Cracking the Code:

How the Rules on Electronic Evidence fair in the Fiber Optic Age

By: Kurt Paul G. Bagayao

Where are we now on this?

The emergence of the World Wide Web, smartphones, and Computer-Mediated

Communications (CMCs) profoundly affect the way in which people interact online and offline.
Individuals who engage in socially unacceptable or outright criminal acts increasingly utilize
technology to connect with one another in ways that are not otherwise possible in the real world
due to shame, social stigma, or risk of detection. As a consequence, there are now myriad
opportunities for wrongdoing and abuse through technology.1

For one, in the morning after the May 9, 2016 elections, grumblings about the security
and credibility of the automated election process are already being sounded, and several election
related deaths are already reported in some provinces. issues concerning the procurement of the
Automated Election Systems (AES) machines and the review (or lack thereof) of the source
codes of the AES machines, particularly in the May 2010 and 2013 elections and, the issues that
surfaced on these matters up to May 2015 that have an impact on the May 2016 elections.2

It has been said that we are all venturing towards a Paperless Society considering that
technology brings about the newest of innovations and inventions in the speed of light. Such
breakthroughs, according to analysts, have rendered paper as obsolete and would be soon
useless. Another school of thought would say that the paper age is far from over-that we are
not quite there yet as to becoming fully developed techno sapiens- beings who fully immerse
themselves in electronic and digital technology, leaving no paper trail behind.

A white paper study prepared for Hewlett-Packard Corp. by global research group
International Data Corp. (IDC) showed that there continues to be a growing need for hardcopy
documents among users despite the popularity of electronically-generated information. In fact,
based on IDC's latest research results on the printer consumables industry, including serial dot
matrix ribbons, ink cartridges and laser toners, the market in the Asia Pacific region is projected
to grow by 7.1 and 14.7 percent in unit shipment and revenue terms respectively last 2014.3

1 Holt, et. Al. (2015) Cybercrime and Digital Forensics: An Introduction

2 Retrieved information: www.noelthecyberlawyer.wordpress.com; July 22, 2016

3 Retrieved information: www.philstar.net; July 18, 2016

 In its study, IDC concentrated both on mature and emerging markets in the region. The
mature markets which are considered as more advanced in information technology (IT) include
New Zealand, Singapore, Hong Kong, Taiwan, Korea and Australia.

On the other hand, the emerging markets include the People's Republic of China, India,
Indonesia, Malaysia, Thailand and the Philippines.

IDC noted that the traditionally less computerized countries tend to rely more heavily on
hardcopy as compared to IT savvy markets. The percentage of hardcopy documents among
companies vary although it remains very high in developing countries due to lack of accessibility
to online systems by most employees, the higher cost of electronic transmission and the
relatively formal communication approach adopted by most organizations, the group said. Yet,
IDC pointed out that regardless of the degree of IT advancements in a country, hardcopies
continue to be generated. The comfort of reading on paper instead of on screen continues to
support massive printing even in today's electronic world, IDC said.4

It is also said that the E-Commerce Act as well as A.M. No. 01-07-01-SC or otherwise
known as the Rules on Electronic Evidence are pioneering laws for the entire judicial world to
emulate. Thank Heavens for the Y2k and Love bug scares. Hacking, Piracy, Viruses running all
around our computer codes and cables has been prevalent for the longest time. Groups such as
We are Anonymous among others have claimed to have hacked various should-be
impenetrable mainframes of nations government offices and databases of various companies.
Just recently, the alleged founder of KickAss Torrent was arrested and is currently being
questioned somewhere in Portugal. We await the proceedings on the matter.

Chain of Custody and Integrity still important, but what else?

Like all pieces of evidence, the principle of Chain of Custody and the maintenance of the
evidences integrity are of paramount importance. The question now lies on how to store
Producing and maintaining documentary evidence for purpose of justice and societal memory
presents greater challenges. The most obvious is the impermanence of digital objects. Digital
photographs, video, text documents, and other electronic products are easily altered and erased.
Here again, the technology world and the field of information forensics are rapidly developing
new ways to detect changes in digital documents. And digital media intrinsically have powerful
capabilities to embed in photographs, video and audio information about their production and
origins. This information, or metadata, if properly preserved, can serve later investigations and
proceedings by providing important indicia of the reliability and authenticity of a given piece of
evidence.

The greater challenge to ensuring the admissibility of documentation collected or created

by human rights groups, however, is the slowness of standards and guidelines for admissibility of

4 Retrieved information: www.philstar.net; July 18, 2015

evidence to evolve in the courts. There are three specific areas in which new support might be
useful.

These include:

1. Digital Content Management Capabilities: The growing amount and complexity of

documentary evidence available to and collected by human rights organizations and courts
creates a critical need for digital asset management (DAM) capabilities. Non-profit technology
providers have begun to create specialized DAM systems for human rights organizations. At the
same time, powerful capabilities for digital asset management are being created in the for-profit
sector, subsidized by commercial activity. Support should be provided for adapting the
infrastructure and tools there developed for the purposes of human rights and civil society groups
like Amnesty International and for the international criminal courts and tribunals.5

2. Documentation of Content Management Practices: The authentication of documentary

evidence for legal purposes relies heavily on information about the processes involved in the
creation and handling of such evidence, available through expert testimony or information
forensics. To support authentication in the future, current practices in the creation, transfer, and
maintenance of documentary evidence should be described and recorded. Mapping and
documenting the lifecycle of particular types of documentary evidence in a range of types of
networks would be useful for those purposes. To ensure that processes such as encryption,
misdirection, and so forth, designed to preserve secrecy and confidentiality can be documented
in the future without compromising security today, arrangements for secure computer code and
other proprietary information can be escrowed with appropriate trusted, independent parties for
later use.6

