Spy recruitment ABCs targeting Pinoys bared: Defense personnel offered fake research jobs

What appeared to be harmless freelance research jobs advertised online have now been linked to a covert espionage effort targeting Philippine military operations in the West Philippine Sea (WPS).

Some Filipino civilian employees connected to the Department of National Defense, the Philippine Navy and the Philippine Coast Guard were recruited through job-search platforms and paid thousands of pesos to answer what initially seemed like academic questions about geopolitics, authorities said.

Investigators added that the questions were anything but academic.

According to Philippine Navy Rear Admiral Roy Vincent Trinidad, spokesperson for the West Philippine Sea, the suspects were gradually drawn into providing sensitive information about Philippine defense operations.

“They were happy initially because they thought they had a job already,” Trinidad said.

The arrested recruits, identified as Lawrence, Allison, Danny and Charles, had posted their résumés on professional networking platforms such as LinkedIn when they were approached by individuals posing as representatives of research organizations.

The assignments appeared legitimate: write geopolitical analysis or answer policy-related questions. However, investigators say the queries slowly shifted toward sensitive military matters.

For more than two years, the recruits presumably provided China information about Philippine defense and foreign policy positions, military logistics and supply operations to Ayungin Shoal.

Six-digit salaries

Some of the questions involved troop rotation and roll-on/roll-off mission schedules supplying the Philippine military outpost aboard the BRP Sierra Madre (LS57), the grounded naval vessel that serves as Manila’s forward outpost in the contested waters.

Other requests reportedly sought the names of personnel assigned to detachments operating in the West Philippine Sea.

Payments ranged from thousands of pesos to as much as P100,000 and were delivered through electronic wallets. Bonuses were also given in exchange for valuable information supplied.

Investigators believe the espionage operation was state-linked.

The National Security Council has said the activities were tied to China, citing the nature of the information requested and the targets of the intelligence collection.

One of the suspects reportedly admitted he realized too late that he had been providing information to Chinese intelligence-linked actors but said financial need drove him to continue.

Ramming

According to Trinidad, one of the recruits only grasped the possible consequences of his actions after watching news footage of a Philippine Coast Guard vessel nearly rammed by a Chinese ship near Escoda Shoal.

The suspect reportedly connected the incident to intelligence he had earlier passed to his handlers.

Trinidad warned that the information provided may have compromised the safety of Armed Forces of the Philippines and Philippine Coast Guard personnel deployed in the West Philippine Sea.

National Security Adviser Eduardo Año described the case as “alarming,” although he said the leaked information was “sensitive but not that high.”

Security officials say the arrests may represent only part of a broader espionage effort.

“Common sense will tell us that most likely there are other spies,” Trinidad said. “These three can be considered a closed case, and we disclosed it so the public would know. But that does not mean it ends there.”

Handlers

Investigators said the suspects communicated with foreign handlers who spoke with noticeable accents. Some sounded Korean but were “obviously Chinese,” while another spoke with what investigators described as a British-Australian accent.

Authorities maintained that the handlers were reluctant to travel to the Philippines, preferring to coordinate remotely while payments were routed electronically.

For Philippine defense officials, the case underscores what they say is a growing effort to infiltrate the country’s “cognitive domain” — shaping information flows while quietly extracting intelligence.

“There is a pattern when it comes to attempts to infiltrate the cognitive domain of Filipinos,” Trinidad said. “Attempts to infiltrate in a very subtle way to extract information from us.”

Trinidad said investigators discovered that the suspects used a covert communication method hidden within a modified gaming application.

“They were given communication gadgets. One had a special gaming app — Tetris — where the communication was embedded. Once you enter a password prompt, it becomes a communication app,” Trinidad explained.

As this developed, the Armed Forces of the Philippines clarified over the weekend that foreign nationals — including Chinese citizens — may still access recreational facilities located inside military camps, such as golf courses.

However, they must now undergo stricter visit clearance procedures.

“Foreign nationals who wish to access recreational facilities inside military camps are required to secure the appropriate visit clearance in accordance with existing AFP policies,” AFP public affairs chief Col. Xerxes Trinidad said.

Several golf courses operate inside military installations, including those in Fort Bonifacio, Villamor Air Base and Camp Aguinaldo.