MANILA, Philippines – Authorities arrested on Friday, January 17, a Chinese man and his two Filipino “cohorts” in Makati City for allegedly gathering sensitive data around military facilities and vital infrastructure, and thus posing national security threats.
The suspected Chinese spy, Deng Yuanqing, was presented to the media on Monday, January 20, along with the Filipinos who had since executed extrajudicial affidavits that they were ordered to drive the Chinese and his equipment around specific areas in Luzon.
Jeremy Lotoc, chief of the cybercrime division of the National Bureau of Investigation (NBI), said agents seized maps from the suspects, indicating plans to go to the Visayas and Mindanao after finishing their rounds of Luzon.
These are what we know so far about Deng, his connections, and his activities in the Philippines, based on the information provided by Lotoc, NBI Director Jaime Santiago, and Armed Forces of the Philippines chief General Romeo Brawner Jr. during the press conference, as well as information from official online sites.
Who is Deng Yuanqing?
The suspect is a graduate of the People’s Liberation Army University of Science and Technology or PLAUST, which has since been renamed the Army Engineering University in 2017. The PLA is the military of the Chinese Communist Party.
Deng is a specialist in control or automation engineering, a field of discipline where systems are designed to “regulate the behavior of other devices or systems” despite constraints. All types of control systems “serve the same purpose: to control outputs.”
Deng has been in the Philippines for five years or more, but is considered a “sleeper” agent because he was able to blend in various groups — “hindi pansinin” (didn’t call attention to himself).
Authorities found him through a combination of technology and human intelligence, the same way they found illegal POGOs (Philippine offshore gaming operators) in various parts of the country that were being used for scams and spying activities.
How powerful is the equipment seized from him?
The equipment seized from him “is capable of producing coordinates…[therefore] can be used for drone control to identify our topography and terrain,” Lotoc said.
NBI Director Santiago said they found an application on Deng’s equipment for remotely accessing devices over the internet. In other words, the suspect could siphon off data without going inside the facilities and without getting hold of the targeted devices.
Santiago said the data captured by the equipment were transmitted to China in real time since the equipment was “using real-time kinematic and global navigation satellite system.”
Clik here to view.
Real-time kinematic GPS is a “powerful technology” that can “provide positioning data that is accurate to within centimeters, making it ideal for a wide range of applications.”
The NBI chief said that when they seized the equipment from the suspect, they saw a profile, with name written in Chinese, “actively siphoning the data off the equipment.”
Who is the suspect working for?
Authorities are doing further investigation to know if Deng’s activities are part of the “overall espionage effort by China,” or if he’s connected to a criminal syndicate.
Deng is part of a group of five Chinese so far composed of a software engineer, a hardware engineer, a financier who is currently in China, and a couple who have already been identified.
A phone confiscated from him stored images of “deposit slips” reflecting amounts that ranged from P1.5 million to P12 million a week that were transferred to shell companies.
In 2024, Rappler disclosed efforts by Philippine intelligence operatives to track down a Chinese man, who once served as Manila bureau chief of a Chinese daily, for his suspicious activities. From 2021 to 2024, Zhang “Steve” Song — Manila bureau chief for the Wenhui Daily — “established a significant network in various strategic institutions,” according to a May 2024 Philippine intelligence report seen by Rappler.
What facilities have been mapped?
Through Deng’s control system, he had gathered data from sites being used under the Enhanced Defense Cooperation Agreement between the Philippines and the United States, according to Brawner.
Lotoc also enumerated some of the facilities mapped by the suspect in Batangas and Laguna, provinces immediately south of Metro Manila. They included power plants, petrochemical plants, substations of the National Grid Corporation of the Philippines, navigational lighthouses, military signal frequency repeater. He also mentioned the Malampaya gas field in Palawan. (Rappler will publish the complete list once we get a copy.)
Why is this dangerous?
Brawner said militaries, when planning an attack, study the topography, entry and exit points, and the configuration of buildings inside the target area or facility.
Based on the data seized from Deng, but probably already transmitted to China, “nakuha (he was able to get) [those] very specific details.”
This was the second time authorities arrested a Chinese man using the same technology on Philippine facilities. The first suspect arrested in 2024 didn’t tap any local guide or driver — he both drove his vehicle and operated his equipment.
Before these two incidents, there had been five times authorities detected and seized drones hovering over vital facilities, Brawner confirmed.
Brawner said the armed forces had further tightened security around their facilities after they noticed that POGOs were “suddenly” sprouting around EDCA sites.
What charges are filed?
Complaints of espionage have been filed against Deng and his Filipino companions because their activities were considered “in prejudice of national defense,” Brawner said.
They are charged under Commonwealth Act 616, the espionage law that took effect in 1941 during World War II.
Bookmark this page for updates. – Rappler.com