FUNDAMENTALS OF CRIMINAL INVESTIGATION

Criminal Investigation
- is an art which deals with the identity and location of the offender
and provides evidence of guilt through criminal proceedings.

Investigation/ Investigator (ILP Rule) (a person who is charged with

the duty of carrying on the objectives of criminal investigation) process
and analysis of facts or collection of facts to accomplish a threefold aim:
a)to identify the guilty party;
b)to locate the guilty party; and
c)to provide evidence of his guilt.

CRIME SCENE INVESTIGATION

It is the conduct of processes, more particularly, the recognition,
handling, preservation and documentation of physical evidence to
include the identification and interview of witnesses and the arrest of
suspect/s at the crime scene.

CRIME SCENE
- a venue or place where the alleged crime/ incident/ event has been
committed.

Cardinal Rule in Crime Scene Investigation? MAC Rule (Hans

Gross)
Do not touch, move, alter anything in the crime scene unless it has
been properly photograph, sketch and recorded. MAC Rule Do not
Move, Alter, Change the crime scene

What are the qualities of a good investigator?

Perseverance
Intelligence
Honest
Understanding of the people and environment
Keen power of observation

MODES OF INVESTIGATON

1) Reactive response
- addresses crimes that have already occurred.

2) Proactive response
- To anticipate criminal activity; investigation is conducted before the
crime is committed; the suspect is identified before committing a crime.

3) Preventive Response
prevention through deterrence is sometimes achieved by arresting the
criminal and by aggressive prosecution
Investigation to get progress should be done in two approaches
Filing thru:

A. Inquest Proceeding
Or
B. Preliminary Investigation

Miranda Doctrine and Rules on Arrest

Primary Job of an investigator

-Discover the offense committed
- determining what specific offense
- 5 ws1 H

What is warrant of Arrest?

a written order issued by the judge to arrest a person or take him into
custody to make him answer for an offense in violation of a law.

What is Arrest ?
- is the taking of a person into custody in order that he may be bound to
answer for the commission of an offense.
When can you arrest?
Rules on Arrest under 113 Section 5 rules on warrantless Arrest

Miranda Doctrine

How made :
An arrest is made by an actual restraint of a person to be arrested,
or by his submission to the custody of the person making the arrest.

Duty of arresting officer. — It shall be the duty of the officer executing

the
warrant to arrest the accused and to deliver him to the nearest
police station or jail without unnecessary delay

It is also their duty to brought the hospital for immediate medical

examination (REPUBLIC ACT NO. 7438, April 27, 1992)
AN ACT DEFINING CERTAIN RIGHTS OF PERSON ARRESTED,
DETAINED OR UNDER CUSTODIAL INVESTIGATION AS WELL
AS THE DUTIES OF THE ARRESTING, DETAINING, AND
INVESTIGATING OFFICERS, AND PROVIDING PENALTIES FOR
VIOLATIONS THEREOF

Penalty (Six thousand pesos (P6,000.00) or a penalty of

imprisonment of not less than eight (8) years but not more than ten
(10) years, or both.)
 Republic Act No. 9745 AN ACT PENALIZING TORTURE AND
OTHER CRUEL, INHUMAN AND DEGRADING TREATMENT OR
PUNISHMENT AND PRESCRIBING PENALTIES THEREFOR

SEC. 12. Right to Physical, Medical and Psychological

Examination. — Before and after interrogation, every person
arrested, detained or under custodial investigation shall have the
right to be informed of his/her right to demand physical examination
by an independent and competent doctor of his/her own choice. If
such person cannot afford the services of his/her own doctor, he/she
shall be provided by the State with a competent and independent
doctor to conduct physical examination.

Time of making arrest. — An arrest may be made on any day and at

any time of
the day or night.

