I. Why the Forum of First Resort Matters

Where and how you first report a cybercrime shapes what evidence is preserved, who acquires specialized warrants, and how fast the case moves from investigation to prosecution. In the Philippines, complainants typically choose between (1) Local Police Stations (City/Municipal), and (2) the Philippine National Police – Anti-Cybercrime Group (PNP-ACG). You may also proceed to the National Bureau of Investigation – Cybercrime Division (NBI-CCD); this guide focuses on local police vs. ACG.

II. Governing Statutes and Rules (Core)

R.A. 10175 – Cybercrime Prevention Act of 2012, and its IRR. Offenses include illegal access, illegal interception, data interference, system interference, misuse of devices, cyber-squatting, computer-related fraud and forgery, and content offenses (e.g., cyber-libel) and cybersex; plus online child exploitation (cross-referenced with R.A. 9775 and R.A. 7610).
R.A. 9995 – Anti-Photo and Video Voyeurism Act (often enforced for non-consensual intimate content).
R.A. 8484 – Access Devices Regulation Act (carding/OTP SIM-swap schemes).
R.A. 8792 – E-Commerce Act (e-evidence admissibility; ICT offenses overlap).
R.A. 10173 – Data Privacy Act (breach, unauthorized processing; separate administrative track with the NPC but factually intertwined with cybercrime).
R.A. 4200 – Anti-Wiretapping Act (voice call recordings generally prohibited without court order; implications for complainants who intend to “record evidence”).
R.A. 9775 – Anti-Child Pornography Act, and R.A. 11930 – Anti-OSAEC (online sexual abuse/exploitation of children).
SC A.M. No. 17-11-03-SC – Rule on Cybercrime Warrants (specialized warrants and procedures).
Revised Rules on Evidence & Rule on Electronic Evidence (authentication of e-evidence).
Revised Penal Code (estafa, threats, unjust vexation, etc., when committed via ICT).

III. Agencies: Mandates and Capabilities

A. Local Police (City/Municipal Stations)

Mandate: Take criminal complaints “of any kind,” create a police blotter, conduct initial investigation, preserve evidence, and endorse to specialized units or the City/Provincial/Regional CIDU/ACG as needed.
Strengths:
- Immediate physical response and coordination (e.g., ongoing extortion meet-ups, on-site harassment, device seizure incident to lawful arrest).
- Familiarity with local terrain and witnesses; can secure CCTV, barangay logs, and local ISP kiosk footage quickly.
Limitations:
- May lack in-house digital forensics and cyber-warrant drafting expertise; often must endorse to ACG/NBI for specialized actions.

B. PNP–Anti-Cybercrime Group (ACG)

Mandate: National operational lead for cybercrime; specialized digital forensics, cyber-threat intelligence, covert online operations, and industry liaison (ISPs, platforms, banks, e-wallets).
Strengths:
- Drafting and execution of cybercrime warrants; expeditious preservation letters; MLAT/foreign liaison (through DOJ–OIA/NCB-Interpol channels).
- Labs for forensic imaging, log analysis, cryptocurrency tracing, SIM/IMEI analysis, OSINT, server-side evidence coordination.
Limitations:
- High case volume and triage thresholds. Complex, trans-border, or high-impact cases are prioritized; purely local misdemeanors with no digital trail may be returned to local stations.

Practical rule: You may start with either. If you begin at a local station, request endorsement to ACG when specialized e-evidence actions are needed.

IV. Venue, Jurisdiction, and Prosecutorial Path

Jurisdiction: Regional Trial Courts (RTCs) designated as Special Cybercrime Courts handle cybercrime cases. Municipal trial courts handle certain related offenses depending on penalty.
Venue: Where any element of the offense occurred; additionally, for ICT-facilitated crimes, venue may lie where the offended party resides or where the computer system/data was accessed, subject to prevailing jurisprudence and rules on continuing crimes.
Prosecutorial route:
- Inquest for warrantless arrests (rare in cyber unless caught in flagrante).
- Regular filing via Complaint-Affidavit with attachments; prosecutor issues subpoena for counter-affidavits; case is resolved for filing of Information or dismissal.
No barangay conciliation prerequisite for criminal cyber offenses; Katarungang Pambarangay generally does not apply to offenses punishable by more than one year of imprisonment or those requiring immediate police action.

