Blog

Cybersecurity Incident Response

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

Here's why cybersecurity incident response is something your entire organization has to care about: Hackers are likely trying to invade your network, and security vulnerabilities likely make this easier than you would believe.

Indeed, we have evolved from a time when executive leaders were mostly disconnected from the information security function to an era where cybersecurity is top of mind for many such former naysayers. And for good reason: There's likely not a day that goes by that your organization isn't under attack or otherwise exposed to IT-related security risks.

 

Security threats and vulnerabilities, and the subsequent incidents and breaches that they can lead to, affect organizations of all kinds. Literally every business -- both large and small and across every industry -- is a target for criminal hackers and careless employees alike. The question is: What are you doing about it?

This is where incident response (IR) comes into play.

What is incident response?

Incident response is the process of detecting security events that affect network resources and information assets and then taking the appropriate steps to evaluate and clean up what has happened. Cybersecurity incident response is critical to today's businesses because, simply put, there is so much to lose. From the simplest of malware infections to unencrypted laptops that are lost or stolen to compromised login credentials and database exposures, both the short- and long-term ramifications of these incidents can have a lasting impact on the business.

Why do you need it?

Security breaches can require notification, resulting in customer distrust, reputation loss, regulatory fines, legal fees and cleanup costs. And these can all come at once -- in ways that even the most financially secure of businesses can have trouble absorbing.


Number of sensitive consumer records exposed

Consumer data exposure is escalating; records containing personally identifiable information reached nearly 450 million in 2018.

 

Networks, software and end users can only reach a certain level of resilience. Oversights will occur, and mistakes will happen. What matters is what you have done, in advance, to minimize the impact of a security incident on your organization. You can't prevent hackers from existing, but you can be proactive in prevention and response. That's why having a functional team, the proper technologies and a well-written incident response plan are essential for being able to respond to such events in a prompt and professional manner.

An important aspect of understanding incident response is fleshing out the necessary elements in your security program to differentiate between threats and vulnerabilities:

  • Threat: An indication or stimulus, such as a criminal hacker or dishonest employee, that's looking to exploit a vulnerability for ill-gotten gains.
  • Vulnerability: A weakness in a computer system, a business process or people that can be exploited.

Threats exploit vulnerabilities, which, in turn, create business risk. The potential consequences include unauthorized access to sensitive information assets, identity theft, systems taken offline, and legal and compliance violations.

Related terms include the following:

  • Breach: An incident where sensitive information, such as intellectual property or customer records, is exposed.
  • Hack (sometimes referred to as an attack): The act of a criminal hacker (or hackers) or a rogue user doing something such as taking your systems offline, planting or spreading malware, or stealing information assets.
  • Incident: An attack that's successful in draining computing resources, obtaining unauthorized access, or otherwise putting information assets and related network resources at risk.
  • Network (or security) event: A term that lawyers often to use to refer to potential security issues that haven't yet been confirmed or the details of which aren't ready to be released to outside parties or the public.

Attacks don't always lead to incidents, and incidents don't always lead to breaches. They're all considered network events and are often played down until the details can be obtained. It all depends on what took place and what can be determined after the fact.


How to take a proactive approach to incident response.

A proactive approach to incident response requires a cross-functional team, an updated plan, a solid framework, appropriate technology and a solution-oriented mindset.

 

The purpose of this guide is to give IT and enterprise security teams actionable strategies to meet today's security threats and vulnerabilities more effectively. This is regardless of whether you have an existing IR program or you're just getting started. It can also serve to help get business executives on board with this critical function of a well-run information security program and highlight ways users may need more security training. You can use this information to improve your incident response capabilities, share it with executive management to further their understanding and get buy-in on your security initiatives, and even use it as a basis for your policies and ongoing user security awareness and training efforts.

Building an IR team

A good incident response program starts with building a great team. Without the right people, security policies, processes and tools mean very little. An IR team is made up of a cross-functional group of people from diverse parts of the business, including IT and security, operations, legal and public relations. One or more of these roles could -- and should -- be at the executive management level. The reason for this is to ensure the highest level of decision-making and that the business's best interests are kept in mind.

What does an IR team do?

The overall goal of an incident response team should be to detect and respond to security incidents in order to minimize their impact on the business. Such teams are often referred to as a computer security incident response team (CSIRT) or a computer emergency response (or readiness) team (CERT). A larger group of IR professionals are often pulled together into a security operations center (SOC), whose scope is broader than incident response. The name of your IR team is largely irrelevant because its goals are the same.

Whatever the name, the IR team should be working to support its role in the overall incident response plan, which itself should complement the goals of your information security program and overall business. Team goals might include working on response times and impact minimization, conducting periodic meetings and performing tabletop exercises. In order for these goals to work, they need to be very specific, written in the present tense and include steps that must be accomplished along with deadlines to help with accountability. The following are examples of IR team goals that might be developed by the team itself or an overarching security committee:

  • We develop metrics for analyzing our IR program initiatives that involve monitoring and alerting, communication among team members, and technology evaluations.
  • We update our IR plan document periodically and consistently.
  • We create and execute three separate tabletop exercises for IR simulations.
  • We engage our security committee and executive management to report on incidents, actions taken and additional improvements needed for incident response.

The IR team -- or program manager -- would flesh out each of these goals with specific steps needed to meet each one, along with deadlines so that everyone on the team knows what's expected and what to aim for.


Steps for building an IR team
Building your IR team requires creating a core group, adding cross-functional members, deciding on external help and outlining responsibilities.
 

Another thing to keep in mind with your incident response team goals is to make sure that they are both reasonable and achievable and, most importantly, that they are being reviewed and followed. Otherwise, they can become an afterthought and evolve into a liability rather than an asset. It's even more complicated if, after an incident or confirmed breach, someone finds that documented procedures were nonexistent or not followed at all.

An essential part of cybersecurity incident response is understanding the various team member roles and responsibilities. After all, what good are goals if you don't have the right people on board, or you have people working on the team but their expectations are not clear? At a minimum, you should outline in your IR plan, or elsewhere, specific roles and responsibilities.

Incident response skills

The IR team should include the following:

  • Technical team: IT and security team members.
  • Executive sponsor: A senior executive charged with overseeing information security.
  • Incident response coordinator: The person responsible for ongoing management of the team and incidents.
  • Media relations coordinator: Your PR representative in charge of interfacing with the news media and related outlets once a breach occurs.
  • Forensic analyst: A forensics expert internal to the company or an outside adviser.
  • Outside consultant: A third-party information security or incident response expert.
  • Legal counsel: Your corporate attorney or outside law firm that would represent your organization as needed for incidents and breaches.

Incident response requires a number of skills. At the heart of an IR team is the core group of technical staff and incident responders who defend an organization against cyberthreats. These members are skilled at security and can execute on tasks such as monitoring the network for vulnerabilities and breaches and taking the appropriate measures where necessary.

As for incident responders, these team members use data to spot and assess the scope or urgency of incidents and perform other ongoing IR duties. They may also report on trends, educate the organization's users and liaise with law enforcement. There are specific questions that can help organizations better hire these team members.

But technical skills are not all that's required for successful incident response. As noted above, a solid IR team will need cross-functional members who can execute on nontechnical tasks, such as talking with the media and responding to legal issues. The actual titles for each of these roles can vary from organization to organization depending on your existing staff structure, staff expertise and your specific business needs. The important thing is that you have the right people on board.

In terms of team building, rather than pulling people into your IR team who may not want to be there, seek out those in the organization who are interested in the topic and are eager to add value to this critical aspect of security. Each IT and security team member has his or her own interests, and incident response may not be one of them. Moreover, it's critical to have both technical and nontechnical people on your IR team. The technical people will know the network environment and can help dig into the details in system logs, network packet captures, vulnerability scanner reports and the like. Nontechnical people can help lead the oversight and team communications required to keep everyone in the know, ask the not-so-obvious questions, and help in the decision-making process so that business interests are properly represented. You might consider linking to an overall business communication plan that may exist.

