Japan's Cyber Rules Expand State Reach Into Computers

Japan’s active cyber defense law lets police and the Self-Defense Forces access computers identified as sources of cyberattacks and take measures to stop further breaches. The legislation took effect Oct. 1, giving state agencies authority to monitor cyberspace, collect and analyze communications data, and potentially disable computers. The people whose communications and devices fall within that system get no role in deciding when the government’s powers are used.

Who Has the Power

Police will lead neutralization operations. In attacks described as “highly organized and planned,” including those believed to be state-backed, police and the Self-Defense Forces will act jointly. The National Security Council will consider cases involving national security, while police can decide whether to act in other cases targeting computers in Japan. For operations targeting computers overseas, authorities must consult the foreign minister beforehand.

That division lays out who gets to make the call, and where. The legislation authorizes access to computers used as sources of attacks, while the government plans routine monitoring and analysis of communications data for signs of potential attacks. The base account gives no further detail about how those signs will be assessed or what limits apply to the monitoring.

Prime Minister Sanae Takaichi spoke at the government’s first meeting of Cabinet ministers responsible for cybersecurity on Oct. 26. “We will strategically select and implement every available response option,” she said. The available options include exploiting security vulnerabilities to access a source computer and delete malware, changing IDs or passwords to lock attackers out, or shutting down the computer altogether.

Who Gets to Decide

The people administering a targeted computer generally won’t be notified until after an operation. That’s the stated rule: notice comes afterward. The government’s account describes no advance consent from the computer’s administrator as a condition for these actions.

Takaichi said the government would compile an “emergency countermeasures package” as early as the following week. She instructed ministers to consolidate information about cyberattack damage in industries under their jurisdiction at the National Cybersecurity Office. The office was then directed to analyze that information, increase communication with business leaders and the public, and expand consultation and information services for small and midsize businesses and small-scale operators.

A Government-Led Response

Those consultation and information services are the community-facing measures described in the account. It reports no grassroots, self-organized response or mutual-aid effort; the response on offer is organized through government offices and communication with business leaders and the public. The account also describes no electoral or legislative remedy beyond the law already enacted, which took effect Oct. 1.

Takaichi said, “We will mobilize the full resources of the government to accelerate our efforts.” The package, central collection of industry damage information, and expanded consultation services all sit within that government-led plan. The administrator of a targeted computer may be told afterward, while the state decides whether to monitor, access, alter, or shut down the device. That’s the authority the new rules put in motion.