The Taiwan model, if you call it that, is that through co-creation and participation with the civil society, with people closer to the pain, we can find solutions that doesn’t make sacrifices and that takes care of both progress and safety through participation. And all of the methods that I ...

Yeah, I think one of the main messages is that Taiwan can contribute to a no-compromise solution to the threat that AI poses to democracy. It’s often phrased as a compromise between progress and safety. If you want more innovation, you give up some public safety. If you want safety, ...

Well, we’re always preparing, right? Wellington Koo of the National Security Council was quoted in the media saying that, just on average, there’s 5 million cyber attack attempts per day. So when I say spikes, it doesn’t mean that normally there’s no – it’s millions per day. That’s just the ...

There was also a significant amount of that, of cyberattacks, especially around denial of service, this March when Dr. Tsai Ing-wen visited the U.S. So there were two spikes. But so far this month, we haven’t witnessed something of that magnitude yet.

As I mentioned, because of generative AI, the costs of both are lowering, which makes further coordination even more likely. So I don’t think in this particular incident there’s this kind of coordination going on, but we’re monitoring quite closely.

But to your question, I think we’re mostly monitoring, like, foreign interference that’s coupled with cyberattacks. So since last August, these two individually quite distinct before last August, cyberattacks and information manipulation attacks become quite closely coordinated last August.

And they have their Twitter account, so I encourage you to ask them that question.

So ADIZ is really the Ministry of Defense, right?

Manipulation attacks?

Yes, that’s the message we hear from OneWeb.

In addition to those remote islands this year, I think OneWeb will cover most of Taiwan toward the end of the year, and hopefully all of Taiwan by the end of the year. And so that’s when we will start rolling out more testing sites for real.

Yeah, we’re quite early into the 700. The thing about the 700 is that it talks about the sites, not about the vendors. So each site can connect to one or two or three or more satellite vendors, right? So I think we’re starting with remote islands first, because remote ...

Fixed or mobile satellite receiver sites.

It is also for the same reason that we’re working with all three major cloud providers. That’s to say Google, Microsoft, and Amazon, not just backing up to outside of Taiwan, but also on local resilience, on setting up their local data centers, at least for the critical video communication ...

So, we’re investing in a plurality of satellite providers, not just for redundancy’s sake, but also we want to work with many jurisdictions, many countries’ systems, so that it becomes, as I mentioned, very difficult to jam or disrupt all those different satellite systems belonging to different countries at once.

I think there are arrangements where having an additional, not as a replacement, satellite provider can be helpful. And as long as basic cybersecurity standards are met, having a high availability, redundant capacity is by definition always a good thing. So we’re not, to your question, ruling anything out. On ...

The hope is that we work with as much as possible – as many as possible – satellite vendors, so that by the end of next year, we’ll have more than 700 either mobile or fixed satellite receiving points, and each point, either a hotspot or a backhaul, connects hopefully ...

This year, the Matsu incident put the cutting of subsea cables from a hypothetical situation into an actual situation. And so we’ve doubled down on the investment in non-geostationary satellite systems. We now have capacity with SES in the Middle Earth orbit, and OneWeb, as I mentioned, in lower Earth ...

Of course, we quickly kicked into action along with NCC to set up microwave stations and satellite capacity and so on, but it did put – it’s just like how last August cyber attacks during Nancy Pelosi’s visit put cyber attack and DDoS into everybody’s mind.

Yeah, I think there’s much more visibility and urgency this year after earlier this year that the subsea cable is connecting Matsu Island and the Taiwan proper, the main island, there are two subsea cables. And within a week, two Paracel flag flying vessels, one fishing, one cargo, “accidentally” dropped ...

OneWeb.

Earthquakes.

That the main threat factor comes from the foreign actors’ manipulative behavior, instead of addictive content and distribution.

We’ve also noticed that in the US, the CFIUS has been talking about an arrangement that specifically addresses the actor/behavior level of changing algorithms and things like that, instead of on the content or distribution level. We think that it agrees with our assessment.

As I mentioned, the focus this year for us is on cyber attacks by the foreign actor in the actor side and coordinated inauthentic manipulative behavior on the behavior side, so the A/B of ABCD. I worry less about the content. Like if you see a short clip that’s distributed ...

