Authorities are investigating an alleged espionage network involving Filipino nationals accused of acting on behalf of Chinese intelligence, describing the case as a “serious national security matter” amid the rising tension in the West Philippine Sea.

Malacañang on Thursday urged government employees to remain vigilant to prevent sensitive information from being compromised.

“According to the National Security Council, individuals have been identified as being involved in espionage and foreign-directed malign activities, and these operations were immediately addressed by our security agencies under the Insider Threat Program,” Presidential Communications Office Undersecretary Claire Castro told reporters.

She urged government personnel to safeguard sensitive information.

“Guard your offices, protect sensitive government information, and ensure that it is not compromised by actors who may pose a threat to national security,” Castro said.

The Armed Forces of the Philippines said activities involving Filipino nationals cooperating with foreign actors linked to malign operations have been disrupted.

AFP spokesperson Col. Francel Margareth Padilla said the development shows how espionage increasingly relies on cyber and technological methods.

“This development highlights how modern espionage increasingly utilizes cyber and technological methods, making vigilance and inter-agency cooperation more important than ever,” Padilla said.

Cyberattacks

She said the military supports efforts to strengthen safeguards protecting national security but declined to disclose operational details.

“At the same time, the Philippines continues to maintain constructive diplomatic engagement with all countries,” Padilla added.

Security officials said the investigation comes as cyber threats linked to China-based actors intensify, driven partly by geopolitical tensions over the West Philippine Sea dispute.

AFP Cyber Command chief Brig. Gen. Joey Fontiveros said the country faces persistent cyberattacks linked to the territorial dispute with China.

“From a security and defense viewpoint, the country faces persistent cyber attacks linked to territorial disputes in the West Philippine Sea, with China-based malicious actors deploying malware, DDoS attacks, data leaks, and website compromises,” Fontiveros said.

The NSC said the operations were uncovered and dismantled through coordinated actions by security and law enforcement agencies. Those involved—all Filipino nationals—have admitted their participation in espionage activities and are cooperating with investigators.

“For reasons of national security, we cannot discuss identities, methods, or timelines so as not to jeopardize ongoing operations,” the NSC said in a statement on Wednesday.

IMSI catcher

The authorities previously reported arrests tied to alleged Chinese espionage.

In April last year, a Chinese national was apprehended while operating a surveillance device near the Commission on Elections office in Manila shortly before the midterm elections.

The suspect allegedly used an IMSI catcher—a device capable of mimicking a cell tower and intercepting mobile communications within a radius of one to three kilometers.

Earlier, in February 2025, two Chinese nationals were arrested for allegedly using the same device near sensitive government and military locations in Manila.

Officials did not say if the latest case is linked to those incidents, but said investigations were continuing.