IR methodology

An incident response plan is a go-to document for when the going gets rough with security issues. It outlines the whowhatwhenwhy and how of addressing security events, incidents, and, once confirmed, breaches. It's important because the last thing you need to be doing under duress is figuring out how to respond to these challenges. In fact, when you don't have a documented plan, you'll be reacting. And when you react, you lose your ability to reason. You're flying by the seat of your pants. You can't think clearly, and you're quite likely not going to make good decisions. By having a documented IR plan, you can respond with clarity and direction and avoid letting emotions drive your response efforts.

Creating an incident response plan

An incident response plan should be developed by the team or IR coordinator in advance and should contain the components detailed in the chart below.

Incident plan element Purpose and scope

Overview

Introduces the plan; details high-level goals, the scope of what's covered and assumptions that have been considered.

Outline of roles and responsibilities

Lists and discusses the duties and expectations of each of the team members.

Detailed list of incidents requiring action

Outlines the specific threats, exploits and situations that require formal incident response actions. The possibilities are endless, but could include denial-of-service attacks, malware infections, email phishing and lost or stolen laptops. Note: This is arguably the most important part of the incident response plan.

Detection, investigation and containment procedures

The beginning of the actual incident response procedures that you plan to use; this includes directives on tasks such as analyzing the situations, notifying team members, getting outside parties involved, securing the network, confirming the incident, gathering evidence and reporting on findings.

Eradication steps

Provides the general steps for cleaning up the incident and may include network traffic and system log analysis, forensics review and subsequent vulnerability testing to confirm resolution.

The recovery phase

Details tasks in the recovery phase, such as reinstalling or reimaging hosts, resetting passwords, and adjusting firewall rules and related network configurations.

Breach notification

Outlines the how and when to alert those impacted by a confirmed breach as required by contracts or law.

Follow-up tasks

Discusses additional reports, enhanced documentation and lessons learned that might come out of this phase.

Call list (in the appendix)

Provides contact information for incident response team members and involved outside vendors, such as internet service providers and cloud service providers.

Testing scenarios (appendix)

Outlines specific testing scenarios that have been or will be carried out.

Revision history (appendix)

Outlines details on plan updates and improvements, including who did it and when it was done.

Everyone's plan will look a little different depending on specific needs. However, the essentials covered by this template are standard and should be included in every organizations' plan. There are IR best practices and other resources available from organizations that you might consider integrating into your plan.

NIST, US-CERT, ISACA and ISO/IEC all provide frameworks that organizations can use as guidance. For example, the NIST "Computer Security Incident Handling Guide" includes an incident response framework in the form of an IR lifecycle -- preparation; detection and analysis; containment, eradication and recovery; and post-incident activity.

Additional frameworks are available from the SANS Institute, the Institute of Electrical and Electronics Engineers, the Internet Engineering Task Force and the European Union Agency for Network and Information Security.

An incident response plan should not be combined with documents on other organizational security plans and procedures, such as such as an overview of security policies or disaster recovery and business continuity plans. Instead, it works best as a stand-alone document that all your incident response team members know about and have easy access to -- both on the network and in hard-copy form. In addition to consulting frameworks from the organizations mentioned above, it can help to start with an IR plan template to guide you in the right direction.

Creating an incident response plan requires the expertise and input of all your incident response team members. A good way to go about establishing a plan -- or, even, fleshing out your existing one -- is to divvy up the various parts to the necessary team members. Once everyone has fleshed out their section, the incident response team can pull it all together into a single document and start working on editing and forming the final version. Keep in mind that your incident response plan is not unlike any given security policy; it's a work in progress. So, you want to make sure that it's reviewed periodically and adjusted appropriately as changes to your network, security and business come about.

To put a fine point on it: Your IR plan needs to be kept current, or it cannot keep your organization safe.

How, when and why to use IR tools

If information security is considered a strategic function of the business (and it often is), then incident response would be a tactical component of the security program. A military concept associated with the decisions and actions needed for effective incident response -- dubbed the OODA loop -- is a cycle where you observeorientdecide and act. The essence of the OODA loop is to use situational awareness and information to see impactful events, such as security incidents, unfold so you can quickly respond and gain an advantage toward thwarting the threat. This enables you to minimize the impact of threats on your business.


How the OODA loop works

The OODA loop -- which consists of observing, orienting, deciding and acting -- is a military concept widely used as a model for incident response.

 

The OODA loop can be utilized as an overall approach to incident response and can also help define which security tools you use in the process. Whether from the functions of prevention, detection or response, there are numerous incident response tools that can be used in this regard. For example, the visibility provided by packet analysis, system resource examination and file integrity monitoring are technologies you can use to fulfill the observe component of the OODA loop. Technologies that use real-time threat indicators and threat intelligence can provide context on attacks and be used to fulfill the orient component of the OODA loop. The decide component could be fulfilled by tools that provide forensic details, including replays of what happened in order to shed light on context and technical information. This can help you make more informed decisions on what to do -- or what not to do -- during the incident response process. Finally, the act component of the OODA loop can be fulfilled by activities such as blocking, redirecting or quarantining threats in order to minimize their effects on your network and information assets.

While cybersecurity incident response is a process, technology can automate certain functions to help minimize the time involved and eliminate errors. IR-focused technology vendors provide tools for functions such as the following:

  • net flow and traffic analysis;
  • vulnerability management;
  • security incident and event management;
  • endpoint detection and response;
  • firewall, intrusion prevention and denial-of-service mitigation; and
  • forensic analysis.

Most technology products in this space are commercial, so you'll need the budget -- sometimes a big one -- for both capital and operating expenditures associated with these tools. As an alternative, there are open source software offerings for most of these areas. You'll have to decide whether open source can meet your specific business requirements and what level of effort will be involved in doing so. You must also consider whether the open source software will be around over the long haul after you've invested so much in establishing your incident response efforts.

You can't simply depend on IR tools to run your entire incident response program.

Of course, as with any new technical control you put in place, you'll need to make sure you have the staff and expertise. Having the necessary resources is critical not only in terms of initial design and implementation, but also with day-to-day administration, troubleshooting and so on.

One final point: Does it make sense to fully integrate the OODA loop with your incident response efforts? It depends. You might at least consider it as a guideline for your approach to incident response and customize your methodology according to your needs. Similarly, you can't simply depend on IR tools to run your entire incident response program. The reality is, the success of the IR function depends on many factors, such as business culture, security buy-in, network design, budget and people. As with your incident response plan document, your IR methodology and tools are going to be unique based on your specific business requirements. If you follow the core OODA steps and use incident response tools where appropriate, that will put you at an advantage -- ahead of the curve -- and that's where you need to be.

A role for SOAR

Security orchestration, automation and response (SOAR) is a stack of compatible software that enables cybersecurity professionals to collect data about security threats and automatically respond to them. SOAR performs the following three main functions:

  • connects and coordinates heterogeneous tool sets and defines incident analysis parameters and processes;
  • automatically triggers specific workflows, tasks and triages based on those parameters; and
  • accelerates general and targeted responses by enabling a single view for analysts to access, query and share threat intelligence.

SOAR and SIEM may seem to play similar roles in the SOC, but they serve different purposes. SIEMs take in log and event data from traditional infrastructure component sources, while SOAR platforms extend that capability, pulling information from a variety of sources, including endpoint security software and third-party sources. SOAR platforms are also more sophisticated in their ability to orchestrate and automate alert responses.

SOAR has an array of use cases, including the following:

  • threat intelligence coordination;
  • case management;
  • vulnerability management;
  • automated enrichment for remediation;
  • threat hunting; and
  • incident response.
SOAR elements 

Incident response problem-solving

Problem-solving is a key part of incident response. Even though the OODA loop is about decision-making, it's important to not get caught up in the process of it or any other IR methodology. It's easy to get sidetracked and lose sight of what's important, and that's prioritization. Looking at this from the perspective of incidents requiring actions discussed above, you must be able to prioritize what to focus your efforts on and know which ones you can ignore. You go about doing this by considering which security events are urgent, which are important and how you'll need to respond to the various scenarios. The best way to do this is to view security events, incidents and confirmed breaches in terms of the following:

  1. What's urgent but not important?
  2. What's important but not urgent?
  3. What's both urgent and important?

An example of an urgent but not important issue would be a malware infection on a branch office sales workstation that only connects to the office network or internet via guest Wi-Fi. An example of an important but not urgent issue is a new, recently imaged laptop that is lost but that doesn't yet contain any business-related information. Examples of an urgent and important situation is a distributed denial-of-service attack against an e-commerce website, a malware infection affecting production servers and phishing attempts against executives that have led to the compromise of network credentials. Urgent and important scenarios are those where something bad is happening to a critical business resource or asset and you know that something must be done quickly.

