Republic of the Philippines
House of Representatives
Quezon City

16" CONGRESS
1st Regular Session

House Bill No,__ 2925

Introduced by Representatives Mariano Michael M. Velarde Jr., Jose L.
Atienza Jr. and Irwin C. Tieng

AN ACT DEFINING AND CRIMINALIZING PHISHING IN THE
PHILIPPINES

EXPLANATORY NOTE

Cyber space has become a new reality in the life of the Filipinos and of society, affecting not
only the private and personal but also the public life. It affects and impact the different aspects
of society, ¢.g., economic, political and socio-cultural. It became an enabler and impetus
towards modernization and development.

‘As much as the countless benefits we derive from cyber space and the Internet, it also entails
new forms of fraud, exploitation, oppression and victimization of unwitting and unwary people.
The economic impact of these new forms of victimization is immeasurable. Phishing as a new
form of identity theft and economic sabotage has already victimized many people and with the
fast pace in technology development and innovation, people are more vulnerable to these new
forms of fraud and theft.

It is paramount for government to protect its people and society from all forms of victimization
and fraud; and to create the right and secure environment for a more productive and developed
nation.

With the Republic Act 10175 or better known as the Cybercrime Prevention Act of 2012 still
hanging in limbo and its revised form will be submitted by the Department of Justice to the 16”
Congress for its approval, the people vulnerable to these new forms of fraud and identity
‘Therefor it is the authors’/view that thjs measure is of importance and relevance. We pray that

Rep. Jose L. Atienza Jr.

Rep. Irwin C. Tieng


Republic of the Philippines
House of Representatives
Quezon City

46 CONGRESS
4° Regular Session

House Bill No.__ 2925

Introduced by Representatives Mariano Michael M. Velarde Jr., Jose L.
Atienza Jr. and Irwin C. Tieng

AN ACT DEFINING AND CRIMINALIZING PHISHING IN THE
PHILIPPINES

Be it enacted by the Senate and HOUSE OF REPRSENTATIVES of the
Philippines in Congress assembled:

SECTION 1. Title. - This Act shall be known as the "Anti Phishing Bill of 2013."

SEC. 2. Declaration of Policy. - The State recognizes the increasingly vital role of
information and communications technology (ICT) as an enabler of key industries, such
as banking, broadcasting, business process outsourcing, electronic commerce, and
telecommunications, and as a driving force for the nation’s overall social and economic
development. The State also recognizes the importance of providing an environment
conducive to the development, acceleration, and application of ICT to attain free, easy,
and intelligible access to exchange and/or delivery of information; and the need to
protect and safeguard the integrity of computer and communications systems, networks,
and database, and the confidentiality, integrity, and availability of information and data
stored therein, from all forms of misuse, abuse, and illegal access by making such
conduct punishable under the law. In this light, the State shall adopt sufficient powers to
effectively prevent and combat such offenses by facilitating their detection,
investigation, and prosecution at both the domestic and international levels, and by
providing arrangements for fast and reliable international cooperation.

SEC. 3 Definition of Terms.

(a) Access - refers to the instruction, communication with, storage of data in, retrieval
of data from, or otherwise making use of any resource of a computer system;

(b) Alteration - refers to the modification or change, in form or substance, of an
existing computer data or program;

(c) Communication — refers to the transmission of information, including voice and
non-voice data;

(d) Computer system — refers to any device or group of interconnected or related
devices, one or more of which, pursuant to a program, performs automated processing
of data. It covers any type of device with data processing capabilities, including but not
limited to, computers and mobile phones. The device consisting of hardware and
software may include input, output and storage components which may stand alone or
be connected in a network or other similar devices. It also includes computer data
storage devices or media;


(e) Computer Data ~ refers to any representation of facts, information, or concepts in a
form suitable for processing in a computer system, including any program capable of
causing a computer system to perform a function, as well as electronic documents or
electronic data messages;

() Computer Program ~ refers to a set of instructions executed by the computer to
achieve intended results;

(g) Conduct Without Right - refers to either: (i) conduct undertaken without or in
excess of authority; or (ii) conduct not covered by established legal defenses, excuses,
court orders, justifications, or relevant principles under the law;

(h) Database — refers to a representation of information, knowledge, facts, concepts, or
instructions which are being prepared, processed or stored or have been prepared,
processed or stored in an organized manner and which are intended for use in a
computer system;

