Cybersecurity Overview of Japan

Japan’s Cybersecurity Reform and Cyberpower Ambition

  • Tünde Lendvai
doi: 10.32567/hm.2025.1.8

Abstract

Over the past decade, Japan has invested significant resources in developing its cyber defense system, driven by threat perceptions associated with the demonstrated offensive cyber capabilities of its regional adversaries such as Russia, China, and North Korea. This research, based on secondary source analysis, explores the country-specific factors that enable or limit the implementation of active cyber defense outlined in Japan’s strategic documents and the application of offensive cyber capabilities. The study argues that three key factors influence these efforts. The first stems from the legal framework, which continues to constrain Japan’s potential responses in cyberspace to such an extent that the effectiveness of cyber defense based on denial-of-success deterrence mechanisms is questionable. However the other two factors, in a security policy context, facilitate the lawful use of offensive capabilities. These include the development of an international cyber defense cooperation network and reforms aimed at enhancing the resilience of the cybersecurity ecosystem.

Keywords:

Japan proactive cyber defence cybersecurity strategy offensive cyber capability cybersecurity Japan Self Defence Force cyber defence

How to Cite

Lendvai, T. (2025). Cybersecurity Overview of Japan: Japan’s Cybersecurity Reform and Cyberpower Ambition. Military Engineer, 20(1), 139–161. https://doi.org/10.32567/hm.2025.1.8

References

ALAN, J. (2024): Japan Considers Measures To Mandate Private Sector Cybersecurity Incident Reporting. The Cyber Express, 2024. augusztus 6. Online: https://thecyberexpress.com/japan-mandatory-cybersecurity-reporting

ANTONIUK, Daryna (2024): Japan Sees Increased Cyberthreats to Critical Infrastructure, Particularly From China. The Record, 2024. február 16. Online: https://therecord.media/japan-critical-infrastructure-cyberthreats

Amerikai Egyesült Államok Indo-csendes-óceáni Parancsnokság (2024): ASD(A) Cyber Warfare, USINDOPACOM, JFHQ-DODIN join forces to host second Indo-Pacific Critical Infrastructure Workshop. 2024. november 6. Online: https://www.pacom.mil/Media/News/News-Article-View/Article/3957555/asda-cyber-warfare-usindopacom-jfhq-dodin-join-forces-to-host-second-indo-pacif/

BARTLETT, Benjamin (2018): Government as Facilitator: How Japan Is Building Its Cybersecurity Market. Journal of Cyber Policy, 3(3), 327–343. Online: https://doi.org/10.1080/23738871.2018.1550522

BARTLETT, Benjamin (2019): How Japanese Cybersecurity Policy Changes. Harvard Program on U.S.-Japan Relations Occasional Paper Series, (1), 1–39. Online: https://projects.iq.harvard.edu/files/us-japan/files/19-01_bartlett.pdf

BARTLETT, Benjamin (2020): Japan: An Exclusively Defense-Oriented Cyber Policy. Asia Policy, 15(2), 93–100. Online: https://dx.doi.org/10.1353/asp.2020.0013

BARTLETT, Benjamin (2023): Why Do States Engage in Cybersecurity Capacity-Building Assistance? Evidence From Japan. The Pacific Review, 37(3), 475–503. Online: https://doi.org/10.1080/09512748.2023.2183242

BASU, Pratnashree (2024): From Reactive to Proactive: Japan’s Advances in Cybersecurity and Cyber Defence Strategies. Observer Research Foundation, 2024. március 17. Online: https://www.orfonline.org/expert-speak/from-reactive-to-proactive-japan-s-advances-in-cybersecurity-and-cyber-defence-strategies

BERZSENYI Dániel (2023): Különleges kiberműveletek. A kiber különleges műveleti képesség és kialakításának vizsgálata. Doktori (PhD-) értekezés. Budapest: Nemzeti Közszolgálati Egyetem Hadtudományi Doktori Iskola. Online: https://doi.org/10.17625/NKE.2023.012

BRUNSON, Xavier – CHICK, Cody (2024): How Cobra Gold Helps the US Strengthen its Indo-Pacific Partnerships. The Diplomat, 2024. május 14. Online: https://thediplomat.com/2024/05/how-cobra-gold-helps-the-us-strengthen-its-indo-pacific-partnerships/

Center for Strategic & International Studies [@csis] (2024): What to Expect from Japan’s New Leader? YouTube, 2024. október 3. Online: https://www.youtube.com/watch?v=sFrSzgDBG4A

FÁBIÁN Emília (2015): Az átalakuló normák hatása a japán biztonságpolitikára. Yoshidától az Abe-doktrínáig- az antimilitarista normától a proaktív pacifizmusig. PhD-értekezés. Budapest: Budapesti Corvinus Egyetem Nemzetközi Kapcsolatok Doktori Iskola. Online: https://doi.org/10.14267/phd.2016016

FAGUY, Ana (2023): China Hacked Japanese Military Networks, Report Says. Forbes, 2023. augusztus 7. Online: https://www.forbes.com/sites/anafaguy/2023/08/07/china-hacked-japanese-military-networks-report-says/

FIXTV HUNGARY (FIX) [@fixhdtv] (2024): Enigma – Bizonytalan Japán háborúra készül. YouTube, 2024. december 13. Online: https://www.youtube.com/watch?v=PcDUPWjMQxY

