REPUBLIC ACT NO.

8792
Electronic Commerce Act of 2000

Legal recognition of electronic data messages, documents and signatures

Focus: Admissibility of electronic evidence
- Text messages are admissible in court.
- Audios, photos and videos are also admissible.

REYES V. GLOBAL BEER BELOW ZERO (2017)

Reyes was dismissed for being late for several instances and frequent absences. He claimed that he was dismissed by his
superior through a phone call and several text messages.
Global claimed that Reyes was not dismissed and that the latter stopped reporting for work on his own volition.
Employee Reyes submitted machine copies of text messages from the respondents saying: “Tet will contact you plus
turnover” and “Kuya pinaayos ko na kay gen salary mo.”
The "text" messages may be given credence especially if they corroborate the other pieces of evidence presented.

PROBLEM: LIMITED PROHIBITED ACTS

Hacking or cracking
- Unauthorized access into a computer system;
- Interference in a computer system/server or information and communication system;
- Any access in order to corrupt, alter, steal, or destroy without the knowledge and consent of the owner of the computer or
information and communications system; and,
- The introduction of computer viruses and the like, resulting in the corruption, destruction, alteration, theft or loss of
electronic data messages or electronic document.
Penalty: Minimum fine of one hundred thousand pesos (P100,000.00) and a maximum commensurate to the damage
incurred and a mandatory imprisonment of six (6) months to three (3) years;
Piracy
- Unauthorized copying, reproduction, dissemination, distribution, importation, use, removal, alteration, substitution,
modification, storage, uploading, downloading, communication, making available to the public, or broadcasting of protected
material, electronic signature or copyrighted works in a manner that infringes intellectual property rights
Penalty: Minimum fine of one hundred thousand pesos (P100,000.00) and a maximum commensurate to the damage
incurred and a mandatory imprisonment of six (6) months to three (3) years;

REPUBLIC ACT NO. 10175

Cybercrime Prevention Act of 2012

Jurisdiction
1. Any violation committed by a Filipino national regardless of the place of commission
2. Any of the elements was committed within the Philippines or committed with the use of any computer system wholly or
partly situated in the country
3. When by such commission any damage is caused to a natural or juridical person who, at the time the offense was
committed, was in the Philippines.
Offenses under cybercrime courts
• Section 4 of RA 10175
a) Illegal access
b) Illegal interception
c) Data interference
d) System interference
e) Misuse of devices
f) Cyber-squatting
 g) Computer-related forgery
h) Computer-related fraud
i) Computer-related identity theft
j) Cybersex
k) Child pornography
l) Online libel

• Section 5 of RA 10175 (Aiding or abetting, and attempt in the commission of cybercrime)

Does not apply to:
a) Child pornography - to protect Google users
b) Online libel

Punishable Act: Illegal Access

The access to the whole or any part of a computer system without right.
Access, meaning: instruction, communication with, storing data in, retrieving data from, or otherwise making use of
any resources of a computer system or communication network.
Not liable: White hat hackers

Punishable Act: Illegal Interception

Interception, defined: listening to, recording, monitoring or surveillance of the content of communications,
including procuring of the content of data, either directly, through access and use of a computer system or
indirectly, through the use of electronic eavesdropping or tapping devices, at the same time that the
communication is occurring.

Elements:
1. Interception of computer data
2. Computer data was transmitted to, from, or within a computer system, through a non public means including
electromagnetic emissions
3. Interception done through technical means
4. Interception was done without right
Exception: When it is your job to do so, and must be done in the course of employment.

Punishable Act: Data Interference

Alteration, damaging, deletion or deterioration of computer data, electronic document, or electronic data message
- Act may be intentional or reckless
- Act is done without right
- Includes introduction or transmission of viruses
Punishable Act: System Interference
The intentional alteration or reckless hindering or interference with the functioning of a computer or computer network
- Interference done by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing
computer data or program, electronic document, or electronic data message
- Act done without right or authority
- It includes the introduction or transmission of viruses.
Cryptomining Malware
- Also known as “Cryptojacking”
- It refers to software programs and malware components developed to take over a computer's resources and
use them for cryptocurrency mining without a user's explicit permission.
- Reports state that malware are now embedded on certain websites to run mining program on visitor's
computer.
In 2017, security researcher, Willem de Groot, has found 2,496 websites are now using this practice to harness the
CPU power and electricity to mine digital currencies.
 Cybercrime?
a) System interference
b) Data interference

Punishable Act: Misuse Of Devices

1. The use, production, sale, procurement, importation, distribution, or otherwise making available, without right, of:
a) Devices used primarily for cybercrimes; or
b) Computer passwords, access codes or similar data
2. The possession of an item above with intent to use said devices for the purpose of committing any cybercrime.

