MANILA, Philippines — Desperate to find a new source of income because his business was going bankrupt, a Filipino man in his 20s responded in 2024 to an online ad for what he thought was a U.S.-based publication seeking a writer specializing in Philippine defense.
The man, who identified himself as “Danny,” told Radio Free Asia that is how he was initially recruited into what he and the Philippine armed forces now believe was a Chinese spy program.
Danny is one of three Filipino nationals arrested for alleged espionage for China earlier this year. He is currently detained by the Philippine military, which allowed him to tell his story to RFA, saying Danny’s case is part of a growing trend of job seekers who find themselves spying for Beijing, even without knowing it at first.
Danny has been cooperative since the start of his detention and his story is consistent with evidence from the military investigation, according to a military source who requested anonymity due to the sensitive nature of the case. RFA was unable to independently confirm Danny’s testimony using non-military sources.
Easy money?
The ad that caught his eye was looking for a military consultant, so Danny, who already had a strong business relationship with the Philippine Coast Guard, posed as an active member to increase his chances of being hired. The deception apparently paid off and he soon began filing Coast Guard reports to get extra money.
At first it was easy, he said. Everything they wanted was publicly available online. But quickly the missions evolved into detailed investigations into troop movements, including patrols in the West Philippine Sea, the term Manila uses for areas of the South China Sea that it considers part of its exclusive economic zone, much of which is also claimed by China.
At one point, Danny got so involved that he stole the cell phone data of his friend, a coast guard officer. The information he provided made his employer happy. But the requests became more and more urgent and his contacts more and more demanding.
Danny spoke to RFA in a mixture of English and Tagalog in a room guarded by Filipino soldiers at an undisclosed location in Manila. He had obscured his physical features with a mask, sunglasses and a hiking cap. He explained why he initially responded to the ad.
“I had a business problem and was desperate for money,” he said. “I was enticed to work for them because of my situation.”
During the interview, Danny removed the cap and hood.
Loose lips…
Danny realized what he was doing had dangerous consequences in August 2024, when the Chinese Coast Guard Ship 3104 collided with two Philippine Coast Guard vessels – the BRP Bagacay and the BRP Cape Engaño – near Sabina Shoal, in the disputed Spratly Islands chain. Although no one was injured, both Philippine ships suffered heavy damage.
Before the incident, Danny had provided the coordinates of the ships to his employer and he said his report could have allowed the Chinese to intercept them.
“I was angry, I didn’t expect them to hit the ships. I had friends there,” he said.
After the clashes in the Spratlys, he began to suspect that his employer might not be a US-based publisher and so cut off all contact.
The employer sent someone who identified himself as “Peter”, who Danny assumes was a Chinese agent tasked with preserving the relationship with the asset manager.
Peter offered Danny a raise to continue sending information.
“That’s when I found out I was being used, but I continued anyway.” » Danny said.
After meeting Peter, Danny began using an alternative method to transmit data. On his smartphone was an app that, to the untrained eye, looked like a mobile version of the popular video game Tetris, but in reality it was the access point to a secret website where he could download the data he had stolen.
Blown cover
The military began to suspect that someone was leaking information to the Chinese after the Spratly incident, according to the military source, but the military source did not confirm to RFA when it learned that Danny was the culprit.
About a year after the incident, in mid-2025, Danny suspected the authorities were going after him and asked Peter for help.
“‘Keep calm,’ that’s what he said. ‘We’ll come get you.'”
But Danny was scared, he explained. He thought this meant the spy organization would send more agents to get him out of the Philippines or, worse yet, silence him.
Before that could happen, the Philippine military arrested him.
“I was surprised, even though I knew it was going to happen,” Danny said. “Now I am cooperating with the government, but what will happen to me in the future is still uncertain. »
Danny said his friends in the Coast Guard now consider him a traitor.
“What I regret most is what happened at Cape Engaño, but there’s nothing more I can do. It’s already happened,” he said.
The military would not say whether Danny is accused of espionage or any other crime, whether he had legal representation, or whether he would be tried in court.
RFA was not authorized to speak to the two other suspected Filipino spies for China – civilian personnel of the Philippine Department of Defense and the Navy.
Like Danny, they also allegedly sold sensitive information to the Chinese, including troop positions and details of a military modernization program backed by the Philippines’ key ally, the United States, the military source said.
Spies Among Us
The arrest of the three spies could be just a “scratch” in a larger network, retired Rear Admiral Roy Vincent Trinidad, a Philippine Navy spokesman in the West Philippine Sea, told RFA.
“We discovered that payments were being sent via e-wallets, dead deposits or via delivery packages,” he said. “Where do they come from and who are these people sending them money? »
Trinidad said the hunt for more Filipino spies and their Chinese handlers was on, and that the arrests of Danny and the two others were the result of the “insider threat program” launched in 2023 and focused on protecting sensitive government data, particularly those related to the South China Sea.
Officials said the recruitment of spies typically follows a similar pattern. Spymasters recruit on publicly accessible online job platforms, such as onlinejobs.ph or LinkedIn. Targets are often those with significant experience in the military, either as active duty members or in civilian roles.
A woman, who identified herself as Maria Nena, who previously worked for the Navy and had sensitive data, told RFA that in 2023 she responded to a job posting for a regional military researcher position for a publication called Military Express. A person claiming to represent the publication contacted her and gave her a recruitment test.
“I was given a series of questions to answer and told I would be given 1-3 tasks to complete as part of the selection process, all of which would be paid upon completion,” Nena said. “After submitting my response, I never heard back.”
A few months later, she saw a similar ad on Facebook, using her real name as the contact. She became suspicious and contacted the group. They contacted her via messaging platform WhatsApp and asked where they could acquire sensitive documents she had co-authored for the navy.
“They asked where they could buy the book, but I said it was not for sale because it was confidential material,” she said. “They asked where to download a declassified document on civil-military operations released by the United States in 2018. I did not answer.”
She instead informed authorities of the recruitment attempt, but the complaint was never resolved.
RFA was unable to confirm whether the two advertisements were produced by the same organization.
Growing sophistication
As the spotlight shines on China’s espionage activities, the Philippines needs to be more vigilant about the modern methods Beijing uses to recruit spies, analysts told RFA.
“Now that this activity has been exposed, the Philippines’ defense and security apparatus must take into account more sophisticated attempts to collect sensitive information, including hacking,” said Julio Amador III, a Manila-based political analyst who focuses on maritime disputes in the South China Sea.
There are “acceptable diplomatic activities” in which accredited diplomats exchange information for a common purpose, but buying off state employees to obtain state secrets is clearly illegal, he said.
“News is a polarizing platform,” Chester Cabalza, founder of the Manila-based International Development and Security Cooperation Research Group, told RFA.
He said Filipinos acting as spies for Beijing herald a new era in which the “generation, transmission and use of information” are the “new engines of military power.”
“Espionage derails the success of a maritime or land strategy,” he said, noting that the 2024 Spratlys collision incident proves that the Chinese spy network in the Philippines is active.
China has categorically denied all allegations of espionage. “In recent years, the so-called Chinese spy cases have either collapsed or been riddled with factual errors,” Beijing’s embassy in Manila said in a statement in February, when the first reports about the alleged spy ring emerged.
Edited by Eugene Whong.