EDITORIAL: Better procurement vetting needed

Prosecutors earlier this week questioned four people over the alleged sale of Chinese-developed software repackaged and marketed as a Taiwanese product to the Ministry of Foreign Affairs.

They allege that three Taiwanese companies repackaged Chinese-developed IP-guard endpoint security management software and passed it off as a domestic product to secure more than NT$20 million (US$623,577) in ministry contracts from 2023 to last year. The case came to light in December last year, when the ministry discovered irregularities during a routine inspection of its information systems. The software can inventory computer equipment, monitor software usage and control data access. The investigation is examining suspected contraventions of the Government Procurement Act (政府採購法).

Taiwan should strengthen its safeguards against companies misrepresenting the origins of software sold to government agencies, particularly for products intended for sensitive diplomatic or military use. The US offers useful models, including more extensive supplier screening, cybersecurity requirements and mechanisms for holding contractors financially accountable for fraud. No procurement system can eliminate misconduct, but stricter verification and enforcement can make deception harder to carry out and less attractive to potential offenders.

One priority should be requiring suppliers of sensitive software to provide independently verifiable evidence of its origins, ownership and development history. A Taiwanese company’s registration does not establish that it developed the product it sells, nor does it guarantee that the software is free of potentially dangerous foreign components. Taiwan could require detailed disclosures of third-party software, subcontractors and intellectual property, backed by technical audits and checks of development records. These requirements should be tailored to the security risks involved rather than applied indiscriminately to every government purchase.

Taiwan should also consider whether the financial consequences of deliberate procurement fraud are sufficient to deter offenders. For example, the US False Claims Act allows the government to recover three times its damages, plus statutory penalties, in qualifying cases involving knowingly false claims. Taiwan already has provisions for excluding serious procurement violators from government contracts, but stronger financial recovery mechanisms could make deliberate misrepresentation far less profitable. Any reforms should distinguish intentional fraud from honest mistakes and ensure that penalties are proportionate to the offense.

Enforcement must extend beyond individual contracts. A government-wide system for tracking sanctioned suppliers, rigorous disclosure requirements for subcontractors and safeguards against companies evading restrictions through affiliated businesses could help prevent repeat offenders from securing new contracts. Independent technical audits and ongoing monitoring would also increase the likelihood that suspicious software is detected before it compromises sensitive systems. Penalties deter misconduct most effectively when violations are likely to be discovered and offenders are held accountable, not merely when the maximum punishment is severe.

Taiwan already has mechanisms for blacklisting suppliers that contravene procurement rules and prequalifying companies for government contracts. However, it could bolster these systems by establishing a specialized, government-wide register of suppliers whose software provenance and cybersecurity credentials have been independently verified. Under the Government Procurement Act, companies that breach the rules, such as submitting false documents, can be listed in the Government Procurement Gazette and barred from government bids for up to three years, depending on the offense. Agencies can also maintain lists of qualified suppliers, but inclusion on such a list does not amount to a universal certification that a company is trustworthy for every type of government purchase.

The allegations involving the foreign ministry should prompt a broader examination of Taiwan’s procurement safeguards, without being taken as proof that its military procurement system is deficient. Restrictions on Chinese-developed technology should be carefully defined to address genuine security risks, while allowing agencies to distinguish between a supplier’s nationality, a product’s origins and the risks posed by its components.

Ultimately, Taiwan needs a system that does more than punishing misconduct after the fact: It must make software origins harder to conceal, ensure that deception is likely to be detected and make the consequences of fraud outweigh its potential rewards. Doing so would protect public funds, enhance cybersecurity and reduce the risk that sensitive government systems are exposed to technology whose origins or security have been misrepresented.