FOURTEENTH CONGRESS OF THE 
First Regular Session 
REPUBLIC OF THE PHILIPPINES 
1 
S E N A T E  
S .  No. 
INTRODUCED BY THE HONORABLE MAR ROXAS 
EXPLANATORY NOTE 
The Internet provides unparalleled opportunities for socially beneficial endeavors, in 
ways that we may not have imagined. 
Many Filipinos with relatives abroad now communicates through electronic mail or 
through Internet Relay Chat (IRC), finding it relatively faster and cheaper than overseas 
phone calls, or by writing letters. On the other hand, research on any topic has been made 
quick and easy by simply accessing the great number of computers connected to the Internet, 
such as US federal agencies; the Library of Congress; educational institutions; and news sites 
such as Cable News Network and Time Magazine, and other search engines such as Google, 
Yahoo, and Wikipedia. 
We are also able to order and purchase goods-such as flowers, compact discs, and 
books through the Internet. The Internet likewise allows us to reserve for seats on flights to 
any destination. 
However, the coming of the Information Age has had its downside. While the 
Internet has nearly boundless potential benefits to society, its potential to serve as a powerful 
new medium for those who wish to commit unlawful acts has also grown. Individuals who 
wish to use the computer as a tool to facilitate unlawful activity may find that the Internet 
provides a vast, inexpensive and potentially anonymous way to commit unlawful acts, such 
as fraud, the sale or distribution of child pornography, the sale of guns or drugs or other 
regulated substances without regulatory protection, and the unlawful distribution of 
computer software or other creative materials protected by intellectual property rights. 
The attacks made by computer hackers on major sites cripple vital business activities 
on the Net. Some unscrupulous individuals hack Internet accounts and leave hapless and 
unsuspecting victims to pay thousands of pesos for Internet time that they did not use in the 
first place. Inevitably, the Internet Service Provider has no choice but to pass on such costs 
to the consumers. 
Viruses and programs released in cyberspace wreak havoc on computers all over the 
world. Damages in terms of lost business opportunities and lost manhours, not to mention 
the inordinate amount of time and money restoring lost data on these computers, has been 
estimated in the billions of dollars. 


Unlawful conduct involving the use of the Internet is just as intolerable as any other 
type of illegal activity. No less than the National Bureau of Investigation has publicly asked 
Congress to enact the necessary legislation to ensure that the Internet does not become a 
haven for unlawful activity. 
Patterned after the United States Computer Fraud and Abuse Act (18 US. Code 1030), 
as amended in 1994 and 1996, as well as Title 18, Section 3933 of the Pennsylvania 
Consolidated Statutes (Crimes Code), this bill, among others, outlaws: 
1. Illegal access to computers, computer systems, computer networks, computer servers, 
and database; 
2. Obtaining information relative to the financial records of a customer of a financial 
institution without the proper authorization; 
3. Obtaining, publishing, and giving out the password to another person’s account; and 
4. Unleashing computer viruses. 
In view of the foregoing, approval of this bill is earnestly requested. 


1 
2 
3 
4 
5 
6 
I 
8 
9 
10 
11 
12 
13 
14 
15 
16 
FOURTEENTH CONGRESS OF THE 
) 
REPUBLIC OF THE PHILIPPINES 
1 
First Regular Session 
1 
8 
JUIj 1 2 p 6 ::3 \ 
# 
. I -  
S E N A T E  
,, &LO: PdEn RY : 
INTRODUCED BY THE HONORABLE MAR ROXAS 
AN ACT 
DEFINING COMPUTER CRIMES, PROVIDING PENALTIES THEREFOR, 
AND FOR OTHER PURPOSES 
Be it enacted by the Senute and House of Representatives of the Philippines in Congress 
assembled: 
SECTION 1. Short Etle - This Act shall known and cited as the “Computer Abuse Act 
of2008.” 
SEC. 2. Declaration ofPolicy - It is hereby declared the policy of the State to: 
(a) Protect and safeguard the integrity of computers, computer systems, computer 
networks, computer servers, database, and the information and data stored therein, which 
are used by any person, natural or juridical, for communications and/or local and foreign 
commerce; and 
(b) Provide an environment conducive to a free exchange of information and data 
among persons here and abroad through the use of computers, computer systems, and 
computer networks. 
SEC. 3. Definition of terms. -As used in this Act: 
(a) “Access” refers to the interception, instruction, communication with, storing data 
in, retrieving data from, or otherwise making use of any resources of a computer, computer 
system, computer network, or database; 
(b) “Computer” refers to an electronic, magnetic, optical, electrochemical, or other 
high speed data processing device performing logical, arithmetic, or storage facility or 
- 1 -  