3. Documentation of Provenance. Information about a digital objects source, chain of custody

and provenance are critical to that objects migration across multiple generations of technology,
and to its value in legal proceedings. Organizations and individuals who handle documentary
evidence in electronic form would be well served by a guide to documenting chain of custody
and provenance, based on actual precedents established in the International Criminal Court, in
various human rights tribunals and, to a lesser extent, in national courts.7

Issues and other Questions

5 Retrieved information: www.crl.edu; July 21, 2016

6 Id.

7 Id.
 One purpose is to remove certain legal obstacles in the use of electronic data messages. In
this way, a more secure legal environment may be created for electronic commerce. By enabling
and facilitating the use of electronic commerce and providing equal treatment to users of paper-
based documentation and those users of computer-enabled information, it aims to spur the
development of the new economy and foster the efficiency of international trade.

However, the movement toward the use of electronic data messages raises some key legal
issues or problems. Some of the major issues are:

1. Electronic documents face the issue of their admissibility as evidence.

Important questions that need to be answered in this situation are: What is an original
electronic document?, How does one authenticate electronic documents? Does the best
evidence or the hearsay rule apply to electronic documents?

2. In the field of taxation, in the on-line purchase of goods between individuals in different
States, where is the tax situs of the transaction?

3. There are problems in venue and jurisdiction. For example, in which Regional Trial Court
should one file a libel suit against a person who made malicious postings on an electronic
message board?

4. Together with the technological development come more advanced and less detectable ways
of violating the privacy and security of others.

5. There are serious issues in intellectual property rights such as, Does ones right to a trade
name also include the exclusive right to use it as a domain name? And sixth, there is the
problem of cybercrime. These are just some of the areas of conflict which people have to deal
with in the digital world.8

Future of E-Commerce in the Philippines

The E-Commerce Act (ECA) is a significant first step in developing the Philippine legal
system in order for it to meet the issues and problems brought about by electronic transactions
and digital relations in the 21st Century. It is important to bear in mind that like the physical
reality that Philippine law wishes to regulate, the use and the development of electronic/digital
technologies is so fast-paced and so far-reaching that it would be foolish to think that the passage
of the ECA would resolve all those issues. There are other major legal issues concerning
electronic commerce which have been intentionally left out of the ECA such as problems of
jurisdiction, digital signatures, privacy, cybercrime, and intellectual property. These issues are
meant to be addressed by subsequent legislation or regulation in the near future (emphasis
authors own). The ECA is not a cure-all, but it simply lays the foundation for electronic

8 Dizon, M. (2001) Digest of Information Technology and the Law

transactions in the country. While the ECA is the first law which specifically deals with
electronic commerce, it was not meant to provide a definitive solution to these perplexing legal
issues. It is only through subsequent legislation, jurisprudence, governmental control and
regulation, and market forces that e-commerce will fully take its hold and its benefits fully
utilized. The ECA was intended not to be an end in itself, but as a springboard to launch the
country into the digital age.9

Cryptology

Cryptology as a discipline arose from the human need to encode secrets (cryptography)
and to break the codes enmeshed with these secrets (cryptanalysis). Dr. Atty. Noel G. Ramiscals
book The Law and Science of Electronic Secrets and Codes is a timely and significant work
that surveys and critiques the legal developments in the field of cryptology in the international
arena, in particular, the Wassenaar Arrangement on Export Controls for Conventional Arms and
Dual-Use Goods and Technologies, and the implementation of its provisions in three countries
which are considered the leading States in the battle against terrorism: the United States of
America, Australia and the United Kingdom. Fusing legal and technological research and
analyses, Dr. Ramiscals seminal study of the cryptological developments delving on the
automated elections, source codes, e-procurement, eTitling of lands, cryptocurrency, electronic
evidence, data privacy and legal ethics in the Philippines, breaks new ground. Dr. Ramiscal
proposes the overhaul of the legal mechanism for source code reviews of any and all information
communication technology (ICT) and security products that utilize cryptologic features which
are, or would be sold or disseminated in the Philippines.10

There are a few scholars who focus their work on this ever-dynamic field of legal study.
Alongside this notion, there can be few attorneys who practice in such field due to a number of
reasons ranging from novelty to its being too technical.

Application in the Philippines

In the few cases that the Philippine Supreme Court had occasion to pass upon issues
involving discovery, only one decision can be found that propounds a definition of the term

9 Id.

10 Harry Roques commentary on Dr. Ramiscals advocacy as published in Dr.

Ramiscals book: The Law and Science of Electronic Secrets and Codes;
www.noelthecyberlawyer.wordpress.com; July 21, 2016
"discovery." In Insular Life Assurance v. Court of Appeals11, the Supreme Court, citing Bouvier's
Law Dictionary, said:

"Discovery, in general, is defined as the disclosure of facts resting in the knowledge of the defendant, or
as the production of deeds, writings, or things in his possession or power, in order to maintain the right or
title of the party asking it, in a suit or proceeding."

Concise definitions of broad concepts, such as the one quoted above, are often exposed to
the criticism of failing to fully capture the scope of the idea. Nonetheless, the definition of
discovery quoted above captures the essence of discovery in using the word "disclosure."
Disclosure is the raison d'em of discovery.

