The Chinese Cyber Warfare

China’s cyber warfare against Taiwan is conducted in a systematic and methodical manner. Influenced by the Gulf War, the PRC began establishing digitized forces and researching novel aspects of cyber warfare (劉 & 張, Reference Jiawei and Jiayuan2021, p. 122). In November 1999, the concept of a “cyber army” (网军) was first mentioned in the Liberation Army Daily, becoming a new branch alongside the Army, Navy, Air Force, and Second Artillery Corps (劉 & 張, Reference Jiawei and Jiayuan2021). The People’s Liberation Army (PLA) began the task of establishing “information warriors”（信息战士）, with the goal of identifying talent within the information industry across various regions (林, Reference Yingyou2016, p. 59). In 2002, Major General Dai Qingmin, who served as the Director of the Fourth Department (Electronic Countermeasures and Radar) of the General Staff Department of the PLA, revealed in an internal report that the PLA had consolidated ten major patterns of “information warfare”（信息战), with a specific focus on “integrated network-electronic warfare”（网电一体战). This refers to the use of electronic warfare, computer network operations, dynamic targeting, and other methods to disrupt the enemy’s battlefield network information systems that support combat operations and force projection. The PLA believed that achieving electromagnetic superiority during the initial stages of a battle was paramount to ensuring victory on the battlefield (林, Reference Yingyou2016).

The overarching strategy employed by the Chinese cyber army involves the utilization of advanced persistent threats (APTs), which leverages the intricacies of human nature and employs sophisticated “social engineering” tactics (林, Reference Yingyou2013, pp. 102–103). These orchestrated and meticulously planned espionage activities distinguish themselves from conventional cybersecurity attacks. In pursuit of their objectives, attackers navigate through various stages of attack, employing diverse tactics to evade detection. These stages include the establishment of initial footholds, internal network scanning, and lateral movement between systems within the network, all aimed at reaching the ultimate target system. Upon carrying out their malicious activities on the target system, attackers reach a decision point. They may opt to remain within the network, continuing their harmful actions on other systems, or they may choose to exit the system after eliminating any traces, depending on the directives of their funding source. These multistage attacks typically initiate with the infiltration of one of the network’s systems. Subsequently, privilege escalation techniques are executed as needed to reach the ultimate target system, gain access to sensitive systems, and transmit status updates or information back to the attackers’ command and control center (Alshamrani et al., Reference Alshamrani, Myneni, Chowdhary and Huang2019, p. 2). APTs demonstrate the meticulous planning, organization, and coordination among cyber army units (曾, Reference Yuzhen2020, p. 22). They exhibit characteristics of organized crime, often with the backing of adversarial governments, and are particularly adept at concealing their tracks (曾, Reference Yuzhen2020).

Taiwan’s Regulatory Response and Its Limitations

Although Taiwan boasts one of the most liberated online environments in Asia, the proliferation of cyberattacks has prompted the nation to embrace a top-down approach to shaping its cybersecurity policy. The Cybersecurity Management Act （資通安全管理法） serves as the primary legislation for cybersecurity. This is part of the strategy of “cybersecurity-as-national-security strategy” (資安即國安) (國家資通安全辦公室, 2021). The law, passed in 2018, applies to government agencies and specific nongovernmental entities, including critical infrastructure providers, state-owned enterprises, and government-funded foundations (資通安全管理法,全國法規資料庫, 2022). The requirements for government agencies are modeled after the Federal Information Security Management Act of 2004 (FISMA). Moreover, specific nongovernmental entities must develop and implement cybersecurity maintenance plans in accordance with their respective cybersecurity responsibility levels and establish incident reporting and response mechanisms. These guidelines should include references to and recommendations for the relevant requirements under the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001 international information security management standard. The broad application of this provision to nongovernmental entities has drawn criticism from scholars and certain members of Congress for its perceived lack of specificity (劉 & 徐, Reference Jingyi and Xu2018, pp. 122–125; “「資通安全管理法」何去何從?,” 2018, p. 158).

