By Wang Chengwen
The Japanese government has been holding frequent meetings to draft amendments to relevant laws to include multiple industries under enhanced cyber defense measures since late December 2024, according to reports by Japan's Kyodo News and other media outlets. Some commentators believe that this is an important measure for Japan to accelerate the implementation of the "active cyber defense" concept, and it is likely to become a turning point in Japan's cyber policy.
The concept of "active cyber defense" is not new. Japan's defense policy documents including the National Security Strategy amended in December 2022 explicitly stated that the Japan Self-Defense Forces (JSDF) would expedite the establishment of an "active cyber defense" mechanism and achieve cyber defense capabilities comparable to or surpassing those of the US and European nations. The so-called "active cyber defense" refers to the relevant Japanese departments' continuous and regular monitoring of cyberspace to discover potential threats in advance, identify and trace the source of network attacks, and take countermeasures such as paralyzing the attack source data based on relevant jurisdiction.
Under Japan's current legal framework, the Japanese government lacks a sufficient legal basis to implement cyber counterattacks. In particular, there is a lack of legal norms on sensitive issues such as setting of legal responsibilities and boundaries for the privacy of people's communications.
To address these issues, the Japanese government established an expert panel in May 2024 to study and determine the legal framework for the "active cyber defense" strategy. The Japanese government plans to draft a bill aimed at securing critical computer systems and submit it to the Diet for deliberation in late January. Concurrently, the government is accelerating efforts to amend the Basic Act on Cybersecurity, the Telecommunications Business Act, the Act on Prohibition of Unauthorized Computer Access, and the Penal Code, among others, aiming to complete legislative work for the "active cyber defense" strategy by mid-2025.
Japan's legislative amendments focus on four main areas. First, it officially designates the state and government as the primary entities responsible for cyber defense and makes cyber defense a statutory obligation of the government. Second, it grants the Cabinet and relevant cyber defense departments authority to trace and counter-hack attacking servers. Third, it comprehensively improves the capability to carry out "active cyber defense." Fourth, it amends the interpretation of the Constitution to legalize monitoring of critical infrastructure networks.
The recent series of "legislative amendment" measures by the Japanese government are likely to become a turning point in Japan's cyber policy. Due to restrictions in the Japanese Constitution and related laws, the Japanese government and the JSDF's network surveillance and attack and defense powers are subject to certain constraints. As these legal amendments progress, Japan's domestic cybersecurity laws will align seamlessly with defense policy documents such as the National Security Strategy. This alignment will enable the government and the JSDF to justify countermeasures or even preemptive actions in cyberspace under the guise of protecting critical infrastructure in key departments. The JSDF's cyber warfare capabilities can also, under the pretext of "active cyber defense," conduct preemptive attacks on foreign servers or preset cyber attack weapons in a "dormant" state that can be activated when necessary.
In recent years, the Japanese government and the JSDF have taken various steps to establish the conditions for an "active cyber defense" mechanism and overcome legal and public opinion hurdles. This aligns with Japan's broader strategic shift from the post-World War II "exclusively defense-oriented" policy to systematically developing so-called "counterstrike capabilities." It can be seen that the "active cyber defense" concept goes beyond traditional defense and represents an extension of Japan's preemptive operational strategy into cyberspace.
Japan has been steadily expanding its cyber warfare capabilities in recent years under the pretext of safeguarding cybersecurity. This obsessive focus on cyberspace and cybersecurity reflects the radicalization of Japan's national security perspective. Japan's attempts and actions to adopt a preemptive approach in emerging domains such as cyberspace contribute to its aggressive adjustments to national security strategy and will pose new threats to global cybersecurity.
