Philippines Warns of Ongoing High Level Chinese Espionage Activities

Manila sounds the alarm as spy cases pile up

Philippine security officials say Chinese spying, influence campaigns, and psychological operations are accelerating inside the country, mirroring the pace of confrontations at sea. The warning has sparked calls from lawmakers and the security sector to modernize laws that were written long before drones, cyber intrusions, and social media manipulation became part of statecraft. It also comes amid a series of arrests that point to a mix of surreptitious surveillance, local recruiting, and information operations that critics say aim to shape public perception and policy.

Philippine National Security Council Assistant Director General Cornelio Valencia said authorities are only now seeing the breadth of activity. He tied the surge to the contest with Beijing in the West Philippine Sea, where the Chinese coast guard and maritime militia have pressed China’s expansive claims against Manila’s exclusive economic zone.

Introducing Valencia’s view, government media carried his assessment that the scale of covert work is no longer marginal and that it sits alongside maritime pressure as a tool of state power:

“The Chinese have been operating in the Philippines for some time and we are now realizing the extent of their operations.”

He added that malign influence activities were “almost on par” with ship deployments and movements in the West Philippine Sea.

Beijing rejects the accusations, saying the cases are smear campaigns. The Philippine side counters that the pattern across land, sea, and online activity is too consistent to ignore. Security agencies say the country must treat espionage and interference as ongoing threats, not isolated incidents.

What arrests and raids are uncovering

Recent cases have sketched an outline of how suspected spies moved, collected data, and blended into daily life. Investigators say Chinese nationals and Filipino associates surveyed military sites in Manila, Palawan, and Subic Bay. In separate incidents, suspects were seen near the presidential palace, the US embassy compound, Camp Aguinaldo, Villamor Air Base, and coastal outposts, often with cameras, drones, or specialized electronics.

Drones, phones and a spy van

In January, agents detained Deng Yuanqing, a software engineer, along with two Filipinos, after a vehicle equipped with advanced surveillance gear was tracked around sensitive installations in Metro Manila. Authorities allege he mapped critical sites, a charge he contests in court. Days later, five Chinese nationals in Palawan were arrested after witnesses reported they had installed a camera at a resort facing a Philippine Coast Guard base. Investigators seized storage devices that included images of navy boats and patrol ships such as BRP Ramon Alcaraz, BRP Teresa Magbanua, and BRP Gabriela Silang, according to case summaries shared by security officials. Another case involved two Chinese nationals who, investigators say, had an international mobile subscriber identity catcher, a device that imitates a cell tower to sweep up data in a large radius.

Subic Bay emerges as a surveillance hotspot

By March, attention shifted to Subic Bay and nearby Grande Island, a historic stronghold that once guarded the entrance to the largest US naval base outside the United States. The National Bureau of Investigation (NBI) arrested six Chinese nationals and a Filipino who, witnesses said, posed as recreational fishers and used drones while lingering at the wharves late at night. NBI officers say images recovered from phones included pictures of US and Philippine naval vessels in the area, with security analysts identifying ships such as the littoral combat ship USS Savannah and a Henry J. Kaiser class oiler. The Filipino suspect was detained for carrying an unregistered firearm. Investigators say the group’s vantage point allowed them to watch naval assets entering and exiting Subic Bay during patrols or joint exercises, a valuable stream of information at a time of frequent US ship visits and new logistics activity in the port.

Influence tactics and local enablers

Espionage is only one arm of the effort, investigators and scholars say. Another line of effort is influence. Four Chinese nationals charged in January led civic groups tied to China’s party influence network and had donated cash to the city of Tarlac and motorbikes to police forces in Tarlac and Manila. Photographs and event programs show repeated meetings through 2024 with China’s military attaché in Manila. China’s foreign ministry says these are self managed organizations, not state bodies. City officials who accepted donations said the gifts were lawful. Critics warn that routine donations from foreign linked groups can open doors and create obligations, even when they do not break anti graft rules.

Why influence activity complicates counterintelligence

Security agencies say Beijing’s method often relies on co opting locals through contacts, favors, and payments. That blurs the line between foreign agent and helpful friend, which can slow law enforcement. The Philippines has yet to pass a dedicated foreign interference law, and prosecutors still rely on the Espionage Act of 1941 and the Revised Penal Code of 1932. Those statutes do not directly address modern information campaigns, covert funding of public events, or influence activity on campuses and in civic groups. Analysts argue that where one operative is exposed, more are likely to be operating in the background, which is why legal tools that reach beyond classic spy tradecraft are now a priority for Manila.

Technology shifts the playing field

The recent cases show a mix of old and new tools. Drones gave suspects eyes over bases and ports without crossing fences. An IMSI catcher, essentially a fake cell tower, can trick phones into connecting, then harvest identifiers and sometimes message content. Security forces also recovered underwater unmanned vehicles of Chinese origin at sea, suggesting a broader maritime reconnaissance program around choke points, reefs, and patrol routes.

