> Information and Communication Law
Back
Previous The Organization Framework, the Notification System and the Legal Norms of Critical Infrastructure Protection in the U.S. Next Legal issues of Third-Party Payment in Taiwan

The approaches to promote critical infrastructure protection in Japan

The approaches to promote critical infrastructure protection in Japan are illustrated below:

1. Coverage of Critical Information Infrastructure

In the "Action Plan on Information Security Measures for Critical Infrastructure" promulgated by the Information Security Policy Council (ISPC) in 2005, critical infrastructure is defined as: Critical infrastructure which offers the highly irreplaceable service in a commercial way is necessary for people's normal lives and economic activities, and if the service is discontinued or the supply is deficient or not available, it will seriously influence people's lives and economic activities. Based on the definition of the action plan, the critical infrastructure contains: telecommunication systems, administration services of the government, finance, civil aviation, railway, logistics, power, gas, water, and medical services

2. Promoted Relevant Policies of The Past

The issues regarding the CIIP are gradually being developed with the norm of information social security policy in Japan. Adopting the Action Plan of the Basic Guidelines Toward the Promotion of an Advanced Information and Telecommunications Society of 1998 proposed by the Japanese government in 1998 as a basis. The Japanese government keeps presenting polices of improvement for the relevant issues in order to acquire the stable development of telematics and telecommunications. Several years later, the Ministry of Economy, Trade, and Industry (METI) announced the Comprehensive Strategy on Information Security in 2003. The formulation of the strategy not only emphasizes the possible telematics-related risks and protection against threats that may be encountered in the information society, but it also enhances the level of information security to the level of national security and presents a comprehensive information security improvement program. Furthermore, the submission of the strategy has identified government’s responsibility in the development of information security Therefore, a division which is solely responsible for information security was established in the Cabinet Secretariat and is devoted to the development of it.

In 2005, the Ministry of Economy, Trade, and Industry (METI) amended the Comprehensive Strategy on Information Security and announced the First National Strategy on Information Security based on the creation of a policy of a long-term information security task in Japan which is also the foundation for the policy of guidelines and action security concerning critical information infrastructure. This is in addition to being the most important basis for the policy of information security development. The strategy is different from the Comprehensive Strategy on Information Security in connotation. In the range of information security protection, it not only maintains information security from the perspective of the government; for instance, to divide the rights and duties on information security protection practices between the central government and the local government, and to strengthen the capacity of the government to solve emergencies such as cyber attacks, but it also tries to employ the public-private partnership on the CIIP issue to construct an extensive information security protection and to develop a Capability for Engineering of Protection, Technical Operation, Analysis and Response (CEPTOAR): one similar to the ISAC of America, to strengthen the information sharing and analysis of information security of all industry involved. According to the strategy, the METI established the Information Security Policy Council (ISPC) and the National Information Security Center (NISC) under the subordination of the Cabinet Secretariat in order to reach a goal of dependable society of information security.1

Finally, the information security policies more directly related with the CIIP are the Action Plan on Information Security Measures for Critical Infrastructure and the Standards for Information Security Measures for the Central Government Computer Systems, both of which regulate CI-related threats, information security standards, public-private partnership information sharing system, and the levels of information security standards between different governments and critical infrastructures, respectively.


3. Oraganization Framework

Generally speaking, the Cabinet Secretariat is the main division of the CIIP and the information security for the Japanese government, while the ISPC and the NISC established under the Cabinet Secretariat in 2005 are the core organizations for the development of the CIIP policy. In addition, the National Policy Agency (NPA) and the Ministry of Internal Affairs and Communications (MIC) also played an important role in assisting the Cabinet Secretariat with critical infrastructure protection. The part of public-private partnership is covered by the CEPTOAR which takes the responsibility for information sharing and analysis of information security between the government and private organizations.

4. Notification System

For critical infrastructure protection, Japan has set up a warning and notification system in addition to the emphasis on fundamental information security protection. With the concept of public-private partnership, various messages related with information security are analyzed and shared in order to prevent information security incidents from occurring. The network of notification system in Japan mainly consists of several organizations as listed below.

(1) National Incident Response Team

The National Incident Response Team (NIRT) which is the information security office under the Cabinet Secretariat in the organization framework belongs to the Computer Emergency Response Team (CERT)2 and is first in line in the government to handle internet emergencies. According to the Action Plan for Ensuring e-Government's IT Security, the NIRT which consists of 17 experts from the government and the private organizations is responsible to (1) accurately understand and analyze emergencies, (2) develop technical strategies to solve and rehabilitate emergencies to prevent incidents from reoccurrence, (3) provide other governmental organizations the assistance to solve the information security issue, (4) collect and analyze information or intelligence so that effective solutions and strategies may be provided when an incident happens, (5) provide the governmental organization with professional knowledge and information, and (6) enhance and improve all knowledge pertinent to information security.

The Japan Computer Emergency Response Team Coordination Center (JPCERT/cc) is the first Computer Security Incident Response Team (CSIRT) established in Japan. It consists of internet service suppliers, security products/service suppliers, governmental agencies, and associations of industry & commerce. The JPCERT/CC is also a member of the Asia Pacific Computer Emergency Response Team (APCERT) and a member of the Forum of Incident Response and Security Teams (FIRST). It coordinates and integrates prevention measures pertinent to information security and is consistent with other CSIRTs.

