Nerio Musa: I have a little nephew of mine who’s two years old, and he just learned something today, this week. I’m visiting with my partner, she’s Taiwanese. I come to Taiwan a lot, and it’s a wonderful place.

Audrey Tang: Do you speak Taigi, Hakka, or any of our 20 national languages?

Nerio Musa: No, she keeps trying to teach me. I’m sure she would love me to learn soon, but I would be very embarrassed to speak.

Audrey Tang: It’s fine. It’s fine. According to reliable sources, GPT will pass Turing test next month, so we’ll just delegate everything to them. Awesome. What’s the agenda today?

Nerio Musa: The agenda is, we have everyone here from Cloudflare. We are very honored to be here, and thank you for taking the time to speak with us today. It’s just about your vision. What do you want to accomplish with MoDA in terms of the digital services?

Nerio Musa: The complexity behind the services that you will deliver that’s sometimes opaque to people who may not understand or who don’t know what’s behind the app.

Audrey Tang: In case of machine learning, it’s opaque to itself, too…

Nerio Musa: Yeah.

Audrey Tang: Very opaque.

Nerio Musa: Just to start off, it’s about moda and the services that you hope to deliver to Taiwan use and to Taiwan. A lot of it being my partner and her parents being here, I get to see the other side of things. It’s about educating people about technology and how to use that technology.

Nerio Musa: Making them aware of what’s available, how to access those service. Then, the services themselves. What value add those services can provide on top of what they could receive already from physical community centers, things like that?

Nerio Musa: Then, of course, the topics behind…You mentioned in an interview recently about confidentiality, integrity, and resilience of these services. How do you accomplish that at moda?

Nerio Musa: The last topic will be around technopolitical topics such as access management, data privacy, things like GDPR, and how regulation is sometimes catching up. Where regulation needs to go in order to provide a fair and robust and secure set of services for citizens of any country.

Audrey Tang: Sure.

Nerio Musa: The first thing I want to talk to you about is moda. It has a very important mission. What’s your vision, and what are you trying to accomplish with moda? Some examples of the successes of moda so far.

Audrey Tang: Our slogan is #FreeTheFuture. It means to foster collaborative diversity. The kind of services or solutions that works today may end up limiting the freedom of the next generations if they’re locked in to specific courses.

Audrey Tang: Some authoritarian regimes say that allowing mobilization is very effective, it’s very efficient, and so on. Maybe so for a very well defined problem. If the virus mutates or [laughs] anything changes, then this kind of top down measures no longer work. It may actually backfire.

Audrey Tang: We’re the contrary of that. We’re making the state transparent to its citizen, not the citizen transparent to the state. We want to make sure that anyone out there who has a better idea as of how to overcome the societal challenges are given the full canvas of the public code, open data, APIs, and so on to figure out the solutions, which is why we say we work with the people not for the people.

Audrey Tang: That’s the main idea behind freeing the future. To that end, of course, we work with very plural technologies, our stack. We try very hard not to being locked in on specific vendors. We make sure that the kind of people you mentioned, we empower the people who empower them.

Audrey Tang: Instead of asking them to all convert to, I don’t know, PDF — sorry, it’s a joke because if you type “convert to Google” it’s just PDF…

Audrey Tang: …not particular relation — convert to any particular file formats like filing PDF online, but to ensure that even if 10 percent of people who do not like digital services and prefer instead face to face, over the counter transactions can find someone who cares about them personally. That person, instead of having to handle all the analog paper stuff is fully empowered.

Audrey Tang: The examples I can give that we’re going to issue NT$6000 to everybody soon, including people with a permanent resident certificate. I don’t whether you’re…

Audrey Tang: …back or not. In this handing out cash, we ensure that people who prefer, who are comfortable with websites simply type their bank account, and that’s it. Then it’s wired to their bank account. People who don’t want to type anything online, who trust their bank’s automatic teller machine, can go to the ATM and get NT$6,000 cash.

Audrey Tang: The people who don’t trust either nevertheless can show up at their local post office, present their identities and so on, and then withdraw cash from the post office. The post office worker is not overwhelmed because the backend is all integrated.

Audrey Tang: This shows the kind of taking care of the people by empowering people closes to the pain while leaving open the infrastructure so that people who figure out better ways to get similar payments and so on can tap into this public infrastructure. Which is why we need to design so it’s extensible to the future.

Nerio Musa: If you think about it, this mindset, this way of thinking, not working for the government, working with that kind of thing, is a huge shift for people who think in terms of, “We have to have a strong government, a strong ministry to do this.”

Nerio Musa: How do you how do you explain that to people in layman’s terms? It’s difficult for somebody to understand that, and then, for example, to be able to…You were doing this through Taiwan’s one tablet per child thing, and we’re doing it for the future. There’s still a transition period that we need to go through, which that shift in mindset…

Audrey Tang: I was born into a martial law, so [laughs] I know what you’re talking about. There are still people who prefer a strong leader and assume a strong leader who dictates things, that the elites must know the best for the people.

Audrey Tang: During the past three years, everybody around the world saw that it’s not like that. It’s not the case, whether it’s about a pandemic, which is a mutated virus, or about a disinformation crisis, the infodemic, which is another mutating virus, or cybersecurity, which is another mutating virus. [laughs]

Audrey Tang: Things that look like that simply do not respond to the authoritarian logic, to the top down logic, to the dictates. Even the people who are following the pandemic guidelines and so on, they need adaptations because the virus itself adapts.

Audrey Tang: A lot of our philosophy gets honed and tested during the three years of the pandemic, and that is what distinguishes our philosophy with many other philosophies around the world.

Audrey Tang: To your point, there’s another point here. If we make sure that the people who think about, for example, the visualization of mask rationing, preregistration vaccines, and so on, get their ideas implemented within the next iteration, which is usually a week or two, then people know what this agile mindset feels like.

