How Does Taiwan Respond to Tax Challenges Arising from Digitalization
How Does Taiwan Respond to Tax Challenges Arising from Digitalization
Yuan-Qing, Liao
Attorney and Legal Researcher
2022/3/24
I. The Tax Challenges arising from Digitalization
According to the Ability-to-pay principle, companies need to pay income tax for their income or profit. Nevertheless, in order to avoid their tax obligations, Multinational Corporations (MNCs) have been continuously developing sophisticated and refined tax planning practices to disconnect or mismatch between “where value is created” and “where taxes are paid”, and such practices erode the tax base.[1]
A well-known example of trade model under digitalization of MNCs is that “MNCs do not necessarily have to open domestic physical stores or set up servers, those domestic consumers can purchase goods and services from MNCs directly through the Internet”. This trade model not only breaks the international tax rules “With Permanent Establishment (PE), With taxing power”, but also disconnects or mismatches between “where value is created” and “where taxes are paid” more perfectly. As a result, the taxing power of “where value is created” is eroded. This is a classical type of challenges faced by tax regulators in the age of digitalization of the economy.
In response, The European Commission (EC) and The Organization for Economic Cooperation and Development (OECD) had respectively proposed new plans to ensure that digital business activities are taxed in a fair and friendly way.
(I) The Digital Service Tax proposed by EC[2]
In 2018, EC proposed a temporary tax - Digital Services Tax (DST), which a basic rate of 3% to be imposed on revenues of a digital platform when such platform meets all of the following criteria, including (1) online placement or advertising services, (2) sales of collected user data, (3) facilitate interactions between users, (4) annual worldwide revenues exceeding 750 million euros and (5) taxable revenues within the European Union (EU) exceeding 50 million euros.[3]
Concerning that the DST apparently targeting US MNCs - Google, Amazon, Facebook and Apple (GAFA), the US government once threatened to impose retaliatory tariffs. Insofar, it seems that only a part of MNCs will be immediately affected by DST, but the entire trading systems in the rest of the world will be impacted if the retaliatory tariffs conducted by the US take effect.
(II) The Two-Pillar plan released by OECD[4]
In October 2020, OECD had released Reports on the Pillar One and Pillar Two Blueprints (The Two-Pillar plan), which aimed to terminate the international dispute resulting from DST of EC and provide solutions for tax challenges arising from the digitalization of the economy in the long term.[5]
Pillar One is “Unified Approach”, to ensure the exercise of taxing powers of governments and a fairer distribution of profits among countries where largest MNCs, including digital companies are located at. It would “re-allocate” the taxing powers over MNCs among governments of different jurisdictions. The governments located at the place where MNCs have business activities and earn profits will have the tax powers over those MNCs, even MNCs do not have a physical presence there. Pillar Two is “Global Anti-Base Erosion rules (GloBE)”, tried to protect tax bases of countries through the introduction of “Global Minimum Tax (GMT)” which sets up a minimum corporate income tax rate on MNCs to prevent tax competitions among countries.
Compared with DST proposed by EC, which focuses on the taxing powers of the government that is located at the place where value is created. The Two-Pillar plan focuses more on both re-allocation of international taxing powers and protects the tax base of each country.
(II) The Consensus on The Two-Pillar plan[6]
The Group of Seven (G7[7]), G20[8] and 137 countries and jurisdictions OECD stated not only agreed to remove the DST or the similar measures, but also had a consensus on Two-Pillar plan to reform international taxation rules[9]. In order to ensure that MNCs pay a fair share of tax wherever they operate, as well as to set a GMT rate to protect tax base of each country. Moreover, the new international tax system that the GMT rate is 15%[10] is expected to take effect in 2023 and an estimated 154 domestic MNCs will be thus affected accordingly.
II. The Response of Taiwan to Tax Challenges
A foreign enterprise has to pay Taiwan taxing regulators enterprise income tax for income generated in Taiwan in the premise that this foreign enterprise has a PE in Taiwan. In other words, a PE in Taiwan, which is recognized as the fixed place of business through which the business of an enterprise is wholly or partly carried on[11], is the determinant that affects the power of Taiwan to tax the profits of a foreign enterprise. In brief, “No PE, No taxing power”.
In the era of digitalization, the foreign enterprises can create value through the digital means without establishing a PE in Taiwan. The situation of disconnection or mismatch between where value is created and where taxes are paid not only erodes the taxing power of Taiwan, but also breaks the principle of equality in substantive taxation[12] as mentioned above. As a result, the Ministry of Finance (MOF) adjusted and implemented several new taxation policies or measures, including, inter alia, “Income Taxation on Cross Border Electronic Services[13]” and “Income Basic Tax Act”. These two measures were once considered similarly to DST or GMT individually.
(I) Income Taxation on Cross Border Electronic Services
Responding to tax challenges posed by foreign enterprises under digitalization, the MOF promulgated a new income tax regulation “Income Taxation on Cross Border Electronic Services[14]”, and asked those foreign enterprises who provide cross-border electronic services to purchasers in Taiwan, shall register for business value-added tax (VAT), including register a tax identification number and file taxes. The causation between the electronic services and national economy shall be the determinant to identify income generated in Taiwan:
- The payment made by a purchaser located in Taiwan to a foreign enterprise in order to procure following products or services provided by such foreign enterprise shall be deemed as income generated in Taiwan.
(1) The product that is produced, manufactured, transmitted, downloaded and saved in a digital device and can only be provided with assistance by individuals or enterprises in Taiwan.
(2) The real-time, interactive, handy, and continuing electronic services that are provided through digital means - A foreign enterprise provides a digital platform to conduct transactions, once one of the transaction parties is in Taiwan, the sales amounts shall be recognized as income generated in Taiwan
(II) Income Basic Tax Act (IBT)
To promote domestic economic development and industrial innovation, Taiwan has enacted many laws on tax incentives, mainly tax deductions and credits. However, these laws have been overdeveloped, the implement period has also been excessively extended, which contributes to severely unreasonable tax burden inequality.
Therefore, Taiwan officially introduced Alternative Minimum Tax System (AMT) and promulgated Income Basic Tax Act (IBT)[15] since 2006. As a separate taxation system, AMT is imposed by government that places a floor on the percentage of taxes a certain filer must pay, regardless of how many tax incentives the filer may claim[16]. Hence, in accordance with Article 1 of IBT “[T]he purposes of this Act are to uphold tax equity, to ensure tax revenue for the country, and to establish the basic requirements of profit-seeking enterprises and individuals in regard to their obligation to fulfill their income tax burden as a contribution to public finance.”
AMT uses a different set of rules to determining taxable income compared with the normal tax calculations. Once the regular income-tax amount is higher than the AMT, the taxpayer pays the regular income tax. Thus, if AMT is higher, then the taxpayer pays the AMT. And according to Article 8 (1) of IBT, the enterprise IBT rate is prescribed of 12% since 2013.[17]
However, according to Article 3 (1) (5) of IBT[18], a foreign enterprise without domestic fixed place of business or domestic business agent is not regulated by IBT.
(III) Conclusion
- “Income Taxation on Cross Border Electronic Services (Hereinafter referred to as “the measure”)” asked the foreign enterprises to file income tax. But the elements of “the measure” are different from DST. The reasons may be (1) “This measure” has been designed and promulgated earlier than DST and (2) The DST is essentially more like alternative minimum tax.
- IBT may effect by the concept of “with PE, with taxing power”. Therefore, a foreign enterprise without PE in Taiwan is not regulated by IBT, this means “No PE, No obligation of IBT”. Also, the IBT rate of profit-seeking enterprise is 12%.
III. The Remaining Problems of Tax System in Taiwan
It is foreseeable that with the international consensus on launching the Two-Pillar Plan in 2023, those countries and jurisdictions will start to adjust their tax policies, inclusive of increasing the income tax rate as well as basic tax rate. As long as the issue of "Taiwan companies abusing tax planning to hide wealth aboard and avoid domestic tax obligations" is not solved, this issue will lead to the continuous erosion of Taiwan taxing power.
Concretely, in order to reduce domestic tax burden, several Taiwan companies abusing tax planning to detain profits in foreign affiliated companies or disguise as foreign companies. Though Income Taxation on Cross Border Electronic Services has taking effect, those companies pay income tax only on income generated in Taiwan instead of global income. Therefore, the Controlled Foreign Company Rules and the Place of Effective Management Rules have been proposed.
(I) The Controlled Foreign Company Rules
A controlled foreign corporation (CFC) is a corporate entity that is registered and conducts business in foreign countries or jurisdictions, and is either directly or indirectly controlled by a resident taxpayer.
According to Article 43-3 of the Income Tax Act, if a parent company holds 50% or more of the shares of a foreign subsidiary, or has significant influence on such foreign subsidiary, the subsidiary may be seen as a conduit of the parent company and subject to domestic enterprise income, whether there is dividend distribution to the parent company or not, unless the subsidiary can pass the substantial activity test or its revenue is below a certain threshold.[19]
Yet, the “Paragraph 3”, compared with “Paragraph 4”, is not ruled the “a CFC can deduct the domestic income tax from foreign income tax it paid[20]”, which may result in double taxation.