(3) Telecom Information Sharing and Analysis Center

In Japan, besides the mechanism responsible to notify the government, which functions as a bridge for communication between it and all those outside of it, the mechanism of information sharing and notification is also established among industries to provide each with a channel for information exchange and consultation. In 2001, Japan established the Telecom Information Sharing and Analysis Center Japan (Telecom-ISAC Japan). In addition to real-time inspection for computer intrusion incidents and conducting information collection and analysis, the Telecom-ISAC Japan proposes to e-government many suggestions related with the Transact-SQL issue as well. The reasons for launching the Telecom-ISAC are to instantaneously detect a computer intrusion incident, and to instantaneously gather and analyze its information, and then exchange this with other telecom carriers and offer them relevant countermeasures for precaution; so that in can reach the goal of ensuring telecom security since it is an important infrastructure concerning social economy.

(4) Cyber Force

The reasons for launching the Cyber Force are to maintain the security to use the internet by regularly "patrolling" it, searching for evidence of internet crime, and to notify the critical infrastructure operators about any unusual internet use so as to prevent the occurrence of cyber terror attacks. The Cyber Force also assists operators to solve and diminish the damage and influences when an incident occurs.

(5) Portal Site of National Police Agency

The National Police Agency owns the portal site "@police". It exists to prevent large-scale cyber emergencies and to provide gathered information concerning information security to government. In addition to providing the techniques related with the safe use of computer networks, @police is also dedicated to educating internet users about the concept of information security and to increase security awareness.

(6) Ministry of Economy, Trade and Industry

Since 1990, the Ministry of Economy, Trade and Industry (METI) has cooperated with the JPCERT/CC and the Information Technology Promotion Agency (IPA) to provide reports on virus, intrusion, and the damage caused by them, to remind the public to pay attention.

5. Legal Norms

The laws regarding critical infrastructure protection in Japan are illustrated as follows:

(1) Unauthorized Computer Access Law of 1999

The Unauthorized Computer Access Law includes various conducts such as cyber intrusion, and data thefts, into the norms of criminal punishment to deter cyber crimes from spreading in order to ensure the safety of the critical information infrastructure.

(2) Act on Electronic Signatures and Certification Business of 2000

With the formulation of the Act on Electronic Signatures and Certification Business, the smooth promotion of the electronic signature system is ensured and the circulation and process of electronic communication can be fostered further.

(3) Basic Law on Formation of an Advanced Information and Telecommunication Network Society of 2001

Through the formulation of the Basic Law on Formation of an Advanced Information and Telecommunication Network Society, the legal basis to execute an information technology policy is enhanced, and the direction and job content for the government to execute this policy is explicitly stated.

1.http://www.nisc.go.jp/eng/pdf/national_strategy_001_eng.pdf(last accessed date: 2009/07/20).

2.http://www.nisc.go.jp/en/sisaku/h1310action.html(last accessed date: 2009/07/20).

※The approaches to promote critical infrastructure protection in Japan,STLI, https://stli.iii.org.tw/en/article-detail.aspx?no=55&tp=2&i=169&d=6123 (Date:2026/01/20)
Quote this paper
Release： 2013/04
Tag
Read with phone
Back
Previous The Organization Framework, the Notification System and the Legal Norms of Critical Infrastructure Protection in the U.S. Next Legal issues of Third-Party Payment in Taiwan
You may be interested
The Research on Cybersecurity Risks in 5G network: Perspectives on Global strategy

