Artificial Intelligence Governance - Taking Deep Fake as an Example

Artificial Intelligence Governance - Taking Deep Fake as an Example

 

1.Introduction

  With the increasing maturity of the use of neural networks, the application of artificial intelligence technologies is becoming more and more widely used. Among them, through the automated editor and convolutional neural network technology, the threshold of the technology of copying films is not very high. In November 2017, some films that superimpose the faces of social celebrities on pornographic film actors/actresses appeared in the American social networking platform, Reddit. These types of films analyze the faces of specific socialites through deep learning algorithms and superimpose their faces on the films, making them look as if the films were taken by the socialites themselves. This technology was released by developers in 2018 and was made into an app for public use. At present, such technology is generally referred to as "deep fake" internationally, and it is believed that it may contribute to the speedy invention and distribution of false information existing throughout the Internet nowadays, which has attracted the attention of legislators worldwide. As it uses fake images or films automatically generated by Deep-learning technology, it involves both dimensions of fake information prevention and artificial intelligence governance. The purpose of this paper is to observe the relevant policies, legal measures and related guidelines or principles of the international community in response to issues of deep fake and artificial intelligence governance, and to examine whether the current legal system in Taiwan can cope with the impact of deep fake so as to provide feasible recommendations.

 

2.Ethics Rules for Artificial Intelligence

  In the governance of artificial intelligence, the European Union introduced the “Ethics Guidelines for Trustworthy AI” on April 8, 2019 to establish a framework for supervising artificial intelligence in order to make artificial intelligence trustable.

  The guidelines first points out that Trustworthy AI requires three key characteristics: (1) it should be lawful: complying with all applicable laws and regulations; (2) it should be ethical: ensuring adherence to ethical principles and values; and (3) it should be robust: both from a technical and social perspective, to avoid AI from inadvertently causing harm.

  Fundamental Rights are the basis of trustworthy AI. In order to comply with the above-mentioned basic human rights and to make AI reliable, their expert group believes that AI should abide by four ethical principles, including: (1) respect for human autonomy; (2) prevention of harm; (3) fairness; and (4) explicability. The four ethical principles are also transformed into the seven specific measures: “human agency and oversight”, “technical robustness and safety”, “privacy and data governance”, “transparency”, “diversity, non-discrimination and fairness”, “societal and environmental wellbeing impact evaluation” and “AI accountability”. To facilitate the true implementation of self-assessment for application developers, the Guidelines devise the Trustworthy AI Assessment List in Chapter 4 for the reference of the enterprise.

 

3.Counter measures Against the International false messages

  In response to the prevention of false messages, the two parties in the United States also jointly proposed in 2018 the Malicious Deep Fake Prohibition Act of 2018 to amend the relevant provisions of fraud in the criminal law. This bill amends Chapter 47 of the United States Code by adding Section 1041 with regard to fraud in connection with audiovisual records. It treats the use of deep fake as a criminal offence and defines deep fake as “audiovisual record created or altered in a manner that the record would falsely appear to a reasonable observer to be an authentic record of the actual speech or conduct of an individual”. It shall be unlawful to, using any means or facility of interstate or foreign commerce, to create, with the intent to distribute, a deep fake with the intent that the distribution of the deep fake would facilitate criminal or tortious conduct; or distribute an audiovisual record with actual knowledge that the audiovisual record is a deep fake, and the intent that the distribution of the audiovisual record would facilitate criminal or tortious conduct. Any person who violates the above may be sentenced to imprisonment for more than 2 years but less than 10 years. However, the bill is currently put on hold without being further reviewed.

  In addition, in order to properly cope with the danger of deep fake, on June 28, 2019, the two parties in the US Congress jointly proposed the bill - "To require the Secretary of Homeland Security to publish an annual report on the use of deep fake technology, and for other purposes”, which may be cited as the "Deepfakes Report Act of 2019". This bill requires the Department of Homeland Security to conduct research on deep fake and related issues, produce an annual report, and to request it to assess the direction of addition or revision of relevant laws and regulations. Moreover, the US senators from both parties also proposed on June 12, 2019 the bill- “Defending Each and Every Person from False Appearances by Keeping Exploitation Subject to Accountability Act of 2019”, which may be cited as “DEEP FAKES Accountability Act”. This Act is the same as the Act of 2018, both of which treat the use of deep fake as a fraudulent act by adding section 1041 to Chapter 47 of the United States Code. However, this Act does not directly define deep fake, but rather define such a type of technology as “advanced technological false personation record”, and require such records to comply with:

(1) DIGITAL WATERMARK: Any advanced technological false personation record which contains a moving visual element shall contain an embedded digital watermark clearly identifying such record as containing altered audio or visual elements.

(2) AUDIOVISUAL DISCLOSURE shall comply with the following principles:

A. clearly articulated verbal statement that identifies the record as containing altered audio and visual elements, and a concise description of the extent of such alteration; and
B. an unobscured written statement in clearly readable text appearing at the bottom of the image throughout the duration of the visual element that identifies the record as containing altered audio and visual elements, and a concise description of the extent of such alteration.

(3) VISUAL DISCLOSURE shall comply with the following principles: Any advanced technological false personation records exclusively containing a visual element shall include an unobscured written statement in clearly readable text appearing at the bottom of the image throughout the duration of the visual element that identifies the record as containing altered visual elements, and a concise description of the extent of such alteration.

(4) AUDIO DISCLOSURE shall comply with the following principles: Any advanced technological false personation records exclusively containing an audio element shall include, at the beginning of such record, a clearly articulated verbal statement that identifies the record as containing altered audio elements and a concise description of the extent of such alteration, and in the event such record exceeds two minutes in length, not less than 1 additional clearly articulated verbal statement and additional concise description at some interval during each two-minute period thereafter.