The average small business, midmarket corporation or large enterprise has countless vulnerabilities that have yet to be acknowledged.

You'll find that many security issues you're forced to address fall into the first two categories above. Although they may need to be addressed in some way, they'll likely only serve as a distraction. This is why you must be good at filtering out the noise and focusing on the things that really matter for your particular environment. The third category -- both urgent and important -- is where you'll find most of your incident response resources should be dedicated. What's important is that you take the bigger picture into account and address the security events that are most impactful towards your critical network resources and information assets.

In today's technology-centric world where decisions are often made for us, it's becoming more of a struggle to find IT and security staff who can truly solve problems, especially when under the pressure of a security event. As it relates to incident response in your security program as a whole, ensure that problem-solving involves the proper areas, which include defining the problem, determining all possible solutions, deciding on the best solution and then taking purposeful action.

Prevention is key

Prevention is critical to incident response. You create a great IR program so you are ready to mitigate cyberattacks and deal with security mishaps and exploits. However, your first line of defense is to keep your network safe and your users empowered and security-aware. The security incidents that can create the most damage are those that exploit the gullibility of your network users, malware, and misconfigured computer systems and software that can be exploited for further enumeration and penetration. The average small business, midmarket corporation or large enterprise has countless vulnerabilities that have yet to be acknowledged, much less addressed. Knowing what we know today and having such advanced tools at our disposal, there's simply no reason to offer low-hanging fruit to hackers. Weak passwords, missing patches and unsecured information can easily lead to an incident or confirmed breach. Unfortunately, that's typically how incidents and breaches occur, so it's up to the incident response team or the security committee to determine where the gaps and opportunities lie and then vow to not let them lead to the downfall of your business.

Rather than implementing more paperwork and technical controls policies, processes and technologies -- many of which can serve as mere bureaucracy or a false sense of security -- what's often needed most is discipline. The discipline to acknowledge security threats and vulnerabilities. The discipline to acknowledge weaknesses in your information security program, including incident response. The discipline to take reasonable steps to prevent most incident scenarios. And the discipline to have the proper visibility and control in place to minimize the impact of the exploits that do get through.

Incident response is not just an IT and security issue that's overseen and executed by technical professionals. Instead, it's a core business function that's arguably as important as anything on the legal, financial or operations side of the business. Business leaders must understand that information security is a critical underpinning of the enterprise that must be supported at the highest of levels. Unless and until critical aspects of security are mastered, including incident response, it's a matter of time before the going gets rough, the questioning begins and intrusive investigations ensue. It's unreasonable to expect a perfect security program. Still, it's better to get started on improving your incident response efforts now before you're forced to.

Understanding Hydrometeorological Hazard

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

HydroMetHazard Mt. Province

WHAT ARE HYDROMETEOROLOGICAL HAZARDS?

First let’s dissect the words and explain their definition:

Hydrometeorology: it’s a branch of meteorology and hydrology that studies the transfer of water and energy between the land surface and the lower atmosphere.

Hazard: any source that can cause harm or damage to humans, property or the environment.

Hazard and risk are often used intertwined, but they are in fact different. Risk is defined as the probability that exposure to a hazard will lead to a negative consequence.

Definition hydrometeorological hazards


When you look up the definition of hydrometeorological hazards you will find: “Process or phenomenon of atmospheric, hydrological or oceanographic nature that may cause loss of life, injury or other health impacts, property damage, loss of livelihoods and services, social and economic disruption, or environmental damage”.

The hazards you can think of are tropical cyclones (typhoons and hurricanes), thunderstorms, hailstorms, tornados, blizzards, heavy snowfall, avalanches, coastal storm surges, floods including flash floods, drought, heatwaves and cold spells.

Read more: Understanding Hydrometeorological Hazard

How to Fix the “File or Directory is Corrupted and Unreadable” Error on a Windows 10 Computer

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

The dreaded “File or Directory is Corrupted and Unreadable” error can stop you from accessing your important files, but you can fix it. Here's how.

Let’s say you connect to your Windows 10 computer an external hard drive containing some important files. But instead of accessing them, you get the “file or directory is corrupted and unreadable” error.

Now, the only way to get your files is to solve this error. While this might sound a bit intimidating, especially if it's the first time you encounter this error, there's no need to worry. We’ll take a look at what causes this error and how to fix it.

What Causes the “File or Directory is Corrupted and Unreadable” Error?

There are multiple reasons for this error but if you can identify the cause, the troubleshooting process should be shorter. Here are a few possible reasons for the “ File or directory is corrupted and unreadable” error:

  • Physical damage. If the storage device is permanently damaged, you can’t access the stored information. Also, check the integrity of the hardware connection. Look for any damaged USB ports or cables.
  • Damaged MFT or FAT. The MFT (Master File Table) contains the file or directory type, size, creation, or modification time, amongst other info. So you will not be able to access your file if the MFT gets damaged or corrupted. The FAT (File Allocation Table) is a system similar to the MFT, and it was designed for hard drives. If the FAT malfunctions, it could also lead to the same error.
  • Virus or malware infection. It’s no secret that you could infect your computer with viruses or malware when downloading something from unofficial sources. This could lead to the corruption of your connected external devices and stop you from accessing your files.

1. Restart Your Computer

If you’ve got into the habit of putting your computer into Sleep mode instead of shutting it down, you might run into different issues and slowdowns. So there’s a chance the “File or directory is corrupted and unreadable” error is just a temporary glitch that should go away once you’ve restarted your computer.

If you still get the same error after the restart, move on to the next solution.

 

2. Disable Your Antivirus

If your antivirus detects a possible threat on the external drive, it could stop you from accessing it. If you are sure there are no threats on the drive, you can temporarily disable the antivirus while using the external drive.

3. Change the Location of the File

In case you are getting the error when you try to open a specific folder or file, try changing its location. So if you want to open a file or folder from an external drive, copy it on the internal drive and try to access it from there.

 

4. Scan the Drive

Scanning the drive from Properties is an efficient way to look for any drive errors. Depending on what errors Windows detects, you can choose the right tool to fix it. To scan the drive, right-click it and select Properties. Then, in the Tools tab, click Check to start the scan.

 

5. Set a New Drive Letter

While this is an odd trick, it might help you solve the "file or directory is corrupted and unreadable” error on your Windows computer. Follow these steps to change the drive letter:

  1. Press Win + R to launch a Run dialog.
  2. Type diskmgmt.msc and click OK.
  3. In the Disk Management window, right-click the external drive and select Change Drive Letter and Paths.
  4. Select the drive letter and click the Change button.
  5. In the Change Drive Letter or Path window, check the Assign the following drive letter and choose a new letter from the drop-down menu.
  6. Confirm the action.
 

Your external drive now has a new letter, and you should be able to open it. If you are using a script to open files from the drive, you’ll need to modify that as well.

 

6. Run the Windows Memory Diagnostic Tool

There’s a chance you can’t access certain files or folders because of memory-related issues. To fix it, you should use the Windows Memory Diagnostic tool. The easiest way to launch the tool is to input Windows Memory Diagnostic in the Start menu search bar and select the Best match. Then, select Restart now and check for problems.

 

Note: Before starting the scan, save all your work and close any running apps.

 

7. Check Your Computer for Malware

If you’ve noticed other problems on your computer, not only the inability to access external hard drives, you may have a virus infestation. You can use your third-party antivirus or a Windows built-in tool to fix it:

  1. Open Settings and go to Update & Security.
  2. From the left pane, click Windows Security.
  3. Select Virus & threat protection.
  4. Click the Scan option and select Full scan.
  5. Once the scan is complete, restart your computer and try to access the external hard drive.
 
 check malware

8. Run a Command Line

If you are still getting the “The file or directory is corrupted and unreadable” error when you try to open an external hard drive, there’s a chance the drive has a bad sector. In this case, you should run the chkdsk command.

