Legislative Acts

Cybersecurity Legislation and Issue Advocacy

Cybersecurity reform is not only a technical issue. It is a shared defense for digital resilience, supply-chain security, and digital human rights. Legislator Ju-Chun Ko argues that government should strengthen SME cybersecurity budgets while preventing anti-fraud measures from harming citizens’ digital rights and fixing the single point of failure behind repeated government website certificate incidents.

The Silent War in Cyberspace

Warfare in the 21st century has changed. Conflicts between nations no longer occur solely on traditional battlefields; increasingly, they take place as a “silent war” in cyberspace. A single successful cyberattack can paralyze critical infrastructure, steal state secrets, disable financial systems, and shake societal trust through disinformation.

Escalating Global Cyber Threats

According to a 2024 report by Check Point Research, Taiwan is the most frequently attacked target in the Asia-Pacific region, suffering nearly 4,000 attacks per week on average. This is a direct reflection of geopolitics—Taiwan stands on the front line of democratic nations and serves as a primary target for external cognitive warfare and cyber penetration.

Attack vectors have grown increasingly sophisticated: evolving from traditional phishing and DDoS attacks into supply-chain attacks (compromising a single software vendor to affect thousands of clients), ransomware (encrypting mission-critical data for ransom), and AI deepfakes (generating highly deceptive fabricated videos and messages).

International Standards: GDPR and Digital Sovereignty

The European Union’s General Data Protection Regulation (GDPR) has become the global gold standard for privacy protection, granting individuals the right to be forgotten, data portability, and the right to object to automated decision-making. Simultaneously, facing potential backdoors and data leakage risks from foreign AI software, nations worldwide are establishing strict inspection and auditing mechanisms, treating cybersecurity as a core pillar of digital sovereignty.

Taiwan’s Vulnerabilities: Three Critical Breaches

While the government champions the slogan “Cybersecurity is National Security,” the actual defense system suffers from critical vulnerabilities.

Breach 1: The SME Cybersecurity Desert

There is a well-known principle in cybersecurity: a bucket’s capacity is determined by its shortest stave. Taiwan has 1.68 million small and medium enterprises (SMEs). They are indispensable links in global supply chains, yet hackers view them as the “shortest stave.”

Attackers often employ a stepping-stone strategy: breach vulnerable SMEs first, then pivot to infiltrate large corporations or government agencies. A prime example occurred in November 2025, when a Taiwanese digital marketing firm was compromised long-term by the Chinese hacking group APT24, impacting over 1,000 client domains.

Yet government investment in SME cybersecurity remains negligible. Current funding under the SME Cybersecurity Joint Defense Program averages only about NT$59 per company per year—less than the price of a lunch box, making effective defense impossible.

Breach 2: Structural Budget Imbalance

Taiwan’s cybersecurity budget suffers from a top-heavy imbalance: central agencies and major state-owned enterprises have ample funding for firewalls and Security Operations Centers (SOCs), but SMEs—making up 98% of all businesses—are left largely on their own.

Compounding the problem, the current budget operates on a single-year allocation model, hindering long-term planning. Cybersecurity is not a one-time software purchase; it is a long-term operational endeavor requiring continuous monitoring, regular drills, and ongoing updates.

Breach 3: Anti-Fraud Overreach Harming Digital Rights

In combating fraud, the government has required social media platforms to take down suspicious accounts en masse. While well-intentioned, execution has been deeply flawed. Due to the lack of rigorous review mechanisms and algorithmic transparency, many innocent citizens have had their accounts suspended without appeal, resulting in digital disenfranchisement.

When algorithms become blunt enforcement tools with unexplained logic and zero accountability, digital human rights and speech freedoms are severely compromised.

Legislator Ju-Chun Ko’s Reform Demands

Facing these structural vulnerabilities, Legislator Ju-Chun Ko has proposed a set of concrete legal and budgetary demands, summarized as “Fix the holes, build a stronger wall, and protect human rights.”

Secure Multi-Year Project Funding

In the Legislative Yuan’s 2025 general policy inquiry, Legislator Ju-Chun Ko demanded the Executive Yuan allocate multi-year cybersecurity project funding to significantly increase subsidies for SMEs. Specific requests include:

• Raise the SME cybersecurity joint defense budget to at least 10,000 NTD per firm per year
• Adopt multi-year (3–5 year) budget planning to enable long-term cybersecurity programs
• Establish a cybersecurity insurance mechanism to share and mitigate risks across firms

Defend Digital Human Rights: Four Concrete Measures

To prevent anti-fraud measures from becoming instruments of digital repression, Legislator Ju-Chun Ko proposed the following four measures:

1. Establish a single complaint window: Citizens must have a clear, centralized appeals channel so government agencies can’t pass responsibility between ministries
2. Publish regular statistics: Release monthly counts of account takedowns, appeals, and account reinstatements for public and parliamentary oversight
3. Review algorithmic logic: Anti-fraud algorithms should be audited periodically, with error rates published and continuous improvements mandated
4. Prohibit training on real user accounts without consent: Government or private actors should not train AI models on users’ real social media accounts without explicit permission

These measures emphasize that technological enforcement must respect human rights and avoid opaque algorithmic decisions.