  According to the bill, those who violate the above requirements shall be subject to legal responsibilities. In criminal liabilities, whoever knowingly violates the above requirements and (1) with the intent to humiliate or otherwise harass the person falsely exhibited, provided the advanced technological false personation record contains sexual content of a visual nature and appears to feature such person engaging in such sexual acts or in a state of nudity; (2) with the intent to cause violence or physical harm, incite armed or diplomatic conflict, or interfere in an official proceeding, including an election, provided the advanced technological false personation record did in fact pose a credible threat of instigating or advancing such; (3) in the course of criminal conduct related to fraud, including securities fraud and wire fraud, false personation, or identity theft; or (4) by a foreign power, or an agent thereof, with the intent of influencing a domestic public policy debate, interfering in a Federal, State, local, or territorial election, or engaging in other acts which such power may not lawfully undertake, may be sentenced to imprisonment for not more than 5 years.  In civil liabilities, any person who violates the above requirements may be subject to a civil penalty of up to US$150,000 per record or alteration, as well as the compensation for the damage, if any.

  In addition to the United States, the United Kingdom also launched the "Online Harms White Paper" in April 2019, which will establish a new "Online Safety" control structure to respond to false messages and underage pornographic videos, deep fake and online drug trafficking and so on.

  The report points out that the new network security control framework will clarify the legal obligations of the Internet company to make the company assume more security responsibilities and avoid the harm caused by the content or actions generated by the service provided, and establish an independent regulatory agency supervising and implementing the relevant legal policies. The regulatory authority should provide relevant guidelines for compliance with the new obligations. If the company is unwilling to comply with the relevant guidelines, it must bear the burden of proof and prove that its alternative measures can achieve more effectively for the purpose of protecting the Internet users. In addition, the framework will also include elements of “Transparency, Trust, and Accountability”. The competent authority will be given the right to request an annual transparency report be submitted by the company, which the report should indicate the relevant harmful contents appeared on its platform, explain how it is handling with the problem, and publish the report on the website. Furthermore, the competent authority will have the right to request additional information from the Internet company, such as how its algorithm works.

  In response to false messages, the report points out that current Internet companies have begun to conduct research on the prevention and control methods of fake news dissemination, including: (1) through the terms of service, users are not allowed to distort their identity on social software to spread false messages. (2) developing relevant tools to detect suspicious, false or junk accounts; (3) using automated artificial intelligence to delete or remove fake accounts; and (4) collaborating with independent fact verifying platforms. However, in the future, the government hopes that the guidelines and related policies proposed by the competent authorities must further include the following matters: (1) The company shall clarify its definition of false information in its terms of service, and state its expectations of users, and the possible penalties to users who violate the company policy; (2) The company should adopt the relevant countermeasures to deal with users with distorted identities who disseminate false messages; (3) The visibility of the disputed content currently under the fact-verifying inspection shall be reduced; (4) The fact-verifying service shall be used, especially during the election period, for fulfilling the obligation of fact verification; (5) Promote authoritative news sources; (6) Promote news circulation from different perspectives, rather than only reinforce the messages of people's existing views; (7) Users should be able to recognize that they are interacting with automated accounts and should ensure that the dissemination of automated accounts information is not abused; (8) Promote the transparency of political advertising to comply with the norms of the UK electoral law; (9) Companies should ensure that users may mark the content that they believe to be false news by themselves and let them know that the company is targeting false news for countermeasures to be taken; (10) The procedures for publishing information should be open and transparent so that the public can assess the effectiveness of the company’s response to false information, and further support the relevant research on online false message activities; (11) The relevant procedures and measures should be taken to continuously monitor and evaluate the effectiveness of the processing flow of fake messages.

  From the above-mentioned relevant international legal policy observations, it can be found that international measures related to deep fake can be classified into the following items:

(1) Establish an independent fact-verifying unit.
(2) Improve the transparency of information sources.
(3) Improve the oversight responsibility of the online platform for the messages appeared on such a platform.
(4) Deep fake is to be treated as an independent criminal act and its criminal, civil and administrative responsibilities are to be clearly regulated.
(5) On the technical level, relevant artificial intelligence tools are being developed to respond to this issue. For example, the American startup company, Deeptrace, has begun to conduct research and develop deep fake identification technology to identify the authenticity of the films.

※Artificial Intelligence Governance - Taking Deep Fake as an Example ,STLI, https://stli.iii.org.tw/en/article-detail.aspx?no=55&tp=2&i=169&d=8313 (Date:2026/10/16)
Quote this paper
You may be interested
Research on the Introduction of Privacy Protection Management Mechanisms and Data Value-Added Services into Communications Enterprises in 2020