Method of arrest by officer without warrant. — When making an

arrest without a
warrant, the officer shall inform the person to be arrested of his
authority and the cause of the arrest, unless the latter is either
engaged in the commission of an offense, is pursued immediately
after its commission, has escaped, flees or forcibly resists before the
officer has opportunity so to inform him, or when the giving of such
information will imperil the arrest. (8a)

Method of arrest by private person. — When making an arrest, a

private
person shall inform the person to be arrested of the intention to
arrest him
and cause of the arrest, unless the latter is either engaged in the
commission of an offense, is pursued immediately after its
commission, or has escaped, flees, or forcibly resists before the
person making the arrest has opportunity to so inform him, or when
the giving of such information will imperil the arrest. (9a)

Search Warrant
An order in writing, issued in the name of the People of the
Philippines, signed by a judge and directed to a peace officer,
commanding him to search for certain personal property and bring it
before the court.

WARRANTLESS SEARCHES

 Search Incidental to Lawful Arrest

 Plain View Searches
 Consented Search
CAN THE POLICE OFFICER SEIZE ANYTHING THAT IS NOT
INCLUDED IN THE WARRANT?

No, anything not included in the warrant cannot be seized EXCEPT if

its mala prohibita, in which case, the seizure is justified under the plain
view doctrine.

CAN THE OWNER OF THE THINGS SEIZED BE MADE TO SIGN

THE RECEIPT?

No since this would be tantamount to a violation of one’s right

against self-incrimination. It is a confession without the
assistance of counsel.

What is the purpose or Why there is need to Conduct

Investigation?

To solve crimes exist which threaten for protection of Rights, Life,

Property, and Liberty inherent power of the state the Police Power

How to conduct and who will conduct?

It is the primary rule of law Enforcement Agency to Conduct

Investigation who has jurisdiction over the person and the case in
the application of all factual methods which uses scientific to give
factual result.

When Investigation does starts?

It starts thru a complaint?

What if it is not reported, is it Subject for Investigation?

Yes, verification of authenticity of existing information in questioned

is always the concern to address the public safety.
Composition of the CSI Team

Team Leader
Evidence Collectors
Evidence Custodian
City or Municipal/Health Officer (Optional)
Crime Photographer
Sketcher/Measurer
Evidence Custodian/Security Officer
Security and Protection of the crime Scene

Tools needed in Investigation?

Evidence Kit /Finger Print Kit

Brief Procedural Action of a Crime Scene (All procedures must be
Photograph)

-Initial Assessment
- Initial Walk Through ( to what Intent the scene is covered)
- Establishment of Marker of Flag lets
- Tagging
- Marking
-Collection
-Turnover to the Custodian-

What is to be investigated?

The things to be investigated are those visible which representation

CRIME Scene occurs which Body of the Crime (corpus delicti ) portrays.

What is the basis of the Investigation in certain Crimes?

-Elements of the Crime Violated

Examples of Crimes Scene you want to Conduct?

What is chain of custody?

It is the number of persons who handle the evidence between the

time of the commission of the offense and the ultimate disposition
of the case and should be kept for court presentation.

GOLDEN RULE: CHAIN OF COSTUDY (In every transfer there is always

a traces)

Next Preparation of documents and Transmittal of Evidences

collected.

WHEN DOES PHOTOGRAPH HAPPENS?

Three Major Types of Pictorial Views

1. Long- range photograph of the overall scene

Distance: From the doorway to the room and other corners of
the room
2. Mid- range photograph
Distance: Eight or ten feet from the victim
3. Close- up photograph

When are you going to do Crime Scene Sketches?

 At the very start of respond for processing until its presentation.

Crime Scene Sketches

Sketches are useful in questioning of suspects and witnesses as well

as in the writing of investigative reports.

Rough sketch is prepared indicating the actual measurement of

things with scale and proportion observed and oriented to the North
Pole

Finish Sketch- Detailed Sketched from A rough Sketch

Specific kinds of sketch

Locality- give picture of the scene, the crime and its environs,
including neighboring buildings, roads etc.
Ground- picture of the scene of the crime with its nearest physical
Exploded/ cross projection- gives the clear impression of the
scene in cases where blood stains or bullet holes are found

Rectangular coordinates method

Triangulation method
Baseline method
Compass point method
Cross projection method

What do you understand by circumstantial evidence?

