CDI 9

Introduction to Cybercrime and Environmental Laws

Cybercrime

Crime committed with or through the use of information and communication technologies, such as radio, television, cellular phones, computer network: and other communication devices or application.

Cybercrime

Is any crime that takes place online or primarily online.

Cybercrime (PNP Revised Criminal Investigation Manual of 2011)

Any ILLEGAL BEHAVIOR committed by means of, or in relation to a COMPUTER SYSTEM or network, including such crimes as illegal possession, offering or distributing information by means of a computer system of network.

The Budapest Convention on Cybercrime / RA 10175 “Cybercrime Prevention Act of 2012”

1. Offenses against the confidentiality, integrity and availability of computer data and systems

2. Computer-related offenses

3. Content-related offenses

4. Copyright-related offenses

IP (Intellectual Property) Crimes

COUNTERFEITING (infringement of trademarks) and PIRACY (infringement of copyright).

1. Digital

2. Physical

Email Spoofing

A spoofed email is one that appears to originate from one source but actually has been sent from another source.

Cyber Defamation

This occurs when defamation takes place with the help of computers and/or the Internet.

Cyber Stalking

The criminal follows the victim by sending emails and frequently entering the chat rooms that causes an intentional, substantial and unreasonable intrusion and mental distress into the private life of the person.

Unauthorized Access / Illegal Access / Hacking

Involves gaining access illegally to a computer system or network and in some cases making unauthorized use of this access.

Email Bombing

This refers to sending a large number of emails to the victim's mail account or mail servers leading to crashing.

Salami Attack

These attacks are often used in committing financial crime and are based on the idea that an alteration, so insignificant, would go completely unnoticed in a single case.

Denial of Service (DOS) Attack

This involves flooding a computer resource with more requests than it can handle, causing the resource (e.g. a web server) to crash thereby denying authorized users the service offered by the resource.

Distributed Denial of Service (DDOS) Attack

The perpetrators are many and are geographically widespread.

Viruses

Attaches to a host program and requires human action to spread when that file is moved or executed. They usually affect the data on a computer, either by altering or deleting it.

Worms

Spread itself to other computers and does not require user action. Stand-alone malicious software that spreads without the need for user activity.

Logic Bombs

These are event dependent programs where programs kick into action only when a certain event (known as a trigger event) occurs or may lie dormant throughout the year and become active only on a particular date.

Trojan Attacks

An unauthorized program which functions from inside what seems be an authorized program, thereby concealing what it is actually doing.

Web Jacking

This occurs when someone forcefully takes control of a website (by cracking the password and later changing it).

Cyber-Terrorism

Cyber-dependent crimes perpetrated for political objectives to provoke fear, intimidate, and/or coerce a government or population, causing or threatening to cause severe harm.

Cyber-Extortion

Occurs when a website, email server, or computer system is subjected to or threatened attacks by malicious hackers. These hackers demand money in return for promising to stop the attacks and to offer "protection".

Ransomware

Malware designed to take users' system, files, and/or data hostage and relinquish control back to the user only after ransom is paid.

Phishing and Pharming

Fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication.

Phishing

Must entice a user to the website through 'bait' in the form of a phony email or link,

Pharming

Re-directs victims to the bogus site when clicked.

White Hat Hackers (Ethical Hackers)

Strive to operate in the public's best interest, rather than to create turmoil.

Black Hat Hackers (Malicious / Criminal Hackers)

Intentionally gain unauthorized access to networks and systems with malicious intent.

Gray Hat Hackers

Access systems without authorization, offer to fix vulnerabilities.

Cybersecurity

Is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user's assets.

Cyber Intelligence

Can be defined as the tracking, analyzing and countering of digital security threats.

Illegal Access

The access to the whole or any part of a computer system without right.

Illegal Interception

The interception made by technical means without right of any non-public transmission of computer data to, from, or within a computer system including electromagnetic emissions from a computer system carrying such computer data.

Data Interference

The intentional or reckless alteration, damaging, deletion or deterioration of COMPUTER DATA, electronic document, or electronic data message, without right, including the introduction or transmission of viruses.

Misuse of Devices

Committed through any of the following acts:

• The use, production, sale, procurement, importation, distribution or otherwise making available, intentionally and without right, of any of the following:
  1. device, including a computer program, designed or adapted primarily for the purpose of committing any of the offenses under this rule; or
  2. a computer password, access code, or similar data by which the whole or any part of a computer system is capable of being accessed with the intent that it be used for the purpose of committing any of the offenses under this rules.