In the Start menu search bar, search for command prompt and select Run as administrator. Then, type chkdsk x: /f /r and press Enter. Remember to replace with your drive letter.

 

Windows will now scan the drive and look for any bad sectors, directory errors, lost clusters, and recover data if necessary. How long the scan takes depends on the drive’s read speed and data size.

If you run the command and Command Prompt displays the “Cannot open volume for direct access” message, restart your computer and try again. Also, you could get the “Unable to determine volume version and state. CHKDSK aborted.” error. In this case, the drive’s data is corrupted.

9. Format the External Hard Drive

If you still can’t access your files, there’s one more solution you can try. Formatting the drive. While it will fix the problem, it will also delete the data you’ve stored on the drive. Before formatting it, you should recover the data.

To format your drive, right-click it and select Format. In the Format window, select the file system and check the Quick format option. Then, click Start to launch the process.

The Judicial Branch

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

INTRODUCTION

Judicial power rests with the Supreme Court and the lower courts, as established by law (Art. VIII, sec. 1 of the 1987 Constitution). Its duty is to settle actual controversies involving rights which are legally demandable and enforceable (Art. VIII Sec. 1 (2)).

The judiciary enjoys fiscal autonomy. Its appropriation may not be reduced by the Legislature below the appropriated amount the previous year (Art. VIII, Sec. 3).

RULES AND PROCEDURES

The Rules of Court of the Philippines, as amended and the rules and regulations issued by the Supreme Court, define the rules and procedures of the judiciary. These rules and regulations are in the form of administrative matters, administrative orders, circulars, memorandum circulars, memorandum orders, and OCA circulars.  The Supreme Court disseminates these rules and regulations to all courts, publishes important ones in newspapers of general circulation, prints them in book or pamphlet form, and uploads them to the Supreme Court website and the Supreme Court E-Library website.

On June 21, 1988, the Supreme Court promulgated the Code of Professional Responsibility for the legal profession.  The draft was prepared by the Committee on Responsibility, Discipline and Disbarment of the Integrated Bar of the Philippines.

APPOINTMENTS TO THE JUDICIARY

By virtue of Article VIII, Section 8, appointments to the judiciary are made by the President of the Philippines based on a list submitted by the Judicial and Bar Council which is under the supervision of the Supreme Court.  Its principal function is to screen prospective appointees to any judicial post. It is composed of the chief justice as ex-officio chairman, the Secretary of Justice and representatives of Congress as ex-officio members, and a representative of the Integrated Bar, a professor of law, a retired member of the Supreme Court and a representative of the private sector as members.

PHILIPPINE JUDICIAL ACADEMY

The Philippine Judicial Academy (PHILJA) is the “training school for justices, judge, court personnel, lawyers and aspirants to judicial posts.”   It was originally created by the Supreme Court on March 16, 1996 by virtue of Administrative Order No. 35-96, and was institutionalized on February 26, 1998 by virtue of Republic Act No. 8557.  No appointee to the bench may commence the discharge his adjudicative function without completing the prescribed court training in the academy. Its organizational structure and administrative setup are provided for by the Supreme Court in its en banc resolution (Revised A.M. No. 01-1-04-sc-PHILJA).

PHILIPPINE MEDIATION CENTER

The Philippine Mediation Center was organized pursuant to the en banc Supreme Court Resolution A.M. No. 01-10-5-SC-PHILJA, dated October 16, 2001, and in line with the objectives of the Action Program for Judicial Reforms (APJR) to decongest court dockets, among others, the court prescribed guidelines in institutionalizing and implementing the mediation program in the Philippines. The same resolution designated the Philippine Judicial Academy as the component unit of the Supreme Court for Court-Annexed Mediation and other Alternative Dispute Resolution (ADR) mechanisms, and established the Philippine Mediation Center (PMC).

Mandatory Continuing Legal Education Office was organized to implement the rules on Mandatory Continuing Legal Education for members of the Integrated Bar of the Philippines (B.M. No. 850 – “Mandatory Continuing Legal Education (MCLE)). It holds office in the Integrated Bar of the Philippines main office.

 

KATARUNGANG PAMBARANGAY

Presidential Decree No. 1508, or the Katarungang Pambarangay Law, took effect on December 11, 1978, and established a system of amicably settling disputes at the barangay level.  This decree and the Local Government Code provided rules and procedures, Title I, Chapter 7, Sections 339-422. This system of amicable settlement of dispute aims to promote the speedy administration of justice by easing the congestion of court dockets.  The court does not take cognizance of cases filed if they are not filed first with the Katarungang Pambarangay.

ALTERNATIVE DISPUTE RESOLUTION (ADR) SYSTEM

Republic Act No. 9285 institutionalized the use of an alternative dispute resolution system, which serves to promote the speedy and impartial administration of justice and unclog the court dockets.  This act shall be without prejudice to the adoption of the Supreme Court of any ADR system such as mediation, conciliation, arbitration or any combination thereof. ↵

THE SUPREME COURT

HISTORY OF THE SUPREME COURT

Royal audencia

The royal audencia was established on May 5, 1583, composed of a president, four oidores (justices) and a fiscal.  The audencia exercised both administrative and judicial functions.  Its functions and structure were modified in 1815 when a chief justice replaced its president and the number of justices was increased.  It came to be known as the Audencia Territorial de Manila with two branches, civil and criminal.  A royal decree issued on July 24, 1861 converted it to a purely judicial body with its decisions appealable to the Court of Spain in Madrid. A territorial audencia in Cebu, and audencia for criminal cases in Vigan were organized on February 26, 1898.

Philippine Revolution and First Republic

In the three phases of the revolution: 1896-1897; 1898; 1899-1901, the exigencies of war prevented the thorough organization of the administration of justice. Katipunan councils, then the provisional governments of Tejeros, Biak-na-Bato, and the Revolutionary Republic proclaimed in Kawit, essentially had General Emilio Aguinaldo exercising decree-making powers instituting ad hoc courts and reviewing any appeals concerning their decisions.

In 1899, when the Malolos Constitution was ratified, it provided for a Supreme Court of Justice. President Aguinaldo proposed the appointment of Apolinario Mabini as Chief Justice, but the appointment and the convening of the Supreme Court of Justice never materialized because of the Philippine-American War.

American military rule

During the Philippine-American War, General Wesley Merrit suspended the audencias when a military government was established after Manila fell to American forces in August, 1898.  Major General Elwell S. Otis re-established the Audencia on May 29, 1899 by virtue of General Order No. 20, which provided for six Filipino members of the audencia.

Establishment of the Supreme Court

With the establishment of civil government, Act No. 136 of the Philippine Commission abolished the audencia and established the present Supreme Court on June 11, 1901, with Cayetano Arellano as the first chief justice together with associate justices—the majority of whom were Americans.

Commonwealth: Filipinization of the Supreme Court

With the ratification of the 1935 Constitution, the membership was increased to 11 with two divisions of five members each.  The Supreme Court was Filipinized upon the inauguration of the Commonwealth of the Philippines on November 15, 1935. The composition of the court was reduced by virtue of Commonwealth Act No. 3. It provided for a Supreme Court, headed by a chief justice with six associate justices.

World War II and the Third Republic

During World War II, the National Assembly passed legislation granting emergency powers to President Manuel L. Quezon; Chief Justice Jose Abad Santos was made concurrent Secretary of Justice and acting President of the Philippines in unoccupied areas. After his capture and execution at the hands of the Japanese, the Commonwealth government-in-exile had no system of courts.

Meanwhile, the Japanese organized the Philippine Executive Commission in occupied areas on January 8, 1942, which gave way to the Second Republic in October 14, 1943. By the end of World War II, the regular function of the courts had been restored, beginning with the appointment of a new Supreme Court on June 6, 1945. On September 17, 1945, the laws of the Second Republic were declared null and void; a Supreme Court decision on Co Kim Cham v. Eusebio Valdez Tan Keh and Arsenio P. Dizon recognized this.

