and wish fulfillment, but not much real action going on.

Founders will read Techcrunch and Tech-in-Asia, join pitching competitions, attend conferences, and regale at the stories and startup advice of this month’s speaker – who by the way is either a government buffoon or is someone who has never built a business with his/her own capital before.

All this only increases the gap between wishful thinking and reality.

The stark reality is that if one looks at a map of Southeast Asia, you’ll see that the Philippines sits apart. It has the smallest venture capital market (in # of deals and value). It’s overlooked by the much bigger regional funds in favor of Singapore and Indonesia. There are very few really good angels, and a lot of predatory ones.

There’s been a number of initiatives over the years to change that, but none have really worked, thanks to the combination of a protectionist Constitution, our underdeveloped capital markets, and the complex regulatory environment (all topics worthy of exploration in a separate article). Just look at our foreign investment metrics as proof. Even Vietnam is eating our lunch.

Thus, scarcity drives the local startup game. And that’s the big point of this post if you’ve made it this far: because the game is stacked against founders, to raise startup funding in the Philippines, you have to make investors believe you don’t need the funding.

And the most empirical way to demonstrate this is to build a cash-flow positive venture. That’s all there is to it. Don’t repeat our mistake in delaying cash-flow positive status to after your 2nd or 3rd funding round.

Because of the smaller early stage funding market relative to Singapore or Indonesia, I would argue that new local Filipino founders should:

1. Have a bias for picking ideas that can be funded by customers, rather than investors

2. Draw a solid plan to get to cash-flow positive ideally in the first year. Maybe two years – max.

3. Have a low enough cost base that can be funded by 1-2 clients if you’re B2B, or 100 customers if you’re B2C. Forget about it if you’re advertising-dependent (Facebook & Google have won).

4. If you do need to raise funding, treat it as a last resort, and give yourself a hard deadline, say, 6 months.

5. Start with regional investors rather than local ones.

6. Incorporate in Singapore, Hong Kong, or Delaware. Create a local operating subsidiary only if necessary.

This certainly narrows the space for the kind of startups the Philippines can build. But it’s not impossible. An enterprise-focused SaaS product with a strong consulting arm can certainly be cash flow positive within a year. Or a direct-to-consumer online store with only 100 monthly customers but PHP 5,000 ATV and low overhead can certainly be profitable.

“That all sounds good, Oliver,” you might say, “but aren’t startups all about growth? What about those ideas that need massive growth and scale to be profitable?

Sure, I’m not discounting the possibility of success for such models. But the Philippines is not the place to start capital-intensive startups. You’ll need to be based in Singapore or Jakarta to access the capital needed to fund hyper growth, and simply have the Philippines as another portfolio country.

Which brings us now to an honest discussion about access to capital.

If you’re just starting out or if you’re cash-flow negative, you then need to figure out where you are in the local Startup Game.

The Game is defined by this 2×2 matrix. This matrix applies if you:

1. Want to do or are currently doing a startup

2. Have a reasonable amount of self-awareness

3. Have objective metrics on the viability of your product

Note that this matrix describes your starting point, not your end-state. It helps define your initial moves, not your destiny.

On the X-axis is your product. Does it have product-market fit, based on objective metrics – users, revenue, margins, retention, net promoter scores, etc?

Now, the Y-axis will likely sound controversial, but it’s the honest truth. On the Y-axis is a famous name: your family name, your school’s, or a previous company affiliation.

It doesn’t mean that raising is an impossibility, but your product will just have to be way better compared to someone in say, Singapore. When I was raising our first round, I got a lot of advice to mention my school or the fact that we won the Asia Pacific leg of the Harvard New Venture Competition – never mind that neither was a factor in our odds of success! But people are herd animals, and you would be wise to take advantage of this gap in human psychology.

The PH Startup Game (1)

If you have a great product and a famous name, go ahead and raise. Do one round and get to cash-flow positive.

If you have a great product, without a famous name, I’d argue not to waste your time fundraising. Instead, you need to get cash-flow positive ASAP. Keep a good SEO strategy for your startup’s name and a healthy LinkedIn presence, and wait for the inbound investor requests to trickle in. You get investors to pitch you rather than the other way around.

If you don’t have a great product, but have a famous name, your next moves will depend on the nature of your famous name. If it’s your school or company, then you might be better off working for Rocket Internet or Uber for 1-2 years to learn the ropes. These guys love brand name degrees. Pick the role wisely. If you want to be an entrepreneur one day, working as a Product Manager at Grab is superior to a sales job at Google.

If it’s a famous family name that you have but not a great product, you can likely syndicate together 1-2 years worth of runway. Manila is full mediocre businesses from children of tycoons and suckers posing as investors.

