The price of stealing Philippines’ top security secrets

2026-03-06 - 06:33

The Philippine government’s “Insider Threat Program” uncovers how foreign nationals — believed to be Chinese — recruit young government personnel with access to sensitive security and defense information. The sweep goes beyond the military and defense department and into the Philippine Coast Guard (PCG), a frontline unit when it comes to defending the country’s entitlements and claims in the West Philippine Sea. A Chinese national targets a man in Palawan province with access to critical PCG information and documents, exposing even the Philippines’ most sensitive missions to the crucial waterway. (Last of three parts) In 2024, over 313,856 Chinese nationals entered the Philippines as tourists. Among them was Peter*, a man who had been boss to Danny*, a Filipino, for over a year. (We are concealing Danny’s real name to protect his identity. “Peter” was how he introduced himself to Danny.) Danny and Peter had never met before, although they chatted online extensively through publicly available messaging apps or a secret chat app disguised as a tetris game. Peter was Danny’s boss — although Danny himself wasn’t sure who Peter was working for, or what the work was actually all about. But Danny knows this: before agreeing to meet for lunch at a restaurant in Mandaluyong City, he had to follow his own security protocols. He insisted that Peter show himself, from a distance, at the Taguig hotel he was staying in before they would meet some six kilometers away at a mall in Mandaluyong. The day before, on December 11, Peter entered Manila using a Chinese passport and a Philippine tourist visa, based on documents sourced from security officials and seen by Rappler. Immigration records showed that Peter arrived wearing thick-rimmed glasses and neatly-styled hair. Two days later, sans glasses and with a messier hairdo, the 25-year-old left Manila. Danny’s lunch with Peter was purely social, and they were not to talk about work. Danny was promised thousands of dollars for agreeing to meet in the first place. The precautions were understandable. After all, their year-long interactions could be punishable under Philippine laws. From early 2024 to mid-2025, Danny sent to Peter information and documents — almost all of them sensitive — from and about the Philippine Coast Guard (PCG) in Palawan. In an interview with Rappler in December 2025, Danny detailed the kind of information that he had access to and sent to Peter, upon the latter’s request: PCG’s personnel and staffing Its rotation and resupply (RORE) missions, both in support of the Philippine Navy and for its own personnel in the West Philippine Sea PCG’s foreign visitors in Palawan Danny is one of several Filipinos identified by government agents as those lured to engage with Chinese bosses. These foreigners scoured social media for the most vulnerable and most available possible sources of information — individuals who had access to national security information and who were, either unwittingly or wittingly, sharing this information to foreigners. In at least four of these cases, recruiters were interested in the same things: RORE missions, the Philippines’ multilateral or bilateral defense engagements, relations with the United States, the Philippine military’s capabilities and strategies, the location of key military assets, and even the basing details of the Armed Forces of the Philippines (AFP). Danny worked with Peter for over two years, sending him near real-time updates on the PCG’s activities in Palawan, including critical RORE missions to the West Philippine Sea. Security officials in the Philippines see the recruitment of Danny, Lawrence, and Alison as part of a larger effort by Beijing to create an information and espionage network. That network used to include only state agents or state-contracted Chinese nationals; now, they include Filipinos — citizens of the country they are spying on. “Necessary actions have been taken against the individuals concerned — all Filipino nationals — who have all confessed their complicity in espionage activities and are cooperating with authorities,” said National Security Council (NSC) spokesperson Assistant Director General Cornelio H. Valencia Jr. on Wednesday, March 4. In a statement released after Rappler published the first part of this investigative series on March 4, Valencia described Danny, Lawrence, and Alison as persons who were acting “on the behest of Chinese Intelligence.” He said their work has been “addressed and terminated.” “The apprehension of these individuals is a result of joint operations by various national government agencies under the Insider Threat Program. The program seeks to protect national security sensitive information, capabilities, and operations from foreign espionage, turn/coercion, and malicious or negligent compromise. The program covers many government agencies handling sensitive information,” he added. The Chinese embassy in Manila did not answer directly if it had knowledge of its nationals engaging in espionage in the Philippines, but said its government “always asks Chinese nationals overseas to abide by local laws and regulations.” “We have no interest in interfering in [the] domestic affairs of other countries, through any means