Research on the Introduction of Privacy Protection Management Mechanisms and Data Value-Added Services into Communications Enterprises in 2020 2021/12/09 I. Introduction   The global economy is shifting away from traditional economic models towards an emerging digital era as technology advancement and new applications are introduced. The rapidly changing digital age has led to a gradual transformation in the way digital technology is used in the industry, thereby driving the overall growth of the global digital economy. The digital economy is driven by "data," and how data is used, its purpose, risks and regulation are all inextricably intertwined with industrial development and application, as is the case for the communications industry.   As such, while the free circulation of data has become central to international free trade and economic operations, it is not only conducive to the promotion of transnational business and economic and trade interactions, but also fraught with worry and concern over how to ensure the protection and security of personal data and privacy. As a result, the issue of how to adapt the data risk control mechanism and related complementary measures so that they can be applied to the industry and comply with regulatory requirements has become a global reality that must be actively addressed. As far as Taiwan is concerned, when considering how to cope with industry needs, there is a pressing need to strike a balance between personal data and international regulatory requirements, and to expedite the legitimate utilization of personal data protection and data value-added service in the sector in an effort to facilitate the development of the digital economy. II. Recommendations on Data Governance and Innovative   Application Planning. According to the aforementioned international data strategies and strategies for innovative data applications, the development of the data economy as a whole is driven by the formulation of overall superior policies, with a view to fully utilizing the potential value of data and building a vibrant ecosystem suited for innovative data applications. With the outbreak of COVID-19 this year, the application of data will be crucial in the post-pandemic era. It is also observed that data applications are gradually moving towards cross-boundary sharing and reuse, and empowerment of data subjects, and therefore, in light of the above observations and findings, we offer recommendations on data governance and innovative application planning. First, as for the establishment of a ministry and mechanism for data application and communication, since there is no single dedicated authority in Taiwan, and the formation of a ministry for science and technology development is now under intense discussion, data application may become an important function of the ministry, so we have to consider an authority for data application and communication. Further, there is currently no sandbox mechanism for data application in Taiwan. Reference should be made to the British data communication mechanism for providing legal advice and consultation sought on data application regulation.   Second, with regard to the formulation of regulations and amendments to existing laws relating to data applications, the most noteworthy is the EU Data Governance Act 2021. Taiwan does not have a complete and appropriate legal framework for data application, except for the Freedom of Government Information Law, the Personal Data Protection Act (PDPA) and the relevant laws and regulations distributed in various fields, and the nation is currently seeking an adequacy decision from the EU, and therefore our PDPA needs to be amended accordingly, yet no progress has been made at this stage. Consequently, a comprehensive strategy should be developed by taking into account both the formulation of the basic data application regulations and the amendments to the current PDPA, in order to achieve long-term data governance and application and sharing.   Lastly, in terms of the incorporation of the concept of data empowerment and the design of the mechanism, the international trend moves towards data empowerment to give data subjects more control over their data. The Financial Supervisory Commission (FSC) of Taiwan has also incorporated this idea in its open banking, so has the National Development Council’s (NDC) MyData program. As such, it is suggested that the government should provide guidelines or devise the relevant system, or even make reference to the Japanese data bank mechanism regarding the establishment of intermediaries to assist consumers in managing their data, which could be used as a reference for the design of the mechanism in the future. III. Accountability for and Management of Data Use in Enterprises   Among the countries studied regulation of Singapore and Taiwan are similar and have adopted the development of digital economy as their main economic strategy, but Singapore has been more proactive than Taiwan in the design of the legal system to facilitate the use of data. Therefore, with regard to the control of data use in businesses by the competent authorities, this Project, by looking at the amendment to the Singaporean PDPA, aims to reinforce the regulation of the accountability system and the operation of the existing series of guidelines. From the changes in Singapore's PDPA, it can be observed that the competent authorities can refer to the practices of enterprises in the use of data.   First of all, the existing regulations in Taiwan tend to have more about compliance than accountability, with emphasis being placed on data security maintenance and compliance with the PDPA. For instance, Taiwan’s “Regulations Governing Security Measures of the Personal Information File for Non-government Entities Designated by National Communications Commission” focus on following the law on the use of personal data. Nonetheless, the so-called accountability means that the competent authorities must oversee the implementation of data protection measures and policies of enterprises, not just pro forma compliance with the letter of the law.   The second observation is that Singapore is quite proactive in addressing the need for data use in the development of its digital economy by making an exception to innovative uses regarding informed consent. The inclusion of data portability also represents a heightened control of the data subject. These amendments are all related to Singapore's policy of actively developing its smart nation initiative and signify a more proactive approach by the authorities in monitoring the use of data by businesses. Taiwan needs to be more open and precise in regulating the use of data for the development of its digital economy.   Finally, there is increased flexibility in enforcement, as authorities can resolve disputes between subjects over data use more quickly through the introduction of mediation or other alternative dispute resolution (ADR) mechanisms. Meanwhile, the Personal Data Protection Commission (PDPC) has developed industry-specific consultation guidelines, recognizing that there may be specific issues for different industries. The PDPC noted that these guidelines are based on the partnerships, consultations and feedback associated with the relevant industries, and close collaboration with the industry's authorities of target businesses. IV. Conclusion   Despite the lack of a dedicated authority for personal data protection, Taiwan can first build a cross-industry coordination and communication platform, and then collaborate across ministries to primary integrate standards in personal data protection to facilitate the needs of industrial innovation in the digital economy.

The Research on Cybersecurity Risks in 5G network: Perspectives on Global strategy