Martial law

The Supreme Court was retained during the martial law years under rules similar to the 1935 Constitution, but with the exception few key factors, e.g.:

  1. The 1973 Constitution further increased the membership of the Supreme Court to 15, with two divisions;
  2. The process by which a chief justice and associate justices are appointed was changed under to grant the president (Ferdinand Marcos during this time) the sole authority to appoint members of the Supreme Court. There were five chief justices that were appointed under this provision.

PRESENT-DAY SUPREME COURT

Pursuant to the provisions of the 1987 Constitution, the Supreme Court is composed of a chief Justice and 14 associate justices who serve until the age of 70. The court may sit en banc or in one of its three divisions composed of five members each. The chief justice and associate justices are appointed by the President of the Philippines, chosen from a shortlist submitted by the Judicial and Bar Council. The president must fill up a vacancy within 90 days of occurrence.

Article VIII, Section 4 (2) of the constitution explicitly provides for the cases that must be heard en banc, and Section 4 (3) for cases that may be heard by divisions.

The Judiciary Reorganization Act of 1980 transferred the administrative supervision of all courts and their personnel from the Department of Justice to the Supreme Court.  This was affirmed by  Article VIII, Section 6 of the 1987 Constitution.  To effectively discharge this constitutional mandate, the Office of the Court Administrator (OCA)  was created under Presidential Decree No. 828, as amended by Presidential Decree No. 842 (and its functions further strengthened by a resolution of the Supreme Court en banc dated October 24, 1996). Its principal function is the supervision and administration of the lower courts throughout the Philippines and all their personnel. It reports and recommends to the Supreme Court all actions that affect the lower court management.  The OCA is headed by the court administrator, three deputy court administrators, and three assistant court administrators.

According to the 1987 Constitution, Article VIII, Section 5, the Supreme Court exercises the following powers:

    1. Exercise jurisdiction over cases affecting ambassadors, other public ministers and consuls, and over petitions for certiorari, prohibition, mandamus, quo warranto, and habeas corpus.
    2. Review, revise, reverse, modify, or affirm, on appeal or certiorari, as the law or the Rules of Court may provide, final judgments and orders of the lower courts in:
      • All cases in which the constitutionality or validity of any treaty, international or executive agreement, law, presidential decree, proclamation, order, instruction, ordinance, or regulation is in question;
      • All cases involving the legality of any tax, impost, assessment, or toll, or any penalty imposed in relation thereto;
      • All cases in which the jurisdiction of any lower court is in issue;
      • All criminal cases in which the penalty imposed is reclusion perpetua or higher;
      • All cases in which only an error or question of law is involved;
    3. Assign temporarily judges of lower courts to other stations as public interest may require. Such temporary assignments shall not exceed six months without the consent of the judge concerned.
    4. Order a change of venue or place of trial to avoid a miscarriage of justice.

 

  1. Promulgate rules concerning the protection and enforcement of constitutional rights, pleading, practice, and procedure in all courts; the admission to the practice of law, the Integrated Bar; and legal assistance to the underprivileged. Such rules shall provide a simplified and inexpensive procedure for the speedy disposition of cases, shall be uniform for all courts the same grade, and shall not diminish, increase or modify substantive rights. Rules of procedure of special courts and quasi-judicial bodies shall remain effective unless disapproved by the Supreme Court.
  2. Appoint all officials and employees of the Judiciary in accordance with the Civil Service Law (Sec. 5 , id.).

THE CHIEF JUSTICE

THE INCUMBENT

Ma. Lourdes P. A. Sereno
Tenure as Chief Justice: August 24, 2012 – present
Appointed by: Benigno S. Aquino III
Age at Appointment: 52

 

Full roster of chief justices

The position of chief justice was created in 1901 by virtue of the establishment of the Philippine Supreme Court. At the time, the chief justice was appointed by the President of the United States: the court was composed mainly of American citizens with a Filipino chief justice. The incumbent Chief Justice, Ma. Lourdes P.A. Sereno, appointed by President Benigno S. Aquino III, took her oath of office on August 25, 2012. She is the first woman to hold the position.

There were six chief justices appointed by the President of the United States. In 1935, upon the inauguration of the Commonwealth of the Philippines, the power to appoint the chief justice was transferred to the President of the Philippines. According to the 1935 Constitution, the President of the Philippines shall make appointments with concurrence of the National Assembly. There have been six Chief Justices who were appointed under the 1935 Constitution. The only chief justice that was not appointed by a president was Chief Justice Jose Yulo, who was in office during the Japanese occupation, from 1942 until the liberation of the Philippines in 1945. During this time, the Chief Justice of the Supreme Court was appointed by the Philippine Executive Committee headed by Jorge B. Vargas.

The 1943 Constitution provided for the members of the Supreme Court and the chief justice to be appointed by the president with the concurrence of his cabinet. Upon the declaration of martial law and the subsequent establishment of the 1973 Constitution, the process of selection of the Chief Justice of the Philippines was changed. The power of Congress to veto an appointment by the president to the office of the chief justice was removed. According to the 1973 Constitution, “The Members of the Supreme Court and judges of inferior courts shall be appointed by the President.” There were five chief justices that were appointed under this provision.

After the revolution of 1986, a new constitution was enacted and a new process of selecting a chief magistrate was created. Former chief justice and 1986 Constitutional Commission delegate Roberto V. Concepcion introduced the concept of the Judicial and Bar Council. The aim of the Council is to de-politicize the judiciary by lessening the appointing power of the president. To read more about the appointment of chief justices, members of the judiciary, and the Office of the Ombudsman.

To date, there have been nine chief justices appointed under the conditions of the 1986 Constitution.

 

CHIEF JUSTICES LISTED ACCORDING TO APPOINTING PRESIDENT OF THE PHILIPPINES

Of the 15 Presidents of the Philippines, only eight have been able to appoint an individual to the highest judicial post in the land. The following is the list of presidents who appointed chief Jjstices and their appointees.

  1. Manuel L. Quezon
    • Jose Abad Santos
  2. Sergio Osmeña
    • Manuel V. Moran
  3. Elpidio Quirino
    • Ricardo M. Paras
  4. Carlos P. Garcia
    • Cesar Bengzon
  5. Ferdinand E. Marcos
    • Roberto V. Concepcion
    • Querube Makalintal
    • Fred Ruiz Castro
    • Enrique M. Fernando
    • Felix V. Makasiar
    • Ramon C. Aquino
  6. Corazon C. Aquino
    • Claudio Teehankee
    • Pedro L. Yap
    • Marcelo B. Fernan
    • Andres R. Narvasa
  7. Joseph Ejercito Estrada
    • Hilario G. Davide
  8. Gloria Macapagal Arroyo
    • Artemio Panganiban
    • Reynato Puno
    • Renato C. Corona
  9. Benigno S. Aquino III
    • Maria Lourdes P.A. Sereno

Notable chief justices

Of the list of chief justices, there are a few individuals that stand out for having gone above and beyond their duty and tenure as chief justice.