Audrey Tang: It’s democracy, just with a faster iteration, with a faster co-creating cycle. It’s this experience, more than any particular digital service, that empowers people’s interest into democratic processes.

Nerio Musa: Until now, as you’ve seen many examples, people tend to gravitate towards positions of authority during times of emergency, but when they keep seeing that maybe this is not the right way…

Audrey Tang: It doesn’t work. [laughs]

Nerio Musa: When you see examples of the counterargument, maybe they will shift that mindset over there. Of course, for the next generation, they’re going to be so used to this moving forward…

Audrey Tang: This co-creation process, because if people have tablets and notebooks during their primary school or even earlier, then they fact check their teachers. It’s just what they do. [laughs] They co-create their own classrooms in Minecraft or something. That’s the default for the digital natives.

Audrey Tang: In a sense, what we’re doing is tapping the digital natives’ experience serving building ambassadors of this open digital global democratic network to the people who are digital immigrants — I count myself because I immigrated when I was 12 — and to adapt to this new logic. There will be a transitional period, but the pandemic has greatly accelerated it.

Nerio Musa: Along with this, there’s potential still for, not abuse, but to misuse the technology and digital services. You mentioned it, where people using the services, you can manipulate and how they use the services.

Nerio Musa: If I remember, another interview, you said it about profiling people using social media, ecommerce, gaming apps, etc., and finding ways to influence them. It’s probably not tempting to you, but it’s tempting to…

Audrey Tang: I don’t want to manipulate people.

Nerio Musa: Of course, not.

Audrey Tang: It just is my brainwave.

Nerio Musa: It’s also a matter of giving that trust to people, to Taiwan that there’s no intention of doing it. How do you communicate that? How do you demonstrate that?

Audrey Tang: A lot of it boils down to the idea of appropriate technology. A technology is appropriate if it’s not cutting edge. Usually appropriate technologies are not the latest integrators. Instead, it’s something people understand.

Audrey Tang: During the pandemic for example, we implemented civil society invented contact tracing method, the 1922 SMS. The great thing about that is that there’s no component in it that you don’t already understand.

Audrey Tang: Even my grandma understand that if you text those 15 digits to 1922, what will happen. Instead many other jurisdictions use, for example, I don’t know if Bluetooth dongles or things like that, which is also very effective, but it conveys a very different message to the citizens.

Audrey Tang: The point, what we’re trying to make here, is that if we make sure that each and every individual component is built upon something that people can readily mix and remix, then it builds the rapports, the mutual support between the civil service on one side and the social movements on the other.

Audrey Tang: Especially if it is those human right groups and so on, designing those systems, then we escape from the dilemma of having the state own everything and therefore profile everyone, or multinational global corporations owning everything and then profiling everyone. Instead we can delegate to, or devolve really into the civil society led social sector first designs.

Audrey Tang: With this design, of course, we still work with private sector, but private sector now implements the norms that’s already set by the social network.

Nerio Musa: Basically what you’re saying is familiarity of interface is important. I need to know that the technologies I’m using, I need to understand them…

Audrey Tang: …and the freedom to remix. For example the week we pushed 1922, the SMS, the Google Play stores the five star rating of the line messenger goes like this. That’s because a lot of people leaves one star marks saying the line, QR code scanner, doesn’t recognize the SMS protocol. They tried and didn’t work, so the app is broken.

Audrey Tang: Then a line, not a Taiwanese company, nevertheless adapted the main scanning service, so their rating goes up. This shows the support, the kind of even like a social contract. When people understand how it works, they know how to negotiate with private sector companies, and private sector company then implements the norms that’s well understood by the people.

Audrey Tang: It’s not just people understanding it, but also they have the agency to effect real change when it comes to the private sector.

Nerio Musa: Similarly, you also mentioned previously about what is it? Humor through rumor or something.

Audrey Tang: Yeah, sure. Humor over rumor.

Nerio Musa: Yeah, exactly. That’s also a way of teaching people about this, the Bluetooth dongle is not going to do bad things that you may hear about it.

Audrey Tang: We don’t use Bluetooth dongles. That’s Singaporean. The Singaporean gov.tech did try to communicate in a very friendly way also and also using open source and public code. What I’m trying to say is that fundamentally it’s still different.

Audrey Tang: The Singaporean model is more like the gov.tech, the government thinking of something and then convey it through friendly means to people. What we’re doing is looking at what the human right activists and so on have invented, and then formally adopt it in the state, and then pushing the private sector to implement.

Audrey Tang: It’s a social sector first approach. We’re just following the people in a sense.

Nerio Musa: Another concern for people is about data protection. Again, going back to what you mentioned previously about confidentiality and integrity of data, how can people using digital services in Taiwan trust that their data is being handled with care?

Audrey Tang: Again, using the SMS 1922 as a running example, we don’t keep the data. Your telecom, if you trust your telecom, then your telecom keeps those random numbers, but they don’t know how those random members map to the venue.

Audrey Tang: This is what’s called a PET, a privacy enhancing technology specifically oblivious federated story or whatever. Using these designs, you don’t have to put blind trust in any particular data controller. Instead through design you can ensure that the service still gets accomplished, but there’s nothing that a telecom doesn’t already know about you ends up being revealed to the operator.

Audrey Tang: This is the principle usually code zero knowledge. If we apply this ZK idea everywhere then you do not have to overextend your trust, so to speak. There’s some sort of trust of course, but that is a preexisting one. It’s not like you have to trust someone just because you need this essential service.

Audrey Tang: This is even more important when it comes to the essential service, like proving your age of consent or things like that. If you have to accidentally also review everything that’s printed on your ID card just to prove that you’re 18, then it’s not zero knowledge, it’s the flip of their knowledge.

Audrey Tang: It’s maximum of privacy leak which is why we’re committed to implement as part of the Zero Trusts Network Architecture reform, the ZK principle toward all the essential services, including on My Data platform.

