v. Cybercrime Warrants (AM 17-11-03-SC)

Cybercrime Warrants (A.M. No. 17-11-03-SC)

Concept

Cybercrime warrants are judicial orders for obtaining or examining computer data under the Rule on Cybercrime Warrants. They address investigative acts involving digital evidence; they are not warrants of arrest. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)

Governing provisions

The principal authorities are the Rule on Cybercrime Warrants and the Cybercrime Prevention Act of 2012. Section 16 of the Act also governs the deposit with the court of computer data examined under a proper warrant. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants) (Sec. 16, Rep. Act No. 10175)¹

Requisites / Rules

• Warrant to disclose computer data (WDCD): Directs a person or service provider to disclose specified computer data in its possession or control. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)
• Warrant to intercept computer data (WICD): Authorizes interception of specified communications or computer data while the communication is occurring. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)
• Warrant to search, seize, and examine computer data (WSSECD): Authorizes a search for, seizure of, and examination of specified computer data. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)
• Warrant to examine computer data (WECD): Authorizes examination of computer data or a computer device already lawfully acquired, where judicial authority to examine its contents is required. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)
• The application must establish the grounds required for the particular warrant. The judge—not the investigating officers—determines whether the showing justifies the requested access to specified data. A warrant must not become a general authorization to explore unrelated files or communications. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants) (Stonehill v. Diokno, G.R. No. L-19550, 19 June 1967)²

Distinctions

Disclosure, interception, and examination are different investigative acts. Disclosure obtains data held by another person; interception captures a communication as it occurs; examination inspects data in a device or system. Identify the act sought before choosing the warrant. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)

Key doctrines

Under Section 16, computer data examined under a proper warrant must be deposited with the court in a sealed package within 48 hours after the warrant’s fixed period expires, together with the executing authority’s affidavit and certification concerning copies. Opening the package, replaying recordings, using them in evidence, or revealing their contents requires a court order upon motion, with notice and an opportunity to be heard by the persons concerned. (Sec. 16, Rep. Act No. 10175)¹

Do not treat Section 12’s authorization for warrantless real-time collection of traffic data as an operative exception: the Supreme Court declared that provision unconstitutional. A valid judicial authorization must be assessed under the applicable cybercrime-warrant rules. (Sec. 12, Rep. Act No. 10175)³ (Disini v. Secretary of Justice, G.R. No. 203335, 11 February 2014)

Bar tip

In a problem involving a seized phone or computer, separate the lawfulness of acquiring the device from the authority to examine its data. Then identify the appropriate cybercrime warrant and the limits of its scope. (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants)