In a recent Foreign Affairs article, the American Enterprise Institute’s Oriana Skylar Mastro issued a grim warning: A Chinese military invasion of Taiwan could be imminent. Citing “disturbing signals” that the Chinese government is “reconsidering its peaceful approach and contemplating armed unification,” Mastro predicts that cutting Taiwan off from the outside world via cyberattacks is one avenue through which China might initiate an armed takeover of the island. Facing China’s growing cyber prowess — shrouded in a veneer of concern for cybersecurity — U.S. policymakers should take this threat seriously.
Chinese President Xi Jinping has called the unification of Taiwan and China “inevitable,” and the costs of ignoring him are too high. Taiwan is a staple of both U.S. trade and grand strategy. Coined an “unsinkable aircraft carrier” by Gen. Douglas MacArthur, the island is a key U.S. trading partner and perhaps Washington’s greatest source of strategic leverage over China. Crucially, for at least the next half-decade, Taiwan will be the sole supplier of the world’s most advanced semiconductor chips for the U.S. and its allies. Taiwan Semiconductor Manufacturing Corporation (TSMC) currently produces more than 50 percent of the world’s semiconductors. Although TSMC and other chip producers have longer-term plans for moving some manufacturing to the United States, a Chinese invasion of Taiwan raises the alarming possibility of fewer chips for our nation’s most important technologies.
An armed unification of China and Taiwan would have occurred decades ago absent continued defensive support from the U.S. China’s reluctance to invade thus has served as either a tacit recognition of U.S. military superiority, or of the high political, social and economic costs of an invasion. Given China’s increasingly aggressive posture toward Taiwan, this calculus is clearly changing.
In the cyber realm, Beijing’s offensive might is far from fantasy. Mastro notes, “Xi’s military reforms have improved China’s cyberwarfare and electronic warfare capabilities” and that “many U.S. experts worry that China could take control of Taiwan before the United States even ha[s] a chance to react.”
In 2019, then-Director of National Intelligence Dan Coats testified that “China has the ability to launch cyber attacks that cause localized, temporary disruptive effects on critical infrastructure — such as disruption of a natural gas pipeline for days to weeks” in the U.S., Taiwan and beyond. If a Chinese cyberattack cripples Taiwan’s critical infrastructure and disables its digital communications, the already unfavorable odds of a U.S. rescue mission would be strained by limited intelligence. At worst, the U.S. might not even know an invasion was launched until it was already over.
The Chinese state’s enriched cyber capabilities, along with its growing brazenness, have been further evidenced by attacks against Microsoft Exchange servers in the United States and United Kingdom, and home and office Wi-Fi routers in France. (The Microsoft hacks were serious enough to merit NATO’s first-ever condemnation of a cyberattack.) We do not yet know whether the Microsoft attack has been used for economic espionage, but China has a poor track record of upholding its commitments to not use such breaches for that purpose. Recently, Taiwan’s cybersecurity agency also revealed that the island faces around 30 million cyberattacks per month — half of which originate from China. Despite new laws restricting private commerce in the name of cybersecurity, China’s surface-level emphasis on good cyber behavior is far less tangible than the legitimate cyber threat it poses to both the U.S. and Taiwan.
The U.S. must take clear action in the face of these threats. First, the Biden administration should consider launching a U.S.-Taiwan joint cyber preparedness framework. This might mean a mutual breach notification treaty between the two sides — with caveats. Both parties are cyber-attacked countless times per day, and even if China is responsible for a sizable portion, notifying one another nonstop about such incidents could create information overload and violate existing secrecy arrangements (such as under the Five Eyes). Some fine-tuning — perhaps guidelines on classified information and an emphasis on infrastructure attacks — thus would be necessary.
Though a breach notification framework may help intelligence officials on both sides to detect suspicious trends and thwart attacks in their early stages, such a system is not guaranteed to withstand a surprise attack or attempted shutdown of Taiwan’s power supply. The U.S. might consider equipping regional military bases with cyber and internet experts who could better act on early intelligence because of their proximity to Taiwan by scrambling teams and technologies — namely, satellite-based networks and high-altitude balloons — to help reconnect Taiwan to the internet. A group of lawmakers and one Federal Communications Commission (FCC) official recently called for a similar undertaking in Cuba, though other experts noted that a degree of physical infrastructure would be required on the ground. The Biden administration should consult the FCC and other key agencies to assess the cost, feasibility and possible timeline of stationing the necessary equipment in Taiwan’s vicinity.
The constant pace of innovation in the cyber realm means that preventing a Chinese attack on Taiwan becomes more challenging each day. Because China’s motives and abilities already pose a clear threat, the U.S. should act now to secure Taiwan’s cyberspace.
Claude Barfield is a senior fellow with the American Enterprise Institute. A former consultant to the Office of the U.S. Trade Representative, he researches international trade policy, including trade policy in China and East Asia.
William Rau is program manager of technology policy studies at the American Enterprise Institute.