The Research on Cybersecurity Risks in 5G network: Perspectives on Global strategy I. The characteristics of 5G and cybersecurity threats   Compared to 4G, 5G adopts several new designs on the network architecture, such as software-defined networking (SDN), a baseband unit (BBU), logical disjunction, network function virtualization (NFV), and multi-access edge computing (MEC), to provide users with high-speed, low-latency and other quality services, as well as flexibility and expansibility to accommodate more emerging applications.   According to the three key usage scenarios (see Figure 1) defined by the International Telecommunication Union (ITU), enhanced mobile broadband access (eMBB) provides high-volume mobile broadband services such as AR/VR or ultra-high-definition video. Massive machine type communication (mMTC) provides large-scale IoT services. Ultra-reliability and low latency communication (uRLLC) can be used for services that require low-latency and high-reliability connections, including unmanned driving and industrial automation.   However, with 5G’s open, flexible and extensible design, as well as its coexistence with other 4G and 3G systems in the early stage of commercial operation, the cybersecurity threats facing 5G networks are more severe and diverse than the past mobile phone generations. At present, the known 5G cybersecurity threats mainly come from network functional components and connection interfaces among components, including the terminal device, access network, air interface, cloud virtualization, multi-access edge computing rental, core network, back-end/backbone network, roaming and external services, and so on. Source: ITU Figure 1Three key 5G scenarios by the ITU II. Cybersecurity strategy development in major countries   5G is not only one of the critical infrastructures, but also an important foundation for pursuing a digital nation, digital economy, the industrial 4.0, and for promoting industrial transformation for upgrading. However, different scenarios require different cybersecurity protection levels, which poses great challenges to both mobile network operators and service providers.   Therefore, the construction of favorable environment for 5G development, the promotion of relevant applications and the development of innovative services and so on, have become the priority of governance in the countries around the world. 1. European Union (EU)   Then European Commission President Jean-Claude Juncker noted in 2017 that “Cyber-attacks can be more dangerous to the stability of democracies and economies than guns and tanks…Cyber-attacks know no borders and no one is immune,” indicating the EU's high priority in the cybersecurity field.   The "Digital Single Market," an important EU policy, lays the foundation for digital economy based on "cybersecurity, trust and privacy." In response to the loss of billions of euros a year in cyber attacks, the EU has taken a series of measures to safeguard and advance the development of the Digital Single Market. For the purposes of this strategy, the European Commission in 2018 came up with the policy of Resilience, Deterrence and Defence: Building strong cybersecurity for the EU,[1]with the aim of improving the level of cyber security, cyber resilience and trust in the EU, and in June 2019 passed the Cybersecurity Act [2] with two highlights described as follows: (1) Strengthen the authority of the European Union Agency for Network and Information Security (ENISA)(see Figure 2), increase the allocation of human and financial resources to ENISA, as well as the preparation for the work items related to the cybersecurity industry, and reinforce cyber security support for EU member states. (2) Establish the EU cybersecurity certification framework. [3]   In the European Union, where different cybersecurity certification schemes already exist, the absence of a common certification regime would increase the risk of fragmentation of the single market. For this reason, a set of technical requirements, standards and procedures are provided under this framework to assess whether information/communication products, services and processes are in compliance with security requirements.   The certification program includes product and service categories, information/communication security requirements (e.g. reference standards or technical specifications), types of assessment (e.g. self-assessment or third-party assessment), levels of security, and so on. All member states agree that certification not only facilitate cross-border business transactions, but also enable consumers to better understand the security of products and services. Source: Compiled from the ENISA websit Figure 2 ENISA organization and authority strengthening 2. the United States (U.S.)   In consideration of cyber security affairs in the country, the US Department of Homeland Security (DHS) in May 2018 unveiled the "Cybersecurity Strategy,"[4] which focused on the objectives and priorities of the U.S. government in future cybersecurity protection, identifying and managing national cybersecurity risks with the overall risk management approach, and addressing security threats to the country, critical infrastructures and private enterprises, as well as preventing cybercrimes.   Then the White House in September 2018 released the National Cyber Strategy of the United States of America, [5] based on the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure [6] issued in May 2017, stating the strategy and position of the United States against the threat of cyber- attacks. The strategic goal aimed to, by safeguarding cybersecurity, protect the American people, the homeland, and the American way of life, to build a secure digital economic environment, to promote American prosperity, and strengthen cooperation with partners to deter malicious cyber attackers, so as to maintain peace and security, and continue to expand U.S. influence.   The department in July 2019 published the Digital Modernization Strategy [7] to announce its national defense strategy in the digital environment, including the use of cybersecurity, AI, cloud computing, blockchain and other technologies in information security protection to create a more secure, coordinated and efficient platform and improve the security of intelligence transmission and processing. 3. Canada   Public Safety Canada in June 2018 released the National Cyber Security Strategy, [8] with the vision of a sustainable, robust cybersecurity environment, innovation and prosperity. Through international cooperation and a domestic public-private partnership, the department has been working on three goals: 1. cyber security and resilience (to reduce cybercrime and ensure Internet privacy; 2. Internet innovation (to create a friendly environment for the development of cybersecurity startups); 3. government leadership and cooperation (to transfer government-owned cybersecurity knowledge to the private sector and set up a cybersecurity governance framework).   The Canadian government also attaches great importance to critical infrastructure. In May 2018, the National Cross Sector Forum 2018-2020 Action Plan for Critical Infrastructure [9] was unveiled to facilitate information sharing between public and private partners through sharing and protecting intelligence, and implementing a full risk management approach. Moreover, Public Safety Canada in April 2019 issued a report called Enhancing Canada’s Critical Infrastructure Resilience to Insider Risk, which provided guidelines and suggestions for action on internal risks in critical infrastructure organizations.[10] 4. Singapore   The government of Singapore in 2018 promulgated the Cybersecurity Act, [11] which aimed to fulfill the vision of a Smart Nation by enacting and putting into effect cybersecurity regulations to achieve the goal of a resilient infrastructure and a more secure cyberspace, and to strengthen the protection of critical information infrastructure against cyber-attacks. The Cyber Security Agency of Singapore (CSA) was given the authority to prevent and respond to cybersecurity threats, and to set up a system for sharing security information, as well as a light-touch licensing system for cybersecurity service providers.[12]   The Government of Singapore has appointed a Commissioner of Cybersecurity responsible for promoting domestic cybersecurity policy. To safeguard Singaporeans from cybersecurity threats, [13] the government particularly laid down cybersecurity threat or incident response provisions in Chapter 4 of the Cybersecurity Act to empower the Commissioner of Cybersecurity to investigate cybersecurity threats and incidents, such as requiring the parties to the incidents to present statements in person or in writing, producing documents or provide information and so on.[14] 5. Australia   The Australian government in 2016 proposed a four-year "Australia's Cyber Security Strategy,"[15] which was expected to invest more than 230 million Australian dollars to strengthen Australia's cyber security capability and complete the following five aspects: national cyber partnership, strong cyber defenses, global responsibility and influence, growth and innovation, and a cyber smart nation.   