Is identification established indirectly by proving other facts or

circumstances from which either alone or in connection with other
facts, the identity of this perpetrator can be inferred.

What must be inferred to prove identity by circumstantial

evidence?

Elements of Crime (MTO RULE)

Motive (Offender) Opportunity (Time) Capability (Offender)

TOOLS OF INVESTIGATION (3 I’s) Three Is in Investigation or Tools

in Investigation

INFORMATION
It is the knowledge/ data which an investigator acquires from records and
persons (Regular Sources (Gov)/Cultivated Sources ( Inf) / prisoners)
INTERVIEW
Is a conversation with a purpose, motivated by a desire to obtain certain

information from the person being interviewed as to what was either

done, seen, felt, heard, tasted, smell or known.

I.R.O.N.I.C. FORMAT

The interview of a witness can be described by its acronym

‘IRONIC’ which stands for Identity, Rapport, Opening

Statement, Narration, Inquiry, and conclusion.

INTERROGATION
is a questioning of a person suspected if having committed an
offense or

a person who is reluctant

to make full disclosure of information in his possession which is
pertinent to the investigation.

(One question, Simplicity and Avoid close ended questions.)

INSTRUMENTATION

Application of scientific or forensic approaches such as application

of Criminalistics such as Ballistic,DNA, Photography, Dactyloscopy
(Fingerprint)

Philosophy of Interview and Interrogation:

The RIGHT officer asking the RIGHT questions in the RIGHT
manner at the RIGHT time and in the RIGHT place will get the
RIGHT answers.

TYPES OF CONFESSION

1. Judicial confession- confession done in the court.

2. Non- judicial confession or extra- judicial confession- called “out

of court’,this kind of confession is inadmissible in court unless
corroborated by proof of corpus delicti.

What is Evidence?

Evidence is the means, sanctioned by these rules, of ascertaining

in a judicial proceeding the truth respecting a matter of fact
Admissibility of evidence. — Evidence is admissible when it is
relevant to the issue and is not excluded by the law of these rules
 Object as evidence. — Objects as evidence are those addressed to
the senses of the court. When an object is relevant to the fact in issue, it
may be exhibited to, examined or viewed by the court.
Documentary evidence. — Documents as evidence consist of
writing or any material containing letters, words, numbers, figures,
symbols or other modes of written expression offered as proof of their
contents.
Witnesses; their qualifications. — Except as provided in the next
succeeding section, all persons who can perceive, and perceiving, can
make their known perception to others, may be witnesses.
Testimony generally confined to personal knowledge; hearsay
excluded. — A witness can testify only to those facts which he knows of
his personal knowledge; that is, which are derived from his own
perception, except as otherwise provided in these rules. (30a)
Exceptions To The Hearsay Rule
Section 37. Dying declaration. — The declaration of a dying
person, made under
Opinion Rule
General rule. — The opinion of witness is not admissible, except as
indicated as expert witness
Opinion of expert witness. — The opinion of a witness on a
matter requiring special knowledge, skill, experience or training which he
shown to posses, may be received in evidence. (43a)
Opinion of ordinary witnesses. — The opinion of a witness for
which proper basis is given, may be received in evidence regarding —
(a) the identity of a person about whom he has adequate
knowledge;
(b) A handwriting with which he has sufficient familiarity; and
(c) The mental sanity of a person with whom he is sufficiently
acquainted.

What is the Corpus Delicti, and what must it prove?

Corpus delicti is the body of the crime or fact of specific loss or injury
sustained

What are those Evidences needed for court presentation?

Physical Evidence- these are the articles and materials which re found
in connection with the investigation and aid in establishing the identity of
the suspect.