The Research on Cybersecurity Risks in 5G network: Perspectives on Global strategy I. The characteristics of 5G and cybersecurity threats 　　Compared to 4G, 5G adopts several new designs on the network architecture, such as software-defined networking (SDN), a baseband unit (BBU), logical disjunction, network function virtualization (NFV), and multi-access edge computing (MEC), to provide users with high-speed, low-latency and other quality services, as well as flexibility and expansibility to accommodate more emerging applications. 　　According to the three key usage scenarios (see Figure 1) defined by the International Telecommunication Union (ITU), enhanced mobile broadband access (eMBB) provides high-volume mobile broadband services such as AR/VR or ultra-high-definition video. Massive machine type communication (mMTC) provides large-scale IoT services. Ultra-reliability and low latency communication (uRLLC) can be used for services that require low-latency and high-reliability connections, including unmanned driving and industrial automation. 　　However, with 5G’s open, flexible and extensible design, as well as its coexistence with other 4G and 3G systems in the early stage of commercial operation, the cybersecurity threats facing 5G networks are more severe and diverse than the past mobile phone generations. At present, the known 5G cybersecurity threats mainly come from network functional components and connection interfaces among components, including the terminal device, access network, air interface, cloud virtualization, multi-access edge computing rental, core network, back-end/backbone network, roaming and external services, and so on. Source: ITU Figure　1Three key 5G scenarios by the ITU II. Cybersecurity strategy development in major countries 　　5G is not only one of the critical infrastructures, but also an important foundation for pursuing a digital nation, digital economy, the industrial 4.0, and for promoting industrial transformation for upgrading. However, different scenarios require different cybersecurity protection levels, which poses great challenges to both mobile network operators and service providers. 　　Therefore, the construction of favorable environment for 5G development, the promotion of relevant applications and the development of innovative services and so on, have become the priority of governance in the countries around the world. 1. European Union (EU) 　　Then European Commission President Jean-Claude Juncker noted in 2017 that “Cyber-attacks can be more dangerous to the stability of democracies and economies than guns and tanks…Cyber-attacks know no borders and no one is immune,” indicating the EU's high priority in the cybersecurity field. 　　The "Digital Single Market," an important EU policy, lays the foundation for digital economy based on "cybersecurity, trust and privacy." In response to the loss of billions of euros a year in cyber attacks, the EU has taken a series of measures to safeguard and advance the development of the Digital Single Market. For the purposes of this strategy, the European Commission in 2018 came up with the policy of Resilience, Deterrence and Defence: Building strong cybersecurity for the EU,[1]with the aim of improving the level of cyber security, cyber resilience and trust in the EU, and in June 2019 passed the Cybersecurity Act [2] with two highlights described as follows: (1) Strengthen the authority of the European Union Agency for Network and Information Security (ENISA)(see Figure 2), increase the allocation of human and financial resources to ENISA, as well as the preparation for the work items related to the cybersecurity industry, and reinforce cyber security support for EU member states. (2) Establish the EU cybersecurity certification framework. [3] 　　In the European Union, where different cybersecurity certification schemes already exist, the absence of a common certification regime would increase the risk of fragmentation of the single market. For this reason, a set of technical requirements, standards and procedures are provided under this framework to assess whether information/communication products, services and processes are in compliance with security requirements. 　　The certification program includes product and service categories, information/communication security requirements (e.g. reference standards or technical specifications), types of assessment (e.g. self-assessment or third-party assessment), levels of security, and so on. All member states agree that certification not only facilitate cross-border business transactions, but also enable consumers to better understand the security of products and services. Source: Compiled from the ENISA websit Figure　2 ENISA organization and authority strengthening 2. the United States (U.S.) 　　In consideration of cyber security affairs in the country, the US Department of Homeland Security (DHS) in May 2018 unveiled the "Cybersecurity Strategy,"[4] which focused on the objectives and priorities of the U.S. government in future cybersecurity protection, identifying and managing national cybersecurity risks with the overall risk management approach, and addressing security threats to the country, critical infrastructures and private enterprises, as well as preventing cybercrimes. 　　Then the White House in September 2018 released the National Cyber Strategy of the United States of America, [5] based on the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure [6] issued in May 2017, stating the strategy and position of the United States against the threat of cyber- attacks. The strategic goal aimed to, by safeguarding cybersecurity, protect the American people, the homeland, and the American way of life, to build a secure digital economic environment, to promote American prosperity, and strengthen cooperation with partners to deter malicious cyber attackers, so as to maintain peace and security, and continue to expand U.S. influence. 　　The department in July 2019 published the Digital Modernization Strategy [7] to announce its national defense strategy in the digital environment, including the use of cybersecurity, AI, cloud computing, blockchain and other technologies in information security protection to create a more secure, coordinated and efficient platform and improve the security of intelligence transmission and processing. 3. Canada 　　Public Safety Canada in June 2018 released the National Cyber Security Strategy, [8] with the vision of a sustainable, robust cybersecurity environment, innovation and prosperity. Through international cooperation and a domestic public-private partnership, the department has been working on three goals: 1. cyber security and resilience (to reduce cybercrime and ensure Internet privacy; 2. Internet innovation (to create a friendly environment for the development of cybersecurity startups); 3. government leadership and cooperation (to transfer government-owned cybersecurity knowledge to the private sector and set up a cybersecurity governance framework). 　　The Canadian government also attaches great importance to critical infrastructure. In May 2018, the National Cross Sector Forum 2018-2020 Action Plan for Critical Infrastructure [9] was unveiled to facilitate information sharing between public and private partners through sharing and protecting intelligence, and implementing a full risk management approach. Moreover, Public Safety Canada in April 2019 issued a report called Enhancing Canada’s Critical Infrastructure Resilience to Insider Risk, which provided guidelines and suggestions for action on internal risks in critical infrastructure organizations.[10] 4. Singapore 　　The government of Singapore in 2018 promulgated the Cybersecurity Act, [11] which aimed to fulfill the vision of a Smart Nation by enacting and putting into effect cybersecurity regulations to achieve the goal of a resilient infrastructure and a more secure cyberspace, and to strengthen the protection of critical information infrastructure against cyber-attacks. The Cyber Security Agency of Singapore (CSA) was given the authority to prevent and respond to cybersecurity threats, and to set up a system for sharing security information, as well as a light-touch licensing system for cybersecurity service providers.[12] 　　The Government of Singapore has appointed a Commissioner of Cybersecurity responsible for promoting domestic cybersecurity policy. To safeguard Singaporeans from cybersecurity threats, [13] the government particularly laid down cybersecurity threat or incident response provisions in Chapter 4 of the Cybersecurity Act to empower the Commissioner of Cybersecurity to investigate cybersecurity threats and incidents, such as requiring the parties to the incidents to present statements in person or in writing, producing documents or provide information and so on.[14] 5. Australia 　　The Australian government in 2016 proposed a four-year "Australia's Cyber Security Strategy,"[15] which was expected to invest more than 230 million Australian dollars to strengthen Australia's cyber security capability and complete the following five aspects: national cyber partnership, strong cyber defenses, global responsibility and influence, growth and innovation, and a cyber smart nation. 　　