A Collaborative Battle in Cybersecurity? Threats and Opportunities for Taiwan

According to the World Economic Forum's 2020 Global Risks Report, cyberattacks rank as one of the top ten hazards in terms of likelihood and impacts, following environmental dangers such as extreme weather or natural disaster.¹ The development of an increasingly digitized economy, the Internet of Things, and other fourth industrial revolution technologies have raised concerns about cybersecurity risks in daily life, business, critical infrastructure, and public domains.²

Despites the threat and potential harm to Taiwan's economy, President Tsai Ing-wen's defense policy has emphasized that cybersecurity is national security. In the past twenty years, Taiwan (the Republic of China, or ROC), with its long history of complicated cross-strait relations, has witnessed a constant and increasing threat from the rising conflicts in cyberspace. According to an interview with Vice Premier Chen Chi-mai of the Executive Yuan (Taiwan's executive branch), Taiwan perceived a total of 3 billion scans by hackers for potential vulnerabilities and 30 million attacks in 2019. Unsurprisingly, most attacks on government sites and services were from mainland China (the People's Republic of China, or PRC) or launched by Chinese network forces,³ including various advanced persistent threats to secretly penetrate both public and private systems.⁴ For example, in June 2019, Taiwan's Ministry of Civil Services reported a serious data leak of civil servants' personal information. In 2014, Taiwan's Apple Daily was subjected to serious cyberattacks from China because of its reports about the Sunflower Movement and Hong Kong's Occupy Central Movement.⁵

Cybersecurity cannot be built independently from cyberdefense. As the director of the National Center for Cyber Security Technology (NCCST), Chien Hung-wei, responded in a magazine interview: "Cybersecurity is not only about advancing security technologies, but also about intelligence, information, and cognition. We need to understand our opponents to prepare for the next steps."⁶ According to Chien, although Taiwan has been the target of massive and numerous cyberattacks, this is actually the best time to use Taiwan as a testing ground for training talent and developing the domestic cybersecurity capacity.

This essay begins by describing the change of government strategies since 1999 in dealing with cybersecurity issues in Taiwan. It then addresses the more recent development of cybersecurity policies under the Tsai administration, including the formation of a cybersecurity strategy triangle between the National Security Council, the Ministry of Defense, and the Executive Yuan. The essay concludes by arguing for the importance of a collaborative alliance with regional friends to build a cybersecurity network through information sharing and communication to protect the regional security altogether.

The Shift in Taiwan's Cybersecurity Strategies

Although Taiwan has experienced cyberthreats from China since 1999,⁷ there was initially a clear distinction between Taiwan's two main political parties, the Kuomintang (KMT) and the Democratic Progressive Party, on Taiwan's cybersecurity strategy. Shortly after President Li Teng-hui announced that Taipei and Beijing had a "special state-to-state" relationship in 1999, many ROC government websites were hacked and left with unauthorized digital graffiti (i.e., website defacement).⁸ People then became aware of the damages and cognitive impacts that could be carried out through cyberattacks. In response, in 2001 the government formed the National Information and Communication Security Taskforce (NICST) and the NCCST to improve information security. The NICST focuses on the management of interagency communication, and the NCCST concentrates on the technical services providing cybersecurity. During the administration of President Ma Ying-jeou in 2015, the government established a new cyberintelligence division within the National Security Bureau. But on the military side, Taiwan seemed to focus more on "establishing capability of force preservation" and continuing the KMT's policies of not provoking the relationship and maintaining sustainable ties with the PRC.⁹

By contrast, given the rising number of advanced persistent threats and other forms of cyberespionage toward government systems, President Tsai Ing-wen's administration began a series of proactive actions from different angles, starting with the establishment of the National Information and Communication Security Office in August 2016. The office is listed under the...