Rules 2.8 – 2.10 PNP Operational Procedures

2.8 Rules on Anti-Illegal Drugs Operations

a. General Policy and Guidelines:

The Philippine Drug Enforcement Agency (PDEA) is mandated by law to carry out the provisions of the Comprehensive Dangerous Drugs Act of 2002 (RA 9165), as amended by RA 10640. It serves as the implementing arm of the Dangerous Drugs Board (DDB) and is responsible for the efficient and eﬀective enforcement of all the provisions of the aforementioned act on any dangerous drug and/or controlled precursor and essential chemicals (CPECs).
Only PNP Drug Enforcement Group Special Operation Units (PDEG SOUs) and Drug Enforcement Units (DEUs) of LPUs are authorized to conduct Anti-Illegal Drug Operations and to coordinate with PDEA.
All other operating units are only allowed as support in the conduct of joint operations with PDEG and/or the concerned DEUs.
The PNP is not prevented from conducting warrantless arrests in relation to violations of RA 9165 as amended under Section 5, Rule 113, and search incidental to a lawful arrest under Section 13, Rule 126 of the Revised Rules of Criminal Procedure.
Information concerning parcels containing dangerous drugs, CPECs, and drug paraphernalia shall be reported to PDEA, through the Inter-Agency Drug Interdiction Task Group. The PNP shall provide the necessary support and assistance to the task group if required.

b. Coordination Requirements

Prior to the conduct of all anti-illegal drug operations, PNP anti-drug units shall coordinate with PDEA Regional Operation Center (ROC), and the LPU having jurisdiction over the area of operation. Coordination shall be made personally with PDEA ROC to secure a Certificate of Coordination (COC);
PDEA anti-illegal drug operations shall be coordinated with the concerned LPU, prior to the conduct of the operation. The PDEA’s Pre-Operation Report and Coordination Form (Annexes “R” and “S”) shall be received and stamped by the Duty Officer of the LPU indicating his/her name, signature, time, and day of coordination;
All operating units shall furnish the concerned LPU a copy of the After-Operation Report immediately after the termination of every anti-illegal drug operation;
There shall only be one COC for every anti-illegal drug operation following the “One-Jurisdiction, One-Operation” rule, wherein only one anti-illegal drug operation against a particular suspect/s covering a specific area at a given time shall be conducted;
Copies of reports pertaining to other police operations that resulted in the arrest of a person/s and/or seizure/confiscation of dangerous drugs, CPECs, and drug paraphernalia shall be furnished to PDEA for record purposes;
The PDEG SOUs may conduct anti-illegal drug operations nationwide, even in areas where there is an ongoing anti-illegal drug operation provided that the area of operation is specifically identified, and details shall be provided in the Pre-Operation Report and a Coordination Form;
In instances that the operating PDEG SOUs and DEUs shall move to another area not mentioned in the COC, a new Pre-Operation Report and Coordination Form shall be submitted to PDEA. When personal coordination cannot be made, online submission of requirements for application for issuance of COC is permitted. Only the control number shall be submitted after the operation in exchange for the original COC, provided that the principle of “OneJurisdiction, One-Operation” rule shall apply; and
The PNP shall at all times submit to PDEA ROC copies of operational reports such as Spot Report, Negative Operation Report, and Progress Report after the conduct of any anti-illegal drug operation.

c. Handling, Custody, and Disposition of Drug and Non-Drug Evidence (DOJ, 2020).

During the handling, custody, and disposition of evidence, the provisions of Section 21, R.A. No. 9165 and its IRR as amended by R.A. No. 10640 shall be strictly observed. Noncompliance, under justifiable grounds, with the requirements of Section 21 (1) of R.A. no. 9165, as amended, shall not render void, and invalid such seizures and custody over the items provided the integrity and the evidentiary value of the seized items are properly preserved by the apprehending officer/team.

Any justification or explanation in cases of non-compliance with the said requirements shall be clearly stated in the sworn statements/affidavits of the apprehending arresting/seizing officers, as well as the steps taken to preserve the integrity and evidentiary value of the seized/confiscated items. Photographs of pieces of evidence must be taken immediately upon discovery of such, including the process of recording the inventory in the presence of required witnesses.

The seizing officer must mark all the evidence seized with his/her initials and signature as well as the date when the evidence was found/recovered or seized, numbered consecutively.

