NOTES ON RA 10175.

Types of Cybercrime Penalty

Prision mayor (imprisonment of six years and 1 day up to 12 years) or  a

fine of at least Two hundred thousand pesos (P200,000) up to a maximum
1.  Illegal access amount commensurate to the damage incurred or BOTH.————————If
Unauthorized access (without right) to a computer system or committed against critical infrastructure:Reclusion temporal
application. (imprisonment for twelve years and one day up to twenty years) or a fine of
at least Five hundred thousand pesos (P500,000) up to a maximum amount
commensurate to the damage incurred or BOTH

2.  Illegal interception

Unauthorized interception of any non-public transmission of  – same as above
computer data to, from, or within a computer system.

3. Data Interference
Unauthorized alteration, damaging, deletion or deterioration of
computer data, electronic document, or electronic data message,
and including the introduction or transmission of – same as above
viruses.Authorized action can also be covered by this provision if
the action of the person went beyond agreed scope resulting to
damages stated in this provision.

4. System Interference
Unauthorized hindering or interference with the functioning of a
computer or computer network by inputting, transmitting,
damaging, deleting, deteriorating, altering or suppressing
computer data or program, electronic document, or electronic data – same as above
messages, and including the introduction or transmission of
viruses.Authorized action can also be covered by this provision if
the action of the person went beyond agreed scope resulting to
damages stated in this provision.

5. Misuse of devices
The unauthorized use, possession, production, sale, procurement,
importation, distribution, or otherwise making available,
of devices, computer program designed or adapted for the purpose
of committing any of the offenses stated in Republic Act – same as above except fine should be no more than Five hundred thousand
10175.Unauthorized use of computer password, access code, or pesos (P500,000).
similar data by which the whole or any part of a computer system
is capable of being accessed with intent that it be used for the
purpose of committing any of the offenses under Republic Act
10175.

6. Cyber-squatting
Acquisition of domain name over the Internet in bad faith to profit,
mislead, destroy reputation, and deprive others from the
registering the same. This includes those existing trademark at the
time of registration; names of persons other than the registrant;
and acquired with intellectual property interests in it.Those who
– same as above
get domain names of prominent brands and individuals which in
turn is used to damage their reputation – can be sued under this
provision.Note that freedom of expression and infringement on
trademarks or names of person are usually treated separately. A
party can exercise freedom of expression without necessarily
violating the trademarks of a brand or names of persons.

7. Computer-related Forgery
Unauthorized input, alteration, or deletion of computer data
resulting to inauthentic data with the intent that it be considered
Prision mayor (imprisonment of six years and 1 day up to 12 years) or a fine
or acted upon for legal purposes as if it were authentic, regardless
of at least Two hundred thousand pesos (P200,000) up to a maximum
whether or not the data is directly readable and intelligible; orThe
amount commensurate to the damage incurred or BOTH.
act of knowingly using computer data which is the product of
computer-related forgery as defined here, for the purpose of
perpetuating a fraudulent or dishonest design.

8. Computer-related Fraud
Unauthorized input, alteration, or deletion of computer data or – same as aboveProvided, That if no damage has yet been caused, the
program or interference in the functioning of a computer system, penalty imposed shall be one (1) degree lower.
causing damage thereby with fraudulent intent.
 9. Computer-related Identity Theft
Unauthorized acquisition, use, misuse, transfer, possession,
– same as above
alteration or deletion of identifying information belonging to
another, whether natural or juridical.

10. Cybersex
Willful engagement, maintenance, control, or operation, directly or
indirectly, of any lascivious exhibition of sexual organs or sexual
activity, with the aid of a computer system, for favor or Prision mayor (imprisonment of six years and 1 day up to 12 years) or a fine
consideration.There is a discussion on this matter if it involves of at least Two hundred thousand pesos (P200,000) but not exceeding One
“couples” or “people in relationship” who engage in cybersex. For million pesos (P1,000,000) or BOTH.
as long it is not done for favor or consideration, I don’t think it will
be covered. However, if one party (in a couple or relationship) sues
claiming to be forced to do cybersex, then it can be covered.

11. Child Pornography
Unlawful or prohibited acts defined and punishable by Republic Penalty to be imposed shall be one (1) degree higher than that provided for
Act No. 9775 or the Anti-Child Pornography Act of 2009, in Republic Act 9775, if committed through a computer system.
committed through a computer system.