What do you understand by circumstantial evidence?

Circumstantial evidence is identification established indirectly by proving
other facts or circumstances from which either alone or in connection with
other facts, the identity of this perpetrator can be inferred.

Associative evidence
-are the physical evidence which may identify the criminal by means of
clues, personal properties, or the characteristics patterns of procedure
deduced from the arrangement of objects at the scene
What are the qualities of a good investigator?
Perseverance
Intelligence
Honest
Understanding of the people and environment
Keen power of observation

What is the legal consequence if an arrested person under

custodial investigation is deprived of the constitutional rights?

Any testimony of statement taken from the arrested person who is

departed of the three constitutional rights would be inadmissible as
evidence in the Courts of Justice. On the other hand, the investigator
may be held criminally liable for
the violation of law.

Crime Scene Sketch

is an invaluable aid in recording investigative data. It is a permanent

record that provides supplemental information that is not easily
accomplished with the exclusive use of crime scene photographs
and notes.

Specific kinds of sketch

Elevation sketch

Portrays a vertical plane rather than a horizontal plane. Examples include

bloodstain patterns on vertical surfaces such as walls or cabinetry and
bullet holes through windows.

Exploded view or cross-projection sketch

 Consists of a combination of the first two sketches. It is similar to

a floor plan except the walls have been laid out flat and objects
on them have been shown in their relative position
  gives the clear impression of the scene in cases where blood
stains or bullet holes are found

Locality

give picture of the scene, the crime and its environs, including
neighboring buildings, roads etc.

Ground

picture of the scene of the crime with its nearest physical

Rectangular coordinates method

Triangulation method
Baseline method
Compass point method
Cross projection method

Different Search Methods

Strip- the searchers will proceed at the same pace along the path
parallel to one side of the rectangle.
Spiral- the searchers will follow each other in the path of a spiral,
beginning in the outside and spiraling towards
the center. Clockwise/ counter clockwise.
Zone- the area to be searched is divide into four quadrants and
each searcher is assigned to one quadrant.
Wheel- for area to be searched approximately circular or oval
Point to point- searcher will stand in a straight line and move
forward together.

Special Crime Scene Investigation

Special Crime Scene Investigation Defines:

 It is study of major crimes based on the application of

Special Investigative technique
 It concentrates more on physical evidence, its collection,
handling, identification and preservation in coordination
with the crime laboratory special crime investigation.

 The emphasis is on physical evidence rather than an extra

judicial confession.
  Focuses on specific crimes which by their nature are difficult
and complex to investigate.

 A special crime investigation is a process of applying special

equipment and special expertise; it needs once expertise
and a particular special instrument.

Authority :

PNP STANDARD OPERATING PROCEDURE NO. ODIDM 2011-

03, April 07, 2011

Crime Scene Investigation (CSI)

 shall refer to all the investigative procedures undertaken at the

crime scene commencing from the arrival of the PNP First
Responders (FRs) to the arrival of the Duty Investigator/IOC and
the SOCO Team until the lifting of the security cordon and
release of the crime scene by the IOC;

 It is the conduct of processes, more particularly, the

recognition, handling, preservation and documentation of
physical evidence to include the identification and interview of
witnesses and the arrest of suspect/s at the crime scene.

Criminal Investigator

A Police Officer who is tasked to conduct the investigation of all

criminal cases as provided for and embodied under the Revised
Penal Code/Criminal Laws and Special Laws. A well-trained,
discipline and experienced professional in the field of criminal
investigation duties and responsibilities;

Scene of the Crime Operation (SOCO) – With SOCO Reports Forms

A forensic procedure performed by the trained personnel of the PNP

Crime Laboratory SOCO Team through scientific methods of
investigation for the purpose of preserving the crime scene,
gathering information, documentation, collection, and examination
of all physical and other forensic evidence

Forensic Evidence –
 A form of legal evidence that can be used in a court of law to
convict a person of a crime and as a category of public presentation

