In the digital age, social media accounts are extensions of personal identity and professional reputation. Unauthorized access (hacking) and persistent unwanted behavior (harassment) are not merely violations of platform terms of service—they are criminal offenses under Philippine law.

This article outlines the legal framework, the evidentiary requirements, and the procedural steps for filing a formal complaint.

1. Relevant Governing Laws

Understanding the legal basis for a complaint is the first step in seeking justice. The primary statutes involved include:

Republic Act No. 10175 (Cybercrime Prevention Act of 2012): This is the primary law penalizing illegal access (hacking), data interference, and cyber-libel.
Republic Act No. 11313 (Safe Spaces Act or "Bawal Bastos" Law): This law penalizes gender-based online sexual harassment, including stalking, uploading/sharing of photos/videos without consent, and misogynistic or transphobic slurs.
Revised Penal Code (RPC): Used for related crimes such as Unjust Vexation, Grave Threats, or Incriminating Innocent Persons, when committed through information and communications technologies (ICT).
Republic Act No. 10173 (Data Privacy Act of 2012): Relevant if the hacking involves the unauthorized processing or disclosure of sensitive personal information.

2. Defining the Offenses

Illegal Access (Hacking)

Under Section 4(a)(1) of RA 10175, illegal access is the access to the whole or any part of a computer system without right. In the context of social media, this includes:

Phishing for credentials.
Using malware to bypass passwords.
Unauthorized entry into an account by an ex-partner, colleague, or stranger.

Cyber-Harassment and Cyber-Stalking

Harassment can be prosecuted under several categories:

Cyber-Libel: Public and malicious imputation of a crime, vice, or defect intended to cause dishonor or contempt.
Gender-Based Online Sexual Harassment: Includes persistent uninvited sexual comments, threats, or the distribution of private intimate images.
Unjust Vexation: Broadly covers behavior that causes annoyance, irritation, or distress to the victim.

3. Preservation of Evidence

In cybercrime cases, digital evidence is ephemeral and easily deleted. You must secure evidence before the perpetrator deactivates their account or deletes messages.

Screenshots: Capture everything—the offensive posts, direct messages, comments, and most importantly, the Profile URL of the perpetrator. A name can be changed; a unique User ID (numerical) is more permanent.
URL Capture: Copy the direct links to specific posts or comments.
Timestamps: Note the exact date and time the content was posted or the hacking occurred.
Transaction Records: If the hacking involved a financial element (e.g., unauthorized purchases), secure bank statements and notification emails.
Digital Logs: If you received security alerts from the platform (e.g., "New login from an unknown device"), save these emails and the IP addresses listed.

4. Where to File the Complaint

There are two primary law enforcement agencies in the Philippines dedicated to handling cybercrime. You may approach either:

A. Philippine National Police - Anti-Cybercrime Group (PNP-ACG)

Location: Camp Crame, Quezon City (or Regional Anti-Cybercrime Units/RACUs).
Procedure: You will undergo an initial interview and evaluation. If the case is actionable, they will assist in the technical investigation.

B. National Bureau of Investigation - Cybercrime Division (NBI-CCD)

Location: NBI Building, Taft Avenue, Manila (or Regional Offices).
Procedure: Similar to the PNP, the NBI focuses on technical forensics and can issue subpoenas to service providers to identify account owners.

C. Department of Justice - Office of Cybercrime (DOJ-OOC)

While not an investigative unit in the same way as the PNP/NBI, the DOJ-OOC supervises the implementation of cybercrime laws and provides international legal assistance if the service provider (e.g., Meta, X, Google) is based abroad.

5. The Procedural Steps

Step 1: Initial Reporting and Verification

Visit the PNP-ACG or NBI-CCD. Bring all printed copies of your evidence and digital copies on a USB drive. You will fill out a complaint form detailing the incident.

Step 2: Technical Evaluation

Law enforcement will verify the digital evidence. They may conduct "open-source intelligence" (OSINT) to trace the perpetrator’s digital footprint.

Step 3: Preparation of the Complaint-Affidavit

If the suspect is identified, you (the Complainant) must prepare a Complaint-Affidavit. This is a sworn statement narrating the facts of the case. It is highly recommended to seek the assistance of a lawyer to ensure the elements of the specific crime (e.g., RA 10175 vs. RA 11313) are correctly alleged.

Step 4: Filing for Preliminary Investigation

The complaint is filed with the Office of the City Prosecutor. The prosecutor will determine if there is probable cause to bring the case to court.

Counter-Affidavit: The respondent (the accused) will be given a chance to submit their defense.
Resolution: The prosecutor will either dismiss the case or file an "Information" (formal charge) in the proper Cybercrime Court.

6. Critical Considerations

Venue of Action: Unlike physical crimes, a criminal action for cyber-libel can be filed where the complainant resides or where the respondent resides. For other cybercrimes, the case is filed in the Regional Trial Court (designated as a Cybercrime Court) of the province or city where the offense was committed or where any of its elements occurred.

Penalties: Cybercrimes generally carry a penalty one degree higher than their counterparts in the Revised Penal Code. For instance, cyber-libel is punished more severely than traditional libel, with potential imprisonment of up to 12 years (Prision Mayor).

Prescription Period: Be mindful of the "expiration" of the crime. Cyber-libel, for example, has a prescription period of 15 years following the Supreme Court's interpretation of RA 10175, though some legal interpretations vary. It is best to file as soon as the evidence is gathered.