COMPUTER AND INTERNET Hacking – Hackers found ways to exploit holes in

operating systems of local and remote systems.

CRIMES They developed methods to exploit security holes
in various computer systems.
Security
Types and Effects of Computer Crimes Internal Misuse – Occasionally, some people use
your computer and some files may be intentionally
What is “Computer Crime”? or unintentionally deleted. When permanently
The term "computer crime" could reasonably deleted from the system, this may mean that you
include a wide variety of criminal offenses, will have to redo the work. System crashes can
activities, or issues. also occur when files needed by a program are
It can be separated into two categories: deleted or altered.
(1) crimes facilitated by a computer; and
(2) crimes where the computer is the target.​ Spoofing – Network spoofing is an ingenious way
for an intruder to gain access to the system. The
THE DIFFERENT COMPUTER SECURITY intruder sets up a program that impersonates the
ISSUES AND THEIR EFFECTS sign-on routine of another system.

There are basically three overlapping types of TWO CATEGORIES OF ELECTRONIC CRIME
risks: TYPES.
1. Bugs or misconfiguration problems that There are many different ways to attack computers
allow unauthorized remote users to: and networks to take advantage of what has made
●​ Steal confidential documents shopping, banking, investment, and leisure pursuits
●​ Execute commands on the host machine, a simple matter of ― “dragging and clicking” for
allowing them to modify the system many people.
●​ Gain information about the host machine, The different types of electronic crime fall into two
allowing them to break into the system main categories:
●​ Launch denial-of-service attacks, rendering the - crimes in which computer is the target of the
machine temporarily unusable attack,
2. Browser-side risks, including: - and incidents in which the computer is a
●​ Active content that crashes the browser, means of perpetrating a criminal act.
damages the user's system, breaches the user's
privacy, or merely creates an annoyance NOTED COMPUTER CRIMES OVER THE PAST
●​ The misuse of personal information knowingly or YEARS:
unknowingly provided by the end-user
3. Interception of network data sent from Morris Worm (November, 1988) – Robert Morris
browser to server or vice versa via network released what has become known as the Internet
eavesdropping Worm.
Citibank and Vladimir Levin (June-October,
THE ASPECTS OF COMPUTER SECURITY 1994) – Levin reportedly accomplished the
break-ins by dialing into Citibank‘s cash
Physical Security – The first and perhaps the management system.
easiest rule of computer security .Everyone knows Kevin Mitnick (February, 1995) – Mitnick admitted
that you need to lock your doors to keep your TV, to having gained unauthorized access to a number
refrigerator, and other appliances safe at home. of different computer systems belonging to
The same idea applies to your computer as well. companies such as Motorola, Novell, Fujitsu, and
We have to make sure that our computers are Sun Microsystems.
attended, watched, or locked behind our doors. Omega Engineering and Timothy Lloyd (July,
1996) – The program that run on July 30 deleted all
Viruses – Once you've started using your the design and production programs for the
computer, viruses can start working on your company, severely damaging the small firm and
computer too. The computer virus is one of those forcing the layoff of 80 employees.
programs you don't want that usually gets sent to Jester and the Worcester Airport (March, 1997)
you by people through email. – Airport services to the FAA control tower as well
as the emergency services at the Worcester Airport
Malicious Logic – This usually affects your and the community of Rutland, Massachusetts
computer system while you are on the net. were cut off for a period of six hours.
Commands are frequently present in web pages we Solar Sunrise (February, 1998) – A series of
visit while surfing the net. This type of computer computer intrusions occurred at a number of
security problem is usually deliberately created. military installations in the U.S.
Symptoms may include slow response time, system Melissa Virus (March, 1999) – Melissa is the
crashes, or uncooperative programs. best-known early macro type viruses that attach

1
themselves to documents for programs that have security systems in place and will be better able to
limited macro programming capability. avoid detection.
The Love Letter Worm (May, 2000) – Also known
as the ―ILOVEYOU‖ virus and the ―Love Bug, Criminal Organizations – Attacks by criminal
was written and released by a Philippine student organizations can fall into the structured threat
named Onel de Guzman. The worm was spread via category, which is characterized by a greater
email with the subject line of ―ILOVEYOU. amount of planning, a longer period of time to
The Code-Red Worm (2001) – This infection took conduct the activity, more financial backing to
only 14 hours to occur. The worm took advantage accomplish it, and possibly, corruption of or
of a buffer-overflow condition in Microsoft‘s IIS web collision with insiders.
servers.
Adil Yahya Zakaria Shakour (August, 2001-May, Terrorists and Information Warfare – An
2002) – Shakour admitted to having accessed information warfare is conducted against
several computers without authorization, including information and information processing equipment
a server at Eglin Air Force Base, computers at used by an adversary.
Accenture, a computer system at Sandia National
Laboratories, and a computer at COMPUTER SECURITY AND NETWORK
[Link]. SECURITY
The Slammer Worm (2003) – It exploited buffer-
overflow vulnerability in computers running Computer security is the effort to create a secure
Microsoft‘s SQL Server or Microsoft SQL Server computing platform, designed so that agents (users
Desktop Engine. or programs) can only perform actions that have
July 2009 cyberattacks – These were a series of been allowed. This involves specifying and
coordinated cyberattacks against major implementing a security policy.
government, news media, and financial websites in
South Korea and the United States. Network security is a protection of networks and
Shamoon (2012) – It is a computer virus their services from unauthorized modification,
discovered in 2012 that attacks computers running destruction, or disclosure, and provision of
the Microsoft Windows operating system. assurance that the network performs its critical
functions correctly and there are no harmful
There are a number of different threats to side-effects.
security and these are the following:
CIA of security.