SOCO REPORTS

CSI Form “1” – (First Responder’s Report Form)

CSI Form “2” – (Request for the Conduct of SOCO)
CSI Form “3” (Turn-over of Collected Evidence from IOC to
SOCO Team)
CSI Form “5” – (Release of Crime Scene Form)

TECHNIQUES TO BE APPLY IN THE CONDUCT OF SCSI

CASE

COMMON MISTAKES ON THE CONDUCT

 Mistakes could not be corrected

Dead person has been move, embalmed, cremated

DETERMINATION THE TIME OF DATES

POST MORTEM LIVIDITY –

Discoloration of the body after death (8-12 hr)

Color

CM poisoning – pinkish or Red

Asphyxia Dark lividity

Phosphorous Poisoning Dark

Post Mortem Rigidity- Stiffening of the body (2-6 hr) hardening of

the muscle

Rigor Mortis- 24 or 36 to 48 hours after death

Algor Mortiz is the calling of the body

Common External Injuries Sustain by victim From Homicidal

attack

Contusion Stab Wound

Hematoma Piuuncture
Abrasion Punctured
Incised Wound Wound
Shooting Incident:

Homicidal

Suicidal

Accidental

Wounds:

Entrance and Exit Wounds

Hanging Incident

Suicidal

Homicidal

Accidental

Electrocution

Accidental

Suicidal

Rape Child
Suicide Pornography
Shooting Hacking
Traffic Accident

What is the chain of custody of sexual assault evidence?

Chain of custody helps to demonstrate evidence was handled properly to

preserve its integrity and avoid contamination or loss. Chain of custody of
the sexual assault evidence collection kit (SAK) begins with the collection
of forensic samples and may involve transfer to law enforcement or a
forensic laboratory.

What is included in the evidence collection for sexual assault?

Evidence collection samples vary based on the history of the assault and
may include oral, anal, vaginal, or penile swabs; collection of hair
samples, blood and or saliva; swabs from skin or dried secretions, or
clothing that may contain potential evidence

How many times can the chain of custody transfer evidence?

The chain of custody needs to document every transmission from the
moment the evidence is collected, from one person to another, to
establish that nobody else could have accessed or possessed that
evidence without authorization. Although there is no limit on the number
of transfers, it is crucial to keep this number as low as possible.

ROUGES GALLERY – Is a collection of pictures or photographs of criminal

and suspects kept for Identification purposes

WHAT IS THE IMPORTANCE OF Special Crime Investigation

Seeks to ascertain the methods, motives, and identities of criminals

and the identity of victims and may also search for and interrogate
witnesses.

THE VERY IMPORTANT ON THIS CRIME SCENE PROCESSING

a. Physical Reconstruction—The physical appearance of the crime

scene is reconstructed from the description
of witnesses and the indication of the physical evidence.

b. Mental Reconstruction—From the physical reconstruction, some

Modus operandi (Method of Operations).

It enables the investigators to recognize a pattern of criminal

behavior, to predict, approximate the next target of the criminals
and to assist complainants to recognize the suspect by means of
recorded information concerning the characteristics of criminal
activities

INTRODUCTION TO CYBER CRIME

CYBER CRIME

- computer oriented crime which refers to criminal activity involving

a computer and network.

There are two main categories that define the make-up of cyber-crimes:
 a. Those that target computer networks or devices such as viruses,
malware, or denial of service attacks.
b. Those that relate to crimes that are facilitated by computer
networks or devices like cyber-stalking, fraud, identity-theft,
extortion, phishing (spam) and theft of classified information

Computer crime has two elements:

1. Computer

2. Crime

Cybers Security is the collection of tools, policies, security concepts,

security safeguards, guidelines, risk management approaches, actions,
training, best practices assurance and technologies that can be used to
protect the cyber environment and organization and user's assets.