As for the global responsibility and influence, the Australian government in 2017 announced the "Australia's International Cyber Engagement Strategy."[16] which aims to strengthen digital trade, to improve cybersecurity and to response to cybercrime through international cooperation; encourage innovative cybersecurity solutions; provide security advice and best practices, such as Essential Eight strategies[17] to mitigate cyber-attacks; establish the Pacific Cyber Security Operational Network (PaCSON) [18] with neighboring countries to develop regional cybersecurity capabilities; and advance the development of Australia's cybersecurity industry, nurture startups and attract foreign investment. III. Cybersecurity strategy to promote 5G in Taiwan   Since President Tsai Ing-wen took office in 2016, she declared that cybersecurity is directly linked to national security. In 2017, the Department of Cyber Security (DCS) under the Executive Yuan issued "National Cybersecurity Development Plan (2017-2020)," and in 2018 the "Cybersecurity Industry Development Action Plan (2018-2025)," in order to enhance the independence of Taiwan's cybersecurity industry, consolidate the nation’s cybersecurity defense line, improve its innovative thinking of cyber security, and further promote it to the international market.   To develop a favorable environment to promote 5G, the Executive Yuan on May 10, 2019 approved the “Taiwan 5G Action Plan (2019-2022),” [19] with a total investment about NT$20.466 billion over a four-year period. The plan aims to build a 5G application and industrial innovation environment, and reshape Taiwan's mobile communication industry ecosystem, with its content planned around five themes, including "promoting 5G vertical application field demonstration", "building 5G innovation and application development environment," "completing 5G technology core and cybersecurity protection capabilities," "planning to release 5G frequency spectrums in line with overall interests" and "adjusting laws and regulations to create favorable environment for 5G development," and to promote industrial upgrading and transformation, as well as create the next wave of economic prosperity in Taiwan.   Secure, robust and reliable 5G systems are sufficient and requisite conditions for building an innovation ecosystem in digital countries. The third theme of the "Taiwan 5G Action Plan" is to "complete 5G technology core and cybersecurity protection capabilities," which is intended to advance the integration of applied science and technology by establishing advantageous core technologies, set up a 5G technology and test platform, and increase the market competitiveness of 5G industry, while drafting the overall national policies on 5G cybersecurity, building the cybersecurity protection mechanism of 5G homemade products, strengthening 5G critical infrastructure and operational cybersecurity protection capabilities, and promoting domestic suppliers to enter the international 5G reliable supply chain.   In terms of strengthening 5G critical infrastructure and operational cybersecurity protection capacities, the NCC has planned a four-year (2019-2022) "5G Network Cybersecurity Protection and Related Regulations Preparation Plan." In coordination with a 5G license issue in 2020, the agency in 2019 added/amended the 5G cybersecurity provisions of the Regulations for Administration of Mobile Broadband Businesses, making it mandatory for the winning bidder of the 5G frequency spectrum to incorporate the cybersecurity protection concept into the system design for system construction.   Upon commercial operation of 5G, the NCC will audit from time to time the implementation of the cybersecurity maintenance plan by telecom operators, so as to ensure and reinforce the cybersecurity protection system of Taiwan's 5G telecom network, and create an opportunity for the development of 5G homemade products with cybersecurity protection capability. In addition, the NCC will also face up to the fact that 5G technology standards continue to evolve, and the operators have different construction schedules and heterogeneous mobile networks coexist. Therefore, relevant regulations will continue to be completed from 2020 to 2022, and examples will be verified through cybersecurity function testing laboratories to ensure that cybersecurity protection functions of 5G networks keep pace with the times. IV. Conclusion and Suggestion   As for emerging technologies, countries around the world are actively evaluating and constructing 5G systems and services. Taiwan boasts excellent industrial advantages in terms of semiconductors, ICT software and hardware, and high-quality talents, and thus makes a foundation for developing 5G. Furthermore, going with the importance of cybersecurity, it is necessary to pay more attention to planning and developing 5G cybersecurity technology.   It is clear that the development of cybersecurity is both a challenge and an opportunity for Taiwan. In order to implement the national policy objectives of "cybersecurity is national security" as well as "innovative economic development programs for a digital nation," and to response to the scientific and technological progress, and the demand for cybersecurity, key development direction is proposed to expedite the establishment of 5G cybersecurity protection. References [1]Resilience, Deterrence and Defence: Building strong cybersecurity in Europe, European Commission, https://ec.europa.eu/digital-single-market/en/news/resilience-deterrence-and-defence-building-strong-cybersecurity-europe [2]The draft Regulation of The European Parliament And of The Council on ENISA, the "EU Cybersecurity Agency", and repealing Regulation(EU)526/2013, and on Information and Communication Technology cybersecurity certification(''Cybersecurity Act'') was published in September 2017 to expand the rights and obligations of ENISA, which would make ENISA the EU's cybersecurity and information competent authority and the authority for critical infrastructure (information) facilities after the passage of the Act. Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.151.01.0015.01.ENG&toc=OJ:L:2019:151:TOC [3]The EU cybersecurity certification framework, European Commission, https://ec.europa.eu/digital-single-market/en/eu-cybersecurity-certification-framework [4]Cybersecurity Strategy(2018), DHS, https://www.dhs.gov/sites/default/files/publications/DHS-Cybersecurity-Strategy_1.pdf [5]National Cyber Strategy of the United States of America(2018), The White House, https://www.whitehouse.gov/wp-content/uploads/2018/09/National-Cyber-Strategy.pdf [6]THE WHITE HOUSE, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, The White House, https://www.whitehouse.gov/presidential-actions/presidential-executive-order-strengthening-cybersecurity-federal-networks-critical-infrastructure/ [7]DoD Digital Modernization Strategy, DoD, https://media.defense.gov/2019/Jul/12/2002156622/-1/-1/1/DOD-DIGITAL-MODERNIZATION-STRATEGY-2019.PDF [8]National Cybersecurity Strategy, Public Safety Canada, https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/ntnl-cbr-scrt-strtg/index-en.aspx [9]National Cross Sector Forum 2018-2020 Action Plan for Critical Infrastructure, Public Safety Canada, Public Safety Canada, https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/pln-crtcl-nfrstrctr-2018-20/index-en.aspx#a02 The action plan is a three-year program under Canada's2010 National Strategy for Critical Infrastructure (National Strategy) starting in 2010 for all phases. [10]Enhancing Canada’s Critical Infrastructure Resilience to Insider Risk, Public Safety Canada, Public Safety Canada, https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/nhncng-crtcl-nfrstrctr/index-en.aspx [11]Cybersecurity Act 2018, Singapore Statutes Online, https://sso.agc.gov.sg/Acts-Supp/9-2018/ [12]Cybersecurity Act, CSA, https://www.csa.gov.sg/legislation/cybersecurity-act [13]Id. [14]Cybersecurity Act Explanatory Statement, https://www.csa.gov.sg/~/media/csa/cybersecurity_bill/cybersecurity%20act%20-%20explanatory%20statement.pdf [15]Australia’s Cybersecurity Strategy, https://cybersecuritystrategy.homeaffairs.gov.au/ What is the Government doing in cybersecurity, Ministers for the Department of Industry, Innovation and Science, https://www.industry.gov.au/data-and-publications/australias-tech-future/cyber-security/what-is-the-government-doing-in-cyber-security [16]Australia’s International Cyber Engagement Strategy, Department of Foreign Affairs and Trade,https://www.dfat.gov.au/sites/default/files/DFAT%20AICES_AccPDF.pdf [17]Essential Eight Explained, ACSC, https://www.cyber.gov.au/publications/essential-eight-explained [18]Pacific Cybersecurity Operational Network(PaCSON), https://dfat.gov.au/international-relations/themes/cyber-affairs/cyber-cooperation-program/Pages/pacific-cyber-security-operational-network-pacson.aspx Or Strengthening cybersecurity across the Pacific, ACSC, https://www.cyber.gov.au/news/pacific-islands PaCSON is comprised of 15 members, including Australia, Fiji, Marshall Islands, New Zealand, Papua New Guinea, Samoa, and Solomon Islands. [19]Taiwan 5G Action Plan, Executive Yuan,https://www.ey.gov.tw/Page/5A8A0CB5B41DA11E/087b4ed8-8c79-49f2-90c3-6fb22d740488