  1. Cayetano Arellano: Cayetano Arellano was the first Chief Justice of the Supreme Court. He was appointed in 1901 when the Supreme Court was created through Act No. 136, along with three American justices and one Filipino justice.
  2. Ramon Avanceña: Appointed in 1925 by U.S. President Calvin Coolidge, he is known for ushering in an all-Filipino Supreme Court in 1935. Upon the establishment of the Philippine Commonwealth in 1935, American justices were no longer allowed to sit in the Philippine Supreme Court—thus, new justices were appointed, all of whom were of Filipino citizenship.
  3. Jose Abad Santos: As a wartime chief justice, Abad Santos took on two different roles; he was the chief justice and concurrently the Secretary of Justice. When President Quezon left the Philippines to evade capture by the Japanese, Abad Santos chose to stay in the country as a caretaker of the government. On May 2, 1942, the Japanese military caught Abad Santos in Cebu and invited him to become one of the members of their puppet government. Abad Santos refused to collaborate. He died at the hands of the Japanese on May 2, 1942. His last words to his son were, “Do not cry, Pepito, show to these people that you are brave. It is an honor to die for one’s country. Not everybody has that chance.”
  4. Manuel V. Moran: Appointed in 1945 by President Sergio Osmeña, Manuel V. Moran would serve as Chief Justice of the Supreme Court for six years. Upon his retirement in 1951, Moran was appointed as Philippine Ambassador to Spain and concurrently to the Holy See. During President Quirino’s administration, Moran was once again offered a position in the Supreme Court in 1953, at the twilight of Quirino’s presidency. Moran, however, refused the midnight appointment.
  5. Roberto V. Concepcion: He went into early retirement for refusing to grant absolute power to Ferdinand Marcos, the president who appointed him. In the resolution of Javellana v. Executive Secretary, Concepcion argued against the validity of the 1973 Constitution and its questionable aspects. Accordingly, he dissented, along with Justices Teehankee, Zaldivar, and Fernando, from implementing the 1973 Constitution. Due to the court’s decision, Concepcion would enter early retirement, 50 days before his originally scheduled retirement date.
  6. Claudio Teehankee: Claudio Teehankee was known for his firm anti-martial law stance during his tenure in the Supreme Court. Teehankee resisted multiple attempts by the Marcos administration to garner absolute power by issuing questionable decrees. In 1973, he was part of the bloc that dissented from the implementation of the 1973 Constitution. In 1980, he dissented from the proposed judicial reorganization act of President Marcos. In 1986, after the EDSA Revolution, he administered the Oath of Office of President Corazon C. Aquino in Club Filipino. He was appointed Chief Justice of the Supreme Court in 1986 by President Corazon C. Aquino
  7. Hilario G. Davide: Appointed by President Joseph Ejercito Estrada in 1998, Chief Justice Hilario G. Davide was known as the presiding judge of the first impeachment proceedings in Asia. During the impeachment of President Estrada, he conducted proceedings with impartiality. Following EDSA II uprising, which deposed President Estrada, Davide swore in Gloria Macapagal-Arroyo as the 14th President of the Philippines.
  8. Maria Lourdes P.A. Sereno: Appointed by President Benigno S. Aquino III in 2012, Chief Justice Sereno is the first woman appointed to the position.

Court of Appeals

The Court of Appeals is the second highest tribunal in the country, which was established on February 1, 1936 by virtue of Commonwealth Act No. 3. The current form of the Court of Appeals was constituted through Batas Pambansa Blg. 129, as amended by Executive Order No. 33, s. 1986, Republic Act No. 7902, and Republic Act No. 8246.

The jurisdiction of the Court of Appeals are as follows:

  1. Original jurisdiction to issue writs of mandamus, prohibition, certiorari, habeas corpus, and quo warranto, and auxiliary writs or processes, whether or not in aid of its appellate jurisdiction;
  2. Exclusive original jurisdiction over actions for annulment of judgements of Regional Trial Courts; and
  3. Exclusive appellate jurisdiction over all final judgements, resolutions, orders or awards of Regional Trial Courts and quasi-judicial agencies, instrumentalities, boards or commission.

The Court of Appeals shall also have the power to try cases and conduct hearings, receive evidence and perform acts necessary to resolve factual issues raised in cases falling within its original and appellate jurisdiction, including the power to grant and conduct new trials or proceedings.

The Court of Appeals is composed of one presiding justice and 68 associate justices, all of which are appointed by the President from a shortlist submitted by the Judicial and Bar Council. The associate justices shall have precedence according to the dates (or order, in case of similar appointment dates) of their respective appointments. The qualifications for the justices of the Supreme Court also apply to members of the Court of Appeals.

The current presiding justice of the Court of Appeals is Andres Reyes Jr., who is set to retire on May 11, 2020.

Court of Tax Appeals

The Court of Tax Appeals (CTA), which is of the same level as the Court of Appeals, was created by virtue of Republic Act No. 1125, which was signed into law on June 16, 1954. Its present-day form was constituted through RA 1125, as amended by Republic Act No. 9282 and Republic Act No. 9503.

The CTA exercises jurisdiction in the following:

  1. Exclusive appellate jurisdiction to review by appeal, as herein provided:
    1. Decisions of the Commissioner of Internal Revenue in cases involving disputed assessments, refunds of internal revenue taxes, fees or other charges, penalties in relation thereto, or other matters arising under the National Internal Revenue or other laws administered by the Bureau of Internal Revenue;
    2. Inaction by the Commissioner of Internal Revenue in cases involving disputed assessments, refunds of internal revenue taxes, fees or other charges, penalties in relations thereto, or other matters arising under the National Internal Revenue Code or other laws administered by the Bureau of Internal Revenue, where the National Internal Revenue Code provides a specific period of action, in which case the inaction shall be deemed a denial;
    3. Decisions, orders or resolutions of the Regional Trial Courts in local tax cases originally decided or resolved by them in the exercise of their original or appellate jurisdiction;
    4. Decisions of the Commissioner of Customs in cases involving liability for customs duties, fees or other money charges, seizure, detention or release of property affected, fines, forfeitures or other penalties in relation thereto, or other matters arising under the Customs Law or other laws administered by the Bureau of Customs;
    5. Decisions of the Central Board of Assessment Appeals in the exercise of its appellate jurisdiction over cases involving the assessment and taxation of real property originally decided by the provincial or city board of assessment appeals;
    6. Decisions of the Secretary of Finance on customs cases elevated to him automatically for review from decisions of the Commissioner of Customs which are adverse to the Government under Section 2315 of the Tariff and Customs Code;
    7. Decisions of the Secretary of Trade and Industry, in the case of non-agricultural product, commodity or article, and the Secretary of Agriculture in the case of agricultural product, commodity or article, involving dumping and countervailing duties under Section 301 and 302, respectively, of the Tariff and Customs Code, and safeguard measures under Republic Act No. 8800, where either party may appeal the decision to impose or not to impose said duties.
  2. Jurisdiction over cases involving criminal offenses as herein provided:
    1. Exclusive original jurisdiction over all criminal offenses arising from violations of the National Internal Revenue Code or Tariff and Customs Code and other laws administered by the Bureau of Internal Revenue or the Bureau of Customs: Provided, however, that offenses or felonies mentioned in this paragraph where the principal amount of taxes and fees, exclusive of charges and penalties, claimed is less than P1 million or where there is no specified amount claimed shall be tried by the regular courts and the jurisdiction of the CTA shall be appellate.
    2. Exclusive appellate jurisdiction in criminal offenses:
      1. Over appeals from the judgments, resolutions or orders of the Regional Trial Courts in tax cases originally decided by them, in their respective territorial jurisdiction.
      2. Over petitions for review of the judgments, resolutions or orders of the Regional Trial Courts in the exercise of their appellate jurisdiction over tax cases originally decided by the Metropolitan Trial Courts, Municipal Trial Courts and Municipal Circuit Trial Courts in their respective jurisdiction.
      3. Jurisdiction over tax collection cases as herein provided:
        1. Exclusive original jurisdiction in tax collection cases involving final and executory assessments for taxes, fees, charges and penalties: Provided, however, that collection cases where the principal amount of taxes and fees, exclusive of charges and penalties, claimed is less than P1 million shall be tried by the proper Municipal Trial Court, Metropolitan Trial Court and Regional Trial Court.
        2. Exclusive appellate jurisdiction in tax collection cases:
          1. Over appeals from the judgments, resolutions or orders of the Regional Trial Courts in tax collection cases originally decided by them, in their respective territorial jurisdiction.
          2. Over petitions for review of the judgments, resolutions or orders of the Regional Trial Courts in the Exercise of their appellate jurisdiction over tax collection cases originally decided by the Metropolitan Trial Courts, Municipal Trial Courts and Municipal Circuit Trial Courts, in their respective jurisdiction.

The CTA is composed of one presiding justice and 8 associate justices, all of which are appointed by the President from a shortlist submitted by the Judicial and Bar Council. The associate justices shall have precedence according to the dates (or order, in case of similar appointment dates) of their respective appointments. The qualifications for the justices of the Court of Appeals also apply to members of the CTA.

The current presiding justice of the CTA is Roman del Rosario, who is set to retire on October 6, 2025.

