MODULE 8.

CYBERCRIME PREVENTION ACT OF 2012

Learning Objectives and Outcomes:

After the completion of the chapter, students will be able to:
1. describe the salient points of cybercrime law

I. Republic Act No. 10175 (Cybercrime Prevention Act of 2012)

Republic Act 10175 – Cybercrime Prevention Act was signed into law last
September 12, 2012. This law is already in effect as the Supreme Court uphold its
constitutionality (February 18, 2014). Although some provisions were deemed as
unconstitutional (struck down) particularly Sections 4(c)(3), 7, 12, and 19.
CHAPTER II PUNISHABLE ACTS

SEC. 4. Cybercrime Offenses. — The following acts constitute the offense

of cybercrime punishable under this Act:
(c) Content-related Offenses:
(3) Unsolicited Commercial Communications. — The transmission of
commercial electronic communication with the use of computer system
which seek to advertise, sell, or offer for sale products and services are
prohibited unless:

(i) There is prior affirmative consent from the recipient; or

(ii) The primary intent of the communication is for service and/or

administrative announcements from the sender to its existing users,
subscribers or customers; or

(iii) The following conditions are present:

(aa) The commercial electronic communication contains a simple, valid,

and reliable way for the recipient to reject. receipt of further commercial
electronic messages (opt-out) from the same source;

(bb) The commercial electronic communication does not purposely

disguise the source of the electronic message; and
(cc) The commercial electronic communication does not purposely include
misleading information in any part of the message in order to induce the
recipients to read the message.
SEC. 7. Liability under Other Laws. — A prosecution under this Act shall be
without prejudice to any liability for violation of any provision of the
Revised Penal Code, as amended, or special laws.

SEC. 12. Real-Time Collection of Traffic Data. — Law enforcement

authorities, with due cause, shall be authorized to collect or record by
technical or electronic means traffic data in real-time associated with
specified communications transmitted by means of a computer system.

Traffic data refer only to the communication’s origin, destination, route,

time, date, size, duration, or type of underlying service, but not content,
nor identities.

All other data to be collected or seized or disclosed will require a court

warrant.

Service providers are required to cooperate and assist law enforcement

authorities in the collection or recording of the above-stated information.

The court warrant required under this section shall only be issued or
granted upon written application and the examination under oath or
affirmation of the applicant and the witnesses he may produce and the
showing: (1) that there are reasonable grounds to believe that any of the
crimes enumerated hereinabove has been committed, or is being
committed, or is about to be committed: (2) that there are reasonable
grounds to believe that evidence that will be obtained is essential to the
conviction of any person for, or to the solution of, or to the prevention of,
any such crimes; and (3) that there are no other means readily available
for obtaining such evidence.

SEC. 19. Restricting or Blocking Access to Computer Data. — When a

computer data is prima facie found to be in violation of the provisions of
this Act, the DOJ shall issue an order to restrict or block access to such
computer data.
1. Penalizes (section 8) sixteen types of cybercrime (Section 4). They are:

Types of Cybercrime Penalty

Prision mayor (imprisonment of six

years and 1 day up to 12 years) or a fine
of at least Two hundred thousand
pesos (P200,000) up to a maximum
amount commensurate to the damage
1. Illegal access incurred or BOTH. If committed against
Unauthorized access (without right) to a critical infrastructure:
computer system or application. Reclusion temporal (imprisonment for
twelve years and one day up to twenty
years) or a fine of at least Five hundred
thousand pesos (P500,000) up to a
maximum amount commensurate to
the damage incurred or BOTH

2. Illegal interception
Unauthorized interception of any non-public
– same as above
transmission of computer data to, from, or
within a computer system.

3. Data Interference
Unauthorized alteration, damaging, deletion or
deterioration of computer data, electronic
document, or electronic data message, and
including the introduction or transmission of – same as above
viruses.Authorized action can also be covered by
this provision if the action of the person went
beyond agreed scope resulting to damages
stated in this provision.

4. System Interference – same as above

Unauthorized hindering or interference with the
functioning of a computer or computer network
by inputting, transmitting, damaging, deleting,
deteriorating, altering or suppressing computer
data or program, electronic document, or
electronic data messages, and including the
introduction or transmission of
viruses.Authorized action can also be covered by
this provision if the action of the person went
beyond agreed scope resulting to damages
stated in this provision.

