Rule on Cybercrime Warrants

Rule on Cybercrime Warrants

sets for the procedure for the application and grant of warrants and related orders involving the preservation, disclosure, interception, search, seizure, and or examination, as well as the custody, and destruction of computer data, as provided under RA No. 10175.

Computer data

refers to any representation of facts, information, or concepts in a form suitable for processing in a computer system, including a program suitable to cause a computer system to perform a function, and includes electronic documents and/or electronic data messages whether stored in local computer systems or online

subscriber information, traffic/non-content data, content data

Classifications of Computer Data (3)

Subscriber Information

Refers to any information that is held by a service provider, relating to subscribers of its services other than traffic or content data.

Traffic or Non-Content data

Refers to any computer data other than the content of the communication, which is usually computergenerated.

Content Data

Refers to the contents of the communication

Preservation

is the activity that keeps stored data secured and safe

Preservation Request/Order

is an Order from the LEAs mandating the service providers to keep, preserve, and maintain the integrity of the computer data subject thereof.

Preservation Request/Order

It is a condition sine qua non before an application for a cyber warrant may be filed in court.

6 months

(Section 3.1. Preservation of Computer Data) Service Provider - minimum period of ____ from the date of the transaction.

6 months

(Section 3.1. Preservation of Computer Data) Content data - preserved for ___ from the date of receipt of the order from law enforcement authorities requiring its preservation.

6 months

(Section 3.1. Preservation of Computer Data) Law enforcement authorities may order a ONE-TIME extension for another ____

one-time extension

This may be granted, provided, that once computer data that is preserved, transmitted or stored by a service provider is used as evidence in a case, the receipt by the service provider of a copy of the transmittal document to the Office of the Prosecutor shall be deemed a notification to preserve the computer data until the final termination of the case and/or as ordered by the court.

disclose, intercept, and search, seizure and examination of computer data

Types of Cybercrime Warrants

warrant to disclose computer data

WDCD meaning

warrant to disclose computer data

Authorizes LEAs to issue an order to disclose and require any person or service provider to disclose or submit computer data in his/her or its possession or control.

48 hours

Return on the disclosure of computer data: Within __ from implementation or after the expiration of the effectivity of the WDCD

retained copy

Return on the disclosure of computer data: Law enforcement authorities are allowed to retain a copy of the disclosed computer data subject of the WDCD if:

1. Used for case build-up/PI; and

2. Kept confidential and labelled as ____

warrant to intercept computer data

WICD meaning

warrant to intercept computer data

an order in writing issued in the name of the People of the Philippines, signed by a judge, upon application of law enforcement authorities, authorizing the latter to carry out any or all of the following activities: (a) listening to, (b) recording, (c) monitoring, or (d) surveillance of the content of communications, including procuring of the contents of computer data.

warrant to intercept computer data

Said Activities are conducted either DIRECTLY or INDIRECTLY.

(direct) Through access and use of computer system, or (indirect) through the use of electronic eavesdropping or tapping devise at the same time that the communication is occurring.

48 hours

Return on the interception of computer data: Within ____ from implementation or after the expiration of the effectivity of the WICD.

30 days

Notice after filing of return WICD: Within __ from the filing of return; or from the lapse of the 48 hour period to file a return, the law enforcement authority has the duty to notify the person whose communication or computer data have been intercepted.

10 days

Notice after filing of return WICD: Within ___ from receipt of notice, the person may challenge, by motion, the legality of the interception.

warrant to search, seize, and examine computer data

WCCECD meaning

warrant to search, seize, and examine computer data

This authorizes LEAs to search a particular place for items to be seized and/or examined. It allows the conduct of both PHYSICAL and VIRTUAL SEARCH.

warrant to search, seize, and examine computer data

Once issued, interception may be conducted without the need of another warrant for such purpose. Period to examine fixed by court, which may be extended not exceeding 30 days upon motion for justifiable reasons.

on-site

WSSECD general rule: The LEAs must endeavor to conduct an ___ search by first making a FORENSIC IMAGE of the COMPUTER DATA ON-SITE as well as to limit their search to the place specified in the warrant

off-site

WSSECD exception: if not practicable, an __ SEARCH may be made, provided 1. Forensic image is nevertheless made, and 2.The reason for such off-site search is stated in the initial return

10 days

Effectivity period of warrants, general rule: __ from the issuance of the warrant

10 days

Effectivity period of warrants, exception: May be extended based on justifiable reasons for a period not exceeding ____ from the expiration of the original period.