03/02/2020 G.R. No. 203335 Undoubtedly, the State has a compelling interest in enacting the cybercrime law for there is a need to put order to the tremendous activities in cyberspace for public good.82 To do this, it is within the realm of reason that the government should be able to monitor traffic data to enhance its ability to combat all sorts of cybercrimes. Chapter IV of the cybercrime law, of which the collection or recording of traffic data is a part, aims to provide law enforcement authorities with the power they need for spotting, preventing, and investigating crimes committed in cyberspace. Crime-fighting is a state business. Indeed, as Chief Justice Sereno points out, the Budapest Convention on Cybercrimes requires signatory countries to adopt legislative measures to empower state authorities to collect or record "traffic data, in real time, associated with specified communications."83 And this is precisely what Section 12 does. It empowers law enforcement agencies in this country to collect or record such data. But is not evidence of yesterday’s traffic data, like the scene of the crime after it has been committed, adequate for fighting cybercrimes and, therefore, real-time data is superfluous for that purpose? Evidently, it is not. Those who commit the crimes of accessing a computer system without right,84 transmitting viruses,85 lasciviously exhibiting sexual organs or sexual activity for favor or consideration;86 and producing child pornography87 could easily evade detection and prosecution by simply moving the physical location of their computers or laptops from day to day. In this digital age, the wicked can commit cybercrimes from virtually anywhere: from internet cafés, from kindred places that provide free internet services, and from unregistered mobile internet connectors. Criminals using cellphones under pre-paid arrangements and with unregistered SIM cards do not have listed addresses and can neither be located nor identified. There are many ways the cyber criminals can quickly erase their tracks. Those who peddle child pornography could use relays of computers to mislead law enforcement authorities regarding their places of operations. Evidently, it is only real-time traffic data collection or recording and a subsequent recourse to courtissued search and seizure warrant that can succeed in ferreting them out. Petitioners of course point out that the provisions of Section 12 are too broad and do not provide ample safeguards against crossing legal boundaries and invading the people’s right to privacy. The concern is understandable. Indeed, the Court recognizes in Morfe v. Mutuc88 that certain constitutional guarantees work together to create zones of privacy wherein governmental powers may not intrude, and that there exists an independent constitutional right of privacy. Such right to be left alone has been regarded as the beginning of all freedoms.89 But that right is not unqualified. In Whalen v. Roe,90 the United States Supreme Court classified privacy into two categories: decisional privacy and informational privacy. Decisional privacy involves the right to independence in making certain important decisions, while informational privacy refers to the interest in avoiding disclosure of personal matters. It is the latter right—the right to informational privacy—that those who oppose government collection or recording of traffic data in real-time seek to protect. Informational privacy has two aspects: the right not to have private information disclosed, and the right to live freely without surveillance and intrusion.91 In determining whether or not a matter is entitled to the right to privacy, this Court has laid down a two-fold test. The first is a subjective test, where one claiming the right must have an actual or legitimate expectation of privacy over a certain matter. The second is an objective test, where his or her expectation of privacy must be one society is prepared to accept as objectively reasonable.92 Since the validity of the cybercrime law is being challenged, not in relation to its application to a particular person or group, petitioners’ challenge to Section 12 applies to all information and communications technology (ICT) users, meaning the large segment of the population who use all sorts of electronic devices to communicate with one another. Consequently, the expectation of privacy is to be measured from the general public’s point of view. Without reasonable expectation of privacy, the right to it would have no basis in fact. As the Solicitor General points out, an ordinary ICT user who courses his communication through a service provider, must of necessity disclose to the latter, a third person, the traffic data needed for connecting him to the recipient ICT user. For example, an ICT user who writes a text message intended for another ICT user must furnish his service provider with his cellphone number and the cellphone number of his recipient, accompanying the message sent. It is this information that creates the traffic data. Transmitting communications is akin to putting a letter in an envelope properly addressed, sealing it closed, and sending it through the postal service. Those who post letters have no expectations that no one will read the information appearing outside the envelope. Computer data—messages of all kinds—travel across the internet in packets and in a way that may be likened to parcels of letters or things that are sent through the posts. When data is sent from any one source, the content is broken up into packets and around each of these packets is a wrapper or header. This header contains the traffic data: information that tells computers where the packet originated, what kind of data is in the packet (SMS, voice call, video, internet chat messages, email, online browsing data, etc.), where the packet is going, and how the packet fits together with other packets.93 The difference is that traffic data sent through the internet at times across the ocean do not disclose the actual names and addresses (residential or office) of the sender and the recipient, only their coded internet protocol (IP) addresses. The packets travel from one computer system to another where their contents are pieced back together. Section 12 does not permit law enforcement authorities to look into the contents of the messages and uncover the identities of the sender and the recipient. For example, when one calls to speak to another through his cellphone, the service provider’s communication’s system will put his voice message into packets and send them to the other person’s cellphone where they are refitted together and heard. The latter’s spoken reply is sent to the caller in the same way. To be connected by the service provider, the sender reveals his cellphone number to the service provider when he puts his call through. He also reveals the cellphone number to the person he calls. The other ways of communicating electronically follow the same basic pattern. In Smith v. Maryland,94 cited by the Solicitor General, the United States Supreme Court reasoned that telephone users in the ‘70s must realize that they necessarily convey phone numbers to the telephone company in order to complete a call. That Court ruled that even if there is an expectation that phone numbers one dials should remain private, such expectation is not one that society is prepared to recognize as reasonable. In much the same way, ICT users must know that they cannot communicate or exchange data with one another over cyberspace except through some service providers to whom they must submit certain traffic data that are needed for a successful cyberspace communication. The conveyance of this data takes them out of the private sphere, making the expectation to privacy in regard to them an expectation that society is not prepared to recognize as reasonable. The Court, however, agrees with Justices Carpio and Brion that when seemingly random bits of traffic data are gathered in bulk, pooled together, and analyzed, they reveal patterns of activities which can then be used to create profiles of the persons under surveillance. With enough traffic data, analysts may be able to determine a person’s close associations, religious views, political affiliations, even sexual preferences. Such information is likely beyond what the public may expect to be disclosed, and clearly falls within matters protected by the right to privacy. But has the procedure that Section 12 of the law provides been drawn narrowly enough to protect individual rights? Section 12 empowers law enforcement authorities, "with due cause," to collect or record by technical or electronic means traffic data in real-time. Petitioners point out that the phrase "due cause" has no precedent in law or jurisprudence and that whether there is due cause or not is left to the discretion of the police. Replying to this, the Solicitor General asserts that Congress is not required to define the meaning of every word it uses in drafting the law. https://lawphil.net/judjuris/juri2014/feb2014/gr_203335_2014.html 12/19