In the Philippine context, therefore, discovery can be broadly defined as the set of
mechanisms provided in Rules 24 to 29 of the Rules of Court through which the disclosure of
information relevant to an action is obtained.

By providing lawyers with the tools of discovery, the Rules remind practitioners that
"litigation is essentially an abiding quest for truth undertaken not by the judge alone but jointly
with the parties."12

These underlying principles of discovery that highlight the importance of "ascertaining

the truth" explain the contrasting attitudes of the judiciary, led by the Supreme Court, on one
hand and a number of practicing lawyers on the other. The Supreme Court is leading the way in
promoting the use of discovery in litigation, with the view of facilitating the conduct of litigation
through the parties' judicious use of discovery techniques. It has even expressed the view that
discovery may even cut short if not altogether avoid litigation under the belief that when the
parties play the game with their cards all laid on the table, the possibility of amicable settlement
is increased.13

The Role of Rule 27 as to the standard of Materiality

Rule 27 provides that a court may "order any party to produce and permit the inspection
and copying or photographing, by or on behalf of the moving party, of any designated document
x x x which constitute or contain evidence material to any matter involved in the action."

As a preliminary observation, this Rule 27standard of materiality seems to be broader

than the standard of relevancy, which requires that evidence must have such a relation to the fact
in issue as to induce belief in its existence and non-existence. This observation is brought about
11 G. R. No. 97654; August 20, 2001

12 Id.

13 Id.
by the approach adopted in Rule 27 of defining the standard of materiality in relation to "any
matter involved in the action."14

It appears that the Rule 27 standard bf materiality was intentionally broadened, as the
Supreme Court itself affirmed in the case of Security Bank Corporation v. Court of Appeals et
al15 In this action for the annulment of certain mortgages impleading the petitioner bank as one
of the defendants, in ruling against the bank's arguments opposing the discovery allowed by the
trial court, the Supreme Court reasoned:

"These arguments are not persuasive. Section 1 of Rule 27 clearly provides that the documents sought
must be 'material to any matter involved in the action.' Respondents have shown that the subject
documents are indeed material to the present action.

"Indeed, the factual backdrop of the case strengthens respondent's cause. The civil action instituted by the
Spouses Dy sought the annulment of two deeds of Real Estate Mortgage between Jackivi and petitioner.
They allegedly issued a Special Power of Attorney to Respondent Dy to mortgage their property only for
their benefit, not for that Jackivi. Because he mortgaged the property as security for Jackivi's loan, they
contend that he exceeded his authority and that the contracts of real estate mortgage were consequently
invalid. Petitioner, on the other hand, filed a cross-claim against him, because it 'relied on the
representations and documents submitted by [the latter] that he was duly authorized to mortgage the
subject property'. Indeed, the rule is that courts, in passing upon a motion for discovery, should be liberal
in determining whether the documents in question are relevant to the subject matter of the action. To
repeat, the rule on discovery 'requires the parties to play the game with cards on the table so that the
possibility of fair settlement before trial is measurably increased'."(Emphasis supplied.) 16

One might observe that there appears to be a tendency to equate relevance with
materiality, although relevant evidence will definitely meet the standard of materiality set by
Rule 27. Attention should also be directed to the reasoning that evidence "manifestly useful" in
the preparation of an answer are discoverable under Rule 27, which appears to be an
interpretation of the materiality standard of Rule 27 and a very liberal one at that.17

2. The Relevance Standard in United States Discovery Jurisprudence

The broad interpretation of the materiality standard by the Supreme Court, in its decision
discussed above, accords with tlle trend in American courts regarding the interpretation of a
sinUlar standard in their rules on discovery. The Federal Rules of Civil Procedure's standard is
14 Retrieved information: www.plj.upd.edu.ph; July 22, 2016

15 G.R. No. 135874, January 25, 2000

16 Id.

17 Retrieved information: www.plj.upd.edu.ph; July 22, 2016

relevance, a standard that is also applied in most of the state courts. The requirement is expressed
in RUle 26 (b)(1) of their Federal Rules of Civil Procedure, which states the general scope of
discovery:

"Parties may obtain discovery regarding any matter, not privileged, which is relevant to the subject matter
involved in the pending action, whether it relates to the claim or defense of the party seeking discovery or
to the claim or defense of any other party, including the existence, description, nature, custody, condition
and location of ay books, documents, or other tangible things and the identity and location of persons
having knowledge of any discoverable matter. It is not ground for objection that the information sought
will be inadmissible at the trial if the information sought appears reasonably calculated to lead to the
discovery of admissible evidence."

The phrase "relevant to the subject matter involved in the pending action" has been
described as the "key phrase" in this Rule. This requisite for discovery has been construed
broadly to "encompass any matter that bears on, or that reasonably could lead to other matter that
could bear on, any issue that is or may be in the case." Notably, this relevance standard has been
construed as not limiting discovery to the issues raised by the pleadings for the reason that
"discovery itself is designed to help deftne and clarify the issues." Neither does this relevance
standard limit discovery to the merits of the case, "for a variety of fact-oriented issues may arise
during litigation that are not related to the merits," such as Issues relating to jurisdiction and
venue. 18

That the relevance standard deals with possibilities, and how it relates to the whole
subject matter of a case emphasize how broadly this standard can be interpreted. Courts in the
United States have consistently sustained this liberal interpretation. Furthermore, it seems that
there is' no sign of any shift by United States courts from this liberal approach to a stricter
construction of the relevance standard.19

Information relating to electronic evidence beyond the electronic information itself will
be helpful in establishing not only the materiality of the electronic evidence for purposes of
discovery, but also the relevance of, as well as the evidentiary weight that can be given, to the
evidence discovered. These matters will be important when the trial on the merits gets underway.

