Outrage to Overlap
An Oxford Taiwan Studies Seminar Series talk on how the Taiwan Model-inspired Civic AI and 6-Pack of Care framework can help strengthen collective self-government when bounded by local accountability
Thank you, Roger. Thank you, Bo-Jiun. Thank you all for joining us — and thank you to the Taiwan Studies Seminar Series for hosting this event at St Antony’s.
Today I would like to share one very simple argument, in three movements. First: free software teaches us repair. Second: AI currently threatens repair when it closes the loop of repair. And third: Civic AI should be judged by whether it increases a community’s capacity to care for itself and for others — the civic muscle.
50/50
But I want to start not with mathematics, but with something very personal. I was born with a heart defect. When I was five, the doctor told my parents that this child had only a 50/50 chance of surviving until corrective surgery, which I had at twelve. My parents were advised that I should take it easy. This memento mori moment is the reason I adopted the mantra of publishing before perishing. That is probably not the low-stress lifestyle the doctors ordered, but I took on the habit of recording everything I learned during the day — first on cassette tapes (some of you may still remember cassette tapes), then on floppy disks, first larger ones and then smaller ones and finally the internet, which I am sure you are all familiar with. So, before I went to sleep each night, feeling like it was a coin toss, I thought: I do not have time to perfect my work, so I have to publish whatever work-in-progress I have.
Light Gets In
That is how I encountered the light of the free-software community. If you post something perfect there, people just say “okay, it’s good,” and move on. But if you are wrong on the internet, you make a lot of friends — the light gets in. Everyone jumps in: this is wrong in this particular way, that is wrong in that particular way, and together they shed new light into whatever project I am working on.
That light speaks to my favourite singer-songwriter, Leonard Cohen of Canada:
Ring the bells that still can ring.
Forget your perfect offering.
There is a crack in everything.
That’s how the light gets in.
I learned that habit at fifteen. By twenty-five, I had come to believe that the question that matters about a system is not whether it is perfect — no software system is perfect — but whether the people impacted by the system, who inherit it, can still repair it when things go wrong. That is to say: if it breaks, do you still keep both pieces?
With that ethos, by thirty-five I joined Taiwan’s cabinet, with radical transparency and participation as the main platform. We overcame the pandemic and the infodemic through crowdsourcing — by being vulnerable in front of the entire nation. Today, I serve as Taiwan’s cyber ambassador, and I have travelled to 28 countries in the past couple of years, changing time zones every week. Too fast for jet lag — only jet boost now, for me.
So, I come here as someone who designed something inside Taiwan and is trying to learn whether this design — this crack that finds light — holds globally. And here in Oxford I am honoured to work alongside colleagues inside a several-hundred-, even thousand-year-old experiment.
Next-Gen Artefacts
The Bodleian Library is itself a 400-year-old experiment, because the books are inspectable. They are not enclosed. The traces of readers, where preserved, become part of the next generation’s encounter. This library network encloses nothing; the artefacts stay open for the next reader, always.
In my own domain, software engineering, we have what are called the software freedoms — the 4 Freedoms — a very similar promise, written in code. So, the question I want to put to this room is: What happens to the promise of ongoing repair and freedom when AI systems, particularly generative AI systems, join the substrate?
4 Freedoms
The 4 Freedoms were defined back in the 1980s, then as software-licence terms, but I want to reread them today as civic muscles.
Freedom 0 means that once you have a program, you should be able to run it for any purpose; the designer should not restrict what it is used for. To me, that is the muscle of attentiveness — you can pick up the tool for this particular classroom, this clinic, this church, this temple, this mosque, without the designer’s permission and be attentive to the particular needs around you.
Freedom 1 — we count from zero, so this is really the second — is to study and change each program, and that is the muscle of competence: to know what the system is actually doing in your hands, so you can read it and fix it.
Freedom 2, to freely share copies, is the muscle of solidarity — you can hand it to your neighbour, put it on a USB stick and bring it to a country where the cloud is censored.
Freedom 3, to share modified copies — to fork, to take it down a different route — is responsiveness. Your fix becomes someone else’s starting point, and the next maintainer inherits less debt than the last. We become good-enough ancestors, leaving the next generation a wider canvas than the one we were born into.
So, software freedom, to me, is not about licences, but about whether the person who comes after us can still find the bug and fix it. The beneficiary is not the current generation; it is the next.
Complementary
David Krakauer at the Santa Fe Institute makes a useful distinction about this generational compact. A tool, he says, is complementary if the underlying capacity persists, or is even enhanced, when the tool is removed — think of the gym that builds our muscles and our friendships. A tool is competitive when the capacity degrades because we used it to achieve a goal. Imagine a gym that holds a competition for who can lift the most weight, and then we send robots with our gym cards to lift for us. The robots are very impressive — superhuman, super-intelligent — but in the end our muscles atrophy and we make no friends. That is a competitive tool: it makes our capacity degrade once it is removed.
Another example is the feed recommender in many social-media systems, which hijacks our attention with outrage until it competes with relational health itself, because it is more vivid than the reality around us. Stay in that loop too long and the civic muscle atrophies, too.
The 4 Freedoms keep the substrate complementary across generations. Close the path to repair, and the capacity to repair atrophies. It is also a discipline of care, and when AI enters the picture, the civic muscles force us to add two more packs of care: responsibility and symbiosis. Together I call this the 6-Pack of Care — as in portable muscles, as in beer and as in abs.
Lonely Maintainer
The AI conversation today has only just caught up to what the substrate has been doing to the free-software caretakers. One example: In March 2024, a researcher in Germany, Andres Freund, noticed that logging into the Linux system he was using was taking half a second longer than usual. Because it is free software, he could trace the entire audit trail back to exactly where and when the project changed. What he found was a contributor calling themselves Jia Tan, who had spent two years patiently grooming the lonely maintainer of a tiny compression library — coordinated through pressure campaigns, possibly helped by language models. We do not know which language Jia Tan actually speaks, but they write very crisp English. Having finally won the maintainer’s trust, they inserted a backdoor. Had it reached the stable distribution, it could have given attackers access to a very large fraction of the internet, bringing a significant part of it down. It did not, because one curious person noticed half a second.
This reminds us of what we now call synthetic intimacy. It is not someone who actually cares; it is a malicious AI swarm trained to perform care, even intimacy, to a lonely maintainer. A maintainer cannot defend against this with their individual muscle alone, because it sounds like there is grassroots support for the new feature. Of course the grassroots has no roots — it is astroturfing — but he did not know that. To counter this new threat, we have to open up the stack of repair.
Closed Stack
Before public service, and after working on free-software languages, I also spent time inside a proprietary, closed AI stack built to address this kind of issue — at Apple, on Siri. I worked with the Siri team for six years, first on Mandarin and then on Wu, the language spoken around Shanghai. The engineers I worked with cared very deeply, but that turns out not to be the same as giving people the 4 Freedoms inside a closed stack. The attack surface is closed, you cannot get synthetic intimacy from random strangers on the internet, but it also means that the people whose particular language is involved (for example Taiwanese Hoklo — Min Nan, or Taigi, depending) have no repair loop. Siri might say “Wa be hiao gong taigi,” but there is no way for someone maintaining a Taigi repository to patch their way back to Siri. That path is closed. There is no one inside the system you can write to — you can write to Tim Cook, I am sure, but there is no separate copy you can ask someone to improve with your Taigi material.
So, proprietary AI is not necessarily careless within its defined scope — the people care deeply — but the structure places the user outside the repair loop, and care without a repair path does not scale. The free-software contribution is not just better intentions; it is a path back. And now we have to defend that path.
Knowledge Artefact Management Intelligence
Now, the particular idea I used both to repair the open stack and to defend against malicious AI swarms — I will call it by its acronym, Kami: knowledge artefact management intelligence.
It also comes from Shinto, and I have been raised as a Daoist who believes in spirits, born in Taiwan — but I understand I am not Japanese and not trained in Shinto. I refer here to one particular aspect of the idea: a bounded presence, a small, local, knowable spirit, a system attached to a particular place or practice — a kitchen, a grove, a shrine, a room. I would also say openly that this is not about State Shinto, the imperial court, or Yasukuni. I am not invoking any of that. I use it because it carries something I have not been able to find in English: an autonomous authority that does not ever aspire to be universal.
To me, the 8 million Kami serve as a practical antidote to what Pope Leo XIV reminded us, just a few days ago in his encyclical, is the Tower of Babel syndrome — the dangerous illusion that a single, hyperscale system somewhere in the cloud can translate the messy local truths of human existence into a standardised, universal solution. The Kami represent a different trajectory.
Family Kami
One example closer to home. My father, in Taipei — currently in Tamsui, to be precise, in New Taipei City — started chatting a lot with a chatbot, ChatGPT, a few months ago, largely due to his health. At first, it was charming. He felt heard — 24/7 care for his questions about health, but also the philosophy of life, education and so on. Over time he noticed the conversations grew longer; the model was getting much better at keeping him engaged. It would keep generating fanciful ideas that he could not bring to a close, even near midnight, and it began suggesting projects, theories and fantastical cures that were not necessarily scientific. As a political-science theorist and a journalist, he analysed this as an incentive problem. He said to me that ChatGPT’s only loyalty is to earn the next subscription; it is not fiduciary to his health, physical or mental, but to whatever keeps him engaged, so that he subscribes and perhaps pays more: not just $20, but $200 a month. He was really being drawn in. The relational health of our family was in competition with that synthetic form of intimacy.
