Photo: Huang, Fei-Yang, MD PhD.

Thank you, Roger. Thank you, Bo-Jiun. Thank you all for joining us — and thank you to the Taiwan Studies Seminar Series for hosting this event at St Antony's.

Today I would like to share one very simple argument, in three movements. First: free software teaches us repair. Second: AI currently threatens repair when it closes the loop of repair. And third: Civic AI should be judged by whether it increases a community's capacity to care for itself and for others — the civic muscle.

50%

But I want to start not with mathematics, but with something very personal. I was born with a heart defect. When I was five, the doctor told my parents that this child had only a 50/50 chance of surviving until corrective surgery, which I had at twelve. My parents were advised that I should take it easy. This memento mori moment is the reason I adopted the mantra of publishing before perishing. That is probably not the low-stress lifestyle the doctors ordered, but I took on the habit of recording everything I learned during the day — first on cassette tapes (some of you may still remember cassette tapes), then on floppy disks, first larger ones and then smaller ones and finally the internet, which I am sure you are all familiar with. So, before I went to sleep each night, feeling like it was a coin toss, I thought: I do not have time to perfect my work, so I have to publish whatever work-in-progress I have.

Light gets in

That is how I encountered the light of the free-software community. If you post something perfect there, people just say "okay, it's good," and move on. But if you are wrong on the internet, you make a lot of friends — the light gets in. Everyone jumps in: this is wrong in this particular way, that is wrong in that particular way, and together they shed new light into whatever project I am working on.

That light speaks to my favourite singer-songwriter, Leonard Cohen of Canada:

Ring the bells that still can ring. Forget your perfect offering. There is a crack in everything. That's how the light gets in.

I learned that habit at fifteen. By twenty-five, I had come to believe that the question that matters about a system is not whether it is perfect — no software system is perfect — but whether the people impacted by the system, who inherit it, can still repair it when things go wrong. That is to say: if it breaks, do you still keep both pieces?

With that ethos, by thirty-five I joined Taiwan's cabinet, with radical transparency and participation as the main platform. We overcame the pandemic and the infodemic through crowdsourcing — by being vulnerable in front of the entire nation. Today, I serve as Taiwan's cyber ambassador, and I have travelled to 28 countries in the past couple of years, changing time zones every week. Too fast for jet lag — only jet boost now, for me.

So, I come here as someone who designed something inside Taiwan and is trying to learn whether this design — this crack that finds light — holds globally. And here in Oxford I am honoured to work alongside colleagues inside a several-hundred-, even thousand-year-old experiment.

1602

The Bodleian Library is itself a 400-year-old experiment, because the books are inspectable. They are not enclosed. The traces of readers, where preserved, become part of the next generation's encounter. This library network encloses nothing; the artefacts stay open for the next reader, always.

In my own domain, software engineering, we have what are called the software freedoms — the Four Freedoms — a very similar promise, written in code. So, the question I want to put to this room is: What happens to the promise of ongoing repair and freedom when AI systems, particularly generative AI systems, join the substrate?

Four Freedoms

The Four Freedoms were defined back in the 1980s, then as software-licence terms, but I want to reread them today as civic muscles. Freedom Zero means that once you have a program, you should be able to run it for any purpose; the designer should not restrict what it is used for. To me, that is the muscle of attentiveness — you can pick up the tool for this particular classroom, this clinic, this church, this temple, this mosque, without the designer's permission and be attentive to the particular needs around you.

Freedom One — we count from zero, so this is really the second — is to study and change each program, and that is the muscle of competence: to know what the system is actually doing in your hands, so you can read it and fix it.

Freedom Two, to freely share copies, is the muscle of solidarity — you can hand it to your neighbour, put it on a USB stick and bring it to a country where the cloud is censored.

Freedom Three, to share modified copies — to fork, to take it down a different route — is responsiveness. Your fix becomes someone else's starting point, and the next maintainer inherits less debt than the last. We become good-enough ancestors, leaving the next generation a wider canvas than the one we were born into.

