The Philippine National Police (PNP) has intensified its cyber operations to identify and arrest those behind social media accounts allegedly used to incite disruption during President Ferdinand “Bongbong” Marcos Jr.’s fifth State of the Nation Address.

PNP chief Police Gen. Jose Melencio Nartatez Jr. said Thursday he ordered the Anti-Cybercrime Group to boost monitoring and digital forensic work in coordination with the Cybercrime Investigation and Coordinating Center and other agencies, following a directive from President Marcos through Interior Secretary Jonvic Remulla.

Authorities earlier flagged nine accounts allegedly linked to hacker groups that encouraged public disorder during the July 27 SONA. The accounts have been taken down after their data were preserved for investigation.

“We respect every Filipino's right to free expression but we will take appropriate legal action against individuals who use digital platforms to incite violence, spread credible threats, or facilitate criminal activities,” PGEN Nartatez said.

Those responsible may face charges including computer fraud, identity theft, grave threats, and inciting to sedition or rebellion.

Investigators are also probing possible links between the online threats and two suspected improvised explosive device incidents reported on SONA day — one inside the Department of Justice compound and another device recovered near the Senate.

Nartatez said leads have been developed and urged the public to remain vigilant and report suspicious online activity.