Cybersecurity Overview of Japan
Japan’s Cybersecurity Reform and Cyberpower Ambition
Copyright (c) 2025 Lendvai Tünde

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Abstract
Over the past decade, Japan has invested significant resources in developing its cyber defense system, driven by threat perceptions associated with the demonstrated offensive cyber capabilities of its regional adversaries such as Russia, China, and North Korea. This research, based on secondary source analysis, explores the country-specific factors that enable or limit the implementation of active cyber defense outlined in Japan’s strategic documents and the application of offensive cyber capabilities. The study argues that three key factors influence these efforts. The first stems from the legal framework, which continues to constrain Japan’s potential responses in cyberspace to such an extent that the effectiveness of cyber defense based on denial-of-success deterrence mechanisms is questionable. However the other two factors, in a security policy context, facilitate the lawful use of offensive capabilities. These include the development of an international cyber defense cooperation network and reforms aimed at enhancing the resilience of the cybersecurity ecosystem.
Keywords:
How to Cite
References
ALAN, J. (2024): Japan Considers Measures To Mandate Private Sector Cybersecurity Incident Reporting. The Cyber Express, 2024. augusztus 6. Online: https://thecyberexpress.com/japan-mandatory-cybersecurity-reporting
ANTONIUK, Daryna (2024): Japan Sees Increased Cyberthreats to Critical Infrastructure, Particularly From China. The Record, 2024. február 16. Online: https://therecord.media/japan-critical-infrastructure-cyberthreats
Amerikai Egyesült Államok Indo-csendes-óceáni Parancsnokság (2024): ASD(A) Cyber Warfare, USINDOPACOM, JFHQ-DODIN join forces to host second Indo-Pacific Critical Infrastructure Workshop. 2024. november 6. Online: https://www.pacom.mil/Media/News/News-Article-View/Article/3957555/asda-cyber-warfare-usindopacom-jfhq-dodin-join-forces-to-host-second-indo-pacif/
BARTLETT, Benjamin (2018): Government as Facilitator: How Japan Is Building Its Cybersecurity Market. Journal of Cyber Policy, 3(3), 327–343. Online: https://doi.org/10.1080/23738871.2018.1550522
BARTLETT, Benjamin (2019): How Japanese Cybersecurity Policy Changes. Harvard Program on U.S.-Japan Relations Occasional Paper Series, (1), 1–39. Online: https://projects.iq.harvard.edu/files/us-japan/files/19-01_bartlett.pdf
BARTLETT, Benjamin (2020): Japan: An Exclusively Defense-Oriented Cyber Policy. Asia Policy, 15(2), 93–100. Online: https://dx.doi.org/10.1353/asp.2020.0013
BARTLETT, Benjamin (2023): Why Do States Engage in Cybersecurity Capacity-Building Assistance? Evidence From Japan. The Pacific Review, 37(3), 475–503. Online: https://doi.org/10.1080/09512748.2023.2183242
BASU, Pratnashree (2024): From Reactive to Proactive: Japan’s Advances in Cybersecurity and Cyber Defence Strategies. Observer Research Foundation, 2024. március 17. Online: https://www.orfonline.org/expert-speak/from-reactive-to-proactive-japan-s-advances-in-cybersecurity-and-cyber-defence-strategies
BERZSENYI Dániel (2023): Különleges kiberműveletek. A kiber különleges műveleti képesség és kialakításának vizsgálata. Doktori (PhD-) értekezés. Budapest: Nemzeti Közszolgálati Egyetem Hadtudományi Doktori Iskola. Online: https://doi.org/10.17625/NKE.2023.012
BRUNSON, Xavier – CHICK, Cody (2024): How Cobra Gold Helps the US Strengthen its Indo-Pacific Partnerships. The Diplomat, 2024. május 14. Online: https://thediplomat.com/2024/05/how-cobra-gold-helps-the-us-strengthen-its-indo-pacific-partnerships/
Center for Strategic & International Studies [@csis] (2024): What to Expect from Japan’s New Leader? YouTube, 2024. október 3. Online: https://www.youtube.com/watch?v=sFrSzgDBG4A
FÁBIÁN Emília (2015): Az átalakuló normák hatása a japán biztonságpolitikára. Yoshidától az Abe-doktrínáig- az antimilitarista normától a proaktív pacifizmusig. PhD-értekezés. Budapest: Budapesti Corvinus Egyetem Nemzetközi Kapcsolatok Doktori Iskola. Online: https://doi.org/10.14267/phd.2016016
FAGUY, Ana (2023): China Hacked Japanese Military Networks, Report Says. Forbes, 2023. augusztus 7. Online: https://www.forbes.com/sites/anafaguy/2023/08/07/china-hacked-japanese-military-networks-report-says/
FIXTV HUNGARY (FIX) [@fixhdtv] (2024): Enigma – Bizonytalan Japán háborúra készül. YouTube, 2024. december 13. Online: https://www.youtube.com/watch?v=PcDUPWjMQxY
GADY, Franz-Stefan (2017): Japan: The Reluctant Cyberpower. Paris–Brussels: Institut français des relations internationales. Online: https://www.ifri.org/en/papers/japan-reluctant-cyberpower
GREIG, Jonathan (2024): FBI Attributes Largest Crypto Hack of 2024 to North Korea’s TraderTraitor. The Record, 2024. december 25. Online: https://therecord.media/fbi-largest-crypto-hack-2024-tradertraitor
HIDESHI, Tokuchi (2023): Japan’s New National Security Strategy and Contribution to Networked Regional Security. Center for Strategic and International Studies, 2023. június 23. Online: https://www.csis.org/analysis/japans-new-national-security-strategy-and-contribution-networked-regional-security
Hit Rádió [@hitradiobudapest] (2024): Létrehozná az ázsiai NATO-t Japán? – Bartók András. YouTube, 2024. november 3. Online: https://www.youtube.com/watch?v=OMR1B1QNsI0
Japan Mulls Requiring Private Sector Operators to Report Cyberattacks on Infrastructure. The Japan Times, 2024. augusztus 4. Online: https://www.japantimes.co.jp/news/2024/08/04/japan/japan-cybersecurity-reporting/
Japán Digitális Ügynökség [é. n.]: Organisational Background of Estabilishment. Online: https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/ed91c288-7d40-4a9b-9d86-1007f256ada6/c83a6759/20240528_en_organization_outline.pdf
Japán Információbiztonsági Politikai Tanács (2013): Cybersecurity Strategy: Towards a World-Leading, Resilient and Vigorous Cyberspace. Online: http://www.nisc.go.jp/eng/pdf/cybersecuritystrategy-en.pdf
Japán Információbiztonsági Politikai Tanács (2014): The Basic Policy of Critical Information Infrastructure Protection (3rd Edition). Online: https://www.nisc.go.jp/eng/pdf/actionplan_ci_eng_v3.pdf
Japán Kiberbiztonsági Stratégiai Központ (2022): The Cybersecurity Policy for Critical Infrastructure Protection. Cybersecurity Strategic Headquarters. Online: https://www.nisc.go.jp/eng/pdf/cip_policy_2022_eng.pdf
Japán Külügyminisztérium (2013): Joint Statement Japan-U.S. Cyber Dialogue. 2013. május 10. Online: https://www.mofa.go.jp/region/page22e_000001.html
Japán Külügyminisztérium (2015): The Guidelines for Japan-U.S. Defense Cooperation. 2015. április 27. Online: http://www.mofa.go.jp/mofaj/files/000078188.pdf
Japán Külügyminisztérium (2024): The 9th Japan-US Cyber Dialogue. 2024. június 27. Online: https://www.mofa.go.jp/press/release/pressite_000001_00394.html
Japán Nemzeti Incidenskészenléti és Kiberbiztonsági Stratégiai Központja (2021): Japan’s Cybersecurity Strategy 2021 (Overview). Online: https://www.nisc.go.jp/pdf/policy/kihon-s/cs-senryaku2021-gaiyou-en.pdf
Japán Védelmi Minisztérium (2019): Defense of Japan 2019. Online: https://www.mod.go.jp/en/publ/w_paper/wp2019/pdf/DOJ2019_Full.pdf
Japán Védelmi Minisztérium (2022a): National Defense Strategy. 2022. december 16. Online: https://www.mod.go.jp/j/approach/agenda/guideline/strategy/pdf/strategy_en.pdf
