Press Conference | Opening the Floodgates to Surveillance: Does Parliament Agree? Joint Press Release by Civil Society Organizations

In response to the Legislative Yuan's upcoming review of the Fraud Crime Hazard Prevention Act, the Communication Security and Surveillance Act (CSSA), the Money Laundering Control Act, and the Technology-Based Investigative Methods Act this week, civil society organizations have jointly issued a statement regarding several controversial provisions in the Executive Yuan's draft bills, particularly the Fraud Crime Hazard Prevention Act and the CSSA:

1. Drastically expanding surveillance items and lowering the surveillance threshold: The draft CSSA infringes upon privacy and informational self-determination
2. Providing a shortcut for website blocking in the Fraud Crime Hazard Prevention Act: The government fails to patch loopholes and instead hands over a blank check
3. A vacuum of corporate responsibility in the Fraud Crime Hazard Prevention Act: With zero-threshold exemption clauses, citizens have no way to hold anyone accountable!
4. Confusing account-freezing regulations and a lack of relief procedures under the Fraud Crime Hazard Prevention Act: Financial credit is stripped away merely upon suspicion of fraud
5. Whistleblowing provisions in the Fraud Crime Hazard Prevention Act: Risks adding an unnecessary burden on frontline police officers or even backfiring
6. The "three-strikes" provision in the Fraud Crime Hazard Prevention Act: Improper connection, double punishment, and an unnecessary burden on correctional facilities

---

1. Drastically expanding surveillance items and lowering the surveillance threshold: The draft CSSA infringes upon privacy and informational self-determination

This draft amendment to the CSSA involves numerous provisions that infringe upon privacy and informational self-determination.

According to statistics from the Ministry of Justice for 2023, among the 80,578 criminal cases where police retrieved "telecommunication user data"—such as the name, ID number, address, and contact information of the registered phone number holder—62,792 cases were retrieved directly by prosecutors; 14,250 cases involved police applying to prosecutors for review, with an approval rate of 99.61%; and 3,536 cases were reviewed by judges, with an approval rate of 89.14%.

Under the current amendments, the Executive Yuan deems neither "prosecutorial reservation" nor "judicial reservation" necessary. Police investigating all criminal cases would be able to directly obtain a suspect's user data. Regarding this major shift, the Executive Yuan's sole justification is that "user data involves a lower degree of privacy and therefore falls outside the scope of protection for the freedom of secret communications." We believe the legitimacy of this policy shift is questionable and the explanation is inadequate.

First, although the rejection rate is not high, 439 retrieval requests were still rejected in 2023. What corresponding remedies and oversight mechanisms will be in place after the draft takes effect? Furthermore, the number of police officers is approximately 60 times that of prosecutors; how can policy ensure that open retrieval will not be abused? Can the aforementioned issues be adequately explained by simply stating that "user data involves a lower degree of privacy"?

Meanwhile, this amendment allows prosecutors and police to obtain a suspect's "internet traffic records" in a manner comparable to how they previously retrieved "telecommunication user data." According to the definition in Article 3-1 of the draft, this includes "mobile device identification codes," "IP addresses," "connection time and usage volume," and "browsing URLs" generated when a mobile phone uses mobile internet. In addition, because this definition adopts an "exemplifying" approach, anything outside of "communication content" could potentially be classified as retrievable "internet traffic records" in the future.

Judging from the aforementioned statistics, if this draft passes, prosecutors and police will be able to obtain the aforementioned "internet traffic records" in 90% of cases without going through the courts. In this regard, the Executive Yuan has not published the negative impact on human rights, nor has it provided a concrete assessment and explanation. It merely waves the banner of "combating fraud" and expects the public and the Legislative Yuan to agree to this blank policy check.

We express grave concern and apprehension regarding this, and call upon the Legislative Yuan to exercise strict gatekeeping. We also demand that the Executive Yuan provide a complete explanation and "human rights impact assessment" regarding the formulation and practical needs of this policy.

2. Providing a shortcut for website blocking in the Fraud Crime Hazard Prevention Act: The government fails to patch loopholes and instead hands over a blank check

Currently, the method of website blocking commonly used by our law enforcement agencies involves utilizing Taiwan Network Information Center's (TWNIC) DNS RPZ mechanism to disable DNS resolution, preventing ordinary internet users from accessing relevant web pages. This is one of the methods commonly known as "website blocking." The DNS RPZ mechanism itself lacks legal authorization or regulation; rather, it has gradually formed through the "self-regulation" of internet service providers. Currently, DNS RPZ is divided into two major categories: one is based on court rulings, and the other—which is also the most criticized by civil organizations—is for emergency cases (RPZ 1.5). RPZ 1.5 claims to be able to block suspicious websites within half a day, serving as a highway that bypasses judicial fair review procedures, and has been widely used over the past two years.

