Fighting a Digital Blockade: View from Taiwan

Fighting a Digital Blockade: View from Taiwan

Speakers: Jason Vogt, Assistant Professor, US Naval War College; Josh Ryder, Former Deputy Principal Cyber Adviser for the Navy

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=CvMVJjPcusI

Overview

This talk, "Fighting a Digital Blockade: View from Taiwan," delves into the critical challenges Taiwan faces in maintaining digital connectivity and resilience in the event of a conflict with the People's Republic of China. Presented by Jason Vogt, an Assistant Professor at the US Naval War College, and Josh Ryder, former Deputy Principal Cyber Adviser for the Navy, the discussion outlines the findings of the Taiwan Resilience Project by the Cyber Innovation Policy Institute. The project explores strategies for enhancing Taiwan's critical infrastructure cybersecurity and overall resilience against potential digital isolation, drawing crucial distinctions from the conflict in Ukraine.

The unique geopolitical and geographical realities of Taiwan—an island nation heavily reliant on a limited number of submarine communication cables—render it exceptionally vulnerable to a digital blockade. This vulnerability extends beyond kinetic attacks to include sophisticated cyber operations against critical infrastructure. The talk underscores the urgent need for robust, multi-layered resilience strategies, encompassing technological diversification, civilian preparedness, and international cooperation, to counter the multifaceted threats posed by a potential adversary.

The insights presented are vital for policymakers, cybersecurity professionals, and military strategists concerned with regional stability and the future of digital infrastructure in conflict zones. By examining the specific vulnerabilities and proposing concrete defensive measures, the speakers provide a sobering yet actionable framework for strengthening Taiwan's ability to withstand and recover from a concerted effort to sever its digital lifelines.

Background

▶ Watch: Introduction and speaker disclaimers (0:00)

The impetus for the Taiwan Resilience Project stemmed from an initial examination of lessons learned from Ukraine's experience in maintaining communications amidst conflict. While Ukraine successfully leveraged civilian and private sector support to sustain connectivity, the project quickly identified fundamental differences that make Taiwan's situation far more precarious. Ukraine, a larger continental country with diffuse infrastructure and land borders, could not be completely isolated digitally by Russia. Taiwan, however, is an island, making it highly susceptible to isolation, particularly given its reliance on a limited number of submarine communication cables for international connectivity. China's capacity to exert pressure on this system, both in a pre-conflict and active conflict scenario, significantly exceeds Russia's capabilities against Ukraine.

To explore these complex challenges, the Naval War College, renowned for its expertise in war gaming, conducted a series of exercises. These war games were held at prominent cybersecurity conferences, including Black Hat and DEF CON, as well as at Cybersac 2025 in Taipei, Taiwan's major cybersecurity conference. The central question posed was twofold: what role could the private sector play in bolstering Taiwan's resilience, and what strategic investments and government initiatives could be implemented over a five-year horizon to enhance the island's ability to withstand a digital blockade? The findings from these war games and subsequent research are available in reports published online by the Naval War College.

A critical aspect of the background discussion involved a deep dive into the nature of submarine cables. These vital conduits of global communication, while seemingly robust, are surprisingly vulnerable. Historical data indicates that cables are frequently cut by accident, often by fishing boats dragging anchors. This accidental susceptibility suggests that deliberate targeting is not inherently difficult. Furthermore, the talk highlighted the readily available information on cable infrastructure; a "super secret website" like submarinecablemap.com openly displays all landing sites and cable routes, effectively providing adversaries with a detailed blueprint for potential attacks. This transparency, coupled with the inherent fragility of the cables and their associated infrastructure, forms the grim backdrop against which Taiwan must build its digital resilience.