Nerio Musa: Part of that, one thing that we didn’t talk about is about the friction of proving that consent, proving you’re showing your idea. That creates friction and that creates…You’re solving two problems then, essentially, right?

Audrey Tang: Yeah. Exactly. By making the privacy preserving option even more easy to use than the better days.

Nerio Musa: Another topic is around data residency and localization.

Audrey Tang: Oh, yeah.

Nerio Musa: Obviously you’re not storing any data in some cases, but it is still on a lot of…

Audrey Tang: Yeah. Computation still relies on specific notes. Those notes either keep operating when our submarine cables are cut or they do not. It’s very clear cut. We did actually in 2006 have submarine cables cut by earthquake.

Audrey Tang: Which is what we’re planning. We’re planning toward a scenario where earthquake cuts our submarine cables, maybe a human made earthquake. Then anything that keeps operating then means our standards.

Audrey Tang: It’s quite different from the data residency impetus in many other jurisdictions. It’s not out of a desire to nationalize source code or things like that, but rather we just want to keep working when the large earthquake happens.

Nerio Musa: That’s the resiliency factor, right?

Audrey Tang: Yes.

Nerio Musa: We have a lot of countries who are trying — EU is trying GDPR, India is trying the digital personal data protection bill, we have SOC2. They’re all attempting to tackle this complex problem, but not only residency, but protection, privacy, and all that.

Nerio Musa: This is legislative instruments and regulatory instruments that are just coming into maturity. Do you think they’re going to be obsolete by technologies such as Web 3.0 which is basically decentralization.

Audrey Tang: Yeah. I think the GDPR, to be fair to it, actually has clauses like joint data controllership and so on, that deals with a more federative or decentralized use cases. In the later acts, the Data Governance Act, the Data Act and so on, also deals with this evolvement of technology.

Audrey Tang: As I mentioned, fundamentally, what we care about is — I don’t want to use the word sovereignty — but the sense of summary is using Web 3.0. The freedom to co-determine how to co-create with a diverse stakeholders and essentially form your own network in the Internet network of networks.

Audrey Tang: If you look at that lens, then GDPR is a boon because GDPR mandates portability. Without portability, you cannot even bootstrap a network because everything is locked in. [laughs] In that sense, GDPR is a great help to our cause.

Audrey Tang: To your other point, which is how those long arm reach [laughs] of data rights and portability rights affect our own planning, I would say two things.

Audrey Tang: First, we want to cross recognize with other data protection regimes. We are a active party of the GDPR. We’ve been seeking GDPR adequacy for quite some time now. Within the next couple of years, we will have a independent DPA, which is the only remaining criteria for getting GDPR adequacy.

Audrey Tang: In all these accounts, we want to remain interoperable with all those data protection regimes. For the next couple of years, what we’re focusing on is on a very tiny slice of it, which is the resilience part, which overlaps but certainly is not all of data protection.

Nerio Musa: Further to that, new technologies are constantly being developed. New ways of thinking about security and resiliency coming into the forefront. You mentioned zero trust. Recently, you also mentioned Taiwan is… What was it? Basically, you’re using zero trust to protect against certain parts of cybersecurity or cyberattack.

Audrey Tang: Definitely.

Nerio Musa: A lot of these terminologies, a lot of these methodologies were not unknown, but were niche in the past. Now, they’re coming to the forefront.

Nerio Musa: What are you doing at moda to constantly scan the horizon to see, “What’s coming up? What’s going to happen in 10 or 20 years from now? What should we pay attention to? What should we plan for”? How do you do that?

Audrey Tang: We run Presidential Hackathon. We run the Ideathon. We run many co-creation events with no monetary prize, last I checked, but rather have this amplifying effect as the main prize.

Audrey Tang: For the Presidential Hackathon, if your idea that work only on a small town or a municipality wins the trophy, then we guarantee that within the next fiscal year, there’s personnel budget and regulatory support to take this cutting edge technology into a national mainstream, the norm.

Audrey Tang: Which is how we got, for example, the telediagnosis, the universal healthcare QR code, and so on, which are all Presidential Hackathon ideas. That was before the pandemic.

Audrey Tang: The fact that we guarantee their acceleration means that when the pandemic comes, it actually is right there. It saves us a lot of infrastructure work, because we’ve been forward looking through the co-creation, Presidential Hackathon, Ideathon events.

Audrey Tang: Of course, we still are active developers. [laughs] We tap into the community, and rely, in a sense, on the public research that’s going on in Ethereum and in many other communities.

Audrey Tang: If those Presidential Hackathon adopted plural voting — which is quadratic voting — not because we’re so cutting edge, but because it’s already proven to work to a degree on the Ethereum community. In a sense, they’re the research and we’re the development.

Nerio Musa: To that, there’s an example. One of my relatives who’s a professor here in Taiwan who has a patent for cryptography, double oblivious transfer, something like that.

Nerio Musa: What he was saying is that all that thought, all those patents feed into a ministry. I forgot the name of the ministry. Some kind of government body that then looks at how they can adopt these things, the new ideas that are coming up.

Audrey Tang: It’s the National Science and Technology Council. I’m a member.

Nerio Musa: Again, going back to it’s up at democratizing where the future is coming from.

Audrey Tang: Exactly.

Nerio Musa: Rather than having a central think tank, or centralized trust of body or body of trust that thinks about everything for you, it’s like you look. It’s much more agile. It’s much more responsive, and can hit the right…Have the right impact at the right time.

Audrey Tang: It’s open innovation. We, in the software world, have known this for a very long time now.

Nerio Musa: Another question is around security, reliability, resiliency should be at the forefront of everything that you do, everything that you think about.

Nerio Musa: What are some of the examples of Taiwan’s approach to cybersecurity when dealing with external actors or disaster readiness? You mentioned some disaster readiness about submarine cables being cut. I think you’ve…

Audrey Tang: We have to do satellites, I guess.

Nerio Musa: Useful.

