Rules and Regulations ImplementingRepublic Act No. 10175, Otherwise Known as the!"bercrime #re$ention Act o% &01&'Pursuant tothe authority of the Department of Justice, Department ofInterior and Local Government, and Department of Science and Technology underRepublic ct !o" #$#%&, other'ise (no'n as the )*ybercrime Prevention ct of+$#+,, the follo'ing rules and regulations are hereby promulgated to implementthe provisions of said ct-R()* 1#reliminar" #ro$isions+ection 1. Title. , These Rules shall be referred to as the Implementing Rules andRegulationsofRepublicct !o" #$#%&, orthe)*ybercrimePreventionct of+$#+,"+ection &.Declaration of Policy.. The State recogni/es the vital role ofinformation and communications industries, such as content production,telecommunications, broadcasting, electronic commerce and data processing, in theState0s overall social and economic development" The State also recogni/es the importance of providing an environment conducivetothe development, acceleration, andrational applicationande1ploitationofinformation and communications technology to attain free, easy,andintelligibleaccesstoe1changeand2ordeliveryofinformation3 andtheneedtoprotect andsafeguard the integrity of computer, computer and communications systems,net'or(s and databases, andthe confidentiality, integrity, and availability ofinformationanddatastoredthereinfromallformsofmisuse, abuseandillegalaccess by ma(ing punishable under the la' such conduct or conducts"TheStateshall adopt sufficient po'erstoeffectivelyprevent andcombat suchoffensesbyfacilitating theirdetection,investigationandprosecution at both thedomestic andinternational levels, andbyprovidingarrangements for fast andreliable international cooperation"1+ection -.Definition of Terms.. The follo'ing terms are defined as follo's-a4 Accessrefers to the instruction, communication 'ith, storing data in,retrieving data from, or other'ise ma(ing use of any resources of acomputer system or communication net'or(3b4 Act refers to Republic ct !o" #$#%& or the )*ybercrime Prevention ct of+$#+,3c4 Alteration refers to the modification or change, in form or substance, of ane1isting computer data or program3d4 Central Authority refers to the D5J . 5ffice of *ybercrime3e4 ChildPornographyreferstotheunla'ful orprohibitedactsdefinedandpunishable by Republic ct !o" 6%%& or the )nti7*hild Pornography ctof +$$6,, committed through a computer system- Provided, that the penaltytobeimposedshall beone8#4 degreehigher thanthat providedfor inRepublic ct !o" 6%%&3f4 Collection refers to gathering and receiving information3g4 Communicationrefers to the transmission of information throughinformationandcommunicationtechnology8I*T4media, includingvoice,video and other forms of data3h4 Competent Authorityrefers to either the *ybercrime Investigation and*oordinating *enter or the D5J . 5ffice of *ybercrime, as the case may be3i4 Computerrefers toanelectronic, magnetic, optical, electrochemical, orother data processing or communications device, or grouping of suchdevices, capable of performing logical, arithmetic, routing or storagefunctions, and 'hich includes any storage facility or e9uipment orcommunications facilityor e9uipment directlyrelatedtoor operatingin2con:unction'ithsuchdevice" It covers anytype of computer device,includingdevices 'ithdata processing capabilities li(e mobile phones,smart phones, computer net'or(s and other devices connected to theinternet3:4 Computer data refers to any representation of facts, information, or conceptsin a form suitable for processing in a computer system, including a programsuitabletocauseacomputer systemtoperformafunction, andincludeselectronic documents and2or electronic data messages 'hether stored in localcomputer systems or online3(4 Computer program refers to a set of instructions e1ecuted by the computerto achieve intended results3l4 Computer system refers to any device or group of interconnected or relateddevices, one or more of 'hich, pursuant to a program, performs automatedprocessingof data" It covers anytype of device 'ithdata processingcapabilities, including, but not limited to, computers and mobile phones" Thedevice consisting of hard'are and soft'are may include input, output andstorage components, 'hich may stand alone or be connected to a net'or( orother similar devices" It alsoincludes computer datastoragedevices ormedia3m4 Content Datareferstothecommunicationcontent ofthecommunication,the meaning or purport of the communication, or the message or informationbeing conveyed by the communication, other than traffic data"n4 Critical infrastructurerefers tothecomputer