Sandiganbayan

To attain the highest norms of official conduct among officials and employees in the government, the creation of a special graft court to be known as the Sandiganbayan was provided for in Article XIII, Section 5 of the 1973 Constitution. This court was formally established through Presidential Decree No. 1606, which was signed into law on December 10, 1978.

Through Article XI (Accountability of Public Officers), Section 4 of the 1987 Constitution, the Sandiganbayan was carried over to the post-EDSA Revolution republic. The current form of the Sandiganbayan was constituted through PD 1606, s. 1978, as amended by Republic Act No. 7975 and Republic Act No. 8245.

The Sandiganbayan has jurisdiction over the following:

  1. Violations of Republic Act No. 3019 or the Anti-Graft and Corrupt Practices Act, as amended, and Chapter II, Section 2, Title VII, Book II of the Revised Penal Code, where one or more of the accused are officials occupying the following positions in the government whether in a permanent, acting or interim capacity, at the time of the commission of the offense:
    1. Officials of the executive branch occupying the positions of regional director and higher, otherwise classified as grade 27 and higher, of the Compensation and Position Classification Act of 1989 (Republic Act No. 6758), specifically including:
      1. Provincial governors, vice-governors, members of the sangguniang panlalawigan and provincial treasurers, assessors, engineers and other provincial department heads;
      2. City mayors, vice-mayors, members of the sangguniang panlungsod, city treasurers, assessors engineers and other city department heads;
      3. Officials of the diplomatic service occupying the position of consul and higher;
      4. Philippine army and air force colonels, naval captains, and all officers of higher rank;
      5. Officers of the Philippine National Police while occupying the position of provincial director and those holding the rank of senior superintendent or higher;
      6. City and provincial prosecutors and their assistants, and officials and prosecutors in the Office of the Ombudsman and special prosecutor;
      7. Presidents, directors or trustees, or managers of government-owned or -controlled corporations, state universities or educational institutions or foundations;
    2. Members of Congress and officials thereof classified as grade 27 and up under the Compensation and Position Classification Act of 1989;
    3. Members of the judiciary without prejudice to the provisions of the constitution;
    4. Chairmen and members of constitutional commissions, without prejudice to the provisions of the constitution; and
    5. All other national and local officials classified as Grade 27 and higher under the Compensation and Position Classification Act of 1989.
  2. Other offenses or felonies whether simple or complexed with other crimes committed by the public officials and employees mentioned in subsection a of this section in relation to their office.
  3. Civil and criminal cases filed pursuant to and in connection with Executive Order Nos. 1, 2, 14 and 14-A, s. 1986.

In addition, the Sandiganbayan exercises exclusive appellate jurisdiction over final judgments, resolutions or orders or regional trial courts whether in the exercise of their own original jurisdiction or of their appellate jurisdiction as herein provided.

The Sandiganbayan also has exclusive original jurisdiction over petitions for the issuance of the writs of mandamus, prohibition, certiorari, habeas corpus, injunctions, and other ancillary writs and processes in aid of its appellate jurisdiction and over petitions of similar nature, including quo warranto, arising or that may arise in cases filed or which may be filed under Executive Order Nos. 1,2,14 and 14-A issued in 1986.

In case private individuals are charged as co-principals, accomplices or accessories with the public officers or employees, including those employed in govemment-owned or controlled corporations, they shall be tried jointly with said public officers and employees in the proper courts which shall exercise exclusive jurisdiction over them.

The Sandiganbayan comprises of one presiding justice and 14 associate justices, all of which are appointed by the President from a shortlist submitted by the Judicial and Bar Council. The associate justices shall have precedence according to the dates (or order, in case of similar appointment dates) of their respective appointments.

The qualifications to become a member of the Sandiganbayan are as follows:

  1. a natural-born citizen of the Philippines;
  2. at least 40 years of age
  3. has been a judge of a court for at least ten years, or been engaged in the practice of law in the Philippines or has held office requiring admission to the bar as a prerequisite for at least ten years.

The current presiding justice of the Sandiganbayan is Amparo Cabotaje-Tang, who is set to retire on November 8, 2024.

The Legislative Branch

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

Introduction

According to the 1987 Constitution, legislative power shall be vested in the Congress of the Philippines, which shall consist of a Senate and a House of Representatives.

The Senate shall be composed of twenty-four Senators who shall be elected at large by the qualified voters of the Philippines, as may be provided by law; the House of Representatives shall be composed of not more than 250 (unless otherwise fixed by law), 20 percent of whom must be Party-list representatives.

The qualifications to become a senator, as stipulated in the constitution, are:

  1. a natural-born citizen of the Philippines;
  2. at least thirty-five years old;
  3. is able to read and write
  4. a registered voter; and
  5. a resident of the Philippines for not less than two years before election day.


Meanwhile, the constitution provides for the following criteria to become a member of the House of Representatives:

  1. a natural-born citizen of the Philippines;
  2. at least twenty-five years old;
  3. is able to read and write; and
  4. except the party-list representatives, a registered voter and a resident for at least one year in the district where s/he shall be elected.

Legislative process

Congress is responsible for making enabling laws to make sure the spirit of the constitution is upheld in the country and, at times, amend or change the constitution itself. In order to craft laws, the legislative body comes out with two main documents: bills and resolutions.

Resolutions convey principles and sentiments of the Senate or the House of Representatives. These resolutions can further be divided into three different elements:

  • joint resolutions — require the approval of both chambers of Congress and the signature of the President, and have the force and effect of a law if approved.
  • concurrent resolutions — used for matters affecting the operations of both chambers of Congress and must be approved in the same form by both houses, but are not transmitted to the President for his signature and therefore have no force and effect of a law.
  • simple resolutions — deal with matters entirely within the prerogative of one chamber of Congress, are not referred to the President for his signature, and therefore have no force and effect of a law.

Bills are laws in the making. They pass into law when they are approved by both houses and the President of the Philippines. A bill may be vetoed by the President, but the House of Representatives may overturn a presidential veto by garnering a 2/3rds vote. If the President does not act on a proposed law submitted by Congress, it will lapse into law after 30 days of receipt.

HISTORY OF THE LEGISLATURE

REPRESENTATION IN THE SPANISH CORTES

Prior to the creation of a legislature in the Philippines, Filipinos, from time to time, were allowed to sit in the Spanish Cortes as representatives of the Philippine Islands. In 1810, the Spanish government allowed Filipinos to receive Spanish citizenship and appropriate representation in the Cortes. When the Cadiz Constitution was in full force and effect, Filipino representation became a standard in the Cortes. However, in 1837, the liberal Cortes finally abolished representation and declared that overseas territories of Spain to be ruled by special laws. This loss of representation was one of the main points that Jose Rizal and other propagandists were fighting for during the Propaganda movement.

MALOLOS REPUBLIC, 1899 – 1901

The first Filipino legislature was convened on September 15, 1898 in Barasoain Church, Malolos, Bulacan. Later known as the Malolos Republic, it drafted the first constitution of the Philippines, which was also the first democratic constitution in Asia. The Congress included delegates from different provinces of the Philippines, some elected and some appointed. It was a short-lived legislature, unable to pass any laws due to the onset of the Philippine-American War. The first Philippine Republic was ended on March 23, 1901 with the capture of President Emilio Aguinaldo in Palanan, Isabela.

PHILIPPINE COMMISSION, 1899 – 1916

In 1899, United States President William McKinley appointed a commission led by Dr. Jacob Schurman to study and investigate the conditions in the Philippine Islands. This would be known as the first Philippine Commission. It was followed by another investigative commission led by William Howard Taft in 1900, which also had limited legislative and executive powers. From 1901 onwards, the Philippine Commission would be regularized. It exercised both executive and legislative powers, with three Filipino delegates, namely Benito Legarda, Trinidad Pardo de Tavera, Jose Luzuriaga. After the organization of the Philippine Assembly (see below) in 1907, the commission stayed on as the upper house of the legislature.

