VERA Files found signs of deliberately staged posts that spread disinformation from 13 Facebook (FB) accounts of former policemen. The users resigned from the Philippine National Police (PNP) supposedly in protest of the alleged involvement of their officials in the arrest of former president Rodrigo Duterte.
Technically called coordinated inauthentic behavior, this practice refers to indicators that certain posts on social media come from an orchestrated effort of malign actors to promote a specific narrative. They make this narrative seem genuine and reflective of the sentiments of the public at the grassroots level on certain issues.
Duterte was arrested on March 11 upon his arrival from a trip to Hong Kong with some members of his family and political allies. Eleven of the posts circulated from the afternoon of March 12 until the evening of March 13, while two were posted in the succeeding days.
The suspicious accounts shared the same sentiments outlined in the same narrative order. They first lamented that the PNP was being used for “political interests,” then they professed their loyalty to Duterte, and “signed off” from their supposed posts in solidarity with the former president.
The 13 posts garnered over 257,000 reactions, more than 158,000 shares and upwards of 20,000 comments combined as of March 31.
A series of retellings amplified these narratives with an additional 173,000 reactions and 136,000 shares.
PNP Chief Gen. Rommel Marbil and Criminal Investigation and Detection Group Director General Nicolas Torre III arrested and took Duterte into custody on March 11 on the strength of a warrant of arrest from the International Criminal Court, coursed through the International Criminal Police Organization. Duterte was subsequently brought to The Hague, Netherlands where he is facing trial for crimes against humanity of murder in relation to his bloody war against illegal drugs during his presidency.
Following the arrest, word spread on social media that a mass resignation in the police force was taking place. However, VERA Files found that at least four of the allegedly resigned officers had been out of the service before March 10.
FB users Isko-lar Bogart and Kevin Castro Sayson both announced their resignation only after the arrest although they left the PNP in 2023. Another ex-cop with the handle Vhel Tabs clarified in a later post that she quit in April 2024.
Another disgruntled ex-officer, CM Nimes, faced backlash after a misleading post that made it appear his resignation was recent. Replying to a comment, he said in part, “lahat ng nag resign 2024 yan. Walang nag resign 2025 pero AWOL lahat, dahil yun ang pinakamadali.”
(Everyone who resigned, they did so in 2024. Nobody resigned in 2025 but they all went AWOL [absence without leave] because that was the easiest.)
User Einastasia Grey, who had “signed off” from her police duties, seems to be living overseas now, based on her FB bio and other posts.
Influencer Yumi Santiago claimed to have ceased being a reservist sergeant, saying in other posts that she had joined the military and was not receiving any salary.
Reservists in the military auxiliary service are subject to guidelines on resignation and discharge, according to Republic Act No. 7077 or the Citizen Armed Forces of the Philippines Reservist Act. All active reservists are entitled to an allowance, while enlisted officers receive pay for their service.
Both the PNP and the Armed Forces of the Philippines (AFP) denied that officers in their units had resigned after Duterte’s arrest.
“Reports of AFP personnel resigning in support of former president Duterte remain unverified,” said military spokesperson Col. Francel Padilla.
This was echoed by PNP spokesperson Brig. Gen. Jean Fajardo who said, “Tinanong ko po ‘yung personnel, so far wala pa naman po, (I asked personnel, so far none [have resigned] yet)” she said.
Same script in near-perfect English
The resignation announcements shared identical talking points, with 12 of the 13 posts having outlines in similar order in the post captions.
The users first expressed how proud they were to have been part of the PNP, followed by their gratitude to the former president. They offered praises for Duterte’s fight against crime and emphasis on discipline.
Then, they declared their disappointment over the alleged erosion of the integrity of the police institution, with some posts claiming that they were used for personal and political interests. The users ended by announcing their exit from the force, opting to “sign off” rather than “resign.”
Eleven of the 13 posts were in perfect English and captions used similar selection of words and frequently used em dashes (—), indicating possible use of AI in the composition.
The two posts in Tagalog were noticeably shorter than the others, both consisting of only one paragraph as opposed to the essay-like length of the English captions.
A hose of ‘bleeding hearts,’ copy pastas
“Headlines” in all caps, quotes in bold type, attention-grabbing fonts, graphics cards with saturated colors and a feigned legitimacy with official-sounding page names—the modus operandi for increasing the reach of disinformation online. Riding the wave created by the police resignation posts, amplifier accounts began their barrage of reposts late afternoon on March 12.
The reach of the original narratives was nearly doubled by 20 additional posts published by 13 accounts. These retellings saw over 173,000 reactions and 136,000 shares. Pulling quotes from the original posts, they made the narratives more concise and shareable.
Pages that posted 14 of the 20 posts were labelled with “media,” “exclusivo,” “news,” “trend” and “Pilipinas.”
In 2021, VERA Files found that disinformation sharers tend to use words like these to pose as news media outlets, projecting a false sense of legitimacy.
Meanwhile, five other posts out of the 20 appeared to be identical. All uploaded on March 13 by different accounts, these posts re-shared the narrative by Jessan Ejes Tano. They lifted the photos and text word-for-word with the accompanying caption:
“Sya Ang Nakita nating isa sa umiiyak kahapon..nag resign na siya ..grabi (sic) my heart bleeds for you”
(She is one [of the officers] we saw crying yesterday… She already resigned… My heart bleeds for you.)
Rumors had circulated online that PNP Special Action Force (SAF) officers were seen crying when Duterte was in police custody on March 11 at Villamor Air Base in Pasay City, hence the caption.
However, Tano claimed in a separate post that she belonged to a different unit and was not present at Villamor during Duterte’s arrest. PNP spokesperson Fajardo also said the SAF officers were only wiping away sweat and not tears.
“We were there… mataas ang tensyon doon, ang init, ang daming tao (tensions ran high, it was humid, there were many people),” she said at a March 13 PNP briefing.
Of the 13 pages that re-shared the narratives, three posted repeatedly about the police officers who allegedly resigned. From March 12 to 13, the page AMPilipinas had five posts about different officers, Giting ng Pinas had three posts and Boses ng Pilipino had two posts.
Boses ng Pilipino in particular exhibited suspicious behavior. The account was created on April 17, 2019 but began posting daily only on March 12. Prior to this date, the page had posted twice in 2020 and changed profile pictures and headers in 2019, 2023 and 2024.
Philippine fact-checking alliance Tsek.ph, of which VERA Files is a partner, reported a surge in online disinformation following Duterte’s arrest. These spurious social media posts leaned heavily in favor of the former president.
“Fabricated claims and misleading narratives widely cast him as a victim of injustice in an effort to garner public support.”
Yvonne Chua, Tsek.ph project coordinator and VERA Files co-founder
Leading the flurry of posts were fabricated statements of support from influential personalities and fictional characters, old protest footage made to appear like pro-Duterte rallies and rumors against President Ferdinand Marcos Jr., PNP leaders and administration allies.
The United States Cybersecurity and Infrastructure Security Agency warns that disinformation sharers tend to capitalize on breaking news events because the full picture is not yet readily available to the public in these instances.
“Disinformation actors can exploit this gap by generating their own influence content and seeding the search term on social media to encourage people to look it up,” the agency wrote in its guide against disinformation tactics.
