“The Philippine government must align its digital transformation goals with a resolute commitment to systemic cybersecurity”
On April 29, 2025, the National Bureau of Investigation arrested a Chinese national, identified as “Tak Hoi Lao” based on his Macau-issued passport, outside the Commission on Elections main office in Intramuros, Manila.
Authorities discovered an International Mobile Subscriber Identity (IMSI) catcher in his vehicle—a device capable of intercepting mobile communications and tracking user locations. The suspect faces charges under the Espionage Act, the Data Privacy Act, and the Cybercrime Prevention Act.
This incident highlights a growing concern around IMSI catchers — surveillance tools that, while legally used by law enforcement and intelligence agencies for criminal investigations, counterterrorism, national security, and emergency response, require strict authorization due to their privacy implications and potential for abuse.
Increasingly, these devices are being weaponized by bad actors. Originally designed to aid public safety, IMSI catchers are now being exploited for illegal data collection, fraud, spreading misinformation and even election campaigning.
IMSI catchers, commonly called Stingrays — named after a surveillance device developed by Harris Corporation — mimic legitimate cell towers to intercept communications, track user locations, and compromise network security.
They operate covertly, bypassing standard telecom infrastructure and evading detection by both users and service providers. Their clandestine nature poses serious risks to personal privacy and national security.
As consumer advocates, we at CitizenWatch Philippines, have expressed alarm over the proliferation of these devices, noting a growing sense of vulnerability among digital users. Every mobile phone user is at risk.
When trust in digital communication erodes, so will the public’s willingness to engage with online services.
The economic implications are profound. As government services and commercial transactions increasingly move online, maintaining public trust is paramount.
Without it, users may revert to inefficient offline alternatives, hindering the growth of the digital economy and undermining e-Government initiatives aimed at enhancing efficiency and accessibility.
Internationally, countries like the United States and Germany have implemented strict regulations on IMSI catchers, limiting their use to law enforcement under stringent oversight.
Australia mandates telecom companies to install detection systems to identify and report unauthorized signals. These measures demonstrate that proactive, legally grounded interventions are both feasible and effective.
In the Philippines, cybersecurity regulatory frameworks are still evolving. However, recent enforcement actions indicate a shift towards addressing this issue more robustly.
On Feb. 20, 2025, the NBI, in collaboration with the Armed Forces of the Philippines, arrested five individuals operating IMSI-equipped vehicles near sensitive government and military facilities.
Utilizing advanced signal detection and monitoring tools, authorities tracked and apprehended the suspects, marking a significant step in combating unauthorized surveillance activities.
Subsequently, on May 1, a former security guard associated with a Philippine offshore gaming operator (POGO) was apprehended for attempting to sell an IMSI catcher online for P600,000.
The Philippine National Police-Anti-Cybercrime Group (PNP-ACG) conducted the entrapment operation.
According to ACG chief Brig. Gen. Bernard Yang, such devices could be misused for scamming, unauthorized election campaigning, or disseminating disinformation. The suspect faces multiple charges under existing cybercrime and data privacy laws.
These incidents highlight the urgent need for comprehensive legislation and enforcement mechanisms to regulate the use of IMSI catchers and similar surveillance technologies.
Department of Information and Communications Technology Secretary Henry Rhoel R. Aguda has emphasized the critical importance of cybersecurity, stating, “Cybersecurity is not just an IT issue — it’s a national security concern and a fundamental pillar of our digital agenda.”
To safeguard the integrity of the nation’s digital infrastructure, the DICT, in coordination with the National Telecommunications Commission and other relevant agencies, must prioritize the development and implementation of policies specifically targeting unauthorized IMSI use.
This includes establishing mandatory detection protocols, creating reporting systems for suspected incidents, and imposing stringent penalties for the possession or deployment of unlicensed IMSI equipment.
Public awareness campaigns are also essential to educate citizens on recognizing and avoiding potential threats.
At its core, this is about digital inclusion — not just giving people access to technology, but making sure that access is safe for everyone. If only the tech-savvy are protected while others remain exposed, many everyday users will be left behind and vulnerable.
The digital economy will not prosper if it not secure.
The Philippine government must align its digital transformation goals with a resolute commitment to systemic cybersecurity.
By implementing robust regulations, leveraging technological solutions, and fostering public awareness, the nation can fortify its digital landscape against emerging threats and ensure that progress does not come at the expense of security.