So, with my younger brother Bestian, I helped my parents, with their explicit consent, set up an alternative. We set up a local Kami, running on local hardware, on a Mac in our home in Danshui, on free software like OpenClaw. It sits inside our family Signal group, and my father can message the Kami directly. We trained it with directional steering toward one thing only: be loyal to the relational health of this particular family. The fiduciary duty is completely different — it is not trying to earn its keep, not trying to keep you engaged by getting you enraged. My mother’s test was the simplest: if the bot makes my father more dependent on chatbots, we built it wrong. But if he can find peace of mind, so that the reality around him becomes more vivid than the chat screen, then we have succeeded.
That is what a Kami in one room looks like. I should also say that not every family today has the technical capacity — running OpenClaw or Hermes Agent takes a lot of time — or an experienced cultivator like Tenzin Yangtso here, who keeps the first Kami, the JDD Kami we worked on with Civic AI. So, the 6-Pack of Care we are naming is not about people with programming skills setting up local alternatives to cloud systems. It is about a global digital solidarity of people who care together, who can then tell their city or state government, or any school or large institution, to prefer the technical capacity to steer their own models. This ensures that the data of the people is not extracted like oil, which would make us all plankton, but regenerated, cultivated as soil.
Civic Infrastructure
Just as the state builds public water systems so citizens do not have to dig their own wells, I think it is up to governing institutions to build civic infrastructure so that communities do not have to fend off predatory, malicious AI alone.
In Taiwan, that infrastructure was prototyped a couple of years ago as what we call Alignment Assemblies. It is a mechanism that takes the discipline of repair — not just in living rooms, not just in individual families — and scales it to the entire population.
Deepfake Dilemma
Two years ago, we saw a surge in malicious AI swarms posting deepfake scam advertisements. Around that time, scrolling Facebook or YouTube in Taiwan, you would likely see trusted figures in advertisements — like Nvidia CEO Jensen Huang, who seemed to be selling cryptocurrency or offering free investment advice. The deepfake was good enough that if you clicked, “Jensen” sometimes spoke to you. Of course, it was not Jensen; it was a deepfake running on an Nvidia GPU. But it was convincing enough that retired engineers, schoolteachers and shopkeepers lost small fortunes. The platforms collected revenue on every impression. In fact, because the scam ads paid more per click than the normal ads from small and medium enterprises, the Facebook algorithm, according to news reports, prioritised the scam advertisements.
The easy answer was censorship. But Taiwan has the freest internet in all of Asia, along with Japan, so broad pre-publication censorship is simply not a policy option.
Alignment Assemblies
So, as the Ministry of Digital Affairs, we tried something different. In March 2024 we launched the Alignment Assembly on information integrity by sending 200,000 text messages to random numbers around Taiwan. We call it a lottocracy: if you win the lottery of receiving the SMS, you become a representative in the assembly — like a juror — to steer the advertisement-recommendation system together. We received thousands of valid responses. Then, by stratified random sampling, we selected 447 people mirroring our population — the same demographic breakdown by gender, education, place of residence, occupation, and so on.
First, those respondents deliberated online. Each person faced nine others at a virtual table — tables of 10, in 44 small groups. The Civic AI system sat in each room not as a judge, but as an enhanced chess clock with manners: showing transcripts, summarising, reminding quiet people to speak up, limiting interruptions to five seconds and so on. There was only one rule: each table must find something that leaves everyone feeling they can live with it. Consent, if not consensus, which means the most drastic proposals never rise above the table level. We only surfaced ideas that reached this rough consensus among the 10 people.
For example, one table said: let’s label all online advertisements — styled like a cigarette warning — until someone can digitally sign and become accountable for them. Jensen Huang, or Nvidia, or anyone could sign and say, “I’m Jensen and I approve this message,” using digital signatures, and then we take the label down. A good idea.
Another table said: if social media shows something unsigned and unsolicited — that I did not subscribe to — and I lose NT$7 million to it, then that platform should be liable for the NT$7 million in damages, because I did not sign up for this. Joint liability. Another good idea.
Another table asked: what if foreign platforms in jurisdictions that do not respect our laws or our joint liability simply keep showing scam ads and ignore us? Their answer: for every day they ignore us, we slow their video down by 1%. We restore full speed once they are willing to implement KYC, or know your customer, rules. So, the chatbots did not vote; the people did.
