LDP Approves Outline of ‘Active Cyber Defense’ Bills; System to Prevent Major Cyberattacks in Japan

The Yomiuri Shimbun

13:46 JST, January 19, 2025

The Liberal Democratic Party approved an outline of bills relating to the “active cyber defense” system to prevent major cyberattacks in Japan.

The outline was presented Thursday by the government to LDP executives at meetings including one at the Headquarters for the Promotion of Economic Security. The system would enable government agencies to acquire and analyze communication data and, therefore, it must conform to the constitutional right to privacy regarding communication. The members deemed that the outline has given sufficient consideration on the matter and approved it in principle.

“The lives of Japanese people will be at risk if we do not improve our cybersecurity capabilities as soon as possible,” LDP Policy Research Council Chairman Itsunori Onodera told reporters after a meeting, citing a spate of cyberattacks in December on Japan Airlines Co. among others.

Related bills will be submitted to an ordinary Diet session, which convenes on Jan. 24, after going through procedures within the LDP and Komeito. The two parties will call on the opposition parties to support the bill to enact the legislation soon.

Active cyber defense will radically strengthen three major areas: closer public-private sector cooperation, the use of information from electronic communication and operations to penetrate and neutralize an attacker’s server. Among them, Diet deliberations will likely focus on the acquisition and analysis of communication information — actions necessary to detect signs of an attack — in terms of consistency with the Constitution.

Strict management

The outline states that information in communication to be monitored is mainly “mechanical ones” like IP addresses and commands, and the essential contents of any communication such as the content of text messages are excluded.

To prevent arbitrary selection, information to be monitored will be narrowed down via “automatic methods that do not involve human knowledge,” and unnecessary information will be immediately deleted. Penalties will be established for cases such as improper use or leakage by administrative staff.

These tasks will be handled by a “national cybersecurity office” to be established within the Cabinet Secretariat. If the government’s analysis detects a risk of a major cyberattack, the police and the Self-Defense Forces will penetrate and neutralize attacker’s servers to stop or delete programs.

An independent body will be established to oversee the active cyber defense system. As an organization based on Article 3 of the National Government Organization Law, the new entity will be responsible for screening the government’s acquisition of communication information before approving it. The government, for its part, will sign agreements with core infrastructure providers, such as major power companies, to obtain their prior consent for such acquisition. Prior approval from the independent body will also be necessary in principle to penetrate and neutralize the source of an attack.

Makers have responsibility

Public-private sector cooperation will be expanded. Core infrastructure providers must report if they have been attacked.

A number of “zero-day attacks” have been reported in which hackers exploit vulnerabilities in information technology products such as security software before developers can find a fix. Under such a circumstance, a system will be established so that the government can request IT makers to take necessary steps when it finds vulnerabilities. The government will ask makers, for their part, to make efforts to provide information to prevent the spread of damage.