From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act

From Deregulation to Re-regulation: An Analysis of the 2025 Amendment to Taiwan's Telecommunications Management Act 2025/09/30 As information and communication technologies (ICT) rapidly evolve, global industries have experienced swift iteration and convergence in the past decades. To adapt to this trend and dismantle outdated regulatory restrictions, Taiwan passed the Telecommunications Management Act in 2019[1], replacing the Telecommunications Act[2] of 1996. This move marked a departure from the traditional model of heavily regulating the telecommunications industry as a concession-based business. The new law aimed to promote the launch of innovative services and foster fair market competition. Its fundamental goal was to deregulate, encourage innovation, and establish a more flexible and efficient regulatory framework. However, the 2025 amendment to the Telecommunications Management Act suggests that Taiwan's telecommunications policy is shifting from openness toward a more conservative stance. I. Background: The 2019 Shift to a Registration-Based System The original Telecommunications Act adopted a strict licensing system and vertical regulation, categorizing operators based on whether they owned physical network infrastructure and the specific services they offered. This rigid regime established detailed rules for each business category and imposed heavy penalties on unlicensed operators, stifling the industry's potential for innovation. In response, the 2019 Telecommunications Management Act introduced a horizontal regulation approach, structuring the communications industry into three distinct layers: infrastructure (telecommunications networks), operations (telecommunications services), and content/application. Furthermore, the market entry system was transformed from a licensing model to a registration model. Only service providers needing to interconnect with other operators, apply for radio frequencies, or use telecommunications numbering resources were required to register as "telecommunications enterprises." Providers of other services, like Internet Access Service Providers (IASPs) and Mobile Virtual Network Operators (MVNOs), were not required to register–a policy designed to invigorate the market by encouraging innovation and cross-industry operations. Once registered, however, an enterprise is subject to close supervision by the National Communications Commission (NCC) and must fulfill various legal obligations, including: General Obligations (e.g., retaining communication records). Special Obligations (for specific services, such as providing emergency communications). Designated Obligations (cooperating with national policies like disaster response and assisting with communication surveillance). Given these obligations and a lack of sufficient incentive, IASPs and MVNOs are unlikely to voluntarily register as telecommunications enterprises. II. The 2025 Amendment: Mandating Registration to Combat Fraud Crime The 2025 amendment to Article 5 of the Telecommunications Management Act fundamentally alters this framework. It now mandates that all MVNOs and IASPs register as telecommunications enterprises and fulfill the corresponding obligations. The amended law took effect on July 2, 2025, and existing operators have a one-year grace period to complete their registration. The primary driver for this policy reversal is the national imperative to combat fraud-related crimes. For MVNOs, the rationale is clear. Mobile phone numbers are integral to modern life, functioning as digital identifiers for accessing financial services and engaging in economic activities. To prevent criminals from exploiting anonymous numbers, mandatory registration enables the government to enforce Know Your Customer (KYC) procedures, ensuring the verification of the end-user's identity. For IASPs, the previous voluntary system created ambiguity regarding the total number of operators in the market. The government requires cooperation from IASPs to implement crime-fighting measures, such as restricting access to fraudulent websites under “The Fraud Crime Hazard Prevention Act”[3], or providing “network traffic records” to judicial authorities as required by “The Communication Security and Surveillance Act”[4]. Mandatory registration ensures all IASPs are identifiable and can be called upon to assist in these efforts. III. Challenges and Outlook: The "Tiered Management" Approach Notably, the new law authorizes the NCC to implement "Tiered management", a system that allows for different regulatory requirements based on an operator's revenue, user base, and other factors. This suggests that smaller operators, which may have different risk profiles and a lesser impact on the public interest, could face more relaxed regulations. The NCC is currently drafting the specific standards for this tiered approach. This presents a potential paradox. If the primary goal of mandatory registration is to establish a comprehensive defense against crime, allowing regulatory intensity to vary by company size could create the very loopholes the amendment aims to close. Effectively implementing a framework that is both fair to smaller businesses and robust against criminal exploitation will be a significant test of NCC. References [1]Telecommunications Management Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060111 (last visited Sept. 30, 2025). [2]Telecommunications Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060001 (last visited Sept. 30, 2025). [3]Fraud Crime Hazard Prevention Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=D0080226 (last visited Sept. 30, 2025). [4]The Communication Security and Surveillance Act, Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/ENG/LawClass/LawAll.aspx?pcode=K0060044 (last visited Sept. 30, 2025).

