Philippines Warrant to Disclose Computer Data (WDCD) PDF

# Warrant to Disclose Computer Data (WDCD) - A WDCD is an order in writing issued in the name of the People of the Philippines signed by a judge, upon application of law enforcement authorities. - Authorizes the latter to issue an order to disclose and accordingly, require any person or service prov...

# Warrant to Disclose Computer Data (WDCD) - A WDCD is an order in writing issued in the name of the People of the Philippines signed by a judge, upon application of law enforcement authorities. - Authorizes the latter to issue an order to disclose and accordingly, require any person or service provider to disclose or submit subscribers' information, traffic data, or relevant data in his/her or its possession or control. ## Contents of Application for a WDCD - The verified application for a WDCD, as well as the supporting affidavits, shall state the following essential facts: 1. The probable offense involved 2. Relevance and necessity of the computer data or subscriber's information sought to be disclosed for the purpose of the investigation 3. Names of the individuals or entities whose computer data or subscribers' information are sought to be disclosed, including the names of the individuals or entities who have control, possession or access thereto, if available 4. Particular description of the computer data or subscribers' information sought to be disclosed 5. Place where the disclosure of computer data or subscribers' information is to be enforced, if available 6. Manner or method by which the disclosure of the computer data or subscribers' information is to be carried out, if available 7. Other relevant information that will persuade the court that there is a probable cause to issue a WDCD ## Issuance and Form of WDCD - If the judge is satisfied that there is probable cause to believe that the facts upon which the application for WDCD exists, he/she shall issue the WDCD, which must be substantially in the form prescribed in "Annex A" of this Rule. ## Return on the WDCD; Retained Copy - Within forty-eight (48) hours from implementation or after the expiration of the effectivity of the WDCD, whichever comes first, the authorized law enforcement officer shall submit a return on the WDCD to the court that issued it and simultaneously turn over the custody of the disclosed computer data or subscribers' information thereto as provided under Section 7.1 of this Rule. - It is the duty of the issuing judge to ascertain if the return has been made, and if none, to summon the law enforcement officer to whom the WDCD was issued and require him to explain why no return was made, without prejudice to any action for contempt as provided under Section 2.6 of this Rule. - Law enforcement authorities are allowed to retain a copy of the disclosed computer data or subscribers' information subject of the WDCD which may be utilized for case build-up or preliminary investigation purposes, without the need of any court intervention; Provided, that the details thereof are kept strictly confidential and that the retained copy shall be labelled as such. - The retained copy shall be turned over upon the filing of a criminal action involving the disclosed computer data or subscribers' information to the court where such action has been instituted, or if no criminal action has been filed, upon order of the issuing court under the procedure set forth in paragraph 3 of Section 8.2 of this Rule. - Upon its turn-over, the retained copy shall always be kept, destroyed, and/or returned together with the computer data or subscribers' information that was originally turned over to the issuing court under the first paragraph of this Section. ## Contempt - Non-compliance with the order to disclose issued by law enforcement authorities shall be deemed non-compliance with the WDCD on which the said order is based, and shall likewise give rise to an action for contempt under Section 2.6 of this Rule. # A. Interception of Computer Data ## Interception of Computer Data - Interception, as defined under Section 3 (m), Chapter I of RA 10175, may be carried out only by virtue of a court issued warrant, duly applied for by law enforcement authorities. ## Warrant to Intercept Computer Data (WICD) - A WICD is an order in writing issued in the name of the People of the Philippines, signed by a judge, upon application of law enforcement authorities, authorizing the latter to carry out any or all of the following activities: - listening to - recording - monitoring - surveillance of the content of communications, including procuring of the content of computer data, either directly, through access and use of a computer system or indirectly, through the use of electronic eavesdropping or tapping devices, at the same time that the communication is occurring ## Contents of Application for WICD - The verified application for a WICD, as well as the supporting affidavits, shall state the essential facts similar to those in Section 4.3 of this Rule, except that the subject matter is the communication or computer data sought to be intercepted. ## Issuance and Form of WICD - If the judge is satisfied