Defense Perspective: Proposals / Cybersecurity command post urgently needed to direct active cyber defense

The Yomiuri Shimbun

7:00 JST, November 22, 2022

The government will by the end of this year revise three key security-related documents — the National Security Strategy, the National Defense Program Guidelines, and the Mid-term Defense Program — aiming to significantly strengthen the nation’s defense capabilities. What must be done before this major change in Japan’s postwar security policy? The Yomiuri Shimbun will present its proposals in this series.

***

The spell of Japan’s exclusively defense-oriented policy has led to the nation lagging behind other countries in the domain of cyberspace, where there are neither boundaries between peacetime and contingency, nor national borders.

Former U.S. Director of National Intelligence Dennis Blair, speaking at the headquarters of the Liberal Democratic Party in April this year, said Japan’s cybersecurity measures rank the lowest among U.S. allies. He also said it is in the minor leagues, thus warning of the poor state of Japan’s cybersecurity system.

In the event of a cyber-attack, critical infrastructure such as electric power supply and railroads will be at risk of malfunctioning. But in Japan, there is a strong aspect of having the task of safeguarding such infrastructure being reliant on the efforts of each ministry or company on its own.

The Self-Defense Forces’ cyber defense unit, which was launched in March this year, has only 540 personnel, dwarfed by their Chinese counterpart at 175,000 personnel and North Korea at approximately 6,800.

In Microsoft’s Digital Defense Report 2022 released Nov. 4, the company analyzed data showing that, in the wake of Russia’s invasion of Ukraine, the number of “nation state actors” targeting critical infrastructure with cyber-attacks over the past year jumped from 20% to 40% of its total detections.

The U.S. government is becoming increasingly concerned that Japanese society could be thrown into disorder in the event of an emergency, and that the deterrence of the Japan-U.S. alliance could be weakened.

In the United States, the Homeland Security Department responds to cyber-attacks on critical infrastructure in cooperation with the Cyber Command. It also conducts active cyber defense, which involves infiltrating enemy servers and other systems to detect signs of an attack and identify the source of the attack.

Active cyber defense includes destroying the attacker’s system using a virus or other means. Taking countermeasures only after great damage has been wrought would be too late. Japan also needs to clearly state its policy on active cyber defense in its National Security Strategy, which is to be revised by the end of the year, and to arrange legislation for the use of such defense.

Another urgent need is to create a government command post function to direct the defense against cyber-attacks. A new organization should be established to absorb the functions of the current National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and expand its scale and authority, which should also assume the role of directing active cyber defense.

At a council held Nov. 9 for experts to comprehensively consider defense as a national strength, Kishida expressed his intention to push ahead with creating a system that will eliminate bureaucratic sectionalism and preferentially secure a budget for cyber security. This is in addition to funding research and development useful for defense and the development of public infrastructure such as ports.

This budget must be used to secure excellent personnel and introduce supercomputers and other equipment for the new organization.

The nation cannot be protected through an illusory pacifism that believes that, if a country is committed solely to its defense, it will not be attacked. The time has come to face the harsh reality and boldly review Japan’s cybersecurity measures.