Astonishingly, this widely used shortcut for website blocking lacks any legal authorization. Yet this serious rule-of-law blemish has long been regarded as a highlight by the Ministry of Digital Affairs, which has progressively expanded website-blocking scenarios from websites with initial cybersecurity doubts to taking down websites suspected of fraud and gambling, and even to "combating fake news" during elections. These website-blocking measures, which undergo no independent agency review either before or after implementation, disregard the basic due process required in a democratic and legal society for freedom of speech and internet freedom. This website-blocking shortcut, which bypasses legal regulations and lacks oversight, seemingly convenient, has already resulted in several "mistaken blocking" blunders. In April of this year, a mistaken blocking incident occurred on WordPress, a widely used website building platform, temporarily halting resolution for all websites built via WordPress, causing massive disruption. In fact, Taiwan was docked points in Freedom House's 2023 Internet Freedom Index precisely because of such website-blocking mechanisms.

Today, rather than comprehensively reviewing and improving this website-blocking shortcut, the government has instead established an extremely hollow authorization in the Fraud Crime Hazard Prevention Act. While it appears to patch the long-standing loophole of lacking legal reservation, it actually allows the loophole to continue worsening in a seemingly justified manner.

Indeed, under specific critical circumstances, emergency disposition is necessary. For example, Article 131 of the Code of Criminal Procedure also permits warrantless emergency searches, provided that specific requirements are met and subsequent review regulations—such as reporting to the court for approval after execution—are followed. Similarly, while legislation permits emergency website-blocking, relevant requirements and procedures should also be established to ensure it is not abused. These include: specific triggering requirements for emergency website-blocking; the requirement that the initiating unit submit an application for review to an independent agency within a certain number of hours after completion of the website-blocking; the timeframe within which the independent agency must complete its review; the right of the interested party to state their opinions; and a remedy system for interested parties.

To ensure that the emergency website-blocking mechanism is not abused and does not infringe upon freedom of speech and internet freedom, the JRF calls upon the authorities not to condone the legalization of unconstrained blank checks for website blocking until relevant triggering thresholds and ex-post review regulations are established.

3. A vacuum of corporate responsibility in the Fraud Crime Hazard Prevention Act: With zero-threshold exemption clauses, citizens have no way to hold anyone accountable!

Articles 12, 14, and 38 of the Fraud Crime Hazard Prevention Act broadly exempt numerous industries from civil liability. The threshold set for these exemption clauses is extremely broad: as long as they are implementing "anti-fraud measures" under this Act or "dispositions taken" in cooperation with government agencies, they are unconditionally exempted from liability.

Perhaps such exemption clauses stem from good intentions, hoping that businesses can act with peace of mind and take bold, decisive measures to combat fraud. However, due to a severe lack of clarity and regulatory design with substantive thresholds—such as conditions excluding damages caused by intentional misconduct or gross negligence—this risks expanding the scope of exemption infinitely.

Furthermore, the industries involved in these provisions are diverse, including e-commerce, internet advertising platforms, the financial sector (including virtual asset platform operators), telecommunications, and online multiplayer gaming. In the future, as long as these companies claim they were cooperating with the government's anti-fraud efforts, any damage caused to anyone in the process will, under the current zero-threshold provisions, be entirely free of any liability for compensation. The potential impact on people's daily lives and digital rights is deeply alarming!

4. Confusing account-freezing regulations and a lack of relief procedures under the Fraud Crime Hazard Prevention Act: Financial credit is stripped away merely upon suspicion of fraud

When the amendment to the Money Laundering Control Act added the "crime of receiving/delivering accounts without justifiable reason" in June last year, our foundation once again emphasized that the existing controversy in fraud crimes regarding "broad determination of subjective elements" would not disappear with the addition of this offense. Now that the Money Laundering Control Act has been in effect for a year, related problems have not eased, yet the plight of individuals wrongfully accused in dummy-account cases has become increasingly dire.

The Regulations Governing the Suspension or Restriction of Functions of Accounts and Account Numbers or Direct Closure Management under Paragraph 6 of Article 15-2 of the Money Laundering Control Act, which took effect on March 1st this year, stipulate that if a perpetrator violates Article 15-2 of the Money Laundering Control Act and is disciplined with a warning by a police agency, the effect of freezing the account shall last for 5 years starting from the date of the warning. This has a more severe impact than the 2-year regulation under the Regulations Governing Deposit Accounts and Suspected Illegal or Clearly Abnormal Transactions. In addition to facing relentless prosecution by the judiciary, individuals wrongfully accused as dummy-account holders must face a severely disrupted daily life, with no way of knowing when their accounts will be unfrozen for continued use.