Viruses and Worms – The original goal of computer and network security
A virus is a self-replicating program that spreads is to provide confidentiality, integrity, and
by inserting copies of itself into other executable availability.
code or documents. ● Confidentiality refers to the security principle
A worm is a type of malware and is a that states that information should not be disclosed
self-replicating program similar to a virus. to unauthorized individuals.
● Integrity is the security principle that requires
Intruders – The act of deliberately accessing information to not be modified except by individuals
computer systems and networks without authorized to do so.
authorization is generally referred to as hacking. It ● Availability applies to hardware, software, and
also applies to the act of exceeding one‘s authority data. All of these should be present and accessible
in a system. This includes authorized users who when the subject (the user) wants to access or use
attempt to gain access to files or obtain them.
permissions that they have not been granted.
Authentication deals with the desire to ensure that
A script kiddie is a derogatory term for an individual is who they claim to be.
inexperienced crackers who use scripts and Nonrepudiation deals with the ability to verify that
programs developed by others for the purpose of a message has been sent and received and that
compromising computer accounts and files, and for the sender can be identified and verified the
launching attacks on whole computer systems. security principles
Elite hackers are people who are not only capable
of writing scripts to exploit known vulnerabilities, but The three ways an organization can choose to
also capable of discovering new ones. address the protection of its networks are:

Insiders – They have the access and knowledge - ignore security issues,
necessary to cause immediate damage to an - provide host security, and
organization. They may also have all the access - approach security at a network level.
they need to perpetrate criminal activity such as
fraud. Moreover, they have knowledge of the Least privilege is applicable to many physical
environments as well as network and host security.
2
Least privilege means that an object should have ● Individual Power - Would-be criminals often
only the necessary rights and privileges to perform need help to misbehave.
its task, with no additional permissions.
Computer crime laws:
Layered security is important every environment ● Fair Credit Reporting Act of 1970 (FCRA).
have multiple layers of security. Controls operations of credit-reporting bureaus,
including how they collect, store, and use credit
Diversity of defense is a concept that information.
complements the idea of various layers of security. ● Freedom of Information Act of 1970. Ensures
access of individuals to personal data collected
Access is the ability of a subject to interact with an about them and about government activities in
object. Access controls refers to devices and federal agency files.
methods used to limit which subjects may interact ● Tax Reform Act of 1976. Regulates the
with specific objects. Authentication mechanisms collection and use of certain information by the
ensure that only valid users are provided access to Internal Revenue Service
the computer system or network. ● Rights to Financial Privacy Act of 1978.
Regulates government access to certain records
The following are the various methods to implement held by financial institutions.
access controls: ● Electronic Funds Transfer Act of 1979.
Enumerates the responsibilities of companies that
Discretionary Access Control means restricting use electronic funds transfer systems, including
access to objects based on the identity of the consumer rights and liability for bank debit cards.
subject and/or groups to which they belong. ● Computer Matching and Privacy Act of 1988.
Regulates cross-reference between federal
Mandatory Access Control means restricting agencies‘ computer files.
access to objects that are based on fixed security ● Video Privacy Act of 1988. Prevents retail
attributes assigned to users and to files and other stores from disclosing video rental records without
objects. a court order.
● Telephone Consumer Protection Act of 1991.
Role-Based Access Control alternative to Limits telemarketers‘ practices.
traditional access control models (e.g., ● Cable Act of 1992. Regulates companies and
discretionary or non-discretionary access control organizations that provide wireless communication
policies) that permits the specification and services, including cellular phones.
enforcement of enterprise-specific security policies ● Computer Abuse Amendments Act of 1994.
in a way that maps more naturally to an Prohibits transmissions of harmful computer
organization's structure and business activities programs and code, including viruses.
● Children’s Online Privacy Protection Act of
Information Ethics 1998. Establishes standards for sites that collect
● Ethics is a set of principles which involves information from children. Its purpose is to prohibit
systematizing, defending, and recommending unfair or deceptive acts or practices in connection
concepts of right and wrong behavior. with the collection, use, or disclosure of personally
● Information ethics can be regarded as part of identifiable information from and about children on
normal business ethics since to do otherwise would the Internet.
mean that normally unethical acts might be all right ● Education Privacy Act. Restricts collection and
via computer. use of data by federally funded educational
● Business ethics is the “code of morals of a institutions, including specifications for the type of
particular profession” and “the standards of conduct data collected, access by parents and students to
of a given profession”. Since morals are “principles the data, and limitations on disclosure.
if right and wrong in conduct”, information ethics,
therefore, can be defined as an agreement among Federal Crime Laws
information systems professionals to do right and to Copyrights Law. Sets standards on copyrights and
avoid wrong in their work. computer programs.
Fraud and False Statements Law. Standards
Four unique information systems attributes against fraud and related activity in connection with
addressed by information ethics access devices and computers.