As for the global responsibility and influence, the Australian government in 2017 announced the "Australia's International Cyber Engagement Strategy."[16] which aims to strengthen digital trade, to improve cybersecurity and to response to cybercrime through international cooperation; encourage innovative cybersecurity solutions; provide security advice and best practices, such as Essential Eight strategies[17] to mitigate cyber-attacks; establish the Pacific Cyber Security Operational Network (PaCSON) [18] with neighboring countries to develop regional cybersecurity capabilities; and advance the development of Australia's cybersecurity industry, nurture startups and attract foreign investment. III. Cybersecurity strategy to promote 5G in Taiwan 　　Since President Tsai Ing-wen took office in 2016, she declared that cybersecurity is directly linked to national security. In 2017, the Department of Cyber Security (DCS) under the Executive Yuan issued "National Cybersecurity Development Plan (2017-2020)," and in 2018 the "Cybersecurity Industry Development Action Plan (2018-2025)," in order to enhance the independence of Taiwan's cybersecurity industry, consolidate the nation’s cybersecurity defense line, improve its innovative thinking of cyber security, and further promote it to the international market. 　　To develop a favorable environment to promote 5G, the Executive Yuan on May 10, 2019 approved the “Taiwan 5G Action Plan (2019-2022),” [19] with a total investment about NT$20.466 billion over a four-year period. The plan aims to build a 5G application and industrial innovation environment, and reshape Taiwan's mobile communication industry ecosystem, with its content planned around five themes, including "promoting 5G vertical application field demonstration", "building 5G innovation and application development environment," "completing 5G technology core and cybersecurity protection capabilities," "planning to release 5G frequency spectrums in line with overall interests" and "adjusting laws and regulations to create favorable environment for 5G development," and to promote industrial upgrading and transformation, as well as create the next wave of economic prosperity in Taiwan. 　　Secure, robust and reliable 5G systems are sufficient and requisite conditions for building an innovation ecosystem in digital countries. The third theme of the "Taiwan 5G Action Plan" is to "complete 5G technology core and cybersecurity protection capabilities," which is intended to advance the integration of applied science and technology by establishing advantageous core technologies, set up a 5G technology and test platform, and increase the market competitiveness of 5G industry, while drafting the overall national policies on 5G cybersecurity, building the cybersecurity protection mechanism of 5G homemade products, strengthening 5G critical infrastructure and operational cybersecurity protection capabilities, and promoting domestic suppliers to enter the international 5G reliable supply chain. 　　In terms of strengthening 5G critical infrastructure and operational cybersecurity protection capacities, the NCC has planned a four-year (2019-2022) "5G Network Cybersecurity Protection and Related Regulations Preparation Plan." In coordination with a 5G license issue in 2020, the agency in 2019 added/amended the 5G cybersecurity provisions of the Regulations for Administration of Mobile Broadband Businesses, making it mandatory for the winning bidder of the 5G frequency spectrum to incorporate the cybersecurity protection concept into the system design for system construction. 　　Upon commercial operation of 5G, the NCC will audit from time to time the implementation of the cybersecurity maintenance plan by telecom operators, so as to ensure and reinforce the cybersecurity protection system of Taiwan's 5G telecom network, and create an opportunity for the development of 5G homemade products with cybersecurity protection capability. In addition, the NCC will also face up to the fact that 5G technology standards continue to evolve, and the operators have different construction schedules and heterogeneous mobile networks coexist. Therefore, relevant regulations will continue to be completed from 2020 to 2022, and examples will be verified through cybersecurity function testing laboratories to ensure that cybersecurity protection functions of 5G networks keep pace with the times. IV. Conclusion and Suggestion 　　As for emerging technologies, countries around the world are actively evaluating and constructing 5G systems and services. Taiwan boasts excellent industrial advantages in terms of semiconductors, ICT software and hardware, and high-quality talents, and thus makes a foundation for developing 5G. Furthermore, going with the importance of cybersecurity, it is necessary to pay more attention to planning and developing 5G cybersecurity technology. 　　It is clear that the development of cybersecurity is both a challenge and an opportunity for Taiwan. In order to implement the national policy objectives of "cybersecurity is national security" as well as "innovative economic development programs for a digital nation," and to response to the scientific and technological progress, and the demand for cybersecurity, key development direction is proposed to expedite the establishment of 5G cybersecurity protection. Reference: [1]Resilience, Deterrence and Defence: Building strong cybersecurity in Europe, European Commission, https://ec.europa.eu/digital-single-market/en/news/resilience-deterrence-and-defence-building-strong-cybersecurity-europe [2]The draft Regulation of The European Parliament And of The Council on ENISA, the "EU Cybersecurity Agency", and repealing Regulation(EU)526/2013, and on Information and Communication Technology cybersecurity certification(''Cybersecurity Act'') was published in September 2017 to expand the rights and obligations of ENISA, which would make ENISA the EU's cybersecurity and information competent authority and the authority for critical infrastructure (information) facilities after the passage of the Act. Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.151.01.0015.01.ENG&toc=OJ:L:2019:151:TOC [3]The EU cybersecurity certification framework, European Commission, https://ec.europa.eu/digital-single-market/en/eu-cybersecurity-certification-framework [4]Cybersecurity Strategy(2018), DHS, https://www.dhs.gov/sites/default/files/publications/DHS-Cybersecurity-Strategy_1.pdf [5]National Cyber Strategy of the United States of America(2018), The White House, https://www.whitehouse.gov/wp-content/uploads/2018/09/National-Cyber-Strategy.pdf [6]THE WHITE HOUSE, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, The White House, https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ [7]DoD Digital Modernization Strategy, DoD, https://media.defense.gov/2019/Jul/12/2002156622/-1/-1/1/DOD-DIGITAL-MODERNIZATION-STRATEGY-2019.PDF [8]National Cybersecurity Strategy, Public Safety Canada, https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/ntnl-cbr-scrt-strtg/index-en.aspx [9]National Cross Sector Forum 2018-2020 Action Plan for Critical Infrastructure, Public Safety Canada, Public Safety Canada, https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/pln-crtcl-nfrstrctr-2018-20/index-en.aspx#a02 The action plan is a three-year program under Canada's2010 National Strategy for Critical Infrastructure (National Strategy) starting in 2010 for all phases. [10]Enhancing Canada’s Critical Infrastructure Resilience to Insider Risk, Public Safety Canada, Public Safety Canada, https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/nhncng-crtcl-nfrstrctr/index-en.aspx [11]Cybersecurity Act 2018, Singapore Statutes Online, https://sso.agc.gov.sg/Acts-Supp/9-2018/ [12]Cybersecurity Act, CSA, https://www.csa.gov.sg/legislation/cybersecurity-act [13]Id. [14]Cybersecurity Act Explanatory Statement, https://www.csa.gov.sg/~/media/csa/cybersecurity_bill/cybersecurity%20act%20-%20explanatory%20statement.pdf [15]Australia’s Cybersecurity Strategy, https://cybersecuritystrategy.homeaffairs.gov.au/ What is the Government doing in cybersecurity, Ministers for the Department of Industry, Innovation and Science, https://www.industry.gov.au/data-and-publications/australias-tech-future/cyber-security/what-is-the-government-doing-in-cyber-security [16]Australia’s International Cyber Engagement Strategy, Department of Foreign Affairs and Trade,https://www.dfat.gov.au/sites/default/files/DFAT%20AICES_AccPDF.pdf [17]Essential Eight Explained, ACSC, https://www.cyber.gov.au/publications/essential-eight-explained [18]Pacific Cybersecurity Operational Network(PaCSON), https://dfat.gov.au/international-relations/themes/cyber-affairs/cyber-cooperation-program/Pages/pacific-cyber-security-operational-network-pacson.aspx Or Strengthening cybersecurity across the Pacific, ACSC, https://www.cyber.gov.au/news/pacific-islands PaCSON is comprised of 15 members, including Australia, Fiji, Marshall Islands, New Zealand, Papua New Guinea, Samoa, and Solomon Islands. [19]Taiwan 5G Action Plan, Executive Yuan,https://www.ey.gov.tw/Page/5A8A0CB5B41DA11E/087b4ed8-8c79-49f2-90c3-6fb22d740488

