Japan passes ‘Active cyber defense’ taking effect from 2027

Japan has officially enacted the Active Cyber Defense Law, authorising preemptive offensive cyber operations in a major departure from its longstanding pacifist security framework.

The legislation, passed by the House of Councillors on Friday following earlier approval by the House of Representatives, empowers Japanese government agencies to neutralise cyber threats before they materialise, including by infiltrating and disabling foreign servers suspected of launching attacks against Japan.

The law allows Japan’s Self-Defence Forces and police to proactively monitor, investigate and disrupt hostile cyber infrastructure, including international communications that transit through or terminate in Japan.

However, domestic communications and the content of messages such as email bodies remain excluded from surveillance, in line with constitutional privacy protections.

Chief Cabinet Secretary Yoshimasa Hayashi said the law is designed to allow Japan to “identify and respond to cyberattacks more quickly and effectively,” and expressed the government’s intention to elevate the country’s cyber capabilities to match those of the United States and major European powers.

The law, which will be fully operational by 2027, also introduces a robust oversight mechanism.

An independent review panel will be responsible for authorising data acquisition and offensive cyber measures, while a new national cybersecurity office will coordinate responses among relevant agencies.

In April, Japan’s Financial Services Agency warned of hundreds of millions of yen in unauthorised trades linked to compromised brokerage accounts.
In March, a major breach at telecom firm NTT affected the data of nearly 18,000 corporate clients.
In December, a cyberattack disrupted operations at Japan Airlines, temporarily halting ticket sales.

While the ruling Liberal Democratic Party led the push for the bill, the main opposition Constitutional Democratic Party also backed it in the upper house, stressing the importance of safeguarding citizens’ rights.

Lawmakers introduced amendments to address public concerns, including penalties of up to 2 million yen or four years’ imprisonment for any official found misusing surveillance powers.

The law also mandates businesses to report cyberattacks and supports the creation of joint cyber defence bases staffed by both police and military personnel.

The government emphasised that it would engage the public and private sectors in building cyber resilience and protecting national security in an increasingly hostile digital environment.

Read more on our website whatrends.com details