To counteract the APTs from China, significant legislative advancements have been made. First, the National Security Act (國家安全法) was updated to include “cyberspace” as the “fifth domain” of national security protection (國家安全法,全國法規資料庫, 2022; 國家安全法異動條文及理由, 立法院法律系統, 2019). This amendment reflects the reality that national security threats have transcended physical boundaries, with organized cyber criminals posing significant risks by targeting and compromising national critical information infrastructure through internet connections. However, the legal definition of cyberspace remains ambiguous, lacking clarity and precision (蔡, 2019, p. 37).

Second, in 2022, the National Communications Commission (NCC) proposed a draft act called the Digital Intermediary Service Act (數位中介服務法) to combat disinformation. The draft legislation included provisions establishing liability for internet intermediaries, modeled after the Digital Service Act. It also includes provisions for an “access restriction order,” inspired by Section 125 of the United Kingdom’s “Draft Online Safety Bill” from 2022 (“數位中介服務法草案總說明,” n.d.). However, the law faced extensive criticisms for infringing on freedom of expression and allegations of unconstitutionality (陳, Reference Chengliang2023). In response, the NCC announced its decision to refer the entire draft back to the internal digital convergence working group for thorough deliberation and examination of the contentious issues. (Shan, Reference Shan2022)

Third, in consideration of data breaches involving nongovernmental organizations, the Administrative Yuan passed an amendment to the Personal Data Protection Act (個人資料保護法) (新聞傳播處, 2023). The proposed legislation establishes an autonomous entity dedicated to data protection and significantly raises the penalty (up to NT$10 million) for private enterprises that fail to ensure the security of personal data. According to the National Development Council (國家發展委員會), this is part of the key strategies outlined in the “New Generation Anti-Fraud Strategy Action Plan” by the Executive Yuan, which focuses on strengthening the cybersecurity obligations of all stakeholders involved under the “Prevention of Fraud” initiative (新聞傳播處, 2023).

Taiwan remains committed to upholding a free and open internet. However, the prevalence of cyberattacks from China has led to the adoption of a top-down approach, involving increased government intervention and the establishment of national boundaries within the internet sphere. Taiwan faces a critical challenge: safeguarding its democratic institutions while navigating the pressures of cyber warfare. This situation reflects broader discussions about the normative behavior of governments and private parties online. This research will explore the underlying norms and metaphors shaping internet governance over time, gaining valuable insights to address the complex challenges of the digital age.

Norms and Metaphors

The internet was conceived in the late 1960s as a groundbreaking project by the U.S. Department of Defense (Leiner et al., Reference Leiner, Cerf, Clark, Kahn, Kleinrock and Lynch1997). Designed to interconnect research institutions and universities, it emerged as a sophisticated network for communication and resource sharing. Since its inception, the internet has undergone remarkable transformations, becoming the ubiquitous global network that defines our modern era. One of the internet’s most important features is its ability to construct virtual reality, which has sparked a wide range of perspectives (Kerr, Reference Kerr2003, p. 357). Building on these perspectives, scholars have increasingly emphasized the idea of a “norm” in the digital context, focusing on how it is defined and established within the internet.

According to political scientist Martha Finnemore and Kathryn Sikkink, a norm is “a standard of appropriate behavior for actors with a given identity” (Finnemore & Sikkink, Reference Finnemore and Sikkink1998, p. 891). The discourse surrounding norms in the digital realm is commonly referred to as “cyber norm,” with its primary focus on defining the expected conduct of governments in relation to global security and the stability of the internet (Finnemore & Hollis, Reference Finnemore and Hollis2016). A norm life cycle consists of three stages: norm emergence, norm cascade, and norm internalization. Norm emergence may potentially result in a norm cascade, once the tipping point has been reached, which is then followed by the norm’s internalization. The fundamental mechanism of the initial stage, norm emergence, entails the persuasive efforts of norm entrepreneurs who strive to sway a critical mass of states toward the adoption of novel norms. This process relies on the art of persuasion and the strategic influence wielded by these entrepreneurial actors to foster the acceptance and endorsement of emerging norms (Finnemore & Sikkink, Reference Finnemore and Sikkink1998, p. 897). In short, the development of norms is linked to the active engagement of norm entrepreneurs.