Challenges and Opportunities from Digital Convergence

Preface With the blooming of IT technologies, the term of “digital convergence” represents the whole atmosphere at this moment. “Digital convergence”—means that after telecommunication and broadcasting systems are following the IP based framework, contents and services, those were easy to define, turn to be confused. Relying on the uniform platform, operators are able to provide services to different systems. Services containing VoIP, IPTV or the latest terms of “Multi-screen Ecosystem” and “Connected TV” are all involved in the “digital convergence” notion. Today, no matter the service of “check in” or “watching TV programs on Smartphone,” any figures about multiple services on different devices are presenting the “digital convergence” effect. On the consumer side, “digital convergence” brings a fascinating imagination of life. Time and space are no more limitations to people for getting information. Consumers select services only depending on the quality of each service. However, the fascinating imagination of customers becomes a pressure to the relative industries. In the past, because of distinctive transmission technique, services of television, internet and information were regarded as in different industries. Effective competitors only appeared in the same industry. However, today “digital convergence” effect results in crossing-industries competition and customer immigration. To accommodating and pursue the new trend, only unique ideas and novel services can help incumbents to survive. “Digital convergence” brings not only a challenge but also an opportunity. Today, user-friendly application services are cumulatively created and accommodated in the mature broadband network. For examples, high quality entertainment services occur after communication and multimedia broadcasting techniques are improved, “Near Field Communication” technology rising causes new types of cash flow services. Otherwise, Cloud Computing technique enables people easily to access tele-healthcare services and Telematics services. Certainly, digital convenience accelerating industries transformation and value-added services is now taking place around us. According to ITU reports, every 10% increase of broadband infrastructure extension might cause 0.255 to 1.38% GDP growth rate. High penetration of broadband infrastructure might lead a significant influence on economy growth. Take South Korean experiences as an example, by owing a complete broadband infrastructure, on-line game industry and national digital content industry in this country are individually possessing $8.3 billion and $ 3.4 billion output value. By sensing the potential possibilities, governments in different countries propose their own national industry policies, including American government proposed “National Broadband Plan”, the “Digital Britain White Paper” formulated by United Kingdom, “Hikari no Michi”(光の道, which means fiber superhighway) in Japan and the “Ultra-Broadband Convergence Network Plan (UBcN plan)” in South Korea, moreover, the “Tri-networks Integration Plan” in China. And Taiwan does not absent in this moment. In order to stand firmly in this trend, we also formulate “Digital Convergence Development Program 2010-2015 (DCDP 2010-2012)” in 2010. Below, we are going to make a briefly and neat description of “DCDP 2010-2012”. 1.INTRODUCTION For assisting national relative industries to smoothly transform and enhancing Taiwan’s international competitiveness, Executive Yuan admitted the “Digital Convergence Development Program 2010-2015 (DCDP 2012-2015)” in 2010. In this program, there were six main goals containing: (1) complement the broadband superhighway infrastructure; (2) initiate the convergence of telecommunication services; (3) accelerate the process of Television digitization; (4) develop emerging internet video services; (5) improve communication industries; and (6) establish an integrity regulation framework, as well as twenty-one improving tactics and seventy-eight measures for crossing- administrations cooperation and negotiation to be declared. Otherwise, Executive Yuan also established DCTF to be responsible for coordinating every effort from every administration and facilitate digital convergence tasks. Latter, we will make further descriptions for the six main goals, we just mentioned above: A.Complement the broadband superhighway infrastructure According to the Global Information Technology Report 2010-2011, proposed by World Economic Forum (WEF), Taiwan on the Network Readiness Index (NRI) item was been ranked at 6th place and at 5th place on another item of highest FTTH/FTTB penetration. However, though our coverage of broadband network was high, the total bandwidth was still insufficient to contain all the new creating services. To resolving the shortage of bandwidth, including Ministry of the Interior (MOI), Ministry of Economic Affairs (MOEA), Ministry of Transportation and Communications (MOTC) and National Communications Commission (NCC) were convened to extend the national fiber coverage and facilitate the installation upgrade. Regarding wireless broadband construction, administrations including MOEA, MOTC and NCC were under obligation to energetically detect the latest developments of wireless telecommunication technologies as well as proposed guidelines from other countries, concerning about the allocation of spectrum, telephone numbers and IP address resources. Through crossing-administrations cooperation and coordination, in December 2011, the total of national subscribers applying fiber network service had achieved 3.31 million houses, besides, there were 24.58% houses in Taiwan possessed 100Mbps broadband network services. Totally, there were 7.88 million wireless broadband accounts being applied. B.Initiate the convergence of telecommunication services Smartphone booming brought an emerging mobile entertainment life style, furthermore, it also accelerated the rising of mobile value-added application services. To this trend, administrations containing MOEA, Financial Supervisory Commission (FSC) and NCC all devoted to establishing a constructive environment, with providing assists and building up a complete regulation framework. For examples, up to the end of 2011, national telecommunication operators had signed a memorandum with EasyCard Corporation to develop a mobile cash flow platform, which allows cash flowing through the Internet, for giving people a more convenient experience. C.Accelerate the process of Television digitization Within various emerging application services, “Television digitization” might be the most important one in people’s life. “Television digitization” service brought not only a higher quality experience of watching programs, but also created extra demands of relative application services. Furthermore, increasing demands also bought an improvement to the industry and simultaneously accelerating the development of digital content industry. Nationwide terrestrial TV signal switching program, a fully signal switching from analog to digital, has accomplished in July 2012. In order to achieve 90% coverage rate of digital signal transmission, accommodations containing Council of Indigenous People (CIP) and NCC were not only devoted to establishing a Digitization Improvement Station, but also attempt to integrate all signals from original terrestrial TV stations into one satellite to transmit. To accomplish this signal switching program, government had cultivated for many years and try to increase people’s acceptance level of high definition (HD) TV service. Before