V. Cybercrime Warrants and Compulsory Processes

Under the Rule on Cybercrime Warrants, law enforcement (ACG/NBI; occasionally local investigators with ACG guidance) obtain:

Warrant to Disclose Computer Data (WDCD) – compels service providers/platforms to disclose subscriber info, traffic and relevant content data specified in the warrant.
Warrant to Search, Seize, and Examine Computer Data (WSSECD) – authorizes on-site imaging/seizure and forensic examination of devices/systems.
Warrant to Intercept Computer Data (WICD) – permits real-time interception/collection of traffic/content data (akin to wiretap authority, strictly circumscribed).
Expedited Preservation Orders – immediate preservation of specified computer data.
Chain-of-Custody Protocols – hashing, imaging, and documentation required for admissibility.

Why ACG is often preferred: Familiarity with drafting, scope minimization, and technical annexes (hash plans, keyword sets, selectors), plus established liaison pipelines with platforms and telcos.

VI. What to File and Where: Decision Framework

Start with Local Police if:

There is an immediate threat to life/safety (stalking, doxxing leading to in-person harassment, live extortion meet-ups).
You need urgent local scene processing (CCTV, witnesses, physical items).
The suspect is a known local and likely reachable by local patrols.

Go directly to ACG if:

The incident involves account takeovers, phishing rings, SIM-swap, carding, malware/ransomware, BEC (business email compromise), or crypto tracing.
You require platform/telco disclosure and log correlation.
The actors are trans-provincial/international, using mules, VPNs/TOR, or complex laundering chains.
Evidence is primarily digital and time-sensitive (tokens/logs with short retention).

Hybrid path: File at local station for the blotter and immediate measures, then seek endorsement to ACG for warrants/forensics. You can also file directly with the Prosecutor after evidence consolidation led by ACG.

VII. Elements, Evidence, and Admissibility

A. Complaint-Affidavit Core

Narrative of facts with dates/times, platform handles/URLs, device identifiers, phone numbers, email addresses, and amounts lost.
Offense mapping (e.g., illegal access + computer-related fraud; or anti-voyeurism + RA 10175 “by means of ICT”).
Prayer for investigation, preservation, and appropriate warrants.

B. Digital Evidence Checklist

Original devices (phone/computer) and untampered data; avoid altering apps after incident.
Screenshots with visible URL, timestamp, and handle; export chat logs (platform export tools); email headers; call logs; wallet addresses and transaction hashes; bank/fintech statements; delivery receipts; CCTV extracts.
Subscriber/transaction records from telcos, banks, e-wallets (often obtained via WDCD/subpoena/warrant; bring your own statements as leads).
Hashing and Imaging are performed by ACG/NBI; local police preserve chain-of-custody until turnover.

C. Authentication & Best Practices

Keep metadata (don’t re-scan screenshots through messaging apps that strip EXIF).
Document who collected what, when, where (simple evidence log).
Use read-only media for copies; never “forward” only—export and save originals.

VIII. Lawful and Unlawful Self-Help (Important Boundaries)

Do not record voice calls without a court-authorized interception order; R.A. 4200 is strict.
Do not hack back, brute-force, or “track” a suspect by unauthorized access—this exposes you to counter-liability.
Do preserve digital traces, cease further victimization (change passwords, enable MFA), and consult investigators before engaging the suspect further.

IX. Special Offense Notes

Online Fraud/Scams (estafa via ICT; ADRA overlaps):
- Expect multi-jurisdictional footprints, money mules, and quick cash-outs.
- ACG typically leads: platform takedowns, freeze requests (through AMLC coordination), and blockchain triage if crypto is involved.
Cyber-Libel:
- Content offense with ICT qualifier; venue and defenses follow libel jurisprudence.
- Evidence focus: publication, identifiability, malice; preserve posts before deletion.
Non-Consensual Intimate Content (R.A. 9995; OSAEC if minor):
- Immediate preservation and swift takedown coordination; child-related cases are non-bailable in higher degrees and prioritized.
Illegal Access / Account Takeover:
- Pair with computer-related fraud if loss occurred; seek WDCD/WSSECD swiftly for IP logs, login telemetry, device fingerprints.
Threats, Stalking, Harassment:
- Chargeable under RPC threats and special laws (e.g., R.A. 9262 if intimate partner violence), with ICT qualifier; local police for safety, ACG for digital trace-back.

X. Interaction with Parallel Regulators/Lanes

National Privacy Commission (NPC): For data privacy violations/breaches (administrative), often parallel with criminal inquiry.
AMLC/BSP: For freeze/monitor of suspicious financial flows linked to cyber-fraud.
DOJ-OIA/MLAT: Cross-border data and suspects; ACG coordinates channel.