● Location - With a computer, an unethical act can Espionage and Censorship. Sets standards in
be committed from many locations. gathering, transmitting, or losing defense
● Time - Information systems make it possible to information.
commit unethical acts quickly. Mail Fraud Law
● Separation of Act from Consequences- Most ● General prohibition on pen register and
people feel guilty when they see someone hurt by trap and trace device use
their actions. ● Pen Registers and Trap and Trace
Devices
3
 ● Standards against fraud by wire, radio, or nature and for any purpose shall be inviolable, and
television no search warrant or warrant of arrest shall issue
● Standards against Interception and except upon probable cause to be determined
disclosure of wire, oral, or electronic personally by the judge after examination under
communications prohibited oath or affirmation of the complainant and the
● Wire and Electronic Communications witnesses he may produce, and particularly
Interception and Interception of Oral describing the place to be searched and the
Communications persons or things to be seized.

Tips on preventing crime on the Internet Section 3. (1) The privacy of communication and
● Use of stand-alone firewall, including correspondence shall be inviolable except upon
hardware and software with network lawful order of the court, or when public safety or
monitoring capabilities. order requires otherwise, as prescribed by law.
● Use Internet security specialists to
perform audits of all Internet and network (2) Any evidence obtained in violation of this or the
activities. preceding section shall be inadmissible for any
● Develop effective Internet and security purpose in any proceeding.
policies for all employees.
● Monitor managers and employees to Note also that under Section 7, Article III of the
make sure they are using the Internet for Constitution, the right of the people to information
business purposes only. on matters of public concern shall be recognized. A
citizen has the right to access to official records,
Other Definition of Terms and to documents and papers pertaining to official
● A hacker is a person who enjoys computer acts, transactions, or decisions, subject to the
technology and spends time learning and using limitations provided by law. Hence, the case being
computer systems jurisprudence, one has the right to access such
● A criminal hacker, also called a cracker, is a information.
computer-savvy person who attempts to gain
unauthorized or illegal access to computer Given the situation, a person cannot invoke that his
systems. In many cases, criminal hackers are right to privacy has been violated because of the
people who are looking for fun and excitement – publication of his name along with the case he was
the challenge of beating the system in as the right to privacy does not prohibit the
● Application viruses infect executable publication of matter which is of public or general
application files, such as word processing programs interest.
● A system virus typically infects operating system
programs or other systems files. THE NATIONAL IDENTIFICATION SYSTEM
● A macro virus is a virus that uses an
application‘s own macro programming language to It‘s been two decades since the government first
distribute itself initiated the establishment of a national ID system.
● Diversity of Defense is concept that
complements the idea of various layers of security In 1996, then President Fidel Ramos issued
● Ergonomics is an approach which puts human Administrative Order No. 308 adopting a
needs and capabilities at the focus of designing National Computerized Identification System.
technological systems
● Access is the ability of a subject to interact with Unfortunately, the order was declared
an object. unconstitutional by the Supreme Court. In striking
● Privacy refers to the right of people to not reveal down A.O. 308, the Supreme Court emphasized
information about them. that the Court is not per se against the use of
X computers to accumulate, store, process, retrieve
TECHNOLOGIES’ IMPACT ON and transmit data to improve our bureaucracy. The
Supreme Court also emphasized that the right to
PRIVACY privacy does not bar all incursions into the right to
individual privacy. This right merely requires that
The Philippines has no specific law on privacy. the law is narrowly focused and a compelling
However, the 1987 Constitution tried to provide interest justifies such intrusions. Intrusions into the
under its: right must be accompanied by proper safeguards
and well-defined standards to prevent
Article III (Bill of Rights) provisions for the right to unconstitutional invasions.
privacy, namely: ●​ The right to privacy is a constitutional
right, granted recognition independently of
Section 2. The right of the people to be secure in its identification with liberty. It is recognized
their persons, houses, papers, and effects against and enshrined in several provisions of our
unreasonable searches and seizures of whatever Constitution, specifically in Sections 1, 2, 3
4
 (1), 6, 8 and 17 of the Bill of Rights. data for whatever purpose, or worse, manipulate
Zones of privacy are also recognized and the data stored within the system.
protected in our laws, including certain
provisions of the Civil Code and the Revised A.O. 308 falls short of assuring that personal
Penal Code, as well as in special laws (e.g., information which will be gathered about our people
Anti-Wiretapping Law, the Secrecy of Bank will only be processed for unequivocally specified
Deposit Act and the Intellectual Property purposes. The lack of proper safeguards in this
Code). regard of A.O. 308 may interfere with the
●​ The right to privacy is a fundamental right individual‘s liberty of abode and travel by enabling
guaranteed by the Constitution. Therefore, it authorities to track down his movement; it may also
is the burden of the government to show enable unscrupulous persons to access confidential
that A.O. 308 is justified by some information and circumvent the right against
compelling state interest and that it is self-incrimination; it may pave the way for “fishing
narrowly drawn. The government failed to expeditions” by government authorities and evade
discharge this burden. the right against unreasonable searches and
A.O. 308 is predicated on two considerations: seizures. The possibilities of abuse and misuse of
(1) the need to provide our citizens and foreigners the PRN, biometrics and computer technology are
with the facility to conveniently transact business accentuated when we consider that the individual
with basic service and social security providers and lacks control over what can be read or placed on
other government instrumentalities and his ID, much less verify the correctness of the data
(2) the need to reduce, if not totally eradicate, encoded. They threaten the very abuses that the
fraudulent transactions and misrepresentations by Bill of Rights seeks to prevent.
persons seeking basic services. While it is
debatable whether these interests are compelling IDENTITY THEFT IN THE PHILIPPINES
enough to warrant the issuance of A.O. 308, it is
not arguable that the broadness, the vagueness, Today, personal information is captured, processed,
the overbreadth of A.O. 308, if implemented, will and disseminated in a bewildering variety of ways,
put our people‘s right to privacy in clear and and through increasingly sophisticated,
present danger. miniaturized, and distributed technologies: identity
cards, biometrics, video surveillance, the use of
The heart of A.O. 308 lies in its Section 4 which cookies and spyware by websites, data mining and
provides for a Population Reference Number profiling, and many others.
