Direction of Japan’s New Cybersecurity Policy

Abstract

The direction of Japan’s cybersecurity policy is shaped by the escalating threat of state-sponsored cyberattacks in peacetime. This surge, notably from Russia, China, and North Korea, involves diverse tactics such as information manipulation, functional disruption, and financially motivated attacks, posing economic and national security risks. In response, nations are increasingly adopting Active Cyber Defense (ACD) strategies. ACD combines real-time attack detection with proactive countermeasures, aiming to impose costs on malicious cyber actors and mitigate potential damage. The United States and the United Kingdom lead in ACD implementation, using technical and policy responses, including hackbacks, to deter and attribute cyber threats. Japan is aligning its security policy with ACD principles, recognizing the need for proactive cyber measures beyond passive cyber defenses. This shift involves enhancing cyber capabilities, increasing cyber-related units, and fostering collaboration with the private sector. However, legal and regulatory challenges hinder ACD implementation in Japan, with existing laws restricting activities such as attack monitoring and attribution. Bridging these gaps is crucial for developing a comprehensive cybersecurity framework and ensuring the nation’s resilience against evolving cyber threats.