Listen to the article
Japan’s emergency cybersecurity package accelerates the country’s cyber defences as it faces a wave of cyberattacks, including attacks linked to North Korea. Japan’s allies should support the measures and learn from them.
By André Pienaar
Eleven days separated Prime Minister Sanae Takaichi’s order for an emergency cybersecurity package on 26 October from its approval on 06 November. In a political system that usually measures reform in advisory panels and fiscal years, the sheer speed was itself a policy. The Prime Minister was right to move boldly and quickly, and the allies should support her.
The emergency is real. Japan’s Personal Information Protection Commission received 2,094 reports of data breaches between 01 April and 16 October, far above the 1,256 filed in the whole of the previous financial year. Of these breaches, 830 occurred in the first 16 days of October. The leaked records total some 260 million. This is more than twice the country’s population. On 07 October, ransomware at SoftBank’s cloud subsidiary stopped servers for 495 corporate and local government customers and took the websites of Ibaraki’s prefectural government and police offline. Times Car, the car-sharing service, disclosed the loss of about 6.6 million accounts, including images of driving licences and other identity documents for about 1.6 million of them.
GMO’s security arm has identified Artex, a Chinese-developed AI tool, in attacks on Japanese companies. Kyodo reports that the inquiry into the extortion of GMO Internet itself points towards a group linked to North Korea. Recorded Future notes the premium criminals place on Japanese data and the likely role of AI in eroding the language barrier that once sheltered Japan from convincing phishing attacks. For a country living alongside China, North Korea and Russia, the line between criminal harvesting and strategic preparation offers little comfort. Stolen identity records serve both.
The most impressive thing about the Prime Minister’s emergency package is its candour. It states that many victims, or their contractors, left known vulnerabilities unpatched, misconfigured their websites and neglected security when building applications, and that AI now allows such gaps to be exploited quickly and at scale. Governments rarely tell their own corporate establishment so plainly that part of the fault lies at home.
The response has been built as a ladder. A new outreach team at the National Cybersecurity Office will approach organisations that may not yet know they have been compromised. A “Top Gun” team at the Information-technology Promotion Agency will use high-performance AI for penetration testing and equip the security firms that serve the private sector. Both are due this month. A public-private cyber rescue team will be sent to victims where the need is most acute, with a joint team of officials, police and Self-Defense Forces personnel reserved for the gravest cases. Small firms will gain backup and recovery support, and government systems will have their AI-assisted vulnerability checks brought forward.
The Prime Minister’s most important instruction concerned time. She told ministers that reports from critical infrastructure operators should reach the National Cybersecurity Office within hours if possible, and on the same day at the latest. Mobilisation was needed, she said, “to keep up with the speed of cyberattacks in the AI era.”
When I helped found South Africa’s Directorate of Special Operations, the Scorpions, our central idea was to put analysts, investigators and prosecutors on the same case from the first hour. Intelligence that reaches the right desk after the trail has gone cold is only history. The National Cybersecurity Office must become that desk for Japan, which is why her further instruction to examine how the office could detect and analyse suspicious traffic aimed at private companies matters so much.
Japan’s active cyber defence law, which came partly into force on 01 October, allows police and the Self-Defence Forces, under set conditions, to access and neutralise servers used in serious attacks. It is a historic departure for a country long cautious about acting beyond its own networks. The package supplies some of the means to use it, including more staff, more training and the takedown of attack infrastructure. It also seeks early access to attack data and to vulnerabilities before publication from foreign technology and frontier AI companies.
Supporting the Prime Minister means helping her finish the job, and three tests lie ahead.
The first is money. The ¥10 billion from reserves is a first instalment, and she has asked her finance minister to find the rest. It must reach the places where the damage is concentrated. Firms with 300 or fewer employees suffered 195 leaks in the first nine months of this year, nearly double the figure a year earlier, and 36 per cent of all incidents involved contractors or cloud providers.
The second is reach. Mandatory incident reporting under the law applies to 15 critical infrastructure sectors, and Nikkei has reported that most of the firms now under attack sit outside them. The revision of the law she has ordered gives her the vehicle to bring within the government’s field of vision the cloud and software suppliers whose compromise cascades across hundreds of customers.
The third is trust. Government analysis of communications data, due to begin by November 2027, is confined to foreign-related traffic. Extending it to domestic communications would test the secrecy of communications guaranteed by Article 21 of the constitution, as would any blocking of websites that host stolen data, an idea still under legal study. Takaichi should make that case openly before the Diet and strengthen independent oversight alongside every new power. Japanese citizens will accept these powers only if they can see how they are used.
The package calls itself a starting point, and it is one. The Prime Minister has told her country the truth about its exposure and set the state an accelerated deadline to bolster defences. Japan’s friends and allies should help her meet it, while assessing whether we need similarly bold and rapid measures at home, given the scale of the attacks.
