In the traditional legal landscape, a man’s house is his castle. In the digital age, that castle has shifted to servers, cloud storage, and encrypted devices. To address this, the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), supplemented by the Rule on Cybercrime Warrants (A.M. No. 17-11-03-SC), introduced specialized warrants tailored for the ephemeral and borderless nature of digital evidence.

Unlike standard search and seizure warrants, cybercrime warrants deal with data that can be deleted in a keystroke. Here is a comprehensive guide to the four primary warrants recognized under Philippine cyber law.

1. Warrant to Disclose Computer Data (WDCD)

The WDCD is the primary tool used to identify the "who" and "where" of a digital footprint. It is an order to a service provider (like an ISP or a platform) to reveal specific information about a user.

Purpose: To compel service providers to disclose subscriber information, traffic data, or relevant data in their possession.
Scope: It targets non-content data. This includes login logs, IP addresses used, account metadata, and billing information.
Key Requirement: Law enforcement must show that such data is relevant and necessary for an ongoing investigation.

2. Warrant to Intercept Computer Data (WICD)

The WICD is perhaps the most invasive of the warrants, as it allows for the "listening in" on digital communications as they happen.

Purpose: To authorize law enforcement to carry out listening, recording, or monitoring of the content of communications.
Scope: This covers the actual content of emails, instant messages, and VOIP calls in real-time (or near real-time).
Legal Threshold: Because this touches upon the constitutional right to privacy of communication, the requirements for a WICD are stringent. It requires a showing that there are no other less-intrusive means to obtain the information.

3. Warrant to Search, Seize, and Examine Computer Data (WSSECD)

This is the digital equivalent of a traditional search warrant, but with a technical twist.

Purpose: To search a specific physical location for computer systems and to seize the data contained therein.
The "Examine" Aspect: Unique to this warrant is the authority to conduct forensic examination. Law enforcement doesn't just take the "box" (hardware); they are authorized to extract and analyze the data within it.
Off-site Examination: If the search cannot be completed on-site due to technical complexity, the authorities are allowed to bring the hardware to a laboratory for further analysis.

4. Warrant to Examine Computer Data (WECD)

The WECD is used when the authorities already have the device in their lawful possession but lack the specific authority to look inside the files.

Scenario: If a device was seized during a valid warrantless arrest (e.g., in flagrante delicto) or through a different legal process, a WECD must be obtained before the police can bypass passwords or search through folders.
Distinction: While a WSSECD covers the act of taking the device, the WECD focuses purely on the forensic extraction of data from a device already held by the state.

Procedural Safeguards and Key Features

To balance the state's power with individual privacy, the Supreme Court established specific rules for these warrants:

Limited Period of Validity: Cybercrime warrants are generally valid for ten (10) days from issuance. However, the court may extend this for another 10 days upon a showing of good cause.
The Return: After the warrant is served, law enforcement must file a "Return" to the court, detailing what was seized or intercepted.
Chain of Custody: Given that digital files are easily manipulated, strict forensic protocols (like hashing and imaging) must be followed to ensure the evidence is admissible in court.
Data Destruction: If the data seized is found to be irrelevant to the case, the law requires that such data be destroyed or returned to the owner to prevent "fishing expeditions."

Warrant Type	Primary Target	Timing
WDCD	Service Provider Records	Post-activity / Log Retrieval
WICD	Live Communications	Real-time Interception
WSSECD	Hardware and Stored Files	Physical Search and Seizure
WECD	Files on a Seized Device	Post-seizure Forensic Analysis

Jurisdictional Note

Under the Rules, these warrants can be applied for before Regional Trial Courts (RTCs) designated as "Special Cybercrime Courts." Their jurisdiction is effectively "national," meaning a warrant issued by a designated RTC in Quezon City can be enforced against a server located in Cebu, acknowledging the decentralized nature of the internet.