This approach is apparent in the discovery by the plaintiffs of the computer capabilities of
the defendant in the case of Dunn v. Midwestern Indemniry. The Fifth Recommendation of the
Manual for Complex Litigation quoted gives a label for this important class of information --
"information relating to the underlying theory and procedures used in the preparation and
storage" of electronic evidence.

18 Id.

19 Id.
 It should also be noted that the matters relating to electronic evidence enumerated in the
Fifth Recommendation include information that are not documentary or object evidence. Thus,
they are not the proper subjects of Rule 27 discovery. In so far ~s discovery is used to gain
information on how computer data is structured, for example, depositions of the personnel that
designed or used such structure will clearly be material and useful. In Dunn, interrogatories were
used as the discovery tool for obtaining information about the computer capabilities of the
defendants.

This observation emphasizes the point that in order to maximize the use of electronic
discovery, a well-planned and integrated approach in resorting to the different modes of
discovery is necessary.

Manner of production of information stored in electronic form

The problem arises because information stored in electronic form may be produced either
as a printed output containing the information or as copies of the electronic form itself, which
may be transferred or stored through data storage media such as magnetic tapes, diskettes, and
compact discs.

The question is usually whether the requesting party has the option to require any or all of
the forms that the electronic information may take. It is a matter which already affects the
convenience or inconvenience of the requesting party in the use of the electronic evidence
produced, as well as the expenses that will be incurred in connection with the discovery. 20

It also affects the kinds of information that are made available, as the electronic form of
the information usually contain other useful data in the form of embedded information or
"metadata" that may or may not be displayed in the printed output.21

In American jurisprudence, there are decisions that support the proposition that the
requesting party has a choice as to the medium of production. There is also jurisprudential
support for the contrary position that once a requesting party has been provided with ne usable
form of electronic information, the requested party can no longer be compelled to produce the
other forms in which the same information is stored. One such reason noted earlier is the desire
of a requesting party to obtain relevant information such as embedded data or "metadata" that
may not be displayed in the printed from of the electronic information. In such a case, the
electronic form of the information will be necessary to reveal such "hidden" information.22

20 Id.

21 Id.

22 Id.
 Another reason that may compel a requesting party to request for the electronic form of
the information is the possible attempt of the requested party to conceal information by not
producing the computer-readable electronic form and merely producing print outs of selected
data.

Possession, custody, control

When the production or inspection of a document or thing is ordered under Rule 27, the
party so ordered will be required to produce or allow the inspection of such documents or things
that are "in his possession, custody or control." Electronic discovery has given rise to the
question of what documents are in a party's possession, custody, or control, an interesting twist,
primarily in relation to certain types of information that are in a computer but which the party
has no knowledge of or has already deleted. The question raised is whether such types of
information should be considered within the party's possession, custody, or control.23

Consider the following appreciation of the problem by Shira A. Scheindlin, a District

Judge of the Southern District of New York, and his former, law clerk Jeffrey Rabkin, in their
article "Electronic Discovery in Federal Civil Litigation: Is Rule 34 up to the Task?":

"'Deleting' a name does not actually erase that data from the computer's storage devices. Rather, it
simply finds the data's entry in the disk directory and changes it to a 'not used' status--thus permitting the
computer. Until the computer writes over the 'deleted' data, however, it may be recovered by searching the
disk itself rather than the disk's directory. Accordingly, many ftIes are recoverable long after they have
been deleted--even if neither the computer user nor the computer itself is aware of their existence. Such
data is referred to as 'residual data.'

"Residual data raises another definitional question. x x x [MJay a respondent be said to be in the
'possession, custody or control' of the residual data stored on the computer? The resolution of that
question is important because it determines whether a respondent is obliged to search for and produce
such information under the terms of Rule 34(a)."

The problem exists because there are ways to recover deleted or residual data from a
computer and view otherwise inconspicuous information. One United States District Court judge
had in fact remarked that the inability to destroy electronic flles may be the computer's ultimate
flaw. For the party ordered to produce electronic documents under Rule 27, the problem is of'
particular importance because such methods of recovery and viewing may entail additional
expense and effort. With respect to deleted information, the issue assumes an added twist if the
deletion was made in anticipation, or during the pendency, of a suit because the discovery of the
deception may give rise to court sanctions and even criminal prosecutions.24

23 Id.

24 Id.
 Courts in the United States have ruled that deleted files or information is discoverable
under their rules on discovery. Notably, this conclusion was reached without a consideration of
the "possession, custody or control" requirement and only a general reference to Rule 34 of the
Federal Rules of Civil Procedure is made to justify such a conclusion. It seems, therefore, that
American courts assumed that such deleted information is under the possession, custody, or
control of the requested party.

While no decision by our Supreme Court has interpreted the phrase "possession, custody
or control," the same conclusion can be justified under Rule 27. The word "possession," in its
ordinary meaning, should include information residing in the computer. As the word is used in
Rule 27, there seems to be no special requirement of intent to possess similar to that required in
criminal law in relation to illegal possession offenses. This interpretation has the added benefit of
helping address the possible circumvention of any order for discovery under Rule 27 through the
deletion of files by the party ordered to produce, or allow the inspection of, certain documents.25

The discoverability of deleted information has given rise to problems because in cases
involving deleted information, discovery will entail examining the information in the requested
party's computer or the analogous task of copying the computer's hard disk and then examining
the same.

