Legal New Japanese law to allow preemptive action against cyberattacks

Today, the Japanese parliament passed legislation enabling preemptive cyber defence measures. The legislation grants the government legal authority to monitor communications data even during peacetime and to disable hostile servers in the event of a cyberattack.

Known as the "active cyber defence" law, the legislation also mandates that operators of critical infrastructure, such as those in the electricity and railway sectors, report any cyber incidents to the government. This legislative shift comes in response to recent cyberattacks that disrupted services at an airline and several financial institutions. In light of these threats, the government is building a comprehensive legal and operational framework to strengthen national cyber resilience, aiming to have the new system entirely in place by 2027.

Information to be monitored and analyzed by the government includes IP addresses used in communication between foreign countries that pass through Japan, as well as those between Japan and abroad. They do not include domestic communications and the government is not permitted to surveil the content of messages, including the body of emails. Under the measures, police will take initial responsibility for neutralizing an attacker's server and the Self-Defense Forces will step in if an incident is deemed particularly sophisticated, organized and premeditated.

Click to expand...