White hat hackers - also known as ethical hacker's strive to operate in

the public's best interest, rather than to create turmoil.

Black hat hackers - intentionally gain unauthorized access the network

and system with malicious intent, whether to steal data, spread malware
or profit from ransomware, vandalize or otherwise damage systems or for
any other reason including gaining notoriety.

Bait and switch hacking technique, an attacker can buy advertising

spaces on the website.

How to respond Cyber Crime Cases?

As always the rule of thumb:

It should always possess the preliminary requirements (Rule

113 Section 5)

What specific procedures to follow?

SCSI AND MAC RULE

Application of fundamentals and Special Crime Scene Procedures and

most earnest effort of preservation of evidence is needed.

Why is a chain of custody important in a cybercrime case?

It protects copyrighted materials. Explanation: Evidence must be
authenticated before it can be admitted in court. A chain of custody helps
to authenticate the evidence by preventing tampering.
Why is a chain of custody important in a criminal case?

The chain of custody is the most critical process of evidence

documentation. It is a must to assure the court of law that the evidence is
authentic, i.e., it is the same evidence seized at the crime scene. It was, at
all times, in the custody of a person designated to handle it and for which
it was never unaccounted.

How do you break chain of custody?

A number of factors can break the chain of custody including:

Investigators waiting too long to collect evidence.

Improper storage of evidence.

Mislabeled evidence.

Alteration of digital evidence.

Unauthorized person accesses evidence.

How do you maintain a chain of custody?

To maintain the chain of custody for evidence collected during medical

forensic examinations, label each item of evidence with the initials of
everyone who handled it, the date, a description and source of the
specimen, the name of the examiner, and the name of the patient.