Electronic Evidence and the Philippines Cybercrime Law

As enunciated in their 2014-2015 report, the Cybercrime Council indicated the following
crimes as their priorities:

1. Online Child Abuse

Considering that most of the cases received by the office pertains to child pornography, in
April 2014, OOC was provided access to the Virtual Private Network (VPN) of the National
Center for Missing and Exploited Children (NCMEC), and was designated as its point-of-contact
for the Philippines. OOC gets notified when NCMEC receives a report that has a Philippine
nexus through its CyberTipline which operates as a national clearinghouse in the United States
for tips and leads relating to child sexual exploitation.

The CyberTipline is authorized by U.S. Congress to create a reporting mechanism for

members of the public, law enforcement, and certain corporate entities, including U.S. electronic
service providers (ESPs) that have statutory reporting obligations to report to NCMEC instances
of child sexual exploitation, including child pornography.26

25 Id.

26 Id.
 From April 2014 to December 2014, OOC was notified by NCMEC with Twelve
Thousand Three Hundred Seventy Four (12,374) reports of child exploitation where either the
offended party or the offender is in the Philippines. All these NCMEC reports were shared with
the Inter-Agency Council against Trafficking (IACAT) and Inter-Agency Council against Child
Pornography.27

In May 2014, the OOC was introduced to INTERPOLs International Child Sexual
Exploitation (ICSE) image database. Said database is equipped with tools to extract digital
information from images and check it against existing data, and with numerous other features
designed to aid investigators and enhance their investigations.

INTERPOL also invites the Philippines to become a member of the international

community of specialized units to save children from sexual exploitation, and requests OOC to
identify the appropriate national unit in the Philippines to be connected to ICSE. In this regard,
the Inter-Agency Council against Child Pornography (IACACP) has recommended that the OOC
be the national unit in the Philippines to be connected to ICSE.

2. Online Fraud and Network Security

The OOC has conducted Basic Cybercrime Ethical Hacking Trainings for law enforcers
as counter-measure to hacking and network security issues of government and business firm
sites. It was attended by the NBI-CCD operatives and PNP-ACG officers. Further, OOC
committed to place digital forensic equipment, surveillance equipment and other equipment to
enhance the capabilities of the Cybercrime Division of the NBI and Anti-Cybercrime Group of
the PNP.

The OOC also participated in the Cybersecurity Forum conducted by the National
Defense College of the Philippines entitled How Safe is Your Money?: Rethinking
Cybersecurity.

The said forum provided a venue for various stakeholders, including representatives from
government agencies, the banking sector, remittance centers, and other financial institutions, to
discuss and exchange best practices in enhancing cybersecurity.28

The evolving challenges of electronic documentation collection and management

require intermediary organizations to engage grassroots institutions and individuals in
different ways. (emphasis authors own) Short-term training is not sufficient. Capacity-
building approaches that provide customized technical support and assistance have the potential

27 Retrieved information: www.doj.org; July 21, 2016

28 Id.
to deepen the impact of assistance by technology providers, funding bodies, and academic
institutions. 29

Sextortion Case: Operation Strikeback

On Nov 11, 2013, Police Senior Superintendent Gilbert C. Sosa, Director of the PNP-
ACG, attended the 1st Eurasian Working Group Meeting for Heads of Cybercrime Units in
Singapore. It was found out that the Philippines is the number one country with the highest
recorded cases of sextortion.

In February 2014, the DOJ OOC received an investigative lead from the Scotland
Police and U.S. Homeland Security Investigations regarding a case of sextortion wherein the
minor victim in UK committed suicide.

An INTERPOL meeting was immediately convened on March 2014 to assess the

situation and consolidate all information gathered by concerned law enforcement agencies
worldwide. The meeting was attended by U.K. Child Exploitation Online Protection (CEOP),
Scotland Police, Hong Kong Police Force, Singapore Police Force, Australian Federal Police
(AFP), DOJ-OOC, PNP-ACG, and private entities such as Facebook, Google, and Western
Union.

Based on the information gathered, there were more or less nine thousand (9,000)
suspected accounts related to sextortion activities. Two thousand eight hundred (2,800) of which
were traced to be from the Philippines.

During investigation, the PNP-ACG was able to identify the subjects and the fifteen (15)
target locations. Search warrant operations were simultaneously conducted in the 15 identified
target areas. Fifty seven (57)subjects were arrested and more than two hundred (200) digital

evidence were seized. (Authors note: these pieces of evidence were not particularized by
the report and the storage of such retrieval was not detailed.)

Future Plans and Programs

a. National Computer Forensics Training Program

In all cybercrime investigations, computer forensics is mostly, if not always, placed as

its heart. (emphasis authors own) It is a complicated science with its own history, implications,
and future.

29 Retrieved information: www.crl.edu; July 19, 2016

 In light of this, a National Computer Forensics Training Program (NCFTP) will be
launched to train and capacitate our law enforcers in computer forensics jointly. The main
purpose is to have a consolidated training for all Law Enforcement Agencies in computer
forensics and provide them with a structured procedures and guidelines consistent with
international best practices. As of this writing, this said program is still under works and was not
launched as of yet.

b. First cyber-responders training

Nowadays, all types of criminal investigations involve electronic evidence. It is therefore

imperative to train our law enforcers, even those who are not involved in cybercrime
investigation, especially the usual first responders, in cyber-incident response.