Aligning Personal Data Laws with International Standards

Legislator Ju-Chun Ko also pushes for amendments to Taiwan’s Personal Data Protection Act inspired by GDPR:

• Data portability: Citizens can request and receive an export of their personal data
• Right to be forgotten: Under specific conditions, individuals can request deletion of their data
• Right to object to automated decisions: Individuals subject to impactful automated decisions (e.g., loan or insurance decisions) can request human review

Aligning with international norms strengthens user protections and increases global interoperability.

Government Certificate Trust Crisis: From Chunghwa Telecom to TWCA

Last Year: Chrome Stops Trusting Chunghwa Telecom Certificates by Default

On May 30, 2025, Google announced that starting in August, Chrome would no longer trust by default new website certificates issued by Chunghwa Telecom under specific root certificate hierarchies. The Ministry of Digital Affairs (MODA) insisted at the time that it had already “deployed a dual-certificate mechanism in advance” and told the public there was “no need to worry.”

In July 2025, Legislator Ju-Chun Ko held a press conference and tested government websites live, showing that automatic dual-certificate failover had not actually been implemented at some agencies. Chunghwa Telecom’s chairman personally responded, calling the findings “misinformation”, and promised to regain default trust in Google Chrome by the end of March 2026. In April 2026, a Control Yuan investigation report also found that MODA lacked risk awareness and that Chunghwa Telecom’s compliance had failed.

It is now November. Chunghwa Telecom reapplied at the end of last year, but there is still no public confirmation from Google that trust has been restored.

This Year: TWCA Intermediate Certificate Serial Numbers Fail Compliance, Forced Revocation

After last year’s incident, MODA switched to Taiwan-CA (TWCA) for government websites’ TLS certificate services. In April 2026, TWCA announced that starting May 4 it would move its certificate chain to the CYBER Root hierarchy.

Then, on October 30, a foreign researcher disclosed on Mozilla’s public bug tracker that TWCA had 10 trusted, unrevoked CA certificates. Six were intermediate CA certificates capable of issuing TLS website certificates, and four of those were issued by CYBER Root. Their serial numbers appeared to contain at most 24 bits of randomness, short of the international requirement of at least 64 bits. That requirement took effect back in September 2016.

On October 31, TWCA issued an urgent notice asking customers to replace the affected SSL certificates and full certificate chains, with the original intermediate certificates to be revoked before 00:00 on November 6. But the notice only said the change was “in response to international requirements,” without fully explaining the root cause or the scope of impact.

Four Problems This Incident Exposes

1. The deadline is imminent, and government services may break: If affected websites, apps, and cross-agency APIs do not replace certificates and update their full trust chains in time, HTTPS validation may fail. Which government websites are affected? How many have finished replacing certificates? MODA should publish this now, instead of letting the public discover at the last minute that a site won’t load.
2. Over-concentrated dependence means one failure ripples everywhere: Last year it was Chunghwa Telecom; this year it is TWCA. If critical services depend on the same intermediate CA without effective backup from a different CA, a single vendor problem puts large numbers of government systems at risk at once. Taiwan just went through a trust crisis last year. Why is it worrying about the same kind of outage again?
3. Years of noncompliance went undetected. Is auditing just for show?: The researcher found that TWCA’s CA certificate serial number generation pattern dates back to at least 2011 and stayed in use after the 2016 requirement took effect. TWCA did not disclose this itself; an outside researcher found it. Some annual WebTrust audit reports even listed these certificate serial numbers, yet the deficiency was never corrected in time. Only in August 2026 did the National Audit Office note that MODA’s new contract with TWCA includes international compliance requirements, penalties, and the agency’s right to conduct its own audits. The contract says so, but did anyone check? And if they checked, why did they miss it?
4. Cryptographic safeguards cannot be compromised: International rules require certificate serial numbers to contain enough secure randomness, partly to prevent certificate forgery through certain hash-collision attacks. There is currently no evidence that TWCA’s private keys leaked, that certificates were forged, or that HTTPS encryption was broken. But security cannot wait until after a breach to fix the fence. A basic requirement set ten years ago should not be exposed by an outside researcher only today.

