MANILA, Philippines – Desperate for a new source of income because his business was failing, a Filipino man in his mid-20s answered an online advertisement in 2024 for what he thought was a U.S.-based publication looking for a writer focusing on Philippine defense.
The man, who identified himself by the pseudonym “Danny,” told Radio Free Asia that this is how he was initially recruited into what he and the Philippine armed forces now believe was a Chinese spying scheme.
Danny is one of three Filipino nationals who were caught for allegedly spying for China earlier this year. He is currently in the Philippine military’s custody, and they allowed him to tell his story to RFA, saying that Danny’s case is part of a growing trend of jobseekers who find themselves spying for Beijing, even unknowingly at first.
Danny has been cooperative since his detention began and his story aligns with evidence in the military’s investigation, according to a military source who requested anonymity due to the sensitive nature of the case. RFA was not able to independently confirm Danny’s testimony using non-military sources.
Easy money?
The ad that caught his eye sought a military consultant, so Danny, who already had deep business connections with the Philippine Coast Guard, posed as an active member to increase his chances of getting hired. The deception seemingly paid off, and he soon began filing reports about the coast guard for extra cash.
At first it was easy, he said. Everything they wanted was all publicly available online. But quickly, the assignments morphed into detailed inquiries on troop movements, including patrols in the West Philippine Sea, Manila’s term for the areas of the South China Sea it considers to be within its exclusive economic zone, much of which is also claimed by China.
At one point Danny got in so deep that he stole data from the mobile phone of his friend, an officer in the coast guard. The information he passed on kept his employer happy. But the requests steadily became more urgent, and his contact more demanding.
Danny spoke to RFA in a mixture of English and Tagalog in a room guarded by Philippine soldiers at an undisclosed location in Manila. He had obscured his physical features with a face covering, sunglasses and a hiking cap. He explained why he initially responded to the ad.
“I had a problem in business and was desperate to find money,” he said. “I was enticed to work for them because of my situation.”
Over the course of the interview, Danny would remove the cap and hood.
Loose lips…
Danny’s realization that what he was doing had dangerous consequences came in August 2024, when Chinese coast guard vessel 3104 collided with two Philippine coast guard ships – the BRP Bagacay and the BRP Cape Engaño – near Sabina Shoal in the disputed Spratly Islands chain. Though no one was hurt, the two Philippine ships sustained heavy damage.
Prior to the incident, Danny had provided the vessels’ coordinates to his employer, and he said his report may have enabled the Chinese to intercept them.
“I was angry, I did not expect that they would ram the ships. I had friends there,” he said.
After the clash in the Spratlys, he started to suspect that his employer might not actually be a U.S.-based publisher, so he cut off all contact.
The employer sent someone who identified himself as “Peter,” whom Danny assumes was a Chinese agent assigned to preserve the asset-handler relationship.
Peter offered Danny an increase in pay to keep sending in information.
“That’s when I learned I was being used, but I still continued.” Danny said.
After meeting Peter, Danny began using an alternative method to transmit data. On his smartphone was an app that to the unsuspecting eye looked like a mobile version of the popular video game Tetris, but in actuality it was the access point for a secret website where he could upload the data he stole.
Cover blown
The military began to suspect that someone was leaking information to the Chinese after the incident in the Spratlys, according to the military source, but the source would not confirm to RFA when they learned that Danny was the culprit.
About a year after the incident, in mid-2025, Danny suspected the authorities were on to him, and he asked Peter for help.
“‘Remain calm,’ that’s what he said. ‘We will come and get you.’”
But Danny was afraid, he explained. He thought it meant that the spy organization would either send more agents to take him out of the Philippines or worse, silence him.
Before any of that could happen, the Philippine military took him into custody.
“I was surprised, even though I knew it was coming,” Danny said. “Now, I am cooperating with the government, but what will happen to me in the future is uncertain as of yet.”
Danny said his friends in the coastguard now view him as a traitor.
“What I regret most is what happened to Cape Engaño, but there is nothing I can do anymore. It already happened,” he said.
The military would not comment on whether Danny is charged with espionage or any other crime, nor whether he had legal representation, nor if he would be tried in court.
RFA was not allowed to speak to the other two suspected Filipino spies for China – civilian staff members from the Philippine Department of Defense and navy.
Like Danny, they are also believed to have sold sensitive information to the Chinese, including troop positions and details about a military modernization program supported by the Philippines’ key ally, the United States, the military source said.
Spies among us
Apprehending the three spies may only be “scratching the surface” of a larger network, retired Rear Adm. Roy Vincent Trinidad, a spokesman for the Philippine Navy in the West Philippine Sea, told RFA.
“We found out that the payments were sent through electronic wallets, dead drops or sent via delivery packs,” he said. “Where do these come from, and who are these people sending them money?.”
Trinidad said the hunt for more Filipino spies and their Chinese handlers is ongoing, and that the arrests of Danny and the two others were a result of the “insider threat program” launched in 2023 that focused on protecting sensitive government data, specifically those relating to the South China Sea.
Officials have said that spy recruitment usually follows a similar pattern. Spymasters recruit on publicly accessible online job platforms, such as onlinejobs.ph or LinkedIn. Often the targets are those with significant experience with the military, either as active duty members or in civilian roles.
One woman, who identified herself using the pseudonym Maria Nena, who once worked for the navy and had sensitive data, told RFA that in 2023, she responded to a job ad for a regional military researcher role for a publication called Military Express. Someone purporting to represent the publication contacted her and gave her a recruitment test.
“I was given a set of questions to answer and was told that I would be given 1-3 assignments to complete as part of the selection process, all of which will be paid upon completion,” Nena said. “After submitting my response, I never heard back.”
Months later she saw a similar ad on Facebook, using her real name as the contact. She grew suspicious and contacted the group. They contacted her via the WhatsApp messenger platform and asked where they could acquire sensitive materials she co-authored for the navy.
“They asked where they could buy the book, but I responded that they were not for sale as they were confidential documents,” she said. “They asked where they can download a declassified document on civil military operations that was released by the United States in 2018. I did not reply.”
She instead informed the authorities about the attempted recruitment, but the complaint was never resolved.
RFA was not able to confirm if both ads were produced by the same organization.
Increasing sophistication
With the spotlight focused on China’s spying activities, the Philippines must be more vigilant about modern ways that Beijing recruits spies, analysts told RFA.
“Now that this activity has been exposed, the Philippines’ defense and security postures must take into account more sophisticated attempts to gather sensitive information including hacking,” said Julio Amador III, a Manila-based political analyst who focuses on maritime disputes in the South China Sea.
There are “acceptable diplomatic activities” where accredited diplomats trade information for a common goal, but buying off state employees to obtain state secrets is patently illegal, he said.
“Information is a polarizing platform,” Chester Cabalza, founder of the Manila-based International Development and Security Cooperation research group, told RFA.
He said that the Filipinos acting as spies for Beijing heralds a new era where the “generation, transmission, and use of information” are the “new drivers for military power.
“Espionage derails the success of a maritime or terrestrial strategy,” he said, stressing that the 2024 Spratlys collision incident proves that the Chinese spy network in the Philippines has been active.
China has flatly denied all espionage allegations. “In the past few years, so-called Chinese spy cases have either collapsed or riddled with factual errors,” Beijing’s embassy in Manila said in a statement in February, when the first reports of the alleged spy network emerged.
Edited by Eugene Whong.
This content originally appeared on Radio Free Asia and was authored by Jason Gutierrez for RFA.