(PRN) as a “common reference number to establish
a linkage among concerned agencies” through the Identity theft is the deliberate use of someone
use of “Biometrics Technology” and “computer else's identity, usually as a method to gain a
application designs.” financial advantage or obtain credit and other
benefits in the other person's name, and perhaps to
Biometry or biometrics is “the science of the the other person's disadvantage or loss.
application of statistical methods to biological facts;
a mathematical analysis of biological data.” The In the Philippines, many syndicated groups used
methods or forms of biological encoding include skimming machines to perform such acts. ATM
finger-scanning and retinal scanning, as well as the skimming is like identity theft for debit cards:
method known as the “artificial nose” and the Thieves use hidden electronics to steal the
thermogram. A.O. 308 does not state what specific personal information stored on your card and
biological characteristics and what particular record your PIN number to access all that
biometrics technology shall be used. hard-earned cash in your account. That's why
skimming takes two separate components to
Moreover, A.O. 308 does not state whether work.
encoding of data is limited to biological information ●​ The first part is the skimmer itself, a card
alone for identification purposes. The Solicitor reader placed over the ATM's real card slot.
General‘s claim that the adoption of the Some ATM skimming schemes employ fake
Identification Reference System will contribute to keypads in lieu of cameras to capture PIN
the “generation of population data for development numbers. Just like the card skimmers fit over the
planning” is an admission that the PRN will not be ATM's true card slot, skimming keypads are
used solely for identification but for the generation designed to mimic the keypad's design and fit over
of other data with remote relation to the avowed it like a glove. If you notice that the keypad on your
purposes of A.O. 308. The computer linkage gives ATM seems to protrude oddly from the surface
other government agencies access to the around it, or if you spy an odd color change
information, but there are no controls to guard between the pad and the rest of the ATM, it could
against leakage of information. When the access be a fake.
code of the control programs of the particular
computer system is broken, an intruder, without THE BLOGGER’S FREEDOM OF EXPRESSION
fear of sanction or penalty, can make use of the AND THE LIBEL LAW
5
 Every defamatory imputation is presumed to be
Scope of the Freedom of Expression malicious, even if it be true, if no good intention and
Article III (Bill of Rights) Section 4 of the 1987 justifiable motive for making it is shown, except in
Philippine Constitution provides that ―No law the following cases:
shall be passed abridging the freedom of speech, 1. A private communication made by any person to
of expression, or of the press, or the right of the another in the performance of any legal, moral or
people peaceably to assemble and petition the social duty; and
government for redress of grievances.‖ In addition, 2. A fair and true report, made in good faith, without
to protect the rights of people having an adverse any comments or remarks, of any judicial,
political beliefs and aspirations, Article III Section legislative or other official proceedings which are
18 (1) further provides ― “No person shall be not of confidential nature, or of any statement,
detained solely by reason of his political beliefs report or speech delivered in said proceedings, or
and aspirations.” of any other act performed by public officers in the
exercise of their functions.
DEFAMATION LAWS IN THE PHILIPPINES
Paragraph 2 aforequoted refers to a qualifiedly
Under Article 353 of the Revised Penal Code of privileged communication, the character of which is
the Philippines, libel is defined as a public and a matter of defense that may be lost by positive
malicious imputation of a crime, or of a vice or proof of express malice on the part of the accused.
defect, real or imaginary, or any act, omission, Once it is established that the article is of a
condition, status or circumstance tending to privileged character, the onus of proving actual
discredit or cause the dishonor or contempt of a malice rests on the plaintiff who must then convince
natural or juridical person, or to blacken the the court that the offender was prompted by malice
memory of one who is dead. or ill will. When this is accomplished the defense of
privilege becomes unavailing.
Thus, the elements of libel are:
(a) imputation of a discreditable act or condition to Prescinding from this provision, when the
another; imputation is defamatory, as in this case, the
(b) publication of the imputation; prosecution need not prove malice on the part of
(c) identity of the person defamed; and, the defendant (malice in fact), for the law already
(d) existence of malice. presumes that the defendant‘s imputation is
malicious (malice in law). The burden is on the side
In libel cases, the question is not what the writer of of the defendant to show good intention and
an alleged libel means, but what the words used by justifiable motive in order to overcome the legal
him mean. Jurisprudence has laid down a test to inference of malice.
determine the defamatory character of words used In order to constitute malice, it will must be
in the following manner, viz: personal. So if the ill will is engendered by one‘s
sense of justice or other legitimate or plausible
“Words calculated to induce suspicion are motive, such feeling negatives actual malice.
sometimes more effective to destroy reputation It is established doctrine that the malice that
than false charges directly made. Ironical and attends the dissemination of the article alleged to
metaphorical language is a favored vehicle for be libelous must attend the distribution itself. It
slander. A charge is sufficient if the words are cannot be merely a resentment against a person,
calculated to induce the hearers to suppose and manifested unconnectedly several months earlier or
understand that the person or persons against one displayed at a much later date.