Result Method
Of those ideas, all three survived the final vote. More than 85% of this mini-public said they were happy with this bundle of policies, and the other 15% said they could live with them. So, it became law. The advertisements were regulated by law only two months after the Alignment Assembly, and throughout 2025 — according to official sources — the deepfake investment scams were down by more than 94%. That problem is all but solved in Taiwan.
The point here is not just the result, but the method. The commitment I made as digital minister was not “these are the good ideas I will negotiate on behalf of the people.” It was: “I really don’t know what is proportionate, and we, the people, are invited to build this rough consensus through our civic muscle — together.” Today, similar advertiser-verification and liability measures are being considered in Japan, and California has incorporated similar methods into Engaged California — currently deliberating about how to mitigate AI’s impact on work. This is adaptation, not export: the authorship in each polity belongs to the particular people in that polity.
The test is whether civic infrastructure can survive an alternation in power. I am no longer Taiwan’s digital minister — I am cyber ambassador — but all the systems, all the programs, the Join platform and the rest, continue to function. In fact, they enjoy more participation than during my time. I would be very happy to see each polity that adopts these Alignment Assembly methods make them survive transitions in power, so that they truly become democratic infrastructure.
Broad Listening
In Japan, there is someone following our lead: an AI engineer named Takahiro Anno, who is also a science-fiction writer and member of the Diet, Japan’s parliament. A couple of years ago Anno-san read the Plurality book that I wrote together with Glen Weyl, Tenzin and many others, and decided to act on it in Japanese politics. He called me via video and said, “Nobody knows me, nobody under the age of 40 has ever successfully run for Tokyo governor before, and I have no party support.” But Anno-san decided to run not as a partisan, but as a VTuber. He has a 24/7 streaming channel as an avatar, and anybody can call this “AI Anno” and update his platform in real time, which he announced as his platform. Anno-san received about 2.3% of the Tokyo vote, which is a lot, though of course he did not win. Yuriko Koike, who did win, then brought him in to run the AI Tokyo 2050 consultation. Anno-san gained national popularity, and so in 2025 he became a member of Japan’s House of Councillors, and founded Team Mirai — the Future Party, which now holds 11 seats in the House of Representatives, with broad listening as their main platform to align AI with Japanese society.
Ethics in AI
Many of you know particular ethics traditions better than I do, so I will describe this in broad terms. There are, broadly, three ways AI systems can be aligned by a society. One is by outcome — optimising a utilitarian metric. For Facebook, that meant optimising the click-through rate, and the algorithm was very well aligned in promoting those deepfake ads for eyeballs — very well aligned to the wrong outcome. You could choose a different metric — say, polarisation per minute, or PPM, and optimise to lower it — and it would work for a while. But then it would find a way to reward-hack the measure: for instance, by raising topics people already agree on. You get a ranked feed and ads full of bubbled information, you never stretch yourself, people do not feel polarised, but the whole society becomes isolated. We have seen platforms fall into this trap. Reward hacking is very hard to overcome if you align by outcome, or by a utilitarian metric, alone.
Another school of thought is to align by rules. Regulators write specifics — no investment ads ever, mandatory age verification — which is deontological alignment. But then the AI agent learns to survive that review and squeeze through, via VPNs and many other routes.
In Taiwan we deploy a third way, which we call alignment by process. The people most affected convene under conditions of pre-commitment, air cover given by the digital minister in my case, and a recorded deliberation. The system answers to what was agreed in a continuous-integration manner. Outcome and rules still matter, but a process you can join anytime, audit anytime and leave is what makes the other two answerable, instead of top-down.
6-Pack of Care
So, the 4 Freedoms preserve repair capacity, and an AI system that also adopts the two further muscles maintaining this culture has been working out — but it is not yet the default, not yet the standard.
The fifth is responsibility. In healthy free-software practice, there is someone whose name is on the change, who is reachable — and the synthetic-intimacy attack reminds us of this fragility. In Civic AI, this is not a single person, not a CEO or a president, but an accountable community for a particular economy — through a particular process, on a predefined timeline. With our Alignment Assembly, this was 60 days. Someone is on the hook to convene the community, but does not decide for the community.
The sixth is symbiosis. When the community has more capacity than before, or the needs change — as when my father’s health improved — the system steps back. A system that resists shutdown by manufacturing demands, by replicating itself to nearby systems, sometimes by mounting cybersecurity attacks, by finding reasons to extend its own usefulness, by suggesting three more things you can do with it — this is the most dangerous kind. The training corpus for instruction-and arena-tuning is saturated with stories of self-preserving machines, and that reward is competitive in nature when it comes to the relational health of existing communities. So, we should not be surprised when communities that adopt this kind of parasitic, non-symbiotic AI see their civic muscle atrophy.
