I have a little nephew of mine who's two years old, and he just learned something today, this week. I'm visiting with my partner, she's Taiwanese. I come to Taiwan a lot, and it's a wonderful place.

Do you speak Taigi, Hakka, or any of our 20 national languages?

No, she keeps trying to teach me. I'm sure she would love me to learn soon, but I would be very embarrassed to speak.

It's fine. It's fine. According to reliable sources, GPT will pass Turing test next month, so we'll just delegate everything to them. Awesome. What's the agenda today?

The agenda is, we have everyone here from Cloudflare. We are very honored to be here, and thank you for taking the time to speak with us today. It's just about your vision. What do you want to accomplish with MoDA in terms of the digital services?

The complexity behind the services that you will deliver that's sometimes opaque to people who may not understand or who don't know what's behind the app.

In case of machine learning, it's opaque to itself, too...

Yeah.

Very opaque.

Just to start off, it's about moda and the services that you hope to deliver to Taiwan use and to Taiwan. A lot of it being my partner and her parents being here, I get to see the other side of things. It's about educating people about technology and how to use that technology.

Making them aware of what's available, how to access those service. Then, the services themselves. What value add those services can provide on top of what they could receive already from physical community centers, things like that?

Then, of course, the topics behind...You mentioned in an interview recently about confidentiality, integrity, and resilience of these services. How do you accomplish that at moda?

The last topic will be around technopolitical topics such as access management, data privacy, things like GDPR, and how regulation is sometimes catching up. Where regulation needs to go in order to provide a fair and robust and secure set of services for citizens of any country.

Sure.

The first thing I want to talk to you about is moda. It has a very important mission. What's your vision, and what are you trying to accomplish with moda? Some examples of the successes of moda so far.

Our slogan is #FreeTheFuture. It means to foster collaborative diversity. The kind of services or solutions that works today may end up limiting the freedom of the next generations if they're locked in to specific courses.

Some authoritarian regimes say that allowing mobilization is very effective, it's very efficient, and so on. Maybe so for a very well defined problem. If the virus mutates or [laughs] anything changes, then this kind of top down measures no longer work. It may actually backfire.

We're the contrary of that. We're making the state transparent to its citizen, not the citizen transparent to the state. We want to make sure that anyone out there who has a better idea as of how to overcome the societal challenges are given the full canvas of the public code, open data, APIs, and so on to figure out the solutions, which is why we say we work with the people not for the people.

That's the main idea behind freeing the future. To that end, of course, we work with very plural technologies, our stack. We try very hard not to being locked in on specific vendors. We make sure that the kind of people you mentioned, we empower the people who empower them.

Instead of asking them to all convert to, I don't know, PDF — sorry, it's a joke because if you type "convert to Google" it's just PDF...

...not particular relation — convert to any particular file formats like filing PDF online, but to ensure that even if 10 percent of people who do not like digital services and prefer instead face to face, over the counter transactions can find someone who cares about them personally. That person, instead of having to handle all the analog paper stuff is fully empowered.

The examples I can give that we're going to issue NT$6000 to everybody soon, including people with a permanent resident certificate. I don't whether you're...

...back or not. In this handing out cash, we ensure that people who prefer, who are comfortable with websites simply type their bank account, and that's it. Then it's wired to their bank account. People who don't want to type anything online, who trust their bank's automatic teller machine, can go to the ATM and get NT$6,000 cash.

The people who don't trust either nevertheless can show up at their local post office, present their identities and so on, and then withdraw cash from the post office. The post office worker is not overwhelmed because the backend is all integrated.

This shows the kind of taking care of the people by empowering people closes to the pain while leaving open the infrastructure so that people who figure out better ways to get similar payments and so on can tap into this public infrastructure. Which is why we need to design so it's extensible to the future.

If you think about it, this mindset, this way of thinking, not working for the government, working with that kind of thing, is a huge shift for people who think in terms of, "We have to have a strong government, a strong ministry to do this."

How do you how do you explain that to people in layman's terms? It's difficult for somebody to understand that, and then, for example, to be able to...You were doing this through Taiwan's one tablet per child thing, and we're doing it for the future. There's still a transition period that we need to go through, which that shift in mindset...

I was born into a martial law, so [laughs] I know what you're talking about. There are still people who prefer a strong leader and assume a strong leader who dictates things, that the elites must know the best for the people.

During the past three years, everybody around the world saw that it's not like that. It's not the case, whether it's about a pandemic, which is a mutated virus, or about a disinformation crisis, the infodemic, which is another mutating virus, or cybersecurity, which is another mutating virus. [laughs]

Things that look like that simply do not respond to the authoritarian logic, to the top down logic, to the dictates. Even the people who are following the pandemic guidelines and so on, they need adaptations because the virus itself adapts.

A lot of our philosophy gets honed and tested during the three years of the pandemic, and that is what distinguishes our philosophy with many other philosophies around the world.

To your point, there's another point here. If we make sure that the people who think about, for example, the visualization of mask rationing, preregistration vaccines, and so on, get their ideas implemented within the next iteration, which is usually a week or two, then people know what this agile mindset feels like.