Key Findings

▶ Watch: Taiwan's unique vulnerability to digital isolation (2:40)

The Taiwan Resilience Project and associated war games yielded several critical findings regarding Taiwan's digital resilience in the face of a potential blockade:

1. Decentralized Communication Strategies: A paramount finding was the need for highly decentralized communication strategies. Relying solely on national-level infrastructure redundancy (e.g., establishing new LEO satellite connections like OneWeb) is insufficient. The project emphasized the importance of distributing resilient communication capabilities throughout the population. This includes leveraging technologies such as Raspberry Pi-based mesh networks and ham radios. Training the civilian population to utilize these tools ensures that connectivity can be maintained even if national-level systems are compromised or destroyed, shifting the burden from a specialized government or military group to a broader societal base.

1. Strategic Stockpiling of Critical Components: Taiwan's island geography means that in a conflict, it would likely be cut off from international supply chains. Therefore, stockpiling critical communications and power components on and around the island is essential. This includes items like transformers and other backup parts for power grids and communication infrastructure. Without immediate access to these components, repairs in a conflict scenario would be impossible, leading to prolonged outages.

1. Societal Resistance and Training: Beyond technical infrastructure, the talk stressed the critical role of civilian societal resistance and training. This ranges from promoting general cybersecurity awareness through public messaging campaigns (which Taiwan already does) to the potential creation of expert civilian cyber corps or "hacker corps." These trained civilians could understand and operate complex technologies in austere conditions to keep the population connected and informed.

1. Submarine Cable Vulnerabilities: A significant portion of the discussion focused on the extreme vulnerability of Taiwan's submarine cables.

• Number and Origin: Taiwan currently has approximately 14 active submarine cables, with plans to increase to around 19 by 2025. Crucially, about half of these cables connect directly to mainland China and would be immediately out of play in a conflict. The remaining cables terminate on Taiwan's eastern shore, making them vulnerable to both kinetic and non-kinetic attacks.
• Attack Vectors: Cables can be physically cut, severed, or crushed. Repeaters—the underwater boxes that amplify signals—require power (8,000 to 18,000 volts) supplied from the beach and are susceptible to kinetic or cyber attacks. The switching centers on the beach, where fiber terminates, often use equipment from vendors like Huawei, raising concerns about inherent cyber vulnerabilities or insider threats that could allow pre-emptive disabling.
• Repair Challenges: The global capacity for laying and repairing submarine cables is extremely limited, with only about a dozen to two dozen specialized ships worldwide operating in the region. Taiwan owns none of these. Major operators are from Japan, Malaysia, Singapore, South Korea, and the US. These are high-value civilian assets, and companies would be highly reluctant to risk them in a combat zone, creating significant delays or outright refusal for repairs during conflict. Designated repair zones and ownership structures further complicate rapid response.

1. Data Storage Dilemma: An ongoing debate in Taiwan, particularly among companies, concerns the optimal location for critical data storage: on-island versus off-island. While off-island storage might seem safer from direct attack, reliance on it could be catastrophic if Taiwan is cut off from external communications. Conversely, on-island storage makes data vulnerable to direct kinetic or cyber attacks. Companies operating in Taiwan must carefully weigh these trade-offs to ensure continuity of operations for daily life functions.

These findings collectively paint a picture of Taiwan as a nation facing an existential digital threat, requiring a comprehensive, multi-faceted approach to resilience that extends from national infrastructure to individual citizens.

Technical Deep Dive

▶ Watch: War game findings: Decentralized communication strategies (3:40)

The technical deep dive of the talk illuminated the specific vulnerabilities of Taiwan's digital infrastructure and the proposed technological countermeasures. At the core of Taiwan's vulnerability is its reliance on submarine communication cables, which are the primary arteries for its international data traffic. These cables are not merely passive conduits; they comprise complex systems susceptible to various forms of attack.