If you neither have have a great product nor a famous name, you have three options:

1. Learn how to build a great product on your own

2. Get a famous name by joining an awesome founder

3. Or my recommended option – do both of the above. This is best accomplished by working directly under a startup founder or the local GM of a global tech company. For example, the direct reports of guys like Ron Hose, Ravi Agarwal, Jerome Uy, Paul Rivera, Nix Nolledo, Laurence Cua, Ken Lingan, or John Rubio will likely have great careers ahead.

That’s essentially the game. You need to recognize where you are to determine the right moves to make.

If you decide to take the fundraising route, stay tuned for Part 2 of this post, where I’ll talk about some of the tools you’ll need.

 

Advertisements
Standard
Uncategorized

This Valentine’s, Skip the Roses. Pay Your Damn Child Support Instead.

208effcb8d201021e700e1ed6289cc09.jpg

Daddy, you owe Mommy.

Dear ladies: chances are, you’re gonna get pregnant tonight. Actually, the data shows that your chances of getting pregnant remain disproportionately high compared to your Singaporean or Malaysian friends.

That’s because 1 out of 3 pregnancies in the the Philippines is unplanned. 1 out 10 teenage  girls between 15 and 19 is already a mother. In fact, we have the highest teenage pregnancy rate in Asia. And that figure is growing, in spite of teenage pregnancy rates going down around the world. There’s even a list of local celebrity moms.

You can probably count at least more than five women among your circle of friends who are single moms. I have so much respect for them. In my experience, they tend to be the hardest-working and most resilient people I know.

Though unplanned pregnancies are public health (lack of contraceptives keeps HIV rates high) and social justice (unwanted pregnancies hurt the poor the most) concerns, there’s something I don’t think the public data captures adequately: the cultural predisposition of Filipino men to avoid paying child support.

How many men involved in unplanned pregnancies actually pay for child support? I don’t know. But based on anecdotal evidence, I’m guessing not much. There’s even a House Bill seeking to criminalize this.

Maybe these men can’t afford it. There are more women college graduates than men, after all. Maybe they just want to break ties completely. Maybe it’s baggage that blocks out prospects of being with another woman. Maybe they don’t feel as responsible, since it’s a sunk cost: you’ve partaken in the short-term upside, but don’t bear the cost of the long term downside. Or siguro macho ka lang.

I got into an argument with a buddy of mine over this sometime back. “It’s not entirely the guy’s fault, you know,” was his consensus response.

And in my head, I’m like, “What a fucking cop out.” We all know which party usually initiates the sexual advance.

And we all know the classic Pinoy Bro trick: using unprotected sex to hold a woman emotionally hostage by demanding proof of her devoted, unconditional love.

“If you really love me, you’ll make me happy.”

Fuck that. So for all the ladies out there, I propose the following: do what whatever fits your lifestyle and values. It’s not my place to tell you how to live your life or treat your partners. But as downside protection, I suggest:

  1. If you are unmarried and he insists on unprotected sex, ask him to set up an escrow account in your name.
  2. Ask him to deposit 10% of his pre-tax income for every act. Naturally, verify his pay slip.
  3. Write an options contract requiring him to pay, in the event of an unwanted pregnancy, 50% of his income on the first trimester, 50% on the second, and so on, with 20% of his income going to ongoing support until your child’s 21st year.
  4. Ask some ex-Oplan Tokhang thugs to help enforce this contract. A better use of their time and killing drug addicts. I promise.
  5. And most of all, do not ever contemplate marriage just because you have a child together.

Happy Valentine’s Day!

 

Standard
Uncategorized

Jollibee Broke the Internet by Breaking Millions of Hearts. Here’s an Inside Look into the Playbook.

screen-shot-2017-02-10-at-5-20-23-pm

Seriously, Pure Evil.

I fucking hate that bride. “Thank you,” she whispers at the end.

I’m gonna take your tears, turn them into a crystal dagger, shove it into your friend-zoned heart, and turn the fragments into nails to hammer into your coffin. Oh, and yes, Father, I do,” was probably what was going on inside her head.

On the evening of Thursday, February 9, Jollibee posted two short films on Facebook, 4 hours apart. Both are killing it and breaking hearts everywhere.

I don’t eat at Jollibee. I don’t even like Jollibee. The Yum Burger tastes like I mixed ketchup, mayonnaise, and two spoons of sugar. Yeah I know, that’s blasphemous for a Filipino to say.

But today, Jollibee is winning with a series of short films about, well, love. The first one is about a boy who meets a girl at a Jollibee counter. The other is about a geek competing for a girl’s affection. And as folksy as those plot lines might sound, the ending won’t disappoint. Neither would I spoil them. Do check them out yourself, if you haven’t already.

As of 3:10pm on Friday, February 10, “Crush” has racked up 6.2 million views, while “Vow” has garnered a whopping 8.2 million views both in less than 24 hours. And it’s all organic. That’s insane.

