11/20/2019

RULE ON
CYBERCRIME
WARRANTS
A.M. NO. 17-11-03-SC

A L ECT UR E B Y
AS S OC . D E AN CH R IS TIAN G .
V IL L AS IS

1
 11/20/2019

INTRODUCTION
The detection, investigation, and prosecution of cybercrime offenses
necessitate a rule of procedure therefor, especially for the application,
issuance, and implementation of court warrants technically-suited to the
nature of cybercrime offenses;

Pursuant to Section 5 (5), Article VIII of the 1987 Constitution,

the Supreme Court is vested with the power to promulgate rules
concerning the pleading, practice, and procedure in all courts;

2
 11/20/2019

INTRODUCTION
Through Memorandum Order No. 11-17 dated February 2, 2017, tasked
the Sub-Committee on Commercial Courts to draft the rules of
procedure "that shall respond to the technical requirements of
cybercrime prosecution and aid the cybercrime courts in the exercise
of their special jurisdiction" through a Technical Working Group created
for the purpose…

3
 11/20/2019

SCOPE AND APPLICABILITY

SEC . 1.2

• This Rule sets forth the procedure for the application and grant of
warrants and related orders involving the preservation,
disclosure, interception, search, seizure, and/or
examination, as well as the custody, and destruction of
computer data…

4
 11/20/2019

SUPPLEMENTARY NATURE OF THIS RULE

SEC . 1.3

• This Rule supplements the existing Rules of Criminal Procedure, which

provisions shall continue to govern the preliminary investigation and all
stages of prosecution…through, and with the use of information and
communications technologies.

• Remedies provided under existing procedural rules shall, whenever

applicable, be made available to any party who seeks relief against any of
the orders provided under this Rule.

5
 11/20/2019

DEFINITION OF TERMS
SEC . 1.4
• COMMUNICATION – refers to the transmission of information through information and
communications technology (ICT) media, including voice, video, and other forms of data;
• COMPUTER - refers to an electronic, magnetic, optical, electrochemical, or other data
processing or communications device, or grouping of such devices, capable of perfonning
logical arithmetic, routing, or storage functions and which includes any storage facility or
equipment or communications facility or equipment directly related to or operating m
conjunction with such device;
• COMPUTER DATA - refers to any representation of facts, information, or concepts in a form
suitable for processing in a computer system, including a program suitable to cause a computer
system to perform a function, and includes electronic documents and/or electronic data
messages whether stored in local computer systems or online

6
 11/20/2019

DEFINITION OF TERMS
SEC . 1.4

• CONTENT DATA - refers to the content of the communication, the meaning

or purported meaning of the communication, or the message or information
being conveyed by the communication, other than traffic data;
• CYBERCRIME COURT - refers to any of the Regional Trial Courts which are
designated as special cybercrime courts;
• INTERCEPTION -refers to listening to, recording, monitoring or surveillance
of the content of communications, including procuring of the content data,
either directly, through access and use of a computer system, or indirectly
through the use of electronic eavesdropping or tapping devices, at the same
time that the communication is occurring

7
 11/20/2019

DEFINITION OF TERMS
SEC . 1.4

• OFFENSE - is a general term used to refer to either a violation of Section 4 (Cybercrime

Offenses), Section 5 (Other Offenses), or Section 6 (all crimes defined and penalized by the
Revised Penal Code, as amended, and other special laws, if committed by, through, and with the
use ofICT), Chapter II of RA 10175;
• PRESERVATION - refers to the keeping of data that already exists in a stored form, protected
from anything that would cause its current quality or condition to change or deteriorate
• SERVICE PROVIDER - refers to: (a) any public or private entity that provides users of its
service the ability to communicate by means of a computer system;
and (b) any other entity that processes or stores computer data on behalf of such
communication service or users of such service

8
 11/20/2019

VENUE OF CRIMINAL ACTIONS

SEC . 2.1

• The criminal actions for violation of Section 4 (Cybercrime offenses) and/or Section 5
(Other offenses), Chapter II of RA 10175, shall be filed before the designated
cybercrime court of the province or city where the offense or any of its elements is
committed, or where any part of the computer system used is situated, or where any
of the damage caused to a natural or juridical person took place;
• All other crimes defined and penalized by the Revised Penal Code, as amended, and
other special laws, committed by, through, and with the use of ICT, as provided under
Section 6, Chapter II of RA 10175, shall be filed before the regular or other
specialized regional trial courts,24 as the case may be.