Audrey Tang: Not just one constellation, because we don’t know what happens to the operator, so many constellations. Strength through plurality is our main idea now.

Nerio Musa: It’s, again, not relying on a single vendor.

Audrey Tang: Single vendor. That’s right.

Nerio Musa: Single point of failure. It’s resiliency through, again, for lack of a better word, democracy of…

Audrey Tang: Yeah.

Nerio Musa: Right?

Audrey Tang: If Cloudflare Workers go down, we’ll switch to the Miniflare Worker instance running NCHC. [laughs]

Audrey Tang: Here, our idea is very simple. We don’t use as default a single vendor for two interfaces that are next to each other. The fact that we’re using Cloudflare Zero Trust means that we do not use WARP. We’ll use CrowdStrike, or something. If we use Azure AD, then we don’t use Intune.

Audrey Tang: That’s the only way to test interoperability. If you use for all those layers the single vendor as what’s usually done before moda, then the interoperability capacities are printed on the table, on the sheet, but it’s never tested.

Audrey Tang: Now, we’re testing, for example, TW FidO — which is our Ministry of Interior FIDO implementation — and interoperating it with Azure AD, or any other WebAuthn FIDO providers. We’re a member of FIDO and W3C.

Audrey Tang: Once we adopt this, then it means that within each layer, we have a primary supplier. Then, we have multiple compatible suppliers almost by default. They are reference implementations to open source competitors in all of these spaces. When worse comes to worst, we can switch to the second or even the third solution provider.

Nerio Musa: Basically, you’re saying you’re trying to solve the vendor lock in problem. Not from a financial sense, but because some vendors, they prefer the whole models.

Audrey Tang: They give a great discount…

Audrey Tang: …if we lock all of our stuff in. There’s incentive. [laughs]

Nerio Musa: That also comes with a risk.

Audrey Tang: Exactly.

Nerio Musa: Also, it’s important to be completely independent, or not dependent on any one subset or one vendor.

Audrey Tang: Really, it’s interdependent. For example, if we work with both low Earth orbit and middle Earth orbit satellite providers, then to completely disable our communication, you’ll have to shut down three different constellations or more.

Audrey Tang: For public cloud hosting, for example, we arranged the local zone hosting with all the three public cloud providers. Again, to completely erase our way to thrive [laughs] during an earthquake, you have to attack all three major public cloud provider, which is very difficult, actually. That’s strength in plurality.

Nerio Musa: A good example is going back to GPS technology for satellites. It’s like the government could turn it off at any time. They did for some time during the Iraq War, I guess. You don’t want to be dependent on that.

Audrey Tang: In a sense, the low Earth orbit can also be used for navigation.

Nerio Musa: It was an announcement that you made that Taiwan embraces zero trust.

Audrey Tang: Of course.

Nerio Musa: This is identity authentication, continued verification, and a never trust posture. Can you tell us how zero trust helps protect against a subset of cyberattacks? What’s your vision about zero trust? Why this is so appealing for moda and for…?

Audrey Tang: Sure. To contrast with zero trust, of course, is a firewall perimeter, intranet, and so on. When we set up moda, we ensured that none of us have a desktop computer. Everybody’s got laptops.

Audrey Tang: The reason why was that if you are tied to specific desktop computers, even if you say you want to do zero trust, you end up with something that’s the worst of both worlds. You know what I’m talking about? I don’t have to elaborate.

Audrey Tang: Once we ensure that there’s no Internet, there’s literally no intranet in moda, then people who care about security actually have to actively think, what does it mean to constantly verify? What does it mean to have the device authenticate?

Audrey Tang: What does it mean to simplify the biometric or whatever ways to verify your personal identity, in a way that takes even less time than typing passwords or inserting your citizen digital certificate to your desktop card reader.

Audrey Tang: Those actual uses, because I think the first week we started, I was diagnosed with COVID, so it was put to immediate test. I was home guarding for seven days and every system that I touch need to be fully ZTNA. Otherwise, it simply doesn’t function.

Audrey Tang: Our MIS department end up doing a lot of R&D to make this work. Of course, CloudFlare helps a lot. They help us to convert, frankly speaking, very legacy systems into ZTNA without having to reprogram them.

Audrey Tang: After that initial boost trapping experience, we found that there are corners within the government that are still paper based. Because they did not trust the old intranet security model. It was good reason. They found many threat actors, many threat models that led them to conclude that maybe a physical paper with physical seal, with physical signature, is actually more secure.

Audrey Tang: It’s done with rigor. It’s a good assessment. it also bothers everyone because we all have laptops now. If you have to run a paper based process, it feels like extra work. Again, it’s about flipping the default because if you are tied to your desktop anyway, then it doesn’t feel like extra work.

Audrey Tang: By making sure that it feels like extra work we then work with the competent authorities in charge of those paper based processes and say, “However, with a ZTNA it’s actually more secure than paper and more convenient.”

Audrey Tang: This is actually the main selling point because it makes sure that the career public service can, I don’t know, go home earlier. I don’t have to work until 9:00 PM or something. Anything that improved the quality of life of public service end up being associated with their ZTNA.

Audrey Tang: That is why we are fully embracing the ZTNA because it offers the flexibility of adapting the workflow to their actual need, instead of forcing everyone to go into a security perimeter, enclave, or things like that, and therefore make them, even later, to go home.

Nerio Musa: Because the perimeter always has some holes somewhere.

Audrey Tang: Exactly.

Nerio Musa: We just spoke about zero trust. That’s just one subset of the types of attacks that you’re trying to protect yourself against DDoS, as you know, data theft, information manipulation. Especially information manipulation because you do make a point when you say that, “Hey, cyberattacks is not just DDoS.”

Audrey Tang: No.

Nerio Musa: It is not just data theft. It’s about how to change the disinformation…

Audrey Tang: It’s how you frame the DDoS.

Nerio Musa: Yeah. You also mentioned a very interesting concept. In Taiwan at the school level, you people are taught to fact check.

