Computer-related Forgery – R.A. No. 10175, Sec. 4(b)(1)

Nature of Computer-related Forgery

Computer-related forgery under Republic Act No. 10175 punishes the falsification of computer data and the knowing use of such falsified data when the data is meant to operate as authentic for legal purposes. It translates the public-interest offense of forgery into the digital environment, where rights, obligations, identities, approvals, and records may exist only as electronic entries, codes, logs, files, certificates, or database values.

The protected interest is public faith in the authenticity and reliability of computer data used in law, commerce, government, employment, finance, education, and regulated transactions. The offense is not limited to documents that can be read on a screen; it covers data in any form suitable for computer processing, including machine-readable data, metadata, encrypted values, digital signatures, QR codes, validation tokens, transaction identifiers, and audit entries.

The crime is committed only when the manipulation or use is done with the required unlawful character and fraudulent mental element. Mere technical error, routine encoding, authorized correction, data migration, system testing, or accidental corruption is not computer-related forgery unless the act results in inauthentic data and is accompanied by the intent required by law.

Statutory Modes

Section 4(b)(1) of Republic Act No. 10175 recognizes two punishable forms. The first punishes the making of inauthentic computer data through unauthorized data activity. The second punishes the knowing use of computer data that is the product of computer-related forgery.

The two modes may be committed by different persons. One person may create the forged data, while another, with knowledge of its character, may later submit, transmit, upload, present, or rely on it to carry out a dishonest design.

Elements of Forgery by Data Manipulation

The first mode has four essential elements. First, the offender inputs, alters, or deletes computer data. Second, the act is done without right. Third, the act results in inauthentic data. Fourth, the offender intends that the inauthentic data be considered or acted upon for legal purposes as if it were authentic.

Input means placing, entering, uploading, encoding, importing, generating, or causing computer data to be recorded in a computer system. It includes the creation of a fabricated electronic record, account credential, electronic certificate, approval entry, database value, payment confirmation, or digital identifier.

Alteration means changing existing computer data. It includes modifying the name of a payee, grade, license status, date, digital signature status, transaction amount, registry entry, audit trail, timestamp, or other data field in a way that affects the genuineness or legal effect of the record.

Deletion means removing computer data. Deletion may amount to forgery when the removal produces an inauthentic state of records, such as erasing a disqualification, cancellation, revocation, restriction, payment default, adverse notation, log entry, or other datum whose absence makes the remaining data appear genuine or legally valid.

The act must involve computer data, meaning a representation of facts, information, or concepts in a form suitable for processing in a computer system, including a program capable of causing a system to perform a function. The data need not be printed, signed by hand, or embodied in a traditional paper document.

Meaning of Without Right

The phrase without right covers conduct undertaken without authority or in excess of authority, as well as conduct not justified by law, court order, consent, established defense, or other lawful excuse. A person may have physical or technical access to a system yet still act without right if the act performed is outside the scope of the permission given.

An employee authorized to encode legitimate updates has no right to fabricate an approval, erase an adverse entry, or modify a database to create a false legal status. A system administrator authorized to maintain a platform has no right to plant false transaction records or create false validation logs. Authority to access is therefore different from authority to falsify.

Good faith matters because the offense requires both unauthorized conduct and a specific fraudulent intent. A mistaken entry corrected in the ordinary course, a restoration from backup, or a permitted system patch does not become forgery merely because computer data was changed.

Inauthentic Computer Data

Inauthentic data is data that falsely appears to be genuine, valid, authorized, complete, unaltered, issued by the proper source, approved by the proper person, or generated by the proper process. The core idea is not simply that the content is false, but that the data is made to pass as authentic for a legally relevant purpose.

Inauthenticity may relate to origin, authorship, approval, identity, integrity, time, sequence, status, certification, or completeness. A fabricated digital certificate, a manipulated public registry entry, a false electronic grade report, an altered land-tax record, a forged online receipt, or a deleted disqualification flag may all be inauthentic if the system state is made to appear legally genuine.

