The organisation, its staff and those acting for it must not, without right, access a computer system (illegal access), intercept non-public transmissions by technical means (illegal interception), alter, damage, delete or deteriorate data or introduce viruses (data interference), hinder the functioning of a computer or network (system interference), make, sell, distribute or possess devices, programs, passwords or access codes intended for these offences (misuse of devices), or acquire in bad faith a domain name confusingly similar to a registered trademark or another person's name (cyber-squatting). The IRR (Rule 2, Section 4(A)(5)) exempts use or possession of such tools for the authorised testing of a computer system; 'without right' means without or in excess of authority or outside recognised defences. Penalty prision mayor or a fine of at least PHP 200,000 up to the damage caused (misuse of devices up to PHP 500,000); against critical infrastructure, reclusion temporal or a fine of at least PHP 500,000. The Supreme Court upheld illegal access, data interference and cyber-squatting in Disini (2014), and aiding, abetting and attempt remain punishable for all of these.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.