Access Devices Regulation Act of 1998

Do you still remember the ILOVEYOU virus? (See a report by CNN here) A virus later on found to have been written by a Filipino student/programmer, Onel de Guzman, wreaked havoc across the globe in the early part of 2000. With the help of foreign experts, the Philippine National Bureau of Investigation (NBI) identified the perpetrator but didn't know what to charge him with. At that time, there was no law yet penalizing "hacking".

For a while they used this law, the Access Devices Regulation Act of 1998, for the reason that the program is designed to steal passwords. The law, Section 9 (Prohibited Acts) of which is found below, was meant to "protect the rights and define the liablilities of parties in such commercial transactions by regulating the issuance and use of access devices" like automated teller machine cards (ATMs). Later on, the NBI, or was it the Department of Justice (DOJ), decided the law could not be used.

Sec. 9. Prohibited Acts. — The following acts shall constitute access device fraud and are hereby declared to be unlawful:

(a) producing, using, trafficking in one or more counterfeit access devices;

(b) trafficking in one or more unauthorized access devices or access devices fraudulently applied for;

(c) using, with intent to defraud, an unauthorized access device;

(d) using an access device fraudulently applied for;

(e) possessing one or more counterfeit access devices or access devices fraudulently applied for;

(f) producing, trafficking in, having control or custody of, or possessing device-making or altering equipment without being in the business or employment, which lawfully deals with the manufacture, issuance, or distribution of such equipment;

(g) inducing, enticing, permitting or in any manner allowing another, for consideration or otherwise to produce, use, traffic in counterfeit access devices, unauthorized access devices or access devices fraudulently applied for;

(h) multiple imprinting on more than one transaction record, sales slip or similar document, thereby making it appear that the device holder has entered into a transaction other than those which said device holder had lawfully contracted for, or submitting, without being an affiliated merchant, an order to collect from the issuer of the access device, such extra sales slip through an affiliated merchant who connives therewith, or, under false pretenses of being an affiliated merchant, present for collection such sales slips, and similar documents;

(i) disclosing any information imprinted on the access device, such as, but not limited to, the account number or name or address of the device holder, without the latter's authority or permission;

(j) obtaining money or anything of value through the use of an access device, with intent to defraud or with intent to gain and fleeing thereafter;

(k) having in one's possession, without authority from the owner of the access device or the access device company, an access device, or any material, such as slips, carbon paper, or any other medium, on which the access device is written, printed, embossed, or otherwise indicated;

(l) writing or causing to be written on sales slips, approval numbers from the issuer of the access device of the fact of approval, where in fact no such approval was given, or where, if given, what is written is deliberately different from the approval actually given;

(m) making any alteration, without the access device holder's authority, of any amount or other information written on the sales slip;

(n) effecting transaction, with one or more access devices issued to another person or persons, to receive payment or any other thing of value;

(o) without the authorization of the issuer of the access device, soliciting a person for the purpose of:

1) offering an access device; or

2) selling information regarding or an application to obtain an access device; or

(p) without the authorization of the credit card system member or its agent, causing or arranging for another person to present to the member or its agent, for payment, one or more evidence or records of transactions made by credit card.