The past few years have seen Filipino brands jumping on the content marketing bandwagon. The typical approach is to take a piece of film meant for TV advertising, and slap it on to Facebook. Spend several million to amplify its reach, then voila! Nestea did this and likely paid Facebook a ton of cash to get Liza Soberano plastered all over Pinoy feeds. I never thought I’d say this, but one can actually get tired of seeing Liza’s face everyday.

Jollibee’s rewriting the playbook with a native approach: story-driven, genre-defying, meme-friendly, and self-replicating.

It takes a new kind of intuition into the Facebook platform to dream all this up, and arguably a skill set traditional ad account managers will find quite alien.

Here are 5 clues into how that playbook works:

1. The story is not a slave to the product. Instead of the focus on the endorser, it’s all about the story, the progression, and the dramatic ending. You’ve probably don’t even recognize the actors in either films. You won’t have the same effect with Anne or Liza starring in these films; the audience gets too transfixed by the celebrity, instead of immersing into the story.

The products are slaves to the story, not the other way around. In fact, the products push the story forward for the audience: in “Crush”, the vintage cup places the setting in the 70s. In “Vow”, the store scene establishes that the characters love the same meal. And because brands aren’t constrained by the 30-second TV limit on Facebook, they can tell more substantial stories.

2. Disobey the genre. “Vow” breaks the standard Pinoy love story trope by going for the unexpected, heart-crunching ending (and sets up a possible sequel). In doing so, it turns the protagonist’s love interest into the film’s villain, sparking the fires of protest of friend-zoned boys everywhere.

3. Use a story’s iconography to replicate itself online. The plot device of the Post-It + the Yum-Burger not only serves the story, but makes it meme-friendly on Facebook. Now you’re starting to see people posting random notes on Yum Burgers. This is a genius move in making the story replicable and sticky.

4. Understand how Facebook amplifies video, past and present. Because of Facebook’s desire to keep you on your feed, it automatically streams you related videos, making this a potent discovery tool. As a result, another similar Jollibee film, “Almusal”, is getting new viewers, even if it was posted last year.

But that was also the key: Jollibee has been experimenting with videos for a long time. Winning with content takes time and investment to discover what works. This is not a traditional three-month campaign. It takes patience and commitment from brands to stumble upon the winning formula.

5. Put your traditional media channel on notice. I think the biggest loser here isn’t actually McDonald’s. It’s likely ABS-CBN and GMA. Jollibee has now uncovered strategic leverage to gain bargaining power over the media duopoly to lower their rate cards. And that’s fucking great. Digital provides all brands such an insanely flexible format to tell new stories, reach a bigger audience at a speed and scale never seen before.

In the few minutes I took to write this post, both films have added more than 300,000 views. You’ll never see that speed to scale on TV, and certainly not have the real-time data. If I were a CPG brand, I would just continuously run experiments on different treatments on social, uncover a hit, and use that data to ask my traditional media to hand over lower rates, with the underhanded threat of moving all my ad spend to digital. When Globe shifted its outdoor and print spending to digital, it’s already demonstrated it can grow its business without relying on legacy media.

What else do you think drives this success? What can brands do better?

Standard
Uncategorized

Who Should Withdraw, Mar or Grace? The Data Says Mar Should.

As of May 7, Rodrigo Duterte is about to win the presidency.

When Duterte first announced his candidacy,  I seriously considered him because of his policy of making it fast and easy to register businesses in Davao. As a startup founder scarred by red tape, bribe attempts from the SEC and Makati City Hall, and the despotic tax system, I was genuinely intrigued.

But based on all the evidence I’ve come across, I’ve come to the conclusion that Mar Roxas is a better fit for the job.

My emotions and grievances want me to support Duterte. But reason dictates that my vote goes to Mar.

I’ve weighed any potential benefits with the greater risks that a Duterte presidency can bring. The cussing and womanizing I can personally live with. But the extra-judicial killings, his treasonous and idiotic approach to China, and this lack of understanding of the economic & technological forces that can sink the BPO industry and our OFW remittances – all these are existential threats to the very idea of a “Philippines”.

Nations fail all the time. And we almost always underestimate how fragile our way of life is. This is the 30th year of our little democracy project in these islands. Duterte could push us to the precipice.

Winning in the Home Stretch

SWS and Pulse Asia show that he is number one, with a 30-33% lead. And contrary to what people say about the 2010 vice-president race, the surveys have always gotten the presidential race right. They may have been mistaken on the 3rd ranked candidates in the past, but that hardly matters right?

Rodrigo Duterte’s Facebook engagement numbers are off the roof. Even Google thinks he’s won already.

Can he be stopped? Unlikely. Given that both Mar and Grace have split 40-45% of the vote, and the last minute momentum that make the undecided vote gravitate to the frontrunner.

