Taiwan Kills Facial Recognition System

Update (October 21, 2026)

In the days after the National Immigration Agency suspended Face8 on January 1, 2026, the procurement scandal expanded rather than resolved.

On December 30, 2025 the Ministry of Economic Affairs' Bureau of Commerce (商業署) said it had paused its facial-recognition attendance feature, which was still in testing, as a preventive measure to ensure information security.^[4] The Hsinchu City Government followed on January 6, 2026, urgently disabling its own copy of the same Face8 attendance system. United Daily News reported that staff inside the city government had heard of a suspected intrusion, while the city government said it had found no evidence of a hack or data leak and had disabled the system preventively because it matched the one used by the Immigration Agency.^[5] The Hsinchu decision extended the practical impact of the MOI suspension from central agencies to municipal users.

Papago (研勤科技) publicly stated that "all key components are Taiwan-made," pushing back against the reporting, but did not publish a detailed bill of materials or an independent third-party component-traceability report.^[6] Coverage by Storm Media and IDSMag amplified the procurement questions the original Mirror Media report raised. Storm Media reported that the Immigration Agency spent about NT$6 million in 2024 on the face-recognition hardware and cited a vendor-claimed throughput of 500,000 recognitions a day across its clients.^[7][8]

As of October 21, 2026 the Ministry of the Interior has not published a final investigation finding or public teardown report on the Face8 hardware, and the suspended systems remain offline across NIA, MOEA Bureau of Commerce, and Hsinchu municipal users. The broader procurement rules the original article flags remain unrevised.

Immigration Agency Facial Recognition Goes Dark

Taiwan's National Immigration Agency deployed Papago Face8 to more than 100 offices for employee time-clock purposes. Workers scanned their faces to clock in and out. Standard biometric attendance tracking.

Then Mirror Media published a report based on insider sources claiming the facial recognition systems used China-made motherboards and software that resulted in data leaks. The Ministry of the Interior responded immediately: shutdown.

The ministry's statement was direct. "Until the issue is clarified, the use of the system by the ministry and its agencies is suspended to ensure protection of personal data." No investigation timeline. No details on what data leaked or where it went. Just a hard stop on the biometric platform.

NT$6 Million Contract Under Scrutiny

Papago Inc., a Taipei-based company listed on Taiwan's stock exchange, won a NT$6 million contract (roughly US$185,000) to provide facial recognition systems to the NIA. The company manufactures navigation tools, vehicle cameras, and biometric systems. They promoted Face8 as Taiwan-made technology suitable for government use.

Taiwan has strict procurement rules designed to keep Chinese components out of sensitive government systems. Bidders must submit documentation proving products are manufactured in Taiwan and don't use "key components produced in China." Acceptance testing is required to verify compliance.

Mirror Media's sources alleged Papago's systems violated those rules. China-made motherboards supposedly made it into production units deployed across immigration offices. If true, that's a procurement failure and a security breach.

Papago's Defense and Corporate Warfare

Papago chairman Jian Liang-yih issued a public statement denying the allegations. He claimed the facial recognition system is "developed domestically" and all products are "made in Taiwan." He insisted Papago fully complied with government procurement rules.

Then he pointed fingers. Jian accused competitor Besense International Co. of spreading false information to damage Papago's reputation following a business disagreement. He didn't provide evidence of the corporate rivalry or explain what the disagreement involved.

Corporate feuds happen. But when biometric data from government employees potentially leaks through China-linked hardware, the accusations need more than a press release. The ministry suspended the system for a reason.

Taiwan's Surveillance Dilemma

Taiwan sits in a unique geopolitical position. China claims the island as its territory. Taiwan operates independently with its own government, military, and technology sector. Keeping Chinese surveillance technology out of government systems isn't paranoia, it's operational security.

Facial recognition systems collect biometric templates that uniquely identify individuals. When deployed for government employee tracking, those systems know who works where, when they arrive, when they leave, and potentially who they meet with. If data from those systems leaks to foreign adversaries, it maps the entire personnel structure of sensitive agencies.

The National Immigration Agency manages border control, visa processing, and entry/exit data. Employees have access to traveler information, passport systems, and security databases. Compromising their biometric data creates opportunities for social engineering, targeted surveillance, and intelligence gathering.

What Leaked and Where It Went

Neither the ministry nor Mirror Media specified what data leaked or where it ended up. "Data leaks" could mean anything from local storage vulnerabilities to active transmission to external servers. The vagueness is a problem.

Facial recognition systems typically store:

If China-made motherboards included backdoored firmware or management chips, any of this data could have been exfiltrated without Papago's knowledge. Supermicro's 2018 motherboard scandal showed how hardware-level compromises work. Bloomberg reported Chinese spies planted chips on server motherboards bound for US companies. The chips provided network access that bypassed normal security controls.

Taiwan's government would be familiar with that playbook. The immediate suspension suggests they're taking hardware compromise seriously.

Not Just Immigration

The Ministry of the Interior noted that "besides the NIA, other agencies of the ministry and the Ministry of Economic Affairs have also installed the system." That's a bigger footprint than employee time clocks at immigration offices.