At its core, the development of norms in internet governance revolves around the metaphors promoted by norm entrepreneurs. These metaphors not only present legitimate regulatory functions and drive policy changes but also possess remarkable cognitive power, as they help us conceptualize complex ideas or phenomena (Frischmann, Reference Frischmann2007; Hunter, Reference Hunter2003). They serve as bridges between the technical complexities of the internet’s infrastructure and the sociopolitical dynamics that shape its governance. Moreover, metaphors encapsulate specific visions of the internet, rendering the abstract realities of the digital world more tangible and relatable.

In the subsequent sections, I will analyze the two influential norm entrepreneurs in the digital realm – the United States and China – to glean perspectives on the evolution of behavioral norms and their significant contributions to this process. I will specifically explore how these norm entrepreneurs have used two distinct metaphors to shape internet policies. This analysis could offer valuable insights into the governance of international relations, where the interplay of law and politics influences the actions of states and other relevant entities (Finnemore & Sikkink, Reference Finnemore and Sikkink1998, p. 916).

The United States and Cyberspace

The US’ norm development was influenced by the “cyberspace” metaphor, popularized by William Gibson, a science fiction novelist, to describe a new place created by worldwide networks (Hunter, Reference Hunter2003, p. 441; Lemley, Reference Lemley2003, p. 524). According to traditional cyberlibertarianism, cyberspace is its own entity and therefore not subject to territorial regulation (Barlow, Reference Barlow1996). This vision depicted a free and open place where “land could be taken, explorers could roam, and communities could form with their own rules” (Hunter, Reference Hunter2003, pp. 442–443). Notably, David Johnson and David Post argued in a 1996 article that cyberspace should be left to develop its own self-regulatory structure, as there was no longer an obvious method to connect an electronic transaction communication to a particular nation-state jurisdiction (Johnson & Post, Reference Johnson and Post1996, p. 1367). Among the various proposals on self-governance, some theorists believe that online transactions should be governed by norms similar to those in the Lex Mercatoria – a set of norms that governed merchant transactions in medieval times (Hardy, Reference Hardy1994, pp. 1015–1025; Hunter, Reference Hunter2003, p. 448; Perritt, Jr., Reference Perritt1997, p. 461–463; Reidenberg, Reference Reidenberg1998, p. 553).

While the internet has never been as independent or sovereign as early idealists believed, the “cyberspace” metaphor strongly influenced the US legal academic discourse, judicial pronouncements, and legislative enactments (Hunter, Reference Hunter2003, pp. 446–447). The concept of cyberspace as an unrestricted virtual realm is deeply rooted in the American philosophy of free speech (Bradford, Reference Bradford2023, pp. 33–68; Lessig, Reference Lessig2000, p. 6). It embodies the conviction that individuals possess the liberty to articulate their thoughts without censorship or unwarranted intervention, akin to the safeguards enshrined in the First Amendment of the U.S. Constitution (Bradford, Reference Bradford2023, p. 41). Most significantly, the cyberspace metaphor resulted in favoring a bottom-up rather than top-down approach to internet governance. This philosophy contributes to an evolving legal landscape in the United States shaping how online activities are governed and influencing the protection of user data and online security. For instance, the United States lacks a comprehensive cybersecurity law. Meanwhile, US legal discourse on cyber policy has been closely monitoring the density of regulations over the cyber world, with the goal of keeping it free and open (Lessig, Reference Lessig1996, p. 869; Mueller, Reference Mueller2020, p. 779).

The metaphor of “cyberspace” has significantly shaped the trajectory of the US international norm development in cybersecurity, particularly by emphasizing constraints on government actions in the digital domain. Since 2005, the United States has actively engaged in the United Nations (UN) Group of Governmental Experts (GGE), prioritizing the development of responsible state behavior to prevent interstate conflict and limit the use of cyberattacks during cyber conflicts (Lotrionte, Reference Lotrionte2013, p. 75; Mueller, Reference Mueller2020, pp. 786–787). The GGE’s efforts fostered constructive progress that culminated in the formation of a 2013 working group whose participants reached a consensus that the principles of the UN Charter principles, as well as international law, apply to the digital domain.