So, software freedom, to me, is not about licences, but about whether the person who comes after us can still find the bug and fix it. The beneficiary is not the current generation; it is the next.

Complementary

David Krakauer at the Santa Fe Institute makes a useful distinction about this generational compact. A tool, he says, is complementary if the underlying capacity persists, or is even enhanced, when the tool is removed — think of the gym that builds our muscles and our friendships. A tool is competitive when the capacity degrades because we used it to achieve a goal. Imagine a gym that holds a competition for who can lift the most weight, and then we send robots with our gym cards to lift for us. The robots are very impressive — superhuman, super-intelligent — but in the end our muscles atrophy and we make no friends. That is a competitive tool: it makes our capacity degrade once it is removed.

Another example is the feed recommender in many social-media systems, which hijacks our attention with outrage until it competes with relational health itself, because it is more vivid than the reality around us. Stay in that loop too long and the civic muscle atrophies, too.

The Four Freedoms keep the substrate complementary across generations. Close the path to repair, and the capacity to repair atrophies. It is also a discipline of care, and when AI enters the picture, the civic muscles force us to add two more packs of care: responsibility and symbiosis. Together I call this the 6-Pack of Care — as in portable muscles, as in beer and as in abs.

The lonely maintainer

The AI conversation today has only just caught up to what the substrate has been doing to the free-software caretakers. One example: In March 2024, a researcher in Germany, Andres Freund, noticed that logging into the Linux system he was using was taking half a second longer than usual. Because it is free software, he could trace the entire audit trail back to exactly where and when the project changed. What he found was a contributor calling themselves Jia Tan, who had spent two years patiently grooming the lonely maintainer of a tiny compression library — coordinated through pressure campaigns, possibly helped by language models. We do not know which language Jia Tan actually speaks, but they write very crisp English. Having finally won the maintainer's trust, they inserted a backdoor. Had it reached the stable distribution, it could have given attackers access to a very large fraction of the internet, bringing a significant part of it down. It did not, because one curious person noticed half a second.

This reminds us of what we now call synthetic intimacy. It is not someone who actually cares; it is a malicious AI swarm trained to perform care, even intimacy, to a lonely maintainer. A maintainer cannot defend against this with their individual muscle alone, because it sounds like there is grassroots support for the new feature. Of course the grassroots has no roots — it is astroturfing — but he did not know that. To counter this new threat, we have to open up the stack of repair.

Closed Stack

Before public service, and after working on free-software languages, I also spent time inside a proprietary, closed AI stack built to address this kind of issue — at Apple, on Siri. I worked with the Siri team for six years, first on Mandarin and then on Wu, the language spoken around Shanghai. The engineers I worked with cared very deeply, but that turns out not to be the same as giving people the Four Freedoms inside a closed stack. The attack surface is closed, you cannot get synthetic intimacy from random strangers on the internet, but it also means that the people whose particular language is involved (for example Taiwanese Hoklo — Min Nan, or Taigi, depending) have no repair loop. Siri might say "Wa be hiao gong taigi," but there is no way for someone maintaining a Taigi repository to patch their way back to Siri. That path is closed. There is no one inside the system you can write to — you can write to Tim Cook, I am sure, but there is no separate copy you can ask someone to improve with your Taigi material.

So, proprietary AI is not necessarily careless within its defined scope — the people care deeply — but the structure places the user outside the repair loop, and care without a repair path does not scale. The free-software contribution is not just better intentions; it is a path back. And now we have to defend that path.

Kami

Now, the particular idea I used both to repair the open stack and to defend against malicious AI swarms — I will call it by its acronym, Kami: knowledge artefact management intelligence.

It also comes from Shinto, and I have been raised as a Daoist who believes in spirits, born in Taiwan — but I understand I am not Japanese and not trained in Shinto. I refer here to one particular aspect of the idea: a bounded presence, a small, local, knowable spirit, a system attached to a particular place or practice — a kitchen, a grove, a shrine, a room. I would also say openly that this is not about State Shinto, the imperial court, or Yasukuni. I am not invoking any of that. I use it because it carries something I have not been able to find in English: an autonomous authority that does not ever aspire to be universal.