So it’s with the same rationality that made me conclude that Mar is right for the job that makes me realize that the best chance for stopping a Duterte presidency is for Mar to withdraw and back Grace. Not the other way around.

I’m writing this because at this point, Mar and Grace are probably trapped in an echo chamber of supporters, where the voice of reason and the triple threats of the confirmation bias, the availability bias, and loss aversion are amplified by group think and the fatalism of Filipino culture. We will win. Good will prevail. We will fight, are all shades of the same fatalism.

So I’m going to write this as objectively as possible. And if you feel queasy confronting data & evidence, I’m sorry but this is what the numbers bear out.

Pulse Asia’s Vote Diffusion Question

What most people don’t realize is that Pulse Asia asks a second choice question and then breaks down this preference within specific voting groups. So for instance, we can see among Duterte supporters, what % prefers Grace, Mar, etc as a second choice.

Pulse Asia calls this 1st to 2nd choice diffusion and it is useful in understanding where votes go if either Grace or Mar withdraws. I averaged out the diffusion percentages of three Pulse Asia surveys, March 8-12, April 19-24, and April 26-29.

* The way this question was asked is: “If your chosen candidate does not pursue his/her candidacy for whatever reason, whom among the remaining people would you for as President if the elections were held today?” The question also doesn’t prevent respondents from naming their 1st choice as their 2nd choice too – “Si Duterte talaga eh, wala nang iba”, is an answer that approximates this.

Across all voting groups, Grace is the dominant 2nd choice. For example:

  • 38% of Duterte supporters have Grace as a 2nd choice (an important consideration – and I’ll get back to this later).
  • 45% of Binay supporters have Grace as a 2nd choice, and
  • 41% of Mar supporters pick Grace as a 2nd choice.

Elections PostIf you zero in to Grace vs Mar, you’ll clearly see that more Mar voters will be attracted to Grace, rather than the other way around. 41% of Roxas voters pick Grace as 2nd choice. Only 24% of Grace voters pick Mar as 2nd choice.

Elections Post-1

Who are the other picks of Grace voters? Binay (27%) and Duterte (19%). This gives credence to the argument that Duterte’s base will get even stronger if Grace was the one who pulled out.

Now if you assume 54.4 million registered voters, a 75% voter turnout (like the previous election), you get a base of 40.8 million votes up for grabs. (Hey, that could’ve been a PR campaign of GrabTaxi, yes? GRABVOTE = click on this app and a vote buyer will appear where you are to bid for your vote. Wait sorry, my ADHD kicked-in. Back to the math).

If you then average out the previous 3 Pulse Asia Surveys, Duterte ends up with 30% of the votes, equivalent to more than 12 million votes. This ignores any last minute momentum effects that could push his lead to more than 35%.

Elections Post-2

If Mar pulls out, asks his base to consolidate support for Grace, where could it go? Based on his diffusion numbers, Grace could gain more than 3 million votes.

Elections Post-3

This could be higher (if Mar is convincing enough and people rally to Grace) or lower (if the limited time prevents him from getting the message across).

The effect of this brings Grace ~9 million votes to within striking distance of Duterte’s 12 million. Duterte of course will gain some votes from Mar, approximate 1 million+ based on the diffusion numbers.

Elections Post-4

What will turn the tide?

Enter the most powerful group of people in this election: the roughly 2 million Undecided voters.

What  the press also seemed to miss is that the Pulse Asia survey also had a question buried deep that allowed us to get clues on where the 5% of Undecideds could go.

After someone says that in the 1st choice question that they are “undecided”, they are also asked the 2nd choice question. In that question, around 20% gave an answer. And among this 20%, the split are: 43% Grace, 19% Binay, 16% Duterte, 11% Roxas.

43% of ~2 million people gives Grace another 800,000+ votes, enough to turn the tide into a narrow Grace victory. In addition, the opposition rallying around Grace would matter to the close to 40% of Duterte supporters (4 million+ people) who picked Grace as their 2nd choice. Even if just 10% of these people switch last minute (400,000) gives Grace a clear 1.2 million vote lead (800k + 400k) over Duterte.

Elections Post-5

A lot of things need to happen in so short a time for this scenario to come true.

But if Mar, Grace, Jojo, and Miriam truly believe Duterte is a threat to our democracy, they have the power to make this happen – if they just need to remove their ego out of the equation and listen to the evidence.

They should try because the alternative – a Leni VP victory leading to an LP-initiated impeachment against Duterte – does more damage to our institutions than this last-minute rally.