whom they were uttered were guilty of certain
offenses, or are sufficient to impeach their honesty, How Committed:
virtue, or reputation, or to hold the person or Under Article 355 of the Revised Penal Code,
persons up to public ridicule. . . .” libel may be committed by means of writing,
printing, lithography, engraving, radio, phonograph,
An allegation is considered defamatory if it painting, theatrical exhibition, cinematographic
ascribes to a person the commission of a crime, the exhibition, or any similar means.
possession of a vice or defect, real or imaginary, or
any act, omission, condition, status or Persons Responsible:
circumstances which tends to dishonor or discredit Any person who shall publish, exhibit, or cause the
or put him in contempt, or which tends to blacken publication or exhibition of any defamation in writing
the memory of one who is dead. or by similar means, shall be responsible for the
same. The author or editor of a book or pamphlet,
Presumption of Malice: or the editor or business manager of a daily
The law also presumes that malice is present in newspaper, magazine or serial publication, shall be
every defamatory imputation. Thus, Article 354 of responsible for the defamations contained therein
the Revised Penal Code provides that: to the same extent as if he were the author thereof.

6
Defenses:
In every criminal prosecution for libel, the truth may COMPUTER HACKERS AND THE CYBERCRIME
be given in evidence to the court and if it appears LAW
that the matter charged as libelous is true, and,
moreover, that it was published with good motives The ILOVEYOU Virus
and for justifiable ends, the defendants shall be Where were you when the ILOVEYOU bug started spreading
on May 4th, 2000?
acquitted.
Was your computer one of the tens of millions of PCs the Love
Letter attacked?
Proof of the truth of an imputation of an act or
omission not constituting a crime shall not be Sixteen years ago, a young Filipino computer
admitted, unless the imputation shall have been student made history by unleashing the world‘s first
made against Government employees with respect global Internet-borne virus. Known as the Love
to facts related to the discharge of their official Bug, the virus spread from East to West in a single
duties. day, inflicting $5.5 billion in damages, corrupting
files, and shutting down computer systems at major
In such cases if the defendant proves the truth of corporations, newsrooms, Wall Street firms and
the imputation made by him, he shall be acquitted. government offices across the world.
It is important to remember that any of the
imputations covered by Article 353 is defamatory The worm arrived in people‘s email boxes with a
and, under the general rule laid down in Article 354, provocative subject line,―“I LOVE YOU: A love
every defamatory imputation is presumed to be letter for you.” When recipients opened the
malicious, even if it be true; if no good intention and attachment,―“LOVE
justifiable motive for making it is shown. There is [Link],” they unwittingly
malice when the author of the imputation is infected their own computer with the
prompted by personal ill-will or spite and speaks self_x0002_replicating worm as well as the
not in response to duty but merely to injure the computers of everyone in their contact list.
reputation of the person who claims to have been
defamed. Truth then is not a defense, unless it is The author of the virus is believed to be Onel de
shown that the matter charged as libelous was Guzman, then 25, a student at AMA Computer
made with good motives and for justifiable ends. University in Makati.
What many people did not realize at the time was
Online Libel in the Philippines that de Guzman‘s original intention for creating the
worm was altruistic at its roots. In the Philippines,
The Supreme Court (SC) of the Philippines an hour‘s worth of Internet access cost as much as
upheld the constitutionality of most parts of the half a day‘s wage: 100 pesos, the equivalent of two
Cybercrime Prevention Act of 2012 (Republic Act dollars.
No.10175), including the contentious provision that For his graduation thesis in computer science, de
punishes online libel. Guzman wrote a program that would enable the
average Filipino to get free Internet access by
The execution of the law was suspended in stealing passwords from the rich. His school
October 2012 by a temporary restraining order rejected his thesis because of its bandit nature, so
issued by the Supreme Court, following criticisms he could not graduate. Undeterred, de Guzman,
and protests among the media and human rights with the help of friends, unleashed his virus the day
advocates. before the university held its graduation ceremony.
However, with this new ruling of the Supreme The Philippine authorities filed theft and other
Court, a person or entity who posts something (in charges against Mr. de Guzman, but dropped them
words or pictures) — which can be proven false, in August because of insufficient evidence. The
and is intended to harm the reputation of another case against him was weakened because at the
by tending to bring the target into ridicule, hatred, time, the Philippines did not have laws governing
scorn or contempt of others — may be arrested, computer espionage.
detained, and imprisoned because of libel. Yes, in
the Philippines, libel is still a criminal offense. It CYBERCRIME PREVENTION ACT OF 2012
is defamation in its very essence, but covers (REPUBLIC ACT 10175)
published work on print, television and other
traditional media. The same is now true for new The following are the punishable acts according to
media like the internet. Chapter II of the Cybercrime Prevention Act of
2012:
This online/internet libel law, however, punishes SEC. 4. Cybercrime Offenses. — The following
only the original author of the post. Those who acts constitute the offense of cybercrime
“liked”, “shared,” “re-tweeted” or re-blogged a post punishable under this Act:
will not be criminally liable, unless the person (a) Offenses against the confidentiality, integrity
added a comment that may deemed to be libelous and availability of computer data and systems:
by a complainant.