The clarification was new.

So some people were interpreting the original Cybersecurity Act-related guidelines as just hardware, or just hardware and software. But we are saying basically even if you rely on the service of an app that connects to a website or an API or anything like that, as long as it’s providing ...

Yeah, we four years ago summarily banned the use of PRC software, hardware, and internet services in our public sector. So it’s not about TikTok or some other little red books or whatever, it’s a blanket ban on PRC services and branded software and hardware. What we did, as you ...

That was four years ago.

Yeah, it’s been four years since we–

For four years now.

Well, we expect that if we do not raise awareness and the civic competence and also use language models in real-time clarification for the social sector people, they have already started developing that capacity. So instead of people in their part time contributing to fact-checking, they now collaboratively tune a ...

We’re not very much near to the election season yet.

And if they get notices and they do not take it down and somebody gets conned and lost a million, and according to our new law, Facebook is now liable for that million as well, which is why they haven’t been fined because they were very – their civic integrity ...

We saw that in Taiwan being used for fraud, scam calls. So they would, for example, call you, and you pick up and say, “Hello,” and so on for three seconds, and then your voice print is cloned, and then the fraudsters will use that voice print to call your ...

Yeah, because closer to campaign, there’s a time there would be canvassing calls and things like that, right? It was just that it was very expensive to have human teams that do that. But now with interactive generative AI, these tasks can be done en masse at a very low ...

So to counter this kind of – the closest are scam and phishing, spear phishing or scam calls. And this kind of phishing-manipulation attacks can only really be countered by raising awareness among our citizenry that such things are now possible. Someone who can voice clone me and talk through ...

The traditional ways of human fact-checking doesn’t address those new attack vectors, because these are not rephrased as news, but rather as individualized messages, each one tailor-made to the profile of the recipient. So it’s like a mailing list that sends a different mail to every receiver, tailor-made to them. ...

Yeah. So we use the actor/behavior/content/distribution ABCD framework, instead of mis- or disinformation which is on the content or distribution layer. But with generative AI this year, we’re seeing that mass manipulation or persuasion doesn’t need a piece of misinformed information. It can base entirely of news, actually, journalism outputs, ...

We have received quite positive responses from the frontier model developers that they’re quite willing to be part of this arrangement so that the threat assessment, the latest red teaming results, and things like threat intelligence can be shared. Like in the cybersecurity world, we have such emergency response teams ...

Sure. So, I would say toward end of the year, the Taiwan National Institute of Cyber Security is going to partner with NIST and other standard bodies in developing advanced evaluation, including testing, verification, and so on, frameworks and capabilities to test out those frontier models.

We’re quite optimistic that when we set up around the end of the year, the testing and verification framework, assurance labs, as part of our cybersecurity institute, It looks like those frontier model labs are quite willing to participate.

This is super recent, all of this is today.

At Concordia, and right after Concordia.

These are not traditional bilateral or multilateral talks, it’s not like those top labs are sovereign countries, but they are interested. And in a multistakeholder setting, I think this message resonates very well. And I think UN is evolving into a hybrid. There’s a multilateral part of it, but there’s ...

Yeah, I think there’s a lot of talk in the sidelines, right? And as I mentioned in my talk, we toil tirelessly from the sidelines. But I think our message is one that resonates, that when AI harms democracy, we can counter that harm with more democracy and AI-assisted democracy. ...

And we think this is going to be very helpful to deliberative democracy and community norm setting, on a lot of matters. So these are the two main messages that we’re sending. Now there’s a technical part of it also, which is the assurance framework, testing and verification. We’re developing ...

This is the kind of town hall or assemblies that can capture all the nuances of what people have talked about without losing the nuances, compress it into a model that can be used to not just align future models, but interactively talk with policymakers so that we can say, ...

Now also to raise the awareness that it is actually possible also to use gen AI for good by running alignment assemblies that gets people talking about not just how to regulate AI, although that’s the first thing we talk about, but also about any policy issue that goes beyond ...

Part of the main agenda is to strengthen the democratic institutions, not just in our country but also worldwide, to move toward zero-trust architecture, move people off passwords, offer stronger authentication online and so on, and just to develop the awareness that this kind of thing is going to meddle ...