Japan’s ‘Active Cyber Defense’ Law Comes into Force

Japan started implementing its “active cyber defense law” on Oct. 1 to detect and disrupt serious cyberattacks before they cause major damage.

“The addition of neutralization measures will allow us to respond practically to cyberattacks targeting our country,” Prime Minister Sanae Takaichi said in a social media post on Wednesday.

The Japanese Diet passed the Active Cyber Defense Act on May 16, enabling the government to operate its active cyber defense program, under which four measures were introduced to prevent cyberattacks preemptively, according to Japanese media outlet Nippon.

The Center for Cybersecurity Policy and Law said in a commentary by Adam Dobell and Grace O’Neill that the most consequential component of the Active Cyber Defense Act is the change in data-collection practices.

The first measure involves the police and the Self-Defense Forces (SDF) responding to servers identified as sources of serious cyberattacks. The second enables authorities to access an attacker’s server and disable malicious activity, rather than simply defending the targeted network.

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

Another measure involves Japanese authorities strengthening cooperation with critical-infrastructure operators, including telecommunications, finance, and electricity companies. The fourth is the establishment of an autonomous Japan Active Cyber Defense Oversight Committee, established this April, which will review whether government actions were appropriate.

Toshiharu Furukawa, the minister in charge of cybersecurity, said at a government meeting on Wednesday, according to Nippon.com, “We’re committed to securing the world’s highest level of resilience.”

Takaichi’s government plans to begin a full-scale enhancement of the laws governing continuous communications monitoring in 2027. This will enable the government to strengthen its cyber defense capabilities to levels on par with those of other major nations.

Japan’s move toward active cyber defense has been driven by increasing cyberattacks from regional and global criminal groups and nation-state actors.

According to Dobell and O’Neill, China’s burgeoning cyber capabilities and operations targeting Japan, along with increasing regional strategic uncertainty, are driving this strategic shift.

“Japan’s 2022 National Security Strategy formally directed the government to address these escalating risks, aiming to match or exceed the cyber capabilities of major Western countries and align more closely with international cybersecurity practices,” Dobell and O’Neill said.

Their commentary also said that the new cybersecurity rules will likely apply to around 250 entities across 15 critical sectors covered by the Economic Security Promotion Act of 2022. These include finance, telecommunications, transportation, energy, and other industries critical to Japan’s national security and public welfare.