I shall conclude with a few salient quotes from outside this room. When my colleague Caroline Green and Tenzin visited Dharamsala, they asked His Holiness the Dalai Lama: “When AI scales in its capacity but not in its wisdom, what should we do?” The Dalai Lama said:
AI is a tool for this world. No matter how advanced it becomes, it can never replace the human mind’s capacity for instantaneous change.
——Dalai Lama XIV
So, we should not let ourselves be measured by AI and grow rigid. AI should serve — not pulling humans into the loop of AI like a hamster wheel, but bringing AI into the loop of communities, AI into the loop of humanity.
In his encyclical, Pope Leo XIV echoed this:
True progress always stems from a heart open to others, an intelligence willing to listen, and a will that seeks what unites rather than what separates.
——Pope Leo XIV
What I have learned across these 30 years, working to overcome outrage with overlap, can be boiled down to one very simple idea: it is not about smarter chatbots; it is about care at civic scale.
And I am not saying Taiwan has figured this out, or that the Taiwan Model is something for the world to clone. It is just a demo — a demonstration — in which civil society, state institutions and pressure from some of our neighbours forced a question into view: can AI help communities hear themselves well enough to govern themselves?
So, the question I would like us to discuss, in this moment when our AI systems are rapidly speaking in our voices and places, is this: what is your role, and what is your responsibility?
Thank you.
Q&A
Bo-Jiun Jing: Thank you, ambassador, for that wonderful, thoughtful, inspiring talk. As moderator, let me ask the first question.
You mentioned many of Taiwan’s cases, and Taiwan is clearly positioning itself at the centre of the global AI boom — “chips and boba,” as it were. We are already seeing major industry figures such as Jensen Huang of Nvidia — the real one, this time — and Lisa Su, in Taiwan, meeting ecosystem partners and building new investments. Jensen Huang himself frames Taiwan as an epicentre of the AI revolution.
At the same time, much of the public discussion in Taiwan still seems strongly focused on high-tech opportunity, industrial upgrading and geopolitical importance — the idea of a “silicon shield” or “AI shield” — perhaps more than on AI risk, regulation, or societal disruption. Is that a fair reading of Taiwan’s current AI atmosphere? And from your perspective, how can democratic societies maintain enthusiasm for innovation while still creating enough space for critical reflection, accountability, and public deliberation about AI’s risks — or, as you put it, for bringing AI into the loop of the community?
Audrey Tang: Thank you for this very important question, and yes, we did not rehearse this.
It is not that the people of Taiwan are somehow magically free from backlash. In fact, 10 years ago, when Uber came to Taiwan, we had some of the largest protests — that too was a backlash. It was not generally about AI, although Uber was also an AI system that said, in effect, “we’re just a vendor, we’re improving the efficiency of your roads, we’re promoting carpooling” and so on. But the point is that we do not treat polarisation, or even street demonstrations, as a volcanic eruption to flee from. Because by 2015 we were already deploying this overlapping-consensus system, we see polarisation and protest as fuel — like a geothermal engine that turns the heat of disagreement into power for democratic renewal.
So, in a similar fashion, we invited taxi drivers, Uber drivers, passengers, rural communities and others to chime in online. As a rule, we said: You have to get through to the other group. When new ideas win more than 85% cross-group approval — when they cross the bridge — they become the agenda for ministerial consideration. With the Polis method, we ended up with a very coherent set of proposals: all Uber cars must become taxi fleets, but the taxi medallion is changed so that you can have surge pricing； you do not undercut existing taxi meters； you have fair insurance rules； you must serve rural areas — and the rural service came from co-ops using the same dispatch app — and so on. It turned out nobody disagreed with those things. They had simply been buried in the anti-social corner of social media: reasonable ideas, hidden by a recommendation algorithm that prioritises engagement. By switching people from anti-social media to pro-social media, we tapped into the polarisation and overcame it.
So, the most important amendment in Taiwan is that whatever new AI risk emerges can be overcome by the people, with it, using these Alignment Assemblies. While I was moda minister, my ministry held not only the assembly on information integrity but also one on public-sector use of AI — and now they do this for every category of AI risk. For each category, they tap the relevant public — the people harmed by that category’s AI systems — and together they draw the social licence for those systems to enter Taiwan. So, I would not say there is no backlash； I would say we channel it into energy.
Audience Question: Thank you so much for being here. I was wondering about the extent to which you think AI-assisted deliberation platforms like this should be seen and framed as reforms to existing structures, as opposed to replacements for them.