• The possession of an item referred to in subparagraphs 5(i) (aa) or (bb) above, with the intent to use said devices for the purpose of committing any of the offenses under this section.

System Interference

The intentional alteration, or reckless hindering or interference with the FUNCTIONING OF A COMPUTER or computer deleting, deteriorating, altering or suppressing network by inputting, transmitting, damaging. computer data or program, electronic document or electronic data message, without right or authority, including the introduction or transmission of viruses.

Cybersquatting

The acquisition of a domain name over the internet in bad faith to profit, mislead, destroy reputation, and deprive others from registering the same.

Computer Related Forgery

• The input, alteration or deletion of any computer data without right, RESULTING IN INAUTHENTIC DATA, with the intent that it be considered or acted upon for legal purposes as if it were authentic, regardless whether or not the data is directly readable and intelligible; or

• The act of KNOWINGLY USING COMPUTER DAТА, WHICH IS THE PRODUCT OF COMPUTER-RELATED FORGERY as defined herein, for the purpose of perpetuating a fraudulent or dishonest design.

Computer Related Fraud

The unauthorized input, alteration or deletion of computer data or program, or interference in the functioning of a computer system, causing damage thereby with FRAUDULENT INTENT.

Computer-Related Identity Theft

The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of IDENTIFYING INFORMATION BELONGING TO ANOTHER, whether natural or juridical, without right.

Cybersex

The willful engagement, maintenance, control, or operation, directly or indirectly, of ANY LASCIVIOUS EXHIBITION OF SEXUAL ORGANS OR SEXUAL ACTIVITY, with the aid of a computer system, for favor or consideration.

Child Pornography (1 degree higher penalty)

The unlawful or prohibited acts defined and punishable by Republic Act No. 9775 or the Anti Child Pornography Act of 2009, committed through a computer system.

Cyberlibel

The unlawful or prohibited acts of libel, as defined in Article 355 of the Revised Penal Code, as amended, committed through a computer system or any other similar means which may be devised in the future. Provided, that this provision applies only to the original author of the post or online libel, and not to others who simply receive the post and react to it.

Unsolicited Commercial Communications

Transmission of commercial electronic communication with the use of computer system which seek to advertise, sell, or offer for sale products and services are prohibited.

1 degree lower

Penalty for:

1. Aiding or Abetting in the Commission of Cybercrime.

2. Attempt to Commit Cybercrime.

Cybercrime Warrants

Are judicial orders that involve the following acts relevant to computer data:

• The keeping of data that is protected from deterioration

• Disclosure of confidential data or information

• Monitoring and listening of the content of communications

• Search, seizure, and/or examination

• Custody and destruction of computer data

These are in connection with Republic Act RA No. 10175 which also known as the "Cybercrime Prevention Act of 2012"

Warrant to Disclose Computer Data

Type of cybercrime warrant that:

An order in writing, issued in the name of the People of the Philippines,signed by a judge, upon application of law enforcement authorities, authorizing the latter:

• to issue an order to disclose and

• accordingly, require any person or service provider

• to disclose or submit subscriber's information, traffic data, or relevant data in his or its possession or control (A.M. No. 17-11-03-SC, Sec. 4.2).

Warrant to Intercept Computer Data

Type of cybercrime warrant that:

An order in writing, issued in the name of the People of the Philippines, signed by a judge, upon application of law enforcement authorities, authorizing the latter to carry out any or all of the following activities:

• (a) listening to, (b) recording, (c) monitoring, or (d) surveillance of the content of communications, including procuring of the content of computer data, either directly, through access and use of a computer system or indirectly, through the use of electronic eavesdropping or tapping devices, at the same time that the communication is occurring (AM. No. 17-11-03-SC, Sec. 5.2).

Warrant to Search, Seize, and Examine Computer Data

A type of cybercrime warrant that:

An order in writing, issued in the name of the People of the Philippines, signed by a judge, upon application of law enforcement authorities, authorizing the latter to search the particular place for items to be seized and/or examined (A.M. No. 17-11-03-SC, Sec. 6.1).

Warrant to Examine Computer Data

Type of cybercrime warrant that:

Required to be applied for and obtained by law enforcement authorities, upon acquiring possession of a computer device or computer system via a lawful warrantless arrest, or by any other lawful method, and before searching the said computer device or computer system for the purpose of obtaining for forensic examination the computer data contained therein (A.M. No. 17-11-03-SC, Sec. 6.9).