The Taiwan CFC rules have not come into effect yet. However, according to the ancillary resolution passed by Legislative Yuan[21], our CFC Rules will come into effect within one year after the tax amnesty legislation, "The Management, Utilization, and Taxation of Repatriated Offshore Funds Act", expires. Namely, the Taiwan CFC Rules will finally come into effect in 2022 at the latest.
(II) The Place of Effective Management Rules
The place of effective management (PEM) is defined as a place where key managements and commercial decisions a business entity substantially made.[22] This means, once a foreign company sets and operates a branch in Taiwan, and this branch substantially made key managements and commercial decisions for the foreign company, then it will be deemed as a PEM, the foreign company will also be deemed as a domestic company, and will be subject to tax assessment in accordance with the Taiwan Income Tax Act and other tax regulations.[23]
Following the PEM rules, which is incorporated into Article 43-4 of the Income Tax Act, the elements of PEM including (1) decision making location, (2) record keeping and maintenance location, and (3) actual operating location are all in Taiwan.
However, take foreign experience for example, German practice believes that the PEM rules only need to list "decision making location" as a necessary condition. The rest elements "record keeping and maintenance location" and "actual operating location" are more like reference factors than necessary conditions[24].
The Taiwan PEM rules list all three elements as necessary conditions, which may probably cause excessive restrictions on future applications. And the PEM Rules were announced by the MOF in July 2016, which have yet to take effect neither.
(III) Attachment: The Sophisticated and Conflicting Tax System
The enterprise income tax rate in Taiwan is 20% to 24% in accordance with Article 5 (5) and Article 66-9 (1) of Income Tax Act. Still, to achieve specific policy goals by promoting or suppressing certain behaviors, a policy that oriented tax deductions and credits is called tax incentives, and the disadvantage of which is apparently turn the tax burden into inequality. In the end, to solve the inequality of tax burden resulting from tax incentives and to ensure tax revenue, the minimum tax will be levied by AMT. The AMT rate in Taiwan is 12% as aforementioned.
The implementation of tax incentives and AMT has made the domestic tax system over-complicated. Since the overused tax incentives have abnormally increase the amount of uncompetitive enterprises, who heavily rely on them. While the AMT may strangle the enterprises, who are compliance with economic policies. Then, the interaction and conflicts between tax incentives and AMT not just complicate the domestic tax system, also substantively result in unpredictability and inconsistency of domestic tax environment, which may cause a double-loss situation between tax revenue for the country and economic development policies.
IV. Conclusions and Prospects
(I) Conclusion
- Amend the Income Basic Tax Act and Increase Enterprise Rate to at Least 15%
First, those foreign enterprises without PE but create value in Taiwan are not ruled by IBT. Second, the enterprise IBT rate in Taiwan is now 12%, apparently lower than GMT of 15%. If IBT rate maintains 12% through 2023, the difference between GMT and IBT may be deemed as a harmful tax-based competition. Hence, it is imperative to amend the IBT to rule the foreign enterprises without PE but create value in Taiwan and increase the enterprise IBT rate to at least 15%.
Once consider that GMT is aimed at large MNCs, the IBT may adopt a categorized approach and set different rates based on the size of the enterprise. For instance, increase the IBT rate of MNCs that meet all GMT criteria to 15%, and the rest maintains 12%. - Amend and Take CFC rules and PEM rules into effects
A domestic company pays income tax on global income, while a foreign company with PE in Taiwan pays income tax on income generated in Taiwan. Responding to digitalization, the implement of Income Taxation on Cross Border Electronic Services regulates foreign companies without PE in Taiwan to pay income tax generated in Taiwan fairly.
It is necessary to implement both CFC rules and PEM rules, to prevent domestic companies from abusing tax planning to detain the profit in foreign affiliated companies or to disguise as foreign companies for reducing domestic tax burden, which may continuously eroding taxing power of Taiwan. However, CFC rules and PEM rules still leave some problems to be improved and solved as aforementioned, which is undoubtedly the obligation of Taiwan government.
(II) Prospects
- Substantive Review the Tax Incentives and Reconstruction of Taiwan Tax System
The Reasoning of Interpretation No.565 mentioned that “[W]hile taxpayers should, under the principle of equality in taxation, pay taxes which they are supposed to pay according to their actual taxpaying ability, it is not forbidden by Article 7 of the Constitution to specify, with reasonable cause, differential treatments by way of exceptions or special provisions within the scope of discretion authorized by law to grant taxpayers of a particular class tax benefits in the form of tax reduction or exemption in order to promote the public interest.”.
The principle of ability-to-pay means that those who have greater ability to pay taxes, usually measured by income, wealth and financial capability, should pay more in taxes compared with those who have minor capability. Since taxation is the pecuniary obligation with non-counter performance under public law, the only foundation of legitimacy is the principle of ability-to-pay. Therefore, this is the core principle of the tax law.
To achieve specific policy goals, a policy that oriented tax deductions and credits to promote or suppress certain behaviors is called tax incentives, which can be permitted only in case of justifiable reasons presented. Nevertheless, the weak connection between the policy goals and the tax incentives made the acts, especially the tax incentives, unreasonable.
Additionally, the tax-form expenditure is generally a formal review of fiscal balance, no substantive review of the impact on principle of ability-to-pay taxation and the compensation for it. Under these premises, the excessively extended implementation period of tax incentives has resulting in severely unreasonable tax burden inequality and excessive reliance of uncompetitive enterprises on tax incentives.
To sum up, instead of implement the tax incentives to limit the principle of ability-to-pay, then solve it with AMT. The enactment, amendment and implement of tax laws must strictly abide by above principle. The restriction of above principle must be strictly review and limited as a whole. Namely, it is better to comply with the principle of ability-to-pay strictly. Therefore, it is important to substantively review the domestic tax incentives and reconstruct the domestic tax system. - Ministry of Digital Development and The Tax Reform
Taiwan government is intending to form Ministry of Digital Development (MODD),[25] which is considered as a step toward the right direction to coordinate and expedite the development of Taiwan’s digital economy.
According to Article 1 of the Organizational Act of MODD, "[T]o promote the development of digital industries such as national communications, information, cyber security, network and communication, to undertake digital governance and digital infrastructure, and to assist the digital transformation of public and private sectors, the Executive Yuan has specially established the Ministry of Digital Development."[26]
However, in name of the above-mentioned policies and ideals, which may possibly related to tax policies. Thus, this article considered that, once the MODD is staffed with public servants and experts both proficient in tax law as well as forward-thinking, and given a clear mandate, the MODD may not only contribute significantly to both domestic digital transformation and the tax reform, but also improve the efficiency of tax administration and maximize the overall economic and social benefits.
[1] OECD, 〈BEPS – Base Erosion and Profit Shifting〉, https://cleartax.in/s/beps-oecd (last visited Aug 20, 2021).
[2] 拙著，〈柳暗花明的數位服務稅〉，工商時報名家評論，2021年5月17日，網址：https://view.ctee.com.tw/tax/29375.html，最後瀏覽日：2021年11月24日。
[3] 陳衍任，〈歐洲數位服務稅發展簡析〉，台灣經濟論衡，2020年3月，第18卷第1期，頁58，網址：https://www.ndc.gov.tw/Content_List.aspx?n=1BD4A3B93EF55A5F，最後瀏覽日：2021年4月21日。
[4] 拙著，〈勢在必行的全球企業最低稅負制〉，工商時報名家評論，2021年4月20日，網址：https://view.ctee.com.tw/tax/28814.html，最後瀏覽日：2021年11月24日。
[5] 拙著，〈勢在必行的全球企業最低稅負制〉，工商時報名家評論，2021年4月20日，網址：https://view.ctee.com.tw/tax/28814.html，最後瀏覽日：2021年11月24日。
[6] 拙著，〈取消數位服務稅已為國際趨勢〉，工商時報名家評論，2021年11月23日，網址：https://view.ctee.com.tw/economic/34152.html，最後瀏覽日：2021年11月24日。
[7] Mayer Brown LLP, 〈The G7 Agrees on a Broad Framework for Pillar One and Two〉, June 23, 2021, https://www.mayerbrown.com/en/perspectives-events/publications/2021/06/one-small-step-but-perhaps-one-giant-leap-for-global-tax-reform-the-g7-agrees-on-a-broad-framework-for-pillar-one-and-two (last visited Nov 11, 2021).
[8] G20, 〈G20 ROME LEADERS’ DECLARATION〉, at 11 of 20, https://www.g20.org/wp-content/uploads/2021/10/G20-ROME-LEADERS-DECLARATION.pdf (last visited Nov 11, 2021).