On a personal note, I think the conversations between Mar and Grace would be completely different if they had  top-notch data science teams instead of PR motherfuckers surrounding them. It’s the data guys who would keep them honest, by not only keeping close track of the surveys, but complimenting this with other big data sources from the internet and social media. If someone from the LP for instance, was doing sentiment analysis, they wouldn’t have to wait till the last minute to sense the grassroots grievance of FIlipinos. And maybe the predominately male LP inner circle would’ve seen that Leni would’ve been the more viable presidential candidate. I have a friend who said late last year that Leni should’ve been fielded as President instead. I doubted it at the time. But how prescient he was. Leni’s the direct anti-thesis of Digong.

Whoever thought democracy could die because people couldn’t understand the data.

PS – this was a quick analysis done in 2 hours – I apologize for any errors. 

Standard
Uncategorized

The COMELEC Data Breach is the Philippine National Disaster We Should Be Talking About

In the 2002 film Red Dragon, Francis Dolarhyde (Ralph Fiennes) is a serial killer who murders his victims as they sleep in their homes, at the behest of an alternate personality whom he calls the Great Red Dragon.

Dolarhyde proceeds to engage in necrophilic acts with the mothers’ corpses, while embedding shards of broken mirror glass into their eyes to watch himself.

FBI agent Will Graham (Edward Norton) deduces that Dolarhyde has very personal information about this victims – who they are, where they live, how many children they have, the layout of their homes, where to enter, and when best to attack. Dolarhyde knows this because he is a home video technician: he works for a lab that converts home video into VHS tapes. The hours of footage give him an intimate look into this victims’ lives.

He just had analog information. Imagine the damage if he had all the digital information about his victims.

Today, countless of Francis Dolarhydes have access to your private information, thanks to the Commission on Elections. And if you’re not outraged because you can’t visualize what 338 gigabytes of data are, maybe you can visualize what it can do:

Imagine someone opening a bank account under your name, using a fake driver’s license and passport. For years, your fake account is used to launder money, without your knowledge. Imagine your residential address easily accessed in one database. Imagine your email being targeted by phising scams. Or being the target of scams and extortion. Imagine a rogue politician using millions of voter data to keep track of his constituents in his municipality, creating detailed voter records and using this for political gain. All of this data is now out in the open.

And the worst part? We don’t even know how exactly it happened or what steps are being done to make sure it doesn’t happen again. The COMELEC even downplayed it. Incredibly, COMELEC wasn’t event transparent enough to disclose what exactly what kind of data was leaked. Only Rappler did an in-depth report on what was actually in the  data that was released.

The rest of local media has largely ignored this; it never made it to the headlines in the same way Kidapawan or the campaign trail did. It only received follow-up articles after Trend Micro, an IT security firm, released a blog post admonishing the government’s responses. None of the presidential candidates think this is a serious concern.

As a result, not only are we not seriously talking about it, most people don’t even know the breach happened. And there could be more breaches we don’t know about – according to security firm Mandiant, data breaches remains undiscovered for more than 6 months.

Make no mistake about it: the COMELEC breach is a disaster of national proportions: it’ll open the floodgates to more attacks and leave our institutions and economy vulnerable for years to come.

Gizmodo is now calling this one of the biggest government data breaches in history.

Blog - Data Breaches

Sources:  data compiled from Rappler.com, MIT Technology Review

The hackers posted the database online on March 27, more than two weeks ago. The fact that it is taking our collective brains so long to appreciate the gravity of this situation is a tragedy. It’s like a different parts of Philippine society got into a car pissed drunk, the driver falls asleep on/behind/in the wheel, and we are blissfully laughing (or arguing over which candidate performed best in the last debate) all the way to the car crash.

ywtfgw6qymomy

Dancing our way to the elections…

Why does this matter?

It matters because we have a $25 billion business process outsourcing industry that employs more than a million Filipinos. This industry survives on the trust of tens of thousands of corporate clients that their data would be handled securely.

It matters because the tension in the West Philippine Sea is leading to the most destabilizing geopolitical conflict of our generation. In this conflict, it’s been documented that one of our adversary’s potent weapons is cyber warfare and espionage. Can China bring the country to its knees by remotely shutting key telecommunications infrastructure, the internet, the electrical grid, and the water supply? Theoretically, it can. In this context, we should be grateful to Filipino hackers for pointing our vulnerabilities.

This conversation matters because the amount of data the government will capture about us will only grow exponentially in the next several years. By 2020, humanity will be producing 40 zettabytes of data. If that’s hard to imagine, picture this: if 1 gigabyte is equivalent to a cup of Starbucks coffee, 1 zettabyte is equivalent to enough Starbucks cups to fill the entire Great Wall of China.

And lastly, it matters because although the COMELEC’s automated election system is run as a separate network, the perception of legitimacy will be the most crucial outcome of a tight race like this (yes, Duterte Bros, it is still anyone’s bet).  Didn’t a great rebel once say that “Revolution, as you know, is like gravity. All it takes is just a little push…

qzehd8clv2jfg

Oh wait, I think he meant “madness”, not revolution. Just the same.

