The Department of Justice (DOJ) has advised that only law enforcement agencies (LEAs) can gather digital evidence in cybercrime cases because, unlike physical evidence, “computer data is volatile, fragile, and easily alterable.”

It pointed out that the integrity of a cybercrime prosecution hinges on “an unbroken chain of custody.”

This was pointed out by DOJ Acting Secretary Frederick A. Vida in his Office of Cybercrime (OOC) Advisory Opinion No. 001, Series of 2026, that was issued last Jan. 22 and meant “to preserve the integrity of prosecutions against technical dismissals.”

Addressed to the DOJ’s National Prosecution Service (NPS), the National Bureau of Investigation (NBI), and the Philippine National Police (PNP), Vida said the Guidelines for Cybercrime Investigation and Prosecution (GCIP) which was launched in 2024 shall serve as “the sole and uniform standard for cybercrime investigation and forensic examination.”

He said that “manuals, protocols, or guidelines issued by agencies other than the DOJ and authorized LEAs are without legal basis for criminal prosecution and must not be utilized in case build-up or court proceedings.”

To preserve the chain of custody and prevent evidence contamination, Vida said “the actual conduct of raids, service of warrants, and seizures of devices must be performed exclusively by LEAs recognized by law and the Rules of Court to exercise such powers.”

He pointed out that “personnel from administrative agencies or non-law enforcement bodies must not participate in the physical processing of the crime scene or the forensic examination of seized evidence to ensure that the integrity of the evidence remains uncompromised.”

He then instructed LEAs to maintain full operational control over cybercrime investigations.

“While inter-agency cooperation is encouraged for policy formulation, the execution of enforcement operations remains the non-delegable duty of the LEAs to ensure that no unauthorized contact contaminates the evidence,” he also said.

Thus, he added that the intervention of personnel from administrative agencies or entities not vested with law enforcement power poses a fatal risk to the case.

“Under the Fruit of the Poisonous Tree doctrine, evidence obtained through irregular procedures or by entities without legal authority is susceptible to suppression and inadmissibility,” Vida stressed.

Citing Section 10 of the Cybercrime Prevention Act of 2012 and the Supreme Court’s Rule on Cybercrime Warrants, Vida also reminded that “the authority to implement cybercrime warrants is strictly limited to LEAs.”