The OOC will start conducting First Cyber-Responders training to the usual crime scene
incident responders to ensure that the volatile nature of electronic evidence is preserved and are
collected in accordance with rules and regulations, and international best practices.

c. Cybercrime Prevention Act Version 2.0

In its effort to strengthen the Cybercrime Prevention Act of 2012, this Department has submitted
a working draft to Congress of a new version of cybercrime law that would supplement and
enhance the existing law.

Other Issues

SMS/TEXT MESSAGES AS ELECTRONIC EVIDENCE

In the 2001 administrative case of Nuez v. Cruz-Apao30, the SC admitted in evidence SMS
or text messages sent by the respondent to the complainant. The messages proved the
respondents illegal solicitation of money for a favorable decision in the appellate court.

In admitting the text messages as evidence, the SC cited the E-Evidence Rules which
defined the term ephemeral electronic communication and classified text messages as such.

COMPUTER PRINT-OUTS AS ELECTRONIC EVIDENCE

In the 2007 case of Aznar v. Citibank31, a computer print-out was used by a private
individual to sue a credit card company for damages, claiming that his credit line was

30 A.M. No. CA-05-18-P. April 12, 2005

31 G.R. No. 164273; March 28, 2007

maliciously cut (blacklisted) even though his credit standing was good. The computer print-out
bore the actual signature of a certain person, said to be the issuer of the document.

The SC declared that the document cannot be considered admissible as its authenticity
and due execution were not sufficiently established. The SC said that the E-Evidence Rules
were not yet in existence at the time of the lower courts decision. The Rules of Court provides
that whenever any private document offered as authentic is received in evidence, its execution
and authenticity must be proved either by anyone who saw the document executed or written, or
by evidence of the genuineness of the signature or handwriting of the maker.

The SC upheld the lower courts ruling denying the admissibility of the computer print-
out, stressing that it is unclear from the document itself who encoded the information and who
printed out the document. Apart from the manual signature, there were other notations on the
document that were also countersigned by another person.

FAX TRANSMISSIONS AS ELECTRONIC EVIDENCE

The SC, in the 2007 case of MCC Industrial Sales Corp. v. Ssangyong Corp.32,
categorically ruled that print-outs of facsimile transmissions and photocopies of facsimile
transmissions are not electronic evidence.

In denying their admissibility, the SC initially resolved the question as to whether an

original print-out of a facsimile transmission is an electronic data message or electronic
document. The SC noted the difference in the definitions of what constitutes electronic data
message or electronic document contained in the E-Commerce Act and its implementing rules
and regulations and in the E-Evidence Rules in light of the UNCITRAL Model Law and the
legislative deliberations on the E-Commerce Act. In the UNCITRAL Model Law, a data
message is defined as information generated, sent, received or stored by electronic, optical or
similar means including, but not limited to, electronic data interchange (EDI), electronic mail,
telegram, telex or telecopy.

This UNCITRAL definition was noted by the SC as similar to the implementing rules
definition of what electronic data message is. The E-Evidence Rules defines electronic data
message merely as information generated, sent, received or stored by electronic, optical or
similar means.

However, the SC pointed out that the intention of the legislature when it passed the E-
Commerce Act is to exclude facsimile transmissions from its definition of electronic data
message. In assessing the legislative deliberations, the SC ruled that the framers of the law
intended to focus the thrust of the law on paperless communications and digital transactions.

PHOTOCOPIES OF DOCUMENTS AS ELECTRONIC EVIDENCE

32 G.R. No. 170633; October 17, 2007
 In the 2007 case of National Power Corp. v. Codilla33, the National Power Corp. (NPC)
tried to present photocopies of certain documents with manual handwriting and notations to
support its complaint for damages against a shipping company. Both the lower and appellate
courts did not admit these as pieces of evidence, arguing that the NPC failed to present the
original copies.

On appeal, the NPC claimed that the photocopies constitute electronic evidence under the
E-Evidence Rules. The NPC argued that an electronic document, to be considered as functionally
equivalent of an original, is not limited to information that is received, recorded, retrieved or
produced electronically. An electronic document can refer to other modes of written expression
that is produced electronically (such as photocopies), as included in the catch-all proviso -- any
print-out or output, readable by sight or by other means.

The SC pointed out that what differentiates an electronic document from a paper-based
document is the manner by which the information it contains is processed. To be considered an
electronic document, the information must be received, recorded, transmitted, stored, processed,
retrieved, or produced electronically.

The SC then pointed out that not all the information contained in the photocopies
presented by the NPC were recorded or produced electronically, as there were handwritten
signatures and notations.

SOCIAL MEDIA POSTS

Social networking has become part of our daily life with 93 percent of Filipino Internet
users having their own Facebook account.On the whole, this is an excellent social phenomenon.
But there is also a bad part of it. Consider, for example, a Facebook post by Mr. Y that reads:
Senator X is a crook. He stole millions of taxpayers money from the PDAF. He is a certified
thief. He deserves all the public humiliation that he is now getting.34

This kind of comment is definitely libelous. It may be the basis for a civil case for
damages and a criminal case for libel. The post, in turn, is admissible in evidence not only in a
civil case but also in a criminal case35. The Facebook post in question is considered a document
pursuant to the functional equivalence and non-discrimination principles under the E-Commerce
Act of 2000 (ECA) and the Rules on Electronic Evidence (REE), which the Supreme Court
promulgated in 2001 to implement the ECA in our courts of law.