Why doesn’t COMELEC “get” the problem?

One clue is that none of the COMELEC commissioners has anything that remotely resembles a background in computer science, engineering, or data science. In an age of automated elections and biometric voter data, isn’t this very very strange?

Blog - Data Breaches-1

Now, since our commissioners are esteemed legal luminaries, you might expect that they would have at least set in place the right institutional and legal framework to enable the COMELEC to protect its data. On this front, it seems there is more damning evidence.

For example, here’s the text of Republic Act 10367 – the law that requires mandatory biometric voter registration. Scroll down to Section 9 on database security and you’ll see this broadly articulated sentence: “The database generated by biometric registration shall be secured by the Commission and shall not be used, under any circumstance, for any purpose other than for electoral exercises.”

Now that sounds cool and sensible enough. After all, it’s not the job of the legislator to get into the practical, implemention-related details. That would fall under the jurisdiction of the COMELEC when it issues the Implementing Rules and Regulation for Republic Act 10367. It’s in the Implementing Rules and Regulations you would expect the COMELEC to at least spell out how it would provide for database security, who would be responsible, the milestones and steps involved, and the costs. Basis management stuff, right?

Here’s a copy of the IRR. Scroll to the relevant section on database security and you’ll notice the glaring fact that the IRR simply copied the text of the Republic Act. In short, there was neither a plan nor a framework from the COMELEC to secure it’s biometrics database (which according to Rappler, was part of the breach).

Another clue is the hard question on institutional checks and balances. As a separate constitutionally mandated commission, the COMELEC’s tech isn’t subject to the oversight of the DOST nor is its website part of the government’s web hosting service. As a result, nobody in its leadership team or its IT department are asking the right questions or providing a check and balance. This is admittedly a tough question to crack – how do you ensure the commission’s independence while ensuring that it’s tech adheres to global best practices? This is another case of technology development outpacing the ability of our laws to keep up.

Why has the media under-reported this story?

There are many obvious reasons for this. In an election cycle where journalists are spread out across the campaign trail and many more equally important stories coming up (Kidapawan, the RCBC-Bangladesh hearings, Poe’s disqualification, which candidate is which celebrity endorsing, etc), it’s easy for journalists and editors to fall into the trap of writing about stories where it is easy to get and verify primary sources (a campaign rally, a Senate hearing, a Supreme Court ruling, etc).

To understand the COMELEC data breach, journalists not only have to comb through the leaked data (which is exactly what Michael Bueza and Wayne Manuel did at Rappler), they have to get a crash course on database architecture, data warehousing, encryption, and network security.

Bring all of these together under an environment where news outlets prioritize speed, clicks, and eyeballs, and you’ll see the underreporting as a another case of market failure. And in every market failure, there’s an opportunity.

If you are a smart journalist, you’ll realize that the world is changing far faster than what seems to be apparent in your daily beats. You’ll realize that fundamentally, we are an island nation and an island people cut off from the world. And there are so many things out there that we don’t even know we don’t know.

You’ll realize that – due to no fault of your own – our educational system and current employers left us woefully unprepared for what is to come. And as a result, you’ll be taking steps to learn new stuff, from platform thinking to network effects.

You’ll be studying R, Python, and D3 on the side because this gives you a skill set that your peers (and editors!) won’t be able to match and makes you incredibly more valuable in the long run.

In Red Dragon, Will Graham had to break the rules to catch Francis Dolarhyde. He had to seek Hannibal Lecter’s counsel. He dug deep into the tragic pathology of his adversary. He had to stretch himself, learn completely  new things, and find his own Great Red Dragon.

Standard
Uncategorized

Debate Notes and a Better Way to Test Presidential Candidates

Notes debates

Source: Screenshot from TV5 livestream

In Harvard Business School, majority of exams allow notes. That’s not because the faculty wants to make it easy for students. They want to make it harder.

In a typical Harvard case exam, students are asked to respond to broad, open-ended questions like “Should Uber launch a self-driving car?” or “How should Apple respond to federal requests for access to encrypted software?“. Not only do students have to write a convincing case, they have to do so with limited time and word count. It’s also hard because there are no right or wrong answers.

If you haven’t mastered the material, trained your mind how to think analytically, or break down issues in a structured manner, your notes won’t help you at all. If anything, they’ll make it harder to make a compelling argument.

In an increasing number of Harvard classes, the exams are  also practical: build an actual website that generates revenue. Or an app or a service that has actual users. Your notes would obviously mean very little for these.

