Cyber Harassment, Illegal Surveillance, and Wiretapping in the Philippines: How to File a Case

This is practical legal information for the Philippines. It isn’t a substitute for specific advice from a lawyer.

1) The Big Picture

“Cyber harassment” covers a range of online misdeeds—threats, impersonation, doxxing, non-consensual sharing of images, abusive posts, etc. “Illegal surveillance” and “wiretapping” cover secret recording or interception of private communications. Depending on facts, multiple laws can apply at the same time (criminal, civil, and administrative), and you can pursue parallel remedies.

2) Laws You Should Know (Philippine Context)

Cybercrime Prevention Act of 2012 (R.A. 10175). Creates “computer-related” crimes; makes penalties one degree higher when traditional crimes (e.g., libel, threats, fraud) are committed through a computer system. Creates special cybercrime courts and authorizes preservation/disclosure/interception by court order. Also provides broad rules on venue/jurisdiction—courts may take cases where any element occurred, or where any device, system, or data is located.
Anti-Wiretapping Act (R.A. 4200). All-party consent. It is generally illegal to secretly record a private conversation or communication without the consent of all parties, or to use/possess such recordings. Evidence obtained in violation is inadmissible. (Court-authorized surveillance in narrowly defined situations is the exception.)
Data Privacy Act of 2012 (R.A. 10173). Protects personal data. Unauthorized collection, use, or disclosure may be a criminal offense and/or an administrative violation. You can complain to the National Privacy Commission (NPC) for takedown/compliance orders and other relief.
Safe Spaces Act (R.A. 11313, “Bawal Bastos”). Penalizes gender-based online sexual harassment (e.g., unwanted sexual comments, threats, unwanted sexual advances, sharing of intimate images). Platforms and employers/schools have duties to act on reports.
Anti-Photo and Video Voyeurism Act (R.A. 9995). Criminalizes recording and sharing of intimate images without consent, even if the sexual act itself was consensual.
Anti-Violence Against Women and Their Children (R.A. 9262). Covers electronic harassment/stalking by a spouse/partner/ex. Lets victims ask courts for Protection Orders (EPO/TPO/PPO), including “no contact” directives and orders to take down content.
Anti-Bullying Act (R.A. 10627). Requires schools to address cyberbullying involving K–12 students.
Other potentially relevant laws: Revised Penal Code (grave threats, grave coercion, unjust vexation, identity theft/fraud through falsification), Anti-Child Pornography Act (R.A. 9775), Anti-OSAEC & Anti-CSAEM Act (R.A. 11930), SIM Registration Act (R.A. 11934) for account/number traceability, and special rules on Cybercrime Warrants (Supreme Court Rules, 2018) for preservation, search/seizure of computer data, interception, and restricting or disabling access—by court order.

3) What Conduct Typically Fits

Cyber harassment (examples): Threats (to person/property), stalking, doxxing, identity theft/impersonation, mass harassment/brigading, defamation (cyber libel), non-consensual dissemination of intimate images, revenge porn, deepfakes causing harm, repeated unwanted sexual advances/messages, extortion (“sextortion”), hacking/credential theft, online fraud/scams that include harassing acts.
Illegal surveillance/wiretapping (examples): Secretly recording private voice calls or in-person conversations without all-party consent; placing a device to intercept calls/chats; secretly activating a device’s mic; sharing/using those recordings. Important: Video without audio of public activities is generally treated differently from recording spoken words; what matters is whether there was a reasonable expectation of privacy and whether audio or private communication was captured.

4) Immediate Safety & Preservation Checklist

Safety first. If there are credible threats to life or imminent harm, call emergency services (911) or go to the nearest police station/barangay.
Preserve evidence—do not alter it.
- Take full-screen screenshots showing URLs, handles, timestamps, post IDs.
- Export chats (Messenger/WhatsApp/Viber/Telegram), keep devices, save emails (.eml), and download account data where possible.
- For websites, capture page source or create a hash (if you have help) to show integrity.
- Keep a timeline: dates, times, links, numbers used, and witnesses.
- Do not make your own secret audio recordings of private conversations—this can violate R.A. 4200.
Report to platforms (Facebook, X, TikTok, etc.). Use in-app reporting; request removal and data preservation (say you may pursue legal action).
Secure accounts. Change passwords, enable 2FA, check login activity, and notify contacts if impersonation is occurring.

5) Where to Report or File (Criminal Path)

You can pursue criminal complaints through either national investigative agencies or directly with prosecutors:

PNP Anti-Cybercrime Group (PNP-ACG). Accepts walk-in and online complaints; can investigate, apply for cybercrime warrants, and coordinate with telcos/platforms.
NBI Cybercrime Division. Similar functions; useful for complex or multi-jurisdictional cases.
Office of the City/Provincial Prosecutor. You can directly file a criminal complaint-affidavit with annexes (evidence). The prosecutor can refer to police/NBI for further investigation.