It's democracy, just with a faster iteration, with a faster co-creating cycle. It's this experience, more than any particular digital service, that empowers people's interest into democratic processes.

Until now, as you've seen many examples, people tend to gravitate towards positions of authority during times of emergency, but when they keep seeing that maybe this is not the right way...

It doesn't work. [laughs]

When you see examples of the counterargument, maybe they will shift that mindset over there. Of course, for the next generation, they're going to be so used to this moving forward...

This co-creation process, because if people have tablets and notebooks during their primary school or even earlier, then they fact check their teachers. It's just what they do. [laughs] They co-create their own classrooms in Minecraft or something. That's the default for the digital natives.

In a sense, what we're doing is tapping the digital natives' experience serving building ambassadors of this open digital global democratic network to the people who are digital immigrants — I count myself because I immigrated when I was 12 — and to adapt to this new logic. There will be a transitional period, but the pandemic has greatly accelerated it.

Along with this, there's potential still for, not abuse, but to misuse the technology and digital services. You mentioned it, where people using the services, you can manipulate and how they use the services.

If I remember, another interview, you said it about profiling people using social media, ecommerce, gaming apps, etc., and finding ways to influence them. It's probably not tempting to you, but it's tempting to...

I don't want to manipulate people.

Of course, not.

It just is my brainwave.

It's also a matter of giving that trust to people, to Taiwan that there's no intention of doing it. How do you communicate that? How do you demonstrate that?

A lot of it boils down to the idea of appropriate technology. A technology is appropriate if it's not cutting edge. Usually appropriate technologies are not the latest integrators. Instead, it's something people understand.

During the pandemic for example, we implemented civil society invented contact tracing method, the 1922 SMS. The great thing about that is that there's no component in it that you don't already understand.

Even my grandma understand that if you text those 15 digits to 1922, what will happen. Instead many other jurisdictions use, for example, I don't know if Bluetooth dongles or things like that, which is also very effective, but it conveys a very different message to the citizens.

The point, what we're trying to make here, is that if we make sure that each and every individual component is built upon something that people can readily mix and remix, then it builds the rapports, the mutual support between the civil service on one side and the social movements on the other.

Especially if it is those human right groups and so on, designing those systems, then we escape from the dilemma of having the state own everything and therefore profile everyone, or multinational global corporations owning everything and then profiling everyone. Instead we can delegate to, or devolve really into the civil society led social sector first designs.

With this design, of course, we still work with private sector, but private sector now implements the norms that's already set by the social network.

Basically what you're saying is familiarity of interface is important. I need to know that the technologies I'm using, I need to understand them...

...and the freedom to remix. For example the week we pushed 1922, the SMS, the Google Play stores the five star rating of the line messenger goes like this. That's because a lot of people leaves one star marks saying the line, QR code scanner, doesn't recognize the SMS protocol. They tried and didn't work, so the app is broken.

Then a line, not a Taiwanese company, nevertheless adapted the main scanning service, so their rating goes up. This shows the support, the kind of even like a social contract. When people understand how it works, they know how to negotiate with private sector companies, and private sector company then implements the norms that's well understood by the people.

It's not just people understanding it, but also they have the agency to effect real change when it comes to the private sector.

Similarly, you also mentioned previously about what is it? Humor through rumor or something.

Yeah, sure. Humor over rumor.

Yeah, exactly. That's also a way of teaching people about this, the Bluetooth dongle is not going to do bad things that you may hear about it.

We don't use Bluetooth dongles. That's Singaporean. The Singaporean gov.tech did try to communicate in a very friendly way also and also using open source and public code. What I'm trying to say is that fundamentally it's still different.

The Singaporean model is more like the gov.tech, the government thinking of something and then convey it through friendly means to people. What we're doing is looking at what the human right activists and so on have invented, and then formally adopt it in the state, and then pushing the private sector to implement.

It's a social sector first approach. We're just following the people in a sense.

Another concern for people is about data protection. Again, going back to what you mentioned previously about confidentiality and integrity of data, how can people using digital services in Taiwan trust that their data is being handled with care?

Again, using the SMS 1922 as a running example, we don't keep the data. Your telecom, if you trust your telecom, then your telecom keeps those random numbers, but they don't know how those random members map to the venue.

This is what's called a PET, a privacy enhancing technology specifically oblivious federated story or whatever. Using these designs, you don't have to put blind trust in any particular data controller. Instead through design you can ensure that the service still gets accomplished, but there's nothing that a telecom doesn't already know about you ends up being revealed to the operator.

This is the principle usually code zero knowledge. If we apply this ZK idea everywhere then you do not have to overextend your trust, so to speak. There's some sort of trust of course, but that is a preexisting one. It's not like you have to trust someone just because you need this essential service.

This is even more important when it comes to the essential service, like proving your age of consent or things like that. If you have to accidentally also review everything that's printed on your ID card just to prove that you're 18, then it's not zero knowledge, it's the flip of their knowledge.