receiving this success, NCC had spent a long time devoting itself to integrating containing every effort from many administrations and associations, such as the local governments, national industry associations and operators of household application, moreover, as well as Public Enterprises, including Taiwan Power Company, Chunghwa Post Corporation and Taiwan Water Corporation to popularizing this program. Nevertheless, about the digitization program of cable TV, up to 2010, though there were already 60% of houses in Taiwan possessing cable TV service, only 5.55% of cable TV houses switched into digital. As a result, we found that no incentive measures might be the crucial reason. To reverse the impasse, our strategy was to amend the current laws, through adjusting the regulation framework we could facilitate the market into effective competition. In addition, to accelerate the cable TV digitization process, government also regarded the Olympic relaying in England as a turning point to create the demands of HD TV service. After getting the franchise, people are able to watch Olympic Games through any platforms, including terrestrial TV, cable TV and even IPTV. As the demands arising, it would also encourage operators to produce more HD programs afterward. D.Develop emerging internet video services Digital convergence effect also caused the emerging internet video services booming. In order to encourage the crossing-platforms video services and achieve 50% user rate in 2015, there were three guidelines been proposed. The first one was emerging video service regulation reforming, the second one was facilitating integration between emerging accessing approaches and distribution channels, and the third one, developing a rational regulation on contents management. In synchromesh with terrestrial TV signal switching program, emerging internet video services were also assigned to provide HD Olympic Games programs. In that period, the subscribers of Chunghwa Telecom’s MOD (Multimedia on Demand) service were able to watch the Olympic Games relaying on 14 free HD channels and 1 free 3D channel, which is provided by ELETA TV. Moreover, they could also receive the programs on demand through internet or Smartphone. Afterward, from the collected data, we found that even though the rate of new subscribers only had a few rise, an obviously rose presented on the turning on rate. Depended on those data, we believe that people had already been more familiar with IPTV and HD programs. Besides, this relaying program totally attracted 95 individual advertising and the total revenue from advertising was NT$ 80 million dollars. E.Improve communication industries Producing prolific contents is the key element for attracting customers and stabilizing the development of digital convergence industry. To facilitate the contents producing, DCDP proposed three elements to be improved: fund, talent and marketing. And the tasks of these three elements were including investment facilitation, marketing skill reinforce, personal training as well as culture protection, consumer’s right protection, technique standardization and transnational cooperation. To assist in industries transformation, MOEA focused on promoting the APP design and upgrades. Recently, measures provided by MOEA, such as transformation counseling, R&D subsidies, drive-by VC investment, personal training and even the R&D loan had already taken effect. In addition, to create a virtuous investment circles in contents industry, government also considered to release more subsidies to encouraged those superior producers and movie makers. F.Establishing an integrity regulation framework Digital convergence effect accelerated the competition in the market, including communication or relative contents industries were enter a transformation era. In this period, it was essential to have a practical and integrity regulation framework. Recently, NCC hastened to undertake the amendments of three Acts, containing Radio and Television Act, Cable Radio and Television Act and Satellite Broadcasting Act. Actually, the expectation of this undertaking was to adopt the adjustment of digital convergence in 2014. In addition, Fair Trade Commission (FTC) and Intellectual Property Office (IPO) would also continue to observe the digital convergence influences in 4C (telecommunication, cable television, computer network and e-commerce) and contents (copyright) industries. 2.Second Edition of DCDP and Primly Policies Indicators Advance Since DCDP was launched, it has caused a tremendous response. Nevertheless, rapidly advanced ICT technologies inspire people’s expectations. Recently, it has already overtaken the anticipations of used DCDP. Therefore, to formulate a prescient version, Executive Yuan adopted the second edition of DCDP 2010-2015 in May 2012. In the second edition, an item of “producing prolific TV programs” is added to be the seventh main subjects, in addition, there are five extra items added in the improving tactics part; moreover, the number of measures increased to 107 items. Digital convergence indicators are also reformulated. First, 100Mbps wired broadcasting service should achieve 100% in 2013, and the second, accomplishing 100% digitization of cable TV in 2014. To achieve these indicators, relative administrations decide to accelerate the network infrastructure complementing process and cable TV digitization process. Simultaneously, they also consider extending their regulatory scale from emerging internet video services to the connected TV industries, and enhancing superior programs producing by policy making. In point of accelerating network infrastructure complementing process, a complete broadband network is a foundation of digital convergence industry. However, a “complete” network indicates not only the non-discriminatory access to the hardware, but also mention about having reasonable prices to access broadband services. By considering of Telecommunication operators and cable TV operators are both provides of broadband services, the digitization issue of cable TV industry is also concerned in the DCDP. As a primary enemy to Telecommunication operators in the convergence market, cable TV operators’ competitiveness does not come from the their large share on the cable TV market, but from their possession of wide spread cable network. Otherwise, various new creating contents and application are also encouraged in the DCDP. With “Smart TV,” “HDTV” and “Connected TV” booming, “TV” has transformed from a passive receiving media to an information transport. Although, those emerging broadcasting techniques might threaten the traditional television industry, they bring positive influences to the media industry. By considering a well-run development must building on a integrity and friendly regulation framework. DCTF, an office established by Exclusive Yuan, will also take its responsible to assist NCC on the digital convergence regulatory issues. 3.Conclusion Digital convergence effect to us is a turbulence but also a moment. Today, this effect, which originally comes from the techniques convergence, has detonated in different nations and various places; crossing-industries competition turns to be more and more common around the world. To accommodate our nation to this trend, the primary strategy proposed by government is to integrate administrations’ effort. Through policies making, including DCDP upgrading and validly relative regulation frameworks amending, every relative industry is able to restore enough energy and seize the moment, further, naturally turns to be a domain of market competition.