Barangay conciliation? Most cyber offenses fall outside mandatory barangay conciliation (because penalties exceed one year and/or the parties don’t live in the same city/municipality). Your prosecutor or lawyer can confirm.

6) How to File a Criminal Case — Step by Step

Prepare a Complaint-Affidavit.
- Narrative (who/what/when/where/how).
- Cite likely offenses (you can list several in the alternative).
- Attach evidence: screenshots, chat exports, headers/logs, platform responses.
- Include your government ID and contact details. Have it notarized or sworn before the prosecutor.
File with PNP-ACG/NBI or directly with the Prosecutor.
- If filing with police/NBI: they’ll take your sworn statement, docket the case, and start investigative work (subpoenas, requests to platforms/telcos, applications for Preservation/Disclosure/Interception/Search warrants from a cybercrime court).
- If filing with the Prosecutor: they issue a subpoena to the respondent for counter-affidavit.
Prosecutor’s Resolution.
- After affidavits/rebuttals, the prosecutor finds probable cause (or dismisses).
- If found, an Information is filed in the proper court (often a designated cybercrime court).
Court Proceedings.
- Warrant of arrest (unless the offense allows summons).
- Arraignment, pre-trial, trial. You and witnesses may testify; digital evidence must be authenticated (see Section 8 below).
- Judgment; restitution or damages may be awarded in the criminal case if claimed.

Typical timelines & costs: Filing a criminal complaint is free; you’ll spend for notarization, copies, and (optionally) private counsel. Timelines vary widely.

7) Administrative Paths (Often Faster for Takedown/Compliance)

National Privacy Commission (NPC) complaint (Data Privacy Act). For unauthorized collection/use/disclosure (e.g., doxxing, leaks of your PI, intrusive monitoring). NPC can order cease-and-desist, erasure, and compliance actions; it may recommend criminal prosecution.
School or Workplace processes.
- Students: Anti-Bullying policies (R.A. 10627) and Safe Spaces rules require investigation and sanctions for cyberbullying/GBOSH.
- Workers: Employers must address online sexual harassment under R.A. 11313; file with HR/Committee on Decorum and Investigation.
Regulators/others:
- NTC/telcos for SIM/account issues (SIM Registration Act).
- Platforms (community standards) for rapid content removal and account restrictions.

These can run in parallel with criminal or civil actions.

8) Civil Action (Damages & Injunctions)

File a civil case for damages (Civil Code Arts. 19, 20, 21) and injunctive relief (Rule 58) to stop continuing harm (e.g., restrain further posting/harassment, compel takedown). You may also claim moral, exemplary, and actual damages, plus attorney’s fees. Civil and criminal cases can be joined or run separately.

9) Evidence: Making Digital Proof Court-Ready

Rule on Electronic Evidence (REE). Electronic documents, logs, emails, and texts are admissible if authenticated: testimony of a competent witness about how they were created/kept; metadata; or certificates from custodians (e.g., telco/platform). Integrity can be shown by hashes, chain of custody, or system descriptions.
Chats & social media: Provide exports and screenshots that show account names/IDs, timestamps, and URLs. Get platform certifications when possible.
Telco records: Investigators typically obtain these by court order (disclosure order/warrant). Private persons generally cannot.
Recordings: Do not secretly record private conversations to “get evidence”—this can violate R.A. 4200 and get excluded. Lawful recordings (e.g., public events with no expectation of privacy; or recordings with all parties’ consent) can be admissible.

10) Venue, Jurisdiction, and Cross-Border Issues

Cybercrime venue/jurisdiction is flexible. Filing may be proper where: (a) the post was uploaded, (b) it was accessed/seen, (c) the victim resides, or (d) any computer system/data relevant to the offense is located.
Extraterritoriality. If the offender is abroad or platforms hold data overseas, authorities use mutual legal assistance and international cybercrime cooperation channels. Parallel platform reporting is crucial for fast action.

11) Prescriptive (Time-Bar) Considerations

Traditional libel under the Revised Penal Code prescribes in 1 year from publication.
Cyber libel (libel via computer system) has been treated by prosecutors/courts as subject to a longer prescription under the special-law rules (Act No. 3326), not the one-year rule for traditional libel. Because jurisprudence evolves, get current advice quickly—don’t delay filing.

For most other cyber offenses, general rules under special laws apply (often longer than one year). When in doubt, file early.

