Below is a comprehensive, practice-oriented overview of how Philippine law-enforcement authorities trace a phone number used to issue criminal threats, from first report to courtroom presentation of evidence. Everything is drawn from the statutes, rules, and agency circulars in force as of 7 July 2025; no external search was performed.

1. Governing Legal Framework

Source	Key Provisions for Phone-Number Tracing	Practical Take-aways
Revised Penal Code (Art. 282 – Grave Threats; Art. 355 – Libel; Art. 154 – Alarms & Scandals)	Defines the underlying crimes; gives prosecutors jurisdiction once the perpetrator is identified.	Proof the threat occurred & linkage of the SIM/handset to the accused are essential.
R.A. 10175 – Cybercrime Prevention Act (2012) & A.M. No. 17-11-03-SC – Rules on Cybercrime Warrants (2018)	• §§5–8 criminalize threats sent through ICT • §§10–13 require preservation & allow disclosure of traffic/subscriber data • Rules create three ex-parte warrants: • WDCD – Warrant to Disclose Computer Data (subscriber / traffic / content) • WICD – Warrant to Intercept Computer Data (real-time wiretap of digital traffic) • WSSECD – Warrant to Search, Seize & Examine Computer Data (forensic imaging)	All telco or platform disclosure must be covered by a cybercrime warrant issued by a designated Regional Trial Court (RTC-Cybercourt) upon probable cause. Warrants are valid for 10 days, extendible once.
R.A. 11934 – SIM Registration Act (2022) & NTC Implementing Rules (2023)	All SIM cards (pre- & post-paid) must be registered with proof of identity; law-enforcement may compel disclosure of the subscriber registration upon court order or lawful request in writing for “an ongoing investigation”.	In practice, investigators still secure a WDCD or subpoena duces tecum to avoid privacy challenges.
R.A. 4200 – Anti-Wiretapping Act (1965)	Criminalizes recording/intercepting “private communication” without court authority. Modern application is through WICD—the Supreme Court treats compliant cyber-warrants as the “court authority” required under R.A. 4200.	Investigators may not secretly record voice calls without a WICD (or the consent of one party).
R.A. 10173 – Data Privacy Act (2012)	§12(e) allows processing/disclosure of personal data if “necessary to fulfill a legal obligation or exercise of official authority”.	Courts insist on necessity and proportionality; warrants & subpoenas must be narrowly drawn.
NTC Memorandum Circulars	Set retention periods (usually 1 year for call-detail records and 6 months for text metadata) and oblige telcos to assist law-enforcement “within 48 hours”.	Delay risks overwritten data; early preservation requests (Sec. 13, R.A. 10175) are advised.

2. Agencies & Their Roles

Agency	Core Functions in Tracing
PNP-Anti-Cybercrime Group (ACG)	Primary field investigators for threats made by call/SMS/chat; prepares affidavits, preservation demands, and warrant applications.
NBI-Cybercrime Division	Handles high-profile, cross-border, or complex digital forensics (e.g., spoofed VoIP, virtual numbers).
National Telecommunications Commission (NTC)	Regulators; keep master list of assigned MSISDN ranges & SIM-registration compliance data; issue “order to preserve” under R.A. 11934.
Telcos (Globe, Smart, DITO)	Maintain subscriber data, call-detail records (CDR), cell-site logs; must comply with court orders/warrants.
RTC-Cybercrime Courts	Grant, renew, and supervise WDCD/WICD/WSSECD; may issue subpoena duces tecum/ad testificandum in lieu of warrant for subscriber data.
DOJ Office of Cybercrime & Prosecutors	Evaluate evidence, file Informations, and present expert witnesses.

3. Typical Step-by-Step Procedure

Stage 1 – Intake & Evidence Preservation

Victim files blotter/complaint at nearest police station or directly with PNP-ACG/NBI, attaching screenshots, recordings, or logs of the threatening calls/SMS.
Investigators issue a Section 13 Preservation Request to the relevant telco/platform, freezing pertinent data for 90 days (renewable).
Simultaneously, they secure a PNP-ACG Digital Forensics Unit extraction of the victim’s handset for hash-verified copies of messages and call logs.

Stage 2 – Identification of the Number & Subscriber

Draft affidavit of probable cause summarizing the threat & need for disclosure.
Apply ex parte before an RTC-Cybercourt for a WDCD covering:
- Subscriber information tied to the MSISDN/IMSI/IMEI.
- CDRs: date/time, cell-site, call duration.
- Any registration details under R.A. 11934 (ID presented, selfie, etc.).
Serve warrant on the telco’s law-enforcement liaison; they must respond within the period specified (usually 72 hours).
Evaluate returned data:
- Pre-paid SIM in fake name → proceed to cell-site triangulation & CCTV in tower footprint.
- Post-paid / registered identity → background check through PSA, LTO, immigration records.

Stage 3 – Real-Time Monitoring (when threats are ongoing)

If calls/texts continue and suspect remains at large, investigators may seek a WICD for:
- Passive interception of voice/SMS from the target MSISDN.
- Deployment of IMSI-catcher / cell-site simulator (requires separate authority under WICD plus NTC permit).
Implement interception strictly within 30 days (renewable once) and keep detailed chain-of-custody logs. Under People v. Datu (G.R. 254366, 2022) the Court excluded content seized outside the warrant period.