Challenges and Opportunities from Digital Convergence

Preface With the blooming of IT technologies, the term of “digital convergence” represents the whole atmosphere at this moment. “Digital convergence”—means that after telecommunication and broadcasting systems are following the IP based framework, contents and services, those were easy to define, turn to be confused. Relying on the uniform platform, operators are able to provide services to different systems. Services containing VoIP, IPTV or the latest terms of “Multi-screen Ecosystem” and “Connected TV” are all involved in the “digital convergence” notion. Today, no matter the service of “check in” or “watching TV programs on Smartphone,” any figures about multiple services on different devices are presenting the “digital convergence” effect. On the consumer side, “digital convergence” brings a fascinating imagination of life. Time and space are no more limitations to people for getting information. Consumers select services only depending on the quality of each service. However, the fascinating imagination of customers becomes a pressure to the relative industries. In the past, because of distinctive transmission technique, services of television, internet and information were regarded as in different industries. Effective competitors only appeared in the same industry. However, today “digital convergence” effect results in crossing-industries competition and customer immigration. To accommodating and pursue the new trend, only unique ideas and novel services can help incumbents to survive. “Digital convergence” brings not only a challenge but also an opportunity. Today, user-friendly application services are cumulatively created and accommodated in the mature broadband network. For examples, high quality entertainment services occur after communication and multimedia broadcasting techniques are improved, “Near Field Communication” technology rising causes new types of cash flow services. Otherwise, Cloud Computing technique enables people easily to access tele-healthcare services and Telematics services. Certainly, digital convenience accelerating industries transformation and value-added services is now taking place around us. According to ITU reports, every 10% increase of broadband infrastructure extension might cause 0.255 to 1.38% GDP growth rate. High penetration of broadband infrastructure might lead a significant influence on economy growth. Take South Korean experiences as an example, by owing a complete broadband infrastructure, on-line game industry and national digital content industry in this country are individually possessing $8.3 billion and $ 3.4 billion output value. By sensing the potential possibilities, governments in different countries propose their own national industry policies, including American government proposed “National Broadband Plan”, the “Digital Britain White Paper” formulated by United Kingdom, “Hikari no Michi”(光の道, which means fiber superhighway) in Japan and the “Ultra-Broadband Convergence Network Plan (UBcN plan)” in South Korea, moreover, the “Tri-networks Integration Plan” in China. And Taiwan does not absent in this moment. In order to stand firmly in this trend, we also formulate “Digital Convergence Development Program 2010-2015 (DCDP 2010-2012)” in 2010. Below, we are going to make a briefly and neat description of “DCDP 2010-2012”. 1.INTRODUCTION For assisting national relative industries to smoothly transform and enhancing Taiwan’s international competitiveness, Executive Yuan admitted the “Digital Convergence Development Program 2010-2015 (DCDP 2012-2015)” in 2010. In this program, there were six main goals containing: (1) complement the broadband superhighway infrastructure; (2) initiate the convergence of telecommunication services; (3) accelerate the process of Television digitization; (4) develop emerging internet video services; (5) improve communication industries; and (6) establish an integrity regulation framework, as well as twenty-one improving tactics and seventy-eight measures for crossing- administrations cooperation and negotiation to be declared. Otherwise, Executive Yuan also established DCTF to be responsible for coordinating every effort from every administration and facilitate digital convergence tasks. Latter, we will make further descriptions for the six main goals, we just mentioned above: A.Complement the broadband superhighway infrastructure According to the Global Information Technology Report 2010-2011, proposed by World Economic Forum (WEF), Taiwan on the Network Readiness Index (NRI) item was been ranked at 6th place and at 5th place on another item of highest FTTH/FTTB penetration. However, though our coverage of broadband network was high, the total bandwidth was still insufficient to contain all the new creating services. To resolving the shortage of bandwidth, including Ministry of the Interior (MOI), Ministry of Economic Affairs (MOEA), Ministry of Transportation and Communications (MOTC) and National Communications Commission (NCC) were convened to extend the national fiber coverage and facilitate the installation upgrade. Regarding wireless broadband construction, administrations including MOEA, MOTC and NCC were under obligation to energetically detect the latest developments of wireless telecommunication technologies as well as proposed guidelines from other countries, concerning about the allocation of spectrum, telephone numbers and IP address resources. Through crossing-administrations cooperation and coordination, in December 2011, the total of national subscribers applying fiber network service had achieved 3.31 million houses, besides, there were 24.58% houses in Taiwan possessed 100Mbps broadband network services. Totally, there were 7.88 million wireless broadband accounts being applied. B.Initiate the convergence of telecommunication services Smartphone booming brought an emerging mobile entertainment life style, furthermore, it also accelerated the rising of mobile value-added application services. To this trend, administrations containing MOEA, Financial Supervisory Commission (FSC) and NCC all devoted to establishing a constructive environment, with providing assists and building up a complete regulation framework. For examples, up to the end of 2011, national telecommunication operators had signed a memorandum with EasyCard Corporation to develop a mobile cash flow platform, which allows cash flowing through the Internet, for giving people a more convenient experience. C.Accelerate the process of Television digitization Within various emerging application services, “Television digitization” might be the most important one in people’s life. “Television digitization” service brought not only a higher quality experience of watching programs, but also created extra demands of relative application services. Furthermore, increasing demands also bought an improvement to the industry and simultaneously accelerating the development of digital content industry. Nationwide terrestrial TV signal switching program, a fully signal switching from analog to digital, has accomplished in July 2012. In order to achieve 90% coverage rate of digital signal transmission, accommodations containing Council of Indigenous People (CIP) and NCC were not only devoted to establishing a Digitization Improvement Station, but also attempt to integrate all signals from original terrestrial TV stations into one satellite to transmit. To accomplish this signal switching program, government had cultivated for many years and try to increase people’s acceptance level of high definition (HD) TV service. Before