In 2015, the GGE released a report that acknowledged eleven voluntary norms – a significant milestone in advancing both the understanding of relevant international laws applicable to information and communications technologies (ICTs) and the imperative of safeguarding critical infrastructure (United Nations General Assembly, 2015). These principles were reaffirmed in the 2021 report by the UN Open-Ended Working Group (OEWG), an initiative originally seen as the GGE’s counterpart and sponsored by Russia (Broeders, Reference Broeders2021, p. 278; United Nations General Assembly, 2021).

Overall, the United States has promoted its norms through the “cyberspace” metaphor, emphasizing minimal government intervention in the digital realm and prioritizing voluntary measures to protect free speech. This approach has influenced US cybersecurity policies abroad and has been effectively championed in international forums such as the UN GGE, where similar norms appear in the UN OEWG, the Paris Call, and the Global Commission (“The 9 Principles,” n.d.; The Hague Centre for Strategic Studies, n.d.).

China and Internet Sovereignty

China views the internet as an extension of its territorial sovereignty, shaping its metaphorical perspective on how the internet should be governed (Bradford, Reference Bradford2023, p. 70). This notion was first introduced in the Chinese State Council Information Office’s 2010 publication, The internet in China (Wang, Reference Wang2020, p. 397). The “internet sovereignty of China” in this context refers to the assertion that the internet within Chinese territory falls under Chinese jurisdiction – a significant statement to partitioning the internet along national boundaries. The Chinese government has spearheaded legitimation and adoption of “internet sovereignty” through its 2017 Chinese Cybersecurity Law, representing the nation’s intent to assert control over the internet within its jurisdiction (Creemers, Webster, & Triolo, Reference Creemers, Webster and Triolo2018). Central to this framework are measures such as “public opinion guidance” and requirements for data localization by foreign companies (McKune & Ahmed, Reference McKune and Ahmed2018, p. 3835; E. Wu, Reference Wu2021, p. 1).

Acting as a norm entrepreneur, China has promoted internet content control norms in regional and international institutions under the principle of internet sovereignty. The Shanghai Cooperation Organization (SCO), jointly led by China and Russia, exemplifies this successful multilateral adoption of digital authoritarian norms and practices (McKune & Ahmed, Reference McKune and Ahmed2018, p. 3841). Formed in 2001, the SCO consisted of China, Russia, Kazakhstan, Kyrgyzstan, Tajikistan, and Uzbekistan. Over time, the organization has developed a robust normative framework and gained international prominence. In 2009, SCO member states adopted the Yekaterinburg Agreement, which established core principles for “international information security” and paved the way for proposing an “International Code of Conduct for Information Security” to the UN in 2011 and 2015 (Ministry of Foreign Affairs of the People’s Republic of China, 2011). This Code of Conduct emphasizes sovereignty, territorial integrity, and political independence, urging UN members to refrain from using ICTs to interfere in the internal affairs of other states or undermine their political, economic, and social stability (McKune & Ahmed, Reference McKune and Ahmed2018, p. 3841). Meanwhile, President Xi Jinping underscored the importance of “respect for cyber sovereignty” at the second World Internet Conference (WIC) held in Wuzhen in December 2015 (McKune & Ahmed, Reference McKune and Ahmed2018, p. 3845).

The concept of “sovereignty” has gained traction, resonating not only in authoritarian regimes but also in liberal democracies such as those in Europe (C.-H. Wu, Reference Wu2021, p. 659). The European Union (EU) has begun using the terms “technological sovereignty” and “digital sovereignty,” driven by the aim of enhancing its competitiveness in the digital realm and ensuring economic independence (Burwel & Propp, Reference Burwel and Propp2020, p. 1; European Commission, 2019, p. 3; von der Leyen, Reference von der Leyen2020). This concept encompasses preserving strategic autonomy and safeguarding security interests, as highlighted by the European Commission (European Commission, 2019, p. 3). The Digital Silk Road (DSR) extends the opportunity to propagate similar ideologies to African nations, potentially importing principles of “internet sovereignty.” One noteworthy policy proposition is “data localization,” which rests on government control, self-determined economic advancement, and societal structuring. This idea holds substantial appeal worldwide, extending well beyond nondemocratic governments (Erie & Streinz, Reference Erie and Streinz2021). The internet appears to be moving toward greater balkanization, marked by the creation of national boundaries that restrict the flow of information within specific jurisdictions (Lemley, Reference Lemley2021, p. 1399).