Submarine Cable Infrastructure and Vulnerabilities:

• Physical Vulnerability: The cables themselves, despite being robust, can be cut or damaged. The speakers highlighted that accidental cuts by fishing boats dragging anchors are common, demonstrating that deliberate attacks are feasible. Publicly available resources like submarinecablemap.com provide precise locations of cable routes and landing sites, effectively an open-source intelligence goldmine for potential adversaries.
• Repeaters and Power Supply: To maintain signal integrity over vast distances, submarine cables incorporate repeaters. These active devices are housed in underwater boxes and require substantial power, typically ranging from 8,000 to 18,000 volts, supplied from shore-based stations. Disrupting this power supply, either through kinetic attacks on the beach-side power infrastructure or cyberattacks on control systems, could disable entire cable segments. The repeaters themselves are also physical targets.
• Switching Centers and Supply Chain Risks: Where the submarine cables meet land, they connect to sophisticated switching centers. A significant concern raised was that much of the equipment in these centers, particularly in the broader region, is manufactured by companies like Huawei. This introduces potential supply chain vulnerabilities, including backdoors or pre-planted malware, which could be activated through cyber means to disable communications even before overt hostilities commence. The concept of an insider threat, as discussed by Dr. Sula Meyer in a preceding talk, was also referenced as a potent risk vector for these critical facilities.
• Repair Constraints: The technical challenges extend to repair. When a cable is cut, specialized ships equipped with remotely operated vehicles (ROVs) must locate the break, retrieve the cable from the ocean floor, and perform repairs on deck. This process is time-consuming and expensive. The scarcity of these specialized repair vessels globally—only about a dozen to two dozen in the region—and Taiwan's lack of ownership over any of them, creates a severe bottleneck. During a conflict, the civilian nature and high value of these ships would make their deployment into a combat zone highly unlikely, rendering repairs virtually impossible for the duration of hostilities.

Resilience Technologies and Strategies:

To counter these vulnerabilities, the talk emphasized a multi-pronged approach to digital resilience, focusing on decentralization and diversification:

• Proliferated LEO and MEO Satellites: Learning from Ukraine's successful utilization of Starlink-like services, Taiwan has moved to enhance its satellite communication (SATCOM) capabilities. It has secured an agreement with Eutelsat OneWeb, a European-based company, to deploy proliferated LEO (Low Earth Orbit) satellite systems. These are already in use for civilian disaster response and could maintain government and military communications during a conflict. Additionally, Taiwan has engaged with Astronis, a US company, to explore MEO (Medium Earth Orbit) satellites, which promise increased bandwidth and additional redundancy options.
• Decentralized Mesh Networks: The concept of mesh networks, particularly those built using inexpensive, widely available hardware like Raspberry Pi, was highlighted. These networks can operate independently of traditional internet infrastructure, forming localized communication grids. Josh Ryder, acknowledging his personal bias as a Meshtastic enthusiast, noted the potential for such systems to maintain local connectivity and information flow within the population. The IoT Village at DEF CON was even mentioned as a resource for learning to build such networks.
• Ham Radios: Amateur radio (ham radio) was presented as a uniquely resilient communication method. Ham radio operators can utilize a diverse spectrum (e.g., 10m, 6m, VHF, UHF, satellite, 900MHz mesh) and various digital modes (e.g., basic text, no voice) that are resistant to jamming. While any signal can theoretically be jammed, jamming all ham radio frequencies simultaneously would require an immense amount of energy, potentially disrupting an adversary's own command and control (C2) capabilities. Taiwan already possesses a robust ham radio community, actively involved in disaster relief, making it a valuable pre-existing asset for conflict resilience. A good operator can find "holes in the spectrum" to communicate even under significant interference.

Data Sovereignty and Location:

The debate over on-island versus off-island data storage represents a critical technical and strategic dilemma. While off-island data might seem protected from direct attack, it becomes inaccessible if Taiwan is digitally isolated. Conversely, storing data on-island makes it a direct target. Companies operating in Taiwan must perform a detailed risk assessment and implement a hybrid strategy that balances accessibility, redundancy, and security to ensure continuity of operations for essential services and daily life.

