Ben Morgan’s Pacific Update: Competition continues in the South China Sea

Operational tempo remains high in the South China Sea. In mid-October, the Philippines Coast Guard published photographs of Chinese Coast Guard ships using water cannon and ramming manoeuvres to harass Philippines vessels near Thitu Island.

Thitu is the largest island in the Spratley Islands, a group of islands located close to Philippines in the southern half of the South China Sea. The Spratley Islands are strategically located where they could provide bases for aircraft, ships, surveillance assets and long-range missiles able to dominate the southern half of the South China Sea. Therefore, China, Philippines, Vietnam, Malaysia, Taiwan, and Brunei all claim parts of the island chain.

Philippines controlled Thitu Island sits close to a Chinese built artificial island called Subi. The Chinese government claims its response was justified because the Philippines vessel ventured too close to Subi Island.  

On 19 October, Australia reported Chinese fighter planes launched flares dangerously close to a Royal Australia Airforce P-8 Poseidon anti-submarine warfare aircraft operating near the Paracel Islands

Later in October, Philippines and several of its security partners exercised in the South China Sea. Naval vessels from the US, Australia, Philippines and New Zealand conducted a training exercise. The objects of the exercise were to practice inter-operability and to demonstrate the participants commitment to ‘freedom of navigation.’ A US 7th Fleet statement saying the exercise demonstrated “a collective commitment to strengthen regional and international cooperation in support of a free and open Indo-Pacific.” The use of terms like ‘free and open’ or ‘freedom of navigation’ is diplomatic wording opposing China’s claim that the South China Sea is its territorial waters. The exercise was noted by China.

On 31 October, the US and Philippines announced the formation of a joint task group to increase cooperation and improve readiness.  The two nations are creating a combined headquarters that can organise and coordinate training in peacetime, or manage a military campaign during a confrontation. Its formation demonstrates America’s military commitment to deterrence in the South China Sea.  

In early November, China also flexed its military muscles by conducting a bomber patrol over the South China Sea. This activity is notable because it is the first overtly military patrol of this nature over the South China Sea by China. Since September 2025, China has based attack aircraft at Woody Island in the Paracel Islands but this patrol may indicate a hardening of China’s position.  Additionally, the Chinese government issued statements warning Philippines and its partners against exercising together in the South China Sea.

Last week, the USS Nimitz exercised near Scarborough Shoal supported by a task group that included Japanese and Philippines warships. US Naval Institute News described the exercise as “The gathering of nine warships and patrol cutters was one of the largest maritime cooperative activities in recent years at the disputed maritime feature, which has been a flashpoint of tensions between Beijing and Philippine forces.” 

Although war in the South China Sea remains unlikely, the activity in recent months is troubling because it indicates an escalating level of confrontation. The parties positions are difficult to reconcile and this confrontation is just one point of contact in a wider Sino-American competition.  A multi-domain competition that is diplomatic, economic, legal, and could become military.  

The South China Sea is becoming more militarised, there are more bases, more exercises, more patrols and more activity in the area. Counterintuitively, this trend may contribute to keeping the peace and the largest concentration of military force in history was in Europe during the Cold War, a concentration of force that deterred conflict and kept the peace between two rival superpowers for 50 years. 

However, military deterrence requires enormous resources and commitment so is an expensive option. Its other weakness is that when large military forces are deployed at a high state of readiness to deter each other it is easy for a small mistake or misunderstanding to escalate quickly.  

Australian defence companies compromised by cyber attack

This week it was revealed that several Australian defence contractors were recently compromised by cyber attacks.  The attacks are believed to be linked to hacking teams that specifically targeted Israeli companies supplying the Australian Defence Force. 

This incident is part of a disturbing trend that involves teams of professional hackers working aggressively to infiltrate business and government networks.  Increasingly groups like this are sponsored by governments, operating in a shadowy world of easy deniability. The teams involved in this attack groups are identified by nicknames, in this case ‘Cyber Toufan’ and the ‘J Group.’

If a hacking group successfully infiltrates a network, then the access is generally used to quietly syphon information out of the compromised organisation. However, successful infiltration can also be used to attack – by introducing malware into the network. In this case the Australian Broadcasting Corporation reports that “The Cyber Toufan group posted images and details on Telegram about the Australian Defence Force’s (ADF) next-generation Redback infantry fighting vehicle.” And that J Group claims to have infiltrated an engineering company’s system for five months collecting information the Hunter Class frigate and Collins Class submarine.

Notably, Mike Burgess the head of the Australian Security and Intelligence Organisation (ASIO) spoke publicly last week about the cyber threat posed to Australia by hackers.  And a recent ASIO security assessment states “Multiple countries are relentlessly seeking information about our military capabilities.”