****** Unsolicited Commercial
Communications (SPAMMING)
THIS PROVISION WAS STRUCK DOWN BY THE
SUPREME COURT AS UNCONSTITUTIONAL.

12. Libel
Unlawful or prohibited acts of libel as defined in Article 355 of the
Revised Penal Code, as amended committed through a computer
system or any other similar means which may be devised in the
future.Revised Penal Code Art. 355 states Libel means by
writings or similar means. — A libel committed by means of
writing, printing, lithography, engraving, radio, phonograph,
painting, theatrical exhibition, cinematographic exhibition, or any Penalty to be imposed shall be one (1) degree higher than that provided for
similar means, shall be punished by prision correccional in its by the Revised Penal Code, as amended, and special laws, as the case may
minimum and medium periods or a fine ranging from 200 to be.
6,000 pesos, or both, in addition to the civil action which may be
brought by the offended party.The Cybercrime Prevention Act
strengthened libel in terms of penalty provisions.The electronic
counterpart of libel has been recognized since the year 2000 when
the E-Commerce Law was passed. The E-Commerce Law
empowered all existing laws to recognize its electronic counterpart
whether commercial or not in nature.

13. Aiding or Abetting in the commission of cybercrime – Imprisonment of one (1) degree lower than that of the prescribed penalty
Any person who willfully abets or aids in the commission of any of for the offense or a fine of at least One hundred thousand pesos (P100,000)
the offenses enumerated in this Act shall be held liable. but not exceeding Five hundred thousand pesos (P500,000) or both.

14.   Attempt in the commission of cybercrime  Any person

who willfully attempts to commit any of the offenses enumerated  – same as above
in this  Act shall be held liable.

15.  All crimes defined and penalized by the Revised Penal Code, as

Penalty to be imposed shall be one (1) degree higher than that provided for
amended, and special laws, if committed by, through and with the
by the Revised Penal Code, as amended, and special laws, as the case may
use of information and communications technologies shall be
be.
covered by the relevant provisions of this Act.

Although not exactly a cybercrime, I am including this here as

penalties are also imposed by the law.
16. Corporate Liability. (Section 9)
When any of the punishable acts herein defined are knowingly
For sanctioned actions, Juridical person shall be held liable for a fine
committed on behalf of or for the benefit of a juridical person, by a
equivalent to at least double the fines imposable in Section 7 up to a
natural person acting either individually or as part of an organ of
maximum of Ten million pesos (P10,000,000).For neglect such as misuse of
the juridical person, who has a leading position within, based on:
computer resources that resulted to cybercrime committed in organization
(a) a power of representation of the juridical person provided the
physical or virtual premises or resources, juridical person shall be held
act committed falls within the scope of such authority;(b) an
liable for a fine equivalent to at least double the fines imposable in Section
authority to take decisions on behalf of the juridical
7 up to a maximum of Five million pesos (P5,000,000).Criminal liability
person. Provided, That the act committed falls within the scope of
may still apply to the natural person.
such authority; or(c) an authority to exercise control within the
juridical person,It also includes commission of any of the
punishable acts made possible due to the lack of supervision or
control.

If you are going to include all provisions in the Revised Penal Code, there can even be more than 16 types of cybercrime as a result.
2. Liability on other laws

Section 7 was struck down by Supreme Court as it violated the provision on double jeopardy.

3. Jurisdiction

(a) The Regional Trial Court designated special cybercrime courts shall have jurisdiction over any violation of the provisions of this
Act including any violation committed by a Filipino national regardless of the place of commission. Jurisdiction shall lie if any of the
elements was committed within the Philippines or committed with the use of any computer system wholly or partly situation in the
country, or when by such commission any damage is caused to a natural or juridical person who, at the time the offense was
committed, was in the Philippines. (section 21)

(b) For international and trans-national cybercrime investigation and prosecution, all relevant international instruments on
international cooperation in criminal maters, arrangements agreed on the basis of uniform or reciprocal legislation, and domestic
laws, to the widest extent possible for the purposes of investigations or proceedings concerning criminal offenses related to
computer systems and data, or for the collection of evidence in electronic form of a criminal offense shall be given full force and
effect. (section 21)

This gives the Philippines the ability to participate in treaties and of mutual cooperation with countries that have counterpart
legislation effectively – especially – on cybercrime cases that have team members or victims residing in the Philippines.

