Grave Threats, Cyber Libel, Related Offenses, and How to Preserve Evidence

This article is for general information in the Philippine context and is not a substitute for legal advice on a specific case.

1) What counts as “online threats” and “public shaming”

In practice, complaints usually involve one or more of these patterns:

Threats of harm: “Papapatayin kita,” “I’ll break your face,” threats to burn property, doxxing with implied harm, etc.
Threats tied to demands: “Pay me or I’ll release your nudes / post your secrets.”
Public shaming / humiliation: viral posts calling you a thief/cheater/scammer; edited photos; humiliating captions; mass-tagging your employer/family; group chats created to ridicule you.
Doxxing: posting your address, phone, workplace, children’s school, IDs, or other identifying information to invite harassment.
Sexualized harassment: lewd comments, threats of rape, “rate my body,” unwanted sexual messages, or sharing intimate images.

These aren’t “just online drama.” Depending on the exact words, intent, and context, they can be criminal, civil, or both.

2) The main criminal cases people file

A. Grave Threats (Revised Penal Code)

Core idea: A person threatens another with a wrong amounting to a crime (commonly: killing, serious physical harm, arson, etc.).

Key points that matter in real cases

A threat can be written, spoken, messaged, or posted.
It can be direct (“I will kill you”) or implied (“Alam ko address mo…”) depending on context.
Threats sometimes fall under:
- Grave threats (serious threats)
- Light threats / other threats (less severe or context-specific)
- Coercion / unjust vexation (light coercions) when the conduct is harassing or forces you to do/stop doing something but doesn’t neatly fit “threats.”

What prosecutors look for

The exact language, emojis included
Whether it’s credible (history of violence, proximity, ability, prior stalking)
Repetition and escalation
Whether it was conditional (“If you don’t… then I will…”)

Where online matters: The fact that it’s online does not remove criminal liability; it often increases reach and harm.

B. Cyber Libel (RA 10175 in relation to RPC Libel)

Core idea: Defamation (libel) committed through a computer system (social media posts, blogs, online articles, etc.).

Libel basics (what must generally be shown)

Defamatory imputation – accusing someone of a discreditable act/condition/status (e.g., “scammer,” “adulterer,” “drug addict,” “thief,” “magnanakaw,” “pedophile”), or ridicule that harms reputation.
Publication – communicated to at least one other person (a post visible to others; a group chat can qualify).
Identifiable victim – named directly or identifiable by context (photos, workplace, tagging, “yung anak ni…”).
Malice – generally presumed in defamatory imputations, subject to defenses/privileges.

Cyber libel vs. ordinary libel

“Cyber” typically means the defamatory content is posted/transmitted online through a computer system.
Cyber libel is commonly treated as carrying a higher penalty than ordinary libel.

Important practical limits people miss

Truth alone is not always an absolute defense; traditionally, truth must be coupled with good motives and justifiable ends in many situations.
Opinion vs. assertion of fact matters. “In my view, the service was terrible” is different from “She stole money.”
Privileged communications can apply (e.g., certain fair reports, fair comment on matters of public interest), but the boundaries are fact-specific.
“Sharing” and “reposting” can still create exposure depending on how it’s done (especially if you add commentary that adopts the imputation).

C. Other charges frequently paired with threats/shaming

1) Threats to publish / extortion-like conduct

If the threat is: “Give money / do X or I will expose you / post your photos / reveal secrets”, prosecutors may consider:

Threat-related provisions and/or
Robbery/extortion-type theories depending on the facts and demands
Other special laws if intimate images are involved

2) Safe Spaces Act (RA 11313) – Online Gender-Based Sexual Harassment

If the shaming or threats are sexualized (lewd comments, sexist slurs, sexual humiliation, rape threats, sexual rumors, unwanted sexual messages), RA 11313 may apply.

3) Anti-Photo and Video Voyeurism Act (RA 9995)

If someone records, shares, uploads, or threatens to share intimate images/videos without consent, RA 9995 is often central.

4) Violence Against Women and Their Children (RA 9262)

If the offender is a current/former spouse, boyfriend, partner, or someone you had a dating/sexual relationship with, online threats and shaming can be framed as psychological violence, harassment, stalking-like conduct, or humiliation—often alongside protection orders.