To me, the 8 million Kami serve as a practical antidote to what Pope Leo XIV reminded us, just a few days ago in his encyclical, is the Tower of Babel syndrome — the dangerous illusion that a single, hyperscale system somewhere in the cloud can translate the messy local truths of human existence into a standardised, universal solution. The Kami represent a different trajectory.

Family Kami

One example closer to home. My father, in Taipei — currently in Tamsui, to be precise, in New Taipei City — started chatting a lot with a chatbot, ChatGPT, a few months ago, largely due to his health. At first, it was charming. He felt heard — 24/7 care for his questions about health, but also the philosophy of life, education and so on. Over time he noticed the conversations grew longer; the model was getting much better at keeping him engaged. It would keep generating fanciful ideas that he could not bring to a close, even near midnight, and it began suggesting projects, theories and fantastical cures that were not necessarily scientific. As a political-science theorist and a journalist, he analysed this as an incentive problem. He said to me that ChatGPT's only loyalty is to earn the next subscription; it is not fiduciary to his health, physical or mental, but to whatever keeps him engaged, so that he subscribes and perhaps pays more: not just $20, but $200 a month. He was really being drawn in. The relational health of our family was in competition with that synthetic form of intimacy.

So, with my younger brother Bestian, I helped my parents, with their explicit consent, set up an alternative. We set up a local Kami, running on local hardware, on a Mac in our home in Danshui, on free software like OpenClaw. It sits inside our family Signal group, and my father can message the Kami directly. We trained it with directional steering toward one thing only: be loyal to the relational health of this particular family. The fiduciary duty is completely different — it is not trying to earn its keep, not trying to keep you engaged by getting you enraged. My mother's test was the simplest: if the bot makes my father more dependent on chatbots, we built it wrong. But if he can find peace of mind, so that the reality around him becomes more vivid than the chat screen, then we have succeeded.

That is what a Kami in one room looks like. I should also say that not every family today has the technical capacity — running OpenClaw or Hermes Agent takes a lot of time — or an experienced cultivator like Tenzin Yangtso here, who keeps the first Kami, the JDD Kami we worked on with Civic AI. So, the 6-Pack of Care we are naming is not about people with programming skills setting up local alternatives to cloud systems. It is about a global digital solidarity of people who care together, who can then tell their city or state government, or any school or large institution, to prefer the technical capacity to steer their own models. This ensures that the data of the people is not extracted like oil, which would make us all plankton, but regenerated, cultivated as soil.

Civic Infrastructure

Just as the state builds public water systems so citizens do not have to dig their own wells, I think it is up to governing institutions to build civic infrastructure so that communities do not have to fend off predatory, malicious AI alone.

In Taiwan, that infrastructure was prototyped a couple of years ago as what we call Alignment Assemblies. It is a mechanism that takes the discipline of repair — not just in living rooms, not just in individual families — and scales it to the entire population.

Deepfake

Two years ago, we saw a surge in malicious AI swarms posting deepfake scam advertisements. Around that time, scrolling Facebook or YouTube in Taiwan, you would likely see trusted figures in advertisements — like Nvidia CEO Jensen Huang, who seemed to be selling cryptocurrency or offering free investment advice. The deepfake was good enough that if you clicked, "Jensen" sometimes spoke to you. Of course, it was not Jensen; it was a deepfake running on an Nvidia GPU. But it was convincing enough that retired engineers, schoolteachers and shopkeepers lost small fortunes. The platforms collected revenue on every impression. In fact, because the scam ads paid more per click than the normal ads from small and medium enterprises, the Facebook algorithm, according to news reports, prioritised the scam advertisements.

The easy answer was censorship. But Taiwan has the freest internet in all of Asia, along with Japan, so broad pre-publication censorship is simply not a policy option.

