On January 23rd, Philippine President Ferdinand ‘Bongbong’ Marcos Jr. ordered a directive ordering the reorganization of the National Intelligence Coordinating Agency (NICA). The goal of Executive Order (EO) 54 is to enhance and increase NICA’s intelligence collection capabilities to respond more effectively to threats that may harm the nation. The country also re-established the Armed Forces of the Philippines Counter-Intelligence Group (AFPCIG) during a ceremony on January 19th. The group’s main task is to conduct counter-intelligence activities throughout the country to support the Armed Forces of the Philippines (AFP). The recent reorganization of the NICA and the re-establishment of the AFPCIG will increase the country’s ability to react to evolving threats to the country’s national security.
NICA Reorganization
EO 54 directed the creation of the Office of the Deputy Director General (ODDG) for Cyber and Emerging Threats that would act as NICA’s main component for the reorganization. The new office would provide direction to the NICA’s planning, supervision, and coordination on counterintelligence and counter-cybersecurity threats, Weapons of Mass Destruction (WMD), and other emerging, nontraditional threats.
A Deputy Director General with the rank of Assistance Secretary will be appointed by the president to lead the new organization once it becomes operational. The ODDG will consist of both the Directorate for Counterintelligence and Security (DCS) and the Directorate for Cyberintelligence and Countering WMDs (DCCWMD). The DCS currently under the ODDG for Operations will be transferred to the ODDG and will serve as the NICA’s main point for the Philippine government’s counterintelligence coordination activities.
The DCCWMD will be led by an Assistant Director General with the bureaucratic rank of Director IV and will be tasked to develop and direct the National Cyber Intelligence Network. The organization will also act as a supervisory authority and monitor the NICA’s Regional Office’s cybersecurity desks. The DCCWMD is responsible for conducting research activities on cyberintelligence and cybersecurity utilizing data analytics. The directorate would also be responsible for intelligence activities to counter chemical, biological, radiological, and nuclear threats, along with any new, emerging threats. The office will also play a lead role in NICA’s internal response operations, security and safety assessment, network monitoring, and information and communications technology development and management.
The reorganized NICA will have the new authority to request the personal details of personnel in other government departments, agencies, and other institutions, but this must be approved by office heads. Other entities – such as the judiciary and Congress – can also request that NICA integrate intelligence and coordinate with the necessary agencies to conduct national intelligence activities or national security investigations. Funding to implement NICA’s reorganization will be adopted from its current and available appropriations and subject to the necessary accounting, auditing, budgeting laws, regulations, and rules. However, future funding will be included in all of NICA’s future funding proposals and will be subject to the budgetary process.
Counter-Intelligence Group Reestablishment
The AFP reactivated the AFPCIG on January 18th and will serve as the AFP’s main component for CI missions nationwide. The reestablishment also follows a directive by President Marcos to reconfigure the AFP and how it deals with different groups that threaten the Philippines. The CIG’s mission also expanded from counter-destabilization to include counter-espionage, counter-infiltration, and counter-sabotage. However, the unit’s reactivation is also part of the AFP’s expanding intelligence collection capabilities and will be considered a separate unit from their intelligence service. The AFP Chief of Staff, General Romeo Brawner Jr., highlighted the importance of the new unit mission in guaranteeing the Philippines and its citizen’s safety from various emerging threats in the global landscape. He also encouraged the new unit to ascend to “unimaginable heights, preserving the rights and liberties of our great nation.” The AFP activated the unit in December 1989 but deactivated in October 1995 due to then Philippine President Fidel Ramos believing that the unit succeeded in neutralizing and prosecuting the “scalawags” in the AFP’s ranks.
Analysis
The recent reforms undertaken by the Philippines to reform its intelligence community to face new threats in an evolving geopolitical landscape are warranted for two reasons. The most important reason is due to the Philippines previously lacking an effective response to the various CI threats that the country faced, such as those from China. China conducts various disinformation and influence operations in the country to sway public opinion against various initiatives, such as the Philippines increasing its security relationship with the United States and other countries. The operations also consist of bots and ‘wumao’ posting comments on social media to create the illusion that the Philippine population is against the various measures. Furthermore, the operations also include pro-Chinese figures or journalists making comments, statements, or writing articles that both criticize and disparage the Philippines’ actions while praising China.
The Philippines also understands that China also has a significant in-country intelligence collection capability that allows it to gain access to classified or other sensitive information through various means. These methods range from human intelligence, such as paid spies or forcing individuals to spy on China’s behalf, to signals intelligence, which includes the interception of communications. However, the Philippines understands that its greatest vulnerability is to offensive network operations and other cyber operations that China likely conducts against its networks. Both the AFPCIG and the DCS will work to decrease and mitigate the threat posed by China’s intelligence collection capabilities and attempts.
However, the reactivation of the AFPCIG also came after rumors appeared in November 2023 of an attempted coup to remove President Marcos orchestrated by former AFP officers. The AFP likely reactivated the CIG as a precaution against any coup attempts by active-duty and retired military officers or personnel. The CIG is especially suited for this role since their primary mission before their 1995 deactivation was to find and arrest former soldiers who attempted several coups against former Philippine President Cory Aquino. The rumors came after speculation that there were misgivings and unrest in both the active-duty and retired components of the AFP. However, AFP Chief of Staff, Gen. Romeo Brawner Jr., said he spoke with the retired officers in early November 2023 about the plot and asked them not to include active-duty personnel in it. Brawner also said that if there are any indications that active-duty members are taking part, they will act swiftly against the individuals.
While the AFP claimed that the media misquoted Brawner and walked back his comments, he released a statement on January 4th that reiterated the AFP’s commitment to the country’s constitution. The statement also said that AFP personnel will continue to act in their role “as the guardians of our nation’s sovereignty and defender of democratic principles.” Brawner’s statement occurred as a response to a former AFP officer releasing a video on YouTube reiterating that there is an (alleged) movement to remove Marcos. The officer also said that current Vice President Sara Duterte is his president and called for her to save the country.