33G.R. No. 170491; April 4, 2007

34 Retrieved information: www.accralaw.com; July 21, 2016

35 (SC En Banc Resolution dated September 24, 2002 in AM No. 01-07-01)

 Under these principles, an electronic document is considered the functional equivalent of
a paper-based document and should not be discriminated against as evidence solely on the
ground that it is not in the standard paper form.

In fact, Section 12 of the ECA expressly provides that nothing in the application of the
rules of evidence shall deny admissibility of an electronic data message or electronic document
on the sole ground that it is in electronic form, or on the ground that it is not the standard form.

The REE further provides that [w]henever a rule of evidence refers to the term of
writing, document, record, instrument, memorandum or any other form of writing, such term
shall be deemed to include an electronic document as defined in these Rules. (Section 1, Rule 3)

In laymans terms, the Facebook post in question should be treated as a paper-based

document. The legal question is how to prove or authenticate this Facebook post as evidence in a
court of law.36

MOBILE PHONE DATA

Are mobile phone dataphonebook contacts, messages, photographs, accounts, emails,

etc., subject to searches and seizure? This legal issue was touched upon in a recent case,
People vs. Noel Enojas.37

The case involves murder charges against four individuals prosecuted for the shooting of
a police officer along Alabang-Zapote Road in Las Pinas City sometime in September 2006.
After the shooting incident, the lawful authorities obtained a mobile phone owned by one of the
suspects. The police then used the phone to locate the suspects. According to their testimony,
they monitored the messages in the phone and, posing as one of the suspects, communicated with
the other accused. The police then conducted an entrapment operation resulting to the arrest of
two of the accused. Subsequently, the remaining two accused were also arrested.

After trial, the Regional Trial Court rendered judgment against the accused and convicted
them of murder. Considering that that the Court of Appeals affirmed in toto the conviction, the
accused appealed to the Supreme Court raising, among others, the issue of whether or not the
text messages were admissible in court.

While it reduced the conviction from murder to homicide aggravated by use of

unlicensed firearm, the Supreme Court nevertheless ruled that there is sufficient evidence to
convict the accused.

36 Retrieved information: www.elegal.com; July 21, 2016

37 G.R. No. 204894; March 10, 2014

 On the issue of admissibility of the text messages, the Supreme Court held that the
Regional Trial Court was corrected in admitting the same. Applying the Rules of Electronic
Evidence, the Supreme Court held that

Text messages are to be proved by the testimony of a person who was a party to the same or has personal
knowledge of them. Here, P03 Cambi, posing as the accused Enojas, exchanged text messages with the
other accused in order to identify and entrap them. As the recipient of those messages sent from and to the
mobile phone in his possession, P03 Combi had personal knowledge of such messages and was
competent to testify on them.

It must be emphasized that these pieces of evidence were central not only in validating
the arrest of the accused but, likewise, in the upholding of their conviction. According to the
Supreme Court, the text messages to and from the mobile phone [] provided strong leads on
the participation and identities of the accused. Indeed, the police caught them in an entrapment
using this knowledge.

What is interesting is that the Supreme Court only discussed the admissibility of the
mobile phone data as it relates to the competency of the person presenting the evidence pursuant
to the Rules of Electronic Evidence. It did not delve into the real issue: do lawful authorities have
the right to use the text messages as tools to arrest and prosecute the accused. Otherwise stated,
prior to determining the competency of the person presenting the evidence, a more fundamental
issue of whether or not there was lawful search and seizure of mobile phone data.

Section 3, Rule 128 of the Rules of Court states that (e)vidence is admissible when it is
relevant to the issue and is not excluded by law or these rules. (Emphasis supplied.) This refers
to the Total Exclusionary Rule. Under this rule, evidence obtained in violation of the accused
constitutional rights must be suppressed from the prosecutions evidence list. A derivative of this
rule is the Fruit of the Poisonous Tree Doctrine, which posits that all evidence (the fruit)
derived from an illegal search (the poisonous tree) must be suppressed, whether it was obtained
directly through the illegal search itself, or indirectly using information obtained in the illegal
search.(Justice O. M. Herrera, Remedial Law Volume V 1999 Edition, Page 37 citing Wong
Suan vs. US, 371 US 474, 484{1963}; Nardone vs US, 308 U.S. 338,341[1939])

Applying the Fruit of the Poisonous Tree Doctrine in the instant case, as it was the text
messages in the mobile phone, which led to the subsequent arrest and identification of the
accused, and all evidence resulting from the use of the mobile phone, must be undone and
excluded.

It is significant to mention that the same issue was presented to the United States
Supreme Court in June 2014 in the case Riley vs. California (No. 12-132, 25 June 2014).
Deciding unanimously, the U.S. Supreme Court held that, although a mobile phone is not
immune from search, a warrant is generally required before the search. In the said case, the
Supreme Court acknowledged notable circumstances that brings the mobile phone to a level
similar to personal records and documents, which are protected by the constitutional amendment
pertaining to right against warrantless searches and seizures, to wit

Cell phones differ in both a quantitative and a qualitative sense from other objects that might be carried
on an arrestees person. Notably, modern cell phones have an immense storage capacity. Before cell
phones, a search of a person was limited by physical realities and generally constituted only a narrow
intrusion on privacy. But cell phones can store millions of pages of text, thousands of pictures, or
hundreds of videos. This has several interrelated privacy consequences. First, a cell phone collects in one
place many distinct types of information that reveal much more in combination than any isolated record.
Second, the phones capacity allows even just one type of information to convey far more than previously
possible. Third, data on the phone can date back for years. In addition, an element of pervasiveness
characterizes cell phones but not physical records. A decade ago officers might have occasionally
stumbled across a highly personal item such as a diary, but today many of the more than 90% of
American adults who own cell phones keep on their person a digital record of nearly every aspect of their
lives.

