Active Cyber Defense: Serious Damage from Cyberattacks Must Be Prevented

Editorial

15:00 JST, February 16, 2025

The fear that cyberattacks could paralyze people’s lives and economic activity has become a reality. It is essential to prevent the occurrence of large-scale harm.

To strengthen the government’s ability to respond to cyberattacks, the government has submitted related bills to the House of Representatives that include the introduction of “active cyber defense” as a central pillar. The government said it aims to have the bills passed in the current Diet session and for the system to be in place within 18 months.

There was a spate of cyberattacks on critical infrastructure from the end of 2024 through the beginning of this year. Flight delays and cancellations occurred frequently at Japan Airlines Co., and it became difficult to access the online banking service of MUFG Bank.

If this issue is not addressed, the risk of society being disrupted by cyberattacks will only increase.

The United States has repeatedly urged Japan to strengthen its measures, saying Japan’s cyber defense system is vulnerable. If defense secrets shared with allies and friendly nations were to flow out of Japan, the country would lose its credibility.

To strengthen measures, it is important for the government to constantly monitor cyberspace and detect signs of attacks. To make this possible, telecommunications carriers must provide information to the government, but the Constitution stipulates “the secrecy” of communications, so it is difficult to do so amid the current situation.

The bills call for the establishment of a mechanism in which a highly independent third-party organization monitors the operation of the entire system and telecommunications operators provide information to the government on the condition that the third-party organization approves the provision.

The reasoning is based on an interpretation that while the secrecy of communications must be respected, certain restrictions are acceptable to protect public welfare.

In addition, to dispel concerns about possible privacy violations, the government will be obliged to report to the Diet every year about the status of the envisioned mechanism’s implementation. The bills also stipulate that penalties will be imposed if government employees leak or misuse information.

The government should carefully explain the importance of cyber defense through the Diet’s deliberation on the bills and broaden understanding.

If a serious attack is detected, the police and the Self-Defense Forces will jointly work to neutralize it by infiltrating the server from which it originated. In addition, businesses in 15 key infrastructure industries, including aviation, finance and telecommunications, will be required to report cyberattacks to the government.

No matter how detailed a legal system is established, it will be difficult to gain the cooperation of the private sector without the technical prowess to actually stop cyberattacks. Training cyber personnel and improving the technical capabilities of the police and the SDF are also important challenges.

(From The Yomiuri Shimbun, Feb. 16, 2025)