PHILIPPINE ASSEMBLY, 1907 – 1916

Electoral representation in the Philippines by Filipinos began when the American insular government allowed partial self-governance by establishing the Philippine Assembly. The assembly, as the lower house, shared legislative power with the Philippine Commission, which remained under American control, as membership in the Philippine Commission was still restricted to appointed American officials. In 1907, still under American rule, the Philippines held its first national elections for the newly created representative body, which had an inaugural membership of 81 Filipinos representing their respective districts. In the succeeding years, the number of districts were increased to 85 in 1910, and 91 in 1912.

RESIDENT COMMISSIONERS, 1907 – 1946

From 1907 to 1946, the Philippine legislature sent a representative to sit in the U.S. House of Representatives, as resident commissioner. Under Spain, the Philippines had also been given limited representation in the Spanish Cortes, and like the resident commissioners, they had the right to speak, but not to vote. The restoration of Philippine independence in 1946 ended Philippine representation in the U.S. Congress. (Note: To this day, Puerto Rico still has a resident commissioner in the U.S. House of Representatives.)

THE PHILIPPINE LEGISLATURE, 1916 – 1935

Upon the enactment of the Jones Law in 1916, the Filipinos were subsequently granted the opportunity to hold other offices in the government. Positions in the Philippine Senate were opened to Filipinos, with 12 senatorial districts and two senators elected from each. The inaugural President of the Senate in 1916 was Manuel L. Quezon, representing the fifth senatorial district. He would hold this position until the establishment of the Commonwealth of the Philippines in 1935. For the 19 years prior to the Commonwealth, the Senate presidency was the highest position a Filipino could hold.

From the first Philippine Commission to the establishment of the Commonwealth of the Philippines, the Philippine legislature were passing public acts. This form of legislation is started at Congress, with the approval of the American governor-general of the Philippine Islands.

COMMONWEALTH OF THE PHILIPPINES, 1935 – 1946

On November 15, 1935, Quezon took his oath as the first President of the Commonwealth of the Philippines, giving control of the executive branch of government to the Filipinos. It was also in this era that the Supreme Court of the Philippines was completely Filipinized. By virtue of the 1935 Constitution, the bicameral Philippine legislature was merged to form the unicameral National Assembly.

Two elections were held under the Commonwealth. The first, in 1935, elected the President of the Philippines as well as members of the National Assembly; the second, in 1939, elected only members of the National Assembly. The National Assembly would be retained until 1941, when a new structure for the legislature was introduced through a constitutional amendment.

From the Commonwealth period to the inauguration of the Third Philippine Republic, the Philippine legislature was passing Commonwealth acts (CA). This form of legislation is started at the National Assembly and approved by the President of the Philippines.

CONSTITUTIONAL AMENDMENTS OF 1941

After six years under a unicameral legislature, the Constitution of 1935 was amended, dividing the National Assembly into two separate houses. The Senate of the Philippines and the House of Representatives were reestablished, with a Senate President and a Speaker of the House leading their respective chambers.

The elections for members of these newly created chambers were held in 1941. However, the onset of World War II prevented the elected members from assuming their posts and the legislature of the Commonwealth of the Philippines was dissolved upon the exile of the government of the Philippines.

THE SECOND REPUBLIC, 1943

On October 14, 1943, the Japanese-sponsored Second Republic was inaugurated, with Jose. P. Laurel as the President. This government followed the newly crafted 1943 Constitution, and reverted the legislature back to a unicameral National Assembly. The National Assembly of the Second Republic would remain in existence until the arrival of the Allied forces in 1944, which liberated the Philippines from the Imperial Japanese forces.

RESTORATION OF THE PHILIPPINE COMMONWEALTH, 1945 – 1946

Upon the reestablishment of the Commonwealth in 1945, President Sergio Osmeña called for a special session of Congress. The first Congress convened on June 9 of that year, with most of the senators and representatives, who were elected in 1941, assuming their positions. Manuel Roxas and Jose C. Zulueta served as Senate President and Speaker of the House, respectively. Not all, however, were allowed to take their post because some were incarcerated for collaboration with the Japanese.

The inaugural session, was held in a converted school house in Lepanto St., Manila, as the Legislative Building in Manila was reduced to ruins as an outcome of the war.

On April 23, 1946, national elections were held to choose new members of Congress, the President, and the Vice President of the Philippines. After the elections the second Congress of the Commonwealth convened on May 25, 1946. It would only last until July 4, 1946, with the inauguration of the Third Republic of the Philippines.

THE THIRD REPUBLIC, 1946 – 1972

The independent Republic of the Philippines was finally proclaimed on July 4, 1946 with Manuel Roxas as President. The Second Congress of the Commonwealth was transformed into the first Congress of the Republic of the Philippines, also made up of the Senate and the House of Representatives. This would mark the beginning of the count of Congresses of the Republic until the imposition of Martial Law in 1972, when Congress would be dissolved.

This era started the legislation of republic acts which would continue until 1972. Upon the restoration of democracy in 1986 and the ratification of the 1987 Constitution, the naming of laws as republic acts would be reinstated.

MARTIAL LAW AND THE FOURTH REPUBLIC, 1972-1986

On September 23, 1972 President Ferdinand E. Marcos issued Presidential Proclamation No. 1081, placing the entire country under Martial Law. This coincided with the closing of the sessions of both chambers of Congress. Days before the scheduled reopening of the Senate and the House of Representatives, Marcos promulgated the 1973 Constitution, which effectively abolished the bicameral legislature and replaced it with a unicameral legislature. Opposition legislators reported to the Legislative Building on January 22, 1973, but found the building padlocked and under an armed guard.

Under martial rule, Marcos created the Batasang Bayan in 1976, by virtue of Presidential Decree No. 995, to serve as a legislative advisory council—a quasi-legislative machinery to normalize the legislative process for the eventual actualization of the 1973 Constitution. The Batasang Bayan would hold office in the Philippine International Convention Center (a modernist structure designed by National Artist for Architecture Leandro Locsin, within the Cultural Center of the Philippines Complex—a pet project of First Lady Imelda R. Marcos). The consultative body would serve until 1978.

The Batasang Bayan would be replaced in 1978 by an elected unicameral body: the Interim Batasang Pambansa (IBP), a parliamentary legislature, as provided for in the 1973 Constitution. On April 7, 1978, elections for were held. Those elected to the IBP would be called Mambabatas Pambansa (Assemblymen) who would be elected per region, via a bloc-voting system. The IBP opened on Independence Day 1984 in the Batasan Pambansa in Quezon City.

Members of the Regular Batasang Pambansa (RBP) were elected in 1984, this time at-large and per province. The RBP held its inaugural session on July 23, 1984.

In 1986, President Marcos succumbed to international pressure and called for a snap presidential election. Though Marcos and his running mate former Senator and Assemblyman Arturo Tolentino were proclaimed by the Batasang Pambansa as the winners of the election, a popular revolt installed opposition leaders Corazon C. Aquino and Salvador H. Laurel as President and Vice President, respectively.

For both the IBP and RBP, the laws passed would be called “Batas Pambansa,” which did not continue the previous numbering of Republic Acts.

THE FIFTH REPUBLIC, 1987 – PRESENT

On March 25, 1986, President Aquino declared a revolutionary government by virtue of Presidential Proclamation No. 3, s. 1986, which suspended some provisions of the 1973 Constitution and promulgated in its stead a transitory constitution. This effectively abolished the Batasang Pambansa. A constitutional commission, tasked with drafting a new charter, was created by virtue of Proclamation No. 9 issued on April 23, 1986.

Following the overwhelming ratification of the 1987 Constitution through a national plebiscite held on February 2, 1987, the 1987 Constitution finally came into full force and effect on February 11, 1987. It re-established a bicameral legislature, composed of the House of Representatives and the Senate, much like the way it was before martial law. The former, being much larger in composition, reopened in the Batasan Pambansa while the Senate, still with its 24 members, returned to the Legislative Building. In 1997, the Senate of the Philippines moved to the GSIS building where it is currently housed.

Laws passed by the bicameral legislature would restore “Republic Acts”, as the laws were named in the Third Republic (1946-1972). Moreover, it was decided to maintain the old count, taking up where the last pre-martial law Congress left off. Thus, the last Congress under the 1935 Constitution was the seventh Congress, and the first Congress under the 1987 Constitution became the eighth Congress.