systems, and2or net'or(s,'hetherphysicalorvirtual,and2or thecomputerprograms,computer dataand2or trafficdatathat aresovital tothiscountrythat theincapacityordestructionof or interference'ithsuchsystemandassets'ouldhaveadebilitating impact on security, national or economic security, nationalpublic health and safety, or any combination of those matters3o4 Cybersecurityreferstothecollectionoftools, policies, ris(managementapproaches, actions, training, best practices, assurance and technologies thatcan be used to protect the cyber environment, and organi/ation and user0sassets33p4 National Cybersecurity Planrefers toa comprehensive planof actionsdesigned to improve the security and enhance cyber resilience ofinfrastructures and services" It is a top7do'n approach to cybersecurity thatcontains broad policy statements and establishes a set of national ob:ectivesand priorities that should be achieved 'ithin a specific timeframe394 Cybersexrefers to the 'illful engagement, maintenance, control oroperation, directly or indirectly, of any lascivious e1hibition of se1ualorgans or se1ual activity, 'ith the aid of a computer system,for favor orconsideration3r4 Cyber refers to a computer or a computer net'or(, the electronic medium in'hich online communication ta(es place3s4 Databaserefers to a representation of information, (no'ledge, facts,concepts or instructions 'hich are being prepared, processed or stored, orhave been prepared, processed or stored in a formali/ed manner, and 'hichare intended for use in a computer system3t4 Digital evidencerefers to digital information that may be used as evidenceinacase" Thegatheringofthedigitalinformationmaybecarriedoutbyconfiscation of the storage media 8data carrier4, the tapping or monitoring ofnet'or( traffic, or the ma(ing of digital copies 8e.g.,forensic images, filecopies, etc"4, of the data held3u4 Electronicevidencerefersto evidence,theuse of 'hichissanctioned bye1isting rules of evidence, in ascertaining in a :udicial proceeding, the truthrespecting a matter of fact, 'hich evidence is received, recorded,transmitted, stored, processed, retrieved or produced electronically3v4 Forensics refers to the application of investigative and analytical techni9uesthat conform to evidentiary standards, and are used in, or appropriate for, acourt of la' or other legal conte1t34'4 Forensic image, also (no'n as a forensic copy, refers to an e1act bit7by7bitcopy of a data carrier, including slac(, unallocated space and unused space"There are forensic tools available for ma(ingthese images" ;ost toolsproduce information, li(e a hash value, to ensure the integrity of the image314 ashvaluereferstothemathematical algorithmproducedagainst digitalinformation8afile, aphysical dis(or alogical dis(4 therebycreatinga)digital fingerprint, or )digital D!, for that information" It is a one7'ayalgorithmandthusit is not possibletochangedigital evidence'ithoutchanging the corresponding hash values3y4 !dentifyinginformationreferstoanynameornumber that maybeusedalone or in con:unction 'ith any other information to identify any specificindividual, including any of the follo'ing-#" !ame, date of birth, driver0s license number, passport number or ta1identification number3+" 84 is committedagainst critical infrastructure, the penalty of reclusion temporal, or a fine of8at least Aive @undred Thousand Pesos 8 &$$,$$$"$$4 up to ma1imum amount commensurate to the damage incurred, or both shall be imposed" ?" !omputer1related O%%enses, 'hich shall be punished 'ith imprisonment ofprision mayor, or a fine of at least T'o @undred Thousand Pesos8 +$$,$$$"$$4 uptoa ma1imumamount commensurate tothe damage incurred, or both, are as follo's-#" !omputer1related 2orger" . a" The input, alteration or deletion of any computer data 'ithout right,resulting in inauthentic data, 'ith the intent that it be considered oracted uponfor legal purposes as if it 'ere authentic, regardless'hether or not the data is directly readable and intelligible3 orb" The act of (no'inglyusingcomputerdata,'hich is theproductofcomputer7related forgery as defined herein, for the purpose ofperpetuating a fraudulent or dishonest design"+" !omputer1related 2raud. The unauthori/ed input, alteration ordeletion of computer data or program, or interference in the functioningofacomputersystem, causingdamagethereby'ithfraudulent intent-Provided, That if no damage has yet been caused, the penalty imposableshall be one 8#4 degree lo'er"=" !omputer1relatedIdentit"3he%t.Theintentional ac9uisition, use,misuse, transfer, possession, alteration or deletion of identifyinginformationbelongingtoanother, 'hethernatural or:uridical, 'ithoutright-Provided,That if nodamagehas yet beencaused, thepenaltyimposable shall be one 8#4 degree lo'er"*" !ontent1related O%%enses-#" nypersonfoundguiltyof *hildPornographyshall be punishedinaccordance 'ith the penalties set forth in Republic ct !o" 6%%& or the)nti7*hild Pornography ct of +$$6,- Provided, That the penalty to beimposed shall be one 8#4 degree higher than that provided for in Republicct !o" 6%%& if committed through a computer system"9+ection 5.