In summary, the technical discussion underscored that a digital blockade against Taiwan would likely involve a combination of kinetic and cyber attacks against a surprisingly vulnerable yet foundational infrastructure. The countermeasures, therefore, must be equally diverse, leveraging both cutting-edge satellite technology and established, resilient, decentralized communication methods, all supported by a prepared and trained civilian population.

Demo / Proof of Concept

▶ Watch: Importance of civilian societal resistance and cyber training (5:50)

The talk "Fighting a Digital Blockade: View from Taiwan" did not include a live demonstration or a specific proof of concept of any particular technology or attack vector. Instead, the speakers, Jason Vogt and Josh Ryder, primarily discussed the findings from the Taiwan Resilience Project, which involved a series of war games conducted by the Naval War College. These war games, held at events like Black Hat, DEF CON, and Cybersac 2025, served as conceptual simulations to explore various scenarios of a digital blockade and test potential resilience strategies. The results and insights from these simulations formed the core of their presentation, rather than a practical, hands-on demonstration of tools or techniques.

Defensive Implications

▶ Watch: Josh's humorous disclaimer and focus on underwater cables (7:00)

The detailed analysis of Taiwan's digital vulnerabilities and potential blockade scenarios provides critical defensive implications for Taiwan, its allies, and even other nations facing similar geopolitical threats.

1. Prioritize Communications Redundancy and Diversification:

• Multi-layered Satellite Connectivity: Taiwan's move to deploy Eutelsat OneWeb LEO satellites and explore Astronis MEO satellites is a vital step. Defenders must ensure these systems are fully operational, widely distributed, and integrated into national communication plans. This includes securing ground stations and ensuring resilient power supplies for them.
• Decentralized Ground-Level Networks: Investment in and promotion of Raspberry Pi-based mesh networks and other localized, independent communication systems (like Meshtastic) is crucial. These provide "last-mile" connectivity when centralized infrastructure fails. Training programs for civilians on how to deploy and operate these networks are essential to scale this capability.
• Leverage Existing Resilient Technologies: The robust ham radio community in Taiwan represents a significant, often overlooked, asset. Governments should support and integrate these civilian operators into disaster response and national resilience plans, providing resources and training to enhance their capabilities in a conflict scenario.

1. Strategic Stockpiling and Supply Chain Resilience:

• Critical Component Stockpiling: Taiwan must aggressively stockpile essential spare parts for critical infrastructure, particularly for power grids (e.g., transformers) and communication networks. These stockpiles need to be strategically distributed across the island to prevent single points of failure.
• Supply Chain Risk Mitigation for Submarine Cables: Given the prevalence of potentially compromised equipment (e.g., Huawei) in switching centers, Taiwan and its allies should conduct thorough audits of all critical communication infrastructure components. Diversifying vendors, implementing strict security controls, and potentially replacing high-risk equipment are crucial steps.

1. Empower and Train the Civilian Population:

• Whole-of-Society Cyber Resilience: Taiwan's new information cyber security strategy promoting "whole of society cyber resilience" is the correct approach. This involves continuous public messaging campaigns on cybersecurity best practices and direct government training for civilians.
• Civilian Cyber Corps: The concept of creating expert civilian cyber corps or "hacker corps" to maintain connectivity in austere conditions is innovative. This would involve identifying and training skilled individuals who can operate and repair digital infrastructure under duress, providing a vital human element to resilience.

1. Address Submarine Cable Vulnerabilities Proactively:

• Physical Protection: While difficult, exploring measures to physically protect critical cable landing sites and repeater boxes from kinetic attacks should be considered.
• Repair Capacity and Legal Frameworks: Taiwan, in cooperation with allies, needs to explore options for securing access to cable repair ships. This could involve pre-negotiated agreements with friendly nations or companies, or even considering joint ownership/control of such vessels for emergency scenarios, addressing the complex legal and operational challenges highlighted in the talk.