1) Drug Evidence

Upon seizure or confiscation of dangerous drugs or CPECs, laboratory equipment, apparatus, and paraphernalia, the operating unit’s seizing officer/inventory officer must conduct the photographing, marking, and physical inventory in the place of operation in the presence of:
1. The suspect/s or the person/s from whom such items were confiscated and/or seized or his/ her representative or counsel;
2. An elected public official; and
3. Representative from the National Prosecution Service (NPS) or media, who shall affix their signatures and who shall be given copies of the inventory. The Chain of Custody Form for Drug Evidence, Non-Drug Evidence, and for Laboratory (Annex “T”, “U” and “V”), whichever is applicable, shall also be accomplished together with the Certificate of Inventory of Seized Items (Annex “W”).
For seized or recovered drugs covered by search warrants, the photographing, marking and inventory must be done in the place where the search warrant was served.
For warrantless seizures like buy-bust operations, the photographing, markings, and physical inventory must be done at the place of apprehension, unless for justifiable reasons, the photographing, markings and physical inventory may be made at the nearest police station or office of the apprehending officer or team, ensuring that the integrity and evidentiary value of the seized items remain intact and preserved. Such justification or explanation as well as the steps taken to preserve the integrity and evidentiary value of the seized/confiscated items shall be clearly stated in a sworn affidavit of justification/explanation of the apprehending/seizing officers.
In cases when the execution of a search warrant is preceded by warrantless seizures, the photographing, marking, and inventory of the items recovered from the search warrant shall be performed distinctly and separately from the photographing, marking, and inventory of the items seized from warrantless seizures.
In case of seizure of plant sources at the plantation site, where it is not physically possible to count or weigh as a complete entity, the seizing officer shall estimate its count or gross weight, as the case may be. If it is safe and practicable, the photographing, marking, and inventory of the seized plant sources may be performed at the plantation site. Representative samples of prescribed quantity pursuant to DDB Board Regulation No. 1, series of 2002, as amended, and/or DDB Board Regulation No. 1, series of 2007, as amended, shall be taken from the site after the seizure for laboratory examination, and retained for presentation as the corpus delicti of the seized/confiscated plant sources following the chain of custody of evidence.
Whenever necessary, the dangerous drugs and/or CPECs seized shall be properly packed, sealed, and marked with the initials and signature of the seizing officer as well as the date when the evidence was found/recovered or seized, numbered consecutively.
Within the same period, the seizing or inventory officer shall prepare an Inventory Sheet which shall include but not limited to the following:
1. Time, date, and place of occurrence/seizure.
2. Identity of person/s arrested.
3. Identity of the seizing officer and all persons who witnessed the marking and inventory;
4. Type of operation (e.g. warrantless seizure, buy-bust, etc.)
5. Description of the vehicle, vessel, place, or person searched from where/whom the substance was found.
6. Description of packaging, seals, and other identifying marks.
7. Quantity of the seized items.
8. Description of the substance found
As far as practicable, all seized dangerous drugs and/or CPECs shall be immediately submitted to the PNP Crime Laboratory (CL) for examination and proper disposition.
Upon submission of the drug evidence to the PNP CL for examination, all the phases of turn-over of evidence must have corresponding receipts to show the continuance of chain of custody.

2) Non-Drug Evidence (to be covered in a separate inventory sheet and chain of custody form)

The following pieces of non-drug evidence shall be photographed, marked, and inventoried:
1. Buy-bust/marked money, if applicable.
2. For motor vehicles and other forms of transportation (e.g. vessel/banca, bicycle, airplane): plate number/ conduction sticker number, color, model, make and type, and description.
3. For firearms: serial number, model, make and caliber, kind, and type.
4. For explosives (after observing safety protocol from EOD unit): description and type.
5. For other deadly weapons (e.g. knives): description, measurement, quantity.
6. For smaller pieces of evidence (e.g. ammunition): pertinent information such as quality, quantity, and place where it was seized/recovered.
For digital evidence such as computers, cell phones, laptops, other similar gadgets, and storage peripherals (e.g. ﬂash drives, cd) the same shall likewise be photographed, marked, and inventoried;
For documentary evidence, the same procedure regarding photographs, marking, and inventory shall be followed; and
For motor vehicles, vessel/banca, firearms, and digital evidence, the same are subject to verification and processing by the LTO, Firearms and Explosive Division (FED), AntiCybercrime Group (ACG), and MG as the case may be.

3) Chain of Custody

To ensure the preservation of the integrity and identity of the drug evidence, the chain of custody form shall indicate:
1. The time and place of the search;
2. The names of the officers who marked inventoried and sealed the seized items;
3. Location of the evidence at the time it was found. If the same was seized from an individual, it should note exactly where on the person the evidence was found (e.g. right front pocket);
4. Type of operation for which the evidence was obtained (e.g. evidence of a sale, implementation of a search warrant);
5. Item numbers of the seized items in a numerical sequence consistent with the inventory sheet;
6. Detailed description of the article at the time it was seized.
7. Names of officers who took custody and in what capacity they received the evidence from one officer to another within the chain; and
8. Time and date every time the transfer of custody of the same evidence was made in the course of safekeeping until submitted to laboratory personnel for forensic laboratory examination and presentation in court.
The receipt of evidence must be acknowledged by all officers receiving the evidence, whether in the same or a separate document. Such receipt shall form part of the case folder of the transmitting unit.
The evidence custodian, when applicable, must maintain a logbook that contains information on:
1. The person who turned in the evidence for safekeeping;
2. The date and time thereof;
3. The person who received it;
4. The person who requested the same for whatever purpose, who shall affix his/her name, signature, date, and time in the logbook.