Legislator Ko’s Five Demands

1. Take inventory now and publish progress: MODA should inventory affected government agencies, critical public services, state-owned enterprises, and cross-agency APIs, and before the November 6 revocation deadline publish daily certificate replacement progress, full-chain validation results, and outstanding risks.
2. Build cross-CA backup to avoid a single point of failure: Critical government services should hold backup certificates issued by a different certificate authority and run regular failover drills. Claiming “dual certificates” means nothing without working automatic failover.
3. Move to short-lived certificates and automated management: Under CA/Browser Forum rules, the maximum validity of newly issued public TLS website certificates was cut to 200 days starting March 2026 and will drop to 47 days by 2029. The government already has ACME automated renewal technology. It should publish each agency’s actual adoption rate and build the capacity for automated issuance, renewal, deployment, private key rotation, anomaly monitoring, and emergency replacement of intermediate CA chains. Once automation and failure drills mature, it should gradually pilot certificates valid for 10 days or less, shrinking the window of damage from a key leak or misissuance.
4. Strengthen technical audits and enforce contract accountability: TWCA should explain the root cause, affected scope, and remediation. MODA should disclose whether it has exercised its audit rights under the new contract, whether it has opened a contract-performance investigation, and why third-party audits failed to catch the problem. Going forward, automated compliance checks and independent technical reviews should replace blind trust in paper reports.
5. Use advanced AI for proactive cyber defense: As an AI island, Taiwan should actively evaluate joining international advanced-model cyber defense programs, such as Anthropic’s Cyber Verification Program (CVP, which incorporates the former Project Glasswing; Glasswing partners found 129,000 vulnerabilities in six months), and, with data security safeguarded, use AI to help with vulnerability detection, code analysis, and patch verification.

Last year, Chunghwa Telecom forced a government-wide certificate swap. This year, TWCA has its own compliance problem. If every vendor failure ends with the government scrambling to tell agencies to swap certificates, that treats the symptom, not the cause. The government and the Legislative Yuan should drop the partisan sniping and prove improvement with concrete progress, public data, and real drills.

Recent Major Cybersecurity Alerts

2026.10: A Two-Week Run of Security Incidents

• Critical PHP vulnerability: Japanese Prime Minister Sanae Takaichi personally issued a warning; MODA said nearly 300 Taiwanese government agencies and about 800 websites and systems were affected.
• Central Election Commission data leak: The candidate asset declaration system exposed the national ID numbers of 1,573 candidates in its background data.
• Binance theft: More than US$6 billion in virtual assets was stolen; the FBI pointed to North Korean hackers.
• Cursor extension marketplace: A maliciously altered Claude Code extension appeared, attempting to plant an SSH backdoor.

The causes differ, but every one of them is a reminder: cybersecurity cannot rely on cleanup after the fact. It requires preparation and proactive defense.

2025.03: CrazyHunter Ransomware Attacks

CrazyHunter ransomware targeted medical centers in Taiwan, encrypting systems and demanding ransom payments. The Ministry of Health and Welfare called it a “systematic attack,” underscoring severe vulnerabilities in hospital cybersecurity infrastructure that threaten patient records and the continuity of medical services.

2025.05: Chrome Distrusts Chunghwa Telecom Certificates

Google announced that starting in August, Chrome would no longer trust by default newly issued website certificates from specific Chunghwa Telecom root hierarchies due to certificate management noncompliance with international standards. This undermined national telecom credibility and highlighted the urgency of aligning infrastructure with global security practices.

2024.03: AI Deepfake Video Warning

Legislator Ju-Chun Ko played two AI-generated deepfake videos in the Legislative Yuan; Premier Chen Chien-jen could not distinguish them. The inquiry demonstrated that “seeing is no longer believing,” raising urgent demands for countermeasures.

Future Vision: Resilient Taiwan, Digital Security for All

Cybersecurity is not just a technical issue—it is a national concern that affects every citizen. Strengthening cybersecurity for SMEs and digital human rights enforcement will:

• Fortify the supply chain: Strong SME defenses safeguard the entire industrial ecosystem
• Promote digital equity: Robust appeals and transparent algorithmic practices protect citizens from arbitrary digital censorship
• Protect national security: A secure and resilient cyber posture defends democratic institutions against foreign influence and attacks

Cybersecurity is national security—digital human rights are not negotiable. Support Legislator Ju-Chun Ko’s reform agenda to shield Taiwan in the silent war of cyberspace.

Resource Hub

Timeline