From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act

From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act 2025/09/30 As information and communication technologies (ICT) rapidly evolve, global industries have experienced swift iteration and convergence in the past decades. To adapt to this trend and dismantle outdated regulatory restrictions, Taiwan passed the Telecommunications Management Act in 2019[1], replacing the Telecommunications Act[2] of 1996. This move marked a departure from the traditional model of heavily regulating the telecommunications industry as a concession-based business. The new law aimed to promote the launch of innovative services and foster fair market competition. Its fundamental goal was to deregulate, encourage innovation, and establish a more flexible and efficient regulatory framework. However, the 2025 amendment to the Telecommunications Management Act suggests that Taiwan's telecommunications policy is shifting from openness toward a more conservative stance. I. Background: The 2019 Shift to a Registration-Based System The original Telecommunications Act adopted a strict licensing system and vertical regulation, categorizing operators based on whether they owned physical network infrastructure and the specific services they offered. This rigid regime established detailed rules for each business category and imposed heavy penalties on unlicensed operators, stifling the industry's potential for innovation. In response, the 2019 Telecommunications Management Act introduced a horizontal regulation approach, structuring the communications industry into three distinct layers: infrastructure (telecommunications networks), operations (telecommunications services), and content/application. Furthermore, the market entry system was transformed from a licensing model to a registration model. Only service providers needing to interconnect with other operators, apply for radio frequencies, or use telecommunications numbering resources were required to register as "telecommunications enterprises." Providers of other services, like Internet Access Service Providers (IASPs) and Mobile Virtual Network Operators (MVNOs), were not required to register–a policy designed to invigorate the market by encouraging innovation and cross-industry operations. Once registered, however, an enterprise is subject to close supervision by the National Communications Commission (NCC) and must fulfill various legal obligations, including: General Obligations (e.g., retaining communication records). Special Obligations (for specific services, such as providing emergency communications). Designated Obligations (cooperating with national policies like disaster response and assisting with communication surveillance). Given these obligations and a lack of sufficient incentive, IASPs and MVNOs are unlikely to voluntarily register as telecommunications enterprises. II. The 2025 Amendment: Mandating Registration to Combat Fraud Crime The 2025 amendment to Article 5 of the Telecommunications Management Act fundamentally alters this framework. It now mandates that all MVNOs and IASPs register as telecommunications enterprises and fulfill the corresponding obligations. The amended law took effect on July 2, 2025, and existing operators have a one-year grace period to complete their registration. The primary driver for this policy reversal is the national imperative to combat fraud-related crimes. For MVNOs, the rationale is clear. Mobile phone numbers are integral to modern life, functioning as digital identifiers for accessing financial services and engaging in economic activities. To prevent criminals from exploiting anonymous numbers, mandatory registration enables the government to enforce Know Your Customer (KYC) procedures, ensuring the verification of the end-user's identity. For IASPs, the previous voluntary system created ambiguity regarding the total number of operators in the market. The government requires cooperation from IASPs to implement crime-fighting measures, such as restricting access to fraudulent websites under “The Fraud Crime Hazard Prevention Act”[3], or providing “network traffic records” to judicial authorities as required by “The Communication Security and Surveillance Act”[4]. Mandatory registration ensures all IASPs are identifiable and can be called upon to assist in these efforts. III. Challenges and Outlook: The "Tiered Management" Approach Notably, the new law authorizes the NCC to implement "Tiered management", a system that allows for different regulatory requirements based on an operator's revenue, user base, and other factors. This suggests that smaller operators, which may have different risk profiles and a lesser impact on the public interest, could face more relaxed regulations. The NCC is currently drafting the specific standards for this tiered approach. This presents a potential paradox. If the primary goal of mandatory registration is to establish a comprehensive defense against crime, allowing regulatory intensity to vary by company size could create the very loopholes the amendment aims to close. Effectively implementing a framework that is both fair to smaller businesses and robust against criminal exploitation will be a significant test of NCC. [1]Telecommunications Management Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060111 (last visited Sept. 30, 2025). [2]Telecommunications Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060001 (last visited Sept. 30, 2025). [3]Fraud Crime Hazard Prevention Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=D0080226 (last visited Sept. 30, 2025). [4]The Communication Security and Surveillance Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060044 (last visited Sept. 30, 2025).