When a piece of evidence is turned in, the custodian should check the identification mark on the piece of evidence to ensure that it is the same item and determine that the item is in the same condition as when it was discovered. Any change in the physical appearance of the evidence should be noted and recorded.

2.9 Rules on Anti-Kidnapping Operations

The Anti-Kidnapping Group (AKG) is the PNP’s lead unit in the conduct of anti-kidnapping operations in close coordination with the LPU, other law enforcement agencies, and the community (Annex “X”).

a. Types of Kidnapping

1) Kidnapping by Organized Crime Group (OCG)/Criminal Group (CG)
2) Kidnapping by Terrorists Groups (TG)
3) Kidnapping by Other Individuals

b. Concept of Operation

Upon receipt of the kidnapping incident report at the police station, the Desk Officer shall record the same in the blotter book. The COP and the investigator shall immediately make an initial assessment of the reported incident.

If the initial assessment has been confirmed that it is indeed a kidnapping incident, the case shall be referred to the AKG, otherwise, the incident shall be handled by the concerned LPU.

AKG will form an evaluation team composed of members of the quad staﬀ and duty officer of the day. They will assess and evaluate the complaint to determine the appropriate operational response.

Kidnapping by Organized Crime Group/Criminal Group
1. If it is assessed as a kidnapping incident by OCGs/CG, AKG will immediately activate the Anti-Kidnapping Action Team (AKAT) which will handle the investigation, negotiation, operation, and intelligence aspect of the case.
2. The AKAT shall be supported by the concerned LPU and other units.
3. The AKAT will only be deactivated when the victim is rescued and a case is filed.
Kidnapping by Terrorist Groups
1. If the case is assessed as a kidnapping perpetrated by TGs, AKG will request for the activation of the Critical Incident Management Task Group (CIMTG). In case the Joint PNPAFP Task force or Crisis Management Committee (CMC), as the case may be, is activated the PNP shall provide full support and cooperation.
2. If the incident happens in Mindanao involving local TGs, the Special Task Force (STF) will be activated with the Deputy Director of the concerned DIPO as the STF head. The STF shall serve as the primary intelligence and operational arm of the PNP against KFR groups operating in Mindanao. It shall establish a coordinative line with the CMC.
Kidnapping by Other Individuals
1. If the alleged kidnapping incident, which is not within the AKG’s mandate, is perpetrated by other individuals, the concerned LPU shall take the appropriate operational response. Otherwise, the AKG shall take cognizance of the incident and handle it accordingly.
2. If the kidnapping incident involves a foreign national as a victim, the following shall be undertaken:

1. 1. By Local Police Unit:
    1. Determine the nationality and other personal circumstances of the foreign kidnapped victim;
    2. Establish the identity and the relationship of the reportee to the kidnapped victim;
    3. Notify the Bureau of Immigration (BI) and his/her embassy/consulate office, as the case may be, and request said office to provide assistance to their citizen like interpreters for non-English speaking complainants, consular assistance, etc; and
    4. Make a thorough assessment and determine if the complaint falls under the category of a Kidnapfor-Ransom (KFR) case and refer it to the AKG if validated;
  2. By AKG:

1. 1. 1. Record all complaints referred by other PNP units, the Office of the CPNP, and other law enforcement agencies at the complaint section. The complaint will be attended by the Initial Assessment Team;
    2. Require the complainant to show proof of identity during the initial assessment and properly record the documents presented;
    3. Assist the complainant to secure the required documents from his/her embassy if the required documents are missing, and
    4. Inform the Embassy of the victim and request their assistance.

2.10 Cybercrime and Cyber-Related Incident Response Operations

[a] Cybercrime Response.

Cybercrime Response is the actual police intervention in a cybercrime or cyber-related incident where the acquisition of matters of evidentiary value is traceable within the computer’s hardware, software and its network.