1 
2 
3 
4 
5 
6 
I 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
communications facility related to, or operating in conjunction with such device, but 
excluding an automated typewriter or typesetter, a portable hand-held calculator, and the 
like; 
(c) “Computer network refers to the interconnection of two (2) or more computers 
through the use of a satellite, microwave, line, or other communication medium; 
(d) “Computer program” refers to an ordered set of instructions or statements and 
related data that, when automatically executed in actual form in a computer system, causes it 
to perform specified functions; 
(e) “Computer software” refers to a set computer programs, procedures, system; and 
associated documentation concerned with the operation of a computer system; 
(f) “Computer system” refers to a set of related, connected, or unconnected computer 
equipment, devices, and software; 
(g) “Computer virus” refers to a computer program copied to or installed on a 
computer, computer network, computer program, computer software, or computer system 
without the informed consent of the owner of the computer, computer network, computer 
program, computer software, or computer system that may replicate itself and that causes 
unauthorized activities within or by the computer, computer network, computer program, 
computer software, or computer system; 
(h) “Damage” refers to any impairment to the integrity or availability of data, a 
program, a system, or information that: 
(1) Causes loss aggregating to not less that Ten thousand pesos (PlO,OOO.OO) in 
value to one (1) or more persons, natural or juridical, during any one (1) year period; 
(2) Modifies, impairs, or potentially modifies or impairs, the medical 
examination, diagnosis, treatment, or case of one (1) or more persons; 
(3) Causes physical injury to any person; or 
- 2 -  


1 
2 
3 
4 
S 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
2s 
(4) Threatens public health andor safety. 
(i) “Database” refers to a representation of information, knowledge, facts, concepts, or 
instruction which are being prepared or processed or have been prepared or processed in a 
formalized manner and which are intended for use in a computer, computer system, 
computer server, or database, which the accesser is not entitled to obtain or later; 
(j) ”Financial institution” refers to: 
Any institution whose deposits are insured by the Philippine Deposit 
Insurance Corporation (PDIC): 
The Bangko Sentral ng Pilipinas (BSP); 
A credit information andor rating agency; 
Brokers or dealers in securities registered as such with the Securities 
and Exchange Commission; 
Mutual fund managers and the like: 
A branch or agency of a foreign bank; 
The Social Security System (SSS) 
The Government Service Insurance System (GSIS); and 
Investment houses and pre-need entities. 
(k) “Financial record’ refers to any information derived from any record held by a 
financial institution pertaining to a customer’s relationship with that financial institution; 
(1) “Government” or Government entity” refers to any agency of the Government of 
the Republic of the Philippines, or any of its agencies or instrumentalities, including Local 
Government Units (LGUs) and government-owned or controlled corporations; any foreign 
country; and any state, province, municipality, or other political subdivision, agency, or 
instrumentality of any foreign country; and 
(m) “Protected computer” refers to a computer, which is: 
- 3 -  


