Philippines Warns of Sustained Chinese Espionage as Arrests Expose Surveillance and Influence Networks

Surveillance cases put Manila's defenses under scrutiny

Six Chinese nationals and a Filipino arrested near Subic Bay, a vehicle carrying surveillance equipment in Metro Manila, and cameras facing a coast guard base in Palawan have brought a growing Philippine security concern into focus. Authorities say suspected Chinese espionage reaches across military installations, naval movements, local civic organizations and computer networks.

As of September 13, 2025, Philippine security officials warn that spying, influence campaigns and psychological operations are accelerating inside the country alongside confrontations in the West Philippine Sea. Psychological operations seek to shape how people think and act, while espionage seeks information that a government or organization wants to protect.

Cornelio Valencia, assistant director general of the Philippine National Security Council, said authorities were recognizing how widely Chinese operatives had been working. Government media carried his assessment:

The Chinese have been operating in the Philippines for some time and we are now realizing the extent of their operations.

Valencia also described malign influence activities as approaching the scale of Chinese ship deployments and movements in the West Philippine Sea:

almost on par

Beijing rejects the accusations as smear campaigns. Philippine agencies say the pattern of activity on land, at sea and online requires a continuing response, while lawmakers and security officials want to update espionage laws written decades before drones, cyber intrusions and social media manipulation became tools of state power.

The arrests remain allegations to be tested through legal proceedings. Deng Yuanqing, the software engineer detained in the Metro Manila investigation, contests the accusation against him in court. The Chinese embassy in Manila has urged Philippine authorities to protect the rights of Chinese nationals as the cases proceed.

What investigators found in Manila and Palawan

In January, agents detained Deng and two Filipinos after tracking a vehicle equipped with advanced surveillance gear around sensitive installations in Metro Manila. Authorities allege that Deng mapped critical sites. The vehicle became one of the clearest examples of the specialized equipment investigators say suspected operatives were using.

Philippine investigators say Chinese nationals and Filipino associates surveyed military sites in Manila, Palawan and Subic Bay. In separate incidents, suspects were observed near the presidential palace, the US embassy compound, Camp Aguinaldo, Villamor Air Base and coastal outposts, often carrying cameras, drones or specialized electronics.

Days after the arrests involving Deng, five Chinese nationals were arrested in Palawan. Witnesses reported that they had installed a camera at a resort facing a Philippine Coast Guard base, giving investigators another case involving surveillance from a location outside a military compound.

Storage devices seized in the Palawan investigation contained images of navy boats and patrol ships, according to case summaries shared by security officials. The vessels included BRP Ramon Alcaraz, BRP Teresa Magbanua and BRP Gabriela Silang.

Another case involved two Chinese nationals who investigators said possessed an international mobile subscriber identity catcher, commonly called an IMSI catcher. The device imitates a mobile phone tower and can collect information from phones across a large radius. Together, the cases show why authorities are examining both photographs of military facilities and electronic collection of information.

Why Grande Island drew attention

By March, investigators had turned their attention to Subic Bay and nearby Grande Island. The island historically guarded the entrance to what was once the largest US naval base outside the United States. Its position also offers a view of ships entering and leaving the bay.

The National Bureau of Investigation (NBI) arrested six Chinese nationals and a Filipino there. Witnesses said members of the group posed as recreational fishers, used drones and lingered at wharves late at night. The Filipino suspect was detained for carrying an unregistered firearm.

NBI officers said photographs recovered from phones showed US and Philippine naval vessels in the area. Security analysts identified ships including USS Savannah, a littoral combat ship, and a Henry J. Kaiser class oiler. An oiler supplies fuel to other ships, making it part of the support system that keeps naval operations running.

Investigators said the group's position allowed it to watch naval assets moving through Subic Bay during patrols or joint exercises. Frequent US ship visits and new logistics activity at the port made those movements a valuable stream of information.

Subic Bay has regained a role as a military hub. The US Marine Corps has leased warehouse space there for prepositioning, which means keeping supplies in place before they are needed. Philippine and US ships also rotate through the port for exercises and patrols. Those activities help explain the attention investigators have given to Grande Island.

