Japan Enacts Active Cyberdefense Bill

Jiji Press

17:40 JST, May 16, 2025

TOKYO (Jiji Press) — The Diet enacted a bill on Friday to allow the government to take proactive steps to prevent serious cyberattacks.

The House of Councillors, the upper chamber, passed the active cyberdefense bill with majority support including from the ruling bloc and the major opposition Constitutional Democratic Party of Japan.

The legislation calls for the respect of the secrecy of communications, a provision added as a result of deliberations at the House of Representatives, the lower chamber.

The government plans to put the new law into full effect in 2027.

The introduction of active cyberdefense is stipulated in the 2022 National Security Strategy, with a goal of having Japan acquire the ability to defend against cyberattacks that is equivalent to or better than that of major Western countries.

Under the new law, the government will acquire and analyze communications between foreign countries via Japan and between Japan and other countries from peacetime. If there is a sign of a cyberattack, police and the Self-Defense Forces will take steps to neutralize threats.

The government will establish joint bases for police and the SDF. The law calls for promoting public-private cooperation, such as sharing of sensitive information, to improve the cyberdefense capabilities of infrastructure operators.

Businesses will be required to report to the government on the introduction of communication devices and cyberattacks.

In order to minimize restrictions linked to the secrecy of communications, which is guaranteed by the Constitution, mechanical information, such as internet protocol addresses and attack commands, will be sorted out and analyzed. Essential contents of communication, such as email texts, will be excluded from examination.

An independent organization will be established as an external bureau of the Cabinet Office to oversee the enforcement of the law. In principle, the acquisition of communication information and neutralization of threats of cyberattacks will be subject to prior approval. The number of such approvals will be reported to parliament.

Government officials who illegally use or leak acquired information will be sentenced to up to four years in prison or up to ¥2 million in fines.