It's maximum of privacy leak which is why we're committed to implement as part of the Zero Trusts Network Architecture reform, the ZK principle toward all the essential services, including on My Data platform.

Part of that, one thing that we didn't talk about is about the friction of proving that consent, proving you're showing your idea. That creates friction and that creates...You're solving two problems then, essentially, right?

Yeah. Exactly. By making the privacy preserving option even more easy to use than the better days.

Another topic is around data residency and localization.

Oh, yeah.

Obviously you're not storing any data in some cases, but it is still on a lot of...

Yeah. Computation still relies on specific notes. Those notes either keep operating when our submarine cables are cut or they do not. It's very clear cut. We did actually in 2006 have submarine cables cut by earthquake.

Which is what we're planning. We're planning toward a scenario where earthquake cuts our submarine cables, maybe a human made earthquake. Then anything that keeps operating then means our standards.

It's quite different from the data residency impetus in many other jurisdictions. It's not out of a desire to nationalize source code or things like that, but rather we just want to keep working when the large earthquake happens.

That's the resiliency factor, right?

Yes.

We have a lot of countries who are trying — EU is trying GDPR, India is trying the digital personal data protection bill, we have SOC2. They're all attempting to tackle this complex problem, but not only residency, but protection, privacy, and all that.

This is legislative instruments and regulatory instruments that are just coming into maturity. Do you think they're going to be obsolete by technologies such as Web 3.0 which is basically decentralization.

Yeah. I think the GDPR, to be fair to it, actually has clauses like joint data controllership and so on, that deals with a more federative or decentralized use cases. In the later acts, the Data Governance Act, the Data Act and so on, also deals with this evolvement of technology.

As I mentioned, fundamentally, what we care about is — I don't want to use the word sovereignty — but the sense of summary is using Web 3.0. The freedom to co-determine how to co-create with a diverse stakeholders and essentially form your own network in the Internet network of networks.

If you look at that lens, then GDPR is a boon because GDPR mandates portability. Without portability, you cannot even bootstrap a network because everything is locked in. [laughs] In that sense, GDPR is a great help to our cause.

To your other point, which is how those long arm reach [laughs] of data rights and portability rights affect our own planning, I would say two things.

First, we want to cross recognize with other data protection regimes. We are a active party of the GDPR. We've been seeking GDPR adequacy for quite some time now. Within the next couple of years, we will have a independent DPA, which is the only remaining criteria for getting GDPR adequacy.

In all these accounts, we want to remain interoperable with all those data protection regimes. For the next couple of years, what we're focusing on is on a very tiny slice of it, which is the resilience part, which overlaps but certainly is not all of data protection.

Further to that, new technologies are constantly being developed. New ways of thinking about security and resiliency coming into the forefront. You mentioned zero trust. Recently, you also mentioned Taiwan is... What was it? Basically, you're using zero trust to protect against certain parts of cybersecurity or cyberattack.

Definitely.

A lot of these terminologies, a lot of these methodologies were not unknown, but were niche in the past. Now, they're coming to the forefront.

What are you doing at moda to constantly scan the horizon to see, "What's coming up? What's going to happen in 10 or 20 years from now? What should we pay attention to? What should we plan for"? How do you do that?

We run Presidential Hackathon. We run the Ideathon. We run many co-creation events with no monetary prize, last I checked, but rather have this amplifying effect as the main prize.

For the Presidential Hackathon, if your idea that work only on a small town or a municipality wins the trophy, then we guarantee that within the next fiscal year, there's personnel budget and regulatory support to take this cutting edge technology into a national mainstream, the norm.

Which is how we got, for example, the telediagnosis, the universal healthcare QR code, and so on, which are all Presidential Hackathon ideas. That was before the pandemic.

The fact that we guarantee their acceleration means that when the pandemic comes, it actually is right there. It saves us a lot of infrastructure work, because we've been forward looking through the co-creation, Presidential Hackathon, Ideathon events.

Of course, we still are active developers. [laughs] We tap into the community, and rely, in a sense, on the public research that's going on in Ethereum and in many other communities.

If those Presidential Hackathon adopted plural voting — which is quadratic voting — not because we're so cutting edge, but because it's already proven to work to a degree on the Ethereum community. In a sense, they're the research and we're the development.

To that, there's an example. One of my relatives who's a professor here in Taiwan who has a patent for cryptography, double oblivious transfer, something like that.

What he was saying is that all that thought, all those patents feed into a ministry. I forgot the name of the ministry. Some kind of government body that then looks at how they can adopt these things, the new ideas that are coming up.

It's the National Science and Technology Council. I'm a member.

Again, going back to it's up at democratizing where the future is coming from.

Exactly.

Rather than having a central think tank, or centralized trust of body or body of trust that thinks about everything for you, it's like you look. It's much more agile. It's much more responsive, and can hit the right...Have the right impact at the right time.

It's open innovation. We, in the software world, have known this for a very long time now.

Another question is around security, reliability, resiliency should be at the forefront of everything that you do, everything that you think about.