$ther Cybercrimes.. The follo'ing constitute other cybercrimeoffenses punishable under the ct-#" !"ber1s4uatting. The ac9uisition of a domain name over the internet,in bad faith, in order to profit, mislead, destroy reputation, and depriveothers from registering the same, if such a domain name is-a" Similar, identical, or confusinglysimilar toane1istingtrademar(registered 'ith the appropriate government agency at the time of thedomain name registration3b" Identical or in any 'ay similar 'ith the name of a person other thanthe registrant, in case of a personal name3 andc" c9uired 'ithout right or 'ith intellectual property interests in it"*yber7s9uatting shall be punished 'ith imprisonment ofprision mayor,or a fine of at least T'o @undred Thousand Pesos 8 +$$,$$$"$$4 up to a ma1imumamount commensurate to the damage incurred, or both-Provided,That if it is committed against critical infrastructure, thepenalty ofreclusion temporal, or a fine of at least Aive @undredThousand Pesos 8 &$$,$$$"$$4 up to ma1imum amount commensurate to the damage incurred, or both shall be imposed" +" !"berse5. The 'illful engagement, maintenance, control or operation,directlyorindirectly, ofanylasciviouse1hibitionofse1ual organsorse1ual activity, 'ith the aid of a computer system, for favor orconsideration" ny person found guilty cyberse1 shall be punished 'ithimprisonment ofprision mayor, or a fine of at least T'o@undredThousandPesos 8 +$$,$$$"$$4, but not e1ceeding5ne;illionPesos 8 #,$$$,$$$"$$4, or both" *yberse1involvingachildshall bepunishedinaccordance'iththeprovision on child pornography of the ct"Bhere the maintenance, control, or operation of cyberse1 li(e'iseconstitutes an offense punishable under Republic ct !o" 6+$C, as10amended, a prosecution under the ct shall be 'ithout pre:udice to anyliabilityfor violationof anyprovisionoftheRevisedPenal *ode, asamended, or special la's, includingR"" !o" 6+$C, consistent 'ithSection C hereof" =" )ibel . The unla'ful or prohibited acts of libel, as defined in rticle =&&of the Revised Penal *ode, as amended, committed through a computersystem or any other similar means 'hich may be devised in the futureshall bepunished'ithprisioncorreccionalinitsma1imumperiodtoprision mayorin its minimumperiod or a fine ranging fromSi1Thousand Pesos 8 D,$$$"$$4 up to the ma1imum amount determined by *ourt, or both, in addition to the civil action 'hich may be brought bytheoffendedparty-Provided,That this provisionapplies onlytotheoriginal author of the post or online libel, and not to others 'ho simplyreceive the post and react to it" >" Othero%%enses.Thefollo'ingacts shall alsoconstituteanoffense'hich shall be punished 'ith imprisonment of one 8#4 degree lo'er thanthat of the prescribed penalty for the offense,or a fine of at least 5ne@undred Thousand Pesos 8 #$$,$$$"$$4 but not e1ceeding Aive @undred Thousand Pesos 8 &$$,$$$"$$4, or both- " iding or betting in the *ommission of *ybercrime" . ny person'ho 'illfully abets, aids, or financially benefits in the commission ofany of the offenses enumerated in the ct shall be held liable, e1cept'ith respect to Sections >8c48+4 on *hild Pornography and >8c48>4 ononline Libel"?" ttempt to *ommit *ybercrime" . ny person 'ho 'illfully attemptstocommit anyoftheoffensesenumeratedinthectshallbeheldliable, e1cept 'ith respect to Sections >8c48+4 on *hild Pornography and >8c48>4on online Libel"Other )iabilities and #enalties+ection 6.Corporate "iability. . Bhen any of the punishable acts herein definedare (no'ingly committed on behalf of or for the benefit of a :uridical person, by anatural personactingeither individuallyoraspart ofanorganofthe:uridical11person, 'ho has a leading position 'ithin, based on- 8a4 a po'er of representationof the :uridical person3 8b4 an authority to ta(e decisions on behalf of the :uridicalperson3 or 8c4 anauthoritytoe1ercisecontrol 'ithinthe:uridical person, the:uridical person shall be held liable for a fine e9uivalent to at least double the finesimposable in Section % up to a ma1imum of Ten ;illion Pesos 8 #$,$$$,$$$"$$4" If the commission of any of the punishable acts herein defined 'as madepossible