Who is cybersecurity for? Taiwan’s approach to engaging the public

This story is part of GovInsider's Digital Trust & Cybersecurity Champions 2026 Special Report. 

Who feels responsible for cybersecurity depends, in part, on how governments talk about it. 

Describe it as a technical problem, and people may see it as someone else’s job.

Wei Jeng, Deputy Director General of the Administration for Cyber Security (ACS) in Taiwan’s Ministry of Digital Affairs, sees cybersecurity as a policy concern.

She wants to tackle the question of how governments can communicate cyber risks, so that more people see a role for themselves in protecting the nation.

She holds two roles in governmental cybersecurity, and an associate professor at the National Taiwan University where her academic work focuses on open science.

"Open science and cybersecurity look like two very different fields: one side encourages people to share information and data, and the other side protects them,” she says. 

But across both fields, the key questions remain the same: "For what purpose, to whom, and when?". 

These questions guide her approach at the ACS, where she oversees the implementation of Taiwan's Cybersecurity Management Act, and coordinates the country’s cybersecurity capabilities including national incident response and international cooperation. 

How language shapes responsibility for cybersecurity 
 

Jeng researches on how metaphors and visual narratives shape the way that experts, policymakers and the public understand cybersecurity risks. 

Drawing on Taiwan’s science media and industry professionals’ descriptions of cybersecurity, her research found that war and crime metaphors dominated the discourse. 

This raises questions about how government communications can help more people understand their stake in cybersecurity and participate in decisions about it. 

The language governments use can emphasise certain aspects of a threat while obscuring others, she explains. 

It also influences who people believe should respond, and whether they see a role for themselves. 

“Language is not a neutral tool. The words a government chooses, determine whether people pay attention to cybersecurity at all and, once they do, how they understand the risk and act,” she says. 

On one hand, terms such as “offence”, “defence”, and “resilience” quickly convey the urgency of strengthening cybersecurity among decisionmakers involved in international diplomacy and national policymaking. 

On the other hand, when used in public communications, such metaphors make cybersecurity seem primarily the responsibility of only some authorities and experts, she says. 

"Those frames reduce cybersecurity to fending off external attackers, leaving little room for individual daily behavior, cooperation between organisations, and shared maintenance," she says. 

The findings inform how the ACS writes its press releases, campaigns, and monthly reports. 

"The test we apply is whether the wording lets those people feel that cybersecurity has something to do with them and see their own role in it," says Jeng. 

Public agencies have laws, audits, and drills which guide their approaches to cybersecurity. 

For citizens and businesses, they receive such guidance through governmental messaging and the media, which they rely on for explanations of what cyber risks mean for them. 

The way governments describe cybersecurity is therefore critical; it should help people understand the risks and the steps they can take to protect themselves. 

Framing the issue using health-related terms instead, suggests Jeng, speaks of the issue as being about daily maintenance and prevention. 

A risk-management frame is also recommended for a similar reason. 

"It helps people accept that threats can never be reduced to zero, so risks are identified and reduced regularly, and cybersecurity becomes a daily practice that improves over time," she says. 

Build resilience through everyday institutions 

For a cybersecurity awareness campaign to produce lasting changes in behaviour, governments should focus on the institutions people are already actively engaged in, Jeng says. 

These are places like families, schools, communities, workplaces, and the platforms and services they use every day. 

Government campaigns have traditionally relied heavily on one-way information delivery, she says, often producing formulaic messages in which people struggle to see themselves. 

To address this, ACS is bringing behavioural science and science communication into its work through card games, toolkits, tabletop exercises and self-assessment checklists that start from people’s own circumstances. 

The aim is to help people develop habits that remain useful even as technologies and threats change. 

These include staying sceptical, verifying important requests through a separate channel, such as a phone number already known to the recipient, and continuing to learn as technology develops. 

For government agencies and critical infrastructure providers, Taiwan’s Cyber Security Management Act requires incidents to be reported and subjects organisations to audits and exercises. 

But Jeng says reporting only works if organisations receive something useful in return. “Whoever reports has to get back more than they gave,” she says. 

When an agency reports an incident, national security operations, emergency response and information-sharing bodies can help contain the attack, support recovery and share lessons with other organisations so they are better prepared for similar threats. 

Jeng says the same principle of reciprocity still applies for organisations outside the law’s direct reach. 

Enterprises that encounter attacks can share information with the TWCERT/CC network and receive early warnings in return. 

For smaller businesses and members of the public, support can take the form of education, practical tools and university cybersecurity clinics, where students work with small and medium-sized enterprises (SMEs) on security checks and awareness training. 

The aim, she says, is not to eliminate cyberattacks altogether. 

“Zero attacks are beyond any country's realm,” Jeng says. 

Instead, Taiwan is trying to build a society capable of protecting itself, recovering quickly when attacks occur and sharing lessons so that others are better prepared. 

“Every democracy is building the same thing under the same pressure, and the building goes faster when we compare notes.”