The Million Mask March’s reach in the Philippines has varied from year to year, but its earlier actions show how online disruption can serve as a signal for street protest. The relationship between the two has never been automatic: a website attack can draw attention to a grievance, while the turnout for a march depends on whether people see the issue as urgent and worth acting on. With November 5 approaching, questions around the Department of Information and Communications Technology (DICT) may give hackers and activists new targets for attention. That makes the date a useful point to watch, even if it can’t tell us in advance how many people will take to the streets.
A protest with a history of digital disruption
Known informally as “Operation Vendetta,” the annual November 5 protest takes its name from V for Vendetta, whose central character wears a Guy Fawkes mask. Anonymous helped establish the worldwide event in 2012, giving the date a shared identity that could travel across national borders. Its largest gatherings were held outside the Philippines, including in London and Washington, DC. The name and mask offer a recognizable frame for protest, but they don’t make the concerns behind each local event identical.
In the Philippines, online activity has often preceded calls to march. Defacements and hacks have been used to draw attention to grievances including political corruption, police violence and militarization. The 2013 event was the most visible local example: more than 30 Philippine government websites were crashed or defaced. That episode shows how digital disruption can turn an otherwise scattered set of complaints into a public signal, though the act of disrupting a site doesn’t by itself establish how broad the underlying support is.
Anonymous apologized in a video for the disruption while urging people to join the November 5 protest. Police said they would take steps to protect public safety and also invited some protesters for questioning. Those responses put two competing concerns in view: the public’s ability to assemble and the government’s responsibility to respond to activity affecting public systems. The event has previously been preceded by hacking activity, including website defacements. (And this is the part most people overlook.) The online actions can shape attention before a crowd gathers, but they can also become the story themselves, leaving the original grievance harder to see.
DICT faces a testing moment
Activity around the march rises and falls with the issues of the moment. The 2025 observance drew less attention than earlier years, with notices appearing mainly in online hacking communities. That leaves the scale of any 2026 action uncertain, and online notices alone don’t show whether people will organize or attend in person. The contrast is a reminder that a recurring protest date provides a stage, not a guarantee of turnout.
Still, DICT could face added scrutiny under its new secretary, former Social Security System chief Robert Joseph de Claro. The department is entering a change in leadership after the departure of Henry Aguda, whose decisions included a temporary Discord ban and threats to restrict other services over concerns about online content linked to violent extremism. Those moves have contributed to a loss of trust in the institution, according to the source article. A leadership change can bring fresh attention to past decisions, but it doesn’t settle the questions those decisions raised. If you’re working in this space, the test will be whether the department can explain its choices clearly and show how it weighs public concerns against its stated aims.
Another pressure point is the preventive suspension of DICT eGov Undersecretary David Almirol over alleged conflicts of interest involving the eGov app and its development. The suspension has put the project under scrutiny, creating an opening for critics or hackers to focus attention on the department. The allegation and suspension are matters for scrutiny; they don’t, on their own, resolve the underlying questions about the project. For a public digital service, questions about who built it and how decisions were made can affect confidence in the service as well as confidence in the agency overseeing it. This is more significant than it looks: a dispute over one project can become a broader test of whether the department’s public explanations are trusted.
What November 5 can—and can’t—show
There’s no reliable way to predict whether these issues will translate into a strong protest or an informal gathering on November 5. Nor does the presence of hacking activity offer a simple measure of public support: online disruption can be visible, but visibility and broad participation aren’t the same thing. That said, the combination of leadership questions and scrutiny of a major digital project gives critics a set of concrete subjects to raise. The numbers here are underwhelming as a forecast; the more useful evidence will be what people actually choose to discuss and do.
The march’s record points to a more useful takeaway: the date can bring unresolved grievances into public view, and in the Philippines those grievances rarely wait for a particular day. A protest can concentrate attention for a moment, while the underlying disputes continue before and after it. For DICT, the practical implication is that public confidence will depend on how it answers scrutiny, not simply on whether a march draws a crowd. The signal may be small. The questions behind it can persist.
