THIRTEENTH CONGRESS OF THE REPUBLIC, 
First Regular Session 
OF THE PHILIPPINES 
& _  
SENATE 
Introduced by Senator S. R. OsmeAa 111 
EXPLANATORY NOTE 
The Internet provides unparalleled opportunities for socially beneficial 
endeavors, in ways that we may not have imagined. 
Many Filipinos with relatives abroad now communicates through electronic 
mail or through Internet Relay Chat (IRC), finding it relatively faster and cheaper 
than overseas phone calls, or by writing letters. On the other hand, research on 
any topic has been made quick and easy by simply accessing the great number of 
computers connected to the Internet, such as US federal agencies; the Library of 
Congress; educational institutions; and news sites such as Cable News Network 
and Time Magazine, to name a few. 
We are also able to order and purchase goods-such as flowers, compact 
discs, and books through the Internet. The Internet likewise allows us to reserve for 
seats on flights to any destination. 
However, the coming of the Information Age has had its downside. While 
the Internet has nearly boundless potential benefits to society, its potential to serve 
as a powerful new medium for those who wish to commit unlawful acts has also 
grown. Individuals who wish to use the computer as a tool to facilitate unlawful 
activity may find that the Internet provides a vast, inexpensive and potentially 
anonymou; way to commit unlawful acts, such as fraud, the sale or distribution of 
child pornography, the sale of guns or drugs or other regulated substances without 
regulatory protection, and the unlawful distribution of computer software or other 
creative materials protected by intellectual property rights. 
Hacker attacks on major sites cripple vital business activity on the Net. 
Some unscrupulous individuals hack Internet accounts and leave hapless and 
unsuspecting victims to pay thousands of pesos for Internet time that they did not 
use in the first place. Inevitably, the Internet Service Provider has no choice but to 
pass on such costs to the consumers. 


Viruses and programs released in cyberspace wreak havoc on computers 
all over the world. Damages in terms of lost business opportunities and lost man- 
hours, not to mention the inordinate amount of time and money restoring lost data 
on these computers, has been estimated in the billions of dollars. 
Unlawful conduct involving the use of the Internet is just as intolerable as 
any other type of illegal activity. No less than the National Bureau of Investigation 
has publicly asked Congress to enact the necessary legislation to ensure that the 
Internet does not become a haven for unlawful activity. 
Patterned after the United States Computer Fraud and Abuse Act (18 U.S. 
Code 1030), as amended in 1994 and 1996, as well as Title 18, Section 3933 of 
the Pennsylvania Consolidated Statutes (Crimes Code), this bill, among others, 
outlaws: 
I. Illegal access to computers, computer systems, computer networks, computer 
servers, and database; 
2. Obtaining information on the financial records of a customer of a financial 
institution without the proper authorization; 
3. Obtainirig, publishing, and giving out the password to another person’s account; 
and 
4. Unleashing computer viruses. 
In view of the foregoing, approval of this bill is earnestly requested 
SERGIO OSMENA 111 
Senator 
, 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
1 1  
12 
13 
THIRTEENTH CONGRESS OF THE REPUBLIC 
First Regular Session 
OF THE PHILIPPINES . 
SENATE 
S. No. 
& 
Introduced by Senator S. R. OsmeAa 111 
AN ACT 
DEFINING COMPUTER CRIMES, PROVIDING PENALTIES THEREFOR, 
AND FOR OTHER PURPOSES 
Be it enacted by the Senate and House of Representatives of the 
Philippines in Congress assembled: 
SECTION 1. Short Title-This Act shall known and cited as the “Computer 
Abuse Act of 2004.” 
SECTION 2. Declaration of Policy-It is hereby declared the policy of the 
State to : 
(a) Protect and safeguard the integrity of computers, computer systems, 
computer networks, computer servers, database, and the information and data 
stored therein, which are used by any person, natural or juridical, for 
communications and/or local and foreign commerce; and 
(b) Provide an environment conducive to a free exchange of information and 
data among persons here and abroad through the use of computers, computer 
systems, and computer networks. 
SECTION 3. Definition of terms. -As used in this Act: 
(a) “Access” refers to the interception, instruction, communication with, 
14 
15 
storing data in, retrieving data from, or otherwise making use of any resources of a 
computer, computer system, computer network, or database; 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
I 1  
12 
(b) “Computer” refers to an electronic, magnetic, optical, electrochemical, or 
other high speed data processing device performing logical, arithmetic, or storage 
facility or communications facility related to, or operating in conjunction with such 
device, but excluding an automated typewriter or typesetter, a portable hand-held 
calculator, and the like; 
(c) “Computer network” refers to the interconnection of two (2) or more 
computers through the use of a satellite, microwave, line, or other communication 
medium; 
(d) “Computer program” refers to an ordered set of instructions or 
statements and related data that, when automatically executed in actual form in a 
computer system, causes it to perform specified functions; 
(e) “Computer software” refers to a set computer programs, procedures, 
13 
14 
system; 
15 
16 
and associated documentation concerned with the operation of a computer 
(9 “Computer system” refers to a set of related, connected, or unconnected 
computer equipment, devices, and software; 
17 
(9) “Computer virus” refers to a computer program copied to or installed on 
I 8 
a computer, computer network, computer program, computer software, or 
19 
computer system without the informed consent of the owner of the computer, 
20 
21 
computer network, computer program, computer software, or computer system 
that may replicate itself and that causes unauthorized activities within or by the 
I 
22 
computer, computer network, computer program, computer software, or computer 
23 
system; 
24 
25 
(h) “Damage” refers to any impairment to the integrity or availability of data, 
a program, a system, or information that: 
26 
(I) 
Causes loss aggregating to not less that Ten thousand pesos (P 
27 
10,000.00) in value to one (I) 
or more persons, natural or juridical, during 
28 
any one (I) 
year period; 