that there is probable cause to believe that the facts upon which the application for WICD exists, he shall issue the WICD, which must be substantially in the form prescribed in "Annex B" of this Rule. ## Return on the WICD - Within forty-eight (48) hours from implementation or after the expiration of the effectivity of the WICD, whichever comes first, the authorized law enforcement officers shall submit a return on the WICD to the court that issued it and simultaneously turn-over the custody of the intercepted communication or computer data thereto as provided under Section 7.1 of this Rule. - It is the duty of the issuing judge to ascertain if the return has been made, and if none, to summon the law enforcement officer to whom the WICD was issued and require him to explain why no return was made, without prejudice to any action for contempt as provided under Section 2.6 of this Rule. ## Notice after filing of Return - Within thirty (30) days from the filing of the return, or, if no return is filed, from the lapse of the forty-eight (48) hour period to file the return, the authorized law enforcement officer has the duty to notify the person whose communications or computer data have been intercepted of the activities conducted pursuant to the WICD. - If a return has been filed, a copy of the same shall be attached the notice. - On the other hand, if no return has been filed. # Search, Seizure and Examination of Computer Data ## Warrant to Search, Seize and Examine Computer Data (WSSECD) - A Warrant to Search, Seize and Examine Computer Data (WSSECD) is an order in writing issued in the name of the People of the Philippines, signed by a judge, upon application of law enforcement authorities, authorizing the latter to search the particular place for items to be seized and/or examined. ## Contents of Application for a WSSECD - The verified application for a WSSECD, as well as the supporting affidavits, shall state the essential facts similar to those in Section 4.3 of this Rule, except that the subject matter is the computer data sought to be searched, seized, and examined, and all other items related thereto. - In addition, the application shall contain an explanation of the search and seizure strategy to be implemented, including a projection of whether or not an off-site or on-site search will be conducted, taking into account the nature of the computer data involved, the computer or computer system's security features, and/or other relevant circumstances, if such information is available. ## Issuance and Form of WSSECD - If the judge is satisfied that there is probable cause to believe that the facts upon which the application for WSSECD exists, he shall issue the WSSECD, which must be substantially in the form prescribed under "Annex C" of this Rule. ## Off-site and On-site Principle; Return of Items Seized Off-site - Law enforcement authorities shall, if the circumstances so allow, endeavor to first make a forensic image of the computer data on-site as well as limit their search to the place specified in the warrant. - Otherwise, an off-site search may be conducted, provided that a forensic image is, nevertheless, made, and that the reasons for the said search are stated in the initial return. - A person whose computer devices or computer system have been searched and seized off-site may, upon motion, seek the return of the said items from the court issuing the WSSECD: Provided, that a forensic image of the computer data subject of the WSSECD has already been made. The court may grant the motion upon its determination that no lawful ground exists to otherwise withhold the return of such items to him. ## Allowable Activities During the Implementation of the WSSECD - Pursuant to Section 15, Chapter IV of RA 10175, the interception of communications and computer data may be conducted during the implementation of the WSSECD: Provided, that the interception activities shall only be limited to communications and computer data that are reasonably related to the subject matter of the WSSECD; and that the said activities are fully disclosed, and the foregoing relation duly explained in the initial return. - Likewise, law enforcement authorities may order any person, who has knowledge about the functioning of the computer system and the measures to protect and preserve the computer data therein, to provide, as is reasonable, the necessary information to enable the undertaking of the search, seizure and examination. ## Initial Return - Within ten (10) days from the issuance of the WSSECD, the authorized law enforcement officers shall submit an initial return that contains the following information: 1. A list of all the items that were seized, with a detailed identification of: - the devices of the computer system seized, including the name, make, brand, serial numbers, or any other mode of identification, if available - the hash value of the computer data and/or the seized computer device or computer system containing such data 2. A statement on whether a forensic image of the computer data was made on-site, and if not, the reasons for making the forensic image off-site 3. A statement on whether the search