12) Special Scenarios

Non-consensual intimate images (“revenge porn”): R.A. 9995 and R.A. 11313. Seek urgent injunctive relief and platform takedowns; consider Protection Orders if the harasser is/was an intimate partner (R.A. 9262).
Sextortion / doxxing: Possible crimes include grave coercion, threats, computer-related identity theft, and Data Privacy violations. Preserve payment trails, crypto addresses, and IP-linked logs (investigators can subpoena/seek warrants).
Minors as victims: R.A. 9775 and R.A. 11930 apply; never store or forward child sexual abuse material. Go straight to PNP-ACG/NBI and the DSWD. Schools must act under R.A. 10627.
Workplace harassment: Use the company’s Safe Spaces mechanisms; employers can be liable for inaction.
Stalking by ex-partner: R.A. 9262 permits EPO/TPO/PPO with “no contact,” device/online restrictions, and orders covering electronic harassment.

13) Defenses You’ll Hear (and How They’re Met)

“It’s free speech.” Speech that is defamatory, threatening, harassing, or sexually abusive is not protected. Truth is a defense to libel but malice, privacy, and harassment statutes still matter.
“No intent.” Many offenses require only commission, not specific malice (e.g., unauthorized disclosure under privacy/voyeurs laws).
“Public place recording.” Wiretapping targets private communications; recordings at public events without audio of private talk are treated differently.

14) Practical Playbook (Step-by-Step)

A. In the next 24–48 hours

Lock down accounts; enable 2FA; alert contacts.
Capture evidence (screens, exports, device imaging if possible).
Send platform reports + preservation requests (mention you may take legal action).
If there’s an intimate partner angle or credible threats: seek a Protection Order (ex parte EPO/TPO may be granted quickly).
Choose venue (police/NBI vs prosecutor) and prepare your Complaint-Affidavit.

B. In the next 1–2 weeks

File your criminal complaint (and optional civil suit for injunction/damages).
Consider an NPC complaint if data privacy was violated.
Follow up with investigators about cybercrime warrants for data preservation/disclosure.
Keep a case file: all reports, ticket numbers, reference IDs, and a running log of incidents.

C. Ongoing

Monitor for retaliation; update evidence log.
Work with counsel on negotiations, court-ordered takedowns, or settlements if appropriate.

15) Templates You Can Re-use

Complaint-Affidavit (outline)

Your name/ID/address and capacity (victim or guardian).
Clear, dated timeline of acts with links, handles, screenshots (Annex “A,” “B,” …).
Identification of respondents (or “John/Jane Does” with identifying details available).
Alleged offenses in the alternative (e.g., R.A. 10175 [computer-related offenses/cyber libel], R.A. 11313 [online sexual harassment], R.A. 9995 [voyeurism], R.A. 10173 [privacy], R.A. 4200 [if applicable], RPC offenses).
Prayer (issuance of subpoenas; application for preservation/disclosure/interception/search warrants; filing of Information; arrest; protection orders; restitution/damages).
Verification and jurat (notarization or sworn before prosecutor).

Platform Preservation/Takedown Request (short form)

Identify the violating content (URLs, post IDs, date/time, handle).
State laws implicated (privacy/harassment/voyeurism/etc.).
Request expeditious removal and preservation of logs and subscriber data pending legal process.
Provide your contact and a warning that non-compliance may result in regulatory complaint.

16) Evidence Do’s and Don’ts (Quick)

DO keep original devices and make forensic copies when possible.
DO capture context (thread views, profile pages, timestamps).
DON’T edit/crop critical areas; keep raw copies alongside redacted ones for sharing.
DON’T secretly record private conversations—ask for consent or seek law-enforcement help.

17) When to Get a Lawyer

If you need a Protection Order, a TRO/injunction, or you’re weighing both criminal and civil routes.
If the suspect is abroad, you’ll need help with MLAT/international cooperation.
If the case involves complex forensics (device imaging, log correlation, blockchain tracing).

18) FAQs

Q: Can I file even if I don’t know the harasser’s real name? Yes. Name them as John/Jane Doe and provide handles, numbers, URLs, and any identifiers. Investigators can seek subscriber data/logs by court order.

Q: The post was deleted. Is my case dead? No. If you preserved screenshots/links quickly, investigators can still request server logs/backups. File ASAP and ask them to seek Preservation/Disclosure Orders.

Q: Can I record our call to catch them? Not without all-party consent if it’s a private conversation. That could violate R.A. 4200. Work with investigators instead.

Q: Do I need barangay conciliation? Usually no for these offenses, but ask the prosecutor.

19) Final Notes & Cautions

Digital-evidence rules, prescriptive periods (especially for cyber libel), and venue doctrines have changed over time and may evolve. Move quickly and consult counsel to lock in the correct forum and timing.
You can (and often should) run platform, administrative, civil, and criminal avenues in parallel.

If you want, I can turn this into a fill-in-the-blanks Complaint-Affidavit plus platform preservation letter you can download and reuse.