receiving this success, NCC had spent a long time devoting itself to integrating containing every effort from many administrations and associations, such as the local governments, national industry associations and operators of household application, moreover, as well as Public Enterprises, including Taiwan Power Company, Chunghwa Post Corporation and Taiwan Water Corporation to popularizing this program. Nevertheless, about the digitization program of cable TV, up to 2010, though there were already 60% of houses in Taiwan possessing cable TV service, only 5.55% of cable TV houses switched into digital. As a result, we found that no incentive measures might be the crucial reason. To reverse the impasse, our strategy was to amend the current laws, through adjusting the regulation framework we could facilitate the market into effective competition. In addition, to accelerate the cable TV digitization process, government also regarded the Olympic relaying in England as a turning point to create the demands of HD TV service. After getting the franchise, people are able to watch Olympic Games through any platforms, including terrestrial TV, cable TV and even IPTV. As the demands arising, it would also encourage operators to produce more HD programs afterward. D.Develop emerging internet video services Digital convergence effect also caused the emerging internet video services booming. In order to encourage the crossing-platforms video services and achieve 50% user rate in 2015, there were three guidelines been proposed. The first one was emerging video service regulation reforming, the second one was facilitating integration between emerging accessing approaches and distribution channels, and the third one, developing a rational regulation on contents management. In synchromesh with terrestrial TV signal switching program, emerging internet video services were also assigned to provide HD Olympic Games programs. In that period, the subscribers of Chunghwa Telecom’s MOD (Multimedia on Demand) service were able to watch the Olympic Games relaying on 14 free HD channels and 1 free 3D channel, which is provided by ELETA TV. Moreover, they could also receive the programs on demand through internet or Smartphone. Afterward, from the collected data, we found that even though the rate of new subscribers only had a few rise, an obviously rose presented on the turning on rate. Depended on those data, we believe that people had already been more familiar with IPTV and HD programs. Besides, this relaying program totally attracted 95 individual advertising and the total revenue from advertising was NT$ 80 million dollars. E.Improve communication industries Producing prolific contents is the key element for attracting customers and stabilizing the development of digital convergence industry. To facilitate the contents producing, DCDP proposed three elements to be improved: fund, talent and marketing. And the tasks of these three elements were including investment facilitation, marketing skill reinforce, personal training as well as culture protection, consumer’s right protection, technique standardization and transnational cooperation. To assist in industries transformation, MOEA focused on promoting the APP design and upgrades. Recently, measures provided by MOEA, such as transformation counseling, R&D subsidies, drive-by VC investment, personal training and even the R&D loan had already taken effect. In addition, to create a virtuous investment circles in contents industry, government also considered to release more subsidies to encouraged those superior producers and movie makers. F.Establishing an integrity regulation framework Digital convergence effect accelerated the competition in the market, including communication or relative contents industries were enter a transformation era. In this period, it was essential to have a practical and integrity regulation framework. Recently, NCC hastened to undertake the amendments of three Acts, containing Radio and Television Act, Cable Radio and Television Act and Satellite Broadcasting Act. Actually, the expectation of this undertaking was to adopt the adjustment of digital convergence in 2014. In addition, Fair Trade Commission (FTC) and Intellectual Property Office (IPO) would also continue to observe the digital convergence influences in 4C (telecommunication, cable television, computer network and e-commerce) and contents (copyright) industries. 2.Second Edition of DCDP and Primly Policies Indicators Advance Since DCDP was launched, it has caused a tremendous response. Nevertheless, rapidly advanced ICT technologies inspire people’s expectations. Recently, it has already overtaken the anticipations of used DCDP. Therefore, to formulate a prescient version, Executive Yuan adopted the second edition of DCDP 2010-2015 in May 2012. In the second edition, an item of “producing prolific TV programs” is added to be the seventh main subjects, in addition, there are five extra items added in the improving tactics part; moreover, the number of measures increased to 107 items. Digital convergence indicators are also reformulated. First, 100Mbps wired broadcasting service should achieve 100% in 2013, and the second, accomplishing 100% digitization of cable TV in 2014. To achieve these indicators, relative administrations decide to accelerate the network infrastructure complementing process and cable TV digitization process. Simultaneously, they also consider extending their regulatory scale from emerging internet video services to the connected TV industries, and enhancing superior programs producing by policy making. In point of accelerating network infrastructure complementing process, a complete broadband network is a foundation of digital convergence industry. However, a “complete” network indicates not only the non-discriminatory access to the hardware, but also mention about having reasonable prices to access broadband services. By considering of Telecommunication operators and cable TV operators are both provides of broadband services, the digitization issue of cable TV industry is also concerned in the DCDP. As a primary enemy to Telecommunication operators in the convergence market, cable TV operators’ competitiveness does not come from the their large share on the cable TV market, but from their possession of wide spread cable network. Otherwise, various new creating contents and application are also encouraged in the DCDP. With “Smart TV,” “HDTV” and “Connected TV” booming, “TV” has transformed from a passive receiving media to an information transport. Although, those emerging broadcasting techniques might threaten the traditional television industry, they bring positive influences to the media industry. By considering a well-run development must building on a integrity and friendly regulation framework. DCTF, an office established by Exclusive Yuan, will also take its responsible to assist NCC on the digital convergence regulatory issues. 3.Conclusion Digital convergence effect to us is a turbulence but also a moment. Today, this effect, which originally comes from the techniques convergence, has detonated in different nations and various places; crossing-industries competition turns to be more and more common around the world. To accommodate our nation to this trend, the primary strategy proposed by government is to integrate administrations’ effort. Through policies making, including DCDP upgrading and validly relative regulation frameworks amending, every relative industry is able to restore enough energy and seize the moment, further, naturally turns to be a domain of market competition.

TOP