1. Strategic Data Storage for Business Continuity:

• Hybrid Data Strategies: Companies operating in Taiwan, particularly those providing essential services, must develop clear data storage strategies that balance on-island and off-island redundancy. This involves understanding the trade-offs between local accessibility during isolation and external protection from direct attack. Robust backup and recovery plans are paramount.

1. International Cooperation and Capacity Building:

• Foster International Partnerships: The call for US and international cybersecurity firms to engage with Taiwan's nascent but growing cybersecurity industry is critical. This builds expertise, fosters trust, and establishes channels for assistance during a crisis.
• Collective Defense Frameworks: Allies should explore frameworks for protecting civilian communication infrastructure in pre-conflict and conflict scenarios. As noted, protecting civilian communications is an easier conversation for international cooperation than direct military intervention.

1. Active Defense Capabilities:

• Taiwan's adoption of "active defense" terminology signifies a recognition that passive defense alone is insufficient. While the specifics of their offensive cyber capabilities were not detailed, this posture indicates a willingness to deter or respond to cyberattacks with proportionate measures, which is a key component of modern cyber warfare doctrine. However, the speakers noted that China is a "much tougher nut to crack" than Russia for offensive cyber operations.

In essence, defending against a digital blockade requires a comprehensive, integrated strategy that combines advanced technological solutions, robust physical security, a highly trained and engaged civilian population, and strong international alliances. The threats are sophisticated and multi-faceted, demanding an equally sophisticated and multi-layered defense.

Key Takeaways

• Taiwan's Unique Vulnerability: As an island nation heavily reliant on submarine communication cables, Taiwan faces an exceptionally high risk of digital isolation in a conflict scenario, distinct from continental conflicts like Ukraine.
• Decentralized Resilience is Crucial: Effective resilience requires a decentralized approach, emphasizing technologies like Raspberry Pi-based mesh networks and ham radios, distributed and operated by a trained civilian population, alongside national-level LEO/MEO satellite systems (e.g., Eutelsat OneWeb, Astronis).
• Strategic Stockpiling and Civilian Preparedness: Stockpiling critical infrastructure components (like transformers) on the island and actively training the civilian population in cyber security and resilient communication methods are vital for maintaining societal function during a blockade.
• Submarine Cable Fragility and Repair Challenges: Submarine cables are vulnerable to accidental, kinetic, and cyber attacks (especially at switching centers with potential Huawei equipment vulnerabilities). The limited global capacity and civilian nature of repair ships pose significant challenges for rapid repairs in a conflict zone.
• International Cooperation and Domestic Industry: Taiwan's "whole of society cyber resilience" strategy emphasizes developing a robust domestic cybersecurity industry and fostering strong international partnerships to build capacity and ensure global support in a crisis.
• Data Storage Dilemma for Businesses: Companies operating in Taiwan must critically assess and strategize their data storage locations (on-island vs. off-island) to balance accessibility and protection against potential digital isolation or direct attacks.

About the Speaker(s)

The talk was delivered by Jason Vogt and Josh Ryder, who stepped in for the originally scheduled Deputy Minister Herming Chiueh and Dr. Shinman.

Jason Vogt is an Assistant Professor at the US Naval War College. His expertise lies in war game design, and he is a key figure in the Taiwan Resilience Project run by the Cyber Innovation Policy Institute. This project is focused on enhancing Taiwan's critical infrastructure cybersecurity and overall resilience against potential digital blockades.

Josh Ryder is the former Deputy Principal Cyber Adviser to the Secretary of the Navy (SECNAV). He is also a self-proclaimed ham radio geek and Meshtastic enthusiast, interests that directly informed some of the resilience strategies discussed in the talk. Ryder actively participated in the war games that formed the basis of the Taiwan Resilience Project's findings.

Both speakers explicitly stated that the views they expressed were their own and did not reflect those of the US government or the Department of Defense.