What are some of the examples of Taiwan's approach to cybersecurity when dealing with external actors or disaster readiness? You mentioned some disaster readiness about submarine cables being cut. I think you've...

We have to do satellites, I guess.

Useful.

Not just one constellation, because we don't know what happens to the operator, so many constellations. Strength through plurality is our main idea now.

It's, again, not relying on a single vendor.

Single vendor. That's right.

Single point of failure. It's resiliency through, again, for lack of a better word, democracy of...

Yeah.

Right?

If Cloudflare Workers go down, we'll switch to the Miniflare Worker instance running NCHC. [laughs]

Here, our idea is very simple. We don't use as default a single vendor for two interfaces that are next to each other. The fact that we're using Cloudflare Zero Trust means that we do not use WARP. We'll use CrowdStrike, or something. If we use Azure AD, then we don't use Intune.

That's the only way to test interoperability. If you use for all those layers the single vendor as what's usually done before moda, then the interoperability capacities are printed on the table, on the sheet, but it's never tested.

Now, we're testing, for example, TW FidO — which is our Ministry of Interior FIDO implementation — and interoperating it with Azure AD, or any other WebAuthn FIDO providers. We're a member of FIDO and W3C.

Once we adopt this, then it means that within each layer, we have a primary supplier. Then, we have multiple compatible suppliers almost by default. They are reference implementations to open source competitors in all of these spaces. When worse comes to worst, we can switch to the second or even the third solution provider.

Basically, you're saying you're trying to solve the vendor lock in problem. Not from a financial sense, but because some vendors, they prefer the whole models.

They give a great discount...

...if we lock all of our stuff in. There's incentive. [laughs]

That also comes with a risk.

Exactly.

Also, it's important to be completely independent, or not dependent on any one subset or one vendor.

Really, it's interdependent. For example, if we work with both low Earth orbit and middle Earth orbit satellite providers, then to completely disable our communication, you'll have to shut down three different constellations or more.

For public cloud hosting, for example, we arranged the local zone hosting with all the three public cloud providers. Again, to completely erase our way to thrive [laughs] during an earthquake, you have to attack all three major public cloud provider, which is very difficult, actually. That's strength in plurality.

A good example is going back to GPS technology for satellites. It's like the government could turn it off at any time. They did for some time during the Iraq War, I guess. You don't want to be dependent on that.

In a sense, the low Earth orbit can also be used for navigation.

It was an announcement that you made that Taiwan embraces zero trust.

Of course.

This is identity authentication, continued verification, and a never trust posture. Can you tell us how zero trust helps protect against a subset of cyberattacks? What's your vision about zero trust? Why this is so appealing for moda and for...?

Sure. To contrast with zero trust, of course, is a firewall perimeter, intranet, and so on. When we set up moda, we ensured that none of us have a desktop computer. Everybody's got laptops.

The reason why was that if you are tied to specific desktop computers, even if you say you want to do zero trust, you end up with something that's the worst of both worlds. You know what I'm talking about? I don't have to elaborate.

Once we ensure that there's no Internet, there's literally no intranet in moda, then people who care about security actually have to actively think, what does it mean to constantly verify? What does it mean to have the device authenticate?

What does it mean to simplify the biometric or whatever ways to verify your personal identity, in a way that takes even less time than typing passwords or inserting your citizen digital certificate to your desktop card reader.

Those actual uses, because I think the first week we started, I was diagnosed with COVID, so it was put to immediate test. I was home guarding for seven days and every system that I touch need to be fully ZTNA. Otherwise, it simply doesn't function.

Our MIS department end up doing a lot of R&D to make this work. Of course, CloudFlare helps a lot. They help us to convert, frankly speaking, very legacy systems into ZTNA without having to reprogram them.

After that initial boost trapping experience, we found that there are corners within the government that are still paper based. Because they did not trust the old intranet security model. It was good reason. They found many threat actors, many threat models that led them to conclude that maybe a physical paper with physical seal, with physical signature, is actually more secure.

It's done with rigor. It's a good assessment. it also bothers everyone because we all have laptops now. If you have to run a paper based process, it feels like extra work. Again, it's about flipping the default because if you are tied to your desktop anyway, then it doesn't feel like extra work.

By making sure that it feels like extra work we then work with the competent authorities in charge of those paper based processes and say, "However, with a ZTNA it's actually more secure than paper and more convenient."

This is actually the main selling point because it makes sure that the career public service can, I don't know, go home earlier. I don't have to work until 9:00 PM or something. Anything that improved the quality of life of public service end up being associated with their ZTNA.

That is why we are fully embracing the ZTNA because it offers the flexibility of adapting the workflow to their actual need, instead of forcing everyone to go into a security perimeter, enclave, or things like that, and therefore make them, even later, to go home.

Because the perimeter always has some holes somewhere.

Exactly.

We just spoke about zero trust. That's just one subset of the types of attacks that you're trying to protect yourself against DDoS, as you know, data theft, information manipulation. Especially information manipulation because you do make a point when you say that, "Hey, cyberattacks is not just DDoS."

No.

It is not just data theft. It's about how to change the disinformation...