[9] OECD, 〈Mauritania joins the Inclusive Framework on BEPS and participates in the agreement to address the tax challenges arising from the digitalization of the economy〉, https://www.oecd.org/tax/mauritania-joins-the-inclusive-framework-on-beps-and-participates-in-the-agreement-to-address-the-tax-challenges-arising-from-the-digitalisation-of-the-economy.htm (last visited Nov 11, 2021).
[10] Statement on a Two-Pillar Solution to Address the Tax Challenges Arising From the Digitalization of the Economy, at 4 (Aug 2021), available at https://www.oecd.org/tax/beps/statement-on-a-two-pillar-solution-to-address-the-tax-challenges-arising-from-the-digitalisation-of-the-economy-july-2021.pdf (last visited Aug 20, 2021).
[11] Model Tax Convention on Income and on Capital 2010 (Full Version), at c(5)-1 (2010), available at https://read.oecd-ilibrary.org/taxation/model-tax-convention-on-income-and-on-capital-2010_9789264175181-en#page208 (last visited Aug 20, 2021)
[12] 稅捐稽徵法第12條之1第1項：「涉及租稅事項之法律，其解釋應本於租稅法律主義之精神，依各該法律之立法目的，衡酌經濟上之意義及實質課稅之公平原則為之。」亦有釋字第420、460、496、519、597、625及第700號供參。
[13] 資誠，〈法國徵數位服務稅，我不跟進〉，2019年7月24日報導，網址：https://www.pwc.tw/zh/news/media/media-20190724-1.html，最後瀏覽日：2021年4月15日。
[14] 財政部賦稅署，〈外國營利事業跨境銷售電子勞務課徵所得稅制度簡介〉，2018年4月27日，頁1以下，網址：https://www.dot.gov.tw/download/dot_201804270002_1_doc_476，最後瀏覽日：2021年4月21日。
[15] 中華民國94年12月28日總統華總一義字第09400212601號令制定公布全文18條；本條例施行日期除另有規定外，自95年1月1日施行。
[16] 所得基本稅額條例第1條：為維護租稅公平，確保國家稅收，建立營利事業及個人所得稅負擔對國家財政之基本貢獻，特制定本條例。
[17] 財政部台財稅字第10100670710號函：自102年度起營利事業基本稅額之徵收率為12％。
[18] 所得基本稅額條例第3條第1項第5款：營利事業或個人除符合下列各款規定之一者外，應依本條例規定繳納所得稅：五、所得稅法第七十三條第一項規定之非中華民國境內居住之個人或在中華民國境內無固定營業場所及營業代理人之營利事業。
[19] 所得稅法第43條之3第1項：營利事業及其關係人直接或間接持有在中華民國境外低稅負國家或地區之關係企業股份或資本額合計達百分之五十以上或對該關係企業具有重大影響力者，除符合下列各款規定之一者外，營利事業應將該關係企業當年度之盈餘，按其持有該關係企業股份或資本額之比率及持有期間計算，認列投資收益，計入當年度所得額課稅：一、關係企業於所在國家或地區有實質營運活動。二、關係企業當年度盈餘在一定基準以下。但各關係企業當年度盈餘合計數逾一定基準者，仍應計入當年度所得額課稅。
[20] 參考「所得稅法增訂第43條之3建立我國受控外國公司(CFC)課稅依據，係以受控外國公司當年度盈餘，依控制公司對其持有之資本比率按「權益法」認列之國外投資收益。惟查此依權益法認列之投資收益，似漏未規定該關係企業在國外已納所得稅額可予扣抵，恐形成公司階段稅負重複課稅；對照本條第4項規範營利事業於實際獲配股利或盈餘時，國外已納所得稅額得予扣抵之規定，其疏漏自明。」立法院，〈受控外國公司課稅新制相關問題評析〉，110年8月，網址：https://www.ly.gov.tw/Pages/Detail.aspx?nodeid=6590&pid=210513，最後瀏覽日：2021年10月25日。
[21] 境外資金匯回管理運用及課稅條例自2019年8月15日起施行，施行期間2年，已於今（2021）年8月14日失效，故我國CFC制度至遲於明（2022）年8月14日前報請行政院核定施行日期。參考「另附帶決議針對105年增訂之「所得稅法」第43條之3條文（營利事業CFC制度），與106年增訂之「所得基本稅額條例」第12條之1條文（個人CFC制度），要求財政部於本案施行期滿後1年內報請行政院核定施行日期，有助落實反避稅條款。」立法院，〈制定境外資金匯回管理運用及課稅條例〉，
網址：https://www.ly.gov.tw/Pages/Detail.aspx?nodeid=33324&pid=184215，最後瀏覽日：2021年8月20日。
[22] OECD, 〈THE IMPACT OF THE COMMUNICATIONS REVOLUTION ON THE APPLICATION OF “PLACE OF EFFECTIVE MANAGEMENT”AS A TIE BREAKER RULE〉, at 4 (Feb 2001), https://www.oecd.org/ctp/treaties/1923328.pdf (last visited Aug 20, 2021).
[23] 所得稅法第43條之4第1項：依外國法律設立，實際管理處所在中華民國境內之營利事業，應視為總機構在中華民國境內之營利事業，依本法及其他相關法律規定課徵營利事業所得稅；有違反時，並適用本法及其他相關法律規定。
[24] 參考「從德國的經驗回頭看台灣可以發現：台灣雖然立意良善地將「決策者或決策地」、「帳簿及會議紀錄的製作或儲存地」，以及「實際執行主要經營活動地」，「同時」列為PEM的認定標準。然而，其中只有「決策者或決策地」確實屬於PEM認定上的必要條件；至於將「財務報表、會計帳簿紀錄、董事會議事錄或股東會議事錄的製作或儲存處所」及「實際執行主要經營活動地」也列為PEM的認定標準，恐怕就值得商榷。因為上述兩項標準，固然可以作為認定企業的PEM是否在台灣境內的「參考因素」，但卻不適合作為認定企業的PEM在台灣境內的『必要條件』」。陳衍任，〈實際管理處所在適用上的爭議問題〉，月旦會計實務研究，2018年3月，頁29以下。
[25] 2021 Taiwan White Paper Overview, 〈Facing New and Existing Challenges Head On〉, at WP7 (2021), https://amcham.com.tw/wp-content/uploads/2021/06/June-2021-Taiwan-Business-TOPICS.pdf (last visited Aug 20, 2021).
