by Brian Hioe
Photo Credit: Jefferry/WikiCommons/CC
DUE TO THE potential security risks, the use of Chinese parts and software for the luggage self-check-in system at Taoyuan International Airport has caused controversy. DPP legislator Lin Chun-hsien was among those to sound the alarm on the issue, criticizing insufficient vetting during the public tender for upgrading the self-check-in system.
In particular, the machinery parts and software are made by the subsidiary of a Chinese arms manufacturer, China North Industries Corporation (Norinco). The machines are built in China, but then disassembled and shipped to Taiwan. The logic controller for the system was programmed by a Japanese company, but using programming originally designed by Norinco, which further leads to concerns that there could be backdoors in this software.
The tender was won by a Taiwanese company, CTCI Advanced Systems Incorporated, which has responded to the controversy by emphasizing that its machines were built in Taiwan but used Chinese parts. Critics, however, have instead framed the company as attempting to pass off Chinese products as Taiwanese ones.
Either way, the controversy points to many of the complications regarding sourcing electronics in Taiwan. Many products use parts or software manufactured in China. Yet this leads to issues preventing security risks that come from Chinese products.
Previously, following criticisms by DPP city councilor Huang Shou-da, there was increased scrutiny on the widespread use of Hikvision security cameras in Taiwan. Hikvision is a Chinese brand and there were fears regarding Hikvision routing footage through Chinese servers. It was found that 1,089 Hikvision cameras were in use at 309 schools or agencies.
Hikvision was later hit by US sanctions affecting 180 countries. Subsequently, pan-Green Kaohsiung city councilors were critical of that security cameras distributed by the city government were made by Hikvision. For its part, the Kaohsiung city government claimed that the cameras had been purchased before the ban, and that they had not previously been aware of the issue.
But the issue is not exclusive to either security cameras or airport self-check-in systems. A report by the Executive Yuan in May 2021 found that 19,256 devices made in China were used in 2,596 schools, local governments, and other institutions. 1,848 cameras or drones made by Da-Jiang Innovations Technology were used by 717 universities, and 1,632 computer networking systems were used by TP-Link Technologies. Some schools refused to remove the cameras after being informed of the issue.
There have been delays by the government in rolling out legislation to address the issue. The Executive Yuan released guidelines on products that may prove information security risks on April 19, 2019 and was to release a list of banned Chinese products three months later. However, by late 2021, no list had been released. Finally, a ban on Chinese-made products in government took place on January 1st, 2022.
It is thought that failure to reach a consensus between different bureaus of government was a contributing factor as to why the government dragged its feet on the matter. Even regarding key issues, the Taiwanese government often proves highly bureaucratic, straight jacketing effective responses to deeply-rooted issues.
More generally, one notes the frequent cost-cutting for public tenders that occurs in Taiwan. This has often incentivized companies to try and pass off cheaper Chinese products as Taiwanese, even when there are safety or security risks. One prominent example occurred with regards to the COVID-19 pandemic, with attempts by companies that were part of the “national team” to boost production of medical masks attempting to pass off cheaply made Chinese medical masks that did not fit medical standards as made in Taiwan products.
Even when there is no attempt to pass off Chinese products as Taiwanese, that Chinese products are much cheaper proves another reason why the government or educational institutions might purchase Chinese products. Workers at such institutions may not be aware of the sensitivity of such issues, as well, or be unwilling to take action.
Sometimes this is due to bureaucratic inertia, in other cases, this is due to being disbelieving of the potential threat. Indeed, knowledge of digital security is widespread in Taiwan, including among government workers and in government bureaus. This, then, proves a larger, systematic issue.