In general, China’s norm development in the cybersecurity realm has advanced significantly, with one notable achievement being the increased awareness among nations of their sovereignty in the digital sphere. As a result, there has been a growing inclination to implement regulations and policies that exercise state control over the internet. By consistently using the term “sovereignty,” President Xi has emphasized the importance of upholding the principle of internet sovereignty, highlighting the need for nations to assert their authority over their respective digital domains and establish governance mechanisms aligned with their national interests.

Taiwan’s Metaphorical Choice: The Internet as Commons

The main implications of the two norm developments, each driven by a distinct metaphor, center on differing cybersecurity strategies. The US conception of “cyberspace” emphasizes voluntary measures, whereas China treats the internet as an extension of its national territory and favors regulatory controls. However, both perspectives face significant challenges. Under the “cyberspace” metaphor, the notion of a free and open internet, while aligned with the original vision of the internet, leaves democratic institutions vulnerable to attacks. As a result, the National Cybersecurity Strategy, published by the White House in March 2023, calls for coherent regulations in critical sectors, signaling a shift toward a model more akin to China’s (The White House, 2023). Meanwhile, the “internet sovereignty” metaphor – by endorsing stringent regulatory measures – risks creating a “splinternet,” characterized by regulatory conflicts and the potential for authoritarian regimes to curtail online freedoms (Lemley, Reference Lemley2021, pp. 1418–1421).

An alternative path for developing internet norms can be fostered by adopting the metaphor of the internet as “commons.” This approach is not without theoretical foundations – scholars and politicians have long used the term “commons” to characterize the internet, with some referencing concepts such as the “global commons,” “semi-commons,” “pseudo commons” or commons within the economic context (111th Congress, 2010; Benkler, Reference Benkler2003; Chertoff, Reference Chertoff2014; Frischmann, Reference Frischmann2013; Hess, Reference Hess1996; Hess & Ostrom, Reference Hess and Ostrom2003; Lessig, Reference Lessig2001; Mueller, Reference Mueller2020; Shackelford, Reference Shackelford2013, Reference Burwel and Propp2020; Shiffman & Gupta, Reference Shiffman and Gupta2013). Embracing the “commons” metaphor to depict the internet offers two primary advantages.

First, the metaphor of the “commons” aptly captures the shared nature of the internet (Hess, Reference Hess1996). The term “commons” generally refers to a resource shared by a group of people subject to social dilemmas (Hess & Ostrom, Reference Hess and Ostrom2007, pp. 3–4). One specific type of shared resource system, known as a “common-pool resource,” combines the subtractability characteristic of private goods with the difficulty of exclusion typically associated with public goods (Ostrom, Reference Ostrom2010, pp. 644–645). Forests, fisheries, and irrigation systems are prominent examples of common-pool resources worldwide (Ostrom, Reference Ostrom2010, p. 645).

Given the internet’s intricacies, the levels of subtractability and exclusivity vary depending on the aspect of the resource system under examination. The exclusion of internet resources is highly fragmented and piecemeal. When many users access the internet simultaneously, congestion can arise, highlighting the issue of subtractability (Hess, Reference Hess1996). However, the attribute of difficulty of exclusion and high subtractability do not fully encompass the diverse resources of the internet. Accordingly, this research focuses on the notion of the “commons” to capture the internet’s shared nature and highlights three shared resources:

• The cable commons: The internet relies on a vast physical infrastructure, with a network of high-performance submarine cables carrying 99 percent of global traffic between countries and continents (Takeshita et al., Reference Takeshita, Sato, Inada, de Gabory and Nakamura2019, p. 36). This infrastructure can be referred to as the cables commons, comprising more than 552 submarine cables that span the ocean floor and linking to over 1,300 distinct coastal landing stations (McDaniel & Zhong, Reference McDaniel and Zhong2022; TeleGeography, n.d.). Ownership of submarine cables is heavily concentrated in the private sector, with about 99 percent privately owned by prominent telecom carriers, content delivery providers, and investor groups (Burnett, Reference Burnett2021). While network operators have traditionally been the primary investors, content providers such as Google, Amazon, Microsoft, and Meta have also expanded their investments to ensure seamless interconnection between their data centers (Wall & Morcos, Reference Wall and Morcos2021). Excluding others from using the same submarine cables can be challenging, given their shared nature. Congestion may occur due to high demand, technical issues, underinvestment, or geopolitical factors.

