Japan Widens Scope of Plans For Active Cyber Defense; Major Hospitals, Defense Firms Likely to Be Covered

The Yomiuri Shimbun

15:00 JST, December 31, 2024

National hospitals and the defense industry will likely be included in the government’s new public-private information sharing framework to prevent cyberattacks, several government officials said.

The government is considering introducing an “active cyber defense” system to monitor communications and penetrate and neutralize the servers used by cyberattackers if necessary. The framework will be established at the time of the system’s introduction.

Disruption of the functions of hospitals and defense industry would interfere with the lives of citizens and the activities of the Self-Defense Forces. The government aims to prevent damage by sharing information with the private sector and supporting its cyber defense, even to the extent of neutralizing the source of an attack if necessary.

Under the new framework, the government and the private sector will regularly share the latest information on threats from both domestic and overseas sources, with an aim to improving defense capability against cyberattacks. It will be mandatory for the private sector to promptly report to the government if they are attacked.

A “national cyber security office” will be established by reorganizing the National center of Incident readiness and Strategy for Cybersecurity (NISC) to handle the task.

Membership in the framework will be voluntary for the private sector, and the government plans to allow national hospitals and the defense industry to join if they wish to, adding them to the list of targets to be protected.

The framework was mainly intended for essential infrastructure business, such as major power companies, based on the Economic Security Promotion Law, but it was deemed necessary to also include national hospitals and the defense industry in the framework from the perspective of “maintaining the functions of society and securing the foundations of security capabilities.”

The government is considering adding private hospitals, too, but will prioritize the security of national hospitals for now as they play a central role in their regions by possessing many beds and critical care medical centers. In cases when large-scale damage to medical institutions is expected, the government would enter the attacker’s server and neutralize the threat.

As for the defense field, Mitsubishi Electric Corp. was hit by a cyberattack in 2019, and the Defense Ministry, which has a business relationship with the company, announced that 59 pieces of sensitive information related to Japan’s defense may have been leaked.

The National Security Strategy as revised in 2022 regards “defense production and technology bases as defense capabilities themselves,” and the defense industry supports the SDF’s sustainability to fight. Since the industry handles sensitive information about equipment, it could become a target of cyberattacks. The government is considering having core companies in the industry participate in the framework.