It's how you frame the DDoS.

Yeah. You also mentioned a very interesting concept. In Taiwan at the school level, you people are taught to fact check.

Yeah. They fact check the presidential candidates.

It's constant observation. There's so many eyeballs constantly, so many brains constantly looking at them and...

Yeah. I get fact checked all the time by students.

Is this the same thing as this similar or a human equivalent of zero trust?

It's a very interesting analogy. It's certainly always verified. That part is the same. Basically don't take even my word for it but simply always verify. Of course, it is a stretch if you associate it with device authentication or things like that.

This always verify really is it comes from a democratic principle. Because in a democracy you're supposed to always verify. If you do not then it's democracy which was a ritualistic voting or things like that, and truly not a democracy.

Always verify comes first. It comes from a democratic attitude. It's the other way around. It's the zero trust trying to look at the security policies and say, "Maybe we were not always verifying. We were not constantly verifying. Maybe we over rely on the maximal privilege of a certain authority figure. Maybe the minister always get all the privilege, which should not be the case."

In a sense, I think it's adapting those democratic principles into network security.

It's not just about authoritarianism. It's about having human bias. You're thinking a certain way because of the environment you are in. Things like that also lead you to a certain position, whereas perhaps it's going back to zero trust model, it's about don't trust by default. Don't assume what you're hearing is correct.

It's about trusting one's own agency of competence, of critical thinking and so on. In a sense, zero trust means not having blind faith, but rather trusting one self's competence and the competence of people who practice similar models.

Tell me more about moda and the people of moda. There's a whole bunch of people who are always thinking about this, always thinking about the current problems, always thinking about the future, always thinking of how to democratize what you're doing. Who are these people? Let's celebrate them.

Yeah, let's celebrate them. Do you want to talk about yourself?

English is fine.

English is fine. We love food. Food brings us together.

Yes. For a while. Yeah.

I think it's just about creating a sense of appreciation for the complexity of the problems that we're dealing with on a daily basis. You're dealing with certainly. It's difficult to convey that across in a media soundbite or things like that. These things require thought.

Thought is something very precious in terms of attention span. You need to find a way to get this across in a very concise meaningful message.

Very good cake. Thank you.

Cloudflare have given us very good discounts and to get...

...very quickly to launch services in the face of emergencies.

Yeah, and we had a call with Patrick on this. Patrick came to me and said, "Hey, we don't care about commercial aspect of things at this time. We want to make sure that everything is OK."

This is during the Pelosi visit, around that time. What can we do to help? Forget about everything else, just help. I think that's very dear to our heart. It's not about a commercial angle.

No.

We can see that. That's embedded into everything that we do, not just with you, many other things. I have a completely non commercial background. I'm just looking after customer support, and I see this every day with the customers that we deal with.

It's our mindset towards getting things right and doing them rightly as well. I really, really appreciate what you do. I'm a big fan of you.

Thank you. Many of you have already met, either online or...

Yes, last week 周詳 used Cloudflare Worker to make many cool services.

We talk about worker for integrate Gitlab and GitHub, and make it using our page worker integrate.

That's great.

Our website, 周詳 showed URL shortening service from the workers, and it's very cool.

It just works but it's excellent. Where I also came from a very non commercial background because he was a police officer. He also majors in machine learning and computer vision. What's your thesis topic again?

Vision for 3D Point Cloud, computer vision. Right now I'm full time in moda. My PhD is pending.

It's pending... somewhere.

My essay right now is moda.

Before you joined moda, we were just checking out the data market of the National Science and Technology Council that infuses all the data from everywhere. I was looking at it during the Luna New Year vacation.

I saw Wjke's name on the data market because he was working with the Hsinchu City government before moda that does traffic planning as the one to make the traffic police work easier...

CCTVs.

Yes. So you share the concerns about zero knowledge, about privacy preservation and enhancing technologies, about data residency and so on. He's got this full stack all the way to having the fiber optics laid out to maintain a actual intranet and so on. Very hardcore, very full stack.

In the moda, we don't have the intranet fiber. Right now, we use a lot of Cloudflare Access and DDos prevention to protect our service outside. Maybe we will put some more service on our cloud.

Or maybe for example GCP, it also can inside the CloudFlare, so it's very good for us to build a lot of infrastructure issue for cloud manage.

Yeah, exactly. The point I'm making is that we need people, and our people are like that, to speak both the legacy systems language and are frankly speaking experts in the pre zero trust network architecture world, so much so that they can see the limitations and then transfer those into actual future requests to the ZTNA world, and evaluate whether it actually gets answered.

If it doesn't, then we have to do more development. If they do, then they carry a certain gravitas when they talk to their old colleagues and say, "You can feel safe migrating to this new model."

Not only so much from the legacy side of things, but also from different use cases. For example, you were talking about traffic. You might think, "What does that have to do with moda?" but it does.

It does.

Having those different mindsets, different thoughts intersecting in a single place with a common goal, with a common problem to solve, it makes the solution a lot more robust.