1 
2 
3 
4 
5 
6 
7 
8 
9 
I O  
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
(2) Modifies, impairs, or potentially modifies or impairs, the medical 
, 
examination, diagnosis, treatment, or case of one (I) or more persons; 
(3) Causes physical injury to any person; or 
(4) Threatens public health and/or safety. 
(i) “Database refers to a representation of information, knowledge, facts, 
concepts, or instruction which are being prepared or processed or have been 
nanner and which are intended for use in a 
server, or database, which the accesser is 
prepared or processed in a formalized 
computer, computer system, computet 
not entitled to obtain or later; 
1 
(k) “Financial institution” refers to: 
(1) Any institution whose deposits are insured by the Philippine 
Deposit Insurance Corporation (PDIC); 
(2) The Bangko Sentral ng Pilipinas (BSP); 
(3) A credit information and/or rating agency; 
(4) Brokers or dealers in securities registered as such with the 
Securities and Exchange Commission; 
(5) Mutual fund managers and the like; 
(6) A branch or agency of a foreign bank; 
(7) The Social Security System (SSS) 
(8) The Government Service Insurance System (GSIS); and 
(9) Investment houses and pre-need entities. 
(I) “Financial record” refers to any information derived from any record held 
by a financial institution pertaining to a customer’s relationship with that financial 
institution; 
(m) ,“Government” or Government entity” refers to any agency of the 
Government of the Republic of the Philippines, or any of its agencies or 
instrumentalities, including Local Government Units (LGUs) and government- 
owned or controlled corporations; any foreign country; and any state, province, 


1 
2 
3 
4 
5 
6 
7 
8 
9 
io 
1 1  
12 
municipality, or other political subdivision, agency, or instrumentality of any foreign 
country; and 
(n) “Protected computer” refers to a computer which is: 
(I) Used exclusively by a financial institution, the government, or in 
the case of a computer not exclusively used for such use, is used by 
i (i) or for a financial institution; (ii) or a government; and any person, 
natural or juridical, and the conduct constituting the offense affects 
that use by or for the financial institution, government, or person; or 
(2) Used in domestic or foreign commerce or communications. 
(0) “Services” refers, but shall not be limited, to computer time, data 
processing, and storage functions. 
SECTION 4. Prohibited Acts.-It shall be unlawful for any person to: 
13 
(a) intentionally access a computer, computer network, computer system, 
14 
computer server, or database, without authorization or exceed authorized access, 
15 
and thereby obtain: 
16 
(I) Information contained in a financial record of a financial institution, 
17 
18 
or contained in a file of a financial institution on a consumer; 
(2) Information from any department or agency of the Government; or 
19 
(3) Information from any protected computer if the conduct involves a 
20 
domestic or foreign communication. 
21 
22 
23 
24 
(b) Intentionally, without authorization, access a non-public computer of a 
department or agency of the Government, access such a computer of that 
department or agency of the Government, access such a computer of that 
department or agency that is exclusively for the use of the Government or, in the 
25 
case of a computer not exclusively for such use, is used by or for the Government 
26 
and such conduct affects that use by or for the Government; 
27 
(c) Knowingly and with intent to defraud, access a protected computer 
28 
without authorization, or exceeds authorized access, and by means of such 
29 
conduct furthers the intended fraud and obtains anything value: Provided, That the 