Japán Védelmi Minisztérium (2022b): Defense Buildup Program. 2022. december 16. Online: https://www.mod.go.jp/j/policy/agenda/guideline/plan/pdf/program_en.pdf
Japan’s SDF Launches New Cyber-Defense Unit. Kyodo News, 2022. március 17. Online: https://english.kyodonews.net/news/2022/03/2009b0fac163-japans-sdf-launches-new-cyber-defense-unit.html?utm_source=chatgpt.com
JOHNSTONE, Christopher B. – KLAAS, Leah (2024): Combating Disinformation. An Agenda for U.S.-Japan Cooperation. Washington, DC: Center for Strategic and International Studies. Online: https://csis-website-prod.s3.amazonaws.com/s3fs-public/2024-07/240708_Johnstone_Combating_Disinformation.pdf
Joint Ministerial Statement of the ASEAN-Japan Ministerial Policy Meeting on Cybersecurity Cooperation. 2013. szeptember 13. Online: www.asean.org/wp-content/uploads/images/Statement/final_joint_statement%20asean-japan%20ministerial%20policy%20meeting.pdf
JPCERT/CC Incident Handling Report January 1, 2024 - March 31, 2024. 2024. április 18. Online: https://www.jpcert.or.jp/english/doc/IR_Report2023Q4_en.pdf
KALLENDER, Paul – HUGHES, Christopher W. (2016): Japan’s Emerging Trajectory as a ’Cyber Power’: From Securitization to Militarization of Cyberspace. Journal of Strategic Studies, 40(1–2), 118–145. Online: https://doi.org/10.1080/01402390.2016.1233493
Kaspersky Lab (2013): The ’Icefog’ APT: A Tale of Cloak and Three Daggers. Online: https://media.kaspersky.com/en/icefog-apt-threat.pdf.
KATAGIRI, Nori (2021): From Cyber Denial To Cyber Punishment: What Keeps Japanese Warriors from Active Defense Operations? Asian Security, 17(3), 331–348. Online: https://doi.org/10.1080/14799855.2021.1896495
KATAGIRI, Nori (2022): Assessing Japan’s Cybersecurity Policy: Change and Continuity From 2017 to 2020. Journal of Cyber Policy, 7(1), 38–54. Online: https://doi.org/10.1080/23738871.2022.2033805
KOO, Soo-Kyung (2013): Cyber Security in South Korea: The Threat Within. The Diplomat, 2013. augusztus 19. Online: https://thediplomat.com/2013/08/cyber-security-in-south-korea-the-threat-within/
KOSUKE, Takahashi (2024): Why Japan Is Lagging Behind in Cyber Defense Capabilities. The Diplomat, 2024. május 24. Online: https://thediplomat.com/2024/05/why-japan-is-lagging-behind-in-cyber-defense-capabilities/
LOTTAZ, Pascal (2023): Japan’s New Security Strategy, Part 2: The Ongoing Debates. The Diplomat, 2023. június 8. Online: https://thediplomat.com/2023/06/japans-new-security-strategy-part-2-the-ongoing-debates/
Malpedia [é. n. a]: APT41. Online: https://malpedia.caad.fkie.fraunhofer.de/actor/apt41
Malpedia [é. n. b]: MirrorFace. Online: https://malpedia.caad.fkie.fraunhofer.de/actor/mirrorface
MARTIN, Alexander (2023): Japan’s Cybersecurity Agency Breached by Suspected Chinese Hackers: Report. The Record, 2023. augusztus 29. Online: https://therecord.media/japan-cybersecurity-agency-breached-report
MATSUO, Miki (2024). Unaddressed Challenges for Defense Policy Reform in Japan. Center for Strategic and International Studies, 2024. május 9. Online: https://www.csis.org/analysis/unaddressed-challenges-defense-policy-reform-japan
MITRE [é. n.]: APT41. Online: https://attack.mitre.org/groups/G0096/
NAJAH, Redouan (2024): Japan’s NSS in the Age of Cyber Warfare: A Historical Transformation. Japan Up Close, 2024. július 8. Online: https://japanupclose.web-japan.org/policy/p20240708_1.html
NAKASHIMA, Ellen (2023): China Hacked Japan’s Sensitive Defense Networks, Officials Say. The Washington Post, 2023. augusztus 8. Online: https://www.washingtonpost.com/national-security/2023/08/07/china-japan-hack-pentagon/
NATO (2023): Individually Tailored Partnership Programme between NATO and Japan for 2023–2026. Online: https://www.nato.int/cps/en/natohq/official_texts_217797.htm.