Exception: Prohibited acts were done as part of an authorized testing of a computer system
Actual case:
a) ATM skimming device
b) Keylogger

Punishable Act: Cyber-Squatting

The acquisition of a domain name over the internet
- Acted in bad faith
- Purpose is to profit, mislead, destroy reputation, and deprive others from registering the same.
Domain name
- The use of domain name pertains to “host name” which is part of a typical Uniform Resource Locator (URL).
The domain name used must be:
1. Similar, identical, or confusingly similar to a registered trademark
2. Identical or in any way similar with the name of a person other than the registrant, in case of a personal name

Microsoft.com vs. MikeRoweSoft.com

Grade 12 student part-time web design business
Settlement: Microsoft gave Mike Rowe an Xbox and cash consideration

Try “facbook.com” and see what will happen! What did Facebook do?

Punishable Act: Computer-Related Forgery

First scenario: The input, alteration, or deletion of any computer data without right resulting in inauthentic data
- Intent is that altered data be considered or acted upon for legal purposes as if it were authentic
- Whether or not the data is directly readable and intelligible is immaterial.
Second scenario: The act of knowingly using computer data which is the product of computer-related forgery.
- Purpose is to perpetuate a fraudulent or dishonest design.
Example: If one forged computer data and
a) No one is harmed yet -> Computer-related forgery
b) One is damaged-> Computer-related fraud

Punishable Act: Computer-Related Fraud

The unauthorized input, alteration, or deletion of computer data or program or interference in the functioning of a
computer system, causing damage thereby with fraudulent intent.
Damage: Not damage to the computer system, but damage to others.

Example: Hack the system of LRA and forge documents to effect an illegal transfer of parcel of land.

Punishable Act: Computer-Related Identity Thef

The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information
belonging to another, whether natural or juridical, without right.
 Damage not required: If no damage caused, penalty is one degree lower
Acquiring and disseminating information made public by the user himself cannot be regarded as a form of theft.
Identifying information refers to any name or number that may be used alone or in conjunction with any other
information to identify any specific individual, including any of the following:
1. Name, date of birth, driver’s license number, passport number or tax identification number;
2. Unique biometric data, such as fingerprint or other unique physical representation;
3. Unique electronic identification number, address or routing code; and
4. Telecommunication identifying information or access device.

Actual case: A was approached by B to join a certain modeling agency. B asked A to submit copies of her IDs
and greeting videos to be used for the latter’s alleged “audition.”
Without the knowledge of A, B used said IDs and videos to put up an online investment scam.
Many people were tricked and were able to send investment money to B. B then shared her
“earnings” to A as her “talent fees.”
Actual cases: Fake Facebook account case

Punishable Act: Cybersex

The willful engagement, maintenance, control, or operation, directly or indirectly, of any lascivious exhibition of sexual
organs or sexual activity, with the aid of a computer system, for favor or consideration.

What if two consenting individuals?

Does this law violate freedom of expression and right to privacy?
Not a crime if two consenting individuals.
Element of “engaging in business” must be present.
It must not constitute cyber prostitution or pornography

Punishable Act: Child Pornography

The unlawful or prohibited acts defined and punishable by Republic Act No. 9775 or the Anti-Child Pornography Act of 2009,
committed through a computer system.
Child pornography, defined: Any representation, whether visual, audio, or written combination thereof, by
electronic, mechanical, digital, optical, magnetic or any other means, of child engaged or involved in real or
simulated explicit sexual activities.
Some prohibited acts under the Anti-Child Pornography Law:
1. To hire, employ, use, persuade, induce or coerce a child to perform in the creation or production of any form of
child pornography; (20 years and 1 day to 40 years AND fine of 1 million to 2 million)
2. To produce, direct, manufacture or create any form of child pornography; (20 years and 1 day to 40 years AND
fine of 1 millionto 2 million)
3. To publish offer, transmit, sell, distribute, broadcast, advertise, promote, export or import any form of child
pornography; (20 years and 1 day to 40 years AND fine of 1 million to 2 million)
4. To possess any form of child pornography with the intent to sell, distribute, publish, or broadcast: Provided.
That possession of three (3) or more articles of child pornography of the same form shall be prima facie
evidence of the intent to sell, distribute, publish or broadcast; (20 years and 1 day to 40 years AND fine of
P750,000.00 to 1 million)
5. To willfully access any form of child pornography; (6 years and 1 day to 8 years AND fine of P200,000.00 to
300,000.00)
6. To possess any form of child pornography. (3 months and 1 day to 4 months AND fine of P50,000.00 to
P100,000.00)

