In July, Taiwan witnessed a first-of-its-kind intrusion – a sophisticated AI cyberattack against its government and private sector networks. The hack was suspected to have been carried out by Chinese actors. While impactful, this is not surprising and it overinflates perceptions of China’s true cyber threat to Taiwan. 

Most people assume that China’s cyber capabilities define the totality of its threat to Taiwan, but this simply does not capture the full picture. Intent and opportunity to use cyber are equally critical. A threat is properly defined as the product of an adversary’s intent, opportunity, and capability. While China’s cyber capabilities currently pose a significant threat to Taiwan’s digital sovereignty, environmental factors limit its intent and opportunity to use cyber in an existential way toward Taiwan. The threat is currently modest but can change rapidly as conditions shift.

Intent

Taiwan represents a fundamental challenge for China’s leadership, not only due to its dominance over the semiconductor market, but also due to its mere existence as a democracy made up of ethnic Chinese. The Chinese Communist Party (CCP) risks losing legitimacy with its populace – and its power – if Taiwan is not incorporated back into the mainland. Thus, China has indicated it aims to integrate Taiwan back into China by 2049. 

The most likely scenario under which China would use cyber in a catastrophic way toward Taiwan would be if it were coupled with an invasion or blockade of Taiwan. Cyber is one of the many tools in the toolbox for states, and like other military actions, its goal is to induce a political outcome. A digital blockade, for instance, through a series of massive multi-sector cyberattacks, by itself would likely not be China’s first coercive option to induce reunification. A naval blockade would likely have a much more sizable and lengthy impact than a digital blockade. Unlike physical ships that cannot be moved unless sunken or moved, a cyberspace effect’s lifespan is much shorter. 

Cyber impact often takes time to generate, requiring complex access and capabilities to be developed, all the while remaining undetected. Once cyber is leveraged against a target, it can be difficult to meaningfully re-engage the target to produce sufficient follow-on impact. After the first cyber shot is fired, network and systems administrators work rapidly to identify vulnerabilities, like the access pathways and malware used. They then reconstitute their network, bringing it back online and patching any remaining known vulnerabilities. While malware can be retooled and new access vectors generated, this too can take time and slow down the offensive inertia. This is why cyber is often more impactful when coupled with other forms of statecraft, not just as a standalone instrument.

China does not currently intend to reunify with Taiwan through force. The costs associated with a kinetic invasion are estimated to be in the trillions of dollars, with impact on the global economy upwards of 10 percent of world-wide GDP. China would bear a significant portion of the costs, including long-term repercussions on its other national goals. Consequently, China has generated an alternate strategy beyond kinetic means to reunify.

That isn’t to say that China won’t take cyber actions against Taiwan. But the threat as it currently exists is not an existential one. 

Central to China’s cyber program is its emphasis on securing information superiority. Whoever controls the information environment controls the levers of power and a population’s political preferences. China utilizes cyber tools daily to gradually chip away at the will of the Taiwanese, aiming to normalize its malicious actions. According to the Taiwanese government, Chinese cyber actors attempt 2.6 million intrusions of its critical infrastructure networks every day. Over a prolonged period, China believes it can both routinely influence the Taiwanese populace to rejoin the mainland while preparing for kinetic reunification as a last-resort effort.

Polling indicates that only 5 percent of Taiwanese want to unify with the mainland. Peaceful reunification currently seems highly unplausible. While cracks are apparent in the Taiwanese political apparatus, they are not substantial enough to tip the scales in China’s favor in any meaningful way. However, Chinese leadership does not appear publicly frustrated by its slow progress in Taiwan, likely due to its long-term strategic outlook. Thus, it will likely continue its peaceful approach, unless something drastic occurs, such as a change to the United States’ “One China” policy or if Taiwan declares its independence publicly.

Opportunity

Taiwan’s critical infrastructure is clearly vulnerable to attack. Both technical and nontechnical security gaps in Taiwan provide China ample access vectors and freedom to traverse through Taiwan’s cyberspace, sometimes undetected. China values secrecy in its cyber operations against Taiwan and uses techniques such as “living-off-the-land” to clandestinely move from network to network and deep inside critical systems. 

Taiwan is one of the world’s most digitally connected countries which increases its cyberspace risk despite its economic upsides. Due to Taiwan’s heavy reliance on imported energy, at over 96 percent, ports like Taichung and Kaohsiung become strategic weaknesses. Impacting even one of these ports could generate downstream effects for Taiwan’s economy and societal functioning. Additional chokepoints include Taiwan’s reliance on only 15 subsea cables for its digital connectivity, as well as its heavily centralized water and electricity networks. All of these are potential targets in a major cyberattack scenario, given China’s years of posturing for conflict.