was conducted on-site, and if not, the reasons for conducting the search and seizure off-site 4. A statement on whether interception was conducted during the implementation of the WSSECD, together with: - a detailed identification of all the interception activities that were conducted - the hash value/s of the communications or computer data intercepted - an explanation of the said items' reasonable relation to the computer data subject of the WSSECD 5. List of all the actions taken to enforce the WSSECD, from the time the law enforcement officers reached the place to be seized until they left the premises with the seized items and reached the place where the items seized were stored and secured for examination 6. A reasonable estimation of how long the examination of the items seized will be concluded and the justification therefor - It is the duty of the issuing judge to ascertain if the initial return has been made, and if none, to summon the law enforcement authority to whom the WSSECD was issued and require him to explain why no initial return was made, without prejudice to any action for contempt as provided under Section 2.6 of this Rule. ## Period to Examine and Order to Return - After the initial return is submitted to the court pursuant to the WSSECD, the court shall issue an order fixing the period to conclude the examination of all the items seized, which period may be extended not exceeding thirty (30) days, upon motion, for justifiable reasons. ## Final Return on the WSSECD - Within forty-eight (48) hours after the expiration of the period to examine as provided under Section 6.7 of this Rule, the authorized law enforcement officers shall submit a final return on the WSSECD to the court that issued it, and simultaneously turn-over the custody of the seized computer data, as well as all other items seized and/or the communications or computer data intercepted in relation thereto, following the procedure under Section 7.1 of this Rule. It is the duty of the issuing judge to ascertain if the final return has been made, and if none, to summon the law enforcement officer to whom the WSSECD was issued and require him to explain why no final return was made, without prejudice to any action for contempt as provided under Section 2.6 of this Rule. ## Examination where lawful possession of device is obtained; Warrant to Examine Computer Data (WECD) - Upon acquiring possession of a computer device or computer system via a lawful warrantless arrest, or by any other lawful method, law enforcement authorities shall first apply for a warrant before searching the said computer device or computer system for the purpose of obtaining for forensic examination the computer data contained therein. - The warrant therefor shall be denominated as a Warrant to Examine Computer Data (WECD). - The verified application for a WECD, as well as the supporting affidavits, shall state the essential facts similar to those in Section 4.3 of this Rule, except that the subject matter is the computer data sought to be examined. - In addition, the application shall disclose the circumstances surrounding the lawful acquisition of the computer device or computer system containing the said computer data. - If the judge is satisfied that there is probable cause to believe that the facts upon which the application for WECD exists, he shall issue the WECD, which must be substantially in the form prescribed under "Annex D" of this Rule. - The initial and final returns, as well as the period to examine under a WECD, shall be similarly governed by the procedures set forth in Sections 6.6 to 6.8 of this Rule. - Interception of communications and computer data may be likewise conducted during the implementation of the WECD under the same conditions stated in Section 6.5 of this Rule. ## Custody of Computer Data ### Deposit and Custody of Seized Computer Data - Upon the filing of the return for a WDCD or WICD, or the final return for a WSSECD or WECD, all computer data subject thereof shall be simultaneously deposited in a sealed package with the same court that issued the warrant. It shall be accompanied by a complete and verified inventory of all the other items seized in relation thereto, and by the affidavit of the duly authorized law enforcement officer containing: The date and time of the disclosure, interception, search, seizure, and/or examination of the computer data, as the case may be. If the examiner or analyst has recorded his/her examination, the recording shall also be deposited with the court in a sealed package and stated in the affidavit; 1. The particulars of the subject computer data, including its hash value; 2. The manner by which the computer data was obtained; 3. Detailed identification of all items seized in relation to the subject computer data, including the computer device containing such data and/or other parts of the computer system seized, indicating the name, make, brand, serial numbers, or any other mode of identification, if available; 4. The names and positions of the law enforcement authorities who had access to the computer data from the time of its seizure until the termination of the examination but