or by directing any Chinese citizens. We urge certain individuals and institutions in the Philippines to respect facts and refrain from floating unfounded accusations and presumption of guilt in the absence of solid evidence,” the embassy said. The ‘prized’ recruit For a long time, security officials would wonder why the China Coast Guard (CCG) seemed to know just when or where to expect the Philippines’ RORE missions. It might have been advanced satellite imagery or other more basic means of visual confirmation. In January 2025, for instance, law enforcement arrested five Chinese nationals accused of covertly collecting information on PCG and Navy ships in Palawan and Manila, on top of monitoring ports and waterways that those ships pass through on their way to West Philippine Sea missions. But in August 2024, Danny realized another possible source of information: himself, through his work with Peter. That month, Danny saw on social media photos of the PCG’s BRP Cape Engaño with a large, gaping hole on its deck. A CCG ship had collided with the vessel as the latter was en route to a resupply mission to PCG outposts in the West Philippine Sea. A couple of days before the collision, Danny relayed to Peter the mission’s details, including which ships were involved, when and what time they would leave Palawan, and where they were heading. “Sabi ko sa kanya, ‘Ba’t mo binangga [’yung barko]? Kanino mo ’binigay ’yung information na ganoon?’” Danny recalled. (I told Peter, “Why did you hit the ship? Who did you give the information to?”) Peter did not answer Danny’s questions, and just told him: What’s important is that his “clients” get the information and that Danny gets paid for that information. Danny felt sick to his stomach when he thought about how his own friends in the PCG could have been hurt. Peter responded by giving Danny cash. “I think he did that because I got upset,” he recalled in an hours-long interview with Rappler. That’s not to say that Danny was forthright either. When he was recruited by another person who introduced himself as Anthony*, Danny was told he was “prized” because he was a member of the PCG. But he was not — a detail he did not tell Anthony nor Peter. Danny only had access to the PCG through close ties with one of its personnel. From taking photos of files that were left out in the open, he found a way to access an informal group chat of PCG Palawan personnel. Later, he was able to access an official PCG official email account shared across different computers. “The main consideration that we did as adjustment is to have a more secure way in handling information with regard to our operations in the West Philippine Sea,” said Rear Admiral Jay Tarriela, spokesperson for the PCG on the West Philippine Sea, in a chance interview with media on Friday, March 6. Tarriela said the PCG is “coordinating” with various government intelligence agencies to prevent more leaks. “This incident proves that the Chinese government is doing all possible actions to undermine our national security and to weaken our position, especially when it comes to operations in the West Philippine Sea,” he added. Like Lawrence and Alison, Danny was recruited on social media, via a private message from Anthony on LinkedIn. Once Danny was in, the change in bosses was quick — Anthony just stopped replying and then, out of the blue, Peter began messaging Danny. In the first few months of working for Anthony and then Peter, Danny went from drafting reports based on open sources to weeding out information from the groups chats of friends in the PCG and, later, an official PCG email account. Easy questions would net Danny a few thousand pesos, paid through digital banks. Their relationship stalled briefly after the August 2024 collision. But after his “bonus,” Danny continued to provide information and introduced some changes: He would relay information a day later, or would change the vessel departure date by a day or two. “I can assure the public that everything is in check... we will make sure that espionage efforts will not succeed,” said National Security Adviser Eduardo Año told reporters on Thursday, March 5. Año also urged Filipinos, particularly government workers, to be critical of “job offers” lest they find themselves in situations similar to those caught in the Insider Threat Program — coerced or deceived into spying for China. A special phone, a special app Unlike Lawrence or Alison, Danny had just a touch more sway with his Chinese “boss.” In late 2024, after he claimed he was being monitored and no longer wanted to communicate using his personal phone, Peter sent by courier a smartphone that came preinstalled with a chat app concealed within a Tetris game where they could communicate moving forward. The new gadget and app gave Danny an added sense of security because he had to input a code into the game before it would turn into a chat platform. Depending on what he sent Peter, Danny could get up to tens of thousands of pesos for a document. Later on, he was given a fixed “rate” on top of the per-document payment he was getting. The payments were all digital, and pains were made to conceal where they came from. Transactions never came from the same person or the same platform. Sometimes, they were cash deposits made through physical