While Taiwan is clearly vulnerable from a cyberspace perspective, other factors significantly reduce China’s opportunity to threaten Taiwan existentially in cyberspace. As articulated earlier, an invasion or blockade are the only other two realistic options that would likely necessitate China using major cyber action against Taiwan. However, even a blockade may have its political limits toward accomplishing unification. While a blockade or digital blockade would present dire circumstances for Taiwan, historically, blockades have not led to countries capitulating their sovereignty. Current polling indicates that between 50 to 85 percent of Taiwanese would politically resist coercion by China’s military in an attempt for unification. Taiwan’s resolve and international backing would likely outweigh China’s prolonged blockade.

Beyond blockades, true political unification in Taiwan will require boots-on-the-ground to unite the two countries. However, there is speculation that China is not currently ready to conduct a full-scale invasion or a blockade of Taiwan. For a military invasion, the People’s Liberation Army (PLA) must be able to conduct a complex inter-service amphibious landing from over 100 nautical miles away and pacify an unwilling population while securing logistics lines and staving off any counter-intervention forces. The PLA’s lack of reliable leadership, unproven joint operations, and nonexistent recent combat experience indicates it is likely not ready to conduct a full joint island attack campaign anytime soon. 

Thus, the opportunity for China to threaten Taiwan through a major cyber incident as a part of a larger coercive unification strategy in the current moment is negligible. 

Capability

China has likely caught up to the United States in cyberspace and is now a world-class cyber superpower, able to operate at speed and scale. China’s offensive cyber program will only become harder to counter in the future with the development of advanced AI models. From a capabilities perspective, China currently has the technology, pre-positioned malware, people, and technical expertise to carry out a major cyberattack against Taiwan. 

There are over 100 malicious cyber actors that operate out of China. According to former FBI Director Christopher Wray, China possesses 50 times more hackers than the FBI’s cyber professionals. China clearly invests heavily in its cyber force, likely due to its importance in its overall Taiwan and information dominance strategy. 

Beyond sheer force size, rapid advancements in AI capabilities are occurring daily and will likely give adversaries like China a first-mover advantage. China is already on the front lines of advanced AI model development, and any application to offensive cyber will completely redefine the cyber threat landscape for Taiwan. Many already predict that AI will provide cyber attackers the upper hand over cyber defenders in the short term.

There was a suspected Chinese-origin AI cyberattack of Taiwan in July. If true, this may indicate that China is making the leap from offensive cyber research and design to integration and deployment. While China has a long record of pre-positioning malware globally, AI will likely assist its cyber operators with breaking into traditionally hard-to-hack networks like air gapped industrial control systems and supervisory control and data acquisition (ICS/SCADA), defense, and government networks. Taiwan’s cyber defenses are likely not as advanced as compared to China’s capabilities, given China’s global superiority in the offensive cyberspace. 

Thus, China meets all the necessary capabilities requirements to cause Taiwan’s networks serious harm.

Next Steps for Taiwan

While China’s capabilities are formidable and amplify its potential to cause Taiwan harm, they are muted by significant environmental factors. The magnitude of threats often change, and the threat model used provides only a snapshot in time for China’s current cyber threat. It is not an eternal label. 

China will likely only be a modest threat overall temporarily. When future conditions are ripe, China will pose a much graver threat to Taiwan’s existence as a free and digitally sovereign society than it currently does. 

While one cannot predict what will happen next, Taiwan can take steps now to preserve its digital sovereignty and future as a free nation. It can  develop a whole-of-society AI Cyber Shield to offset offensive AI cyber capabilities, and train more government cyber operators and establish national cyber privateers. That includes conducting red team cyberattacks on critical infrastructure chokepoints.

Taiwan can increase societal resilience to mass cyber shock, continue civil-military joint readiness exercises, and prepare hack-back offensive plans and capabilities.

Finally, Taiwan can improve foreign partner engagement to glean best cybersecurity practices.

Taiwan may currently be in a suitable state to survive China’s low-level cyber influence campaign, but the future is much less assured. China has and continues to prepare itself for conflict to unify with Taiwan. If Taiwan does not take the appropriate steps to secure its cyberspace, a day will come when the threat becomes reality. Perhaps then China will be the ten-foot-tall cyber giant everyone presumes it to be.