NATO (2025): Emerging and Disruptive Technologies. Online: https://www.nato.int/cps/fr/natohq/topics_184303.htm?selectedLocale=en
Notice Regarding Results of Security Incident Investigation. Fujitsu, 2024. július 9. Online: https://www.fujitsu.com/global/about/resources/news/notices/2024/0709-01.html
ONODERA, Yoshifumi – TANAKA, Hiroyuki – SHIMAMURA, Naoto (é.n.): Cybersecurity 2024: Japan. In Chambers Global Practice Guides. Online: https://org-www.morihamada.com/en/insights/publications/2024-60
OSAWA, Jun (2024): Direction of Japan’s New Cybersecurity Policy. Asia-Pacific Review, 30(3), 63–78. Online: https://doi.org/10.1080/13439006.2023.2295707
PAGANINI, Pierluigi (2020): Mitsubishi Electric Corp. Was Hit by a New Cyberattack. Security Affairs, 2020. november 20. Online: https://securityaffairs.com/111201/hacking/mitsubishi-electric-cyberattack.html
PERNIK, Piret (2023): NATO-Japan Deepening Cooperation in Cybersecurity and Critical Technologies. Japan Up Close, 2023. március 24. Online: https://japanupclose.web-japan.org/policy/p20230324_2.html
SINHA, Sharat (2024): Japan Cyber Threat Landscape, Elevandi & Future Matters Center of Excellence, Online: https://www.elevandi.io/hubfs/custom-video-thumbnails/Japan%20Cyber%20Threat%20Landscape%20-%20Sharat%20Sinha%20-%20March%202024.pdf
SIRIPALA, Thisanka (2024): Japan’s Rush to Play Cyber Defense Catchup. The Diplomat, 2024. június 14. Online: https://thediplomat.com/2024/06/japans-rush-to-play-cyber-defense-catchup/
SMITH, Sheila A. (2024): How Japan is Viewing the North Korea-Russia Alliance. Council on Foreign Relations, 2024. június 27. Online: https://www.cfr.org/expert-brief/how-japan-viewing-north-korea-russia-alliance
SOESANTO, Stefan (2020): Japan’s National Cybersecurity and Defense Posture. Policy and Organizations. Zürich: Center for Security Studies (CSS), ETH Zürich. Online: https://doi.org/10.3929/ethz-b-000437790
Strategic Command (2024): Strategic Command Shares Cyber Expertise With Japan. Gov.uk, 2024. február 20. Online: https://www.gov.uk/government/news/strategic-command-shares-cyber-expertise-with-japan?utm_source=chatgpt.com
TELYCHKO, Veronika (2024): Kimsuky APT Campaign Detection Targeting Japanese Organizations. SOC Prime, 2024. július 10. Online: https://socprime.com/blog/kimsuky-apt-campaign-detection-targeting-japanese-organizations
TOMONAGA, Shusei (2024a): MirrorFace Attack against Japanese Organisations. JPCERT/CC Eyes, 2024. július 16. Online: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html
TOMONAGA, Shusei (2024b): Recent Cases of Watering Hole Attacks, Part 1. JPCERT/CC Eyes, 2024. december 19. Online: https://blogs.jpcert.or.jp/en/2024/12/watering_hole_attack_part1.html
VOO, Julia et al. (2020): National Cyber Power Index 2020. Methodology and Analytical Considerations. China Cyber Policy Initiative Reports. Cambridge: Harvard Kennedy School, Belfer Center for Science and International Affairs. Online: https://www.belfercenter.org/sites/default/files/2024-09/NCPI_2020.pdf
VOO, Julia – HEMANI, Irfan – CASSIDY, Daniel (2022): National Cyber Power Index 2022. Cambridge: Harvard Kennedy School, Belfer Center for Science and International Affairs. Online: https://www.belfercenter.org/publication/national-cyber-power-index-2022
Jogi források
Japán Alaptörvénye (The Constitution of Japan). 1946. május 3. Online: https://japan.kantei.go.jp/constitution_and_government_of_japan/constitution_e.html
- 2014. évi 104. Kiberbiztonsági kerettörvény (The Basic Act on Cybersecurity). Online: https://www.japaneselawtranslation.go.jp/en/laws/view/4618
- 2022 évi 70. törvény a japán távközlési vállalkozásokról szóló 1984. évi 86. törvény egyes rendelkezéseinek módosításáról (revised Telecommunications Business Act). Online: https://www.japaneselawtranslation.go.jp/en/laws/view/3648/en