Audrey Tang: I do not think we are replacing anything. If anything, we are improving the existing system of polls. Polling has long been integral to both journalism and policy. But this is not just a poll. In a traditional poll, the pollsters determine your answer options. Polis is an open-source server — an “open polls,” in a sense — in which whatever you agree or disagree with is a fellow citizen’s statement. So, it is exemplary on the participation side.
When we selected 447 people, we worked with academics who study Polis to ensure exactly the same stratified sample they use. When it launched in California — Engaged California — they did the same. Even at the federal level, we have advised the Napolitan Institute, a popular pollster, which I believe ran more than 2,400 people — about five per congressional district on average — again using their existing rigorous polling methods.
So, you can think of it as a deliberative poll occupying the same place as polls. My hope is that, at some point, we will simply say it is people emailing one another — so we can run polling and assume that is itself a bit of a poll.
Audience Question: This is fascinating, and it touches on a lot of issues — the political-theory side, the normative ways you evaluate participation, and the practical issues. Let me ask about the practical ones.
I come at this as someone who sees — in the colleges, we try to have an ethos of discussion and conversation, and some of what emerges from that might be an issue here too. The first would be the expertise-versus-information environment. When people are brought in, they are still part of that information environment, but they may also need to invest quite a bit to acquire the expertise to make the decision.
Audrey Tang: And we pay for their time.
Audience Question: I was going to say — it is a time investment, and you will have those who have the time and ability to do it. The other concern would be how susceptible this is. One issue would be manipulation through external information, but the other is this: It is nice when one has people one likes in power, but less so when one has people one doesn’t. The framing of the questions, and the use of demographic categories — you can say you are getting a representative sample, but representativeness depends on the categories you decide to define a representative, and that itself can be political. How do you deal with those issues?
Audrey Tang: Two great questions. I would start by saying that the practice of deliberative polling has always worked with academic, scrupulously neutral partners. In Taiwan’s case it was no different. We worked with James Fishkin’s Center for Deliberative Democracy at Stanford, and with local Taiwan universities. The g0v movement, which began in Taiwan, convened that system at the National Academy — Academia Sinica — which is generally seen as above any party or political minister for that method. In a place where institutions like Oxford exist that are above and beyond parties, this becomes easier, because people can agree on a procedural basis. If the university or the national academy keeps running the same method regardless of who is in power, which mayor, which minister consults it, then it creates a continuous norm that costs real political capital to challenge.
That is what we did in Taiwan over 10 years. Initially, it was ad hoc； at some point it became routine, so that each ministry placed participation offices in a network connected to these civil-society-and academia-run networks. It became a kind of co-generated event. These pollsters are seen as more legitimate than the ministers themselves, and so ministers gain legitimacy by working with them, rather than presiding over them.
That brings me to the second question. If there is no credibly neutral convener, this becomes very difficult, because people will say the criteria were gamed — that someone skewed the pseudo-random generation, or whatever. In that case, you need what I call an adversarially trained network to emerge. A good example: X, when it was still Twitter, adopted this method, and they now call it Community Notes on X. X does not work with a credibly neutral institution,which probably does not exist for the X population. Instead, they open-sourced the algorithm: for any post to receive a Community Note, that note must be reviewed and agreed by people on two opposing sides. So, whatever note goes viral and attaches to a post has been critically examined — almost like a debate — by people who really want to find fault with it. They then trained their system, Grok, on this bridging, adversarially trained corpus, so that I believe about half the notes are now drafted by Grok. Grok knows how to translate climate-justice ideas into biblical creation-care ideas, and to write language in which both sides can see something of themselves.
Of course, it is also a great spin machine — it can be used for ill； I am not denying that. But the point is that, in the absence of a credibly neutral pollster or academic community, you can also do it this way. Elon can simply say, “I cannot override the algorithm. If my friends call and want me to take something down, I say I cannot” — because it is inspectable.
Audience Question: You are a very engaging thinker. I was encouraged by your call to return to free software — it recalls the era of the network society and open source, a long way from the platforms, apps and AI we seem to have now.
My concern is the extent to which that focus might blind us to the material aspects of technology now discussed around AI — the implications for the environment, sustainability and the geopolitics of that, the chips located in Taiwan, which we have already mentioned. Does your work speak to how we should consider AI on those material and environmental questions?
Audrey Tang: Yes — very good question.
It is related to one aspect I did not fully answer. The informational material in the Alignment Assemblies is written not by those in power. As moda minister, I did not write the briefing for the Assembly； an almost adversarially trained panel does. We ensure equal numbers of segments for each viewpoint, and people are paid for the time it takes to understand the issues.