• The communications commons: The internet’s most significant accomplishment is its standardized means of communication, enabled by a set of globally accepted protocols. The communications commons refers to the shared, interoperable, and equitable nature of internet communication. This commons is primarily maintained by several organizations, including the Internet Engineering Task Force (IETF), Internet Corporation for Assigned Names and Numbers (ICANN), and Institute of Electrical and Electronics Engineers (IEEE). A foundational conceptual framework for coordinating the development of interconnection standards is the Open Systems Interconnection (OSI) model, developed by the ISO. This model consists of seven abstraction layers, including physical, data link, network, transport, session, presentation, and application layers (ISO, 1994). Each layer represents a specific aspect of the communication process in a computing system. These standards are designed to be open and universal, enabling anyone, anywhere, to build software or hardware that connects to the internet. Because of these open standards and the interoperable nature of the internet, excluding others can be difficult. However, congestion may occur due to network architecture, peak usage, heavy users, or distributed denial of service (DDoS) attacks.

• The content commons: The “content commons” refers to the collective body of information and speech that flows across the internet, shaping the virtual world. It encompasses content created by both users and organizations such as governments, corporations, and academic institutions. Much of this commons is hosted on platforms controlled by large US and Chinese corporations – ranging from social networking to search engine services and e-commerce (CompaniesMarketCap, 2023). Within these platforms, diverse social groups establish various sub-commons, each with unique functions, thereby fostering distinct communities. Sharing content on the web remains relatively easy due to low costs, wide reach, and the prevalence of social media platforms. However, congestion can occur because of information overload, the tendency to prioritize quantity over quality, and the lack of effective content discoverability.

Second, Ostrom’s scholarly inquiry into the governance of commons offers profound insights that can significantly enhance internet governance, particularly regarding cybersecurity strategies. Ostrom’s main contribution to the commons theory lies in her formulation of eight institutional design principles, which are strongly tied to the effectiveness of institutions in managing common-pool resources. These principles were the successful commons management systems she identified among the cases examined in Governing the Commons (Ostrom, Reference Ostrom2015). The eighth design principle, which addresses larger and more complex systems of common-pool resources, specifies that various governance activities associated with robust institutions should be organized across multiple layers of nested enterprises. In subsequent work, Ostrom and others have sometimes used the term “polycentric” interchangeably with, or in reference to, the “nested” requirement of the eighth design principle – though polycentricity implies more than nestedness (Carlisle & Gruby, Reference Carlisle and Gruby2017, p. 930).

While there is no unified definition of “polycentric governance,” at the heart of nearly every discussion is the notion of multiple centers of decision-making, where none of them has ultimate authority for making collective decisions (Stephan, Marshall, & McGinnis, Reference Stephan, Marshall, McGinnis, Thiel, Garrick and Blomquist2019, p. 31). This mirrors the structure of the internet, wherein the decision-making centers encompass national authorities, international organizations, private companies, and individuals. Recognizing this, when governance systems are structured in a polycentric manner – from the smallest to the largest scales – they become capable of addressing collective action problems across multiple levels (Ostrom, Reference Ostrom, Brousseau, Dedeurwaerdere, Jouvet and Willinger2012, p. 107). This arrangement inherently fosters the development of norms among participants through a variety of mechanisms, all interconnected and mutually reinforcing. It emphasizes the potential for effective cooperation, conflict resolution, fruitful competition, and shared learning (Bruns, Reference Bruns, Thiel, Garrick and Blomquist2019, p. 237). As a result, polycentricity highlights the organic and self-organizing nature of internet governance – where multiple centers of decision-making interact and collaborate – and stands in contrast to a purely market- or state-centric approach (Stephan, Marshall, & McGinnis, Reference Stephan, Marshall, McGinnis, Thiel, Garrick and Blomquist2019).