Audrey Tang: Yeah. They fact check the presidential candidates.

Nerio Musa: It’s constant observation. There’s so many eyeballs constantly, so many brains constantly looking at them and…

Audrey Tang: Yeah. I get fact checked all the time by students.

Nerio Musa: Is this the same thing as this similar or a human equivalent of zero trust?

Audrey Tang: It’s a very interesting analogy. It’s certainly always verified. That part is the same. Basically don’t take even my word for it but simply always verify. Of course, it is a stretch if you associate it with device authentication or things like that.

Audrey Tang: This always verify really is it comes from a democratic principle. Because in a democracy you’re supposed to always verify. If you do not then it’s democracy which was a ritualistic voting or things like that, and truly not a democracy.

Audrey Tang: Always verify comes first. It comes from a democratic attitude. It’s the other way around. It’s the zero trust trying to look at the security policies and say, “Maybe we were not always verifying. We were not constantly verifying. Maybe we over rely on the maximal privilege of a certain authority figure. Maybe the minister always get all the privilege, which should not be the case.”

Audrey Tang: In a sense, I think it’s adapting those democratic principles into network security.

Nerio Musa: It’s not just about authoritarianism. It’s about having human bias. You’re thinking a certain way because of the environment you are in. Things like that also lead you to a certain position, whereas perhaps it’s going back to zero trust model, it’s about don’t trust by default. Don’t assume what you’re hearing is correct.

Audrey Tang: It’s about trusting one’s own agency of competence, of critical thinking and so on. In a sense, zero trust means not having blind faith, but rather trusting one self’s competence and the competence of people who practice similar models.

Nerio Musa: Tell me more about moda and the people of moda. There’s a whole bunch of people who are always thinking about this, always thinking about the current problems, always thinking about the future, always thinking of how to democratize what you’re doing. Who are these people? Let’s celebrate them.

Audrey Tang: Yeah, let’s celebrate them. Do you want to talk about yourself?

Wjke: English is fine.

Audrey Tang: English is fine. We love food. Food brings us together.

Audrey Tang: Yes. For a while. Yeah.

Nerio Musa: I think it’s just about creating a sense of appreciation for the complexity of the problems that we’re dealing with on a daily basis. You’re dealing with certainly. It’s difficult to convey that across in a media soundbite or things like that. These things require thought.

Nerio Musa: Thought is something very precious in terms of attention span. You need to find a way to get this across in a very concise meaningful message.

Nerio Musa: Very good cake. Thank you.

Wjke: Cloudflare have given us very good discounts and to get…

Audience Member: …very quickly to launch services in the face of emergencies.

Nerio Musa: Yeah, and we had a call with Patrick on this. Patrick came to me and said, “Hey, we don’t care about commercial aspect of things at this time. We want to make sure that everything is OK.”

Nerio Musa: This is during the Pelosi visit, around that time. What can we do to help? Forget about everything else, just help. I think that’s very dear to our heart. It’s not about a commercial angle.

Wjke: No.

Nerio Musa: We can see that. That’s embedded into everything that we do, not just with you, many other things. I have a completely non commercial background. I’m just looking after customer support, and I see this every day with the customers that we deal with.

Nerio Musa: It’s our mindset towards getting things right and doing them rightly as well. I really, really appreciate what you do. I’m a big fan of you.

Audrey Tang: Thank you. Many of you have already met, either online or…

Wjke: Yes, last week 周詳 used Cloudflare Worker to make many cool services.

Leo Jiang: We talk about worker for integrate Gitlab and GitHub, and make it using our page worker integrate.

Audrey Tang: That’s great.

Wjke: Our website, 周詳 showed URL shortening service from the workers, and it’s very cool.

Audrey Tang: It just works but it’s excellent. Where I also came from a very non commercial background because he was a police officer. He also majors in machine learning and computer vision. What’s your thesis topic again?

Wjke: Vision for 3D Point Cloud, computer vision. Right now I’m full time in moda. My PhD is pending.

Audrey Tang: It’s pending… somewhere.

Wjke: My essay right now is moda.

Audrey Tang: Before you joined moda, we were just checking out the data market of the National Science and Technology Council that infuses all the data from everywhere. I was looking at it during the Luna New Year vacation.

Audrey Tang: I saw Wjke’s name on the data market because he was working with the Hsinchu City government before moda that does traffic planning as the one to make the traffic police work easier…

Wjke: CCTVs.

Audrey Tang: Yes. So you share the concerns about zero knowledge, about privacy preservation and enhancing technologies, about data residency and so on. He’s got this full stack all the way to having the fiber optics laid out to maintain a actual intranet and so on. Very hardcore, very full stack.

Wjke: In the moda, we don’t have the intranet fiber. Right now, we use a lot of Cloudflare Access and DDos prevention to protect our service outside. Maybe we will put some more service on our cloud.

Wjke: Or maybe for example GCP, it also can inside the CloudFlare, so it’s very good for us to build a lot of infrastructure issue for cloud manage.

Audrey Tang: Yeah, exactly. The point I’m making is that we need people, and our people are like that, to speak both the legacy systems language and are frankly speaking experts in the pre zero trust network architecture world, so much so that they can see the limitations and then transfer those into actual future requests to the ZTNA world, and evaluate whether it actually gets answered.

Audrey Tang: If it doesn’t, then we have to do more development. If they do, then they carry a certain gravitas when they talk to their old colleagues and say, “You can feel safe migrating to this new model.”

Nerio Musa: Not only so much from the legacy side of things, but also from different use cases. For example, you were talking about traffic. You might think, “What does that have to do with moda?” but it does.

Audrey Tang: It does.

Nerio Musa: Having those different mindsets, different thoughts intersecting in a single place with a common goal, with a common problem to solve, it makes the solution a lot more robust.

Audrey Tang: It also adds to a certain culture of not being afraid of working in the open and say that, “This is a open research problem. We don’t even know how to solve that. If you’re interested, join our presidential hackathon or whatever.”