I 
2 
3 
4 
5 
G 
I 
8 
9 
10 
1 1  
12 
13 
14 
15 
16 
17 
I8 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
object of the fraud and the thing obtained consists only of the use of the computer: 
Provided, further, That the value of such use is not more than Fifty Thousand 
Pesos (P50,OOO.OO) in any one (I) 
year period; 
(d) Knowingly cause the transmission of a program, information, code, or 
command, and as result thereof, 
intentionally causes damage without 
authorization, to a protected computer; 
(e) Intentionally access a protected computer without authorization, and as 
a result thereof, causes damage; 
(9 Knowingly and with intent to defraud, traffic in any password or any 
similar information through which a computer, computer network, computer 
system, computer server, or database, may be accessed without authorization; 
(9) Transmit any communication containing any threat to cause damage to 
a protected computer, with the intent to extort from any person, natural or juridical, 
or government entity, any money or other thing of value. 
(h) Electronically distribute, or through intentional distribution of a computer 
virus: 
(I) 
Access, exceed authorization to access, alter, damage, or destroy 
any computer, computer network, computer software, computer 
system, computer program, computer server, or database, with the 
1 
intent to: 
(i) Interrupt the normal functioning of an organization; or 
(ii) Devise or execute any scheme or artifice to defraud, deceive, 
or control property or services by means of false or fraudulent 
pretenses, representations, or promises; 
(2) Intentionally and without authorization, access, alter, interfere with 
the operation of, damage, or destroy or damage any computer, 
computer system, computer network, computer software, computer 
program, or computer data base, or any part or parts thereof; 


1 
(3) Intentionally or knowingly and without authorization, give, 
2 
publicize, or publish a password, identifying code, personal 
3 
identification number, or other confidential information about a 
4 
computer, computer system, computer network, computer server, or 
5 
database; or 
6 
(4) Intentionally, or knowingly engage in a scheme or artifice, 
7 
including, but not limited to, a denial of service attack upon any 
8 
computer, computer system, computer network, computer software, 
9 
computer program, computer server, or database, or any parts 
10 
thereof that is designated to block, impede, or deny the access of 
I I  
information or initiation, or completion of any sale, transaction, or 
12 
communication by users of that computer, computer system, 
13 
computer network, computer software, computer program, computer 
14 
server, or database, or any part or parts thereof. 
15 
I G  
SEC,TION 5. Penalties. (a) Violation of Section 4 (a). -The penalty of prision 
mayor or an fine ranging from Twenty Five Thousand Pesos (P 25,000.00) to Forty 
17 
18 
I9 
20 
21 
22 
23 
24 
25 
26 
27 
28 
29 
Five Thousand Pesos (P 45,000.00), or both, at the discretion of the court, shall be 
imposed on any person found guilty of violating Section 4 (a) hereto (b) Violation of 
Section 4 (b) and (c).-The penalty of prision mayor in its maximum period, or a fine 
ranging from Fifty Thousand Pesos (P50,OOO.OO) to One Hundred Thousand 
Pesos (P lOO,OOO.OO), or both, at the discretion of the court, shall be imposed on 
any person found guilty of violating Section 4 (b) and 4 (c) hereof. (c) Violation of 
Section 4 (d) and (e).-The penalty of reclusion temporal in its minimum period, or a 
fine ranging from One Hundred and Fifty Thousand Pesos (P 150,000.00) to Two 
Hundred and Fifty Thousand Pesos (P250,000.00), or both, at the discretion of the 
court, shall be imposed on any person found guilty of violating Section 4 (d) and 4 
(e) hereof. (a') Violation of Section 4 (0-The penalty of reclusion temporal in its 
medium period, or a fine ranging from Three Hundred Thousand Pesos 
(P300,OOO.OO) to Four Hundred and Fifty Thousand Pesos (P 450,000.00), or both, 