(Personally, I would’ve advised Mar to just allow Jojo Binay to freely brandish his folders on stage. In the college debating world, we had this tactic of luring an opponent to spend a long time defending a position. And then in our speech, concede and agree to everything they just said – because it was irrelevant and the debate is something else entirely. Roxas could’ve pulled that trick. Think about it. “Sige po, Luchi – hayaan natin siyang gumamit ng codigo. Kaming tatlo, di namin kailangan.” Binay would’ve also looked like a bigger fool navigating throughout the paper work in a tiny desk, when everyone else spoke without notes.)

And that’s the biggest problem of debates so far: they tell us very little about the presidential candidates. I know they’re a necessary component in the showmanship of every democracy, but they barely scratch the surface. A major policy issue like climate change or drugs gets 2 minutes each. Half of the time is spent mud-slinging. They’re not real constructive conversations.

I think there’s a better way to assess: make each presidential candidate build an MVP.

No, no, not Manny V. Pangilinan. In startup parlance, an MVP is a “minimum viable product” – an early, rough prototype good enough to test a solution to a problem. In tech, it could be a bare bones website or mobile app. In retail, it could be product samples. The point is to have just a minimum number of features to a.) define a hypothesis, b.) build an experiment to test that hypothesis, c.) and gather data to validate or invalidate our hypothesis.

Here’s how it’ll work: we’ll ask each candidate to build an MVP for one, single issue they care about. They get to pick their own team of 5 people: engineers, developers, graphic artist, copywriters, etc. They’ll start on a Friday morning. They’ll each be filmed constantly – no cuts or edits – during the day from 9am to 6pm. On Sunday evening, they’ll be asked to demo their MVP in front of a live audience and streamed on YouTube. A panel of experts will ask tough questions.

Here are some ideas:

  • Jojo Binay likes to showcase the healthcare benefits Makati residents receive. His goal is to build an MVP for a site similar to Obamacare’s Healthcare.gov.   The site’s mission: provide universal health coverage for every Filipino.  At the end, he has to demo his work to a panel of doctors, HMO providers, technologists, and employers.
  • Grace Poe can build an MVP for a platform that centralizes all government and private sector services for overseas Filipinos, a constituency she leans on when critics question her patriotism.
  • Mar Roxas wants sustained economic growth. So he work on an MVP for an online platform that helps train senior high school students in data science, analytics, and computer science – three fields that are the next step in the value chain for our BPO industry, which obviously cannot rely on voice services to accelerate growth.
  • Rody Duterte likes local government, so he can build an app that enables participatory democracy, enabling citizens to take photos, report, and up-vote pressing local barangay and municipality level problems – think unfinished road repairs and empty clinics.

If it sounds like Startup Weekend, well it is. And more than any presidential debate or campaign rally, an exercise like this helps us understand:

  • How they think through tough problems. In the OFW example, is the problem to be tackled upstream opportunities for people who want to work abroad, or for existing OFWs? Grace’s answer will lead to entirely different MVPs. If she chooses the former, why? Why not the latter?
  • How each candidate prioritizes issues. In the healthcare example, do you start with building an interface for providers? Or for customer registration and validation? Why this sequence?
  • How they collaborate with a small team to reach an imperfect solution? What’s their management style? Do they ask a lot of questions? Or do they rely on personal domain expertise? Will they pick people who are smarter than they are? Or do they need to be the alpha in the room?
  • How do they deal with uncertainty? Do they go with their gut, rely on others, or leave the building to find data?
  • How they respond to feedback? How do they deal with tough questions?

In an earlier post, I wrote something on how the presidentiables can court the Entrepreneur Vote:

Make the candidates put themselves in the shoes of the entrepreneur. And not in a superficial way like visiting Aling Nena’s sari-sari store or manning a Jollibee counter for an hour. Each presidentiable will have 38 days to register a corporation. Why 38? Because that’s the World Bank measure of how long it takes. They have to get as far into the process as they can within that amount of time. I’ll give each candidate all the forms they need, and Php 5,000.00 each as initial paid-in capital. They have to fill up all the forms themselves in that event – no accountants, no lawyers.  Broadcast this live in front of the people. SEC Articles of Incorporation. By-Laws. BIR Forms. DTI. SSS. Pag-Ibig. City Permit. Barangay Clearance.

You get the drift: the idea is to make each presidentiable feel what every Filipino entrepreneur has to go through. All the presidentiables will be invited to a public forum to discuss their experience in front of small business owners.  This won’t be a debate format. Instead, we ask each candidate to answer the following:

  • Describe your experience in registering a company.
  • Diagnosis the process of starting the company. What were the bottlenecks? What worked? What didn’t?
  • Recommend the changes and how you would implement them.

*******

They can use all the notes they want in any of the above exercises. It’s not a debate, it’s real work. When the dust settles, we’ll have a treasure trove of data about each candidate. We get to have a glimpse into how a leader actually gets shit done.

The President is not just the head of state or the leader of the country. He or she is employee # 1. The President works for me. I’m the boss here. And so are you. I pay his salary every month. And so do you.