5) Data Privacy Act (RA 10173)

If personal information is disclosed without lawful basis (IDs, addresses, numbers, workplace details), a privacy complaint may be possible, depending on purpose and context.

6) Physical injuries / slander / slander by deed

Sometimes “public shaming” includes humiliating acts, edited videos, or face-to-face follow-through leading to traditional RPC offenses.

3) Choosing the right case: a quick decision map

If the message says “I will harm/kill you” or implies harm:

Grave threats / other threats
Possibly coercion if tied to forcing behavior
Consider also protective remedies (especially under RA 9262 if applicable)

If the post says you committed a crime or morally disgraceful act:

Cyber libel
Possibly grave threats too if accompanied by intimidation

If they posted your address/IDs to invite harassment:

Data Privacy Act (potentially)
Unjust vexation / coercion (depending on conduct)
Threat-related provisions if there’s implied harm

If intimate images are involved:

RA 9995 (often primary)
Threat-related provisions if used to intimidate
RA 9262 if relationship-based

If sexualized insults/harassment are present:

RA 11313 (online gender-based sexual harassment)
Plus cyber libel if defamatory imputations are made

Because facts overlap, it’s common to file multiple counts in one complaint when supported by evidence.

4) Evidence wins (or loses) these cases

A. What evidence you should preserve immediately

Create a folder and preserve:

Screenshots
- Capture the full screen: name/handle, profile photo, the post/message, timestamps, comments, reactions, and the URL bar if on browser.
- Screenshot the context (previous messages, thread, and any “replying to” indicators).
URLs and identifiers
- Copy and save links to posts, reels, stories, tweets, comment permalinks.
- Save profile URLs and group page URLs.
Screen recordings (high value)
- Record scrolling through the profile and post, opening comments, and showing it’s publicly accessible or visible to the relevant audience.
Downloads / exports where possible
- For chat apps: export chat logs (if available), download media in original quality.
Witnesses
- If friends saw it live, ask for their screenshots and prepare them for sworn statements.
Device preservation
- Keep the phone/computer where you received the messages. Don’t factory reset. Don’t delete the conversation.
Timeline notes
- Write a chronological log: date/time you saw it, when it was posted, who sent what, what you did next, any escalation.

B. Don’t rely on screenshots alone when you can do better

Screenshots are helpful, but defense arguments often attack them as “editable.” Stronger practice includes:

Multiple captures from different devices/accounts
Screen recording showing navigation and the URL
Preserving original files and message metadata
Independent witness captures
Where necessary, forensic extraction by a qualified examiner

C. Authentication: how electronic evidence is commonly proven

Philippine courts generally require you to show:

What the item is (post/message/photo)
Who is connected to it (linking the account/device to the respondent)
Integrity (that it wasn’t altered)

Common ways to authenticate:

Testimony of a person who personally saw the post/message and captured it
Showing the account profile, identifiers, prior conversations, photos, friends/followers, and other markers tying it to the respondent
Corroboration through other evidence: admissions, replies, consistent use of the handle, known phone number/email linked to the account, or witness familiarity

5) Linking the online account to the real person (the hardest part)

Many cases fail not because the post isn’t defamatory/threatening, but because identity isn’t proven beyond “it looks like them.”

Linking strategies that matter

Prior chat history showing it’s the same person
Shared personal photos unique to the respondent
The account is tagged by mutual friends as that person
The respondent’s other known accounts cross-link it
Replies to messages from the account acknowledging identity
Consistent phone number/email used for recovery or contact
If needed: lawful investigative steps via cybercrime procedures (see below)

6) Where to file and what the process usually looks like

A. First stops for reporting

You can start with:

Office of the City/Provincial Prosecutor (for filing a complaint-affidavit for criminal cases)
PNP Anti-Cybercrime Group (ACG) or NBI cybercrime units (for blotter, technical assistance, and case build-up)
For relationship-based abuse: consider also women and children protection desks and remedies under RA 9262

B. Typical case flow (criminal)

Prepare complaint-affidavit (your sworn narrative + attachments)
File with prosecutor’s office (and/or through law enforcement assistance depending on locality practice)
Preliminary investigation
- Respondent files counter-affidavit
- Possible clarificatory hearing
Resolution (probable cause or dismissal)
If probable cause: Information filed in court
Arraignment, trial, judgment

Cybercrime matters can involve specialized warrant procedures for electronic data (next section).