due to the lac( of supervision or control by a natural person referred toand described in the preceding paragraph, for the benefit of that :uridical person bya natural person acting under its authority, the :uridical person shall be held liablefor a fine e9uivalent to at least double the fines imposable in Section % up to ama1imum of Aive ;illion Pesos 8 &,$$$,$$$"$$4" The liability imposed on the :uridical person shall be 'ithout pre:udice tothe criminal liability of the natural person 'ho has committed the offense"+ection 7. *iolation of the )evised Penal Code+ as Amended+ Through and (iththe ,se of !nformation and Communication Technology.. ll crimes definedand penali/ed by the Revised Penal *ode, as amended, and special criminal la'scommittedby, throughand'iththe use of informationandcommunicationstechnologies shall be covered by the relevant provisions of the ct- Provided, Thatthe penalty to be imposed shall be one 8#4 degree higher than that provided for bythe Revised Penal *ode, as amended, and special la's, as the case may be" +ection7."iability under $ther"a#s..prosecutionunder the ctshall be'ithout pre:udicetoanyliabilityforviolationofanyprovisionoftheRevisedPenal *ode, as amended, or special la's-Provided, That this provision shall notapplytotheprosecutionofanoffender under8#4bothSection>8c48>4ofR""#$#%& and rticle =&= of the Revised Penal *ode3 and 8+4 both Section >8c48+4 ofR"" #$#%& and R"" 6%%& or the )nti7*hild Pornography ct of +$$6,"R()* -*n%orcement and Implementation+ection 8. "a# Enforcement Authorities. . The !ational ?ureau of Investigation8!?I4 andthe Philippine !ational Police 8P!P4 shall be responsible for theefficient and effective la' enforcement of the provisions of the ct" The !?I and12theP!Pshall organi/eacybercrimedivisionorunit tobemannedbySpecialInvestigators to e1clusively handle cases involving violations of the ct"The !?I shall create a cybercrime division to be headed by at least a @ead gent"The P!P shall create an anti7cybercrime unit headed by at least a Police Director"The D5J 7 5ffice of *ybercrime 855*4 created under the ct shall coordinate theefforts of the !?I and the P!P in enforcing the provisions of the ct"+ection 10.Po#ers and Functions of "a# Enforcement Authorities.. The !?Iand P!P cybercrime unit or division shall have the follo'ing po'ers andfunctions-a" Investigate all cybercrimes 'here computer systems are involved3b" *onduct datarecoveryandforensicanalysisoncomputersystemsandother electronic evidence sei/ed3c" Aormulateguidelinesininvestigation, forensicevidencerecovery, andforensic data analysis consistent 'ith industry standard practices3d" Provide technological support to investigating units 'ithin the P!P and!?I includingthesearch, sei/ure, evidencepreservationandforensicrecoveryof datafromcrimescenes andsystems usedincrimes, andprovide testimonies3e" Develop public, private sector, and la' enforcement agency relations inaddressing cybercrimes3f" ;aintain necessary and relevant databases for statistical and2ormonitoring purposes3 g" Developcapacity'ithintheir organi/ations inorder toperformsuchduties necessary for the enforcement of the ct3h" Supporttheformulationandenforcement ofthenationalcybersecurityplan3 andi" Perform other functions as may be re9uired by the ct"13+ection 11.Duties of "a#Enforcement Authorities.. To ensure that thetechnical nature of cybercrime and its prevention is given focus, and consideringthe procedures involved for international cooperation, la' enforcement authorities,specifically the computer or technology crime divisions or units responsible for theinvestigationof cybercrimes, arere9uiredtosubmit timelyandregular reportsincludingpre7operation, post7operationandinvestigationresults, andsuchotherdocumentsasmaybere9uiredtotheDepartment ofJustice8D5J4.5fficeof*ybercrime for revie' and monitoring"La' enforcement authorities shall act in accordance 'ith the guidelines, advisoriesand procedures issued and promulgated by the competent authority in all mattersrelatedto cybercrime,andutili/e the prescribedformsand templates, including,but not limited to, preservation orders, chain of custody, consent to search, consentto assume account2online identity and re9uest for computer forensic e1amination"+ection1&.Preservationand)etentionof ComputerData. .Theintegrityoftraffic data and subscriber information shall be (ept, retained and preserved by aserviceproviderforaminimumperiodofsi18D4monthsfromthedateofthetransaction" *ontent data shall be similarly preserved for si1 8D4 months from thedate of receipt of the order fromla'enforcement authorities re9uiring