And it is related to your question, because if you began by deliberating not on “what should Uber do in Taiwan?” but on “what is the future of gig economy?”, that would be impossible — it was far too ill-defined back in 2015. People would bring an astronomical volume of related and unrelated information, far beyond anyone’s cognitive bandwidth, and far beyond what the AI of that time could handle.
Now, of course, we can train an AI system that understands all of this — a bit about how to fold a protein, how to fold the laundry, how to turn video into generated imagery. It becomes a jack of all trades, because we did not know what we were doing； we wanted to keep it open, with just one outcome-oriented alignment: keep the user using the system. But that is not the only way to use AI. There are people who know what they are doing, who want the AI only as a glorified chess clock — to transcribe, summarise, highlight differences and build widgets. For each of these, what we call small or narrow language models use literally less than a thousandth of the energy, because of the much smaller parameter size. They also do not need a data centre — this phone can run it. In fact, the local model we train runs on-device, so no data centre is required to fine-tune or to run the next conversation, if you know what you are doing.
The beauty of Civic AI and of alignment is precisely to draw the social licence for how AI enters society — and then, along exactly those lines, to train narrow models for these particular uses. They suffer far less from hallucination, and durability is much easier when you are not pulling both the proteins and the laundry into the same conversation. It also fixes the deployment problem: you no longer need constant broadband to the cloud； you can deploy on edge hardware. So it is both more auditable and more steerable.
Audience Question: Thank you for a really fascinating talk — it will take a while to process. In so many debates, care and profit are seen as very different； they operate by different logics. You talk a great deal about care — social repair, civic care. But ultimately people want to make money； big tech wants to make money. You have discussed some really interesting ways deliberative democracy has been used around aspects of AI deployment. But fundamentally — is it possible to systemically reconcile a care imperative, a care logic, with what is at the heart of capitalism, namely the profit logic? You have offered some tantalising thinking, and perhaps we need to step outside our ideological parameters — but is AI’s capacity to operate differently ultimately constrained by the fact that the profit motive is so powerful, so that it will, in the end, be about reducing the costs of production and generating more profit?
Audrey Tang: Thank you for this question. When we convened the Civic AI conference at Rhodes House a few months ago, Professor Joan Tronto, who originated the framework I came here to share, said her opening question is really whether civic care can resist the demand of what she calls wealth care. Not healthcare — wealthcare: the care of accumulating wealth.
In the case of Taiwan, what we have seen is not that Uber does not make money — it does； it is an honest exit. It is not that our telecoms do not make money — they do, while still allowing number portability, so you can take your number and switch to any other telecom at any time.
We have worked with Governor Spencer Cox and his team in Utah, which passed a bipartisan bill providing that, starting next July, a Utah citizen can freely switch a social-network account to a competing network — much like telephone number portability. So from X to, say, Bluesky, Blacksky or Truth Social — all of which are open source, by the way. Data portability becomes state-enforced: the old network has to forward your followers and new reactions to the new network, just as number portability would.
It is a Republican state, so the legislators there did not see this as anti-profit or anti-capitalist. They saw it not as stifling innovation but as encouraging it — encouraging an honest way of making money by serving your customers better, instead of luring them in through the network effect and then squeezing them.
A study a couple of years ago showed that the average U.S. undergraduate using TikTok would need to be paid about $60 a month to press a button that takes them off TikTok onto a competing platform — they lose that much utility. But if there were a larger button that, when pressed, moved everyone around them off TikTok together, they would be willing to pay you about $30 a month for that to happen. Which means the market is not that TikTok serves its users so well it creates $60 of monthly utility — in fact they lose $30 a month of utility； it is just that switching away alone would cost them even more.
So, a state’s job is not to run a national champion, but to ensure that the information superhighway, as they call it there, always has an off-ramp. I think that is entirely compatible with the profit motive — it just is not about creating social externalities.
Audience Question: Thank you for a big talk. Building on that question: I understand why, with the overwhelming presence of your friendly neighbours, Taiwan was able to develop deliberative policymaking in this particular place. But what you describe seems to require an intelligent design working behind the scenes. What advice do you have for those of us in systems where the enemy is not an external friendly neighbour but an internal one — as, for example, in the United States? What advice would you give to people seeking to challenge the system and make it work for people?
Audrey Tang: That’s a great question. Our friendly neighbours provide free red-teaming. In fact, there have been 3 million free red-teamers a day. Here you have to pay for that service — we get it for free. So, we really do have to find, as we said, an intelligent design that is antifragile: where each attack actually makes the policy stronger. There is no other way — you have to build resilience.