From malware to maritime sensors

Cyber operations add another layer. Security researchers say a Philippine defense contractor was hit by a stealthy toolkit known as EggStreme that operates in memory, masks its activity inside trusted Windows processes, and can run dozens of commands to move through networks, capture keystrokes, and siphon data. They link the campaign to actors with ties to China and describe an approach that avoids leaving files on a hard drive, which frustrates traditional antivirus. The goal, the researchers say, is quiet access to systems used by organizations that work near contested maritime zones. Philippine and US officials have stepped up intelligence sharing and cyber cooperation to spot this kind of activity earlier and contain it faster.

Outdated laws collide with modern spying

Manila’s legal toolkit was written for a different era. The Espionage Act dates to 1941. The espionage sections of the Revised Penal Code date to 1932. Philippine National Security Adviser Eduardo Ano and Defense Secretary Gilberto Teodoro have urged Congress to amend the laws so the government can prosecute modern methods and apply stronger penalties, including for acts committed in peacetime. Prosecutors also want the law to cover non kinetic information operations, covert funding that targets public officials or units, and the use of drones and cyber tools against military and critical infrastructure.

What reforms could include

Lawmakers and security experts are discussing a dedicated foreign interference statute, clearer definitions of espionage across digital and physical domains, stronger rules on donations to uniformed services, and reporting requirements for political and civic groups with foreign backers. They also point to cyber defense needs such as mandatory breach reporting for vendors with government contracts, better protection for telecom networks, and more resources for the NBI and the Armed Forces of the Philippines (AFP) to investigate online targeting and financial flows. Agencies argue that updated legal definitions will deter operatives and give courts a firmer basis to handle cases that do not fit 20th century templates.

South China Sea tensions raise the stakes

The security backdrop is the West Philippine Sea, where Chinese coast guard and maritime militia vessels have used ramming and high pressure water cannons against Philippine boats since early 2023. Manila says these actions violate an international ruling in 2016 that rejected China’s nine dash line, and that the pattern threatens the Philippines’ exclusive economic zone (EEZ). Beijing says it is enforcing its sovereignty. The dispute has pushed the Philippines to deepen defense ties with the United States and other partners.

Subic Bay has regained its role as a military hub. The US Marine Corps has leased warehouse space there for prepositioning. Philippine and US ships rotate through the port for exercises and patrols. That activity explains why investigators say Grande Island offered a valuable vantage for anyone trying to watch allied movements. In parallel, Taiwanese authorities have announced arrests of retired officers accused of spying for Beijing, a reminder that the Philippines is not the only country confronting this mix of covert collection and influence.

Beijing denies and points to alleged Philippine spying

China’s government says the arrests in the Philippines are politically driven. Chinese state media reported that three Filipinos were detained in China for alleged espionage, claiming they were recruited by a Philippine intelligence handler and sent to photograph military facilities. Chinese authorities said the suspects confessed. Philippine officials have described such televised confessions as unreliable and possibly coerced. The cases deepen mutual suspicion and risk tit for tat detentions even as both governments say they want to keep channels open.

The Chinese embassy in Manila has urged the Philippines to protect the rights of Chinese nationals. Philippine agencies say they are enforcing the law, and that evidence in ongoing cases includes photographs, maps, drone footage, and specialized devices recovered during arrests.

Managing the risk without inflaming tensions

The Philippine Chinese community has warned against sensationalism and discrimination. Security officials and civic leaders say the country must separate careful enforcement from blanket suspicion based on ethnicity or nationality. That balance will shape how Manila builds public support for tougher laws and more intrusive counterintelligence while maintaining civil liberties.

Security planners describe a whole of society approach that includes tighter access controls at ports and airfields, stronger vetting for contractors at bases, community outreach, and better training for police on digital evidence. Critical infrastructure operators are reviewing vendor access and data handling. The Justice Department and the NBI want faster channels to work with telecom companies on lawful intercepts and network forensics. Private firms are encouraged to deploy endpoint detection tools and practice incident response. Each piece aims to raise the cost and risk for foreign operatives who try to work in the open or in the shadows.

The Essentials

• Philippine security officials warn Chinese espionage, disinformation, and psychological operations are running at a high pace inside the country.
• National Security Council official Cornelio Valencia said malign influence activities are nearly on par with maritime pressure in the West Philippine Sea.
• Authorities have arrested multiple Chinese nationals and Filipino associates in Manila, Palawan, and Subic Bay on suspicion of spying.
• Six Chinese and one Filipino were detained on Grande Island near Subic Bay, where investigators say drones were used to photograph US and Philippine naval vessels.
• Other cases involved a vehicle with surveillance gear in Metro Manila and suspects seen installing cameras near a coast guard base in Palawan.
• Investigators say some suspects used an IMSI catcher, a device that mimics a cell tower to harvest phone data.
• Four Chinese suspects led civic groups tied to China’s party influence network that donated cash and vehicles to local governments and police forces.
• Philippine laws on espionage date to 1932 and 1941, prompting calls for updated statutes and a dedicated foreign interference law.
• Cyber campaigns are part of the picture, with researchers linking a stealth toolkit known as EggStreme to a breach at a Philippine defense contractor.
• China denies the accusations and reported detaining three Filipinos for alleged spying inside China, a claim Manila treats with caution.
• US and Philippine defense cooperation at Subic Bay has expanded, and both sides are deepening intelligence and cyber coordination.
• Officials say the challenge is to harden defenses and modernize laws while avoiding discrimination and protecting civil rights.