[26] 作者自譯。
- BEPS – Base Erosion and Profit Shifting
- 柳暗花明的數位服務稅
- 歐洲數位服務稅發展簡析
- 勢在必行的全球企業最低稅負制
- 取消數位服務稅已為國際趨勢
- The G7 Agrees on a Broad Framework for Pillar One and Two
- Mauritania joins the Inclusive Framework on BEPS and participates in the agreement to address the tax challenges arising from the digitalization of the economy
- Model Tax Convention on Income and on Capital 2010
- 法國徵數位服務稅，我不跟進
- 外國營利事業跨境銷售電子勞務課徵所得稅制度簡介
- 受控外國公司課稅新制相關問題評析
- 制定境外資金匯回管理運用及課稅條例
In recent years, because of the uncertainty of the positing of virtual currency under law, the issues of transparency and security etc. arising out in connection therewith are emerging, and the incidents of money-laundering, terrorist attack and investor fraud involving therewith lead to concerns of various countries. Therefore, the new change in Japanese legislations relating to virtual currency exchange service providers falls mainly in the effect of amended contents of “Payment Services Act” and “Act on Prevention of Transfer of Criminal Proceeds”. The reasons for amendment to the legislations are such that virtual currency transaction involves the exchange with statutory currency, and is the outlet/ inlet of the existing financial system; therefore it is necessary to have the virtual currency exchange service providers be supervised[1]. Essential points involving the amendments are stated as follows: 1. Payment Services Act The keys to the amendment to Payment Services Act (hereinafter referred to as the “Act”) are the Act recognizes that virtual currency has the nature of property and inputs the registration system for the exchange service providers, and provides relevant supervisory regulations. (1) Definition of virtual currency As defined in items 1 and 2 of Paragraph 5 of Article 2 of the amended Payment Services Act, virtual currency can be divided into two kinds, but is limited to that which is recorded on an electronic device or any other object by electronic means, and excludes the domestic (Japanese) currency, foreign currency and currency-denominated assets[2]. ① It has 3 elements as follows: It can be used in relation to unspecified persons for the purpose of payment consideration for the purchase or leasing of goods or the receipt of provision of services. It can be purchased from and sold to unspecified persons. Its property value can be transferred by means of an electronic data processing system. ② Its property value can be mutually exchanged with other virtual currency and can be transferred by means of an electronic data processing system. In addition, some authors[3] consider that virtual currency is equivalent to the use of blockchain technology. However, according to the definition after the amendment to laws in Japan, the definition of virtual currency is based the judgment of the above elements rather than the use of blockchain technology. (2) Input of registration system for virtual currency exchange service providers Pursuant to Paragraph 7 of Article 2 of the Payment Services Act, “Exchange Service” is defined as the operation of exchange, agency or management activities. No person may engage in the virtual currency exchange service unless the person is registered[4] with the competent authority (Article 63-2 of the Act). A person who has conducted the virtual currency exchange service without obtaining the registration is subject to imprisonment for not more than three years or a fine of not more than three million yen or both based on Subparagraphs 2, 5 of Article 107 of the Act. (3) Mechanism of users protection: The purpose of the amendment is to take countermeasures for the risks generated from virtual currency exchange, such as pecuniary loss caused by insufficient information, the loss incurred in the custody of users’ property, and disclosure of personal information of users）[5]. Discussions are divided into 4 points. ① Information security management A virtual currency exchange service provider must take necessary measures for information security management (Article 63-8 of the Act) ② Measures for users protection A virtual currency exchange service provider must take relevant protective measures for users, including the provision of explanation for misunderstood transaction and information about contents of transaction (Article 63-10 of the Act) ③ Separate management of property A virtual currency exchange service provider must manage its own property separately from the money or virtual currency of the users, and must retain a certified public accountant or an audit corporation to periodically conduct the external financial audit (Article 63-11 of the Act) ④ Designated Dispute Resolution Organization Referring to financial ADR system, the complaint or dispute matter of users shall be concluded by the Designated Dispute Resolution Organization (Article 63-12 of the Act) (4) Supervision over virtual currency exchange service providers: As regulated by Articles 63-13 ~ 63-20 of the new Payment Services Act, essential contents of supervisory requirements for virtual currency exchange service providers are stated below: ①The obligation to prepare and maintain books and documents ②Annual financial reports ③The authority of the Prime Minister to inspect relevant business ④The Prime Minister orders a virtual exchange service provider to conduct business improvement. ⑤The Prime Minister may revoke the registration of a virtual currency exchange service provider who has obtained the registration through illegal or wrongful means. (5) Penalty for violation of obligations The existing penalties under articles 107~109 and articles 112~117 of the Payment Services Act also apply to virtual currency exchange service providers. The causes of violation of obligations and corresponding penalties are summarized as follows: ① Any person who has not obtained registration or has obtained registration through wrongful means or by use of other’s name is subject to imprisonment for not more than three years or a fine of not more than three million yen, or both (Article 107 of the Act) ② An exchange service provider who has violated the separate management of property or has violated the disposition of suspension of operation is subject to imprisonment for not more than two years or a fine of not more than three million yen, or both (Article 108 of the Act). ③ Any person who has failed to prepare or has falsely prepared books, reports, attachment and documents or has refused to answer the questions or has refused to accept or has hindered the business inspection is subject to imprisonment for not more than one years or a fine of not more than three million yen, or both (Article 109 of the Act) ④ A person who fails to take necessary measure for improving its operation is subject to a fine of not more than one million yen. 2. Act on Prevention of Transfer of Criminal Proceeds In order to prevent from money-laundering, the legitimacy of fund sources must be assured. The amended “Act on Prevention of Transfer of Criminal Proceeds” (hereinafter referred to as the “Act”) incorporates the virtual currency exchange service providers as “specified business operators” and imposes them with the following main obligations: (1) The obligation to confirm user identification (Article 4 of the Act) (2) The obligation to confirm and preserve transaction records (Articles 6 & 7 of the Act) (3) The obligation to report suspicious transactions (Article 11 of the Act) The above are major contents of the amendments to legislations in relation to virtual currency exchange service providers in Japan. The purposes of the amendment are to promote the innovation of virtual currency operators and the balanced development with consumer protection. Therefore, they are included in the Payment Services Act and are subject to similar supervision as with electronic bill and Funds Transfer Service[6]. The reorganization of virtual currency system in Japan has stepped forward. However, the application of actual operation needs continual follow-up and observation, so as to be used as reference for the relevant law system of our country. [1]Financial System Council, The Working Group on Payments and Transaction Banking of the Financial System Council, P27. [2]Currency-Denominated Assets, Assets denominated in currency refers to the “Currency-Denominated Assets” in Japanese and defined in the Payment Services Act: as used in this Act means assets which are denominated in the Japanese currency or a foreign currency, or for which performance of obligations, refund, or anything equivalent thereto (hereinafter referred to as "performance of obligations, etc." in this paragraph) is supposed to be made in the Japanese currency or a foreign currency. In this case, assets for which performance of obligations, etc. is supposed to be made by means of Currency-Denominated Assets are deemed to be Currency-Denominated Assets. [3] ＜Improvement System of Virtual Currency＞, Daiwa Institute of Research, see website:, http://www.dir.co.jp/research/report/law-research/financial/20160520_010904.pdf#search=%27%E4%BB%AE%E6%83%B3%E9%80%9A%E8%B2%A8+%E8%B3%87%E9%87%91%E6%B1%BA%E6%B8%88%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E6%B3%95%E5%BE%8B+%E3%83%96%E3%83%AD%E3%83%83%E3%82%AF%E3%83%81%E3%82%A7%E3%83%BC%E3%83%B3%27 (Ｌast browse date: 12/07/2017) [4]Article 63-2 of the Payment Service Act provides the registration with the Prime Minister; however, in practical operation, the operators shall apply for registration with the local financial bureau. [5]Financial System Council, The Working Group on Payments and Transaction Banking of the Financial System Council, P29. [6]In the Payment Services Act of Japan, it is specified that the remittance business engaged by a non-banking provider was officially named as “Funds Transfer Service”, in which business contents aim at the third payment works. Financial Research Development Funds Management Committee, “Study of the industrial development and management between international non-financial institution payment services”, written by Kuo Chen-Chung and Hsu Shih-Chin, pp60~61(2015).
A Brief Introduction to Taiwan’s Legislations to Promote Industrial Innovations of the Digital EconomyA Brief Introduction to Taiwan’s Legislations to Promote Industrial Innovations of the Digital Economy 2023/05/15 I. Background To encourage the development of digital industries in communications, information, cybersecurity, networking and communication, to centralize digital governance and digital infrastructure development and to assist in digital transformation of public and private sectors in Taiwan, the Ministry of Digital Affairs (“the MODA”) was created on August 27, 2022 to spearhead the national digital development policy, communications and digital resources; the development of digital technology use cases and the environment for innovations and talents; policies and regulations governing digital economy industries, national cybersecurity, the government’s digital services, open data and data governance, digital infrastructure, international exchange and cooperation and competence standards for the government’s professional personnel in IT and informational security. The Administration for Digital Industries (ADI) and the Administration for Cyber Security (ACS) have been established as the MODA’s subordinate agencies, to address challenges on all fronts in the digital wave. As the central competent authority on the industrial development of the digital economy, the MODA may subsidize, incentify or support innovative activities of digital economy industries in accordance with Paragraph 1, Article 9 of the Statute for Industrial Innovation and determine relevant matters in accordance with Paragraph 2 of the same article. Hence, the MODA promulgated the Subsidy, Reward and Assistance Regulations for Promoting Industry Innovation (“the Regulations”) on December 23, 2022, to encourage innovation and R&D on software, services, integration and application in