When we hire employees, we don’t just ask job candidates to tell us who they are and what their back story is. We get a sense of how they can actually get things done. A President is no different.

*******

As most of you know, I don’t proofread my articles – I write as I go along. All errors are mine. 

Standard
Uncategorized

How Would Martial Law Happen in 2016?

interphoto_1379741929

The biggest irony today is that the freedom young Marcos supporters enjoy to voice an unpopular opinion (that the dictatorship was a golden age) is the same freedom that was taken away from their parents in the 1970s.

More time has passed between today and the start of Martial Law than the time between Martial Law and the end of World War II. So it’s no surprise that we have but the faintest idea of the Marcos dictatorship compared to that generation’s memories of the atrocities of war.

So re-watching Batas Militar made me wonder, if I were alive in the 1970s, what would happen to me? Obviously an incredibly difficult scenario to imagine, but this one’s easier: if Martial Law were proclaimed today, what would happen to me and the world around me?

First, Rappler would be taken over. Marcos would strip Maria Ressa and her colleagues of their board seats and hand them over to cronies. A military rep will commandeer the passwords to their servers and software. Chay Hofileña, Maritess Vitug, Natashya Guttierez, Leloy Claudio, Patricia Evangelista and other brilliant / courageous writers who fearlessly speak truth to power would be taken in the middle of the night from their homes. The women would be raped at knifepoint. The men would be found weeks later, their testicles cut off, their guts full of water.

Second, Ernest Cu and Manny Pangilinan would be forcibly asked to turn over control of Globe and PLDT’s vital internet infrastructure to the government. Facebook would be blocked, China-style. YouTube will be swamped with content takedown requests from Malacañang.

Carlo Katigbak and Felipe Gozon would be made to report to the Palace (no, not the pool club) every week. All broadcast shows from ABS-CBN and GMA must require approval from the Presidential Communications Office. Guys like Arnel Cassanova, upright public servants who aren’t afraid to go after vested interests, will be out of a job, or worse, find themselves detained in Camp Crame. SWS and Pulse Asia surveys will be doctored. Leading opposition candidates Jojo Binay and Grace Poe would be behind bars. Brian Llamanzares, for showing off his shoes, would attract the ire of some Generals and will be found lifeless in a Tarlac ditch, his feet cut off.

Third, Marcos would use a rising China and the West Philippine Sea dispute as leverage to bargain for more military aid (fair game to skimming in the form of unaudited intelligence funds) from an American government keen to implement a Pacific Pivot. But he’ll also play two sides of the same coin. As Marcos covets US aid with his right hand, the left hand would be reaching out to excess Chinese liquidity and divert it to local investments through his cronies, naturally.

This generation’s version of the coco levy scam – a scheme so brazenly and intelligently designed for wealth transfer would involve using our strong foreign currency reserves to acquire overseas assets whose control would be given to the same cronies, with Marcos getting a healthy cut.

Taxes on overseas remittances will triple overnight. A Presidential Decree – which Marcos produced copious amounts that would put an Instagram Wife’s selfies to shame – will be required for new BPO licenses.

My startup would be shut down, disingenuously accused for trying to “endanger” a business of a Blue Lady. Kalibrr, Pawnhero, Lenddo, OLX, and more would be shut down for threatening established conglomerates. Bantay.ph will be censored and Henry would disappear. In the guise of protecting sari sari store owners, Lazada’s warehouses all over the country would be seized. Last night’s talk from Sequoia Capital wouldn’t happen as all interest from foreign VCs would evaporate. Expats like Christian Besler would be deported for being too opinionated in public affairs. The CBCP doesn’t like Carlos Celdran’s protest-as-art? Well they might find him with his top hat stuffed into his mouth in a Cavite swamp.

If I were still in college, debate friends from Ateneo, UP, UST, and DLSU – incredibly brilliant legal minds such as William Panlilio, Joan de Venecia, and Arlene Maneja – would slip in one debate and attract the ire of the presidential daughter and disappear Archimedes Trajano-style. Those who survive the purge would flee abroad.

So, yeah:

1. I would definitely not have survived Martial Law. And I think a lot of my friends wouldn’t either.

2. There are tens of thousands of independent minded, intelligent, and talented Filipinos who are either dead or have fled overseas. All our woes of not having enough good public servants, entrepreneurs, PhDs, etc could be traced back to those years.

3. The very fact young people are free to argue that Noynoy Aquino is a bad president without fear of Kris Aquino sending out her bodyguards in retaliation should make those same young people very very thankful – no matter how much the EDSA generation fucked up in the decades after.

So to my parents’ generation, thank you for giving me the chance to write this without fear. To guys like Primitivo Mijares, where ever you and your pen are, there are still a lot of the key players alive, rich, and well that we are waiting for you to fetch.

Standard