Philippine Cybercrime Prevention Act (RA 10175)

Republic Act No. 10175.

The lawful identification, collection, preservation, examination, and analysis of evidence relating to offenses involving computer systems, networks, or digital technologies.

Information of potential evidentiary value that is stored, transmitted, or processed in digital form.

Any representation of facts, information, or concepts in a form suitable for processing in a computer system, including programs capable of causing a computer system to perform a function.

A device or group of interconnected or related devices that performs automated data processing pursuant to a program.

Accessing the whole or any part of a computer system without right.

Interception by technical means, without right, of nonpublic transmissions of computer data to, from, or within a computer system, including covered electromagnetic emissions.

Intentional or reckless alteration, damaging, deletion, or deterioration of computer data, electronic documents, or electronic data messages without right, including introduction or transmission of viruses.

Intentional alteration or reckless hindering or interference with the functioning of a computer or computer network by specified unauthorized acts involving computer data or programs.

Specified unlawful production, sale, procurement, importation, distribution, or possession of devices, programs, passwords, or access codes intended for committing covered cybercrime offenses.

Bad-faith acquisition of a domain name over the internet to profit, mislead, destroy reputation, or deprive others of registration, when the statutory conditions are met.

Unauthorized input, alteration, or deletion of computer data resulting in inauthentic data intended to be considered or acted upon as authentic for legal purposes.

Unauthorized input, alteration, deletion, or interference involving computer data or systems causing damage with fraudulent intent, as provided by law.

Intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another, without right, under the statute.

Libel as defined under the Revised Penal Code when committed through a computer system or other similar means, subject to applicable constitutional rulings and jurisprudence.

Disini v. Secretary of Justice, G.R. No. 203335, February 18, 2014.

Computer data other than content data relating to a communication by means of a computer system, including its origin, destination, route, time, date, size, duration, or type of underlying service.

The substance or meaning of a communication, as distinguished from traffic or subscriber-related information.

Information held by a service provider relating to a subscriber, such as identifying or service details, excluding traffic and content data as defined by applicable rules.

To require preservation of specified computer data so that potentially relevant evidence is not lost while lawful access or disclosure is pursued.

At least six months from the date of the transaction, subject to applicable extensions and legal requirements.

At least six months from receipt of an order from law enforcement authorities requiring preservation, subject to applicable law.

A.M. No. 17-11-03-SC, the Rule on Cybercrime Warrants.

A judicial warrant authorizing the disclosure of specified computer data under the conditions of the Rule on Cybercrime Warrants.

A judicial warrant authorizing specified interception of computer data under the conditions and safeguards prescribed by the Rule on Cybercrime Warrants.

A judicial warrant authorizing specified search, seizure, and examination of computer data or related systems under the applicable rule.

A judicial warrant authorizing forensic examination of computer data lawfully obtained through means covered by the Rule on Cybercrime Warrants.

Computer data may be protected by constitutional privacy rights and statutes requiring judicial authorization or another recognized legal basis.

The creation of a forensic copy of digital storage media using procedures designed to preserve and verify relevant data.

A copy reproducing the data at the bit level from the selected source or acquisition scope, subject to technical limitations.

A fixed-length output produced by a cryptographic algorithm from input data, commonly used to help verify digital evidence integrity.

To help determine whether the compared digital data remained unchanged during handling or transfer.

No. It supports data integrity but does not independently establish the source, authorship, lawful acquisition, or truth of the contents.

A device or software control intended to prevent modification of source storage media during appropriate forensic acquisition or examination.

Data that may be lost when a system loses power or changes state, such as certain memory contents and active process information.

Data stored in media that ordinarily retains information without continuous power, such as solid-state drives and hard disks.

Information describing other data, such as file creation times, modification records, device details, or communication attributes.

They may be affected by time-zone settings, incorrect system clocks, synchronization errors, or later modification.

A record of the tools, methods, personnel, dates, times, settings, and relevant results of a digital evidence acquisition.

To maintain a reference source for verification, reexamination, and evaluation of the integrity of forensic copies.

Collection of selected files, records, or data accessible through the operating system or another logical interface.

Collection of data at a lower storage level, potentially including areas unavailable through ordinary file-level access, depending on the device.

To document possession, transfers, access, and handling so the identity and integrity of the evidence can be evaluated.

It may help identify a network connection or service endpoint at a particular time but does not by itself establish the identity of the person using it.

It may associate an account or service with identifying information, subject to verification and lawful disclosure requirements.

Device attribution links activity to equipment or an account; personal attribution requires evidence identifying who actually performed the activity.

That the compared data are consistent at the time of hashing, not that every statement within the data is true.

Who actually used the connection or device, whether the records are reliable, and whether other evidence supports personal responsibility.

Potential violation of constitutional privacy protections and the statutory and judicial safeguards governing interception.

No. Examination must remain within the authority granted by applicable law, consent, or a valid judicial warrant.