Audrey Tang: In the old days of authoritarian models, one is supposed to come up with all the solutions, and if one doesn’t, one don’t say it publicly. With people who are well versed in those worlds, they know that the old model doesn’t work anyway, [laughs] so it’s OK to simply state that, “We’ve solved this particular issue.”

Audrey Tang: For example, using static pages and IPFS, we’ve solved our availability problems for our static websites. “The IPFS doesn’t yet do dynamic updates, and there’s a limitation. We feel comfortable saying that.

Audrey Tang: Contrast that to the other scenario, where if you want to switch to a new system, you have to do bug-for-bug compatibility. That solves all the problems that the old systems purported to solve. That will hinder the progress. This incrementalism is very important.

Nerio Musa: If you go like for like, you also inherit the same problem you previously had.

Audrey Tang: Exactly. That’s right.

Nerio Musa: We deal with this from an engineering standpoint at Cloudflare every day, because the products that we have are used by many, many people. We have to make it easy to use, we have to make it security conscious, resilient. All the same challenges that you’re facing at moda, we also face.

Nerio Musa: You mentioned feature requests. We, of course, take it very seriously. What else can we do to help?

Audrey Tang: A lot, actually.

Audrey Tang: We already talked about, during our initial conversation about IPFS and Ethereum gateways, how you plan to make the ad-hoc worker-based solutions and so on that we use to, for example, automate deployments, automates all kind of workflow processes, and so on into something that’s more generally available and supported.

Audrey Tang: The mainstreaming of these two technologies is something that interests both of us, because when we joined the W3C, we specifically, in addition to accessibility, security, anything that we should care about, we also care about decentralized identifiers.

Audrey Tang: The Democracy Network Department within our ministry is explicitly tasked to investigate to the DIDs. DIDs rely on a mainstreaming of a common knowledge player of the Internet, of which, of course, IPFS and Ethereum are some of those common knowledge players.

Audrey Tang: By making it not esoteric, but rather as simple as, for example, HTV3 or things like that, that’s something that we overlap in a lot of our interests.

Nerio Musa: On another topic, what about quantum computing? Does moda play any kind of role in that?

Audrey Tang: Anything that’s more than four years in the horizon that’s the NSTC. That’s the National Science and Technology Council. We focus, along with our National Institute of Cybersecurity, on things that can be rolled out in the next four years.

Audrey Tang: It involves, for example, quantum resistant cryptography, but jot quantum computing, because it’s different time horizon.

Nerio Musa: That’s coming up soon.

Audrey Tang: Soon. Very exciting.

Nerio Musa: Yes, it is. What about on the regulatory side, do you constantly interact with the regulators and the legislative bodies?

Audrey Tang: Yes.

Nerio Musa: Even with GDPR. You said the design of GDPR is robust and it actually forces us to think about how to implement that design. If you do implement that design properly, then it actually helps everyone. It’s not obsolete. Legislation is not necessarily lagging where…

Audrey Tang: It’s only obsolete if you implement a particular implementation that is foreclosing future possibilities. if you implement it in a way that’s extensible as the EU IDAS infrastructure it’s trying to do. It’s not preventing any particular member countries from coming up with more creative versions of interoperating with existing identity regimes.

Audrey Tang: During the pandemic the EU DCC is another very good example. Even though we’re not part of the EU, we were very successful in interoperating with the EU digital vaccine certificate, that later on the same code base also interact with the smart health certificate — the SHC.

Audrey Tang: The point I’m making is that I think if our code base is commonly shared with the infrastructure or code, some people call it the DPI — digital public infrastructure — that’s actively used and developed around the world, then any gaps between particular implementations of GDPR can actually refer to a creative implementation that satisfied the spirit of the law.

Audrey Tang: This legality then carries over to our use of the same common component. If we insist on developing everything ourselves from a software stack perspective, then we’ll have to constantly reinvent the same creative interpretations. That’s a very difficult role.

Nerio Musa: Actually in some sense some people think that there’s a friction between legislation and technology. Technology wants to go ahead. Then legislation wants to pull it back.

Audrey Tang: No.

Nerio Musa: That’s not really the case.

Audrey Tang: No, I don’t think that’s the case. It is the case if the technology brings people farther away from one another. If the technology fosters polarization, if it fosters anti democratic actions, if it discourages people from voting or participating in the democratic process in these senses like antisocial social media, really we do see other democratic jurisdictions passing laws trying to wring in such counter democratic forces in technology.

Audrey Tang: The kind of technology we’re describing — appropriate technology, public code, digital public infrastructure, and so on — is the prosocial force. The more people implement this kind of mindset, the more people feel that, “Oh, democracy is not just about voting every four years, but rather about a day to day.

Audrey Tang: Sending pull requests to moda, for example, is democracy. The more people engage in that, the less we need to wring anything. Rather, our legislation is then just to encourage this kind of expression by the community.

Nerio Musa: It’s fully open source basically?

Audrey Tang: Exactly.

Nerio Musa: Moda is open source?

Audrey Tang: Yeah, of course. Oh, we call it public code because we relinquish our copyright by CC0, which is technically not a open source license. That’s very pedantic. We say we’re public code or we’re CC0. “No rights reserved” as written on our home page.

Nerio Musa: Yeah, that’s refreshing.

Audrey Tang: Mm-hmm.

Nerio Musa: Thank you.

Audrey Tang: Thanks. Any other topics? It felt remarkably like a panel.

Vera Tsai: Q&A.

Audrey Tang: Yeah. Q&A for the fireside chat.

Vera Tsai: I have a one question.

Audrey Tang: Yes.

Vera Tsai: As a Taiwanese, I’m so proud of I was born in a country. It’s freedom country. I always have choice. I’m also proud of the company I belong to. I only have three different jobs and Cloudflare is my third job. I really appreciate the vision of our company and they encourage us to do the right thing and they want to support the country, the government.