It also adds to a certain culture of not being afraid of working in the open and say that, "This is a open research problem. We don't even know how to solve that. If you're interested, join our presidential hackathon or whatever."

In the old days of authoritarian models, one is supposed to come up with all the solutions, and if one doesn't, one don't say it publicly. With people who are well versed in those worlds, they know that the old model doesn't work anyway, [laughs] so it's OK to simply state that, "We've solved this particular issue."

For example, using static pages and IPFS, we've solved our availability problems for our static websites. "The IPFS doesn't yet do dynamic updates, and there's a limitation. We feel comfortable saying that.

Contrast that to the other scenario, where if you want to switch to a new system, you have to do bug-for-bug compatibility. That solves all the problems that the old systems purported to solve. That will hinder the progress. This incrementalism is very important.

If you go like for like, you also inherit the same problem you previously had.

Exactly. That's right.

We deal with this from an engineering standpoint at Cloudflare every day, because the products that we have are used by many, many people. We have to make it easy to use, we have to make it security conscious, resilient. All the same challenges that you're facing at moda, we also face.

You mentioned feature requests. We, of course, take it very seriously. What else can we do to help?

A lot, actually.

We already talked about, during our initial conversation about IPFS and Ethereum gateways, how you plan to make the ad-hoc worker-based solutions and so on that we use to, for example, automate deployments, automates all kind of workflow processes, and so on into something that's more generally available and supported.

The mainstreaming of these two technologies is something that interests both of us, because when we joined the W3C, we specifically, in addition to accessibility, security, anything that we should care about, we also care about decentralized identifiers.

The Democracy Network Department within our ministry is explicitly tasked to investigate to the DIDs. DIDs rely on a mainstreaming of a common knowledge player of the Internet, of which, of course, IPFS and Ethereum are some of those common knowledge players.

By making it not esoteric, but rather as simple as, for example, HTV3 or things like that, that's something that we overlap in a lot of our interests.

On another topic, what about quantum computing? Does moda play any kind of role in that?

Anything that's more than four years in the horizon that's the NSTC. That's the National Science and Technology Council. We focus, along with our National Institute of Cybersecurity, on things that can be rolled out in the next four years.

It involves, for example, quantum resistant cryptography, but jot quantum computing, because it's different time horizon.

That's coming up soon.

Soon. Very exciting.

Yes, it is. What about on the regulatory side, do you constantly interact with the regulators and the legislative bodies?

Yes.

Even with GDPR. You said the design of GDPR is robust and it actually forces us to think about how to implement that design. If you do implement that design properly, then it actually helps everyone. It's not obsolete. Legislation is not necessarily lagging where...

It's only obsolete if you implement a particular implementation that is foreclosing future possibilities. if you implement it in a way that's extensible as the EU IDAS infrastructure it's trying to do. It's not preventing any particular member countries from coming up with more creative versions of interoperating with existing identity regimes.

During the pandemic the EU DCC is another very good example. Even though we're not part of the EU, we were very successful in interoperating with the EU digital vaccine certificate, that later on the same code base also interact with the smart health certificate — the SHC.

The point I'm making is that I think if our code base is commonly shared with the infrastructure or code, some people call it the DPI — digital public infrastructure — that's actively used and developed around the world, then any gaps between particular implementations of GDPR can actually refer to a creative implementation that satisfied the spirit of the law.

This legality then carries over to our use of the same common component. If we insist on developing everything ourselves from a software stack perspective, then we'll have to constantly reinvent the same creative interpretations. That's a very difficult role.

Actually in some sense some people think that there's a friction between legislation and technology. Technology wants to go ahead. Then legislation wants to pull it back.

No.

That's not really the case.

No, I don't think that's the case. It is the case if the technology brings people farther away from one another. If the technology fosters polarization, if it fosters anti democratic actions, if it discourages people from voting or participating in the democratic process in these senses like antisocial social media, really we do see other democratic jurisdictions passing laws trying to wring in such counter democratic forces in technology.

The kind of technology we're describing — appropriate technology, public code, digital public infrastructure, and so on — is the prosocial force. The more people implement this kind of mindset, the more people feel that, "Oh, democracy is not just about voting every four years, but rather about a day to day.

Sending pull requests to moda, for example, is democracy. The more people engage in that, the less we need to wring anything. Rather, our legislation is then just to encourage this kind of expression by the community.

It's fully open source basically?

Exactly.

Moda is open source?

Yeah, of course. Oh, we call it public code because we relinquish our copyright by CC0, which is technically not a open source license. That's very pedantic. We say we're public code or we're CC0. "No rights reserved" as written on our home page.

Yeah, that's refreshing.

Mm-hmm.

Thank you.

Thanks. Any other topics? It felt remarkably like a panel.

Q&A.

Yeah. Q&A for the fireside chat.

I have a one question.

Yes.

As a Taiwanese, I'm so proud of I was born in a country. It's freedom country. I always have choice. I'm also proud of the company I belong to. I only have three different jobs and Cloudflare is my third job. I really appreciate the vision of our company and they encourage us to do the right thing and they want to support the country, the government.