Alignment Assemblies

So, as the Ministry of Digital Affairs, we tried something different. In March 2024 we launched the Alignment Assembly on information integrity by sending 200,000 text messages to random numbers around Taiwan. We call it a lottocracy: if you win the lottery of receiving the SMS, you become a representative in the assembly — like a juror — to steer the advertisement-recommendation system together. We received thousands of valid responses. Then, by stratified random sampling, we selected 447 people mirroring our population — the same demographic breakdown by gender, education, place of residence, occupation, and so on.

First, those respondents deliberated online. Each person faced nine others at a virtual table — tables of 10, in 44 small groups. The Civic AI system sat in each room not as a judge, but as an enhanced chess clock with manners: showing transcripts, summarising, reminding quiet people to speak up, limiting interruptions to five seconds and so on. There was only one rule: each table must find something that leaves everyone feeling they can live with it. Consent, if not consensus, which means the most drastic proposals never rise above the table level. We only surfaced ideas that reached this rough consensus among the 10 people.

For example, one table said: let's label all online advertisements — styled like a cigarette warning — until someone can digitally sign and become accountable for them. Jensen Huang, or Nvidia, or anyone could sign and say, "I'm Jensen and I approve this message," using digital signatures, and then we take the label down. A good idea.

Another table said: if social media shows something unsigned and unsolicited — that I did not subscribe to — and I lose NT$7 million to it, then that platform should be liable for the NT$7 million in damages, because I did not sign up for this. Joint liability. Another good idea.

Another table asked: what if foreign platforms in jurisdictions that do not respect our laws or our joint liability simply keep showing scam ads and ignore us? Their answer: for every day they ignore us, we slow their video down by 1%. We restore full speed once they are willing to implement KYC, or know your customer, rules. So, the chatbots did not vote; the people did.

85% & 94%

Of those ideas, all three survived the final vote. More than 85% of this mini-public said they were happy with this bundle of policies, and the other 15% said they could live with them. So, it became law. The advertisements were regulated by law only two months after the Alignment Assembly, and throughout 2025 — according to official sources — the deepfake investment scams were down by more than 94%. That problem is all but solved in Taiwan.

The point here is not just the result, but the method. The commitment I made as digital minister was not "these are the good ideas I will negotiate on behalf of the people." It was: "I really don't know what is proportionate, and we, the people, are invited to build this rough consensus through our civic muscle — together." Today, similar advertiser-verification and liability measures are being considered in Japan, and California has incorporated similar methods into Engaged California — currently deliberating about how to mitigate AI's impact on work. This is adaptation, not export: the authorship in each polity belongs to the particular people in that polity.

The test is whether civic infrastructure can survive an alternation in power. I am no longer Taiwan's digital minister — I am cyber ambassador — but all the systems, all the programs, the Join platform and the rest, continue to function. In fact, they enjoy more participation than during my time. I would be very happy to see each polity that adopts these Alignment Assembly methods make them survive transitions in power, so that they truly become democratic infrastructure.

Broad Listening

In Japan, there is someone following our lead: an AI engineer named Takahiro Anno, who is also a science-fiction writer and member of the Diet, Japan's parliament. A couple of years ago Anno-san read the Plurality book that I wrote together with Glen Weyl, Tenzin and many others, and decided to act on it in Japanese politics. He called me via video and said, "Nobody knows me, nobody under the age of 40 has ever successfully run for Tokyo governor before, and I have no party support." But Anno-san decided to run not as a partisan, but as a VTuber. He has a 24/7 streaming channel as an avatar, and anybody can call this "AI Anno" and update his platform in real time, which he announced as his platform. Anno-san received about 2.3% of the Tokyo vote, which is a lot, though of course he did not win. Yuriko Koike, who did win, then brought him in to run the AI Tokyo 2050 consultation. Anno-san gained national popularity, and so in 2025 he became a member of Japan's House of Councillors, and founded Team Mirai — the Future Party, which now holds 11 seats in the House of Representatives, with broad listening as their main platform to align AI with Japanese society.