(\) Interception — refers to listening to, recording, monitoring or surveillance of the
content of communications, including procurement of the content of data, either directly,
through access and use of a computer system or indirectly, through the use of
electronic eavesdropping or tapping devices, at the same time that the communication
is occurring;

() Phishing — refers to the act of securing personal information such as username,
password, bank account numbers and credit card details for the purpose of using it in
fraud, or for participating in fraudulent business practices, or for the purpose of identity
theft and misrepresentation;

(&) Service Provider — refers to: (i) any public or private entity that provides to users of
its service the ability to communicate by means of a computer system; or (ii) any other
entity that processes or stores computer data on behalf of such communication service
or users of such service;

() Subscriber's Information — refers to any information contained in the form of
computer data or any other form that is held by a service provider, relating to
subscribers of its services other than traffic or content data and by which can be
established: (i) the type of communication service used, the technical provisions taken
thereto and the period of service; (ii) the subscriber's identity, postal or geographic
address, telephone and other access number, any assigned network address, billing
and payment information, available on the basis of the service agreement or
arrangement; (iii) any other available information on the site of the installation of
communication equipment, available on the basis of the service agreement or
arrangement;

(m) Traffic Data or Non-Content Data — refers to any computer data other than the
content of the communication, including but not limited to the communication’s origin,
destination, route, time, date, size, duration, or type of underlying service

CHAPTER Il - PUNISHABLE ACTS

SEC. 4. Phishing Offense: The following acts constitute the offense of phishing
punishable under this Act:

(a) Any unauthorized act of securing personal information such as username,
password, bank account numbers and credit card details for whatever purpose, except
for valid and legitimate business transaction;


(b) Any act of securing personal information such as username, password, bank
account numbers and credit card details for the purpose of using it in fraud, or for
participating in fraudulent business practices, or for the purpose of identity theft and
misrepresentation; or

(c) Any use of such data obtained through phishing as defined in the Section 4 (a)
and (b) above.

SEC. 5. Other Offenses. The following acts shall also constitute an offense:

(a) Aiding or Abetting in the Commission of Phishing — any person who willfully abets or
aids in the commission of any of the offenses enumerated in this Act shall be held liable;
or

(b) Attempt to Commit Phishing — any person who willfully attempts to commit any of
offenses enumerated in this Act shall be held liable

SEC. 6. Liability under Other Laws. A prosecution under this Act shall be without
prejudice to any liability for violation of any provision of Republic Act No. 3815, as
amended, otherwise known as the Revised Penal Code, or any other law.

CHAPTER Ill - PENALTIES

SEC. 7. Penalties. - The following penalties shall be imposed on violations under this
Act:

(@) Any person found guilty of any of the punishable acts enumerated in Section 4A and
4B of this Act shall be punished with imprisonment of six (6) years and one day to
twelve (12) years or a fine of at least Two Hundred Thousand Pesos (PhP 200,000.00)
up to a maximum amount commensurate to the damage incurred or both

SEC. 8. Corporate Liability. - When any of the punishable acts herein defined is
knowingly committed in behalf of or for the benefit of a juridical person, by a natural
person acting either individually or as part of an organ of the juridical person, who has a
leading position within, based on: (a) a power representation of the juridical person; (b)
an authority to take decision on behalf of the juridical person; or (c) an authority to
exercise control within the juridical person, the juridical person shalll be held liable for a
fine equivalent to at least double the fines imposable in Section 7 up to a maximum of
Ten Million Pesos (PhP10,000,000.00)

When the commission of any of the punishable acts herein defined was made possible
due to the lack of supervision or control by a natural person referred to and described in
the preceding paragraph, for the benefit of that juridical person by a natural person
acting under its authority, the juridical person shall be held liable for a fine equivalent to
at least double the fines imposable in Section 7 up to a maximum of Five Million Pesos
(Php 5,000,000.00).

The liability imposed on the juridical person shall be without prejudice to the criminal
liability of the natural person who has committed the offense.

CHAPTER IV - ENFORCEMENT AND IMPLEMENTATION

SEC. 9. Law Enforcement Agencies - The National Bureau of Investigation (NBI) and
the Philippine National Police (PNP) shall be responsible for the efficient and effective
law enforcement of the provisions of this Act. The NBI and the PNP shall designate
special investigators to exclusively handle cases involving violations of this Act


SEC. 10. Real-time Collection of Computer Data. - Law enforcement authorities shall
be authorized to collect or record by technical or electronic means, and service
providers are required to collect or record by technical or electronic means, and/or to
cooperate and assist law enforcement authorities in the collection or recording of, traffic
data, in real-time, associated with the specified communications transmitted by means
of a computer system, subject to existing laws and procedures.

