A Warrant to Search, Seize and Examine Computer Data (WSSECD) is an order in writing issued in the name of the People of the Philippines, signed by a judge, upon application of law enforcement authorities, authorizing the latter to search the particular place for items to be seized and/or examined. This is provided under the Rule on Cybercrime Warrants issued by the Supreme Court pursuant to the Cybercrime Prevention Act of 2012 (Republic Act No. 10175).
CONTENTS OF APPLICATION
The verified application for a WSSECD, as well as the supporting affidavits, shall state the following essential facts:
- 1. The probable offense involved;
- 2. Relevance and necessity of the computer data sought to be searched, seized, and examined, and all other items related thereto, for the purpose of the investigation;
- 3. Names of the individuals or entities whose computer data is to be searched, seized, and examined, and all other items related thereto, including the names of the individuals or entities who have control, possession or access thereto, if available;
- 4. Particular description of the computer data sought to be searched, seized, and examined, and all other items related thereto;
- 5. Place where the search, seizure and examination of computer data, and all other items related thereto, is to be enforced, if available;
- 6. Manner or method by which the search, seizure and examination of computer data, and all other items related thereto, is to be carried out, if available; and
- 7. Other relevant information that will persuade the court that there is a probable cause to issue a WSSECD; and
In addition, the application shall contain an explanation of the search and seizure strategy to be implemented, including a projection of whether or not an off-site or on-site search will be conducted, taking into account the nature of the computer data involved, the computer or computer system’s security features, and/or other relevant circumstances, if such information is available.
ISSUANCE AND FORM OF WSSECD
If the judge is satisfied that there is probable cause to believe that the facts upon which the application for WSSECD exists, he shall issue the WSSECD, which must be substantially in the form prescribed under the Rule on Cybercrime Warrants.
OFF-SITE/ON-SITE PRINCIPLE; RETURN OF ITEMS SEIZED OFF-SITE
Law enforcement authorities shall, if the circumstances so allow, endeavor to first make a forensic image of the computer data on-site as well as limit their search to the place specified in the warrant. Otherwise, an off-site search may be conducted, provided that a forensic image is, nevertheless, made, and that the reasons for the said search are stated in the initial return.
A person whose computer devices or computer system have been searched and seized off-site may, upon motion, seek the return of the said items from the court issuing the WSSECD, provided that a forensic image of the computer data subject of the WSSECD has already been made. The court may grant the motion upon its determination that no lawful ground exists to otherwise withhold the return of such items to him.
ALLOWABLE ACTIVITIES DURING IMPLEMENTATION
The interception of communications and computer data may be conducted during the implementation of the WSSECD. However, the interception activities shall only be limited to communications and computer data that are reasonably related to the subject matter of the WSSECD; and that the said activities are fully disclosed, and the foregoing relation duly explained in the initial return.
Likewise, law enforcement authorities may order any person, who has knowledge about the functioning of the computer system and the measures to protect and preserve the computer data therein, to provide, as is reasonable, the necessary information to enable the undertaking of the search, seizure and examination.
INITIAL RETURN
Within 10 days from the issuance of the WSSECD, the authorized law enforcement officers shall submit an initial return that contains the following information:
- 1. A list of all the items that were seized, with a detailed identification of: (a) the devices of the computer system seized, including the name, make, brand, serial numbers, or any other mode of identification, if available; and (b) the hash value of the computer data and/or the seized computer device or computer system containing such data;
- 2. A statement on whether a forensic image of the computer data was made on-site, and if not, the reasons for making the forensic image off-site;
- 3. A statement on whether the search was conducted on-site, and if not, the reasons for conducting the search and seizure off-site;
- 4. A statement on whether interception was conducted during the implementation of the WSSECD, together with (a) a detailed identification of all the interception activities that were conducted; (b) the hash value/s of the communications or computer data intercepted; and (c) an explanation of the said items’ reasonable relation to the computer data subject of the WSSECD;
- 5. List of all the actions taken to enforce the WSSECD, from the time the law enforcement officers reached the place to be seized until they left the premises with the seized items and reached the place where the items seized were stored and secured for examination; and
- 6. A reasonable estimation of how long the examination of the items seized will be concluded and the justification therefor.
It is the duty of the issuing judge to ascertain if the initial return has been made, and if none, to summon the law enforcement authority to whom the WSSECD was issued and require him to explain why no initial return was made, without prejudice to any action for contempt.
PERIOD TO EXAMINE AND ORDER TO RETURN
After the initial return is submitted to the court pursuant to the WSSECD, the court shall issue an order fixing the period to conclude the examination of all the items seized, which period may be extended not exceeding 30 days, upon motion, for justifiable reasons.
FINAL RETURN ON WSSED
Within 48 hours after the expiration of the period to examine as provided under Section 6.7 of this Rule, the authorized law enforcement officers shall submit a final return on the WSSECD to the court that issued it, and simultaneously turn-over the custody of the seized computer data, as well as all other items seized and/or the communications or computer data intercepted in relation thereto. [See Custody of Computer Data]
It is the duty of the issuing judge to ascertain if the final return has been made, and if none, to summon the law enforcement officer to whom the WSSECD was issued and require him to explain why no final return was made, without prejudice to any action for contempt.
- Extension of Filing Periods and Suspension of Hearings for March 29 to April 4, 2021: SC Administrative Circular No. 14-2021 (Full Text) - March 28, 2021
- ECQ Bubble for NCR, Bulacan, Cavite, Laguna and Rizal: Resolution No. 106-A (Full Text) - March 27, 2021
- Guidelines on the Administration of COVID-19 Vaccines in the Workplaces (Labor Advisory No. 3) - March 12, 2021