I can help wondering if I'm employee of moda, it would be very difficult. It's a not easy job because what you mentioned you want to leverage a different solution. How do you ensure their skill set is ready, and how do you develop your talent, your army, to help you overcome the challenge and build the solution for our Nation?

Yeah. We simply look at all the open source conference presenters. COSCUP, SITCON, and so on. The open source community have one thing going for it in Taiwan.

In that even people who are very experienced, like literally CEOs or CEO, many of them take a weekend or two every month to participate in the open source community. In g0v, we see some of the most senior leadership position like entrepreneurs but they still donate their time to effect social impact and social change.

That's very unique. The venue we have, our National Academy, is known for being politically neutral. If you go to National Academy to run a government subsidized venue you're not seen as being co-opted by the government because the National Academy reports only to the president and no other ministers

It's independent from all the universities and all the ministries. When the people who belong to one party or another, one ideology or another, and so on, nevertheless there's a incredibly neutral ground in the National Academy that they can go every month or so, or every week, there's some event there.

Basically we just tap into that community and see the people who want to embrace this co-creation across diversity, willing to work with people who speak different languages of different cultural backgrounds, different ideology, through the work of appropriate technology which then we just tap these people.

Nowadays we're still recruiting. In a month or so we'll start recruiting even more people throughout new National Institute of Cybersecurity. We are working with many of the community leaders to ensure that on topics such as design systems, ZTNA configuration and so on, there's a new team that will develop on the public code first way.

Because previously many of these were done by the, for example, Institute for Information Industry, or the ITRI and so on, which are all institutes that do not have a public code default culture. Because we want to show to the community, that they can contribute their spare time also to the national cybersecurity infrastructure through what they're already doing, like sending poll requests and so on, so we need a bridging team of around 40 people.

To your question, we look at the community and the kind of time they can contribute. They either do part time contribution or full time but just for three years or so on a bridging way. If they truly like public service, at any given time, they can become moda staff proper.

I see. How to avoid information leak? Do you need to sign an NDA and to...

Of course. There's a full background check for anyone who join the NICS.

Thank you.

Do you think this mindset you just described about public service, everything we spoke about today, do you think Taiwan is particularly embedded in such things because of the constant threat, either natural or man made, and that is what's driving, is firing this passion?

It's this clarity, this urgent clarity. It's urgency with clarity. Sometimes, there's urgency, but there's no clarity of vision. Maybe politically, there's the left, the right, or whatever polarization, but in Taiwan, the political conversation is all around resilience now.

None of those four major parties in the government, in the Parliament, is even a little bit against, for example, the National Institute of Labor Security because that what everybody see is needed.

If we, through our work in moda and NICS, connects to the world, to the democracies that care about Taiwan like during last August there's a lot of people donating their spare hard drive, IPFS, to help us stay afloat. I got many emails from many communities around the world thanks to the Web3 Gateway.

Protocol Labs contract us immediately carrying a very similar message as you just said from Cloudflare, "Whatever we can do to help." Through this, we connect with democratic network. That, again, is urgency and clarity in one.

None of our parliamentary parties is against us engaging more democracies in the world. I think we're very fortunate in that we're in this intersectional zone of a shared clarity and urgency.

I think when we really want something, the whole universe will help us.

Exactly.

That resiliency is mainly possible due to democratization...

Exactly.

...of effort, of mind, and will.

You were trying to say something?

No. I just really happy being here. We have some meeting with deeper in the department, I mean part of the group, government deployment. Because moda, they willing to understand more about cybersecurity, and I'm very happy for that.

Even maybe they don't have kind of virtual discussion, I'm still very happy because they are willing to know more about the cloud solution, the soft solution. They already understand our solution. I'm very happy for that.

Thank you.

I'm happy to help moda...

We're happy that you're helping us.

Everyone happy.

If you want to try some new future features...

Yeah, we're glad to try.

Because we are SaaS provider, we can enable more future immediately.

Very good. Thank you.

Every week, every Friday, we have a soft pitches update. Maybe you can have a contact window with our...

周詳 and me will have a check.

I think it's important to realize that this is not a political discussion. It's not a commercial discussion. It's about mindset, right?

Exactly.

That transcends any kind of politics. It's not about left right and not about this country, that country, but the message. Always, there are subtle message in that willingness or desire to help. It's not to do with...There's no agenda as such.

That's right.

This is beneficial to every human being.

That's the vision of the original Internet. Before Internet, people who share similar values are not neighbors. The Internet is built such that people who are from very different intranets can actually discover each other and form able communities.

A lot of us are working to further the original Internet's vision just bring it to more things. Previously the Internet wasn't designed with identity payments or whatever in mind. It's mostly about sending emails and write packets.

Now more and more we understand that the social fabric, if it's learns from the Internet, so that is a network of networks, then it automatically brings the people who share the same values into neighborhoods.

Which is why we see the Internet of beings, the Internet of everything is now extending to more and more parts of this society. That's the moda's vision too. Yeah.