SEC. 11. Preservation of Computer Data. - The integrity of traffic data and subscriber
information relating to communication services provided by a service provider shall be
preserved up to a minimum period of six (6) months from the date of the transaction.
Content data shall be preserved for a minimum period of six (6) months from the date of
receipt of the order from law enforcement authorities requiring its preservation.

Law enforcement authorities may order a one-time extension of six (6) months:
Provided, That once computer data preserved, transmitted or stored by a service
provider is used as evidence in a case, the mere furnishing to such service provider of
the transmittal document to the Office of the Prosecutor shall be deemed a notification
to preserve the computer data until the termination of the case.

The service provider ordered to preserve computer data shall keep confidential the
order and its compliance.

SEC. 12. Disclosure of Computer Data - Law enforcement authorities shall be
authorized to issue an order requiring any person or service provider to disclose or
submit subscriber's information, traffic data or relevant data in his/its possession or
control within seventy-two (72) hours from receipt of the order in relation to a valid
complaint officially docketed and assigned for investigation and the disclosure is
necessary and relevant for investigation purposes.

SEC.13. Search, Seizure and Examination of Computer Data. - Where a search and
seizure warrant is properly issued, law enforcement authorities shall, within the time
period specified in the warrant, have the following powers and duties

(a) To conduct interception, as defined in this Act, of content data;

(b) To secure a computer system or a computer-data storage medium;

(c) To make and retain a copy of secured computer data;

(d) To maintain the integrity of the relevant stored computer data;

(e) To conduct examination of the computer data storage medium; and

(f To render inaccessible or remove those computer data in the accessed computer
system.

The law enforcement authorities may order any person who has knowledge about the
functioning of the computer system and the measures to protect and preserve the
computer data therein to provide, as is reasonable, the necessary information, to enable
the undertaking of the search, seizure and examination,

Law enforcement authorities may request for an extension of time to complete the

‘examination of the computer data storage medium and to make a return thereon but in

no case for a period longer than thirty (30) days from date of expiration of the warrant
CHAPTER V - JURISDICTION

SEC.14. Jurisdiction. - The Regional Trial Court shall have jurisdiction over any
violation of the provisions of this Act committed within the territory of the Philippines,


including Philippine ships or airships, or by a Filipino national regardless of the place of
commission. Jurisdiction shall also cover any of the elements committed within the
Philippines or committed with the use of any computer system wholly or partly situated
in the country, or when by such commission, any damage is caused to a natural or
juridical person who, at the time the offense was committed, was in the Philippines.

The Department of Justice (DOJ) shall designate special prosecutors to exclusively
handle cases involving violations of this Act.

CHAPTER VI - INTERNATIONAL COOPERATION

SEC. 15. Mutual Assistance and Cooperation. - The Government of the Philippines
shall cooperate with, and render assistance to other nations for purposes of detection,
investigation, and prosecution of offenses referred to in this Act and in the collection of
evidence in electronic form in relation thereto. The principles contained in Presidential
Decree 1069, otherwise known as the Philippine Extradition Law and other pertinent
laws shall apply.

In this regard, the Government of the Philippines shall

(1) Provide assistance to a requesting nation in the real-time collection of traffic data
associated with specified communications in the Philippine territory transmitted by
means of a computer system, with respect to criminal offences defined in this law for
which real-time collection of traffic data would be available;

(2) Provide assistance to a requesting nation in the real-time collection, recording or
interception of content data of specified communications transmitted by means of a
computer system to the extent permitted under Republic Act No. 4200, otherwise known
as the Anti Wiretapping Act, Republic Act No. 9372, otherwise known as the Human
Security Act of 2007, and other related and pertinent laws;

(3) Allow another nation, without its authorization to:

(a) access publicly available stored computer data, located in Philippine territory, or
elsewhere; or

(b) access or receive, through a computer system located in Philippine territory, stored
computer data located in another country, if the nation obtains the lawful and voluntary
consent of the person who has the lawful authority to disclose the data to the nation
through that computer system;

