Japan Seeks to Balance Active Cyber Defense, ‘Secrecy of Information’ Guaranteed by Constitution

The Yomiuri Shimbun

21:00 JST, November 24, 2024

With a third-party entity set to be established for approving wiretaps, the government aims to strike a balance between effective measures against cyberattacks and the “secrecy of any means of communication” guaranteed in the Constitution. It plans to establish the independent entity as part of an active cyber defense to prevent cyberattacks.

Analysis of communications from foreign countries, where the servers of the attacking parties are often located, will likely be key to such cyber defenses. The government is setting up its new system to allow for such analysis.

The government believes that the Constitution offers little protection for electronic communications between foreign countries that pass through Japan, and that if there are security concerns it would be possible to acquire this information without the consent of users.

Japan is a major hub in Asia for undersea cables, which handle 90% of international traffic for electronic communications, and it is expected to play a major role in obtaining information on cyberattacks by countries such as China and Russia.

For communications from overseas to Japan that are directed to operators in 15 key areas of infrastructure, such as electricity and railways, a system will be introduced to obtain the operator’s consent prior to the government obtaining their information, as there is a risk of major disruption to the economy if the operators are damaged in a cyberattack.

The system is also intended to allow the government to acquire and analyze electronic communications in Japan, as well as data from servers that have been used in past attacks, with the prior approval of the planned third-party entity.

Initially, the government had planned to monitor two main types of communications: those between foreign countries and those between foreign countries and key domestic infrastructure providers. However, the Liberal Democratic Party and experts insisted that this was not enough to prevent increasingly sophisticated cyberattacks, so the government had been reconsidering its approach.

The third-party entity will be highly independent, like the Personal Information Protection Commission, which was established as an external bureau of the Cabinet Office. It is expected to be made up of experts on the Constitution, international law, security and telecommunications, and to monitor whether the system is being used properly.

An expert panel for the government, chaired by former Japanese Ambassador to the United States Kenichiro Sasae, is expected to produce its recommendations on active cyber defense at a meeting later this month. The government plans to come up with new legislation and revisions to the Self-Defense Forces Law based on the panel’s recommendations, as well as discussions by the ruling and opposition parties. It aims to submit the necessary bills to the ordinary Diet session next year.