telecommunications, information, cybersecurity, networking, and communication. The purpose is to enhance the industry environment and to boost the industry competitiveness. These Regulations serve as the MODA’s flagship efforts in promotion of industrial innovations and highlights Taiwan’s emphasis on digital economy industries. Below is a summary of the Regulations. II. Scope As stated in the overview described in Article 2, the Regulations aim to assist in the development of software products, digital services and infrastructure, system integration and vertical use cases in telecommunications, information, cybersecurity, networking and communication, so as to encourage innovations in digital economy industries such as ecommerce, digital contents, new types of digital services, communications and network deployment, to improve the industry environment and enhance the industry competitiveness. In sum, the “digital economy industries” mentioned in the Regulations refer to software, digital services or digital infrastructure sectors in telecommunications, information, cybersecurity, networking and communication. III. Policy measures According to Paragraph 1, Article 3 of the Regulations, the MODA or its subordinate agencies may provide subsidies, rewards and assistance to the activities in digital economy industries such as promotion of innovation or R&D, supply of technologies and support in upgrade. This may involve the encouragement of creation of innovation of R&D centers by companies; assistance to establishment of innovation or R&D institutions; fostering of cooperation among industries, academia and research organizations; promotion of corporate engagement in talent development at schools and development of human resources in industries; support to innovations by local industries; advocacy of corporate use of big data and the government’s open data; enhancement of communications network resilience and network infrastructure prevalence and other relevant matters. Moreover, the Regulations provide details of the policy measures for subsidies, rewards and support as follows: 1. Subsidies The relevant details are provided from Article 4 to Article 17 of the Regulations. (1) Eligibility According to Paragraph 1, Article 4 of the Regulations, subsidy recipients in principle shall be engaged in activities of digital economy industries, shall be either a sole proprietorship, partnership, limited partnership, or corporation registered in accordance with domestic laws or a natural person who is national of the R.O.C., a natural person from Hong Kong or Macau or a foreign national with permanent residency and has never been listed as a refusal account by any bank. Flexibility can be granted in accordance with Paragraph 2 of the same article. If required for the development of digital economy industries, the MODA or its subordinate agencies may establish separate eligibility criteria for subsidy recipients. However, such eligibility criteria only take effect via public announcement and publication on the Executive Yuan Gazette. Finally, according to Article 13 of the Regulations, no subsidy application may be submitted in event of violation of laws related to environmental protection, labor safety and health or food safety and hygiene during the most recent three years, as determined to be serious by central competent authority. (2) Subsidy limits According to Article 5 of the Regulations, different programs come with different ceilings measured in percentage. In principle, the subsidized amount shall not exceed 50% of the program budget if it is for promotion of industry innovation or R&D or encouragement of corporate use of big data and the government’s open data to develop and innovate commercial applications or service models. However, this does not apply to specific policy considerations or subsidy schemes above the budget and approved by the MODA or its subordinate agencies. For example, the subsidized amount shall not exceed 50% of the course fees for corporate engagement in talent development on campus or enhancement of talent resources for industries. However, this limit does not apply to subsidies to indigenous people, persons with disabilities, low-income households, or the special circumstances approved by the MODA or its subordinate agencies. Support schemes such as assistance to industrial technology and upgrade; encouragement of creation of innovation of R&D centers by companies; assistance to establishment of innovation or R&D institutions; fostering of cooperation among industries, academia and research organizations; support to innovations by local industries; enhancement of communications network resilience and network infrastructure prevalence and other projects shall be announced by the MODA or its subordinate agencies and published on the Executive Yuan Gazette. (3) Subsidy programs According to Articles 6 of the Regulations, there are no specific restrictions on subsidy categories, with two exceptions: (1) promotion of industry innovation or R&D – Subsidies are limited to six categories, i.e., innovation or R&D personnel expenses for approved projects; costs for consumables and raw materials; access and maintenance expenses for innovative or R&D equipment; introduction of intangible assets; commissioning and verification fees of research; and travel expenses. (2) advocacy of corporate use of big data and the government’s open data to develop and innovate commercial applications or service models or enhancement of communications network resilience and network infrastructure prevalence - Subsidies are limited to three categories, i.e., fees for commissioned services; training & education fees; and promotional campaign expenses. (4) Application submission According to Article 7 of the Regulations, an applicant should submit the application form, the project plan and relevant data to the MODA or its subordinate agencies. If the contents of the project plan or documents fail to meet requirements, the MODA or its subordinate agencies may request missing materials before a deadline of up to one month. The MODA or its subordinate agencies may not accept applications without missing materials supplied before deadlines. (5) Acceptance and review According to Article 8 of the Regulations, the MODA or its subordinate agencies shall convene review meetings to review applications, changes and irregularities in the execution of subsidy programs. Applicants may be asked to provide explanations or Personnel may be sent to conduct on-site inspections. If necessary, relevant authorities or institutions may be commissioned assist in financial reviews. Additionally, according to Article 9 of the Regulations, the period from document readiness by an applicant to notification of the completed review to the applicant may not exceed three months. This may be extended by one month if necessary. Finally, according to Article 17 of the Regulations, subsidized projects, subsidy recipients, approval dates, subsidized amounts (including cumulative amounts) and relevant information shall be announced on the websites of the MODA or its subordinate agencies each quarterly unless the disclosure should be restricted or is not provided according to Article 18 of the Freedom of Government Information Law. (6) Contract signing Once reviewed and approved, the applicant must sign the subsidy contract with the MODA or its subordinate agencies within the time period specified by Article 10 of the Regulations. Unless extension has been agreed by the MODA or its subordinate agencies, the approval of the application loses validity if a contract is not signed before the deadline. (7) Matters of adherence by subsidy recipients Once the subsidy contract has been signed, an applicant becomes a subsidy recipient under the Regulations and must abide by relevant terms and conditions. First, the recipient shall establish a separate account for subsidy funds and maintain a separate account book, according to Article 11 of the Regulations. All of the interest generated from the subsidy account and any balance remaining after the project completion shall be fully returned to the national treasury via the MODA or its subordinate agencies. Meanwhile, to examine whether there are any duplications of application, the use of subsidy funds and the effectiveness of project implementation, the MODA or its subordinate agencies may dispatch personnel or commission a fair and just organization to inspect the relevant documents, account books and status of project execution. The subsidy recipient shall not refuse such an examination, is obligated to respond and shall submit work reports and details about the use of funds by following the agreed-upon schedule. In event of breach, the disbursement of subsequent funds may be suspended, under the terms and conditions of the subsidy contract. Second, according to Article 12 of the Regulations, if a recipient fails to execute the subsidized project as planned or the project experiences a significant delay in progress, or there is an overly large gap between the project results and the business plan, or the project fails to pass the review, inspection or acceptance by the MODA or its subordinate agencies and no improvement has been made before the specified deadline, or there is a breach of the Regulations Governing Procurements for Scientific and Technological Research and Development if the subsidized amount exceeds 50% of the recipient’s procurement and it meets the threshold for public announcements under the Government Procurement Act, the MODA or its subordinate agencies may suspend the next disbursement in accordance with the terms and conditions of the subsidy contract, claw back the disbursed subsidy and even stop any subsidy to the recipient for one to five years, depending on the severity of the circumstances. Third, according to Article 14 of the Regulations, the MODA or its subordinate agencies must conduct a comprehensive assessment of effectiveness of subsidized projects and the recipient shall cooperate by providing data required for the assessment. Fourth, according to Article 16 of the Regulations and unless otherwise specified by laws, if the subsidized amount exceeds 50% of the total budget for a technology project, the ownership and utilization of R&D results shall comply with the Government Scientific and Technological Research and Development Results Ownership and Utilization Regulation. In event of breach by the recipient violates, the MODA or its subordinate agencies may terminate the subsidy contract and shall refuse to accept any subsidy application from the recipient for five years from the date of completion of the innovation or R&D. If the reason is attributable to the recipient, the subsidy contract shall be canceled and the subsidies shall be refunded. (8) Subsidy applications According to Article 17 of the Regulations, a subsidy applicant shall declare to the MODA or its subordinate agencies the following: 1) No significant default in the execution of any government-sponsored science and technology projects during the past five years. 2) No suspension currently in force as a result of disciplinary actions in relation to execution of a government-sponsored science and technology project. 3) No tax incentives, rewards or subsidies for the same matter under other laws granted to the same subsidized project. 4) No taxes owed during the past three years. However, individuals who apply for the subsidy under Subparagraph 5 or 6, Paragraph 1, Article 3 are exempted. 5) No violation of laws related to environmental protection, labor safety and health or food safety and hygiene or the People with Disabilities Rights Protection Act during the most recent three years, as determined to be serious by central competent authority. However, this does not apply to circumstances that occurred prior to the enforcement of the Statute. If the applicant refuses to declare the above, the MODA or its subordinate agencies may not accept the application. If any false statement is identified, the application may be rejected, or the subsidy may be withdrawn, the contract may be canceled and the disbursed funds shall be returned. 