7
(1) Illegal Access. – The access to the whole or the intent that it be considered or acted upon for
any part of a computer system without right. legal purposes as if it were authentic, regardless
whether or not the data is directly readable and
(2) Illegal Interception. – The interception made intelligible; or
by technical means without right of any non-public (ii) The act of knowingly using computer data which
transmission of computer data to, from, or within a is the product of computer-related forgery as
computer system including electromagnetic defined herein, for the purpose of perpetuating a
emissions from a computer system carrying such fraudulent or dishonest design.
computer data.
(2) Computer-related Fraud. — The unauthorized
(3) Data Interference. — The intentional or input, alteration, or deletion of computer data or
reckless alteration, damaging, deletion or program or interference in the functioning of a
deterioration of computer data, electronic computer system, causing damage thereby with
document, or electronic data message, without fraudulent intent: Provided, That if no damage has
right, including the introduction or transmission of yet been caused, the penalty imposable shall be
viruses. one (1) degree lower.

(4) System Interference. — The intentional (3) Computer-related Identity Theft. – The
alteration or reckless hindering or interference with intentional acquisition, use, misuse, transfer,
the functioning of a computer or computer network possession, alteration or deletion of identifying
by inputting, transmitting, damaging, deleting, information belonging to another, whether natural or
deteriorating, altering or suppressing computer data juridical, without right: Provided, That if no damage
or program, electronic document, or electronic data has yet been caused, the penalty imposable shall
message, without right or authority, including the be one (1) degree lower.
introduction or transmission of viruses.
(c) Content-related Offenses:
(5) Misuse of Devices. (1) Cybersex. — The willful engagement,
(i) The use, production, sale, procurement, maintenance, control, or operation, directly or
importation, distribution, or otherwise making indirectly, of any lascivious exhibition of sexual
available, without right, of: organs or sexual activity, with the aid of a computer
(aa) A device, including a computer program, system, for favor or consideration.
designed or adapted primarily for the purpose of
committing any of the offenses under this Act; or (2) Child Pornography. — The unlawful or
(bb) A computer password, access code, or similar prohibited acts defined and punishable by Republic
data by which the whole or any part of a computer Act No. 9775 or the Anti-Child Pornography Act of
system is capable of being accessed with intent 2009, committed through a computer system:
that it be used for the purpose of committing any of Provided, that the penalty to be imposed shall be
the offenses under this Act. (1) one degree higher than that provided for in
(ii) The possession of an item referred to in Republic Act No. 9775.
paragraphs 5(i)(aa) or
(bb) above with intent to use said devices for the (3) Unsolicited Commercial Communications. —
purpose of committing any of the offenses under The transmission of commercial electronic
this section. communication with the use of computer system
which seek to advertise, sell, or offer for sale
(6) Cyber-squatting. – The acquisition of a domain products and services are prohibited unless:
name over the internet in bad faith to profit, (i) There is prior affirmative consent from the
mislead, destroy reputation, and deprive others recipient; or
from registering the same, if such a domain name (ii) The primary intent of the communication is for
is: service and/or administrative announcements from
(i) Similar, identical, or confusingly similar to an the sender to its existing users, subscribers or
existing trademark registered with the appropriate customers; or
government agency at the time of the domain name (iii) The following conditions are present:
registration: (aa) The commercial electronic communication
(ii) Identical or in any way similar with the name of a contains a simple, valid, and reliable way for the
person other than the registrant, in case of a recipient to reject. receipt of further commercial
personal name; and electronic messages (opt-out) from the same
(iii) Acquired without right or with intellectual source;
property interests in it. (bb) The commercial electronic communication
does not purposely disguise the source of the
(b) Computer-related Offenses: electronic message; and
(1) Computer-related Forgery. — (cc) The commercial electronic communication
(i) The input, alteration, or deletion of any computer does not purposely include misleading information
data without right resulting in inauthentic data with
8
in any part of the message in order to induce the with imprisonment one (1) degree lower than that of
recipients to read the message. the prescribed penalty for the offense or a fine of at
least One hundred thousand pesos
(4) Libel. — The unlawful or prohibited acts of libel (PhP100,000.00) but not exceeding Five hundred
as defined in Article 355 of the Revised Penal thousand pesos (PhP500,000.00) or both.
Code, as amended, committed through a computer
system or any other similar means which may be THE DATA PRIVACY ACT (RA 10173):
devised in the future.
What is The Data Privacy Act of the
SEC. 5. Other Offenses. — The following acts Philippines?
shall also constitute an offense: ●​ The Data Privacy Act (DPA), or Republic
Act No. 10173 was passed by the
(a) Aiding or Abetting in the Commission of Philippines Congress in 2012 and finally
Cybercrime. – Any person who willfully abets or implemented five years later in 2016. RA
aids in the commission of any of the offenses 10173 assures the ―free flow of information
enumerated in this Act shall be held liable. to promote innovation and growth‖
(b) Attempt in the Commission of Cybercrime. (Republic Act. No. 10173, Ch. 1, Sec. 2)
— Any person who willfully attempts to commit any while protecting the users‘ fundamental
of the offenses enumerated in this Act shall be held rights to privacy.
liable. How is it implemented?
●​ RA 10173 protects and maintains the right
The following are the punishment for such acts: of customers to confidentiality by setting a
SEC. 8. Penalties. — Any person found guilty of legal list of rules for companies to regulate
any of the punishable acts enumerated in Sections the collection, handling, and disposal of all
4(a) and 4(b) of this Act shall be punished with personal information. Companies legally
imprisonment of prison mayor or a fine of at least responsible for keeping their customers‘
Two hundred thousand pesos (PhP200,000.00) up data protected from third parties or any form
to a maximum amount commensurate to the of misuse, internally or externally.
damage incurred or both. What does that mean for data
collectors/companies?