5. Misuse of devices
The unauthorized use, possession, production,
sale, procurement, importation, distribution, or
otherwise making available, of devices, computer
program designed or adapted for the purpose of
– same as above except fine should be
committing any of the offenses stated in
no more than Five hundred thousand
Republic Act 10175.Unauthorized use of
pesos (P500,000).
computer password, access code, or similar data
by which the whole or any part of a computer
system is capable of being accessed with intent
that it be used for the purpose of committing any
of the offenses under Republic Act 10175.

6. Cyber-squatting
Acquisition of domain name over the Internet in
bad faith to profit, mislead, destroy reputation,
and deprive others from the registering the
same. This includes those existing trademark at
the time of registration; names of persons other – same as above
than the registrant; and acquired with
intellectual property interests in it.Those who get
domain names of prominent brands and
individuals which in turn is used to damage their
reputation – can be sued under this
provision.Note that freedom of expression and
infringement on trademarks or names of person
are usually treated separately. A party can
exercise freedom of expression without
necessarily violating the trademarks of a brand or
names of persons.

7. Computer-related Forgery
Unauthorized input, alteration, or deletion of
computer data resulting to inauthentic data with Prision mayor (imprisonment of six
the intent that it be considered or acted upon for years and 1 day up to 12 years) or a fine
legal purposes as if it were authentic, regardless of at least Two hundred thousand
whether or not the data is directly readable and pesos (P200,000) up to a maximum
intelligible; orThe act of knowingly using amount commensurate to the damage
computer data which is the product of computer- incurred or BOTH.
related forgery as defined here, for the purpose
of perpetuating a fraudulent or dishonest design.

8. Computer-related Fraud
– same as above Provided, That if no
Unauthorized input, alteration, or deletion of
damage has yet been caused, the
computer data or program or interference in the
penalty imposed shall be one (1) degree
functioning of a computer system, causing
lower.
damage thereby with fraudulent intent.

9. Computer-related Identity Theft

Unauthorized acquisition, use, misuse, transfer,
possession, alteration or deletion of identifying – same as above
information belonging to another, whether
natural or juridical.

10. Cybersex Prision mayor (imprisonment of six

Willful engagement, maintenance, control, or years and 1 day up to 12 years) or a fine
operation, directly or indirectly, of any lascivious of at least Two hundred thousand
exhibition of sexual organs or sexual activity, pesos (P200,000) but not exceeding
with the aid of a computer system, for favor or One million pesos (P1,000,000) or
consideration. There is a discussion on this BOTH.
matter if it involves “couples” or “people in
relationship” who engage in cybersex. For as
long it is not done for favor or consideration, I
don’t think it will be covered. However, if one
party (in a couple or relationship) sues claiming
to be forced to do cybersex, then it can be
covered.

11. Child Pornography

Penalty to be imposed shall be one (1)
Unlawful or prohibited acts defined and
degree higher than that provided for in
punishable by Republic Act No. 9775 or the Anti-
Republic Act 9775, if committed
Child Pornography Act of 2009, committed
through a computer system.
through a computer system.

****** Unsolicited Commercial

Communications (SPAMMING)
THIS PROVISION WAS STRUCK DOWN BY THE
SUPREME COURT AS UNCONSTITUTIONAL.

12. Libel
Unlawful or prohibited acts of libel as defined in
Article 355 of the Revised Penal Code, as
amended committed through a computer system
or any other similar means which may be devised
in the future. Revised Penal Code Art. 355
states Libel means by writings or similar means. —
A libel committed by means of writing, printing, Penalty to be imposed shall be one (1)
lithography, engraving, radio, phonograph, degree higher than that provided for by
painting, theatrical exhibition, cinematographic the Revised Penal Code, as amended,
exhibition, or any similar means, shall be and special laws, as the case may be.
punished by Prision Correccional in its minimum
and medium periods or a fine ranging from 200
to 6,000 pesos, or both, in addition to the civil
action which may be brought by the offended
party. The Cybercrime Prevention Act
strengthened libel in terms of penalty provisions.
The electronic counterpart of libel has been
recognized since the year 2000 when the E-
Commerce Law was passed. The E-Commerce
Law empowered all existing laws to recognize its
electronic counterpart whether commercial or
not in nature.