Introduction to Critical Infrastructure Protection

The security facet of cyberspace along with a world filled with CPU-controlled household and everyday items can be examined from various angles. The concept of security also varies in accordance with different stages of national conditions and industrial development in different nations. As far as our nation is concerned, the definition of security industry is "an industry offering protection for human bodies, important infrastructure, information, financial system, as well as offering equipment to defend the security of national lands and the service"1 as initially defined by "Security Industry Program Office." Judging from the illustration of the definition, the security industry should be inter-disciplinary and integrative, which covers almost all walks of life and fields, such as high-tech industrial security management, traffic & transportation security management, fire control and prevention against natural calamities, disaster relief, information security management, security management in defense of national borders, and prevention of epidemics. After the staged mission, "e-Taiwan program", was accomplished in 2007, our government hoped to construct a good surrounding by creating a comfortable life from a user’s point-of-view. This was hoped to be achieved by using "the development of a high-quality internet society" as a main source by using innovative services, internet convergence, perceptive environment, security, trust, and human machine linkage. At the Economic Development Vision for 2015: First-Stage Three-Year Sprint Program (2007~2009) formulated by the Executive Yuan, wireless broadband, CPU computer-controlled items all have become part of our every day lives, and healthcare, along with the green industry are listed as the next emerging industries; whereby the development of relevant critical technologies is hoped to be promoted to create higher industrial values and commercial opportunities. However, from a digitally-controlled-life viewpoint, the issue concerned by all walks of life is no longer confined to the convenience and security of personal life but gradually turns to protection of security of a critical infrastructure (CI) run by using information technology. For instance, finance management, stock market, communication network, harbors and airports, high speed rail, R&D of important technology, science parks, water purification facilities, water supply facilities, power, and energy facilities. 2Because security involves resources related with people's most fundamental living needs and is the most elementary economic activity of the society, it is regarded as an important core objective to promote the modern social security system. Therefore, critical infrastructure protection requires more dependence on information and communication technology to maintain the stability of finance and communication, as well as the security of facilities related with supply and economy of all sorts of livelihoods in order to ensure regular operation. With the influence of information and communication technology on the application of critical infrastructure on the increase, the society has increasingly deepened its dependence on the security of our cyber world. The concept and connotation of information security also keep extending with it toward the aforementioned critical infrastructure protection planning, making critical information infrastructure protection (CIIP) and critical infrastructure protection (CIP) more inseparable in concept3 , and becomes an important goal of policy implementation to achieve the vision of a digital lifestyle which is secure for every nation. In recent years, considerable resources have been invested to complete an environment whereby a legal system of “smart lifestyle” is developed. However, what has been done for infrastructure protection continues to appear as not being comprehensive enough. This includes vague definitions, scattered regulations and policies, different protection measures taken by different authorities in charge, obvious differences in relevant risk management measures and in the magnitude of management planning of information security and so on. These problems all influence the formation of national policies and are the obstacles to the promotion of relevant industrial development. In view of this, the 2008/2009 International CIIP Handbook will be used as the cornerstone of research in this project. After the discussion on how critical infrastructure protection is done in America, Germany and Japan, the contents of norms of regulations and policies regarding critical infrastructure protection in our nation will be explored to make an in-depth analysis on the advantages and disadvantages of relevant norms. It is hoped to find out what is missing or omitted in the regulations and policies of our nation and to make relevant amendments. Suggestions will also be proposed so that the construction of a safe environment whereby the digital age of our nation can be expanded to assist the “smart lifestyle” to be developed further. 1.See http://tsii.org.tw/modules/tinyd0/index.php?id=14 (last visited May 24, 2009) 2.For "2008 International Conference on Homeland Security and Application of Technology in Taiwan ~ Critical Infrastructure Protection~", please visit http://www.tier.org.tw/cooperation/20081210.asp (last visit date: 05/17/2009). 3.For critical infrastructure protection, every nation has not only proceeded planning for physical facilities but put even more emphasis on protection jobs of critical information & communication infrastructure maintained via the information & communication technology. In the usage of relevant technical terms, the term "critical infrastructure" has also gradually been used to include the term "critical information & communication infrastructure". Elgin M. Brunner, Manuel Suter, Andreas Wenger, Victor Mauer, Myriam Dunn Cavelty, International CIIP Handbook 2008/2009, Center for Security Studies, ETH Zurich, 2008. 09, p. 37.

Most read
[　X Close　]
Copyright © 2016 STLI,III. All Rights Reserved.
TOP