Within seventy-two (72) hours

Law enforcement authorities, upon securing a court warrant, shall issue an order requiring any person or service provider to disclose or submit subscriber's information, traffic data or relevant data in his/its possession ог control _____ from receipt of the order in relation to a valid complaint officially docketed and assigned for investigation and the disclosure is necessary and relevant for the purpose of investigation.

Shall not exceed a period of ten (10) days

Any warrant issued under this Rule shall only be effective for the length of time as determined by the court, which _____ from its issuance.

Not exceeding ten (10) days

The court issuing the warrant may, upon motion, extend its effectivity based only on justifiable reasons for a period ______ from the expiration of the original period.

Service Providers

Any public or private entity that provides to users of its service the ability to communicate by means of a computer system.

Subscribers Information

Refers to any information contained in the form of computer data or any other form that is held by a service provider.

Six (6) months

Service providers preserves info for a minimum period of _____ from the date of the transaction.

Six (6) months

Content data shall be similarly preserved for _____ from the date of receipt of the order from law enforcement authorities requiring its preservation.

Six (6) months

Law enforcement authorities may order a one-time extension for another _____.

Forty-eight (48) hours

All computer data, including content and traffic data, examined under a proper warrant shall, within _____ after the expiration of the period fixed therein, be deposited with the court in a sealed package, and shall be accompanied by an affidavit of the law enforcement authority executing it stating the dates and times covered by the examination, and the law enforcement authority who may access the deposit, among other relevant data.

Immediately and completely destroy

Upon expiration of the periods as provided in Sections 13 and 15, service providers and law enforcement authorities, as the case may be, shall _____ the computer data subject of preservation and examination.

Cybercrime Investigation and Coordination Center (CICC)

An inter-agency body to be known as the _____, under the administrative supervision of the Office of the President, for policy coordination among concerned agencies and for the formulation and enforcement of the national cybersecurity plan.

DOJ - Office of Cybercrime (DOJ-OOC)

Is an office within the DOJ created under RA 10175 and Is designated as the CENTRAL AUTHORITY in all matters relating to international mutual assistance and extradition for cybercrime cases. Is also tasked to monitor and review cybercrime and cyber-related cases being handled by the NBI and PNP.

National Bureau of Investigation - Cybercrime Division (NBI-CCD)

Is tasked to investigate all cyber related crimes punishable under RA 10175 and related laws, and to establish and maintain and Incident Response Team and Digital Forensic Section that will be responsible for responding to the current and emerging cyber threats and conducting digital forensic examination and analysis.

PNP - Anti Cybercrime Group (PNP-ACG)

Investigates all cybercrimes and other crimes in which information and Communications technology (ICT) is used in the commission of the criminal acts or the objects of attack, conduct data recovery and forensic analysis on all computer, computer peripherals and storage devices, and other digital evidence seized by the PNP units and any other law enforcement agencies within the country.

RA 10173

Data Privacy Act of 2012

National Privacy Comission

Attached to the Department of Information and Communications Technology (DICT). To administer and implement the provisions of this Act, and to monitor and ensure compliance of the country with international standards set for data protection, there is hereby created an independent body.

Unauthorized processing of personal information and sensitive personal information

It is committed when the processing of the same was done without the required consent of the data subject or the person whose personal information is being processed, or without being authorized under the Data Privacy Act or any existing law.

Accessing personal information and sensitive personal information due to negligence

It is committed when a person provided access to personal information of the data subject due to his or her negligence.

Improper disposal of personal information and sensitive personal information

It is committed when a person knowingly or negligently disposes, discards, or abandons the personal information of an individual in an area accessible to the public or has otherwise placed the personal information of an individual in its container for trash collection.

Processing of personal information and sensitive personal information for unauthorized purposes

It is committed when a person processed personal information for purposes not authorized by the data subject or otherwise authorized under the Data Privacy Act or under existing laws.

Unauthorized access or intentional breach

It is committed when a person knowingly and unlawfully violates data confidentiality and security data systems, breaks in any way into any system where personal and sensitive personal information is stored.

Concealment of security breaches involving sensitive personal information

It is committed when a person, after having knowledge of a security breach and of the obligation to notify the National Privacy Commission, intentionally or by omission conceals the fact of such security breach.

Malicious disclosure

It is committed when a person, with malice or in bad faith, discloses unwarranted or false information relative to personal information or personal sensitive information obtained by him.