Punishable Act: Online Libel

The unlawful or prohibited acts of libel as defined in Article 355 of the Revised Penal Code, as amended, committed through
a computer system or any other similar means which may be devised in the future.
 Libel, defined: public and malicious imputation of a crime, or of a vice or defect, real or imaginary, or any act,
omission, condition, status, or circumstance tending to cause the dishonor, discredit, or contempt of a natural or
juridical person, or to blacken the memory of one who is dead.

Elements of Libel:
1. Allegation of a discreditable act or condition concerning another;
2. Publication of the charge;
3. Identity of the person defamed; and
4. Existence of malice.

Subject Facebook post: Pedro Batungbakal is a thief!

1. John likes the Facebook post, is he liable? • NO!
2. John shares the Facebook post, is he liable? • NO!
3. John commented “Correct!” on the post, is he liable? • Still NO! He merely expresses agreement with the statement on
the post.
4. John commented “Correct! Pedro Batungbakal likewise beats his wife and children” on the post, is he liable? • YES! This is
an original posting published on the Internet.

Actual case: David case

The accused posted the following in his Facebook account:
“Hoy Maria David! Ikaw malandi ka! Alam naman ng lahat na kahit kanino pumapatol ka! Tuwing gabi nasa park ka,
kasama mo nanay mo! Magkano ba ang rate natin ngayon? 500 hundred, tatlong oras? Ha? Pokpok! Pokpok!
Pokpok kayo ng nanay mo!”

What crime was committed?

- If a minor: Anti-Child Pornography Act in relation to Cybercrime Prevention Act
Penalty: 20 years and 1 day to 40 years AND fine of 1 millionto 2 million
- If not a minor: Anti-Photo and Video Voyeurism Act of 2009
Penalty: 3 years to 7 years AND fine of P100,000.00 to 500,000.00 REPUBLIC ACT NO. 9995 Anti-Photo and
Video Voyeurism Act of 2009

Punishable Acts: Ra 9995 Anti-Photo and Video Voyeurism Act of 2009

1. The unconsented taking of a photo or video of a person or group of persons engaged in a sexual act or any similar
activity, or capturing an image of the private area of a person, under circumstances in which the said person has a
reasonable expectation of privacy;
2. The copying or reproduction of such photo or video recording of the sexual act;
3. The selling or distribution of such photo or video recording;
4. The publication or broadcasting, whether in print or broadcast media, or the showing of such sexual act or any similar
activity through VCD/DVD, the internet, cellular phones, and other similar means or devices without the written
consent of the persons featured.

What does the “private area of a person” include?

The “private area of a person” includes naked or undergarment-clad genitals, pubic area, buttocks, or the female
breast.

What does it mean to have a reasonable expectation of privacy?

1. When the person believes that one could undress in privacy without being concerned that an image of him or her is
being taken; and
 2. When a reasonable person would believe that one’s private area would not be visible regardless of whether the person
is in a public or private place.

Will one be liable for the non- commercial copying or reproduction of said photo or video?
• Yes. The mere copying or reproduction of said material will make one liable under the law regardless of the reason or
whether one profits or not from such act. Indeed, the mere showing of the material on one’s cellphone would violate the
law.