XI. Timelines and Data Retention Realities

Preservation (R.A. 10175, Sec. 13): Service providers must preserve traffic/content data for at least 6 months, extendable. Act quickly; some platform logs expire within days.
ER for Warrants: Cyber warrants are time-bound and specific; extensions require renewed showing of necessity.
Prosecution: Affidavit/counter-affidavit cycle typically runs weeks to months; complex e-evidence can protract evaluation.

XII. Civil and Protective Remedies

Civil damages under the Civil Code for tortious acts via ICT.
Protection Orders (e.g., R.A. 9262 for online intimate partner abuse; child protection orders for minors).
Notice-and-takedown against platforms per terms of service; preserve correspondence as evidence.

XIII. Step-by-Step Playbooks

A. Rapid Response (any offense)

Secure accounts: change passwords, enable MFA, revoke sessions.
Preserve evidence: screenshots with timestamps/URLs; export chats; save headers/logs; keep devices powered but idle.
File immediately at Local Police (for blotter and physical risks) or ACG (for digital triage).
Request preservation letters and endorsement to ACG if you began locally.
Prepare a Complaint-Affidavit with annexes for the prosecutor.

B. Financial Cyber-Fraud (e-wallet/bank/crypto)

File at ACG; bring transaction IDs, wallet addresses, and statements.
Seek freeze/hold coordination (AMLC/BSP channels, bank/fintech recovery desks).
Expect WDCD to unmask subscriber data and WSSECD for devices when identified.

C. Intimate Image Abuse / OSAEC indicators

Prioritize victim safety and mental health referral.
ACG for swift takedown and forensic preservation; NPC complaint if privacy breach; alert ICAB / DSWD if a minor is involved.
Prepare for in-camera handling of sensitive materials; follow chain-of-custody.

XIV. Choosing the Forum: Comparative Snapshot

Factor	Local Police Station	PNP–ACG
Access/Speed	Easiest walk-in; immediate blotter	Regional/National offices; may require appointment/online intake
On-scene response	Strong (patrol, CCTV pulls)	Coordinates when needed; not neighborhood-patrol centric
Cyber warrants	Usually endorses to ACG	Primary drafter/executor (WDCD/WICD/WSSECD)
Forensics	Limited tools	Dedicated labs, imaging, log analysis
Platform/telco liaison	Through unit/endorsement	Direct channels, faster preservation/disclosure
Complex, cross-border cases	Endorse upward	Core mandate

Bottom line: Start where urgency and expertise best align. You can file in one and escalate to the other without losing momentum.

XV. Common Pitfalls

Delayed reporting causing log expiry.
Relying on illegally obtained audio recordings (R.A. 4200 risk).
Altering devices (updates/deletions) before forensic imaging.
Using screenshots without context (no URL, no handle, no timestamp).
Ignoring civil/regulatory remedies that can freeze assets or remove content while the criminal case matures.

XVI. Minimum Documents to Bring

Government ID; proof of residence.
Chronology of events with dates/times.
Evidence set: device(s), exported chats, emails (with headers), transaction records, platform tickets, bank/fintech letters.
If applicable: birth/marriage certificates (identity linkage), corporate authority (for BEC), guardianship papers (for minors).

XVII. Ethical and Safety Considerations

Protect minors’ identities in filings; request confidential handling of intimate materials.
Avoid public posting of evidence that doxes yourself/others.
Coordinate controlled communications with suspects only under investigator guidance (to prevent entrapment errors).

XVIII. Quick Reference: Who Does What

Local Police: Blotter, immediate protection, local evidence capture, initial subpoenas, endorsement.
PNP–ACG: Cyber warrants, forensics, platform/telco liaison, national/international coordination, complex case management.
Prosecutor: Probable cause determination and filing of Information.
Courts (Cybercrime-designated RTCs): Warrant issuance, trial, judgments.
NPC/AMLC/Regulators: Parallel administrative/financial relief.

XIX. Actionable Summary

Report immediately—local police for urgent safety and locality-bound evidence; ACG for digital-heavy or cross-border cases.
Preserve first, then analyze—do not alter devices; collect logs, headers, full-context screenshots.
Leverage cyber warrants through ACG to reach platforms/telcos and secure volatile data.
Run parallel tracks: criminal case with prosecutor, regulatory takedowns, and financial recovery where possible.
Mind legal limits (no illegal recordings/hack-backs) and keep a clean chain-of-custody to protect admissibility.