4. Responsibilities of the Philippine National Police (PNP) and National Bureau of Investigation (NBI)

The law gave police authorities the mandate it needs to initiate an investigation to process the various complaints/report it gets from
citizens. There are instances of online attacks, done anonymously, where victims approach police authorities for help. They often
find themselves lost in getting investigation assistance as police authorities can’t effectively initiate an investigation (only do special
request) – as their legal authority to request for logs or data does not exist at all unless a case is already filed. (which in case of
anonymously done – will be hard to initiate)

I truly believe in giving citizen victims, regardless of stature, the necessary investigation assistance they deserve. This law – gave our
police authorities just that.

The PNP and NBI shall be responsible for the enforcement of this law. This includes:

(a) The PNP and NBI are mandated to organize a cybercrime unit or center manned by special investigators to exclusively handle
cases involving violations of this Act. (Section 10).

(b) The PNP and NBI are required to submit timely and regular reports including pre-operation, post-operation, and investigation
results and such other documents as may be required to the Department of Justice for review and monitoring. (Section 11)

(c) THE SUPREME COURT STRUCK DOWN SECTION 12 THAT IS SUPPOSED TO authorize law enforcement
authorities, without a court warrant, to collect or record by technical or electronic means traffic data in real-time
associated with specified communications transmitted by means of a computer system. (Section 12) Getting a COURT WARRANT is
a must.

(d) May order a one-time extension of another six (6) months on computer data requested for preservation. Provided, That once
computer data preserved, transmitted or stored by a service provider is used as evidence in a case, the mere furnishing to such
service provider of the transmittal document to the Office of the Prosecutor shall be deemed a notification to preserve the computer
data until the termination of the case. (Section 13)

(e) Carry out search and seizure warrants on computer data. (section 15) Once done, turn-over custody in a sealed manner to courts
within 48 hours (section 16) unless an extension for no more than 30 days was given by the courts (section 15).

(f) Upon expiration of time required to preserve data, police authorities shall immediately and completely destroy the computer data
subject of a preservation and examination. (section 17)

5. The responsibility of service providers (SP)

Service provider refers any public or private entity that provides to users of its service the ability to communicate by means of a
computer system, and processes or stores computer data on behalf of such communication service or users of such service. (Section
3(n).
(a) SP upon receipt of a court warrant from police authorities to disclose or submit subscriber’s information, traffic data or relevant
data in its possession or control shall comply within seventy-two (72) hours from receipt of the order in relation to a valid complaint
officially docketed and assigned for investigation and the disclosure is necessary and relevant for the purpose of investigation.
(section 14)

(b) The integrity of traffic data and subscriber information relating to communication services provided by a service provider shall
be preserved for a minimum of six (6) months period from the date of the transaction. Content data shall be similarly preserved for
six (6) months from the date of receipt of the order from law enforcement authorities requiring its preservation. (Section 13)

(c) Once computer data preserved, transmitted or stored by a service provider is used as evidence in a case, the mere furnishing to
such service provider of the transmittal document to the Office of the Prosecutor shall be deemed a notification to preserve the
computer data until the termination of the case. (Section 13)

(d) Upon expiration of time required to preserve data, SP shall immediately and completely destroy the computer data subject of a
preservation and examination. (section 17)

(e) Failure to comply with the provisions of Chapter IV specifically the orders from law enforcement authorities shall be punished as
a violation of Presidential Decree No. 1829 with imprisonment of prision correccional in its maximum period or a fine of One
hundred thousand pesos (P100,000) or both for each and every non-compliance with an order issued by law enforcement
authorities.

Service Provider protection insofar as liability is a concern is already covered under the E-Commerce Law.

6. Responsibility of individuals

(a) Individuals upon receipt of a court warrant being required to disclose or submit subscriber’s information, traffic data or relevant
data in his possession or control shall comply within seventy-two (72) hours from receipt of the order in relation to a valid complaint
officially docketed and assigned for investigation and the disclosure is necessary and relevant for the purpose of investigation.

(b) Failure to comply with the provisions of Chapter IV specifically the orders from law enforcement authorities shall be punished as
a violation of Presidential Decree No. 1829 with imprisonment of prision correccional in its maximum period or a fine of One
hundred thousand pesos (P100,000) or both for each and every non-compliance with an order issued by law enforcement
authorities.