6 
I 
8 
9 
10 
11 
12 
13 
14 
1s 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
(1) 
Used exclusively by a financial institution, the government, or in the 
case of a computer not exclusively used for such use, is used by (i) or 
for a financial institution; (ii) or a government; and any person, natural 
or juridical, and the conduct constituting the offense affects that use by 
or for the financial institution, government, or person; or 
(2) 
Used in domestic or foreign commerce or communications. 
(n) “Services” refers, but shall not be limited, to computer time, data processing, and 
storage functions. 
SEC. 4. Prohibited Acts. - It shall be unlawful for any person to: 
(a) intentionally access a computer, computer network, computer system, computer 
server, or database, without authorization or exceed authorized access, and thereby obtain: 
(1) 
Information contained in a financial record of a financial institution, 
or contained in a file of a financial institution on a consumer; 
Information from any department or agency of the Government; or 
Information from any protected computer if the conduct involves a 
domestic or foreign communication. 
(2) 
(3) 
(b) Intentionally, without authorization, access a non-public computer of a 
department or agency of the Government, access such a computer of that department or 
agency of the Government, access such a computer of that department or agency that is 
exclusively for the use of the Government or, in the case of a computer not exclusively for 
such use, is used by or for the Government and such conduct affects that use by or for the 
Government; 
(c) Knowingly and with intent to defraud, access a protected computer without 
authorization, or exceeds authorized access, and by means of such conduct furthers the 
intended fraud and obtains anything value: Provided, That the object of the fraud and the 
- 4 -  


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
thing obtained consists only of the use of the computer: Provided, further, That the value of 
such use is not more than Fifty Thousand Pesos (P50,OOO.OO) in any one (1) year period; 
(d) Knowingly cause the transmission of a program, information, code, or command, 
and as result thereof, intentionally causes damage without authorization, to a protected 
computer; 
(e) Intentionally access a protected computer without authorization, and as a result 
thereof, causes damage; 
(9 Knowingly and with intent to defraud, traffic in any password or any similar 
information through which a computer, computer network, computer system, computer 
server, or database, may be accessed without authorization; 
(9) Transmit any communication containing any threat to cause damage to a 
protected computer, with the intent to extort from any person, natural or juridical, or 
government entity, any money or other thing of value. 
(h) Electronically distribute, or through intentional distribution of a computer 
virus: 
(1) 
Access, exceed authorization to access, alter, damage, or destroy any 
computer, computer network, computer software, computer system, 
computer program, computer server, or database, with the intent to: 
(i) 
(ii) 
Interrupt the normal functioning of an organization; or 
Devise or execute any scheme or artifice to defraud, deceive, or 
control property or services by means of false or fraudulent 
pretenses, representations, or promises; 
(2) 
Intentionally and without authorization, access, alter, interfere with 
the operation of, damage, or destroy or damage any computer, 
- 5 -  


1 
2 
3 
4 
5 
6 
I 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
(3) 
(4) 
computer system, computer network, computer software, computer 
program, or computer data base, or any part or parts thereof; 
Intentionally or knowingly and without authorization, give, publicize, 
or publish a password, identifying code, personal identification 
number, or other confidential information about a computer, computer 
system, computer network, computer server, or database; or 
Intentionally, or knowingly engage in a scheme or artifice, including, 
but not limited to, a denial of service attack upon any computer, 
computer system, computer network, computer software, computer 
program, computer server, or database, or any parts thereof that is 
designated to block, impede, or deny the access of information or 
initiation, or completion of any sale, transaction, or communication by 
users of that computer, computer system, computer network, computer 
software, computer program, computer server, or database, or any part 
or parts thereof. 
SEC. 5. Penalties. (a) Violation of Section 4 (a). - The penalty of prison mayor or an 
fine ranging from Twenty-Five Thousand Pesos (P 25,000.00) to Forty-Five Thousand Pesos 
(P 45,000.00), or both, at the discretion of the court, shall be imposed on any person found 
guilty of violating Section 4 (a) hereof. 
(b) Violation of Section 4 (b) and (c). - The penalty of prison mayor in its maximum 
period, or a fine ranging from Fifty Thousand Pesos (PS0,OOO.OO) to One Hundred Thousand 
Pesos (PlOO,OOO.OO), or both, at the discretion of the court, shall be imposed on any person 
found guilty of violating Section 4 (b) and 4 (c) hereof. 
(c) Violation of Section 4 (d) and (e). - The penalty of reclusion temporal in its 
minimum period, or a fine ranging from One Hundred and Fifty Thousand Pesos (P 
- 6 -  


