Cyber Law Passed In Japan Enables Early Threat Response

Japan has passed a new law that allows the government to take offensive action against cyberattacks before they cause damage.

The Active Cyberdefense Law, which received parliamentary approval on Friday, will become fully operational by 2027, as reported by The Japan Times (JT). It aims to develop Japanese cyber capabilities that match or surpass those of major Western countries.

Under the new law authorities, including police and Self-Defense Forces (SDF), can conduct pre-emptive server intrusions on systems suspected of cyberattack preparation. The new law allows them to conduct these investigations before any actual attacks occur. Additionally, it also grants authorities the power to monitor foreign internet traffic that passes through Japan.

This law will help Tokyo “‘equal or exceed’ the cyber capabilities ‘of major European countries and the US,’” said Chief Cabinet Secretary Yoshimasa Hayashi, as reported by The Record. He added that it would allow Japan to “identify and respond to cyber attacks more quickly and effectively.”

The Record notes that the move follows a series of high-profile incidents, including a 2023 breach of Japan’s cybersecurity agency that lasted nine months. Reports from 2020 showed Chinese military hackers compromised Japan’s defense networks, in what experts labeled as the nation’s most destructive cyberattack to date.

JT reports that to address privacy concerns, the law strictly limits the data the government can examine. The law blocks personal content such as email texts while it monitors technical data consisting of IP addresses together with attack patterns. A new independent watchdog established under the Cabinet Office will monitor all operations while requiring prior approval for every action.

The officials who misuse data will receive a maximum penalty of four years imprisonment along with a ¥2 million ($13,760) fine, as reported by JT. The law also encourages cooperation with private companies and requires businesses to report cyber incidents and the use of certain communication devices.