prior to depositing it with the court, and the names of officers who will be delivering the seized items to the court; 5. The name of the law enforcement officer who may be allowed access to the deposited data. When the said officer dies, resigns of severs tie with the office, his/her successor may, upon motion, be granted access to the deposit; and 6. A certification that no duplicates or copies of the whole or any part thereof have been made, or if made, all such duplicates or copies are included in the sealed package deposited, except for the copy retained by law enforcement authorities pursuant to paragraph 3 of Section 4.5 of this Rule. The return on the warrant shall be filed and kept by the custodian of the log book on search warrants who shall enter therein the date of the return, the description of the sealed package deposited, the name of the affiant, and other actions of the judge. ## Instituted - It shall be the duty of the prosecutor, or his/her duly authorized representatives, to move for the immediate transmittal of the records as well as the transfer of the intercepted, disclosed, searched, seized and/or examined computer data and items, including the complete and verified inventory thereof, to the court that subsequently acquired jurisdiction over the criminal action. The motion for the purpose shall be filed before the court that issued the warrant and has custody of the computer data within ten (10) days from the time the criminal action is instituted and shall be acted upon by the court within a period of five (5) days. ## Access to and Use of Computer Data - The package containing the computer data so deposited under Section 7.1 of this Rule shall not be opened, or the recordings replayed, or its contents revealed, or, in any manner, used as evidence, except upon motion duly granted by the court. The motion for the purpose shall state: 1. The relevance of the computer data sought to be opened, replayed, revealed, or used as evidence; and 2. The names of the persons who will be allowed to have access thereto, if the motion is granted. - The motion shall include proof of service of copies sent to the person or persons whose computer data is the subject of the motion. The said person or persons shall be given ten (10) days from receipt of notice thereof to file a comment, after which the court shall rule on the motion, unless it finds it necessary to conduct a clarificatory hearing for the purpose. ## Destruction of Computer Data ### Duty of Service Providers and Law Enforcement Authorities to Destroy - Pursuant to Section 17 of RA 10175, upon expiration of the periods as provided in Sections 13 and 15 of the said law, service providers and law enforcement authorities, as the case may be, shall immediately and completely destroy the computer data subject of preservation and examination. ### Destruction and Return of Computer Data in the Custody of the Court - Upon motion and due hearing, the court may, for justifiable reasons, order the complete or partial destruction, or the return to its lawful owner or possessor, of the computer data or any of the related items turned over to its custody. - Likewise, the court may, motu proprio, and upon written notice to all the parties concerned, order the complete or partial destruction, or return to its lawful owner or possessor, of the computer data or any of the related items turned over to its custody if no preliminary investigation or case involving these items has been instituted after thirty-one (31) days from their deposit, or if preliminary investigation has been so instituted within this period, upon finality of the prosecutor's resolution finding lack of probable cause. In its sound discretion, the court may conduct a clarificatory hearing to further determine if there is no reasonable opposition to the items' destination or return. ### Destruction of Computer Data; How Made - The destruction of computer data and related items, if so allowed under Section 8.2 of this Rule, shall be made in the presence of the Branch Clerk-of-Court, or in his/her absence, in the presence of any other person duly designated by the court to witness the same. The accused or the person/s from whom such items were seized, or his/her representative or counsel, as well as the law enforcement officer allowed access to such items as indicated in the inventory, or his/her duly authorized representative, may also be allowed to witness the said activity; Provided, that they appear during the scheduled date of destruction upon written notice to them by the Branch Clerk-of- Court at least three (3) days prior to the aforementioned date. - Within twenty-four (24) hours from the destruction of the computer data, the Branch Clerk-of-Court or the witness duly designated by the court shall issue a sworn certification as to the fact of destruction and file the said certificate with the same court. - The storage device, or other items turned over to the court's custody, shall be destroyed by shredding, drilling of four holes through the device, prying the platters apart, or other means in accordance with international standards that will sufficiently make it inoperable.