CYBERCRIME no longer happens neatly in one place. The victim may be in Manila, the offender abroad, the platform in the United States and the relevant cloud server elsewhere. Evidence may be scattered across phones, laptops, messaging applications, online accounts, financial systems and remote servers.
It may appear as screenshots, downloaded videos, private messages, emails, transaction records, subscriber information, cloud backups, deleted files, artificial intelligence (AI) outputs and application logs.
But finding digital evidence is not the same as proving a case.
The real question is whether that evidence can survive examination in court.
I have seen this concern from both the international and technical sides. I led the Philippine technology work connected with the United Nations cybercrime treaty process and previously served as a member of the Scientific Working Group on Digital Evidence (SWGDE). Those experiences reinforced one basic point: International cooperation is only as useful as the quality of the evidence being exchanged.
The Philippine Digital Forensics Manual treats digital evidence as something that must be identified, collected, preserved, examined, analyzed, interpreted and reported through a disciplined process. Each significant step should be documented so another qualified examiner can understand what was done and, where possible, reproduce the result.
This matters because digital evidence is fragile. A device may change simply because it is turned on. Files may be modified when opened. A phone connected to the internet may receive messages, synchronize with the cloud, update an application or be remotely wiped.
A screenshot is a good example. It may appear to show a threat, fraudulent payment, social media post or private conversation. Yet it is only an image of what appeared on a screen at a particular moment.
It may have been cropped, edited, fabricated or removed from context. It may not show the complete conversation, original account, correct date and time, or source application. Investigators must ask: Who captured it? From what device? Is the original available? Can the account be attributed to a person? Are there supporting metadata, application records, server logs or testimony?
Downloaded videos require the same care. A video found on a phone does not automatically prove that the owner created, downloaded, watched or shared it. It may have been received through a group chat, cached automatically, copied from another device or synchronized from the cloud.
The examiner should assess the file path, metadata, thumbnails, download history, source application, playback records, sharing activity and deletion history before drawing conclusions.
This approach is consistent with Republic Act (RA) 10175, the Cybercrime Prevention Act of 2012, and the Rule on Cybercrime Warrants, which govern the preservation, disclosure, interception, search, seizure, examination, custody and destruction of computer data.
RA 10173, the Data Privacy Act of 2012, is equally important. A digital investigation may expose personal, sensitive, privileged or irrelevant information. Lawful access is not permission to collect everything without limits.
Cross-border evidence adds another layer. Investigators may need rapid preservation before foreign-held data disappears under a provider’s retention policy. They may also need subscriber records, traffic data, content data or cloud files from another jurisdiction.
The United Nations cybercrime treaty offers an important framework for cooperation and electronic-evidence sharing. But no treaty can cure poor forensic handling. Evidence obtained abroad must still be lawfully requested, properly received, securely preserved, documented, authenticated and explained under Philippine law.
SWGDE and NIST guidance matter because forensic tools and methods must be tested, documented, repeatable and reliable. A report should identify the device examined, acquisition method, forensic copy, tool and version used, hash values, errors encountered, time-zone assumptions and analytical limitations.
The person presenting the findings must also prove his or her qualifications. A title is not enough. Knowing how to operate expensive software is not enough. Education, training, certifications, practical experience, proficiency testing, tool competence and knowledge of accepted standards must be capable of validation.
The expert must also separate fact from inference. The fact may be that a downloaded video exists on a device. The inference may be that the owner knowingly downloaded and watched it. That conclusion requires support from account control, user activity, playback records, application logs, related messages or testimony.
Artificial intelligence can classify images, correlate logs, detect suspicious transactions, summarize messages and sort large data sets. But AI output is not self-authenticating. The system, version, limitations, error rate, input data and human verification must be disclosed.
An algorithmic flag should begin an inquiry, not end it. Digital evidence is not credible simply because it appears on a screen or comes from advanced software. It becomes credible when the court can trace its source, verify its integrity, examine the method, evaluate the expert and distinguish fact from interpretation.
Technology may uncover the evidence. Only a lawful, transparent and defensible process can make it worthy of belief.