PUNISHABLE ACTS
Section 4. Cybercrime Offenses. — The following acts constitute the
offense of cybercrime punishable under this Act:
(a) Offenses against the confidentiality, integrity and availability of
computer data and systems:
(1) Illegal Access. – The access to the whole or any part of a
computer system without right.
(2) Illegal Interception. – The interception made by
technical means without right of any non-public transmission
of computer data to, from, or within a computer system
including electromagnetic emissions from a computer system
carrying such computer data.
(3) Data Interference. — The intentional or reckless
alteration, damaging, deletion or deterioration of computer
data, electronic document, or electronic data message,
 without right, including the introduction or transmission of
viruses.
(4) System Interference. — The intentional alteration or
reckless hindering or interference with the functioning
of a computer or computer network by inputting,
transmitting, damaging, deleting, deteriorating, altering or
suppressing computer data or program, electronic document,
or electronic data message, without right or authority,
including the introduction or transmission of viruses.
(5) Misuse of Devices.
(i) The use, production, sale, procurement, importation,
distribution, or otherwise making available, without
right, of:
(aa) A device, including a computer program,
designed or adapted primarily for the purpose of
committing any of the offenses under this Act; or
(bb) A computer password, access code, or similar
data by which the whole or any part of a computer
system is capable of being accessed with intent
that it be used for the purpose of committing any
of the offenses under this Act.
(ii) The possession of an item referred to in paragraphs
5(i)(aa) or (bb) above with intent to use said devices for
the purpose of committing any of the offenses under
this section.
(6) Cyber-squatting. – The acquisition of a domain name
over the internet in bad faith to profit, mislead, destroy
reputation, and deprive others from registering the same, if
such a domain name is:
(i) Similar, identical, or confusingly similar to an
existing trademark registered with the appropriate
government agency at the time of the domain name
registration:
(ii) Identical or in any way similar with the name of
a person other than the registrant, in case of a
personal name; and
(iii) Acquired without right or with intellectual property
interests in it.
(b) Computer-related Offenses:
(1) Computer-related Forgery. —
(i) The input, alteration, or deletion of any computer data
without right resulting in inauthentic data with the intent that
it be considered or acted upon for legal purposes as if it were
authentic, regardless whether or not the data is directly
readable and intelligible; or
(ii) The act of knowingly using computer data which is the
product of computer-related forgery as defined herein, for the
purpose of perpetuating a fraudulent or dishonest design.
 (2) Computer-related Fraud. — The unauthorized input,
alteration, or deletion of computer data or program or interference
in the functioning of a computer system, causing damage thereby
with fraudulent intent: Provided, That if no
damage has yet been caused, the penalty imposable shall be one
(1) degree lower.
(3) Computer-related Identity Theft. – The intentional
acquisition, use, misuse, transfer, possession, alteration or deletion
of identifying information belonging to another, whether natural or
juridical, without right: Provided, That if no damage has yet been
caused, the penalty imposable shall be one (1) degree lower.
(c) Content-related Offenses:
(1) Cybersex. — The willful engagement, maintenance, control, or
operation, directly or indirectly, of any lascivious exhibition of
sexual organs or sexual activity, with the aid of a computer system,
for favor or consideration.
(2) Child Pornography. — The unlawful or prohibited acts defined
and punishable by Republic Act No. 9775 or the Anti-Child
Pornography Act of 2009, committed through a computer system:
Provided, That the penalty to be imposed shall be (1) one degree
higher than that provided for in Republic Act No. 9775.1âwphi1
(3) Unsolicited Commercial Communications. — The
transmission of commercial electronic communication with the use
of computer system which seek to advertise, sell, or offer for sale
products and services are prohibited unless:
(i) There is prior affirmative consent from the recipient; or
(ii) The primary intent of the communication is for service
and/or administrative announcements from the sender to its
existing users, subscribers or customers; or
(iii) The following conditions are present:
(aa) The commercial electronic communication
contains a simple, valid, and reliable way for the
recipient to reject. receipt of further commercial
electronic messages (opt-out) from the same source;
(bb) The commercial electronic communication does
not purposely disguise the source of the electronic
message; and
(cc) The commercial electronic communication does
not purposely include misleading information in any
part of the message in order to induce the recipients to
read the message.
(4) Libel. — The unlawful or prohibited acts of libel as defined in
Article 355 of the Revised Penal Code, as amended, committed
through a computer system or any other similar means which may
be devised in the future.
Section 5. Other Offenses. — The following acts shall also constitute an offense:
(a) Aiding or Abetting in the Commission of Cybercrime. – Any person who
willfully abets or aids in the commission of any of the offenses enumerated
in this Act shall be held liable.
 (b) Attempt in the Commission of Cybercrime. — Any person who
willfully attempts to commit any of the offenses enumerated in this Act
shall be held liable.
Section 6. All crimes defined and penalized by the Revised Penal Code, as
amended, and special laws, if committed by, through and with the use of
information and communications technologies shall be covered by the relevant
provisions of this Act: Provided, That the penalty to be imposed shall be one (1)
degree higher than that provided for by the Revised Penal Code, as amended,
and special laws, as the case may be.
Cases filed in relation to Cyber Crime:
Notable Anti-Cybercrime Operations
A. Terrorist Financing “Telecom Fraud Scam”
On November 24, 2011, PNP conducted search and seizure operation against
suspected group of telecom hackers victimizing a US telecom company with the
cooperation of FBI and US Embassy in Manila. More than $2M in lost revenues.
The criminal group is allegedly connected to a foreign terrorist financing group
reponsible for financing the terrorist attack in Mumbai, India in 2008.
B. Transnational Telecom Fraud Scam “Chinese & Taiwanese Fraud
Ring”
On May 26, 2012 the PNP together with police from China and CIB, Taiwan,
arrested 37 suspected members of an international telecom fraud ring in
separate raids in Manila. Searched and seized were assorted ICT equipment that
the syndicate used in their illegal operations. The suspects were charged for
violation of R.A. 8484 “ Access Device Regulation Act of 1998”.
C. Transnational Telecom Fraud Scam “Chinese & Taiwanese Fraud
Ring”
On August 23, 2012, PNP-CIDG, PAOCC, NISF, BID, DOJ, China and Taiwan
Embassies conducted simultaneous search and seizure warrant operation in
Manila and Rizal resulting to the confiscation various computer and telecom
devices and 380 arrested, mostly Chinese and Taiwanese nationals. Suspects
were charged for violation of R.A. 8484 “Access Device Regulation Act of 1998”.
D. ATM / Credit Card Fraud Syndicate
On April 20, 2013, three Malaysian nationals were arrested by police in Iloilo City
suspected of siphoning off money from ATM card holders. A small camera and a
skimming device are placed in ATM booths. Credit card information stolen is
cloned using sophisticated card tools to withdraw money from the victim’s bank
account. Suspects were charged for violation of R.A. 8484 “ Access Device
Regulation Act of 1998”.
E. Internet Fraud/Scam “ WakaNetwork.com”
On May 15, 2013, PNP-ACG together with Mabolo Police Station conducted
search and seizure warrant at Interface Techno-Phil Cebu City. The said call
center was offering fraudalent waka gift vouchers to US nationals. Suspects were
charged for violation of R.A. 8484 “ Access Device Regulation Act of 1998” and
Article 212 of the Revised Penal Code “Corruption of Public Officials”.
F. Illegal Internet Pharmacy Operation
On July 11, 2012 ATCCD-CIDG conducted search and seizure warrant at “724
Care Call Center” located at Mandaue City, Cebu for marketing and selling
alleged counterfeit Pfizer medicines to US nationals. They were suspected of
violating of R.A. 8484 “Access Devices Regulation Act of 1998”.
G. Corporate Illegal System Hacking
On October 4, 2011, ATCCD-CIDG arrested SHIN UN-SUN in Batangas Province by
virtue of an international warrant issued by Interpol and KNP for alleged hacking
into Hyundai customer database stealing around 420,000 customer records and
extorted money from Hyundai. The suspect SUN was turned over to the
Immigration Bureau for deportation to South Korea.
RULE ON CYBERCRIME WARRANTS (A.M. NO. 17-11-03-SC):
1. Warrant to Disclose Computer Data (WDCD)