banks to his digital bank accounts. There were also digital bank transfers, but the sender would never be the same person. The second time Danny would have second thoughts about his work was in March 2025, when he realized that he was putting his and his friends’ safety at risk. Peter asked him to stay, but Danny would not budge. Within a week or two, Peter wiped out the Samsung phone remotely, and the gaming app was nowhere to be found. Danny’s pause did not last long. By June 2025, his family’s business back home went bust. His elder sibling fell sick again, and his younger siblings were about to start college. Since he was the family’s breadwinner, Danny soon went back to work for Peter — a relationship that went on until he was caught in June 2025 by Philippine security personnel as part of the Insider Threat Program. That Danny was able to access sensitive files and information from friends in the PCG , with relative ease is telling of weaknesses in the Philippines’ and the PCG’s information security and integrity protocols. But their recruitment wiles did not work on everyone, however. The few good men After more than a decade as an officer in the Navy, Charles* decided in late 2023 that it was time to retire. His salary as a junior officer in the force was enough to make ends meet, but with his children nearing college age, Charles figured it was time to focus on serving his family. Toward the end of the year, he started scouring the internet and LinkedIn for job openings, with the goal of retiring by 2024. It didn’t take long for someone to message him, recalled Charles in a September 2025 interview. Jessica*, a Filipino woman who appeared to be in her 30s, said they were “impressed” by Charles’ CV. In the Navy, he handled policy and planning, and dealt with foreign counterparts. Consultancies at major private firms, or multilateral development banks, Charles thought, would be on the horizon. A month after an initial Zoom meeting, Charles and Jessica met at a small hotel in Quezon City. He learned that the whole company worked remotely, and its supposed headquarters was still being constructed. Jessica said she couldn’t talk about who their clients were, citing privacy issues. Charles thought this was suspicious, but shook the feeling off. Since the company was supposed to be a start-up, its website was mostly unfinished. Jessica’s spiel neatly explained why there was little about the company online. She also said she couldn’t disclose who their would-be clients were, for privacy reasons. Then Jessica asked Charles: What facilities are inside military camps in the Philippines? He didn’t understand the question. Jessica expounded: What facilities are inside the camp? Are there communication facilities? Barracks? A playground? How many people live there? Charles was taken aback. His face hardened as he retold Rappler this part of the story. “I told her, ‘That’s classified.’” Looking back, Charles thinks she was reading off a script, both in their Zoom and in-person meetings. Charles brushed off what he now thinks as red flags. After two weeks, he got his first assignment brief from Jessica via the chat app Telegram: a paper about “how Filipinos interact with Americans,” with explicit instructions for him to include his own personal experience in dealing with Americans. For less than 2,000 words, he was promised up to P15,000. Since he couldn’t find literature specific to Filipino-American work dynamics, he turned to business research that spoke, in theoretical terms, about how cultural differences play out in the workplace. After a week of writing — and only after his official work hours in the Navy — Charles turned in his first piece. Jessica told him a week later that his work wasn’t what they were looking for. They wanted to read about his personal experience in dealing with Americans — such as his American counterparts in the military — and how their dynamics played out. For the second time within months of knowing Jessica, Charles was taken aback. “That’s classified, a breach of confidentiality, and beyond what you need to know,” he told her. If they weren’t happy with what he already wrote, then fine, he could always find a new opportunity. Weeks later, Jessica reached out again with the promise of trips to Hong Kong, Malaysia, or the United States, and a starting pay of P15,000 for a part-time gig. This time, Jessica said her “higher-ups” wanted to meet Charles. “Para saan (What for)?” Charles asked both Jessica and himself. Around the same time, Charles happened to come across a news report about China’s United Front Work (UFW) or its multi-faceted, broad strategy to co-opt and influence key sectors of society. The red flags he had spotted before, Charles recalled, suddenly made more sense. Jessica persisted and reached out again. This time, Charles was more blunt. “I have a feeling you’re working for the Chinese,” he told her. She didn’t answer his question, and instead boasted of her work benefits: a good salary, “very generous” bonuses, and the ability to travel both for work and to where she wanted to go. It wasn’t even a question for Charles. There was no world in which he would say yes to undermining the Armed Forces of the Philippines, an institution that he had devoted most of his adult life serving. — Rappler.com