Ruling the Country by Technology: Convenience? or Surveillance?

The eID in Taiwan and in Estonia is functionally similar. They both are personal identification with digital signature and could combine with healthy insurance and tax files. Moreover, Taiwan eID contains photo, signature, date and location of birth, marriage status and spouse’s name and household information. If a governmental staff got your ID number, he/she can get all yours and your families’ information through the system. Since so much information contained in eID that it raises lots of concerns about information security and privacy. For example, Estonia used "X-Road" database, a cross-platform and non-centralized database to store people's information in each department independently. A government or company can get people's information with that person's authority. Also, Estonia has established an open-source monitoring system that allows the public to know what government agency, at what time, and what information has been checked. However, this monitoring system does not exist in Taiwan as well as the Taiwan government fail to disclose how the information will be used and stored in eID. Transparency here seems does not exist.

The new eID also contains digital signature. There are two major concerns: one is the digital signature might be mixed up with identity certification; the other is that the ESA hasn’t been modified for 20 years and only regulates one encryption method: Public Key Infrastructure. Basing eID on the outdated and narrowly legislated ESA is troublesome because it creates tremendous legal uncertainty around the many other encryption methods which is widely used yet unregulated. In addition, it must be clear how to separate the identity certification and digital signature while using eID.

“Technology Investigation Act” on one hand regulates the due process of law enforcement’s usage of technology in investigation; on the other hand, it allows them to scout directly through people’s devices or other digital information. For example, law enforcement can intrude into people's smartphones and implant Trojans. They can monitor and obtain conversation texts, audios and photos, as well as control your devices remotely and secretly.

Therefore, we should not allow them to inspect people’s communication, not to mention setting up a back door on people’s devices. That would be totally a violation of privacy and autonomy.

I think this is a draft opinion piece for the general reader in Taiwan, in English for now. Measured to that purpose, I think this is a very good first draft. You can improve it by making the discussion of the Supreme Court cases shorter, because the general reader of a newspaper opinion essay doesn't need the detail. But the right to anonymity will be something the reader will want more said about than just an assertion. And the differences between Estonian and Taiwanese treatment of citizens' digital rights should be made clearer and more specific, so the Taiwan reader can see exactly where she is being shortchanged. You might want to try out the Chinese version of the next draft with some readers there. Grace Huang would be a good interlocutor, I think.

Governed the Country by Technology: Convenience? or Surveillance?

-- By WanTingHuang - 20 Nov 2020

Introduction: Anonymity and Our Life

When trying to advocate “anonymity,” I usually heard that “I am not a criminal, why should I need anonymity? Why should I hide?” But actually, anonymity is a freedom and a right that a person can decide whether to reveal himself/herself or not, and anonymity should exist everywhere as long as a person wants it. In other words, no one should be forced to reveal, we deserve anonymity.

However, governments around the world increasingly trying to take advantage of technology to help them govern their countries and control their citizens. Here, I will illustrate some technology policies in Taiwan, point out problems and try to figure out some notions to improve our digital life.

Govern the Country by Technology in Taiwan

Recently, Taiwan government promotes several policies of technology from different perspectives to govern the country, such as eID, digital signature and technology investigation, trying to learn from Estonia and to transform into an advanced country governed by technology.

A. eID

This month, a new policy of using New eID in 2021 is promulgated and it will replace the traditional ID card, which has been used since 1946. Taiwan government compares the eID to Estonia Digital Identity Card, but there is a significantly different between Estonia and Taiwan’s eID, especially in information security and transparency.

Functionally, the eID in Taiwan and in Estonia is similar. They both are personal identification with digital signature and could combine citizen’s driving license, healthy insurance card, and tax files. Moreover, Taiwan eID contains ID number, photo, signature, birthday, city of birth, marriage statute and spouse’s name and household information. So much information contained in the eID, and therefore, it raises lots of concerns about information security and privacy. What’s more, the Taiwan government doesn’t clearly explain how will those information be stored in the public section and private section in eID and how will they be used. Transparency here seems does not exist.

In Interpretation No. 603, the Constitutional Court determined that the right to privacy should be protected under Article 22 of the Constitution in order to protect human dignity, individuality, and the integrity of personality, as well as to protect the private sphere of personal life from intrusion and self-determination of personal information (see J.Y. Interpretation No. 603; see also J.Y. Interpretation No. 585). Not until this Interpretation No. 603 in 2005 did Taiwan stop collecting fingerprints when people change ID cards. It’s clear that people have the right to determine what and how their personal information to be used. But now, the new eID policy seems just ignore all the concerns and make no explanation.

B. Digital Signature

There are three essential characteristics of digital signature: integrity, authentication, and non-repudiation. While concerning of safety of Digital Signature, there are two things come to our mind first: verification and encryption. The “Electronic Signatures Act (ESA)” in Taiwan was promulgated in 2001 and seems to have regulated those parts. The digital signature regulation follows the ETSI TR 102 038 Technical Report of EU. But actually, the certification agencies in Taiwan are private companies. It shouldn’t be some companies with such power to access people’s information without disclosing how they dealing with them.

The new eID also contains digital signature. There are two major concerns: one is the digital signature might be mixed up with identity certification; the other is that the ESA hasn’t been modified for 20 years, and only regulate one encryption method: Public Key Infrastructure. As time changes, if we use other kinds of technology methods to make a digital signature, then we must make sure it’s admitted under the law or not. In addition, it must be clear how to separate the identity certification and digital signature while using eID.

C. Technology Investigation

The third technology policy Taiwanese government promotes is “technology investigation.” The Ministry of Justice asserts that the only object of the investigation is “criminal;” however, people are afraid that the Technology Investigation would become another Martial Law, which terminated in Taiwan on April 30, 1994 and a lot of people still suffer from its shadow.

“Technology Investigation Act” on one hand regulate the proper progress and timing that police officers and prosecutors could use technology to investigate; on the other hand, it allows them to scout directly through people’s cell phone or other digital information. We should not allow them to inspect people’s communication, not to mention setting up a back door on people’s devices. That’s totally a violation of privacy.

Improving Information security by Education

While Estonia government talks about the e-Estonia by digital identity, digital signature and information encryption, ironically, Taiwan government talks about eID, digital signature and technology investigation.

Establishing digital ID cards and popularizing digital signatures is not the most important thing to become a digital country; the most important thing is to teach information encryption. Nonetheless, sadly Taiwan only carries out the first two methods, and forgets about data encryption intentionally or unintentionally. People need to understand that they have “choices,” they need to know anonymity and privacy are their right and freedom. The more we trust and adore the machine and the digital system, the better we should learn about how to protect our information. Before launching a new policy of teaching children how to program coding in elementary schools, it’s better to teach children as well as adults how to protect their information and read freely without surveillance. But somehow, the Taiwanese government just forgets to teach people about those stuff for convenience. Well, who’s convenience?

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, WanTingHuang
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.