Any person found guilty of the punishable act under ●​ The Act applies to any process of personal
Section 4(a)(5) shall be punished with data by anyone in government or private
imprisonment of prision mayor or a fine of not sectors.
more than Five hundred thousand pesos ●​ All personal data must have legitimate
(PhP500,000.00) or both. reasons for collection as well as should be
If punishable acts in Section 4(a) are committed clear to both parties giving and receiving
against critical infrastructure, the penalty of information. With that being said, all
reclusion temporal or a fine of at least Five hundred collection must be done with the customer
thousand pesos (PhP500,000.00) up to maximum the customers‘ proper consent.
amount commensurate to the damage incurred ●​ All personal information used must also be
ornboth, shall be imposed. relevant solely used for its intended and
Any person found guilty of any of the punishable state purposes. Companies must protect
acts enumerated in Section 4(c)(1) of this Act shall customer information from collection to
be punished with imprisonment of prison mayor or proper disposal, avoiding access from
a fine of atleast Two hundred thousand pesos unauthorized parties.
(PhP200,000.00) but not exceeding One million
pesos (PhP1,000,000.00) or both. What is “personal information?”
Any person found guilty of any of the punishable ●​ “Personal information” refers to any
acts enumerated in Section 4(c)(2) of this Act shall information, whether recorded in a material
be punished with the penalties as enumerated in form or not, from which the identity of an
Republic Act No. 9775 or the “Anti-Child individual is apparent or can be reasonably
Pornography Act of 2009”: Provided, That the and directly ascertained by the entity
penalty to be imposed shall be one (1) degree holding the information, or when put
higher than that provided for in Republic Act No. together with other information would
9775, if committed through a computer system. directly and certainly identify an individual‖
Any person found guilty of any of the punishable (Republic Act. No. 10173, Ch. 1, Sec. 3)
acts enumerated in Section 4(c)(3) shall be
punished with imprisonment of arresto mayor or a What is “sensitive personal information?”
fine of at least Fifty thousand pesos ●​ (1) About an individual‘s race, ethnic origin,
(PhP50,000.00) but not exceeding Two hundred marital status, age, color, and religious,
fifty thousand pesos (PhP250,000.00) or both. philosophical or political affiliations;
Any person found guilty of any of the punishable ●​ (2) About an individual‘s health, education,
acts enumerated in Section 5 shall be punished genetic or sexual life of a person, or to any
9
 proceeding for any offense committed or by imprisonment up to six years and a fine of not
alleged to have been committed by such less than Five hundred thousand pesos (PHP
person, the disposal of such proceedings, or 500,000).
the sentence of any court in such
proceedings; Sprout Solutions puts data privacy with the utmost
●​ (3) Issued by government agencies peculiar priority and takes advanced measures to maintain
to an individual which includes, but not confidentiality in information handling
limited to, social security numbers, previous
or cm-rent health records, licenses or its FREEDOM OF EXPRESSION
denials, suspension or revocation, and tax Info about china.
returns; and “In 1995, the government of the People's Republic of
●​ (4) Specifically established by an executive China established the country's first Internet service
order or an act of Congress to be kept provider (ISP). They introduce government-controlled
classified.‖(Republic Act. No. 10173, Ch. 1, Internet, often referred to as the "Great Firewall of
Sec. ). China."

What is “consent?” Freedom of Expression - Freedom to express

●​ Consent of the data subject refers to any opinions
freely given, specific, informed indication of 1987 Constitution of the Republic of the
will, whereby the data subject agrees to the Philippines-Article III: BILL OF RIGHTS
collection and processing of personal Section 3. (1) The privacy of communication and
information about and/or relating to him or correspondence shall be inviolable except upon
her. Consent shall be evidenced by written, lawful order of the court, or when public safety or
electronic or recorded means. It may also order requires otherwise, as prescribed by law.
be given on behalf of the data subject by an (2) Any evidence obtained in violation of this or the
agent specifically authorized by the data preceding section shall be inadmissible for any
subject to do so (RA. No. 10173, Ch. 1, purpose in any proceeding.
Sec. 1). Section 4. No law shall be passed abridging the
freedom of speech, of expression, or of the press,
What are the rights of the data subject? or the right of the people peaceably to assemble
and petition the government for redress of
The data subject or the individual sharing his/her grievances.
personal information has to be fully informed of Section 5. No law shall be made respecting an
several factors of the data collecting process. This establishment of religion, or prohibiting the free
list includes, but isn‘t limited to: exercise thereof. The free exercise and enjoyment
(1) the reason for use of religious profession and worship, without
(2) methods for access discrimination or preference, shall forever be
(3) the identity and contact details of the allowed. No religious test shall be required for the
personal information controller exercise of civil or political rights
(4) how long the information will be stored for
(5) access to their rights. Speech that are not protected by Law:
● Obscene Speech - refers to material, content or
What steps do I need to take in compliance with speech that is considered highly offensive,
the Data Privacy Act? particularly in a sexual or prurient context.