The law expressly applies regardless of whether the data is directly readable and intelligible. This clause is important because many legally significant digital records are readable only through software, forensic tools, cryptographic verification, database queries, or system interpretation.

Legal Purpose Requirement

The offender must intend that the inauthentic data be considered or acted upon for legal purposes as if it were authentic. Legal purpose is broader than litigation; it includes any setting where data may affect rights, duties, status, authority, eligibility, liability, ownership, payment, compliance, public records, contractual relations, or official action.

The required intent is present when forged computer data is meant to support the release of money, issuance of a permit, recognition of an identity, approval of a benefit, satisfaction of a regulatory requirement, cancellation of an obligation, creation of a credential, or alteration of a legally material record. The law does not require that the intended legal effect actually occur; the punishable act is the creation of inauthentic data with the prescribed intent.

A purely private prank, test entry, or internal dummy record normally lacks this element if it is not intended to be relied upon as authentic for any legal purpose. Once the data is designed to affect an official, contractual, evidentiary, financial, proprietary, or regulatory decision, the legal-purpose element is supplied.

Elements of Knowing Use

The second mode punishes a person who knowingly uses computer data that is the product of computer-related forgery. Its elements are: the existence of computer data produced by the first mode; the accused knows its forged character; the accused uses the data; and the use is for the purpose of perpetuating a fraudulent or dishonest design.

Use includes submitting, uploading, transmitting, presenting, displaying, validating, invoking, relying upon, or otherwise employing the forged data in a transaction, proceeding, application, claim, audit, verification, or system process. Possession or viewing alone is not the use punished by this mode unless the surrounding acts show employment of the forged data to advance a dishonest purpose.

Knowledge may be proved by direct evidence or by circumstances, such as participation in obtaining the false data, benefit from the falsification, concealment of the true source, inconsistent explanations, unusual access patterns, or coordinated use with the original forger. The user need not be the person who performed the input, alteration, or deletion.

The dishonest design requirement separates punishable use from innocent handling. A person who submits a forged electronic certificate believing it to be genuine lacks the required knowledge; a person who knows the certificate is forged and uses it to obtain a license, employment, payment, or official recognition commits the use mode.

Consummation and Damage

The first mode is consummated once unauthorized input, alteration, or deletion results in inauthentic data and the offender has the intent that the data be treated as authentic for legal purposes. Actual reliance, successful deception, and pecuniary loss are not elements of this mode.

The second mode is consummated by the knowing use of the forged computer data for a fraudulent or dishonest design. Actual completion of the design is not indispensable to liability, although actual damage may affect the fine, civil liability, proof of motive, and the presence of related offenses.

Because the statute punishes both creation and use, the same scheme may produce separate liabilities for different acts. The person who fabricates a false electronic record and the person who knowingly deploys it may both be liable, depending on their participation and intent.

Relation to Electronic Documents

Philippine law gives legal recognition to electronic documents, electronic data messages, and electronic signatures when their integrity, authenticity, and admissibility requirements are met. Computer-related forgery is the penal counterpart of that recognition: because electronic records may produce legal effects, their falsification may injure public faith in the same way as falsified paper documents.

An electronic record may be relevant even if no paper original exists. A database entry, system-generated certificate, electronically signed file, digital permit, online registry record, or transactional log may be the very record on which rights and obligations depend.

Authentication of electronic evidence remains a matter of proof. Logs, metadata, access records, hash values, timestamps, user credentials, database histories, backup comparisons, and forensic examination may be used to show what data existed, what changed, who caused the change, and whether the resulting data was inauthentic.

Relation to Falsification and Other Cybercrime Offenses

Computer-related forgery overlaps conceptually with falsification under the Revised Penal Code, but it is a distinct cybercrime offense focused on computer data. Traditional falsification centers on documents and legally significant written instruments; computer-related forgery centers on the authenticity of data processed, stored, transmitted, or generated by a computer system.