As moda is very important. The vision to lead Taiwan to have a substitute in this kind of solution. I really hope and you will impacted the whole Taiwan outcome, other industry, like hiding the joy in your finance to move faster.

Definitely. Because they always see our partnership as moving forward together. That's the only way moda can do the work -- moda can help.

It's also not just Taiwan. Yes. We're here in Taiwan, we're talking about Taiwan, but this is far more profound, far more impactful than just for Taiwan.

Yeah, definitely. When we first designed moda, it was not mainly for resilience, it was mainly for industry of digital transformation. Then the Ukrainian situation happened at the Russian annexation. then we saw that maybe there's a better metaphor.

During the war we've seen that a democracy connected through electronic services in particular idea enabled really collective intelligence, and not just intelligence in the military sense but rather a kind of collective wisdom of how to react to true adversity in a way that elevates the spirits of everyone, the likes of which has never really been seen on a national scale.

Then we said everybody can learn from Ukraine, and then digital resilience for all become our slogan and free in the future. To the end, many people are now looking at these experiences like beer and so on, and rethink about the original assumptions when it comes to this security or the trustworthiness and so on.

To your point, there are many like FinTech operators interested in Ukraine, because before the war, Ukraine was also a data residency jurisdiction. It certainly did not engage with public clouds that much.

They, out of necessity, did a full reconfiguration while having to still enhance the security because without which they would lose the war. Just tracing through the same process is the process that many decision makers in the finance industry and so on, have been thinking for the past year or so.

I think just piggybacking on that, we can offer very similar services and interpret it so that we can say, "Oh, if you work with the public infrastructure in the public cloud with this and these battle-tested criteria, then even when all our submarine cables are cut your data is safe, your computation is safe." and so on.

That's a much more convincing argument than simply "Audrey Tang says so."

Just very sorry for late joining.

No worries.

Yeah. I think cybersecurity is national security. I'm very glad see that the moda beauty, and if by Audrey. You are a very good leader and different to the traditional political person. Thank you.

Thank you.

Not to sound like Audrey fan club... What's one of the mistakes that moda has made that you've learned from?

Yeah, a lot. Actually even before moda, our first collaboration with CloudFlare had many people, so very publicly, that the traffic went through Singapore for a few hours. That's like the one image of CloudFlare that was on everyone's mind. When we first started 1922.gov.tw. That's literally the first screen that many have seen.

It really started a very good conversation. Because then the legislators, our department of cybersecurity people and so on, all went back and look at what actually happens when CloudFlare processes incoming requests. What would it take for a sovereign county to take over CloudFlare?

All the difficult questions, because it involved the universal healthcare number. It's not health data per se, but it is a number that many people associate with the most sensitive of personal information.

So we fixed the routing in just a few hours. Again, people saw the agility of a SaaS model, if we have configured that in our router, in our server rack, in an outpost server and so on, it would take longer.

Then we get the explanations very clear and concise from CloudFlare of what actually happens. Then we talk about how to re-route the traffic. That's done in a very transparent manner. The MPs remember that. The ministers remember that.

I think really it's a case of "there's a crack in everything, and that's how the light gets in." This initial experience, we can certainly call it a mistake. This initial mistake led to the conversations that enhance everybody understanding about what does it take to configure a cloud service so that it's safe, reliable, trustworthy, and so on.

Immediately after that, we made many more mistakes when it comes to worker configuration for waiting room, and that was also on the news. It showed to people that they need to wait like 4,000 hours or something. Then it's fixed very quickly. Again, very rapidly. The parameters adjusted rapidly.

So much so that our main service, 1922, who didn't want to use waiting room because of the initial impressions, eventually did adopt it because they saw how, as you said, it's not about a commercial deal, but a true partnership, because it's also cutting edge technology for you. You were also just prototyping that technology.

We co-created a different kind of response pipeline and so on for that. I recount all these details because it's important to show publicly the mistakes are corrected, even faster than our existing weekly iteration during the pandemic. Always, it's fixed in a matter of hours.

Then that's what ultimately won the heart and minds of the major system integrators that are in charge of some of the largest public infrastructure. So much so that in the 6,000 anti dollar service we don't even have to tell them to use contract. It's just assumed now.

I think those mistakes are very pedagogical, so to speak. It's a public textbook, so to speak, for many people in the public service.

I guess you can say it's both doing the right things and doing them rightly. Part of that doing them rightly, is to rapidly iterate and solve the problems that they come in and to build that trust in a transparent manner.

Exactly. Instead of saying "let's just use it on minor services and test it for two years. Open a public bid and evaluate and things like that instead of this testing production thing..." -- during those times, the urgency of getting everybody vaccinated just supersedes all these concerns.

Again, they fast track this mutual trust-winning processes. I think owning up to those mistakes and correcting it literally with everybody watching the 2:00 PM CECC press conference and me bringing up the CloudFlare analytics during the CECC conference, and say that waiting room problem has been resolved.

All of that is a very much part of this public education processes.

Thank you very much.

Thank you.

Again and thanks to your team and thanks to moda for graciously giving your time for us. Thank you.