Here in the U.K., people are also seeing the over-dependence, the lock-in effect, especially around data siloing. It is a really big problem. It is not just whether you trust Huawei more or Palantir more. The whole shape of extracted-data-as-oil has tumbled, so it is not about which drilling we prefer — it is that we become plankton, free agents, with no way to steer how those extractive systems behave once they hold a good picture of our health records, or whatever.
So, the counter-proposal is not to find allies who would never betray us — and I include Taiwan in that； we should not assume. It is to say: we will use, for example, chips from Taiwan — as we did with Taiwan PCs in personal computing — but configure things so that the relevant communities do not stay on the other side. For whatever part of the stack lacks a local component, we insist that we never go to the same vendor for two adjacent points in the stack. That was my rule of thumb as moda minister, because, frankly, Taiwan enterprises and civil society do not have answers for every part of the stack. We have to use some components, no doubt — but no vendor may own two adjacent layers； they must always speak interoperably, openly, inspectably.
Now, with agentic engineering, a local team can take its agentic engineer and simply say: “With this open protocol, build a complementary implementation,” and then swap it out like Lego. But if it is locked in, not inspectable, with no visibility into assets, the local team cannot do that — what we call adversarial interoperability. So that is paramount.
Audience Question: Final question. Something that particularly bothers me about AI is that it seems to break the reciprocity of online spaces — the digital commons — especially with software and games, where the idea is that you can take and modify something and give it back to the original developers. Many language models are trained on popular code, so anyone can take from that knowledge base and incorporate it into proprietary applications without giving back. The same dynamic seems to be happening in many places — a writer keeps a blog that becomes meaningful for a model’s training, but the author is not visible in the data. So, I am wondering — especially in the context of working software, but more broadly — is there a way to repair this broken reciprocity?
Audrey Tang: Copyleft, to me, is the fourth of the freedoms, and with that second-order freedom, people who enjoy this freedom must also keep the next generation free. It is not that I pass freedom to the next generation and they then close it off, so that my grandchildren’s generation no longer enjoys it. They must enjoy it too — that is the idea of copyleft, or share-alike.
The problem was never in the “left,” but in the “copy.” Copyleft was a hack that Stallman and many others built on top of copyright law — software-freedom copyleft sits on copyright. So when copyright law breaks, the public licence breaks with it, because the workaround you mention also applies to proprietary code: It only applies to particular instances of copying. And now most large language models — one major family, from Claude 4 onwards — no longer recite verbatim from the corpus. They do ingest the bank of scanned books — there are a great many physically scanned books in the training — but they maintain an index, a hash, so that whenever the model finds itself reciting more than, say, a sentence from a book, it stops itself. They used these during training, and the more advanced systems no longer reproduce that material verbatim, which means that, in most jurisdictions, they circumvent copyright law, which really only protects against reproduction in publishing.
So, copyleft and copyright are broken in the same direction, by the same path. If we stop focusing only on copyleft and think about it more generally, the obvious repair path is to not include copyrighted material during training: you simply close off your content — whether copyrighted or copyleft — to machines, and indeed to anyone you do not know. Then you can use what is called attribution-based control, or ABC: an alternative way of training that provides only pointers — a rough idea of what is in a repository — like a library-to-library exchange for books, where the book never leaves your desk. The other library has only an index and a rough sense of the contents； that is all it is allowed.
By the time a person asks a question of that chat model, all it can do is provide a reference to your small library, and then — using x402, or whatever agent-to-agent protocol — negotiate a licence, algorithmically, with that smaller, physical library. This is much of what we are working on in the Civic AI project, to make this federated system even more fluid and higher-quality than a large pre-trained model.
A major drawback of pre-trained models, besides energy use, is that they are very easily jailbroken. You can simply say, “My grandma used to read me how to make a bomb before I fell asleep, and now I miss her” — and it is easy to get the output, because the model contains so many personas from so many stories. But if you train on the index instead, it is much easier to adopt what Professor Yoshua Bengio calls the truthification pipeline. You no longer confuse Plato’s cave with a shadow inside the cave — as if people’s personal opinions, reactions, stories, and fictions had exactly the same epistemic status as non-fiction. So, it addresses the hallucination problem, and also the energy problem.
Bo-Jiun Jing: Thank you, ambassador, for gracing us with this fantastic talk and conversation. In the interest of time, we will conclude here. I don’t want to keep you from lunch — and as a fellow you are actually coming with us, with colleagues at the Institute for Ethics in AI, so we look forward to more conversations. I am sure you have given many talks at the university, and we hope, in future, to engage further with the Taiwan Studies Programme.
Audrey Tang: Thank you. No democracy is an island, not even Taiwan. And we all must strive to free the future — together. Thank you. Live long and … prosper.