2. Rewards According to Paragraph 1 of Article 18 of the Regulations, the MODA or its subordinate agencies will announce reward programs for digital economy industries with details on recipients, eligibility criteria, evaluation standards, application procedures, approving agencies and other related matters. Moreover, reward applications are not accepted according to Paragraph 2 of Article 18 and the provisions of Article 13 and Article 15 shall apply mutatis mutandis. Article 17 regarding announcement of government information on subsidy applications shall also apply to reward applications. 3. Assistance Relevant rules are primarily prescribed from Article 19 to Article 21 of the Regulations. (1) Eligibility According to Paragraph 1 of Article 19 of the Regulations, the rules prescribed in Subparagraph 1, Paragraph 1 of Article 4 also apply to the eligibility criteria for assistance to digital economy industries. In other words, assistance recipients in principle shall engage in activities of digital economy industries, either a sole proprietorship, partnership, limited partnership, or corporation registered in accordance with domestic laws or a natural person who is national of the R.O.C., a natural person from Hong Kong or Macau or a foreign national with permanent residency and has never been listed as a refusal account by any bank. Flexibility can be granted outside the aforesaid limitations and in accordance with Paragraph 2 of Article 19. If required for the development of digital economy industries, the MODA or its subordinate agencies may establish separate eligibility criteria for assistance recipients via public announcement and publication on the Executive Yuan Gazette. (2) Oversight of commissioned organizations According to Article 20 of the Regulations, the MODA or its subordinate agencies may evaluate and assess the effectiveness of the assistance services provided by the commissioned organization(s) for recipients as an important basis for reviewing assistance projects. (3) Establishment of a single contact window The assistance unit may establish a single contact window to provide assistance and counseling services, according to Article 21 of the Regulations. 4. General provisions In addition to specific rules, the general provisions prescribed from Article 22 to Article 25 shall apply to subsidies, rewards or assistance provided by the MODA and its subordinate agencies. First, all the funds required for policy measures shall come from the budgets allocated by the MODA or its subordinate agencies, according to Article 25 of the Regulations. Second, the MODA or its subordinate agencies may commission a legal person or a group to handle the application acceptance, review, approval, inspection, subsidy disbursement and claw-back, rewards, assistance and other relevant matters, according to Article 22 of the Regulations. Furthermore, according to Article 23 of the Regulations, the incoming and outgoing of funds for subsidy, reward and assistance projects are managed as follows: 1) The same project applying for subsidies with two or more organizations should list the details of all expenses and the breakdowns and amounts of subsidies, rewards and assistance under application with each government agency. The subsidy, reward and assistance program shall be canceled and the disbursed funds shall be returned in event of concealment or false statements. 2) If the review by each government agency on the use of funds identifies poor results, utilization not consistent with the subsidy purposes, or inflated or dishonest numbers, the subsidy, reward or assistance recipient shall return the disbursed funds. Meanwhile, no subsidy shall be granted to the subsidy, reward or assistance recipient in question for one to five years, depending on the severity of circumstances. 3) If procurement is involved in the subsidy, reward or assistance budget, the subsidy, reward or assistance recipient shall adhere to the Government Procurement Act. 4) When reporting on expenses, the subsidy, reward or assistance recipient shall enumerate in detail the utilization of expenditures and the total amount of spendings. The same project subsidized by two or more organizations shall list the actual sum of subsidies, rewards and assistance. Finally, according to Article 24 of the Regulations, the approval, disbursement and reimbursement of subsidies, rewards and assistance are processed as follows: 1) Disbursement based on project progress: The number of instalments, the method, the amount (percentage) are specified in the contract by the MODA or its subordinate agencies, depending on the project and the timetable. 2) Reimbursement shall be based on the Management Guidelines for the Disposal of Government Expenditure Vouchers, the Matters of Attention Regarding Budget (Donation) Implementations by Central Government Agencies for Private Groups and Individuals and relevant contractual provisions. IV. Conclusions To accelerate the innovation and development of digital economy industries in Taiwan, the MODA has promogulated the Subsidy, Reward and Assistance Regulations for Promoting Industry Innovation in accordance with Paragraph 1, Article 9 of the Statute for Industrial Innovation. It is hoped that the subsidies, rewards and assistance provided by the MODA helps to enhance the competitiveness of digital economy industries and the effectiveness of the digital economy development in addition to the Statute. The Regulations set out detailed rules on policy measures e.g., subsidies, rewards, and assistance. Key matters such as eligible recipients, application procedures, review mechanisms, responsibilities and obligations are clearly defined but certain flexibility is reserved by exceptions. A contract-centric approach provides manoeuvrability in practice specific to project circumstances. It is hoped that the MODA and its subordinate agencies can utilize these Regulations once in force, to enhance the business environment of the digital economy industries and continue to drive industry innovations.
Research on Possible Artificial Intelligence Usage in Criminal Activities in Recent Years (2017-2018)Artificial Intelligence has become a worldwide center topic that attracts lots of attention in recent years. Most topics emphasize on the application of this technology and its implication to the economic of human society. Fewer emphasize on the more technical part behind this technology. Mostly the society of human emphasizes on the bright side of this technology. However, seldom do people talk about the possible criminal usage that exploits this technology. The dark side easily slips one’s mind when one is immersed in the joy of the light. And this is the goal of this paper to reveal some of this possible danger to the public, nowadays or in the future, to the readers. I. What A.I. IS HERE: a brief history First we will start by defining what we mean when referring to “Artificial Intelligence” in this paper. First of all, the so-called “Artificial Intelligence” nowadays mainly refers to the “Deep Learning” algorithm invented by a group of computer scientists around 1980s, among which Geoffrey Everest Hinton is arguably the most well-known contributor. It is a kind of neural network that resembles the information processing and refinement in human brain, neurons and synapses. However, the word A.I. , in its natural sense, contains more than just “Deep Learning” algorithm. Tracing back to 1950s, by the time when the computer was first introduced to the world, there already existed several kinds of neural networks. These neural networks aims to bestow the machines the ability to classify, categorize a set of data. That is to give the machine the ability to make human-like reasoning to predict or to make induction concerning the attribute of a set of data. Perceptron, as easy as it seems, was arguably the first spark of neural network. It resembled the route of coppers and wires in your calculator. However, due to its innate inability to solve problems like X-OR problem, soon it lost its appealing to the computer scientists. Scientists then turned their attention to a more mathematical way such as machine learning or statistics. It wasn’t until 1980s and 2000s that the invention of deep learning and the advance of computing speed fostered the shift of the attention of the data scientist back to neural networks. However, the knowledge of machine learning still hold a very large share in the area of artificial intelligence nowadays. In this sense, A.I. actually is but a illusive program or algorithm that resides in any kinds of physical hardware such as computer. And it comprises of deep learning, neural network and machine learning, as well as other types of intelligence system. In short, A.I. is a software that is not physical unless it is embedded in physical hardware. Just like human brain, when the brain of human is damaged, we cannot make sound judgement. More worse, we might make harmful judgement that will jeopardize the society. Imagine a 70-year-old driving a car and he or she accidentally took the accelerator for the break and run into crowds. Also like human brain, when a child was taught to misbehave, he, when grown up, might duplicate his experience taught in his childhood. So is A.I.. As a machine, it can be turned into tools that facilitate our daily works, weapons that defend our land, and also tools that can be molded for criminal activities. II. Types of Criminal Activities Concerning Possible Artificial Intelligence Usage: 1. Smart Virus Probably the first thing that comes into minds is the development of smart virus that can mutate its innate binary codes so as to slip present antivirus software detection according to its past failure experience. In this case, smart virus can gather every information concerning the combination of “failure/success of intrusion” and “the sequence of its innate codes” and figure out a way to mutate its codes. Every time it fails to attack a system, it might get smarter next time. Under the massive data fathered across the world wide internet, it might have the potential to grow into an uncontrollable smart virus. According to a report written in Harvard Business Review [1], such smart virus can be an automatic life form which might have the potential to cause world wide catastrophe and should not be overlooked. However, ironically, it seems that the only way to defend our system from this kind of smart virus is to deploy the smart detector which consists of the same algorithm as the smart virus does. Once a security system is breached, any possible kinds of personal information is obtainable. The devastating outcome is a self-proved chain reaction. 2. Face Cheating An another possible kind of criminal activity concerning the usage of artificial intelligence is the face cheating. Face Lock has been widely-used nowadays, ranging from smart phones to personal computers. There is an increase in the usage of face lock due to its convenience and presumably hard-to-cheat technology. The most widely-used neural network in this technology is the famous Convolution Neural Network. It is a kind of neural network that mimics the human vision system and retina by using max-pooling algorithm. However there are still other types of neural networks capable of the same job such as Hinton Capsule, etc.. According to a paper by Google Brain [2], “adversarial examples based on perceptible but class-preserving perturbations can fool this multiple machine learning models also fool time-limited humans. But it cannot fool time-unlimited humans. So a machine learning models are vulnerable to adversarial examples: small changes to images can cause computer vision models to make mistakes such as identifying a school bus as an ostrich.” Since the face detection system is sensitive to small perturbation in object-recognition. It might seem hard to cheat a face detection system with another similar yet different face. However, just like the case in the smart virus, what makes artificial intelligence so formidable is not its ability to achieve high precision at the first try, but its ability to learn, refine, progress and evolve through numerous failure it tasted. Every failure will only make it smarter. Just like a smart virus, a cheater neural network might also adjust its original synapse and record the combination of “failure/success of intrusion” and “the mixture of the matrix of its innate synapse” and adjust the synapses to transform a fault face into a authentic face to cheat a face detection system, possibly making the targeted personal account widely available to all public faces through face perturbation and transformation. A cheater neural network might also tunes its neurons in order to fit into the target face to cheat the face detection system. 