1 
2 
3 
4 
S 
6 
7 
8 
9 
10 
1 1  
12 
13 
14 
15 
I 6  
17 
18 
19 
20 
21 
22 
23 
24 
at the discretion of the court, shall be imposed on any person found guilty of 
violating Section 4 (9 hereof. (e) Violation of Section 4 (9) and (h).-The penalty of 
reclusion temporal in its maximum period, or a fine ranging from Five Hundred 
Thousand Pesos (P 500,000.00) to One Million Pesos (P 1 ,OOO,OOO.OO), or both, at 
the discretion of the court, shall be imposed on any person found guilty of violating 
Section 4 (9) and (h) hereof. (9 Violation of Section 4.-ln addition to the penalties 
in subsections (a), (b), (c), (d), (e), (9, (g), and (h), of Section 4, any person found 
guilty of violating this Act shall be barred from working in any computer-related 
profession, corporation, industry, or concern, including any government agency, 
instrumentality, LGU, and/or government-owned or controlled corporation for a 
period of five (5) to fifteen (15) years, at the discretion of the court, and shall be 
perpetuallyi disqualified from holding public office. (9) If, in committing any of the 
acts enumerated in Section 4 hereof, any of the other acts as enumerated is also 
committed, then the penalty next higher in degree as provided herein shall be 
imposed. 
SECTION 6. Remedies.- Any person, natural or juridical, who shall suffer 
loss or damage in its business or property by reason of violation of Section 4 of 
this Act, may file an action with the Regional Trail Court having jurisdiction to 
recover damages, injunctive relief, and he costs of the suit with the Regional Trail 
Court: pro\jided, That damages for violations involving damage as defined in 
Section 4 (h) of this Act shall include an order by the court for the accused to 
reimburse the victim for: (a) the cost of repairing, or if necessary, replacing the 
affected computer, computer system, computer network, computer software, 
computer program, or database; (b) lost profit for the period that the computer, 
2s 
26 
27 
28 
computer system, computer network, computer software, computer program, or 
database in unusable; or 0 the cost of replacing or restoring the data lost or 
damaged as a result of violation of Section 4 (h) of this Act: Provided, finally: That 
no action may be brought under this Section unless: (a) such action is begun 


. 
a 
1 
within two i 2 )  years of the date of the act complained of; or (b) the date of the 
2 
discovery of the damage. 
3 
4 
5 
G 
7 
8 
9 
10 
12 
SECTION 7. Appropriations.- The amount necessary for the initial 
implementation of this Act shall be charged against the current year’s 
appropriations ,of the National Bureau of Investigation (NBI). Thereafter, such sums 
as may be necessary for the effective implementation of this Act shall be included 
in the annual General Appropriations Act. 
I 
SECTldN 8. Implementing Rules and Regulations. -The Department of 
Justice (DOJ),! the NBI, and the National Computer Center (NCC), shall jointly 
b 
formulate and /issue the necessary implementing rules and regulations within sixty 
(60) days after: the effectivity of this Act. 
SECTION 9. Public Information Campaign-The Commission on Higher 
13 
Education (CHED), the Department of Education, Culture and Sports (DECS), the 
14 
DOJ, the NBI,: and the NCC shall, in coordination with the Philippine Information 
15 
Agency (PIA),# undertake a public information campaign to educate the student 
16 
17 
population and the general public on the salient provisions of this Act. 
SECTION I O .  Annual Report- At the end of every year, the DOJ, the NBI, 
18 
and the NCC shall jointly submit a report to the President, the Senate, and the 
19 
House of Representatives, on the implementation of this Act; any recommendation 
20 
21 
22 
and use. 
23 
SECTION 11. Separability Clause-If, for any reason, any section or 
24 
provision of this Act is declared unconstitutional or valid, such parts not affected 
25 
thereby shall remain in full force and effect. 
26 
SECTION 12. Repealing Clause-All laws, decrees, executive orders, 
27 
issuances, rules and regulations, or parts thereof, which are inconsistent with the 
for additional and/or remedial legislation; and to provide for the publication of 
reports in such form and manner as may be best adapted for public information 
L 
28 
provisions of this Act are hereby repealed or immediately modified accordingly. 


4 
1 
SECTION 13. Effectivity-This Act shall take effect upon its complete 
2 
publication in at least two (2) national newspapers of general circulation. 
3 
Approved,