Op-Ed | From the Xiaohongshu Incident to the Amendments to the National Security Act: Website Blocking Measures Must Establish Due Process and Prevent "Emergency Exceptions" from Becoming the Norm

On December 4, 2025, the Ministry of the Interior invoked Article 42 of the Fraud Crime Hazard Prevention Act, concerning "emergency cases for fraud crime prevention," to issue a one-year order to "suspend domain name resolution or restrict access" to the Xiaohongshu app, also known as RedNote in English.[1] The move attracted significant public attention and prompted discussion over how a governance model can be designed to avoid creating a false zero-sum conflict between "countering digital authoritarianism" and "upholding the rule of law and human rights." Even if the purpose of this measure was to "combat fraud," questions remain as to whether the Ministry of the Interior had a sufficiently solid legal basis for adopting such an emergency measure and whether adequate procedural safeguards were in place. The current absence of mechanisms for prior review and subsequent approval still warrants serious examination by the legislature and civil society. Xiaohongshu is also referred to as RedNote in English-language reporting by the Taipei Times.

Two weeks after the Xiaohongshu incident, on December 18, 2025, the Executive Yuan announced draft amendments to certain provisions of the National Security Act. The proposed amendments would introduce administrative penalties for publicly advocating war online and require online platform operators to cooperate in removing content, deleting user accounts, and preserving relevant data. They would also replicate the "Xiaohongshu model" by authorizing the Ministry of the Interior, in emergency circumstances, to directly order the suspension of domain name resolution or restriction of access. The Executive Yuan's December 18 draft indeed proposed adding these Internet-related measures to Articles 4 and 4-1.

When an "Emergency" Provision Becomes an Institutional Shortcut

It is understandable that, when circumstances are genuinely urgent, the law must provide administrative authorities with a means of taking emergency action. However, both the Fraud Crime Hazard Prevention Act, which is already in force, and the recently announced draft amendments to the National Security Act focus heavily on granting administrative authorities the power to act immediately when blocking access to websites. Yet neither framework has established sufficiently robust due process mechanisms to constrain the exercise of that power. Specific standards for what constitutes an "emergency," independent third-party review before or after the measure is imposed, including judicial review, and opportunities for affected parties to participate and seek remedies all remain largely absent.

Under the current statutory framework for fraudulent content appearing on online platforms, the ordinary procedure under Article 39 of the Fraud Crime Hazard Prevention Act is first to impose a fine on the platform operator and order it to take corrective action within a specified period. Where the violation is serious and remains uncorrected after the deadline, the Ministry of Digital Affairs must convene an expert review meeting before measures such as traffic management or restriction of access may be imposed on the platform. By contrast, Article 42 of the Fraud Crime Hazard Prevention Act authorizes the relevant competent authorities or judicial police authorities, where immediate action is deemed necessary, to directly order Internet service providers to suspend domain name resolution or restrict access. It does not establish different legal consequences according to the severity of the circumstances, nor does it provide a mechanism for subsequent procedural review or judicial approval. Article 42 currently provides that emergency action may be taken to prevent citizens from accessing fraudulent websites in a timely manner.

Similarly, proposed Article 4-1 of the National Security Act establishes an ordinary procedure for removing online speech under which the Ministry of the Interior must first consult the relevant agencies, including the Ministry of Justice, Ministry of Digital Affairs, and Mainland Affairs Council, before ordering an Internet service provider to remove content or a user account. However, where the circumstances are serious or immediate action is necessary, the Ministry of the Interior would be permitted to bypass these procedures and reviews and directly initiate blocking measures. Like the Fraud Crime Hazard Prevention Act, the draft contains no mechanism requiring subsequent completion of the omitted procedures or ex post review and approval. Contemporary reporting on the Cabinet-approved draft likewise states that the Ministry of the Interior could directly order Internet access providers to halt domain resolution or restrict access when circumstances are serious or immediate action is necessary to avert imminent harm.

This legislative gap effectively creates a perverse institutional incentive for administrative authorities. If an authority follows the ordinary procedure, its decision must pass through multiple layers of stringent procedural review. Yet once an incident is characterized as an emergency involving "a need for immediate action," the safeguards of procedural justice and institutional checks disappear because of the regulatory vacuum. This structural imbalance can readily encourage authorities to choose the emergency route presenting the least resistance, ultimately depriving restrictions on speech and information of the scrutiny that the exercise of public power should require.

Case Review: Examining the Legality of the Emergency Blocking Measure Against Xiaohongshu

The Xiaohongshu blocking case provides a real-world test of Taiwan's emergency Internet restriction regime and its procedural deficiencies, and can help clarify the direction of future amendments to both the Fraud Crime Hazard Prevention Act and the draft National Security Act.

First, the Ministry of the Interior's order suspending domain name resolution or restricting access to the entire Xiaohongshu platform should be examined under the principle of proportionality. With respect to suitability, although the measure may formally contribute to combating fraud, it is primarily implemented through DNS Response Policy Zone (DNS RPZ) technology, and users can readily circumvent the restriction by switching DNS services or using a VPN. Its practical effectiveness is therefore quite limited. Because the measure may not effectively achieve its stated objective, there is reason to question whether it satisfies the suitability requirement.

With respect to necessity, if the government did not first employ less restrictive alternatives—such as requiring the targeted removal of specific fraudulent content or imposing traffic restrictions only on particular platform functions—but instead directly imposed a platform-wide measure affecting the information-access rights of millions of users, the action could be regarded as excessive and inconsistent with the requirement that such intervention be used only as a last resort. More importantly, the institutional purpose of an emergency measure should be to stop imminent harm and create sufficient time for the matter to return to ordinary procedures. In this case, however, a restriction lasting an entire year was imposed at once. In substance, the measure quietly transformed into a long-term regulatory measure, departing entirely from the emergency and temporary character that should define such powers and seriously raising concerns under the least-restrictive-means requirement.