(4) Entertain a request of another nation for it to order or obtain the expeditious
preservation of data stored by means of a computer system, located within Philippine
territory, relative to which the requesting nation intends to submit a request for mutual
assistance for the search or similar access, seizure or similar securing, or disclosure of
the stored computer data

(@) A request for preservation of data under this Section shall specify:

(i) the authority seeking the preservation;

(ii) the offense that is the subject of a criminal investigation or proceedings and a brief
summary of the related facts;

(iii) the stored computer data to be preserved and its relationship to the offence;

(iv) the necessity of the preservation; and


(v) that the requesting nation intends to submit a request for mutual assistance for the
search or similar access, seizure or similar securing, or disclosure of the stored
computer data.

(b) Upon receiving the request from another nation, the Government of the Philippines
shall take all appropriate measures to preserve expeditiously the specified data in
accordance with this law and other pertinent laws. For the purposes of responding to a
request, dual criminality shall not be required as a condition to providing such
preservation.

(c) A request for preservation may only be refused if.

(i) the request concerns an offense which the Government of the Philippines considers
as a political offense or an offense connected with a political offense; or

(ii) the Government of the Philippines considers the execution of the request will
prejudice its sovereignty, security, public order or other national interest

(d) Where the Government of the Philippines believes that preservation will not ensure
the future availability of the data, or will threaten the confidentiality of, or otherwise
prejudice the requesting nation’s investigation, it shall promptly so inform the requesting
nation. The requesting nation will determine whether its request should be executed

(e) Any preservation effected in response to the request referred to in paragraph 1 shall
be for a period not less than sixty days, in order to enable the requesting nation to
submit a request for the search or similar access, seizure or similar securing, or
disclosure of the data. Following the receipt of such a request the data shall continue to
be preserved pending a decision on that request.

(6) Accommodate request from another nation to search, access, seize, secure, or
disclose data stored by means of a computer system located within Philippine territory,
including data that has been preserved under the previous subsection. The Government
of the Philippines shall respond to the request through the proper application of
international instruments, arrangements and laws

(a) The request shall be responded to on an expedited basis where:

(i) there are grounds to believe that relevant data is particularly vulnerable to loss or
modification; or

(ii) the instruments, arrangements and laws referred to in number 2 of this Section
otherwise provide for expedited co-operation.

(b) The requesting nation must maintain the confidentiality of the fact or the subject of
request for assistance and cooperation. It may only use the request information subject
to the conditions specified in the grant.

SEC. 16. Grounds for Refusal to Cooperate. - The Government of the Philippines
shall have the right to refuse cooperation under any of the following grounds:

(a) the offense is punishable under Philippine laws and the Philippine courts have
acquired jurisdiction over the person of the accused;

(b) the information requested is privileged, protected under Philippine laws, or that
which affects national security;

(C) if, for any reason, the production of the information is unreasonable,


we i
: ee

(d) the foreign government requesting for assistance has previously refused without
justifiable reason, a similar request by the Government of the Philippines; and

(e) the foreign government requesting for assistance has previously breached an
agreement to keep the fact or subject of request confidential, or has previously violated
any condition of the grant.

SEC. 17. Cooperation Based on Reciprocity. — In the absence of a treaty or
agreement, mutual assistance and cooperation under the preceding sections in this
Chapter shall be based on the principle of reciprocity.

CHAPTER VII - FINAL PROVISIONS

SEC. 18. Appropriations. — The amount necessary to implement the provisions of this,
‘Act shall be included in the Annual General Appropriations Act.

SEC. 19, Implementing Rules and Regulations. — The Commission on Information
and Communications Technology (CICT) and the Department of Justice shall jointly
formulate the necessary rules and regulations for the effective implementation of this
Act.

SEC. 20. Separability Clause. — If any provision of this Act is held invalid, the other
provisions not affected shall remain in full force and effect.

SEC. 21. Repealing Clause. — Alll laws, decrees, or rules inconsistent with this Act are
hereby repealed or modified accordingly. Specifically, Section 33 of Republic Act No.
8792 or the Electronic Commerce Act is hereby modified accordingly.

SEC. 22. Effectivity. — This Act shall take effect fifteen (15) days after its publication in
the Official Gazette or in at least two (2) newspapers of general circulation,

larde Jr.

Rep. Jose L. Atienza Jr.

Rep. Irwin C. Tieng