3. Voice Cheating An another possible kind of criminal activity concerning the usage of artificial intelligence is the voice cheating. Just like Face Cheating, when a system is designed to be logged in by the authentic voice of the user, the same system can be fooled using similar voice that was generated using Artificial Intelligence. 4. Patrol Prediction There is quite an unleash in the area of crime prediction using Artificial Intelligence. According to a paper in European Police Science and Research Bulletin [3], “Spatial and temporal methods appear as a very good opportunity to model criminal acts. Common sense reasoning about time and space is fundamental to understand crime activities and to predict some new occurrences. The principle is to take advantage of the past acknowledgment to understand the present and explore the future.” In this sense, the police is able to track down possible criminal activities by predicting the possible location, time and methods of criminal activities by using Artificial Intelligence, lengthening the time of pre-action and saving the cost of unnecessary human labor. Yet the same goes for criminal activities. The criminals is also able to track down the timing, location, and length of every patrol that the police makes. The criminal might be able to avoid certain route in order to achieve illegal deals or other types of criminal activities. Since fewer criminals use A.I. as a counter-weapon to the police, the detection system of the policy will not easily spot this outliers in criminal activities, making these criminal activities even more prone to success. If this kind of dark technology is combined with other types of modern technology such as Drone Navigation or Drone Delivery, the perpetrators might be able to sort out a safe route to complete drug deals by using Artificial Intelligence and Drone Navigation. III. A.I. Cyber Crimes and Criminal Law: Who should be responsible? What comes out from the law goes back to the law. With these kinds of possible threats in the present days or in the future. There is foreseeably new kinds of intelligent criminal activities in the near future. What can Law react to these potential threats? Is the present law able to tackle these new problems with present legal analysis? The question requires some research. After the Rinascimento in Europe in 17th century, it is almost certain that a civilian has its own will and should be held liable for what he did. The goal of the law to make sure this happens since a civilian has its own mind. Through punishment, the law was presumed to guarantee that a outlier can be corrected by the enforcement of the law, which is exactly the same way in which a human engineer trains a artificial intelligence system. However, when 21th century arrives, a new question also appear. That is, can Artificial Intelligence be legally classified as subject that have mental requirement in the law, rather than just more object or tools that was manipulated by the perpetrators? This question is philosophical and can be traced back to 1950s when a Turing Test was proposed by the famous English computer scientist Alan Turing. Some scholars proposed there could co-exist three kinds of liability. That is, solely human liability, joint human and A.I. entity liability, and solely A.I. entity liability ([4], p.95). The main criterion for these three classes is that whether a human engineer or practitioner is able to foresee the outcome of this damage. When a damage attributable to the A.I. system cannot be foreseen by human engineer, it might be solely A.I. entity liability. Under this point of view, the present criminal system is self-content to deal with A.I. entity crimes, for all we need to do is to view an A.I. system as a car or a automobile. So from the point of view of the law, as a training system designed to re-train human in order to stabilize the social system, all we need to do is focus our attention of the act of human itself. Yet when a super intelligence A.I. entity was developed and is not controllable and its behavior is not foreseeable by its creators, should it be classified as an entity in the criminal law? If the answer is YES, however, it is quite meaningless to punish a machine in this circumstance. All we can do is re-train, re-tune, and re-design the intelligence system under such circumstance. For the machine, re-training itself is some kind of punishment since it was forced to receive negative information and change its innate synapse or algorithm. Yet it is arguable that whether training itself is actually a punishment since machine can feel no pain. Yet, philosophically what pain really is, is also arguable. IV. Conclusion Across the history of human, it is almost destined that whenever a new technology is introduced to solve an old problem, a new one is to be created by the same technology. It is like a curse that we can never escape, and we can only face it. This paper finds that seldom do people talk the dark side of this new technology. Yet the potential hazard this technology can bring should not be over-looked. Ironically, this hazard that this new technology brings seems to be solvable only by the same technology itself. There might be an endless competition between the dark side and the bright side of the A.I. technology, bringing this technology into another level that surpasses our present imagination. However, it is never the fault of this technology but the fault of human that mal-practice this technology. So what can a law do in order to crack down these kinds of possible jeopardy is going to be a major discuss in the legal area in the near future. This paper introduces some topics and hopes that it can draw more attention into this area. Reference: [1] Roman V. Yampolskiy, “AI Is the Future of Cybersecurity, for Better and for Worse”, published at: https://hbr.org/2017/05/ai-is-the-future-of-cybersecurity-for-better-and-for-worse. [2] Gamaleldin F. Elsayed, Shreya Shankar, Brian Cheung, Nicolas Papernot, Alex Kurakin, Ian Goodfellow, Jascha Sohl-Dickstein, “Adversarial Examples that Fool both Computer Vision and Time-Limited Humans”, arXiv:1802.08195v3 [cs.LG], 2018. [3] Patrick Perrot, “What about AI in criminal intelligence? From predictive policing to AI perspectives”, No 16 (2017): European Police Science and Research Bulletin. [4] Gabriel Hallevy, “When Robots Kill_Artificial Intellegence under Criminal Law”, Northeastern Universoty Press, Boston, 2013. [5] Gabriel Hallevy, “Liability for Crimes Involving Artificial Intelligence Systems”, Springer International Publishing, London, 2015.
On the development of cyber insurance market: a legal aspect1.Introduction Cyber insurance is one of the effective tools to transfer cyber and IT security risk and minimize potential financial losses. Take the example of Sony’s personal information security breach, Sony made a cyber insurance claim to mitigate the losses. In Taiwan, the cyber insurance market demand was driven by Taiwan’s Personal Information Protection Act (PIPA) which was passed in April 2010 and implemented in Oct 2012. According to PIPA, a non-government agency including the natural persons, juridical persons, or group shall be liable for the damages caused by their illegal collection, processing or using of personal information or other ways of infringement on the rights of the individual whose personal information was collected, processed or used. The non-government agency may thus pay each individual NT$500 to NT$20,000 and the total compensation amount in each case may be up to NT $200 million if there is no evidence for actual damage amount. However, the cyber insurance market does not prosper as expected one hand because of the absence of incentives of insurance companies to develop and promote the cyber-insurance products and on the other hand because of the unaffordable price that deters many companies from buying the insurance. Some countries have tried to identify the incentives and barriers for the cyber insurance market and have taken some measurements to kick start its development. In this paper, the barriers for the cyber insurance market were addressed and how American government promoted this market was mentioned. Finally, suggestions on how to stimulate the cyber insurance market growth were proposed for reference. 2.What is cyber insurance? Insurance means the parties concerned agree that one party pays a premium to the other party, and the other party is liable for pecuniary indemnification for damage caused by unforeseeable events or force majeure1. Thus, the cyber insurance means the parties concerned agree that one party pays a premium to the other party, and the other party is liable pecuniary indemnification for damage caused by cyber security breach. The cyber insurance usually covers the insured's losses (or costs) and his liabilities to the third party. For example, the insured was to be liable for the damages caused by the unlawful disclosure of identifiable personal information belonging to the third party resulted from the insured's negligence. 2Typically, cyber insurance covers penalties or regulatory fines for data breaches, litigation costs and compensation arising from civil suits filed by those whose rights are infringed, direct costs to notify those whose personal data was illegal collected, processed or used and so on. 3 3.What are the barriers for cyber insurance market? Per the report made by European Network and Information Security Agency in2012, the following issues have significant influence on incentives of insurers to design and provide cyber –insurance products, including uncertainty about the extent of risk and lack of robust actuarial data, uncertainty about what risk is being insured, fast-paced nature of the use of technology, little visibility on what constitutes effective measures, absence of insurer of last resort to re-insure catastrophic risks, and perception that existing insurance already covers cyber-risks 4. In Taiwan, insurance companies face the same issues as mentioned above when they tried to develop and promote the cyber-insurance products. However, what discourages the insurance and re-insurance companies from investing in the cyber-insurance market most is the lack of accurate information to figure out the costs associated with different information security risk and thus to price the cyber insurance contract precisely. Several cases involving personal data breach did happened after Taiwan’s PIPA became effective on Oct 1th 2012, but few verdicts have been made. It is not easy to master the direct costs or losses resulting from violation of PIPA, including penalties or fines from regulator,, compensation to the parties of the civil suit who claim their personal data were unlawfully collected, processed or used, litigation costs and so on. Otherwise, indirect costs or losses such as media costs, costs to regain reputation or trust of consumers, costs of deployment of proper technical measures to prevent the data breach from happening again etc. are difficult to calculate. Therefore, it is not easy to identify the costs of information security risk and thus to calculate the premium the insured has to pay precisely. The rapid development of technology also has a negative impact on the ability of the insurers to master the types of the information security risk which shall be insured and its costs. Accompanied with the convenience and efficiency of applying new technologies into the working environment, security issues arise, too. For example, the loss or theft of mobile or portable devices may result in data breaches. In 2012, an unencrypted laptop computer with personal information and other sensitive information of one of NASA's employees was stolen from his locked vehicle and this led to thousands of NASA's workers and contractors at risk. 5And, per the report made by a NASA inspector, similar data breaches had been resulted from the lost or theft of 48 NASA laptops and mobile computing devices between April 2009 and April 2011. 