Legal Vulnerability Research Philippines: Authorization

Direct answer

Vulnerability research is legal in the Philippines when the system owner has authorized it. Section 4(a)(1) of the Cybercrime Prevention Act punishes access to a computer system “without right,” and the Supreme Court in Disini v. Secretary of Justice said an ethical hacker’s prior permission from the client insulates the work from that offense. There is no broad statutory safe harbor for unauthorized good-faith testing. Obtain written authorization defining targets, methods, dates and reporting rules before testing. If you find a flaw by accident, stop, keep minimal evidence and report it through the owner’s channel.

Authority-to-action bridge

Question	Cybercode answer
What the authority says	RA 10175 penalizes illegal access and related conduct; authorization and scope are central to whether access is “without right.”
What it means	A public website is not blanket permission to scan, bypass controls, access records or test other users’ accounts.
What changes the answer	A clear vulnerability-disclosure policy, bug-bounty scope, contract or written owner authorization can materially change the risk.
What to do next	Get scope in writing, minimize data access, avoid persistence or disruption, and document a responsible disclosure timeline.

Key takeaways

Good intentions are not a substitute for authorization.
A bug-bounty program protects only activity within its published scope and rules.
Do not access real customer records merely to prove impact.
Rate limits, credential testing, social engineering and denial-of-service tests need explicit treatment.
Keep an audit trail showing what was tested, when, from where and under whose authority.

The legal boundary: access with or without right

Section 4(a)(1) of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175) defines illegal access as “the access to the whole or any part of a computer system without right.” Other offenses in Section 4 may be implicated by interception, interference, misuse of devices, fraud or identity-related conduct, depending on the facts. For how the Section 4 offenses and their penalties fit together, see CyberCode’s guide to RA 10175 Sections 4 and 6.

The Supreme Court upheld Section 4(a)(1) in Disini v. Secretary of Justice, G.R. No. 203335 (11 February 2014). Answering the concern that it could catch ethical hackers, the Court said: “Since the ethical hacker does his job with prior permission from the client, such permission would insulate him from the coverage of Section 4(a)(1).” It described that agreement as one fixing the extent of the search, the methods to be used and the systems to be tested. The same decision held that the aiding-or-abetting and attempt provisions of Section 5 validly apply to illegal access, so helping or attempting unauthorized access is also exposed.

Personal data adds a second exposure. Section 29 of the Data Privacy Act of 2012 (Republic Act No. 10173) punishes a person who knowingly and unlawfully “breaks in any way into any system where personal and sensitive personal information is stored” with one to three years’ imprisonment and a fine of ₱500,000 to ₱2,000,000. That is why a proof of concept should stop short of opening real records.

Authorization should come from a person who actually controls the relevant system. Permission from a customer, employee or reseller may not cover the platform, cloud tenant, third-party API or data of other users. Scope should identify domains, IP ranges, accounts, techniques, time window and prohibited actions.

Data privacy duties still matter during authorized testing. Researchers should use synthetic accounts, minimize personal-data exposure, encrypt evidence, restrict access and delete material after remediation and verification under an agreed process.

Evidence to preserve

A well-kept authorization and activity record protects both the system owner and the researcher.

Signed authorization, statement of work or published vulnerability-disclosure policy.
Exact in-scope assets, dates, test accounts and permitted techniques.
Source IPs, tools, commands, timestamps and request identifiers.
Minimal proof of concept that avoids unnecessary personal data.
Disclosure emails, acknowledgments, remediation updates and agreed publication date.

Your options: where to report a vulnerability

Situation	Where to go and why	What to bring
The owner has a bug-bounty program, disclosure policy or security contact	Report only through that channel and within its scope. The program’s terms are the written permission Disini treats as decisive.	Asset, finding, minimal proof of concept, timestamps, your source IPs and a copy of the program terms as they read on the test date.
No published channel, or the owner does not respond	DICT’s CERT-PH, whose mandate is to receive, review and respond to computer-security incident reports, through its report-an-incident page. It can coordinate with the owner; it cannot authorize testing after the fact.	The same technical record plus your prior contact attempts.
Government website or system	Use the agency’s own security contact if published, otherwise CERT-PH. Do not keep testing to prove impact.	Same as above.
You receive a demand letter, subpoena or police invitation	Stop all testing and talk to counsel before giving a statement; the Public Attorney’s Office is an option if you qualify. Preserve your authorization and logs.	Authorization documents, correspondence and your activity log.
You run the system and receive a report	Acknowledge, triage and fix. If personal data was actually exposed, assess whether the NPC’s 72-hour breach-notification criteria are met (NPC breach reporting).	Report, logs, affected data, containment steps and decision record.

Deadlines: no Philippine statute fixing a vulnerability-disclosure or publication period was verified; agree a remediation and publication timeline with the owner in writing. The only fixed clock found here is the owner’s NPC notification duty for a notifiable personal-data breach.

What to do next

Identify the legal owner and technical operator of every target asset.
Obtain written authorization and resolve conflicting terms before testing.
Use dedicated accounts and the least intrusive method that can validate the issue.
Stop when a test reaches real data, out-of-scope infrastructure or instability.
Preserve minimal evidence securely and notify the designated contact.
Agree on remediation, retest and publication timelines; do not threaten disclosure for payment.
If discovery was accidental and no policy exists, stop and seek a safe reporting channel or legal advice.

Common mistakes

Assuming robots.txt, an open port or a public API is consent to test.
Continuing after the program says an asset is out of scope.
Downloading a database to prove that records are accessible.
Publicly disclosing exploit details before users can be protected.

Frequently asked questions

Does responsible disclosure guarantee immunity?

No. It reduces risk when supported by clear authorization and disciplined conduct, but it is not a universal legal shield. Follow the owner’s written policy and obtain clarification where scope is unclear.

Can I scan Philippine government websites?

Do not assume permission. Government systems can involve heightened security, service-continuity and sensitive-data concerns. Use an official disclosure or authorization route.

What if the company ignores my report?

Do not expand access or use threats. Preserve the timeline, send a concise follow-up through official contacts, consider a coordinator or counsel, and disclose only after assessing legal and safety risks.

Related Cybercode guides

Official sources

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Sources rechecked as of: 28 September 2026

Legal Vulnerability Research in the Philippines: Authorization and Safe Disclosure