The Taiwan–China conflict illustrates the clash between two different internet metaphors. The US concept of “cyberspace” encourages minimal regulatory intervention and is less effective in mitigating cyberattacks, whereas China’s “sovereignty” perspective prioritizes stricter regulations and enhanced security, often at the expense of freedom of expression. Embracing the metaphor of the “internet as a commons” offers Taiwan valuable insights for formulating its cybersecurity strategy. It directs the attention toward identifying shared resources and decision-making centers within the internet. This metaphor serves as a critical tool for interpreting, shaping, and navigating the intricate landscape of policies and protocols that underpin Taiwan’s cybersecurity frameworks. It also promotes meaningful dialogue among diverse stakeholders – policymakers, technologists, academics, civil society, and businesses – that often transcends disciplinary and cultural boundaries. By adopting this approach, Taiwan gains a strategic advantage without veering toward an overly idealized “cyberspace” metaphor or fully embracing “internet sovereignty.” Individuals can safeguard and coordinate the management of shared resources without relying on centralized rulemaking, thereby enhancing security and fostering norm development (Shiffman & Gupta, Reference Shiffman and Gupta2013, p. 100).

Tragedy of the Internet Commons

V. Ostrom, Tiebout, and Robert Warren (Reference Ostrom, Tiebout and Warren1961) introduced the concept of polycentricity in their endeavor to ascertain the nature of activities undertaken by numerous public and private agencies involved in the provision and production of public services within metropolitan areas (Carlisle & Gruby, Reference Carlisle and Gruby2017, p. 928). V. Ostrom’s idea of polycentricity goes beyond specific domains and encompasses various aspects of societal organization, including economic markets, legal systems, scientific disciplines, and multicultural societies. In the realm of politics, federalism stands as a key example of polycentricity (Stephan, Marshall, & McGinnis, Reference Stephan, Marshall, McGinnis, Thiel, Garrick and Blomquist2019, p. 24). As mentioned earlier, Elinor Ostrom adopted the term in her work on governing the commons, making it a central pillar of the Bloomington School of Political Economy (Carlisle & Gruby, Reference Carlisle and Gruby2017, p. 930).

The main purpose of Ostrom’s polycentric governance is to mitigate the risk of the “tragedy of the commons” (Hardin, Reference Hardin1968). In valuable open-access resources, the absence of an effective governance regime – either by involved parties themselves or external authorities – may lead to suboptimal outcomes. As internet usage increases, it introduces more threat vectors and provides malicious actors with an expanded range of networks to target, creating a scenario akin to the “tragedy of the commons.” While the broader China–Taiwan conflict resembles a vibrant threat system, the emergence of APTs and activities such as undersea cable disruptions, DDoS attacks, and disinformation campaigns within the internet context are analogous to overexploitation of resources across different internet commons. These developments present a collective action problem that falls within the realm of classic social dilemmas (Shackelford, Reference Shackelford2013, p. 1293).

Taiwan’s Polycentric Governance in the Internet Commons

Within the internet commons, global problems involve a diverse array of actors, extending beyond governments to include corporate entities that serve as agents for complex publics and exhibit significantly intricate behavior (McGinnis & Ostrom, Reference McGinnis and Ostrom1992). As mentioned, nearly every discussion of polycentric governance revolves around the concept of multiple “decision-making centers” (Stephan, Marshall, & McGinnis, Reference Stephan, Marshall, McGinnis, Thiel, Garrick and Blomquist2019, p. 31). This concept highlights the distributed nature of governance, where power and decision-making are dispersed across various institutions. Jurisdictions of authority may overlap, with many centers of decision-making operating formally independent of each other (Ostrom, Tiebout, & Warren, Reference Ostrom, Tiebout and Warren1961). The goal of polycentric governance is to facilitate the use of local knowledge and build mutual trust (Cole, Reference Cole2015). Local communities possess the skills, local knowledge, and capacity to overcome many challenges, making it essential to resolve problems as close to these communities as possible. This approach effectively addresses the challenges posed to traditional models of democracy centered on the nation-state (Scholte, Reference Scholte and Kohl2017, p. 167). Polycentricity challenges the belief that either the state or markets alone hold the solution to addressing complex challenges (Shackelford, Reference Shackelford2013, p. 1333). Instead, it creates an effective mechanism for cooperation, coordination, conflict resolution, and the utilization of local knowledge.