An order to disclose and accordingly, require any person or service provider to

disclose or submit subscriber’s information, traffic data, or relevant data in
his/her controversial or is possession or control

2. Warrant to Intercept Computer Data (WICD)

An order authorizing law enforcement authorities to carry out any or all of the
following activities: (a) listening to, (b) recording, (c) monitoring, or (d)
surveillance of the content of communications, including procuring of the content
of computer data, either directly, through access and use of a computer system
or indirectly, through the use of electronic eavesdropping or tapping devices, at
the same time that the communication is occurring

3. Warrant to Search, Seize and Examine Computer Data (WSSECD)

An order authorizing law enforcement authorities to search a particular place for

items to be seized and/or examined

4. Warrant to Examine Computer Data (WECD)

Upon acquiring possession of a computer divide or computer system via a lawful

warrantless arrest, or by any other lawful method, law enforcement authorities
shall first apply for a WECD before searching the said computer device or
computer system for the purpose of obtaining forensic examination the
computer data contained therein

Related Orders

1. Preservation Order

An order requiring a service provider to keep, retain and preserve:

– The integrity of traffic data and subscriber’s information for a minimum period
of 6 months from the date of transaction

– Content data for 6 months from the date of receipt of the order

2. Destruction Order or Return Order

An order requiring the complete or partial destruction, or the return to its lawful
owner or possessor, of the computer data or any related items turned over to the
court’s custody
Where to file an application for a warrant Before any of the designated
cybercrime courts of the province or the city where the offense or any
of its elements has been committed, is being committed, or is about to
be committed, or where any part of the computer system used is
situated, or where any of the damage caused to a natural or juridical
person took placeSupreme Court issued the Rule on Cybercrime Warrants,