Imprisonment of one (1) degree lower

13. Aiding or Abetting in the commission of than that of the prescribed penalty for
cybercrime – Any person who willfully abets or the offense or a fine of at least One
aids in the commission of any of the offenses hundred thousand pesos (P100,000)
enumerated in this Act shall be held liable. but not exceeding Five hundred
thousand pesos (P500,000) or both.

14. Attempt in the commission of cybercrime Any

person who willfully attempts to commit any of
– same as above
the offenses enumerated in this Act shall be held
liable.

15. All crimes defined and penalized by

the Revised Penal Code, as amended, and special Penalty to be imposed shall be one (1)
laws, if committed by, through and with the use degree higher than that provided for by
of information and communications technologies the Revised Penal Code, as amended,
shall be covered by the relevant provisions of this and special laws, as the case may be.
Act.

Although not exactly a cybercrime, I am including For sanctioned actions, Juridical person
this here as penalties are also imposed by the shall be held liable for a fine equivalent
law. to at least double the fines imposable
16. Corporate Liability. (Section 9) in Section 7 up to a maximum of Ten
When any of the punishable acts herein defined million pesos (P10,000,000).For neglect
are knowingly committed on behalf of or for the such as misuse of computer resources
benefit of a juridical person, by a natural person that resulted to cybercrime committed
acting either individually or as part of an organ of in organization physical or virtual
the juridical person, who has a leading position premises or resources, juridical person
within, based on:(a) a power of representation of shall be held liable for a fine equivalent
the juridical person provided the act committed to at least double the fines imposable
 falls within the scope of such authority;(b) an in Section 7 up to a maximum of Five
authority to take decisions on behalf of the million pesos (P5,000,000).Criminal
juridical person. Provided, That the act liability may still apply to the natural
committed falls within the scope of such person.
authority; or(c) an authority to exercise control
within the juridical person,It also includes
commission of any of the punishable acts made
possible due to the lack of supervision or control.

If you are going to include all provisions in the Revised Penal Code, there can even be more
than 16 types of cybercrime as a result.

2. Liability on other laws

Section 7 was struck down by Supreme Court as it violated the provision on double
jeopardy.

3. Jurisdiction

(a) The Regional Trial Court designated special cybercrime courts shall have jurisdiction over
any violation of the provisions of this Act including any violation committed by a Filipino
national regardless of the place of commission. Jurisdiction shall lie if any of the elements
was committed within the Philippines or committed with the use of any computer system
wholly or partly situation in the country, or when by such commission any damage is caused
to a natural or juridical person who, at the time the offense was committed, was in the
Philippines. (section 21)

(b) For international and trans-national cybercrime investigation and prosecution, all
relevant international instruments on international cooperation in criminal maters,
arrangements agreed on the basis of uniform or reciprocal legislation, and domestic laws, to
the widest extent possible for the purposes of investigations or proceedings concerning
criminal offenses related to computer systems and data, or for the collection of evidence in
electronic form of a criminal offense shall be given full force and effect. (section 21)

This gives the Philippines the ability to participate in treaties and of mutual cooperation with
countries that have counterpart legislation effectively – especially – on cybercrime cases
that have team members or victims residing in the Philippines.

4. Responsibilities of the Philippine National Police (PNP) and National Bureau of

Investigation (NBI)
The law gave police authorities the mandate it needs to initiate an investigation to process
the various complaints/report it gets from citizens. There are instances of online attacks,
done anonymously, where victims approach police authorities for help. They often find
themselves lost in getting investigation assistance as police authorities can’t effectively
initiate an investigation (only do special request) – as their legal authority to request for logs
or data does not exist at all unless a case is already filed.

The PNP and NBI shall be responsible for the enforcement of this law. This includes:

(a) The PNP and NBI are mandated to organize a cybercrime unit or center manned by
special investigators to exclusively handle cases involving violations of this Act. (Section 10).

(b) The PNP and NBI are required to submit timely and regular reports including pre-
operation, post-operation, and investigation results and such other documents as may be
required to the Department of Justice for review and monitoring. (Section 11)

(c) THE SUPREME COURT STRUCK DOWN SECTION 12 THAT IS SUPPOSED TO authorize law
enforcement authorities, without a court warrant, to collect or record by technical or
electronic means traffic data in real-time associated with specified communications
transmitted by means of a computer system. (Section 12) Getting a COURT WARRANT is a
must.