itspreservation" La' enforcement authorities may order a one7time e1tension for another si1 8D4months- Provided, That once computer data that is preserved, transmitted or storedby a service provider is used as evidence in a case, the mere act of furnishing suchserviceprovider 'ithacopyof thetransmittal document tothe5fficeof theProsecutor shall be deemed a notification to preserve the computer data until thefinal termination of the case and2or as ordered by the *ourt, as the case may be" The service provider ordered to preserve computer data shall (eep the order and itscompliance there'ith confidential" +ection 1-. Collection of Computer Data. La' enforcement authorities, upon theissuance of a court 'arrant, shall be authori/ed to collect or record by technical orelectronicmeans, andtheserviceprovidersarere9uiredtocollect orrecordbytechnicalorelectronicmeansand2ortocooperateandassist inthecollectionor14recordingof computer datathat areassociated'ithspecifiedcommunicationstransmitted by means of a computer system"Thecourt 'arrant re9uiredunder thissectionshall beissuedor grantedupon'ritten application, after the e1amination under oath or affirmation of the applicantand the 'itnesses he may produce, and the sho'ing that- 8#4 there are reasonablegrounds tobelieve that any of the crimes enumerated hereinabove has beencommitted, is being committed or is about to be committed3 8+4 there arereasonable grounds to believe that the evidence that 'ill be obtainedis essential tothe conviction of any person for, or to the solution of, or to the prevention of anysuch crimes3 and 8=4 there are no other means readily available for obtaining suchevidence"+ection 1..Disclosure of Computer Data.. La' enforcement authorities, uponsecuringacourt 'arrant, shall issueanorder re9uiringanypersonor serviceprovider to disclose or submit, 'ithin seventy7t'o 8%+4 hours from receipt of suchorder, subscriber0s information, traffic data or relevant data in his2its possession orcontrol, inrelationtoa validcomplaint officiallydoc(etedandassigned forinvestigation by la'enforcement authorities, and the disclosure of 'hich isnecessary and relevant for the purpose of investigation"La'enforcement authoritiesshall recordall s'orncomplaintsintheir officialdoc(eting system for investigation" +ection15.%earch+ %ei-ureandExaminationof ComputerData..Bhereasearch and sei/ure 'arrant is properly issued, the la' enforcement authorities shallli(e'ise have the follo'ing po'ers and duties- a" Bithin the time period specified in the 'arrant, to conduct interception,as defined in this Rules, and to-#" Search and sei/e computer data3+" Secure a computer system or a computer data storage medium3 =" ;a(e and retain a copy of those computer data secured3 >" ;aintain the integrity of the relevant stored computer data3 15&" *onduct forensic analysis or e1amination of the computer datastorage medium3 and D" Render inaccessible or remove those computer data in the accessedcomputer or computer and communications net'or("b" Pursuant thereto, the la' enforcement authorities may order any person,'ho has (no'ledge about the functioning of the computer system and themeasures to protect and preserve the computer data therein, to provide, asis reasonable, the necessary information to enable the underta(ing of thesearch, sei/ure and e1amination"c" La'enforcement authoritiesmayre9uest for ane1tensionof timetocomplete the e1amination of the computer data storage medium and toma(e a return thereon, but in no case for a period longer than thirty 8=$4days from date of approval by the court"+ection 16.Custody of Computer Data.. ll computer data, including contentand traffic data, that are e1amined under a proper 'arrant shall, 'ithin forty7eight8>C4 hours after the e1piration of the period fi1ed therein, be deposited 'ith thecourtinasealedpac(age, andshallbeaccompaniedbyanaffidavit ofthela'enforcement authoritye1ecutingit, statingthedatesandtimes coveredbythee1amination, andthela'enforcement authority'homayhave access tothedeposit, amongother relevant data" Thela'enforcement authorityshall alsocertify that no duplicates or copies of the 'hole or any part thereof have been madeor, if made, that all such duplicates or copies are included in the pac(age deposited'ith the court" The pac(age so deposited shall not be opened, or the recordingsreplayed, or used in evidence, or their contents revealed, e1cept upon order of thecourt, 'hich shall not be granted e1cept upon motion, 'ith due notice andopportunity to be heard to the person or persons 'hose conversation orcommunications have been recorded"+ection 17.Destruction of Computer Data..