The Ministry of Economic Affairs handles industrial policy, trade regulation, intellectual property, and technology development. If Papago Face8 deployed across economic ministry facilities, the exposure includes officials working on Taiwan's semiconductor industry, trade negotiations with foreign partners, and technology export controls.

Face8 was also marketed internationally. Papago promoted the system for smart city projects across Southeast Asia in 2020. Facial recognition for public spaces, access control, and security monitoring. If international deployments used the same hardware platform with China-made components, Taiwan's government isn't the only one affected.

Procurement Rules Didn't Stop It

Taiwan requires documentation proving products don't use Chinese components. Papago won the contract. That means either the company submitted false documentation, the components weren't disclosed properly, or acceptance testing failed to detect them.

Hardware supply chains are opaque. Manufacturers source components globally. A "Taiwan-made" system might use circuit boards fabricated in China, chips from the US, and assembly in Taiwan. Determining origin of every component requires detailed bills of materials, factory inspections, and component authentication.

Most governments lack resources for that level of verification. They rely on vendor certifications and spot checks. Adversaries know this and exploit it. Counterfeit components, mislabeled origins, and shell companies disguise supply chain compromises.

Taiwan's suspension shows the system failed. Government agencies deployed facial recognition with alleged China-made components despite procurement rules designed to prevent exactly that. The rules exist. Enforcement is the gap.

What Taiwan Does Next

The ministry's suspension order demands clarification before the system can resume. That investigation needs to answer:

• What components in Papago Face8 are China-made?
• How did they pass procurement checks?
• What data leaked and to where?
• Are other deployments compromised?
• What happens to the biometric data already collected?

Taiwan could demand hardware teardowns, supply chain audits, and forensic analysis of network traffic. If China-made components are confirmed, expect contract termination, potential legal action against Papago, and tightened procurement verification.

The NIA needs a replacement system. Facial recognition for employee attendance is convenient but not essential. Badge readers, PIN codes, or fingerprint scanners work without the same supply chain risks. Or Taiwan could mandate domestic-only facial recognition hardware with verified component sourcing.

Hardware Matters

Software gets security attention. Vendors publish CVE disclosures. Researchers find bugs. Patches ship. Hardware compromises are harder to detect and impossible to patch.

If you're deploying biometric systems in sensitive environments:

Taiwan's suspension shows even governments with strict procurement rules struggle to verify hardware integrity. Private companies have less leverage and fewer resources. If your threat model includes nation-state adversaries, hardware supply chains are an attack vector.

The Broader Pattern

This isn't Taiwan's first biometric security scare. In 2021, the island debated implementing facial recognition at airports before privacy advocates raised alarms. In 2019, lawmakers questioned police use of Chinese-made surveillance cameras in public spaces.

The pattern across democracies facing Chinese surveillance pressure is consistent: deploy biometric systems for convenience or security, discover China-linked components or data flows, scramble to respond. Australia banned Hikvision and Dahua cameras from government facilities in 2022. The UK removed them from sensitive sites in 2022. The US banned Chinese telecom equipment in 2019 and restricted surveillance cameras in 2020.

Facial recognition is particularly sensitive because biometric data uniquely identifies individuals across contexts. Once collected, it can track people through airports, border crossings, public transit, retail stores, and office buildings. When adversaries control the systems collecting that data, they gain persistent surveillance capabilities.

Taiwan suspended one facial recognition platform. But biometric systems are spreading. Access control, identity verification, contact tracing, payment processing: faces are becoming digital keys. Every deployment creates a surveillance ledger. Who controls the hardware controls the ledger.

References

1. Taipei Times - NIA halts use of facial recognition system over concerns
2. Biometric Update - Papago readies Face8 biometrics for Southeast Asia smart city projects
3. Taiwan Excellence - Face8 Biometrics Facial Recognition
4. Ministry of Economic Affairs (Taiwan). "商業署把關資安，人臉辨識功能暫緩實施." December 30, 2025. Ministry of Economic Affairs press release pausing the Bureau of Commerce facial-recognition attendance feature as a preventive information-security measure.
5. United Daily News (經濟日報). "獨家／疑駭客入侵？竹市府差勤系統急停用 市府：避資安風險." January 6, 2026. Coverage of the Hsinchu City Government disabling the same Face8 attendance system after a suspected intrusion, and the city's denial that any hack or data leak was found.
6. People News. "移民署人臉辨識遭爆中製涉國安疑慮？ 研勤：關鍵零件皆台製." December 30, 2025. Reports Papago's statement that all key components use mature, trusted solutions from Taiwanese suppliers.
7. Storm Media. "移民署花600萬買人臉系統 疑用中製主機板，日辨識50萬次惹疑慮." December 30, 2025. Reports the roughly NT$6 million 2024 procurement and the vendor-claimed daily recognition volume.
8. IDSMag. "移民署人臉辨識差勤系統爆採用中國製零組件." December 30, 2025. Component-level coverage of the Face8 allegations.