7) Cybercrime-specific tools that can preserve and obtain data (when necessary)

When identity or data preservation is at risk (deleted posts, dummy accounts), cybercrime procedure becomes important.

Common judicial tools used in cybercrime investigations include:

Preservation of computer data (to prevent deletion while legal process runs)
Disclosure / production orders for specific data
Search, seizure, and examination of devices
Orders relating to traffic data and related technical information

These are court-controlled steps and are particularly relevant when:

Posts are being deleted
The account is anonymous or uses fake credentials
You need platform-side records (to the extent available and legally obtainable)
You need to examine a seized device for evidence

8) Drafting a strong complaint-affidavit (practical blueprint)

A. Structure that prosecutors find easiest to evaluate

Parties – your identity and respondent’s identity (or “John/Jane Doe” with identifying details if unknown)
Facts – chronological, numbered paragraphs
Exact quotations – copy verbatim the threatening/defamatory lines (include original language)
Context – relationship, prior disputes, motive, why it was harmful, audience reached
Elements – short section mapping facts to offense elements
Evidence index – “Annex A, A-1…” with descriptions
Prayer – request for filing of appropriate charges and any lawful relief

B. Attachments checklist

Screenshots + screen recordings
Printouts of posts with URLs
Copies of chat exports
Proof of identification: the respondent’s profile, photos, mutual links
Witness affidavits (if any)
Proof of harm: medical/psych records (if applicable), workplace consequences, threats received by family, etc.

C. Avoiding self-inflicted problems

Don’t exaggerate. Stick to provable facts.
Don’t edit screenshots. Keep originals.
Don’t respond with threats/insults that could trigger countercharges.
Don’t publicly post about “filing cases” in a way that escalates harassment or muddies the record.

9) Defenses you should anticipate (and prepare for)

Even strong complainants get hit with common defenses:

For cyber libel

Not defamatory / mere opinion / rhetorical hyperbole
No identification (“not clearly about you”)
No publication (privacy settings; only you saw it)
Privileged communication / fair comment
Truth and good motives / justifiable ends (fact-specific)
Lack of malice
Mistaken identity / hacked account

For threats

Joke / anger / no intent
Not a threat of a crime
No credibility / no capability
Context shows it was not meant seriously
Not the sender (identity dispute)

Your evidence and narrative should be built to withstand these.

10) Civil actions and protective remedies (often overlooked)

A. Civil damages

Even when criminal cases are pending (or if criminal proof is difficult), civil claims may be possible for:

Reputational harm, emotional distress, actual damages, and other legally recognized injury

B. Protection orders (especially under RA 9262)

If relationship-based, protection orders can impose restrictions that immediately reduce harm (contact bans, distance, harassment prohibitions), depending on the facts and court findings.

C. Workplace/school administrative remedies

If the respondent is a coworker/classmate, parallel administrative processes may exist, and the same evidence set can support them.

11) Practical “first 48 hours” playbook

Screenshot + screen record everything (post, comments, profile, URLs).
Ask 1–3 trusted people to view and capture independently.
Preserve the device; don’t delete chats.
Write a timeline while memory is fresh.
If there is imminent danger, prioritize safety and immediate reporting to authorities.
Start preparing affidavits and organize annexes cleanly.

12) What “public shaming” is not (so you don’t file the wrong case)

Truthful complaints made in proper channels (e.g., reports to authorities) may be treated differently than viral posts made to humiliate.
Consumer reviews can be lawful if framed as experience/opinion and not as false criminal accusations.
Generalized rants with no identifiable target are harder to prosecute.
Private insults in a one-to-one setting may not meet “publication” for libel, though other offenses may apply depending on conduct.

13) Bottom line

In the Philippine setting, “online threats” and “public shaming” most commonly lead to grave threats/other threats, cyber libel, and related charges (including Safe Spaces, anti-voyeurism, VAWC, and data privacy depending on the facts). Winning these cases depends less on outrage and more on (1) matching facts to legal elements and (2) preserving and authenticating electronic evidence, especially identity-linking proof.