Active Cyber Defense: Urgently Prepare System, Including Development of Human Resources

Editorial

14:56 JST, May 20, 2025

A law related to “active cyber defense” has been enacted to prevent cyberattacks on critical infrastructure. The government must hasten the preparation of its operational system, including human resources development.

Active cyber defense means practices by which the government monitors the internet space in normal times, and if it detects signs of a cyberattack, it will infiltrate the server from which the attack originated and neutralize threats.

The police and the Self-Defense Forces will be the ones to carry out the neutralization. The main targets to be defended include government agencies as well as infrastructure providers in fields such as electric power, finance, and information and telecommunications.

There have been a spate of cases in which key infrastructure has already been subjected to cyberattacks, disrupting the lives of the public.

In 2023, the loading and unloading of containers at Nagoya Port was temporarily halted. At the end of 2024, Japan Airlines Co. experienced frequent delays and flight cancellations, and it became difficult to log in to the internet banking service of MUFG Bank.

Up to now, infrastructure providers have taken measures such as increasing the security of their systems in preparation for attacks. However, such passive approaches are no longer sufficient to prevent increasingly sophisticated and enhanced attacks. It is essential to nip such attacks in the bud.

Some have argued that the law could infringe on the “secrecy of any means of communication” under the Constitution. The government explained in the Diet that “in order to maintain the public welfare, there could be some restrictions on the secrecy of communications.”

In the vote on the bills for the law, not only the ruling coalition of the Liberal Democratic Party and Komeito, but also the Constitutional Democratic Party of Japan, the Japan Innovation Party and the Democratic Party for the People voted in favor of the bills. They likely realized that the reality of cyberattacks having become an imminent threat cannot be ignored.

A challenge for the future is to secure the personnel who will play a central role in dealing with cyber defense. The government needs to improve the capabilities of its personnel and also recruit civilians with superior skills.

In addition, the law stipulates that the police first infiltrate the server from which an attack originated and neutralize threats, and that the SDF join in if the attack is “highly organized and planned.” The police and the SDF should share knowledge and improve their skills through repeated joint training sessions.

According to the government’s explanation, the communications and information to be analyzed are limited to metadata, including email addresses, and the texts of emails and others are not included. The status of the government’s operations is supposed to be supervised by an independent body to be newly established, which is called the supervisory committee on cyber communications and information.

In response to requests from opposition parties in the House of Representatives, an article was added stating that the secrecy of any means of communication must not be unreasonably restricted. It will be important for the committee to perform a sufficient checking function.

(From The Yomiuri Shimbun, May 20, 2025)