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
150,000.00) to Two Hundred and Fifty Thousand Pesos (P250,000.00), or both, at the 
discretion of the court, shall be imposed on any person found guilty of violating Section 4 (d) 
and 4 (e) hereof. 
(d) Violation of Section 4 (f). - The penalty of reclusion temporal in its medium 
period, or a fine ranging from Three Hundred Thousand Pesos (P300,OOO.OO) to Four 
Hundred and Fifty Thousand Pesos (P 450,000.00), or both, at the discretion of the court, 
shall be imposed on any person found guilty of violating Section 4 (f) hereof. 
(e) Violation of Section 4 (g) and (h). - The penalty of reclusion temporal in its 
maximum period, or a fine ranging from Five Hundred Thousand Pesos (P 500,000.00) to 
One Million Pesos (Pl,OOO,OOO,OOO.OO), or both, at the discretion of the court, shall be 
imposed on any person found guilty of violating Section 4 (g) and (h) hereof. 
(0 
Violation of Section 4. - In addition to the penalties in subsections (a), (b), (c), (d), 
(e), (f), (g), and (h), of Section 4, any person found guilty of violating this Act shall be barred 
from working in any computer-related profession, corporation, industry, or concern, 
including any government agency, instrumentality, LGU, and/or government-owned or 
controlled corporation for a period of five (5) to fifteen (15) years, at the discretion of the 
court, and shall be perpetually disqualified from holding public office. 
(g) If, in committing any of the acts enumerated in Section 4 hereof, any of the other 
acts as enumerated is also committed, then the penalty next higher in degree as provided 
herein shall be imposed. 
SEC. 6. Remedies. - Any person, natural or juridical, who shall suffer loss or damage 
in its business or property by reason of violation of Section 4 of this Act, may file an action 
with the Regional Trail Court having jurisdiction to recover damages, injunctive relief, and 
he costs of the suit with the Regional Trail Court: provided, That damages for violations 
involving damage as defined in Section 4 (h) of this Act shall include an order by the court 
- 7 -  


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
1s 
16 
17 
18 
19 
20 
21 
22 
23 
for the accused to reimburse the victim for: (a) the cost of repairing, or if necessary, replacing 
the affected computer, computer system, computer network, computer software, computer 
program, or database; (b) lost profit for the period that the computer, computer system, 
computer network, computer software, computer program, or database in unusable; or (c) 
the cost of replacing or restoring the data lost or damaged as a result of violation of Section 4 
(h) of this Act: Provided, finally: That no action may be brought under this Section unless: 
(a) such action is begun within two (2) years of the date of the act complained of; or (b) the 
date of the discovery of the damage. 
SEC. 7. Appropriations. - The amount necessary for the initial implementation of this 
Act shall be charged against the current year’s appropriations of the National Bureau of 
Investigation (NBI). Thereafter, such sums as may be necessary for the effective 
implementation of this Act shall be included in the annual General Appropriations Act. 
SEC. 8. Implemenring Rules and Regulations, - The Department of Justice (DOJ), the 
NBI, and the National Computer Center (NCC), shall jointly formulate and issue the 
necessary implementing rules and regulations within sixty (60) days after the effectivity of 
this Act. 
SEC. 9. 
Public Information Campaign - The Commission on Higher Education 
(CHED), the Department of Education, Culture and Sports (DECS), the DOJ, the NBI,: and 
the NCC shall, in coordination with the Philippine Information Agency (PIA), undertake a 
public information campaign to educate the student population and the general public on the 
salient provisions of this Act. 
SEC. 10. AnnualReporr. - At the end of every year, the DOT, the NBI, and the NCC 
shall jointly submit a report to the President, the Senate, and the House of Representatives, 
24 
on the implementation of this Act; any recommendation for additional and/or remedial 
- 8 -  


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
legislation; and to provide for the publication of reports in such form and manner as may be 
best adapted for public information and use. 
SEC. 11. Separability Clause - If, for any reason, any section or provision of this Act is 
declared unconstitutional or valid, such parts not affected thereby shall remain in full force 
and effect. 
SEC. 12. Repealing Clause - All laws, decrees, executive orders, issuances, rules and 
regulations, or parts thereof, which are inconsistent with the provision of this Act are hereby 
repealed or immediately modified accordingly 
SEC. 13. Effectivity - This Act shall take effect immediately upon its complete 
publication in at least two (2) national newspapers of genera1 circulation. 
Approved, 
- 9 -