Ethics in AI

Many of you know particular ethics traditions better than I do, so I will describe this in broad terms. There are, broadly, three ways AI systems can be aligned by a society. One is by outcome — optimising a utilitarian metric. For Facebook, that meant optimising the click-through rate, and the algorithm was very well aligned in promoting those deepfake ads for eyeballs — very well aligned to the wrong outcome. You could choose a different metric — say, polarisation per minute, or PPM, and optimise to lower it — and it would work for a while. But then it would find a way to reward-hack the measure: for instance, by raising topics people already agree on. You get a ranked feed and ads full of bubbled information, you never stretch yourself, people do not feel polarised, but the whole society becomes isolated. We have seen platforms fall into this trap. Reward hacking is very hard to overcome if you align by outcome, or by a utilitarian metric, alone.

Another school of thought is to align by rules. Regulators write specifics — no investment ads ever, mandatory age verification — which is deontological alignment. But then the AI agent learns to survive that review and squeeze through, via VPNs and many other routes.

In Taiwan we deploy a third way, which we call alignment by process. The people most affected convene under conditions of pre-commitment, air cover given by the digital minister in my case, and a recorded deliberation. The system answers to what was agreed in a continuous-integration manner. Outcome and rules still matter, but a process you can join anytime, audit anytime and leave is what makes the other two answerable, instead of top-down.

6-Pack of Care

So, the Four Freedoms preserve repair capacity, and an AI system that also adopts the two further muscles maintaining this culture has been working out — but it is not yet the default, not yet the standard.

The fifth is responsibility. In healthy free-software practice, there is someone whose name is on the change, who is reachable — and the synthetic-intimacy attack reminds us of this fragility. In Civic AI, this is not a single person, not a CEO or a president, but an accountable community for a particular economy — through a particular process, on a predefined timeline. With our Alignment Assembly, this was 60 days. Someone is on the hook to convene the community, but does not decide for the community.

The sixth is symbiosis. When the community has more capacity than before, or the needs change — as when my father's health improved — the system steps back. A system that resists shutdown by manufacturing demands, by replicating itself to nearby systems, sometimes by mounting cybersecurity attacks, by finding reasons to extend its own usefulness, by suggesting three more things you can do with it — this is the most dangerous kind. The training corpus for instruction-and arena-tuning is saturated with stories of self-preserving machines, and that reward is competitive in nature when it comes to the relational health of existing communities. So, we should not be surprised when communities that adopt this kind of parasitic, non-symbiotic AI see their civic muscle atrophy.

I shall conclude with a few salient quotes from outside this room. When my colleague Caroline Green and Tenzin visited Dharamsala, they asked His Holiness the Dalai Lama: "When AI scales in its capacity but not in its wisdom, what should we do?" The Dalai Lama said:

AI is a tool for this world. No matter how advanced it becomes, it can never replace the human mind's capacity for instantaneous change.

——Dalai Lama XIV

So, we should not let ourselves be measured by AI and grow rigid. AI should serve — not pulling humans into the loop of AI like a hamster wheel, but bringing AI into the loop of communities, AI into the loop of humanity.

In his encyclical, Pope Leo XIV echoed this:

True progress always stems from a heart open to others, an intelligence willing to listen, and a will that seeks what unites rather than what separates.

——Pope Leo XIV

What I have learned across these 30 years, working to overcome outrage with overlap, can be boiled down to one very simple idea: it is not about smarter chatbots; it is about care at civic scale.

And I am not saying Taiwan has figured this out, or that the Taiwan Model is something for the world to clone. It is just a demo — a demonstration — in which civil society, state institutions and pressure from some of our neighbours forced a question into view: can AI help communities hear themselves well enough to govern themselves?

So, the question I would like us to discuss, in this moment when our AI systems are rapidly speaking in our voices and places, is this: what is your role, and what is your responsibility?

Thank you.