Finally, under proportionality in the strict sense—that is, the requirement that the means employed remain proportionate to the objective pursued—the Ministry of the Interior may face considerable difficulty demonstrating that the public interest in combating fraud outweighs the comprehensive harm imposed on public access to information, freedom of expression, and related economic activities. Viewed from this perspective, the Ministry's emergency measure may have significant difficulty satisfying the principle of proportionality.

It is also important to note that the object that Article 42 of the Fraud Crime Hazard Prevention Act authorizes the government to block in an emergency is expressly limited to "fraudulent websites," such as fraudulent websites impersonating government agencies or banks and single-page scam websites. The Ministry of the Interior's reliance on this provision to impose emergency blocking measures on a social media platform such as Xiaohongshu therefore arguably involves an improper application of the statute. Despite the existence of statutory provisions governing the ordinary handling of fraud involving online platforms, the Ministry instead relied on a provision intended specifically for the emergency blocking of "fraudulent websites." This further illustrates the peculiar gaps in Taiwan's current platform-governance framework.[2]

Rebuilding the Rule-of-Law Firewall for Website Blocking

When the state exercises public power to block access to a website, it imposes a significant restriction on freedom of expression, freedom of access to information, and Internet freedom. Such measures should therefore be accompanied by the most robust possible procedural safeguards. Yet the provisions governing suspension of domain name resolution and restriction of access under the Fraud Crime Hazard Prevention Act, whether through the ordinary procedure under Article 39 or the emergency procedure under Article 42, remain seriously deficient in terms of due process.

Nearly a year and a half has passed since the Fraud Crime Hazard Prevention Act was promulgated. Nevertheless, the Ministry of Digital Affairs, as the competent authority for industries related to the digital economy, has still not fulfilled its statutory responsibility under Paragraph 4 of Article 39 to establish and promulgate criteria for determining what constitutes a "serious" violation, standards governing the exercise of discretion in adopting traffic-management measures or restricting access, and regulations governing the composition, functions, and other procedural requirements of expert review meetings.

Consequently, when the government deals with platforms that in practice account for a substantial volume of fraud cases, such as Line, Google, and Meta, it still lacks a normalized due process framework that incorporates proportionality review and expert deliberation.

In this respect, the Ministry of Digital Affairs should actively fulfill the institution-building responsibilities imposed on it by law and promptly fill the gaps in the ordinary regulatory framework. Only by establishing a complete system of due process safeguards can administrative authorities be prevented from relying excessively on emergency provisions in response to public pressure to combat fraud, thereby ensuring that the exercise of public power does not circumvent the institutional oversight that should ordinarily apply.

The structural deficiencies in the emergency measures authorized by Article 42 can be addressed in two respects. First, as a matter of legal certainty, the implementing regulations should specifically set out the elements or factors that constitute an "emergency," preventing administrative authorities from adopting highly intrusive measures merely by formally invoking the statutory provision. Second, as a matter of due process, an ex post approval mechanism should be considered. For example, a blocking measure could be required to obtain approval from a court or an independent professional body within 48 hours after it is imposed.

Taiwan could also draw on the stringent procedures governing the "temporary restriction of access" under Article 51(3)(b) of the EU Digital Services Act (Regulation (EU) 2022/2065).

Under that framework, restriction of access is treated as a measure of last resort: other enforcement powers must first have been exhausted, the infringement must remain unremedied or ongoing and cause serious harm, and it must constitute a criminal offense involving a threat to the life or safety of persons before the competent Digital Services Coordinator may request a judicial authority to order a temporary restriction of access. The EU framework also provides for the participation of interested parties, ordinarily requiring that they be given at least two weeks to submit written observations before the request is made. Any restriction is generally limited to four weeks, and extensions are subject to authorization and conditions established by the competent judicial authority.

Looking more broadly at the draft amendments to the National Security Act, important questions also remain concerning how "false or misleading information" should be defined and what should qualify as "public" dissemination. These issues will undoubtedly become focal points of public debate. Taiwan should work toward establishing a coherent legal framework for platform accountability and implementing rigorous due process for Internet restriction measures, rather than relying solely on fragmented forms of content regulation. The most urgent task at present is to use legislation to clearly define the threshold for invoking emergency website-blocking powers and to establish sound mechanisms for both ex ante and ex post review and oversight.

If an exceptional route for government website blocking becomes normalized, what will ultimately be damaged is the public's freedom to access the Internet and the stability of democratic rule of law. Only by ensuring consistency between the means we use to defend democracy and the democratic values we seek to protect can Taiwan safeguard its most precious values of democracy and freedom while also defending national security and social stability.

---

[1] In legal terminology, "suspension of domain name resolution or restriction of access" generally refers in practice to Internet Access Service Providers (IASPs) ceasing to resolve specified domain names through DNS blocking, thereby technologically preventing users from connecting to unlawful content. This constitutes one form of website blocking in the broad sense and is currently among the regulatory measures most commonly employed by administrative authorities.

[2] In the Xiaohongshu case, because Xiaohongshu had not been designated by the Ministry of Digital Affairs as an online advertisement platform operator "reaching a certain scale" under Article 27 of the Fraud Crime Hazard Prevention Act, Articles 27 through 41 of the Act did not apply to the platform. This includes the "local presence" requirement emphasized by the Ministry of the Interior in this case, namely Xiaohongshu's failure to designate a legal representative in Taiwan under Articles 28 and 29 of the Fraud Crime Hazard Prevention Act.

*Originally published on January 7, 2026, on CommonWealth Independent Opinion.