THEY USED A TETRIS APP TO SPY ON BRP SIERRA MADRE TROOPS

A phone was given to the recruit. On it, a Tetris game. Nothing suspicious on the surface — except that app contained a hidden messaging platform used by Chinese intelligence handlers to pass instructions and collect sensitive Philippine military information.

That is how at least part of the espionage network operated, according to the National Security Council and the Armed Forces of the Philippines.

FOUR FILIPINOS, ONE NETWORK

The NSC went public in the first week of March 2026 after its multi-agency Insider Threat Program (ITP) — running under the Comprehensive Archipelagic Defense Concept — uncovered a China-linked spy ring that had recruited government and military personnel with access to intelligence on the West Philippine Sea.

Four individuals were identified. Authorities used codenames: Lawrence, Charles, Allison, and Danny.

Lawrence had worked at the Department of National Defense before joining the Philippine Navy. Allison came from the DND. Danny was from the Philippine Coast Guard. Charles was a Navy officer — and the one who said no.

Charles was flagged by the ITP after contact with Chinese handlers was detected. He admitted the approach but refused to cooperate with the espionage operation. The other three are in military custody and cooperating with the investigation.

WHAT THEY WERE AFTER

The handlers — led in part by a man identified as Scott Chan, who appears to be of Chinese descent — were specifically hunting for information tied to BRP Sierra Madre.

That is the deliberately grounded Philippine warship at Ayungin Shoal, in the Spratlys. A small contingent of Filipino Marines lives on the rusting hull. The ship is resupplied through regular RORE missions — rotational and resupply operations that have themselves become flashpoints with China.

What the network wanted: personnel lists, details on RORE schedules, troop rotations, and deployment information from Ayungin Shoal.

AFP Spokesperson Rear Admiral Roy Vincent Trinidad confirmed that BRP Sierra Madre personnel data may have been compromised, with Danny's position at the coast guard being a key access point.

Some of the handlers on the other end of those Tetris messages spoke English — but not in a Chinese accent. They had British and Australian accents, which suggests a wider operation beyond just Chinese nationals.

WHO THEY RECRUITED AND HOW

National Security Adviser Eduardo Año said certain Filipinos received payments from China in exchange for sensitive information.

The recruitment profile was deliberate. Handlers targeted young government workers — typically in their mid-to-late-20s — with financially unstable families. People who needed money and had access.

The approach apparently started around 2022. Rear Admiral Trinidad said the pattern of attempting to infiltrate Filipinos' cognitive domain to extract sensitive defense intelligence began that year and has continued since.

WHY AYUNGIN SHOAL IS THE TARGET

BRP Sierra Madre has been the center of Philippine-China tension in the South China Sea for years.

From 2023 to mid-2024, Chinese Coast Guard vessels ran an aggressive campaign to block RORE missions — preventing food, water, and supplies from reaching the marines stationed aboard. There were repeated confrontations.

In June 2024, the standoff turned violent. Eight Filipino sailors were injured during a clash with Chinese forces at Ayungin Shoal. One of them lost a thumb.

A provisional agreement reached later in 2024 has since allowed resupply missions to proceed with less friction at that location. China has shifted more pressure toward Scarborough Shoal and Sabina Shoal.

But the intelligence interest in Sierra Madre clearly did not stop.

THE AFP'S WARNING

Trinidad did not suggest the four identified individuals represent the full extent of the problem.

"Common sense indicates that it is highly probable there are still [other spies] out there," he said. He framed the disclosure as informing the public — not as a signal that the operation is over.

The AFP characterized the espionage activity as part of a "growing global intelligence trend" by the Chinese Communist Party. The operation in the Philippines is being treated as one piece of a larger CCP intelligence push, not an isolated event.

LEGISLATION WAITING IN THE WINGS

Representative Leila de Lima used the disclosure to push for House Bill 1844, the proposed Anti-Espionage Act.

The bill would amend the Revised Penal Code to impose stricter penalties for espionage. De Lima said the legislation is "long overdue" and that security agencies need stronger legal tools to conduct a nationwide crackdown, especially around sensitive defense facilities.

The bill has not passed yet.

THE BIGGER PICTURE

What the ITP caught was a targeted, organized effort to map out the military situation at a specific location — one that happens to be at the center of the country's territorial dispute with China.

The recruits had access. The handlers had patience. The Tetris app gave them cover. And according to AFP, the four people identified are probably not the last.