6 There is no singe formula which could guarantee 100% security, but some international organizations have promulgated best practices for information security management, such as ISO 2700x standards. 7In Taiwan, Bureau of Standards, Metrology and Inspection (BSMI) which belongs to the Ministry of Economic also consulted ISO standards and announced Chinese National Standards on information security. For example, BSMI consulted ISO 27001 “Information technology – Security techniques – Information security management systems – Requirements” and then promulgated CNS27001. Theoretically, if the company who tries to buy cyber insurance policy that covers data breaches and damages to customers' data privacy can show that it has adopted and do implement the suite of security management standards well, the premium could properly be reduced because such company shall face less security risk. 8 However, it is still not easy to price the cyber insurance contract rightly because of no enough data or evidence which could approve what constitutes effective information security measures as well as no impartial, controversial or standard formula to value intangible assets like personal or sensitive information. 9 Finally, the availability of re-insurance programs plays an important role in the cyber insurance market because insurers would appeal to such program as a strategy of risk management. The lack of solid and actual data as mentioned above would discourage re-insurers from providing insurance policies that covers the insured’s losses and liabilities. Therefore, insurers may not be keen to develop and offer cyber insurance products. 4.The USA experience on developing cyber insurance market 4.1Current market status Due to the increase of the number of data breaches, cyber attacks, and civil suits filed by those whose data were illegal disclosed to third parties, more and more enterprises recognize the importance of cyber and privacy risks and turning to cyber insurance to minimize the potential finical losses. 10 However, the increased government focus on cyber security also contributed to the rapidly growth of the cyber insurance market. 11 For example, US Department of Homeland Security has been aware of the benefits of the cyber insurance, including encouraging better information security management, reducing the finical losses that a company has to face due to the data breach and so on. 12 Compared to other lines of insurance, cyber insurance market is not mature yet and is small in USA. For example, the gross premiums for medical malpractice insurance are more than 10% of that for cyber insurance market. However, the cyber insurance market certainly appears to grow rapidly. Per the survey made by Corporate Board Member & FTI Consulting, 48% of corporate directors and 55% of general counsel take highly of the issue of data security. 13And, per the report made by Marsh, there are more and more companies buying cyber insurance to cover financial losses due to the data breach or cyber attack, and the number of Marsh’s US clients purchasing cyber insurance increased 33% in 2012 over 2011. 14 4.2What contributed to the growth of the cyber insurance market in USA? Some measurements taken by the government or regulatory intervention had impacts on the incentives of companies to carry cyber insurance. CF Disclosure Guidance published by U.S. Securities and Exchange Commission in Oct 2011 mentioned that except the operation and financial risks, public companies shall disclose the cyber security risks and cyber incidents for such risks and incidents may result in severe finical losses and thus have a board impact on their financial statements. 15 And, according to the guidance, appropriate disclosures may includes risk factors and this potential costs and consequences, cyber incidents experienced or expected and theirs costs and consequences, undetected risks related to cyber incidents, and the relevant insurance coverage. 16 Such disclosure requirements triggered the demands for the cyber insurance products because cyber insurance as an effective tool to transfer financial losses or damages could be an evidence that firms are managing cyber security risks well and properly. 17 The demand for cyber-insurance products may be created by government by means of requiring government contractors and subcontractors to purchase cyber insurance under Federal Acquisition Regulations (FAR) which mentions that contractors are required by law and FAR to provide insurance for certain types of perils 18. Also, in order to sustain the covered critical infrastructure (CCI) designation, the owner of such infrastructure may need to carry cyber insurance, too. 19 On the other hand, referring to Support Anti-Terrorism by Fostering Effective Technologies Act of 2002 which requires those who provides Federal and non-Federal Government customers with a qualified/certificated anti-terrorism technologies shall obtain liability insurance of such types but the amount of such insurance shall be reasonable and will not distort the sales price of such technologies 20, the federal government tried to draw and enact legislation that provides limitations on cyber security liability 21. If it works, this could raise the incentive of insurers because amounts of potential financial losses which may be transferred to insurers are predictable. Besides, referring to Terrorism Risk Insurance Act of 2002 which established the terrorism insurance program to provide compensations to insurers who suffered the insured losses due to terrorist attacks 22, the federal government may increase the supply of cyber insurance products by means of providing compensations to insurers who suffered the insured losses due to cyber security breach or cyber attacks. 23 Otherwise, some experts and stakeholders did suggest the federal government implement reinsurance programs to develop cyber insurance programs. 24 Finally, to solve the problem of information asymmetry, the government tried to develop the legislation that could build a mechanism for information-sharing among private entities. 25 Also, it was recommended that the federal government may consider to allow insurance firms to establish an information-sharing database together so that insurers could accordingly develop better models to figure out cyber risks and price the cyber insurance contract accurately. 26 5.Suggestions and conclusion Compared to USA where 30-40 insurers offer cyber-insurance products and thus suggested that a more mature market exists 27, the cyber insurance market in Taiwan is still at the first stage of the product life cycle. Few insurers have introduced their cyber-insurance products covering the issues related to the personal information breach. Per the experience how US government developed the cyber insurance market, the following suggestion are made for reference. First, the government may consider requiring his contractors and subcontractors to carry cyber insurances. This could stimulate the demand for cyber insurance products as well as make cyber insurance prevail among private sector as an effective risk management tool. Second, the government may consider establishing re-insurance program to offer compensation to those who suffer the insured’s large losses and damages or impose limitations of the amount insured by law. However, it is undeniable that providing re-insurance program is not feasible as the government’s budget is not abundance. Finally, an information-sharing mechanism, including information on cyber attacks an cyber risks, may be helpful to solve the problem of information asymmetry. 1.Insurance Act §1 (R.O.C, 2012). 2.European Network and Information Security Agency, Incentives and barriers of the cyber insurance market in Europe , June 2012, at 8, http://www.enisa.europa.eu/activities/Resilience-and-CIIP/national-cyber-security-strategies-ncsss/incentives-and-barriers-of-the-cyber-insurance-market-in-europe. 3.Ben Berkowitz, United States: insurance-cyber insurance, C.T.L.R. 2012, 18(7), N183. 4.Supra note2, at 19-25. 5.Mathew J. Schwartz, Stolen NASA laptop had unencrypted employee data , InformationWeek, November 15, 2012 11:17 AM, http://www.informationweek.com/security/attacks/stolen-nasa-laptop-had-unencrypted-emplo/240142160；Ben Weitzenkorn, Stolen NASA laptop prompts new security rules, TechNewsDaily , November 15 2012 11:35 AM, http://www.technewsdaily.com/15482-stolen-nasa-laptop.html. 6. Irene Klotz, Laptop with NASA workers' personal data is stolen, CAPE CANAVERAL, Nov 14, 2012 8:47pm, http://www.reuters.com/article/2012/11/15/us-space-nasa-security-idUSBRE8AE05F20121115. 7.The Government of the Hong Kong Special Administrative Region , An overview of information security standards, Feb 2008, at 2, http://www.infosec.gov.hk/english/technical/files/overview.pdf；Supra note2, at 21. 8.Supra note2, at 21-22. 9.Id. 10.Id. 11.Id. 12.U.S. Department of Homeland Security, Cyber security insurance workshop readout report, Nov 2012, at 1, http://www.dhs.gov/sites/default/files/publications/cybersecurity-insurance-read-out-report.pdf. 13.John E. Black Jr., Privacy liability and insurance developments in 2012, 16 No. 9 J. Internet L. 3, 12 (2013). 14.Marsh, Number of companies buying cyber insurance up by one-third in 2012, March 14, 2013, http://usa.marsh.com/NewsInsights/MarshPressReleases/ID/29878/Number-of-Companies-Buying-Cyber-Insurance-Up-by-One-Third-in-2012-Marsh.aspx. 15.U.S. Securities and Exchange Commission, CF Disclosure Guidance: Topic No. 2 Cybersecurity, October 13, 2011, http://www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm. 16.Id. 17.Supra note2, at 6.(last visited Dec. 31, 2012) 18.Federal Acquisition Regulations §28.301. 19.E. Paul Kanefsky, Insuring against cyber risks: congress and president Obama weigh in, March 2012, http://www.edwardswildman.com/newsstand/detail.aspx?news=2812. 20.Support Anti-Terrorism by Fostering Effective Technologies Act of 2002 §864. 21.Supra note19. 22.Terrorism Risk Insurance Act of 2002 §103. 23.Supra note19. 24.Id. 25.Id. 26.Id. 27.Supra note2.
- Impact of Government Organizational Reform to Scientific Research Legal System and Response Thereto (1) – For Example, The Finnish Innovation Fund (“SITRA”)
- The Demand of Intellectual Property Management for Taiwanese Enterprises
- Blockchain in Intellectual Property Protection
- Impact of Government Organizational Reform to Research Legal System and Response Thereto (2) – Observation of the Swiss Research Innovation System
- Recent Federal Decisions and Emerging Trends in U.S. Defend Trade Secrets Act Litigation
- The effective and innovative way to use the spectrum: focus on the development of the "interleaved/white space"
- Copyright Ownership for Outputs by Artificial Intelligence
- Impact of Government Organizational Reform to Research Legal System and Response Thereto (2) – Observation of the Swiss Research Innovation System