(d) May order a one-time extension of another six (6) months on computer data requested
for preservation. Provided, That once computer data preserved, transmitted or stored by a
service provider is used as evidence in a case, the mere furnishing to such service provider of
the transmittal document to the Office of the Prosecutor shall be deemed a notification to
preserve the computer data until the termination of the case. (Section 13)

(e) Carry out search and seizure warrants on computer data. (section 15) Once done, turn-
over custody in a sealed manner to courts within 48 hours (section 16) unless an extension
for no more than 30 days was given by the courts (section 15).

(f) Upon expiration of time required to preserve data, police authorities shall immediately
and completely destroy the computer data subject of a preservation and examination.
(section 17)

5. The responsibility of service providers (SP)

Service provider refers any public or private entity that provides to users of its service the
ability to communicate by means of a computer system, and processes or stores computer
data on behalf of such communication service or users of such service. (Section 3(n).

(a) SP upon receipt of a court warrant from police authorities to disclose or submit
subscriber’s information, traffic data or relevant data in its possession or control shall
comply within seventy-two (72) hours from receipt of the order in relation to a valid
complaint officially docketed and assigned for investigation and the disclosure is necessary
and relevant for the purpose of investigation. (section 14)

(b) The integrity of traffic data and subscriber information relating to communication
services provided by a service provider shall be preserved for a minimum of six (6) months
period from the date of the transaction. Content data shall be similarly preserved for six (6)
months from the date of receipt of the order from law enforcement authorities requiring its
preservation. (Section 13)

(c) Once computer data preserved, transmitted or stored by a service provider is used as
evidence in a case, the mere furnishing to such service provider of the transmittal document
to the Office of the Prosecutor shall be deemed a notification to preserve the computer data
until the termination of the case. (Section 13)

(d) Upon expiration of time required to preserve data, SP shall immediately and completely
destroy the computer data subject of a preservation and examination. (section 17)

(e) Failure to comply with the provisions of Chapter IV specifically the orders from law
enforcement authorities shall be punished as a violation of Presidential Decree No. 1829 with
imprisonment of prision correccional in its maximum period or a fine of One hundred
thousand pesos (P100,000) or both for each and every non-compliance with an order issued
by law enforcement authorities.

Service Provider protection insofar as liability is a concern is already covered under the E-
Commerce Law.

6. Responsibility of individuals

(a) Individuals upon receipt of a court warrant being required to disclose or submit
subscriber’s information, traffic data or relevant data in his possession or control shall
comply within seventy-two (72) hours from receipt of the order in relation to a valid
complaint officially docketed and assigned for investigation and the disclosure is necessary
and relevant for the purpose of investigation.

(b) Failure to comply with the provisions of Chapter IV specifically the orders from law
enforcement authorities shall be punished as a violation of Presidential Decree No. 1829 with
imprisonment of prision correccional in its maximum period or a fine of One hundred
thousand pesos (P100,000) or both for each and every non-compliance with an order issued
by law enforcement authorities.

7. Inadmissible evidence
(a) Any evidence procured without a valid warrant or beyond the authority of the same shall
be inadmissible for any proceeding before any court or tribunal. (section 18)

8. Access limitation

The Supreme Court struck down Section 19 of the law that gives the Department of Justice
powers to order the blocking of access to a site provided there is prima facie evidence
supporting it.

9. Cybercrime new authorities

(a) Office of Cybercrime within the DOJ designated as the central authority in all matters
relating to international mutual assistance and extradition. (section 23)

(b) Cybercrime Investigation and Coordinating Center (CICC) an inter-agency body to be

created under the administrative supervision of the Office of the President, for policy
coordination among concerned agencies and for the formulation and enforcement of the
national cybersecurity plan. (section 24)

CICC will be headed by the Executive Director of the Information and Communications
Technology Office under the Department of Science and Technology as Chairperson with
the Director of the NBI as Vice Chairperson; the Chief of the PNP, Head of the DOJ Office of
Cybercrime; and one (1) representative from the private sector and academe, as members.
(section 25)

The CICC is the cybercrime czar tasked to ensure this law is effectively implemented.
(section 26)