Vera Tsai: I can help wondering if I’m employee of moda, it would be very difficult. It’s a not easy job because what you mentioned you want to leverage a different solution. How do you ensure their skill set is ready, and how do you develop your talent, your army, to help you overcome the challenge and build the solution for our Nation?

Audrey Tang: Yeah. We simply look at all the open source conference presenters. COSCUP, SITCON, and so on. The open source community have one thing going for it in Taiwan.

Audrey Tang: In that even people who are very experienced, like literally CEOs or CEO, many of them take a weekend or two every month to participate in the open source community. In g0v, we see some of the most senior leadership position like entrepreneurs but they still donate their time to effect social impact and social change.

Audrey Tang: That’s very unique. The venue we have, our National Academy, is known for being politically neutral. If you go to National Academy to run a government subsidized venue you’re not seen as being co-opted by the government because the National Academy reports only to the president and no other ministers

Audrey Tang: It’s independent from all the universities and all the ministries. When the people who belong to one party or another, one ideology or another, and so on, nevertheless there’s a incredibly neutral ground in the National Academy that they can go every month or so, or every week, there’s some event there.

Audrey Tang: Basically we just tap into that community and see the people who want to embrace this co-creation across diversity, willing to work with people who speak different languages of different cultural backgrounds, different ideology, through the work of appropriate technology which then we just tap these people.

Audrey Tang: Nowadays we’re still recruiting. In a month or so we’ll start recruiting even more people throughout new National Institute of Cybersecurity. We are working with many of the community leaders to ensure that on topics such as design systems, ZTNA configuration and so on, there’s a new team that will develop on the public code first way.

Audrey Tang: Because previously many of these were done by the, for example, Institute for Information Industry, or the ITRI and so on, which are all institutes that do not have a public code default culture. Because we want to show to the community, that they can contribute their spare time also to the national cybersecurity infrastructure through what they’re already doing, like sending poll requests and so on, so we need a bridging team of around 40 people.

Audrey Tang: To your question, we look at the community and the kind of time they can contribute. They either do part time contribution or full time but just for three years or so on a bridging way. If they truly like public service, at any given time, they can become moda staff proper.

Vera Tsai: I see. How to avoid information leak? Do you need to sign an NDA and to…

Audrey Tang: Of course. There’s a full background check for anyone who join the NICS.

Vera Tsai: Thank you.

Nerio Musa: Do you think this mindset you just described about public service, everything we spoke about today, do you think Taiwan is particularly embedded in such things because of the constant threat, either natural or man made, and that is what’s driving, is firing this passion?

Audrey Tang: It’s this clarity, this urgent clarity. It’s urgency with clarity. Sometimes, there’s urgency, but there’s no clarity of vision. Maybe politically, there’s the left, the right, or whatever polarization, but in Taiwan, the political conversation is all around resilience now.

Audrey Tang: None of those four major parties in the government, in the Parliament, is even a little bit against, for example, the National Institute of Labor Security because that what everybody see is needed.

Audrey Tang: If we, through our work in moda and NICS, connects to the world, to the democracies that care about Taiwan like during last August there’s a lot of people donating their spare hard drive, IPFS, to help us stay afloat. I got many emails from many communities around the world thanks to the Web3 Gateway.

Audrey Tang: Protocol Labs contract us immediately carrying a very similar message as you just said from Cloudflare, “Whatever we can do to help.” Through this, we connect with democratic network. That, again, is urgency and clarity in one.

Audrey Tang: None of our parliamentary parties is against us engaging more democracies in the world. I think we’re very fortunate in that we’re in this intersectional zone of a shared clarity and urgency.

Vera Tsai: I think when we really want something, the whole universe will help us.

Audrey Tang: Exactly.

Sally Chen: That resiliency is mainly possible due to democratization…

Audrey Tang: Exactly.

Sally Chen: …of effort, of mind, and will.

Audrey Tang: You were trying to say something?

Sally Chen: No. I just really happy being here. We have some meeting with deeper in the department, I mean part of the group, government deployment. Because moda, they willing to understand more about cybersecurity, and I’m very happy for that.

Sally Chen: Even maybe they don’t have kind of virtual discussion, I’m still very happy because they are willing to know more about the cloud solution, the soft solution. They already understand our solution. I’m very happy for that.

Audrey Tang: Thank you.

Jeffrey Yu: I’m happy to help moda…

Audrey Tang: We’re happy that you’re helping us.

Jeffrey Yu: Everyone happy.

Intervier: If you want to try some new future features…

Wjke: Yeah, we’re glad to try.

Jeffrey Yu: Because we are SaaS provider, we can enable more future immediately.

Audrey Tang: Very good. Thank you.

Vera Tsai: Every week, every Friday, we have a soft pitches update. Maybe you can have a contact window with our…

Wjke: 周詳 and me will have a check.

Nerio Musa: I think it’s important to realize that this is not a political discussion. It’s not a commercial discussion. It’s about mindset, right?

Audrey Tang: Exactly.

Nerio Musa: That transcends any kind of politics. It’s not about left right and not about this country, that country, but the message. Always, there are subtle message in that willingness or desire to help. It’s not to do with…There’s no agenda as such.

Audrey Tang: That’s right.

Nerio Musa: This is beneficial to every human being.

Audrey Tang: That’s the vision of the original Internet. Before Internet, people who share similar values are not neighbors. The Internet is built such that people who are from very different intranets can actually discover each other and form able communities.

Audrey Tang: A lot of us are working to further the original Internet’s vision just bring it to more things. Previously the Internet wasn’t designed with identity payments or whatever in mind. It’s mostly about sending emails and write packets.

Audrey Tang: Now more and more we understand that the social fabric, if it’s learns from the Internet, so that is a network of networks, then it automatically brings the people who share the same values into neighborhoods.

