The Philippine National Police (PNP) has intensified cyber operations to identify and arrest the individuals behind social media accounts allegedly used to encourage disruption and public disorder during President Ferdinand "Bongbong" R. Marcos Jr.'s fifth State of the Nation Address (SONA).

PNP chief Gen. Jose Melencio Nartatez Jr. directed the Anti-Cybercrime Group (ACG) to strengthen cyber monitoring and digital forensic investigations in coordination with the Cybercrime Investigation and Coordinating Center (CICC) and other partner agencies.

The move follows President Marcos' directive, relayed through Interior Secretary Jonvic Remulla, to ensure that individuals who use digital platforms to commit crimes are held accountable.

"The PNP, through our Anti-Cybercrime Group and in close coordination with the CICC and other partner agencies, is actively pursuing all available leads to identify those behind these online accounts," Nartatez said.

The CICC earlier disclosed that it had flagged nine social media accounts allegedly linked to hacker groups that sought to encourage public disorder and gatherings during the President's SONA on 27 July.

Authorities said the accounts have since been taken down after investigators preserved their digital evidence and turned it over to law enforcement agencies. Those responsible could face charges including computer fraud, identity theft, grave threats, and inciting to sedition or rebellion.

"We respect every Filipino's right to free expression, but we will take appropriate legal action against individuals who use digital platforms to incite violence, spread credible threats, or facilitate criminal activities," Nartatez said.

Investigators are also examining possible links between the online threats and two suspected improvised explosive device incidents reported on SONA day. One explosion occurred inside the Department of Justice compound, while another suspected IED was recovered near the Senate.

Nartatez said investigators have already developed leads on the individuals behind the incidents.

"We urge the public to remain vigilant, avoid sharing unverified or malicious content, and immediately report suspicious online posts to the authorities," he said.