Unexpectedly, the provisions of the current Fraud Crime Hazard Prevention Act go to even greater extremes, introducing account-freezing regulations even for "those suspected of participating in fraud crimes." A close examination of the draft reveals that financial institutions may actually adopt control measures against "abnormal deposit accounts, electronic payment accounts, credit cards, or virtual asset accounts" of "those suspected of participating in fraud crimes," including "continuously reviewing customer identity," "suspending deposits or withdrawals," "remitting funds or virtual assets," "suspending all or part of transaction functions," "controlling credit cards and suspending credit card account transaction functions," and "refusing to establish business relationships or provide services." This no longer merely affects the rights of defendants in criminal cases; it completely expands the government's scope of control over people's property rights. Furthermore, the provisions lack any specification regarding the effective duration of the aforementioned dispositions, nor do they stipulate how citizens subjected to such dispositions may contest or seek relief.

While combating fraud is an urgent necessity, financial-end regulation is certainly a crucial component of fraud prevention. However, since many current scams are conducted using virtual currencies, it remains unknown how many cases can actually be blocked through financial industry regulations. Failing to provide the public with avenues for relief against potential "wrongful collateral damage" is even more inappropriate.

Worse still, Articles 43 and 44 of the draft Fraud Crime Hazard Prevention Act once again increase criminal penalties. Does this genuinely help achieve anti-fraud goals? And does it comply with the principle of proportionality? These questions are also highly questionable.

5. Whistleblowing provisions in the Fraud Crime Hazard Prevention Act: Risks adding an unnecessary burden on frontline police officers or even backfiring

From the perspective of frontline police officers, the reward mechanism for "personnel with meritorious service in the prevention and control of fraud crimes" actually suffers from vague definitions. Aside from disputes over the distribution of case-solving bonuses commonly seen in practice, fraud prevention encompasses not only investigation but also public advocacy, frontline interception, and other aspects. Regarding bonuses, national budgets are inevitably limited and involve trade-offs, and such bonuses may not be entirely fair to personnel responsible for different items, thereby affecting actual policy implementation.

The fundamental problem with our country's criminal work bonus system lies in the fact that it practically confuses "routine payments" with "non-routine payments." The low willingness of frontline police officers to participate in criminal work ultimately stems from the problem of "excessive routine workload." While bonus systems can reward hardworking personnel, their nature remains "non-routine." To genuinely boost willingness overall, aside from resolving the structural problem of basic overall manpower shortages, personnel policies should focus primarily on increasing routine payments (such as allowances) supplemented by bonus systems.

Moreover, in concrete operation, frontline officers must also face the burden of screening cases following reports. Aside from discerning the quality of tips amid a flood of "enthusiastic" public reports and having to explain to informants whether action will be taken, officers may also encounter complex evaluations such as internal whistleblowing or rival organizations framing one another, the chaos of which can be easily imagined. While a reward system can boost reporting willingness and increase tips, whether it will subsequently create extra workloads or legal controversies must also be carefully considered.

6. The "three-strikes" provision in the Fraud Crime Hazard Prevention Act: Improper connection, double punishment, and an unnecessary burden on correctional facilities

The draft also introduces a "three-strikes" provision targeting fraud crimes. However, the so-called three-strikes provision restricts the right to "parole." Parole focuses on the correctional progress of inmates in correctional facilities, which involves completely different considerations at a different stage from "crime prevention and control."

Using "restricted parole" to "combat crime" in the current draft risks an improper connection between ends and means. Furthermore, the Criminal Code already provides for increased penalties for repeat fraud offenders; imposing additional restrictions on parole conditions risks double punishment, and may even penalize vulnerable youth groups who are already at the bottom of society and exploited by fraud syndicates.

Particularly considering the chronic overcrowding in our prisons, the Ministry of Justice should first study whether "extending prison sentences" and "restricting parole" can genuinely reduce fraud crime rates. Otherwise, this merely shifts social costs onto correctional procedures without truly solving the problem of fraud crimes, let alone satisfying victims' demands for compensation.

Press Conference Attendees

Ch'en Chün-hung / Standing Board Director, Judicial Reform Foundation; Chairperson, Taiwan Association of Criminal Defense Lawyers
Kao Yang-hui / Standing Executive Committee Member, Judicial Reform Foundation
Hsiao Jen-hao / Standing Director, Taiwan Police Work Rights Promotion Association
Ch'iu Ch'i-hung / Member, Judicial Reform Committee, Taiwan Bar Association
Chou Kuan-ju / Deputy Secretary-General, Taiwan Association for Human Rights
Li Po-feng / Chairperson, Open Culture Foundation

Press Contacts

Chang Hua-che, Deputy Director of Case Action Department, Judicial Reform Foundation
Email: ven@jrf.org.tw

Huang, Project Manager for International Affairs and Digital Human Rights, Judicial Reform Foundation
Email: grace.huang@jrf.org.tw