Japan's government has begun operating an "active cyber defense" — a system that lets the state strike at attackers before damage occurs — under a law that took effect on October 1. The measure allows authorities to enter the servers behind an attack and shut down the programs used to carry it out, a step the government calls a "neutralization measure."
Prime Minister Sanae Takaichi stressed the reach of the new powers at the first meeting of a cabinet committee on cybersecurity on October 26. "We will strategically select and execute every response option available against cyberattacks, including neutralization measures," she said.
How the measure works
Neutralization is the core of the program. When the government detects signs of an impending hack, it moves first: entering the server computers used for the attack and deleting or shutting down the malicious programs to prevent harm. Police carry out the measure in emergencies where leaving the attack alone could cause serious harm, and the Self-Defense Forces handle sophisticated attacks involving foreign governments.
Attackers are widely considered to hold a decisive advantage, and they can now use artificial intelligence to find security holes and launch more attacks than defenders can absorb. Striking first lets the government cut an attack off at its source.
The law obliges 258 operators in 15 sectors — including finance, electricity and gas, telecommunications, railways and aviation — to report to the government when they detect signs of an attack.
A request from a victim, and a refusal
Because the government acts behind the scenes before damage occurs, responding once harm is visible is difficult. GMO Internet Group, the first company to ask for the measure after the law took effect, had already been attacked, and the government is unwilling to apply it.
Chief Cabinet Secretary Minoru Kihara said only that "the law does not set out any procedure for requests from victim organizations." Companies were not expected to file such requests, and the program is meant to prevent damage rather than respond to it, which limits what the government can do.
Neutralizing a server located abroad could be seen as a preemptive strike. The foreign minister must first confirm whether the action is permissible under international law.
The law gives the state offensive powers that it exercises out of public view, and it sets no procedure for the companies it is meant to protect to ask for help.