● Defamation - when the expressions, whether
Companies essentially have to ensure that their spoken or written, are untrue and cause harm to
data collection methods are flawless as well as another person.
consistently share the entire process with data ❖ An oral defamatory statement is slander,
subjects, including a breach of security. To do this, and a written defamatory statement is libel.
companies should
FREEDOM OF EXPRESSION: KEY ISSUES
1. Appointing a Data Protection Officer ● Internet filtering - for software that can be
2. Conducting a privacy impact assessment installed with a web browser to block access to
3. Creating a privacy knowledge management certain websites containing inappropriate or
program offensive material.
4. Implementing a privacy and data protection ❖ URL filtering – URL or domain name is
policy identified as an objectionable site and the user is
5. Exercising a breach reporting procedure not allowed to access it.
❖ Keyword filtering – uses keywords or phrases
What happens if I do not comply? such as sex, Satan, and gambling to trigger the
blocking website.
Improper/unauthorized processing, handling or ❖ Dynamic filtering – each website’s content is
disposal of personal information can be penalized evaluated immediately before it displayed, using
10
such techniques as object analysis and image they enable hardware and software from
recognition different manufacturers to work together
❖ Submarine Patent - A patent that is
Another filtering system is available through the hidden within a standard and does not
Internet Content Rating Association (ICRA), a surface until the standard is broadly
nonprofit organization whose members include adopted - intentionally delayed by the
Internet industryleaders such as AOL Europe, applicant for a long time.
BellSouth, British Telecom, IBM, Microsoft, and ❖ Patent Farming - A devious patent
Verizon holder might influence a standards
organization to make use of its patented
● Anonymity - Allows people to state their own item without revealing the existence of the
opinions without revealing their identity. patent. Then, later, the patent holder might
❖ Anonymous Remailer - Internet users demand royalties from all parties that use
who want to remain anonymous can send the standard.
email to a service, where a computer ● A trade secret is an "information, including a
program strips the originating address from formula, pattern, compilation, program, device,
the message. method technique, or process, with economic value
❖ In a John Doe lawsuit, the identity of the Employees make the greatest threat to the
defendant is temporarily unknown company's trade secrets, as they might either
● Defamation and Hate Speech accidentally disclose these trade secrets or steal
❖ Speech that is merely annoying, them for monetary gain
critical, demeaning, or offensive enjoys ❖ Because organizations can risk losing
protection under the law trade secrets when key employees leave,
❖ Legal recourse is possible only when they often try to prohibit employees from
hate speech turns into clear threats and revealing secrets by adding nondisclosure
intimidation against specific hate citizens clauses to employment contracts.
● Pornography ❖ Another option for preserving trade
❖ Many believe that nothing is illegal or secrets is to have an experienced member
wrong about purchasing adult pornographic of the Human Resources Department
material conduct an exit interview with each
❖ On the other hand, most parents, departing employee.
educators, and other child advocates are ❖ A key step in the interview is to review a
deeply concerned about viewing checklist that deals with confidentiality
pornography and its impact on children, also issues. At the end of the interview, the
fearing about increasingly easy access to departing employee is asked to sign an
pornography encourages pedophiles and acknowledgment of responsibility not to
sexual molesters divulge any trade secrets.
❖ Employees can also use noncompete
INTELLECTUAL PROPERTY - is a term agreements to protect intellectual property
used to describe works of the mind, such as art, from being used by competitors when key
books, films, formulas, inventions, music, and employees leave. Such agreements require
processes, that are distinct and "owned" or created employees not to work for any competitors
by a single person or group. for a period of time, perhaps one to two
● A copyright grants the creators of "original l years.
works of authorship in any tangible medium of
expression The copyright in works shall be INTELLECTUAL PROPERTY: KEY TERMS
protected during the life of the author and for fifty ● Plagiarism is the theft and passing off of
(50 years after his death. This rule also applies to someone's ideas or words as one's own.
posthumous (after death) works. ● Reverse engineering is the process of taking
● A patent is a grant of a property right to something apart in order to understand it, build a
inventors. copy of it, or improve it.
❖ Prior art is the existing body of ● Open source code refers to any program whose
knowledge that is available to a person of source code is made available for use or
ordinary skill in the art. (determining the modification as users or other developers see fit.
patentability of an invention) ● Competitive intelligence is the gathering of
❖ A standard is a definition or format that legally obtainable information to help a company
has been approved by a recognized gain an advantage over its rivals; different from
standards organization or is accepted as a industrial espionage. It requires continual gathering,
de facto standard by the industry. Standards analysis, and evaluation of data with controlled
exist for programming languages, operating dissemination of the useful information to decision
systems, data formats, communications makers. industrial espionageI is a serious crime
protocols, and electrical interfaces. that carries heavy penalties.
Standards are extremely useful because ● Cybersquatting
11
❖ A trademark is anything that enables a
consumer to differentiate one company's products
from another's. A trademark may be a logo,
package design, phrase, sound, or word.
Consumers often cannot examine goods or
services to determine their quality or source, so
instead they rely on the labels attached to the
products.
❖ Trademark law gives the trademark's owner the
right to prevent others from using the same mark or
a confusingly similar mark. Trademark protection
lasts as long as a mark is in use.
❖ Companies that want to establish an Internet
presence know that the best way to capitalize on
the strength of their brand names is to make the
names part of the domain names for their Web
sites.
❖ Cybersquatters registered domain names for
famous trademarks company names to which they
had no connection, with the hope that the
trademark‟s owner would buy the domain name for
a large sum of money

12