What the Investigation Bureau found
On July 7, 2026, prosecutors at the Shilin District Prosecutors Office issued deferred-prosecution orders against Li Hualun and Chen Mengsen, the operators of a Taipei firm called Abigail, closing an investigation Taiwan's Ministry of Justice Investigation Bureau (MJIB) opened in April 2025. According to the MJIB's own account of the case, Li and Chen collected LINE accounts registered to real Taiwanese mobile numbers and leased them, at roughly 1,100 yuan (about $161) per account, to Xiamen Empress Information Technology — a Chinese firm Taiwanese authorities allege is tied to the People's Liberation Army's cyber units (MJIB press release). The buyers used the accounts to impersonate journalists, including reporters affiliated with the International Consortium of Investigative Journalists, to build trust with Taiwanese officials, academics, and civil-society figures before pushing malware-laced files (ICIJ; The Record). The Bureau says its findings corroborate earlier reporting by ICIJ and Citizen Lab tying the same infrastructure to a Beijing-directed espionage campaign against journalists and diaspora activists.
The uncomfortable detail: the system worked
Taiwan requires two forms of photo ID to activate a SIM card precisely so that every mobile number, and by extension every account tied to it, traces back to a verifiable person — a rule sold to the public as a fraud- and crime-fighting measure enforced by the National Communications Commission (NCC). In this case, that traceability held. The LINE accounts Abigail supplied were not spoofed, stolen through SIM-swap fraud, or synthetically generated; they were real accounts, registered by real people, that a broker then aggregated and rented out on a commercial basis. The exploit sat downstream of identity verification, not inside it. That is the detail regulators and commentators should not blur: this was not a failure of real-name registration, it was the emergence of a secondary market in the proof of authenticity that real-name registration creates.
Steelmanning the case for a harder crackdown
There is a real argument for going further than what prosecutors did here. Critics can fairly note that a deferred-prosecution order — Taiwan's mechanism for suspending charges under conditions rather than pursuing a full criminal trial — looks lenient for conduct that fed foreign intelligence-linked malware campaigns against sitting officials and journalists covering Beijing's influence operations. Taiwan's Personal Data Protection Act carries criminal penalties of up to five years' imprisonment and fines as high as NT$1,000,000 for the unlawful collection or transfer of personal data (Taiwan PDPA, Art. 41), and one could argue a case with this much national-security weight warranted the maximum available charge rather than a suspended one. There is also a coherent policy case for platforms and regulators to treat bulk account transfer itself — regardless of intent — as a bright-line violation, since any market for renting "verified" identities is, by construction, a market in undermining the thing verification was built to guarantee.
Why the fix isn't tighter SIM rules
But the temptation to respond to this case by hardening SIM registration further — more ID checks, lower per-person number caps, expanded government access to registration databases — would burden thirty million ordinary users to address a problem that originated in commercial account-leasing behavior, not in registration itself. Taiwan already runs one of the region's stricter real-name regimes, and the NCC has spent the past two years fining carriers for KYC lapses and building anti-fraud number-risk systems. None of that infrastructure would have stopped Abigail, because Abigail's inputs were legitimately registered accounts, not compromised registration data. Piling more identity friction onto SIM issuance punishes the wrong layer of the stack and drifts toward the kind of pervasive digital-identity surveillance regime that a pro-speech, pro-innovation publication should be wary of endorsing even in service of a genuinely serious counter-espionage goal.
What proportionate enforcement looks like
The better lever is the one Taiwan actually pulled: treat commercial account-leasing as a discrete criminal offense under existing data-protection law, prosecute the domestic brokers who monetize it, and lean on platform operators — LINE's parent, Naver-adjacent LY Corporation — to detect and suspend accounts that are used, sold, or logged into in bulk-transfer patterns rather than by their registered owner. That is a narrower, more targeted intervention than rewriting telecom identity law, and it is more likely to actually disrupt the business model, since brokers like Abigail depend on a functioning platform account, not on the SIM card once the account is created. Taiwan's response here — a targeted PDPA prosecution paired with public attribution of the buyer, rather than a fresh regulatory mandate — is the right template for a democracy defending against foreign intelligence operations without expanding the surveillance apparatus it exposes to its own citizens.