Proving the Identity of Social Media Accounts in Criminal Cases — The Santos vs Reyes Case

This article talks about how to prove social media accounts in criminal cases in the Philippines.

Proving who owns, controls, or authored content from a social media account is now a central evidentiary issue in many Philippine criminal prosecutions, especially those involving online harassment, libel, or violence against women and children. The problem arises from ease of creating fake or anonymous accounts, shared devices, and ephemeral communications. Courts have therefore developed guideposts—grounded in statutory law, procedural rules, and Supreme Court jurisprudence—to determine identity and attribute online acts to particular persons (Santos v. Reyes, G.R. No. 274842, 22 October 2025).

Governing laws, rules, and issuances

• Rules on Electronic Evidence — authentication requirements for electronic documents and ephemeral communications (A.M. No. 01-7-01-SC, Rule 5; Rules on Electronic Evidence).
• Rule on Cybercrime Warrants — procedures for WDCD, preservation and disclosure of electronic data (A.M. No. 17-11-03-SC, Rule on Cybercrime Warrants, Sec. 4.2).
• Revised Rules of Criminal Procedure — integration of electronic evidence with criminal procedure (Revised Rules of Criminal Procedure).
• Relevant statutes: Anti-Violence Against Women and Their Children (RA 9262) when harassment/psychological violence is charged; Cybercrime Prevention Act (RA 10175) when computer data is involved.
• Supreme Court decisions: Santos v. Reyes (G.R. No. 274842, 22 Oct. 2025) — guideposts for proving social media account ownership; Rules on Electronic Evidence (A.M. No. 01-7-01-SC) — authentication; cases on identification and moral certainty (e.g., People v. Caliso, G.R. No. 183830, 2011; People v. Maguing, G.R. No. 144090, 2003).

Core requirements and guideposts (doctrinal foundation)

The Court in Santos articulated non‑exclusive factors to establish ownership, access, or authorship of a social media account. Proof may rest on a combination of the following, evaluated under the totality of circumstances:

• Admission of ownership or authorship (Santos v. Reyes, G.R. No. 274842).
• Witness testimony that the suspect was seen accessing the account or composing posts (Rules on Electronic Evidence; Santos v. Reyes).
• Content bearing information known only to the suspect or a small circle (phraseology, nicknames, circumstances) (Santos v. Reyes).
• Language, tone, or style consistent with the suspect’s previous communications (Santos v. Reyes).
• Technical records and forensics: account metadata, IP logs, device identifiers, geolocation, timestamps from the service provider, and preserved data pursuant to a Warrant to Disclose Computer Data (WDCD) or similar order (A.M. No. 17-11-03-SC, Sec. 4.2; Santos v. Reyes).
• Device forensic analysis (extracted messages, app logs) linking the account to the suspect’s device (Rules on Electronic Evidence; Rule on Cybercrime Warrants).
• Pattern of acts consistent with prior posts or messages from the same account (Santos v. Reyes).

These guideposts reflect the twin legal foundations: (1) the burden of authentication for electronic evidence (Rules on Electronic Evidence, Rule 5), and (2) the criminal-law requirement that identity of the perpetrator be proved beyond reasonable doubt (People v. Maguing, G.R. No. 144090).

Procedures to obtain technical evidence

• Seek preservation and production: apply for preservation or WDCD under the Rule on Cybercrime Warrants to compel ISPs/social media platforms to preserve and disclose subscriber and transactional data (A.M. No. 17-11-03-SC, Sec. 4.2).
• Secure a disclosure order or search warrant tailored to specific data items (account ID, IP addresses, device IDs, login timestamps). (Rule on Cybercrime Warrants; Cybercrime statutes.)
• Conduct device forensics through qualified examiners: obtain search/seizure and forensic imaging that follows chain-of-custody and forensically sound procedures (Rules on Electronic Evidence).
• Authenticate ephemeral communications (text messages, Messenger threads) through testimony of participants or admissible printouts accompanied by corroborating metadata (Rules on Electronic Evidence, Section on ephemeral communications).

Exceptions, limitations, and evidentiary weight

• A single factor is seldom dispositive; courts apply the totality of circumstances and seek moral certainty for criminal conviction (People v. Caliso; People v. Maguing).
• Technical evidence from platforms outside the Philippines may require additional procedural steps (letters rogatory or cooperation with providers), and the probative value depends on chain-of-custody and provider’s logs (Rule on Cybercrime Warrants).
• Data privacy and statutory protections (Data Privacy Act) must be respected; disclosure should conform to legal orders and safeguards (Based on internal knowledge of Philippine law).
• Mere presence of a profile photo or public posts is suggestive but insufficient alone; courts look for corroborating evidence (Santos v. Reyes).

Practical implications and typical scenarios

Example 1 — Online harassment: Victim presents screenshots of Facebook posts calling her names. To prove defendant authored posts, prosecution should: obtain WDCD for the account (A.M. No. 17-11-03-SC, Sec. 4.2), secure witness testimony that the defendant used the account, and show content containing unique facts known to defendant (Santos v. Reyes).

Example 2 — Anonymous threatening messages: If messages originate from a phone number, secure subscriber information from telco via WDCD and perform device forensics to match SIM/IMEI and timestamps (Rule on Cybercrime Warrants; SIM Registration Act, RA 11934).

Practical advice for victims and practitioners:

• Preserve screenshots with visible timestamps and URLs; note context and witnesses.
• Promptly request preservation orders to avoid deletion.
• Engage a digital forensic expert early.
• When seeking disclosures, specify exact data sought (IP addresses, login logs, message headers) per WDCD requirements (A.M. No. 17-11-03-SC, Sec. 4.2).

Best practices for courts and investigators

• Apply totality-of-circumstances analysis; avoid overreliance on single indicators (Santos v. Reyes; People v. Caliso).
• Ensure proper chain-of-custody and adherence to Rules on Electronic Evidence for authentication (A.M. No. 01-7-01-SC, Rule 5).
• Balance privacy interests with investigatory needs by using narrowly tailored orders (Rule on Cybercrime Warrants; Data Privacy Act considerations).

Summary

• Burden: Prosecution must prove identity beyond reasonable doubt; electronic evidence must be authenticated (Rules on Electronic Evidence; People v. Maguing).
• Guideposts: admission, observed access, unique knowledge, language/style, technical logs, and device forensics (Santos v. Reyes).
• Procedure: Use WDCD/preservation orders and forensics; specify precise data sought (A.M. No. 17-11-03-SC, Sec. 4.2).
• Caution: Single indicators (photo, name) are insufficient alone; apply the totality of circumstances (Santos v. Reyes; People v. Caliso).

06 January 2026

About Nicolas and De Vega Law Offices

 Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.