How the cases developed

The investigations unfolded against a longer period of maritime confrontation and contacts between Chinese organizations and Philippine institutions. The sequence connects the security pressures at sea with the surveillance and influence concerns now under examination:

• Since early 2023, Chinese coast guard and maritime militia vessels have used ramming and high pressure water cannons against Philippine boats in the West Philippine Sea.
• Throughout 2024, photographs and event programs showed repeated meetings between leaders of civic groups later linked to suspects and China's military attaché in Manila.
• In January, agents detained Deng Yuanqing and two Filipinos in the surveillance vehicle case. Days later, five Chinese nationals were arrested in Palawan.
• Also in January, four Chinese nationals who led civic groups tied to China's party influence network were charged.
• By March, the NBI investigation had shifted attention to Subic Bay and Grande Island, where six Chinese nationals and a Filipino were arrested.
• By September 13, 2025, security officials were calling for stronger responses to espionage, foreign interference and cyber operations.

Philippine agencies say evidence in ongoing cases includes photographs, maps, drone footage and specialized devices recovered during arrests. Their wider concern is how information gathered from different places could help an outside power follow military activity and shape decisions inside the country.

Donations and contacts bring influence under scrutiny

Four Chinese nationals charged in January led civic groups tied to China's party influence network. The groups donated cash to the city of Tarlac and motorbikes to police forces in Tarlac and Manila. Photographs and event programs showed repeated meetings through 2024 with China's military attaché in Manila.

China's foreign ministry says the organizations are self managed groups rather than state bodies. City officials who accepted the donations said the gifts were lawful. Critics warned that routine donations from groups with foreign links can open doors and create a sense of obligation, including when the gifts comply with laws against graft.

Security agencies describe a method involving local contacts, favors and payments. A person approached through a civic organization, public event or donation may see the relationship as friendly assistance, while investigators may be examining whether it serves a foreign government's interests. Those overlapping roles can slow law enforcement.

Investigators and scholars say influence is a separate line of activity alongside espionage. Information campaigns seek to shape public perception and policy, while surveillance gathers details about facilities, personnel or movements. Philippine officials are concerned about both forms of activity operating at the same time.

The Philippines has yet to pass a dedicated foreign interference law. Existing statutes do not directly address modern information campaigns, covert funding of public events, or influence activity on campuses and within civic groups. Analysts argue that exposing one operative may point to others working in the background, adding pressure for legal tools that reach beyond traditional spying.

From drones to devices that imitate phone towers

Drones give a camera a view over bases and ports without requiring the operator to cross a fence. The suspected use of drones around Subic Bay illustrates how ordinary equipment can be used to observe sensitive movements from outside a restricted area.

An IMSI catcher works differently. By presenting itself as a mobile phone tower, it can trick nearby phones into connecting. Investigators say such devices can harvest phone identifiers and, depending on their capabilities, sometimes message content. The identifiers can help track which phones are present in an area.

Security forces have also recovered underwater unmanned vehicles of Chinese origin at sea. Officials view those recoveries as suggesting a broader maritime reconnaissance program around choke points, reefs and patrol routes. Reconnaissance means gathering information about an area or the activity within it.

The combination of cameras, drones, electronic collection devices and underwater vehicles gives security agencies several types of evidence to examine. Some equipment observes physical movements, while other tools collect digital information. Each requires investigators to understand how it was used and preserve the material it gathered.

A defense contractor faces a stealthy cyber campaign

Security researchers say a Philippine defense contractor was targeted with a toolkit known as EggStreme. They linked the campaign to actors with ties to China and described an effort to gain quiet access to systems used by organizations working near contested maritime zones.

EggStreme operates in computer memory and hides its activity inside trusted Windows processes, according to the researchers. It can run dozens of commands to move through networks, capture keystrokes and siphon data. Capturing keystrokes can expose what a person types, while moving through a network can give an intruder access to additional computers.

The toolkit's approach avoids leaving files on a hard drive, making detection harder for traditional antivirus software that looks for suspicious files. Researchers describe the method as designed to keep access discreet while collecting information.

Philippine and US officials have stepped up intelligence sharing and cyber cooperation to detect such activity earlier and contain it faster. The cyber campaign adds another part to the security challenge: protecting information inside organizations that support defense work, alongside guarding ports, airfields and military installations.

Why officials want to rewrite espionage laws

Philippine prosecutors still rely on the Espionage Act of 1941 and espionage provisions in the Revised Penal Code of 1932. National Security Adviser Eduardo Ano and Defense Secretary Gilberto Teodoro have urged Congress to amend the laws to cover modern methods and impose stronger penalties, including for acts committed in peacetime.

Prosecutors also want provisions covering non kinetic information operations, covert funding aimed at public officials or units, and the use of drones and cyber tools against military sites and critical infrastructure. Non kinetic operations use information or other means rather than physical force to pursue an objective.