9
 11/20/2019

WHERE TO FILE AN APPLICATION FOR A

WARRANT
SEC. 2.2

• An application for a warrant under this Rule concerning a violation of Section 4 (Cybercrime
Offenses) and/or Section 5 (Other Offenses), Chapter II of RA 10175 shall be filed by the law
enforcement authorities before any of the designated cybercrime courts of the province or the
city where the offense or any of its elements has been committed, is being committed,
or is about to be committed, or where any part of the computer system used is situated,
or where any of the damage caused to a natural or juridical person took place…

10
 11/20/2019

EFFECTIVE PERIOD OF WARRANTS

SEC . 2.5

• Any warrant issued under this Rule shall only be effective for the length of time as determined
by the court, which shall not exceed a period of ten (10) days from its issuance.
• The court issuing the warrant may, upon motion, extend its effectivity based only on justifiable
reasons for a period not exceeding ten (10) days from the expiration of the original period.
• Failure to timely file the returns for any of the issued warrants under this Rule … shall subject
the responsible law enforcement authorities to an action for contempt. (Sec. 2.6)

11
 11/20/2019

WARRANT TO DISCLOSE COMPUTER DATA

(WDCD)
SEC. 4.2

• A WDCD is an order in writing… authorizing law enforcement authorities to

issue an order to disclose and accordingly, require any person or service
provider to disclose or submit subscriber's information, traffic data, or relevant
data in his/her or its possession or control.
• Within forty-eight (48) hours from implementation or after the expiration of
the effectivity of the WDCD, whichever comes first, the authorized law
enforcement officer shall submit a return on the WDCD to the court that
issued it and simultaneously tmn over the custody of the disclosed computer
data… (SEC. 4.5)

12
 11/20/2019

WARRANT TO INTERCEPT COMPUTER

DATA (WICD)
SEC. 5.2

• A WICD is an order in writing… authorizing law enforcement authorities to carry

out any or all of the following activities: (a) listening to, (b) recording, ( c) monitoring,
or ( d) surveillance of the content of communications, including procuring of the
content of computer data…

• Within forty-eight ( 48) hours from implementation or after the expiration of the
effectivity of the WICD, whichever comes first, the authorized law enforcement
officers shall submit a return on the WICD to the court that issued it and
simultaneously turn-over the custody of the intercepted communication or computer
data thereto… (SEC. 5.5)

13
 11/20/2019

WARRANT TO SEARCH, SEIZE AND

EXAMINE COMPUTER DATA (WSSECD)
SEC. 6.1

• An order authorizing law enforcement authorities to search the particular

place for items to be seized and/ or examined.
• Initial Return - Within ten (10) days from the issuance… (SEC. 6.5)
• Period to Examine – After the initial return, the court shall issue an order fixing
the period to conclude the examination of all the items seized, which period
may be extended not exceeding thirty (30) days, upon motion, for justifiable
reasons. (SEC. 6.7)

14
 11/20/2019

WARRANT TO SEARCH, SEIZE AND

EXAMINE COMPUTER DATA (WSSECD)
SEC. 6.1

• Final Return - Within forty-eight (48) hours after the expiration of the period
to examine s shall submit a final return on the WSSECD to the court that
issued it, and simultaneously turn-over the custody of the seized computer
data, as well as all other items seized and/or the communications or computer
data intercepted… (SEC. 6.8)

15
 11/20/2019

DEPOSIT AND CUSTODY OF SEIZED

COMPUTER DATA
SEC. 7.1

• Upon the filing of the return for a WDCD or WICD, or the final return for a
WSSECD or WECD, all computer data subject thereof shall be simultaneously
deposited in a sealed package with the same court that issued the warrant. It
shall be accompanied by a complete and verified inventory of all the other
items seized in relation thereto, and by the affidavit of the duly authorized law
enforcement officer…

16
 11/20/2019

DEPOSIT AND CUSTODY OF SEIZED

COMPUTER DATA
SEC. 7.1

• Upon the filing of the return for a WDCD or WICD, or the final return for a
WSSECD or WECD, all computer data subject thereof shall be simultaneously
deposited in a sealed package with the same court that issued the warrant. It
shall be accompanied by a complete and verified inventory of all the other
items seized in relation thereto, and by the affidavit of the duly authorized law
enforcement office…

17
 11/20/2019

DEPOSIT AND CUSTODY OF SEIZED

COMPUTER DATA
SEC. 7.1

• Upon the filing of the return for a WDCD or WICD, or the final return for a
WSSECD or WECD, all computer data subject thereof shall be simultaneously
deposited in a sealed package with the same court that issued the warrant. It
shall be accompanied by a complete and verified inventory of all the other
items seized in relation thereto, and by the affidavit of the duly authorized law
enforcement office…

18
 11/20/2019

ACCESS TO AND USE OF COMPUTER DATA

SEC. 7.3

• The package containing the computer data so deposited under Section 7 .1 of

this Rule shall not be opened, or the recordings replayed, or its contents
revealed, or, in any manner, used as evidence, except upon motion duly granted
by the court.The motion for the purpose shall state:
1.The relevance of the computer data sought to be opened, replayed, revealed, or used as
evidence; and
2.The names of the persons who will be allowed to have access thereto, if the motion is granted

19
 11/20/2019

DESTRUCTION OF COMPUTER DATA

SEC . 8.1

• Pursuant to Section 17 of RA 10175, upon expiration of the

periods as provided in Sections 13 and 15 of the said law, service
providers and law enforcement authorities, as the case may be, shall
immediately and completely destroy the computer data subject of
preservation and examination.

20
 11/20/2019

DESTRUCTION AND RETURN OF COMPUTER DATA IN THE

CUSTODY OF THE COURT
SEC . 8.2

• Likewise, the court may, motu proprio, and upon written notice to
all the parties concerned, order the complete or partial
destruction, or return to its lawful owner or possessor, of the
computer data or any of the related items turned over to its
custody if no preliminary investigation or case…

21