The persons in the photo knew and consented to the video recording or taking of the photo; can I reproduce, distribute, or
broadcast it?
• No. If the person merely consented to the taking of the photo or the video recording and did not give written consent for
its reproduction, distribution, and broadcasting, then anyone committing the said acts shall be held liable

Does RA 9995 cover peeping toms who do not take photo or video recording?
• No. It only covers situations where there was capturing, photographing, recording or copying of sexual acts or private
parts. • But may still be subjected to other civil or criminal cases.
PENALTY: RA 9995
• Penalty: 3 years to 7 years AND fine of P100,000.00 to 500,000.00

Republic Act No. 8484 Access Devices Regulation Act of 1998

Access Device: It means any card, plate, code, account number, electronic serial number, personal identification number, or
other telecommunications service, equipment, or instrumental identifier, or other means of account access that can be used
to obtain money, good, services, or any other thing of value or to initiate a transfer of funds

Prohibited Acts
1. Producing, using, trafficking in one or more counterfeit access devices;
2. Trafficking in one or more unauthorized access devices or access devices fraudulently applied for;
3. Using, with intent to defraud, an unauthorized access device;
4. Using an access device fraudulently applied for;
5. Possessing one or more counterfeit access devices or access devices fraudulently applied for
6. Producing, trafficking in, having control or custody of, or possessing device-making or altering equipment;
7. Inducing, enticing, permitting or allowing another to produce, use traffic counterfeit, unauthorized or fraudulently
applied access devices;
8. Multiple imprinting on more than one transaction record, sales slip or similar document;
9. Disclosing any information imprinted on the access devicewithout the owner’spermission;
10. Obtaining money or anything of value through the use of an access device, with intent to defraud or with intent to gain
and fleeing thereafter
11. Possessing, without authority, an access device or material where the access device is indicated;
12. Writing on sales slips approval numbers when no approval was given;
13. Effecting transaction with other’s access device
14. Soliciting without authority of issuer of access device

CZ V. PEOPLE (2017) • A---- De S--- C--- was found in possession of Citibank Visa credit card number 4539 7207 8677 7008,
which bore the name "G---- S-----." • He used the same credit card to purchase Ferragamo shoes worth US$363.00 at Duty
Free Fiesta Mall. Citibank Visa credit card number 4539 7207 8677 7008 was later proven to be a counterfeit access device.
Penalty:
a) Use: 10 to 12 years of imprisonment AND a fine of US$726.00 or Php37,752.00
b) Possession: 6 to 10 years of imprisonment AND a fine of Php10,000.00
Other Cybercrimes
Sextortion: Online Robbery
Online Privacy Issue

Vivares V. St. Theresa’s College (2014)

Facebook Post Vivares v. St. Theresa's College, G.R. No. 202666, September 29, 2014
Julia and Julienne were both minors and graduating students of St. Theresa's College (STC). In a beach party, they
took pictures of themselves only in their undergarments. These pictures were uploaded by their friend Angela on her
Facebook account.
Using STC’s computers, the students of Escudero (computer teacher) logged in to their respective personal
Facebook accounts and showed her photos of Julia, Julienne and other students.
After STC’s investigation, Julia, Julienne, Angela and other students involved were barred from joining the
commencement exercises.
Minors' contention: Photos were viewable only to the five of them, thus their right to privacy was violated.

HELD:
It is suggested, that a profile, or even a post, with visibility set at "Friends Only" cannot easily, more so
automatically, be said to be "very private," contrary to petitioners’ argument.
No invasion of privacy by STC: Respondents were mere recipients of what were posted. They did not resort to any
unlawful means of gathering the information as it was voluntarily given to them by persons who had legitimate access to the
said posts.

“FRIENDS ONLY” SETTING NOT ENOUGH

Reason: A friend of your friend (the former not being your friend) can still view your “for Friends Only” photo under
certain circumstances.
a) The user’s own Facebook friend can share said content or tag his or her own Facebook friend thereto,
regardless of whether the user tagged by the latter is Facebook friends or not with the former.
b) Also, when the post is shared or when a person is tagged, the respective Facebook friends of the person who
shared the post or who was tagged can view the post, the privacy setting of which was set at "Friends."

PRIVATE IF “ONLY ME” or “CUSTOM” SETTING

Had it been proved that "Only Me" privacy setting, or "Custom" setting had been used, the result may have been
different, for in such instances, the intention to limit access to the particular post, instead of being broadcasted to the public
at large or all the user’s friends en masse, becomes more manifest and palpable.

Taken from:
SEMINAR ON CYBERCRIME LAWS Atty. Marco Polo E. Cunanan Public Attorney II, PAO San Fernando (P) District Lecturer,
Tarlac State University School of Law