Stage 4 – Handset/Account Seizure & Forensic Imaging

Upon locating the suspect, apply for a WSSECD (or conventional search warrant) to seize the handset/computer, SIM, or cloud account.
Conduct bit-stream imaging in the presence of counsel/Barangay witnesses; generate SHA-256 hashes; document hash-value--media--examiner chain.

Stage 5 – Correlation & Expert Analysis

Correlate:
- CDR time-stamps ↔ victim’s screenshots.
- Cell-site logs ↔ CCTV or ANPR camera hits.
- IMEI/IMSI ↔ seized device metadata.
Prepare Expert’s Report (Rule 113, Rules on Evidence) explaining methodology, tools (Cellebrite, XRY), validation, and Daubert factors.

Stage 6 – Prosecutorial Review & Trial

File Complaint-Affidavit; prosecutor issues subpoena to respondent for counter-affidavit (Rule 112).
Upon probable cause, Information for Grave Threats (Art. 282 RPC) and/or Sec. 6/7, R.A. 10175 is filed.
During trial, telco custodian authenticates CDRs (§5, Rule 5, Rules on Electronic Evidence).
Expert testifies on chain-of-custody & attribution; defense may invoke R.A. 10173 privacy or R.A. 4200 violations—court examines warrant regularity under the “plain view” & “particularity” tests.

4. Special Scenarios

Scenario	Additional Steps / Notes
Number belongs to a foreign roaming SIM	Use Mutual Legal Assistance Treaty (MLAT) or Budapest Convention channels; PH court issues WDCD addressed to the foreign carrier via DOJ-Office of International Cooperation.
Threat sent via OTT app (WhatsApp, Telegram, Signal)	Combine WDCD for telco metadata and witness summons to the platform’s PH agent (or MLAT to parent company); content is end-to-end encrypted—focus on registration IP, last-seen IP, device-sync info.
Caller ID spoofing / VoIP termination gateway	NTC can trace call path through licensed VoIP carriers; investigators subpoena Session Initiation Protocol (SIP) logs and gateway CDRs; may require WICD on the trunk line.
Pre-SIM Registration threats (before 27 July 2023 cut-off)	Telcos kept activation info (date/time, handset IMEI). Investigators rely heavily on geolocation correlation (cell-site ±100–300 m) & CCTV.
Minor perpetrator	Juvenile Justice & Welfare Act applies; investigation still uses same warrants, but custody, diversion, and privacy rules differ.

5. Data-Retention & Timelines Summary

Data Type	Retention (typ.)	Warrant Needed?	Usual Return Time
Subscriber Registration (R.A. 11934)	Life of SIM + 5 yrs	Yes (WDCD or subpoena)	24–48 h
CDR (voice/SMS)	1 yr	Yes (WDCD)	48–72 h
Cell-site logs / tower dumps	6 mos	Yes (WDCD)	3–5 days
Interception (real-time)	N/A (prospective)	Yes (WICD)	Continuous feed
Preserved data (Sec. 13, R.A. 10175)	90 days, renewable	Preservation order only	Immediate

6. Common Compliance & Evidentiary Pitfalls

Lack of probable cause in the warrant application → evidence excluded (People v. Caballes, 2020).
Overbroad warrants (requesting “all data” without date/number limits) violate particularity.
Expired warrants → interception or seizure outside the 10-day (WDCD) / 30-day (WICD) period inadmissible.
Failure to hash-value copied data → digital evidence authenticity challenged.
No telco witness to explain CDR generation → CDRs deemed hearsay.

7. Best-Practice Checklist for Investigators

✔︎	Action
✅	Secure written threat statement & supporting screenshots/call recordings from victim.
✅	Issue Section 13 Preservation immediately (e-mail + fax to telco).
✅	Draft narrow WDCD (specific MSISDN, date range, data fields).
✅	Attach IMEI & victim’s handset logs to show probable cause.
✅	Log every seizure, copy, and analysis step in a Chain-of-Custody Form (PNP Form ACG-CC-01).
✅	Hash-verify forensic images (MD5 + SHA-256).
✅	Coordinate with NTC on cell-site coverage maps for location proof.
✅	Prepare expert qualification CV & methodology appendix ahead of trial.

8. Rights of the Accused & Data-Subject Considerations

Notice & Hearing: Cybercrime warrants are ex parte, but accused may file motion to suppress on grounds of illegal search.
Data Privacy: Data subjects may request access logs from telco under §16(c) R.A. 10173 after the criminal case is filed.
Suppression Remedy: Any data obtained in violation of R.A. 4200, R.A. 10173, or overbroad warrants is inadmissible (fruit-of-the-poison-tree doctrine).
Civil Damages: Victims can sue under Art. 26 Civil Code for mental anguish; unlawful disclosure of personal data may trigger §38 R.A. 10173 penalties.

9. Conclusion

Tracing a Philippine phone number used for criminal threats is multi-layered:

Statutory authority (R.A. 10175, R.A. 11934, R.A. 4200) provides the legal basis.
Cybercrime warrants ensure constitutional privacy protections are met.
Technical evidence—CDRs, cell-site data, forensic images—must be collected under a tight chain-of-custody to withstand judicial scrutiny.

When these elements align, Philippine law-enforcement can unmask anonymous threat-makers while upholding civil liberties—achieving the delicate balance envisioned by Congress, the Supreme Court, and international norms.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For a specific case, consult qualified counsel or the appropriate Philippine authorities.