When a falsified electronic record also qualifies as a document or as evidence of a legal transaction, liability may implicate both ordinary falsification concepts and the special cybercrime statute. If a crime under the Revised Penal Code or a special law is committed by, through, and with the use of information and communications technology, Republic Act No. 10175 may also affect the applicable penalty under its cybercrime provisions.

Computer-related forgery should also be distinguished from computer-related fraud. Forgery focuses on making or using inauthentic data for legal purposes; computer-related fraud focuses on unauthorized input, alteration, or deletion of data, or interference in a computer system, that causes damage to property with fraudulent intent. A fabricated online payment record used to obtain money may involve both the inauthenticity of data and property damage, but the elements of each offense must still be proved.

It also differs from illegal access and data interference. Illegal access punishes access to a computer system without right. Data interference punishes the intentional or reckless alteration, damaging, deletion, or deterioration of computer data without right. Computer-related forgery requires the additional result of inauthentic data and the additional intent that it be legally treated as authentic, or the knowing use of such data for a dishonest design.

Participation, Attempt, and Aiding

Liability depends on the offender's act and mental state. One person may be liable for performing the unauthorized input, alteration, or deletion; another may be liable for knowingly using the forged data; others may incur liability if they intentionally assist, induce, facilitate, or attempt the cybercrime under the relevant provisions of Republic Act No. 10175.

A programmer who supplies a script specifically designed to fabricate approval records, an insider who provides credentials for the falsification, or a participant who coordinates the deployment of forged data may be treated according to the character and degree of participation proved. Mere technical capacity, neutral service provision, or presence in a communication channel does not establish liability without intentional participation or the required knowledge.

Attempt may arise where the actor begins the execution of the cybercrime by overt acts but the offense is not completed by reason of causes other than spontaneous desistance. The analysis remains tied to the statutory elements: there must be acts directed toward creating inauthentic computer data or toward knowingly using forged computer data for the prohibited design.

Penalty and Jurisdiction

A person guilty of computer-related forgery under Section 4(b)(1) is punished under the penalty provision for cybercrime offenses in Section 4(b): imprisonment of prision mayor, or a fine of at least Two Hundred Thousand Pesos up to an amount commensurate to the damage incurred, or both. Where aiding, abetting, or attempt is separately punished, the penalty is lower than that prescribed for the completed cybercrime, together with the applicable fine.

When the punishable act is knowingly committed on behalf of or for the benefit of a juridical person by a natural person holding a leading position, the juridical person may be subjected to the statutory corporate fine without extinguishing the criminal liability of the natural person who committed the act. Liability may also arise where lack of supervision or control by a leading person made the cybercrime possible for the benefit of the juridical person.

Regional Trial Courts have jurisdiction over violations of Republic Act No. 10175. Jurisdiction may attach when any element is committed in the Philippines, when the act uses a computer system wholly or partly situated in the country, when damage is caused to a person located in the Philippines, or when the offender is a Filipino national covered by the statute's jurisdictional rule.

Applications

Computer-related forgery may be committed by creating a false electronic diploma record intended to be relied upon by an employer, changing an online registry to show a non-existent license, deleting a cancellation entry so that a permit appears valid, fabricating an electronic receipt to prove payment, or manipulating a database so that a person appears qualified for a benefit or exemption.

It may also be committed by using forged computer data after the falsification is complete, such as submitting a fabricated online certificate to a government office, presenting an altered electronic transaction record to claim reimbursement, uploading a manipulated credential for employment, or relying on a forged electronic approval to induce release of funds.

The decisive inquiry is whether the computer data has been made or used as a false token of legal authenticity. If the data is inauthentic, the act was without right, and the required intent or knowing dishonest use is present, the offense falls within computer-related forgery even if the data is invisible to ordinary readers, exists only inside a database, or can be understood only through technical verification.