Unauthorized disclosure

It is committed when a person discloses to a third person personal information without the consent of the data subject. In this mere disclosure without the consent of the data subject is prohibited.

Environmental Law (Environmental and Natural Resources Law)

Is a collective term describing the network of treaties, statutes, regulations, common and customary laws addressing the effects of human activity on the natural environment.

Department of Environment and Natural Resources (DENR)

The implementing agency of environmental law.

PD 1586 (Environmental Impact Statement (EIS) System of 1978)

States that "No person, partnership or corporation shall undertake or operate any such declared environmentally critical project or area without first securing an Environmental Compliance Certificate issued by the President or his duly authorized representative."

Environmental Compliance Certificate

Is a document issued by the DENR-EMB after a positive review of an ECC application, certifying that based on the representations of the proponent, the proposed project or undertaking has complied with all the requirements of the EIS System and has committed to implement its approved Environmental Management Plan, EMP to address the environmental impacts.

Project is not considered as environmentally critical

All other projects, undertakings and areas not declared by the President as environmentally critical shall be considered as non-critical and shall NOT BE REQUIRED TO SUBMIT an environmental impact statement.

Violation of Standards for Stationary Sources

For actual exceedance of any pollution or air quality standards under this Act or its rules and regulations, the Department, through the Pollution Adjudication Board (PAB), shall impose a fine of not more than One hundred thousand pesos (P100,000.00) for every day of violation against the owner or operator of a stationary source until such time that the standards have been complied with.

Violation of Standards for Motor Vehicles

No motor vehicle shall be registered with the DOTC unless it meets the emission standards set by the Department as provided in Sec. 21 hereof. Any vehicle suspected of violation of emission standards through visual signs, such as, but not limited to smoke-belching, shall be subjected to an emission test by a duly authorized emission testing center.

Roadside inspection system

The DOTC or its authorized testing center shall establish a ______.

No violation

Immediate release of the vehicle.

Violation

Continued custody of the impounded vehicle unless penalties are paid.

License plate surrendered

Unless vehicle is repaired + Owner will be given a PASS valid for a period not exceeding seven (7) days to give way for repairs.

Driver and operator

_____ of the apprehended vehicle shall undergo a seminar on pollution control management.

Ban on Incineration

Incineration, hereby defined as the burning of municipal, bio-medicat and hazardous wastes, which process emits poisonous and toxic fumes, is hereby prohibited. Provided, however, that the prohibition SHALL NOT APPLY to traditional small-scale method of community/neighborhood sanitation "siga", traditional, agricultural, cultural, health, and food preparation and crematoria.

RA 9275

Clean Water Act of 2004

RA 9003

Philippine Ecological Solid Waste Management Act of 2000

RA 9147

Wildlife Resourcers Conservation and Protection Act of 2001

Wildlife

Means wild forms and varieties of flora and fauna in all developmental stages, including those which are in captivity or are being bred or propagated.

Habitat

Means place or environment where species or subspecies naturally occur or has naturally established its population.

Department of Environment and Natural Resources (DENR)

Shall have jurisdiction over all terrestrial plant and animal species, all turtles and wetland species, inctuding but not limited to crocodiles, waterbirds and all amphibians and dugong.

Department of Agriculture (DA)

Shall have jurisdiction over all declared aquatic eritical habitats, all aquatic resources including but not limited to all fishes, aquatic plants, invertebrates and all marine mammals, except dugong.

Secretaries of the DENR and DA

Shall review, and by joint administrative order revise and regularly update the list of species under their respective jurisdiction.

Palawan Council for Sustainable Development

In the Province of Palawan, jurisdiction herein conferred is vested to the _____ pursuant to Republic Act No. 7611.

Economically Important Species

Means species or subspecies which have actual or potential value in trade or utilization for commercial purpose.

Endemic Species

Means species or subspecies which is naturally occurring and found only within specific areas in the country.

Exotic Species

Means species or subspecies which do not naturally occur in the country.

Threatened Species

A general term to denote species or subspecies considered as critically endangered, endangered, vulnerable or other accepted categories of wildlife whose population is at risk of extinction.

Critically Endangered Species

Refers to a species or subspecies that is facing extremely high risk of extinction in the wild in the immediate future; e.g. Tamaraw, Philippine Crocodile, Tarsier

Endangered Species

Refers to species or subspecies that is NOT CRITICALLY ENDANGERED but whose survival in the wild is unlikely if the causal factors continue operating. e.g. PH Spotted deer, Pawikan