CNOOC’s Rigs Feed the PLA. One of the Targets Is the Luzon Strait.
The US listed CNOOC as military-linked years ago; analysts speculated its rigs were dual-use. EIP found the actual pipe — sensor data to named PLA submarine-warfare customers, on dedicated lines.
By the EPCYBER Intelligence Team
The United States has treated CNOOC as a military problem for years. In 2021 the Treasury Department added the state oil giant to its list of Chinese military-linked companies, and the Commerce Department restricted its access to U.S. technology — with the Commerce Secretary stating outright that CNOOC "acts like a bully" for the Chinese military in the South China Sea.
The dual-use suspicion is older than the sanctions. Back in 2012, CNOOC's own chairman, Wang Yilin, told an audience at company headquarters that "large-scale deep-water rigs are our mobile national territory and a strategic weapon." In the years since, analysts at the Atlantic Council, CSIS, Jamestown, and CIMSEC have all circled the same idea — that CNOOC's platforms function as sovereignty markers and potential dual-use military infrastructure, not just commercial assets. But every one of those assessments stopped at the same place: informed speculation. The seismic and survey data could be valuable to the PLA. The rigs might serve a military purpose. Nobody could show the actual pipe.
EIP — our EPCYBER intelligence platform — found it. Not an inference, not a "could be." An internal source shows sensor data from CNOOC's platforms being turned into operational support for submarine warfare and passed on dedicated lines to named PLA customers. The chain the analysts suspected, documented end to end.
What Is Being Produced — and for Whom
An internal source covers four distinct operational categories of environmental support, tied to named military users:
- Environmental support for key sea areas, northern South China Sea. Persistent coverage of operationally significant water.
- Sudden-situation environmental support, northern South China Sea. Rapid reconstruction of internal wave conditions, eddies, thermoclines, and acoustic propagation on demand — built explicitly for crisis response. This is not a research product.
- Submarine navigation safety support, northern South China Sea. Water column profiling, sound speed gradients, density layers — the environmental data a submarine commander needs before taking a boat through contested transit corridors.
- Ocean acoustic field environmental support. Sonar propagation modeling — where sound travels underwater, where it doesn't, where a submarine becomes invisible to a pursuing vessel.
These are not academic outputs. They are operational support, on named feeds, to named military customers.
A submarine leaving Yulin Naval Base for the Philippine Sea crosses the Luzon Strait — where internal waves can displace a boat hundreds of metres vertically in minutes, defeating navigation and exposing position. Someone has to forecast that environment. The internal source does. It documents exactly who receives the forecast.
The named customers include the Navy Submarine Academy, a Southern Theater Command staff element, and NUDT's oceanography college. Unit designators — five digits, partially masked — appear alongside institutional names. These are not shared research feeds. They are dedicated lines.
The Sensor Network: CNOOC, China Tower, and the Southern Theater
The data feeding these products is not generated by military platforms. It flows from CNOOC — China's dominant state oil company — whose 147 platforms across the South China Sea operate, in this architecture, as a distributed sensor network. Wave height, water temperature, current profiles, underwater acoustic conditions — all of it moving on a dedicated line to the Southern Theater Command.
China Tower is named as the infrastructure partner. China Tower is not a neutral technology company — it is the entity that consolidated Chinese telecommunications infrastructure and now operates backbone connectivity across military installations nationwide. Its role here as the civilian data pipe carrying military-grade oceanographic feeds is consistent with how civil-military fusion actually works in practice: not through secret programmes, but through named partnerships between named state entities.
Add 75 oceanographic gliders and 147 seafloor moorings to the 147 CNOOC platforms and the picture becomes clear. The sensor network covers the Luzon Strait, the waters southeast of Taiwan, the Mindoro Strait, Pratas Island, and the Paracels — every significant waypoint on the transit corridor Chinese submarines use to reach the Pacific.
The waters where sanctioned vessels conduct ship-to-ship transfers in the South China Sea are not unwatched open ocean. They are fully instrumented by civilian energy infrastructure with a permanent military feed. CNOOC owns the platforms. China Tower carries the data. The Southern Theater Command reads it. A vessel operating in those waters is inside a sensor network that looks, from the outside, like an oil company.
The Operational Geography Is the Finding
Product names and customer lists matter. But the geography is what makes this significant for anyone tracking Chinese military intent in the South China Sea.
The Luzon Strait is the primary deep-water passage between the South China Sea and the Pacific — the route Chinese nuclear submarines must transit to reach patrol areas where they are relevant to strategic deterrence. The waters southeast of Taiwan are the approach corridor for any naval scenario involving the island. Mindoro Strait is the secondary submarine transit route. Pratas and the Paracels are contested features whose environmental conditions affect both surface and subsurface operations.
This is not generalised oceanographic research. It is named support, for named military customers, covering exactly the waters those customers need before a conflict — or during one. The "sudden situation" category exists because someone specified a requirement for crisis-speed environmental reconstruction. That requirement came from somewhere.
What EIP Collected and What It Means
EIP surfaced this cluster through open-source collection on Chinese maritime entities — Chinese-language sources, state procurement records, institutional publishing, and technical indicators that Western tooling does not reach — and expanded the visibility outward from a single entity to the full network around it. The finding is all open source. The gap is not access. The gap is language, tradecraft, and the willingness to follow one entity until it connects to a military customer.
What this documents is civil-military fusion operating at the infrastructure layer — not as policy language, but as a working delivery chain. Sensor data from a state oil company is processed into operational military support and passed on dedicated feeds to submarine warfare and theater command customers. China Tower carries the signal. The whole arrangement is documented end to end.
Whether every sensor in the network is actively reporting today, or some capacity is contracted but not yet fully deployed, we cannot confirm from open sources. What is confirmed: the architecture is designed, the customers are named, the products are specified, and the geography matches the operational requirements of a Taiwan-contingency submarine force to a degree that has no civilian explanation.