Comparing the Enojas Case to the Riley Case, the latter seems to be more in tune with
our present laws, specifically with Sections 15 and 16 of Republic Act No. 10175, otherwise
known as the Cybercrime Prevention Act of 2012. Section 15 thereof acknowledges the right of
law enforcement authorities to seize and analyze computer data, among others. However, the
same provision explicitly mentions that a search and seizure warrant must be properly issued.38

Note that, in the definitions of the law of computer and computer data, the same
include mobile phone and mobile phone data.

Admittedly, the factual circumstances attending the Enojas Case occurred prior to the
enactment of the Cybercrime Prevention Act of 2012, nevertheless, considering that retroactive
application must operate to favor the accused, it is submitted that Section 15 of the Cybercrime
Prevention Act of 2012 should have been applied in the Enojas Case.39

Conclusion

The Rules on Electronic Evidence represent a successful effort in bringing the principles
of fundamental fairness to the judicial system. In that regard, suggestions have been made where

38 Lim, F. May 23, 2014, Are social media posts admissible in evidence?; www.elegal.com

39 Id.
clarity can be improved, where certain issues need to be addressed and where more modern
principles need to be established.40

Considering that it is still in its infancy stage, a lot of suggestions will continue to pour in.
However, scholars in this mix of legalistic and technological expertise should continue to step up
in order to facilitate the efficiency and effectivity of rules and other statutes concerning this
matter. Trainings and seminars will be futile if only a handful know about the admissibility of
such pieces of evidence and how technology affect mans current modern life.

Generally, case law on digital evidence matters is sparse, largely because it is an

emerging form of evidence at international criminal courts. Countries with juggernaut companies
that specialize on technological developments will be the source of various precedents for
developing countries to follow suit but it does not mean that the latter will be lagging behind in
the updating and in the ratifying of its laws and rules regarding technology as a whole and how it
affects the entire litigation process.

Authentication

Based on the review of relevant cases, it appears that international criminal courts place a
high priority on live testimony of an expert who can corroborate the authenticity of digital
evidence. Courts also accept documentary evidence, such as a transcript of an audio recording, in
lieu of or in addition to live testimony. The need for external corroboration raises several
questions. For example, what procedures should be considered during the collection of digital
evidence so as to ensure eventual authentication in proceedings? Digital evidence provided by
non-governmental actors in the course of an investigation may pose challenges to protect the
identities of individuals with direct knowledge of the evidence. Therefore, how can courts
balance authenticity needs with identity protection?41

Hearsay

Due to the lack of a formal rule on the acceptance of hearsay, the ICC has not explicitly
dealt with its admission in many cases. Still, both the ICC and the ad hoc tribunals generally
admit hearsay when it is corroborating other evidence that has a higher probative value. To
strengthen the probative value of digital evidence hearsay, prosecutors have presented live
testimony from those who were involved in gathering the digital evidence, explaining their
methods, as well as presenting a strong chain of custody. This testimony improves the reliability
and credibility of the evidence. There does not seem to be a bar to admitting hearsay, as the ICC
has already admitted anonymous hearsay. However, questions remain as to whether hearsay can
40 Retrieved information: www.americanbar.org; July 21, 2016 (Volume 1)

41 Retrieved information:www.law.berkeley.edu; July 24, 2016; An overview of the

use of Digital Evidence in International Criminal Courts
be introduced for the truth of the matter. As well, it is not clear whether hearsay can be admitted
without testimony regarding how it was obtained, and if testimony is necessary, 1) to what extent
this testimony has to be from a party that was directly involved in gathering the evidence; and 2)
how much testimony would be sufficient for the court to consider the evidence credible.42

Provenance (Chain of Custody)

Case law demonstrates that, when courts assign weight to the evidence, authorship is the most
prevalent and important consideration. However, there are situations where authorship may be
difficult to determine. For example, NGOs and other non-governmental actors may possess
important digital evidence, such as video footage, where the author may not be identified or
locatable. Proper verification of the identities of those who have had control of information
before it reached investigators may be required, or the evidence may be at risk of exclusion. The
importance of proof of authorship also raises questions about digital evidence in forms where
digital transmissions may be difficult to link to an author, such as email. In this scenario, courts
could potentially require verification of electronic signatures or other linkage to an author, or
could require corroborating evidence.43

Preservation

So far, international criminal courts have provided little guidance on the best means of
preserving digital evidence. Additionally, the ICC does not appear to take measures to ensure
digital information has been properly preserved before investigators obtain it. Therefore,
questions arise as to what methods should be used to ensure evidence is preserved in a manner
that will satisfy Chambers. It is especially uncertain what methods of preservation are proper for
evidence obtained from unverifiable sources, such as videos uploaded to the Internet without
identity information of the owner.44

Like every existing statute or Supreme Court-issued Administrative Matter, reforms should
likewise make its way to the top. Perhaps this can be further initiated by having more counsels,
not necessarily the technologically-savvy ones, or an alliance of which that should do the
prodding in suggesting the needed improvements because again, it cannot be overemphasized
that the current traditional and civil cases would always have an electronic or digital element
to them. It has indeed come and soon enough, would envelope all cases and all matters of
judicial proceedings.

42 Id.

43 Id.

44 Id.