Cyber and maritime pressure on Taiwan converge on the election calendar

Noise in the count, signal in the timing

The week's headline is a nine-digit number. According to a National Security Bureau report cited by the Taipei Times on 21 October, Taiwan's Government Service Network (GSN) took 185.6 million attacks in July, a single month that exceeded the total for the first quarter of 2026. UDN reported on 20 October that the figure passed 100 million for the same month and put the daily average at 2.58 million through the end of September. The numbers include blocked attempts; as of 21 October no major service outage on the government network had been reported.

The quiet variable is not the number itself but its timing, which lines up with an election 38 days away. The bureau says it does not rule out preparations to interfere in the nine-in-one local elections on 28 November, a warning it also issued in April. An earlier report cited by Reuters on 5 January 2026 found that cyber attacks escalated during 23 of the 40 joint combat readiness patrols held in 2025. In 2025 the attack curve also spiked around political dates such as President Lai Ching-te's anniversary speech and Vice President Hsiao Bi-khim's November trip to Europe.

Why now

What has loosened the constraint is the cost of the tools. The bureau says artificial intelligence is being used at 4 stages: finding weak points, selecting targets, hunting for zero-day vulnerabilities (flaws with no patch yet) and sending phishing emails. Automation lowers the marginal cost of producing July's 185.6 million volume. The same report says first-half 2026 targets were academic institutions, telecoms companies and the defence-industry supply chain, so selected targets sit behind the volume.

The second front is the information space. Suspicious accounts shared 2.5 million pieces of disputed content in January–September, up 48% from 1.69 million in the same period of 2025. Facebook's share rose from 43.6% to 68.9% and Threads' from 4.5% to 9%. In its 2026 report the bureau describes a model in which official channels build the narrative while troll accounts, bots and accounts belonging to public relations firms amplify it. RFA reported on 31 August that the Central Election Commission is setting up a platform where candidates can report deepfakes, along with a dedicated task force.

On the legal front, UDN says the number of people charged with spying for China rose from 6 in 2020 to 73 in 2026. Between 2020 and October 2026, 264 people were charged and 163 convicted, a conviction rate of 91%.

The maritime front advances under a law-enforcement guise

On 20 October, the day the cyber report reached the press, there was also an incident at Pratas. CNA says China Coast Guard 3102 was detected at 05:00 local time with its AIS (automatic identification system) switched off and entered restricted waters north-east of the island at around 08:00. Taiwan's patrol vessel Taichung shadowed it and broadcast warnings; at the 22:00 update the stand-off was still under way. The Coast Guard Administration has expelled 15 Chinese vessels in 12 incidents in Pratas waters since the start of 2026.

The pattern of the 12 incidents is administrative, not military. In a statement cited by the Taipei Times on 21 October, the Coast Guard Administration said China has in recent weeks conducted multi-point harassment around Taiwan using mixed groups of coast guard, research and fishing vessels. Randall Schriver, chairman of the US-China Economic and Security Review Commission, called the persistent Chinese patrols off the east coast destabilising in Taipei on 20 October. By presenting 1 ship's entry into restricted waters as law enforcement, Beijing puts its jurisdictional claim on the record while staying below the military threshold.

On the other side of the region, Japan and the US launched the Keen Sword 27 exercise on 19 October with about 45,000 Japanese and 12,000 US personnel; the Philippines is taking part for the first time. Japan has deployed its first Type-25 ground-to-ship missile, with a range of about 1,000 kilometres, to Yonaguni, roughly 110 kilometres from Taiwan.

The structural constraint lies in measurement and attribution

Two different data series limit how far this picture can be read. The bureau's 2025 series measured critical infrastructure and showed 2.63 million attacks a day, up 6% on 2024. The 2026 series measures only the government network and gives 2.58 million a day, so the 2 series cannot be compared directly. Attribution is also the bureau's own assessment; China's Taiwan Affairs Office did not respond to a request for comment in the Reuters report published on 5 January, and Beijing routinely rejects such accusations. With 38 days to the vote, the misleading move would be to confuse the attack count with the network's resilience.

What would refute this reading

Our thesis is that until 28 November cyber intrusion and information operations against Taiwan will stay on a high plateau, while maritime pressure continues below the military threshold under a law-enforcement guise. We see this as the most likely path, at 55%.

The first refutation: if the bureau gives monthly figures for August and September well below July at the 22 October legislative session, the July peak reads as a one-off campaign rather than a preparatory phase. The second: if no new expulsion is reported at Pratas before 28 November, the thesis that maritime pressure is tied to the election calendar weakens. The third: if a leaked government document or candidate data surfaces before 28 November, the plateau scenario gives way to escalation.