[b] Guidelines in Responding to Cybercrime and Cyber-Related Incidents

When responding to a cybercrime incident, or to a crime scene where Information and Communication Technology (ICT) equipment (e.g computers, digital storage devices and other electronic devices or equipment) are present, it is imperative for the First Responder (FR) to protect and preserve the crime scene and seek the assistance of the station IOC to identify potential evidence such as the following:
1. Contraband or fruits of a crime;
2. Tools used for the commission of the crime; and/or
3. Other items that may be used in the commission of the crime.
The FR shall immediately coordinate with the nearest ACG ofce, through the station TOC or the IOC, for assistance. Upon arrival of the ACG personnel, they shall immediately conduct the “bag and tag” procedure on the digital evidence and turn over to the IOC.
The concerned investigating unit shall secure and submit a court order and necessary legal requirements for the ACG to conduct digital forensic examination that is in accordance with the rule on cybercrime warrants. The evidence seized shall then be subjected to digital forensic examination by the PNP ACG. The result of the forensic examination, as well as the testimony of the forensic expert, shall be made available during the trial.

[c] Preservation of Seized Computer

Upon determination of how the computer was utilized in the commission of the crime, and once the legal requirements have been complied with, the following are the guidelines in the preservation of the seized computer:

Secure the Scene
1. Officer’s safety is always paramount.
2. Preserve the area for potential fngerprints.
3. Immediately restrict access to the computer.
4. Disable the internet connection to restrict remote access to the computer
Secure the computer as evidence
1. If the computer is “OFF”, do not turn it “ON”.
2. If the computer is “ON”, do not turn it “OFF”, nor touch its mouse or its keyboard.
For stand-alone connection or single area connection computers (non-networked)
1. Consult a Digital Forensic Examiner.
2. If a Digital Forensic Examiner is not available, the station IOC shall perform the following:
  1. Photograph screen and disconnect all power sources and plugs including those at the back of the computer;
  2. Cover or put a tape over each drive slot;
  3. Photograph (or make a diagram) and label parts located at the back of the computer including its connections;
  4. Label all connectors and cable end to allow reassembly as needed (Example: “Socket” marked “A” and the “cable End” also marked “A”);
  5. If transport is required, pack the components as “fragile cargo” prior to transport;
  6. Keep it away from magnets, radio transmitters, and from other hostile environment; and
  7. Ensure that only the Digital Forensic Examiner conducts the search for any evidence contained in the computer hardware;
For Networked Computers (or business computers)
1. Consult a Digital Forensic Examiner for assistance.
2. Do not immediately pull the plug to prevent the following:
  1. Severe damage to the system;
  2. Disrupting the legitimate business; and
  3. Possible liability of the police officers.
For Ransomware or Malware Attack on a Computer
1. Consult a computer specialist for assistance;
2. Immediately disconnect the computer from the network to avoid the spread of malware to other computers on the same network; and
3. Do not immediately pull the plug and wait for the computer specialist to arrive.

[d] Guidelines in the Treatment of Other Electronic Data Storage Devices

The IOC should understand that other electronic devices may contain viable evidence associated with the crime. The IOC must ensure that the device should not be accessed unless a warrant has been issued.

[e] Preservation of Seized Mobile Communication Devices

Upon determination of how the mobile communication device was utilized in the commission of the crime the following are the guidelines to be followed:

If the device is turned “ON”, do not turn it “OFF” as it could activate lockout feature
1. Take a photograph of the screen display and write down all information therein;
2. If possible, turn on airplane/ﬂight mode or use a signal blocking container, if available, and record the steps undertaken;
3. If the device is locked, do not attempt to unlock it; and
4. Bring the power supply cord of the seized device found at the scene.
If the device is TURNED “OFF”, leave it “OFF” AS IT could alter evidence in the device.

f. Preservation of Seized Facsimile or Fax Machine or Similar Devices

If the fax machine is “ON”, do not turn it “OFF” as it may cause the loss of the last number dialed or other stored fax numbers. If possible, all manuals
should be seized along with the machine. Photographs of the machine and its display shall be taken.

g. Preservation of Seized Caller ID Devices and Other Similar Devices

The IOC should be able to recognize potential evidence contained in caller ID devices such as telephone numbers and subscriber’s information from incoming phone calls.
The IOC should remember that interruption of the power supply of the caller ID device may cause loss of data if not protected by an internal battery back-up.

h. Guidelines in the Treatment of Seized Digital Video Recording (DVR) Devices

The IOC should be able to recognize potential evidence contained in DVR devices such as the date and time of occurrence and the persons viewed on the video captured by the Audio and Video Recorder (AVR) and camera devices; and
The IOC should secure a warrant for the conduct of forensic examination/enhancement of audio video recorded by the DVR device.

i. Acquiring the DVR Devices and/or their Footages/ Recording

The IOC shall send a Preservation Letter (Annex “Y”) addressed to the DVR device owner directing him/her to keep, retain and preserve the footages/recordings; and
A court order or a notarized afdavit of consent together with the photocopy of valid ID from the DVR device owner or authorized administrator must be secured to obtain the original and/or duplicate copies of footages/recordings.

Next: The Rules 3 – Internal Security Operations

Click “Continue” to proceed or previous” to review the previous module.