Lawmakers and security experts are discussing a dedicated foreign interference statute and clearer definitions of espionage across physical and digital activity. Other proposals include stronger rules for donations to uniformed services and reporting requirements for political and civic groups with foreign backers.

Cyber defense proposals include mandatory breach reporting for vendors with government contracts, stronger protection for telecommunications networks, and more resources for the NBI and the Armed Forces of the Philippines (AFP). Agencies want greater capacity to investigate online targeting and financial flows.

Officials argue that clearer legal definitions would deter operatives and give courts a firmer basis for handling cases involving newer technology or influence tactics. These measures remain proposals; no date was given for their passage or for the next hearings in the ongoing cases.

The maritime dispute raises the stakes

The West Philippine Sea dispute is central to Manila's assessment of the threat. Chinese coast guard and maritime militia vessels have pressed China's expansive claims against the Philippines' exclusive economic zone, while Philippine security officials connect the pace of covert activity with the pressure at sea.

An exclusive economic zone (EEZ) is an area of sea where a coastal country has rights over resources. Manila says Chinese actions threaten those rights and violate the 2016 international ruling that rejected China's nine dash line claim. Beijing says it is enforcing its sovereignty.

Ramming and high pressure water cannon attacks against Philippine boats since early 2023 have pushed Manila to deepen defense ties with the United States and other partners. More exercises, patrols and logistics activity create additional movements that investigators say suspected spies have tried to observe.

Taiwanese authorities have also announced arrests of retired officers accused of spying for Beijing. Those cases place the Philippine investigations within a wider regional concern about covert collection and influence, while Manila's immediate focus remains the incidents on its own territory and near its maritime operations.

China rejects the accusations and alleges Philippine spying

China's government describes the Philippine arrests as politically driven. Chinese state media reported that three Filipinos had been detained in China for alleged espionage, saying they were recruited by a Philippine intelligence handler and sent to photograph military facilities.

Chinese authorities said the suspects confessed. Philippine officials have described such televised confessions as unreliable and possibly coerced. The accusations deepen mutual suspicion and increase the risk of reciprocal detentions, even as both governments say they want to keep communication channels open.

The Chinese embassy's call for protection of its nationals' rights sits alongside Manila's position that its agencies are enforcing Philippine law. Philippine investigators point to the photographs, maps, drone footage and specialized equipment recovered in the cases as evidence for their allegations.

Protecting security and civil rights together

The Philippine Chinese community has warned against sensationalism and discrimination. Security officials and civic leaders say enforcement should focus on evidence and individual conduct, while avoiding blanket suspicion based on ethnicity or nationality.

That balance matters as Manila seeks support for tougher laws and more intrusive counterintelligence work. Authorities must investigate suspected foreign operations while protecting civil liberties and the rights of people living and working in the Philippines.

Security planners describe a response involving institutions and communities across the country. Measures include tighter access controls at ports and airfields, stronger vetting of contractors working at bases, community outreach, and better police training in handling digital evidence.

Critical infrastructure operators are reviewing vendor access and data handling. The Justice Department and the NBI want faster channels for working with telecommunications companies on lawful interception and network forensics, the examination of network activity to trace an intrusion or collect evidence.

Private firms are encouraged to use endpoint detection tools, which monitor devices for suspicious activity, and to practice incident response. These measures aim to make foreign operations harder to conduct, whether they involve people observing naval movements, organizations cultivating local contacts or intruders seeking access to computer systems.

The Essentials

• Philippine security officials warn that Chinese espionage, influence campaigns, disinformation and psychological operations are continuing at a high pace.
• Cornelio Valencia linked malign influence activity to the scale of maritime pressure in the West Philippine Sea.
• Investigations in Manila, Palawan and Subic Bay involve surveillance equipment, cameras, drones and images of military facilities and ships.
• The Grande Island case involved six Chinese nationals and a Filipino; the Filipino was detained for carrying an unregistered firearm.
• Authorities are examining civic donations, local recruitment, mobile phone surveillance devices and recovered underwater unmanned vehicles.
• Researchers linked the EggStreme campaign against a Philippine defense contractor to actors with ties to China.
• Officials want to update laws dating to 1932 and 1941 and create stronger tools against foreign interference.
• Beijing denies the accusations and has alleged espionage by three Filipinos detained in China.
• Philippine agencies are pursuing stronger physical and cyber defenses while facing calls to protect civil rights and prevent discrimination.