EDITORIAL: NSC working to harden security

The National Security Council (NSC) has introduced five measures to buttress national loyalty and prevent Chinese infiltration, including expanding background checks, conducting regular security reviews, restricting access to sensitive information and monitoring computer activity.

The measures were outlined in a report to the Legislative Yuan after its Judiciary and Organic Laws and Statutes Committee proposed freezing NT$4 million (US$121,729) from the council’s consultancy and research budget. The committee has requested a written report within three months detailing the council’s counter-infiltration procedures, screening standards and checks on advisory committee members before the funds can be released.

The council’s approach reflects practices in other democracies. The US conducts continuous evaluations of and periodic reinvestigations into personnel with security clearances, while Canada, the UK and Germany use tiered screening systems based on the sensitivity of employees’ positions.

Taiwan’s plan to link the frequency of background checks to security clearance levels follows a similar risk-based approach. However, screening personnel is only one part of security. Compartmentalizing access according to the need-to-know principle is equally important: Even employees with high-level security clearances should only be able to access information required for their duties. This limits the damage if someone is recruited, bribed or coerced by a foreign intelligence service, or deliberately leaks information.

An official investigating Chinese influence operations, for example, might need access to financial records and communications, but not the identities of intelligence sources or details of unrelated investigations. Compromising one employee should not expose an entire operation.

Taiwan has a legal foundation for this approach. Article 14 of the Classified National Security Information Protection Act (國家機密保護法) restricts access to classified information to those handling it within their official duties or with specific written authorization. Article 24 limits the sharing of classified information between government agencies to officials directly responsible for handling it. The NSC’s new measures build on these provisions, but the government could go further by ensuring that senior officials cannot automatically access multiple categories of sensitive information simply because they hold high-level clearances. Particularly sensitive operations could require two-person authorization before intelligence is accessed.

Artificial intelligence (AI) could further strengthen these safeguards by helping determine what information personnel need on a case-by-case basis. Rather than relying solely on fixed security-clearance levels, AI systems could assess an employee’s role, responsibilities and authorization history before recommending access to specific information. They could also identify the minimum information needed to complete a task and flag requests requiring additional human approval. Access rights could be adjusted when employees change positions or responsibilities.

AI could monitor information-access patterns and flag suspicious activity, such as employees accessing unusually large volumes of classified documents, repeatedly attempting to open files outside their responsibilities or downloading sensitive material at unusual hours. It could identify patterns involving multiple employees or accounts that might indicate coordinated attempts to obtain information. Security personnel could then investigate alerts and, where called for, temporarily suspend access. Such systems would need human oversight, as unusual activity should prompt investigation rather than automatically be treated as evidence of espionage.

Taiwan could develop these capabilities through the NSC and the Ministry of Digital Affairs, building on existing cybersecurity initiatives.

The Administration for Cyber Security has announced plans to develop domestic AI-enabled cyberdefense capabilities and bolster threat-intelligence sharing. However, it remains unclear whether AI is already being used to assess access requests or monitor NSC personnel. A program combining AI-assisted access management and suspicious-activity detection could help establish such capabilities.

Chinese espionage cases highlight the importance of stringent, routine controls over access to sensitive government information and monitoring of how it is used. The NSC reported that 64 people were prosecuted for Chinese espionage in 2024, up from 48 in 2023, with military personnel and veterans accounting for a substantial proportion of those targeted. These cases underscore the risks posed by compromised insiders and the importance of limiting what any one person can access.

The NSC’s measures show that Taiwan recognizes the threat and is taking steps to strengthen its information security. Further incorporating AI could make those safeguards more responsive and effective.