7. Inadmissible evidence

(a) Any evidence procured without a valid warrant or beyond the authority of the same shall be inadmissible for any proceeding
before any court or tribunal. (section 18)

8. Access limitation

The Supreme Court struck down Section 19 of the law that gives the Department of Justice powers to order the blocking of access to
a site provided there is prima facie evidence supporting it.

9. Cybercrime new authorities

(a) Office of Cybercrime within the DOJ designated as the central authority in all matters relating to international mutual assistance
and extradition. (section 23)

(b) Cybercrime Investigation and Coordinating Center (CICC) an inter-agency body to be created under the administrative
supervision of the Office of the President, for policy coordination among concerned agencies and for the formulation and
enforcement of the national cybersecurity plan. (section 24)

CICC will be headed by the Executive Director of the Information and Communications Technology Office under the Department of
Science and Technology as Chairperson with the Director of the NBI as Vice Chairperson; the Chief of the PNP, Head of the DOJ
Office of Cybercrime; and one (1) representative from the private sector and academe, as members. (section 25)

The CICC is the cybercrime czar tasked to ensure this law is effectively implemented. (section 26)

Although the law specifically stated a fifty million pesos (P50,000,000) annual budget, the determination as where it would go or
allotted to, I assume shall be to the CICC.
DEBATE / DISPUTE on the Cybercrime Prevention Act.

In my discussion with lawyers, journalist, bloggers, among others, concerns were raised on how the law can be in violation of the
Constitution and other laws. This includes:

1. Discrimination against online crime.

In crimes committed online, the law gives a higher penalty compared to its offline counterpart. This is seen as a violation of
principles within the E-Commerce Law where both offline and online evidence is given equal weight. In its implementing rules and
regulations, it also indicated not to give special benefit or penalty to electronic transactions just because it is committed online.

However, I note that perhaps the reason for this also is to increase the penalties. The original Revised Penal Code, for example, gives
a penalty for libel in the amount of up to six thousand pesos (P6,000).

2. Did the Cybercrime Law criminalize online libel? Will it result to double jeopardy? Some see the Cybercrime Law as
enabling criminalization of online libel. I think that is not correct.

Libel is a criminal offense as defined under the Revised Penal Code.

The E-Commerce Law empowered all existing laws to recognize its electronic counterpart. It recognized both commercial and non-
commercial in form. This made electronic documents (text message, email, web pages, blog post, etc) admissible as evidence in court
(and can’t be denied legal admissibility just because it is electronic form and has the same primary evidence weight). Existing
penalties under the laws where offense fall in shall apply. That is why the filing of libel cases committed electronically became
possible in the past years (and there were cases filed, some won, some lost, and some are ongoing).

Libel is already a criminal offense under the Revised Penal Code as is. Then it got extended to its electronic form since 2000 (with
the recognition of its electronic form provided by the E-Commerce Law) with existing penalties applying to it. With the Cybercrime
Law, it increased the penalty further if committed with the use of ICT.

According to Atty. Geronimo Sy (Department of Justice), during the PTV4 Forum on Anti-Cybercrime Law, a complaint on
electronic libel will only have one (1) case to be filed. The maximum penalty for electronic libel is 8 years.

Hitting the “Like” button on Facebook does not make you commit the act of libel. In this ANC interview, Senator Ed Angara
clarified that posting a comment where you get to share your thoughts is covered under “protected expression”.

The amount of penalty is still to be set by the DOJ as there is usually no automatic degree scaling in special penal laws. If a person
who got accused of committing electronic libel also did the same in traditional (offline) form, only one case shall be filed. It will be
interesting to see how the DOJ will implement the scaling in effect as a result of this.

The mention of libel in the Cybercrime Law is the most contested provision in the law. The additional penalties is seen to curtail
freedom of expression. Most of the petitions against the Cybercrime Law focused on this provision.

Numerous legislators are already expressing interest as well in amending the Cybercrime Law and Revised Penal Code.

3. Real-time data access

I appreciate the need for real-time access to data, such as cellular traffic data,  especially in tracking scammers and any critical
incident as it happens (such as kidnapping and other in-progress crimes) where immediate access is important.

However, the mining of this data for surveillance can be seen as subject abuse. Furthermore, if no intervention such as a judge
approval, comes first before getting access where need can be justified.