Sam Pickles, a cyber security expert and founder of international cyber security company RedShield opined that when Burgess spoke on 12 November, he was aware of Cyber Toufan’s attack that was claimed by the hacking group on 30 October. “Recently, all members of the Five Eyes intelligence partnership made announcements signalling the increasing threat posed by the offensive cyber operations of several key countries” Pickles said. 

Pickles says that a cyber breach is often the culmination of an adversary investing considerable time in a long process of probing to discover vulnerable systems, or taking advantage of opportunities that arise; like between system maintenance patch cycles. Successful breaches can take time to detect, and in some cases, hackers maintain access to a target organisation’s systems for an extended period before they are discovered. 

According to Pickles, hackers probe organisations continuously to gather intelligence, and even unclassified information can be useful. For instance, the jargon and language used by people in a company or industry is used to craft phishing emails. Likewise, hackers are continually working to map the cyber attack surface, discovering vulnerable systems and building context to plan future attacks. 

This attack and ASIO’s concerns are noteworthy and area a timely warning for all industries and government organisations that many countries invest enormous sums of money in cyber operations. Generally, they gather information and create ‘back door’ access that can be used for future attacks, activities that do not impact on the public. However, this work is consistent and its objectives are harmful so it is important that government and businesses make cyber security a priority.   

Melanesian update 

A regular update on the Pacific’s least reported trouble spot; Melanesia. 

Logging in Papua New Guinea – A useful case study 

Papua New Guinea is world’s largest exporter of tropical wood, and the Malaysian online news service The Rakyat Post discussed a new report studying Malaysia’s logging operations in Papua New Guinea titled ‘Timber Colony: Exposing Malaysia’s Grip Over Papua New Guinea’s Forests.’

The report is co-authored by Malaysia environment NGO RimbaWatch, Swiss environmentalist Bruno Manser Fonds and the Papua New Guinea Environmental Alliance. It highlights the risk of over-exploitation of Papua New Guinea’s forests by Malaysia logging companies.  Malaysia has a long history of forestry and as the industry becomes more controlled at home, Malaysian companies are looking overseas. 

The report claims that 97% of Forestry Clearance Authorities are issues to Malaysia companies and alleges that amongst these companies a variety of unfair or illegal practices are common in Papua New Guinea. 

Papua New Guinea suffers from widespread corruption and from weak state institutions. In 2024, Transparency International’s Corruption Perceptions Index scored Papua New Guinea 37 out of 100, a low score. This year the nation’s Independent Anti-Corruption Agency has suffered enormous issues as its executive leadership team accused the commissioner of corruption and abuse of power.

Factors that make Papua New Guinea more susceptible to corrupt business practices that inappropriately influence government decision-making. ‘Timber Colony: Exposing Malaysia’s Grip Over Papua New Guinea’s Forests’ provides a useful case study of how these practices can develop and of their impact. 

A potential impact of corruption is people becoming frustrated and resorting to violence to remedy unfair situations. When this happens the security situation deteriorates. This report highlights issues and strengthens the case for international support to help improve governance in the Papua New Guinea. 

Vanuatu signals it will expel foreign advisors

Vanuatu’s government has signalled that it may remove foreign advisors embedded in its government agencies, specifically the police and defence force. Radio New Zealand reports that “Vanuatu’s government has stoked concern in Canberra and Wellington by moving to expel all foreign advisers and police officers working on national security from government buildings, declaring that it is taking the step to protect its sovereignty.”

Recent legislative amendments in Vanuatu mean that foreign nationals working in defence and police posts now need to work from embassies rather than being embedded in Vanuatu’s government departments. Radio New Zealand reports that “Vanuatu government spokesperson Kiery Manassah said foreign advisers would still be able to access police and government buildings but could not be based there permanently.”

Prime Minister of Vanuatu, Jotham Napat emphasised that this change applied to all nations, including China.  However, the impact on New Zealand and Australia will be greater because both countries have personnel embedded in Vanuatu’s security services.

This change is noteworthy because Vanuatu and Australia are currently negotiating a new security arrangement called the Nakamal Agreement. Finalising the agreement is taking longer than expected and this initiative could have an impact on this process.  

In my opinion, this is another good example of an emerging trend in which small Pacific nations struggle to manage Sino-American or Sino-Australian competition. The last Pacific Islands Forum was marked by the exclusion of foreign donors and step taken to reduce similar diplomatic tensions.  In this case, Vanuatu appears to be taking a similar position by limiting access across the board. Whether this is a best option remains to be seen, but countries wishing to develop influence in the Pacific need to understand this trend and develop strategies to engage more effectively. 

Ben Morgan is a bored Gen Xer, a former Officer in NZDF and TDBs Military Blogger – his work is on substack