Audrey Tang: Which is why we see the Internet of beings, the Internet of everything is now extending to more and more parts of this society. That’s the moda’s vision too. Yeah.

Jeffrey Yu: As moda is very important. The vision to lead Taiwan to have a substitute in this kind of solution. I really hope and you will impacted the whole Taiwan outcome, other industry, like hiding the joy in your finance to move faster.

Audrey Tang: Definitely. Because they always see our partnership as moving forward together. That’s the only way moda can do the work – moda can help.

Nerio Musa: It’s also not just Taiwan. Yes. We’re here in Taiwan, we’re talking about Taiwan, but this is far more profound, far more impactful than just for Taiwan.

Audrey Tang: Yeah, definitely. When we first designed moda, it was not mainly for resilience, it was mainly for industry of digital transformation. Then the Ukrainian situation happened at the Russian annexation. then we saw that maybe there’s a better metaphor.

Audrey Tang: During the war we’ve seen that a democracy connected through electronic services in particular idea enabled really collective intelligence, and not just intelligence in the military sense but rather a kind of collective wisdom of how to react to true adversity in a way that elevates the spirits of everyone, the likes of which has never really been seen on a national scale.

Audrey Tang: Then we said everybody can learn from Ukraine, and then digital resilience for all become our slogan and free in the future. To the end, many people are now looking at these experiences like beer and so on, and rethink about the original assumptions when it comes to this security or the trustworthiness and so on.

Audrey Tang: To your point, there are many like FinTech operators interested in Ukraine, because before the war, Ukraine was also a data residency jurisdiction. It certainly did not engage with public clouds that much.

Audrey Tang: They, out of necessity, did a full reconfiguration while having to still enhance the security because without which they would lose the war. Just tracing through the same process is the process that many decision makers in the finance industry and so on, have been thinking for the past year or so.

Audrey Tang: I think just piggybacking on that, we can offer very similar services and interpret it so that we can say, “Oh, if you work with the public infrastructure in the public cloud with this and these battle-tested criteria, then even when all our submarine cables are cut your data is safe, your computation is safe.” and so on.

Audrey Tang: That’s a much more convincing argument than simply “Audrey Tang says so.”

Jeffrey Yu: Just very sorry for late joining.

Audrey Tang: No worries.

Justen Lin: Yeah. I think cybersecurity is national security. I’m very glad see that the moda beauty, and if by Audrey. You are a very good leader and different to the traditional political person. Thank you.

Audrey Tang: Thank you.

Nerio Musa: Not to sound like Audrey fan club… What’s one of the mistakes that moda has made that you’ve learned from?

Audrey Tang: Yeah, a lot. Actually even before moda, our first collaboration with CloudFlare had many people, so very publicly, that the traffic went through Singapore for a few hours. That’s like the one image of CloudFlare that was on everyone’s mind. When we first started 1922.gov.tw. That’s literally the first screen that many have seen.

Audrey Tang: It really started a very good conversation. Because then the legislators, our department of cybersecurity people and so on, all went back and look at what actually happens when CloudFlare processes incoming requests. What would it take for a sovereign county to take over CloudFlare?

Audrey Tang: All the difficult questions, because it involved the universal healthcare number. It’s not health data per se, but it is a number that many people associate with the most sensitive of personal information.

Audrey Tang: So we fixed the routing in just a few hours. Again, people saw the agility of a SaaS model, if we have configured that in our router, in our server rack, in an outpost server and so on, it would take longer.

Audrey Tang: Then we get the explanations very clear and concise from CloudFlare of what actually happens. Then we talk about how to re-route the traffic. That’s done in a very transparent manner. The MPs remember that. The ministers remember that.

Audrey Tang: I think really it’s a case of “there’s a crack in everything, and that’s how the light gets in.” This initial experience, we can certainly call it a mistake. This initial mistake led to the conversations that enhance everybody understanding about what does it take to configure a cloud service so that it’s safe, reliable, trustworthy, and so on.

Audrey Tang: Immediately after that, we made many more mistakes when it comes to worker configuration for waiting room, and that was also on the news. It showed to people that they need to wait like 4,000 hours or something. Then it’s fixed very quickly. Again, very rapidly. The parameters adjusted rapidly.

Audrey Tang: So much so that our main service, 1922, who didn’t want to use waiting room because of the initial impressions, eventually did adopt it because they saw how, as you said, it’s not about a commercial deal, but a true partnership, because it’s also cutting edge technology for you. You were also just prototyping that technology.

Audrey Tang: We co-created a different kind of response pipeline and so on for that. I recount all these details because it’s important to show publicly the mistakes are corrected, even faster than our existing weekly iteration during the pandemic. Always, it’s fixed in a matter of hours.

Audrey Tang: Then that’s what ultimately won the heart and minds of the major system integrators that are in charge of some of the largest public infrastructure. So much so that in the 6,000 anti dollar service we don’t even have to tell them to use contract. It’s just assumed now.

Audrey Tang: I think those mistakes are very pedagogical, so to speak. It’s a public textbook, so to speak, for many people in the public service.

Nerio Musa: I guess you can say it’s both doing the right things and doing them rightly. Part of that doing them rightly, is to rapidly iterate and solve the problems that they come in and to build that trust in a transparent manner.

Audrey Tang: Exactly. Instead of saying “let’s just use it on minor services and test it for two years. Open a public bid and evaluate and things like that instead of this testing production thing…” – during those times, the urgency of getting everybody vaccinated just supersedes all these concerns.

Audrey Tang: Again, they fast track this mutual trust-winning processes. I think owning up to those mistakes and correcting it literally with everybody watching the 2:00 PM CECC press conference and me bringing up the CloudFlare analytics during the CECC conference, and say that waiting room problem has been resolved.

Audrey Tang: All of that is a very much part of this public education processes.

Nerio Musa: Thank you very much.

Audrey Tang: Thank you.

Nerio Musa: Again and thanks to your team and thanks to moda for graciously giving your time for us. Thank you.