GADY, Franz-Stefan (2017): Japan: The Reluctant Cyberpower. Paris–Brussels: Institut français des relations internationales. Online: https://www.ifri.org/en/papers/japan-reluctant-cyberpower

GREIG, Jonathan (2024): FBI Attributes Largest Crypto Hack of 2024 to North Korea’s TraderTraitor. The Record, 2024. december 25. Online: https://therecord.media/fbi-largest-crypto-hack-2024-tradertraitor

HIDESHI, Tokuchi (2023): Japan’s New National Security Strategy and Contribution to Networked Regional Security. Center for Strategic and International Studies, 2023. június 23. Online: https://www.csis.org/analysis/japans-new-national-security-strategy-and-contribution-networked-regional-security

Hit Rádió [@hitradiobudapest] (2024): Létrehozná az ázsiai NATO-t Japán? – Bartók András. YouTube, 2024. november 3. Online: https://www.youtube.com/watch?v=OMR1B1QNsI0

Japan Mulls Requiring Private Sector Operators to Report Cyberattacks on Infrastructure. The Japan Times, 2024. augusztus 4. Online: https://www.japantimes.co.jp/news/2024/08/04/japan/japan-cybersecurity-reporting/

Japán Digitális Ügynökség [é. n.]: Organisational Background of Estabilishment. Online: https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/ed91c288-7d40-4a9b-9d86-1007f256ada6/c83a6759/20240528_en_organization_outline.pdf

Japán Információbiztonsági Politikai Tanács (2013): Cybersecurity Strategy: Towards a World-Leading, Resilient and Vigorous Cyberspace. Online: http://www.nisc.go.jp/eng/pdf/cybersecuritystrategy-en.pdf

Japán Információbiztonsági Politikai Tanács (2014): The Basic Policy of Critical Information Infrastructure Protection (3rd Edition). Online: https://www.nisc.go.jp/eng/pdf/actionplan_ci_eng_v3.pdf

Japán Kiberbiztonsági Stratégiai Központ (2022): The Cybersecurity Policy for Critical Infrastructure Protection. Cybersecurity Strategic Headquarters. Online: https://www.nisc.go.jp/eng/pdf/cip_policy_2022_eng.pdf

Japán Külügyminisztérium (2013): Joint Statement Japan-U.S. Cyber Dialogue. 2013. május 10. Online: https://www.mofa.go.jp/region/page22e_000001.html

Japán Külügyminisztérium (2015): The Guidelines for Japan-U.S. Defense Cooperation. 2015. április 27. Online: http://www.mofa.go.jp/mofaj/files/000078188.pdf

Japán Külügyminisztérium (2024): The 9th Japan-US Cyber Dialogue. 2024. június 27. Online: https://www.mofa.go.jp/press/release/pressite_000001_00394.html

Japán Nemzeti Incidenskészenléti és Kiberbiztonsági Stratégiai Központja (2021): Japan’s Cybersecurity Strategy 2021 (Overview). Online: https://www.nisc.go.jp/pdf/policy/kihon-s/cs-senryaku2021-gaiyou-en.pdf

Japán Védelmi Minisztérium (2019): Defense of Japan 2019. Online: https://www.mod.go.jp/en/publ/w_paper/wp2019/pdf/DOJ2019_Full.pdf

Japán Védelmi Minisztérium (2022a): National Defense Strategy. 2022. december 16. Online: https://www.mod.go.jp/j/approach/agenda/guideline/strategy/pdf/strategy_en.pdf

Japán Védelmi Minisztérium (2022b): Defense Buildup Program. 2022. december 16. Online: https://www.mod.go.jp/j/policy/agenda/guideline/plan/pdf/program_en.pdf

Japan’s SDF Launches New Cyber-Defense Unit. Kyodo News, 2022. március 17. Online: https://english.kyodonews.net/news/2022/03/2009b0fac163-japans-sdf-launches-new-cyber-defense-unit.html?utm_source=chatgpt.com

JOHNSTONE, Christopher B. – KLAAS, Leah (2024): Combating Disinformation. An Agenda for U.S.-Japan Cooperation. Washington, DC: Center for Strategic and International Studies. Online: https://csis-website-prod.s3.amazonaws.com/s3fs-public/2024-07/240708_Johnstone_Combating_Disinformation.pdf

Joint Ministerial Statement of the ASEAN-Japan Ministerial Policy Meeting on Cybersecurity Cooperation. 2013. szeptember 13. Online: www.asean.org/wp-content/uploads/images/Statement/final_joint_statement%20asean-japan%20ministerial%20policy%20meeting.pdf

JPCERT/CC Incident Handling Report January 1, 2024 - March 31, 2024. 2024. április 18. Online: https://www.jpcert.or.jp/english/doc/IR_Report2023Q4_en.pdf

KALLENDER, Paul – HUGHES, Christopher W. (2016): Japan’s Emerging Trajectory as a ’Cyber Power’: From Securitization to Militarization of Cyberspace. Journal of Strategic Studies, 40(1–2), 118–145. Online: https://doi.org/10.1080/01402390.2016.1233493

Kaspersky Lab (2013): The ’Icefog’ APT: A Tale of Cloak and Three Daggers. Online: https://media.kaspersky.com/en/icefog-apt-threat.pdf.

KATAGIRI, Nori (2021): From Cyber Denial To Cyber Punishment: What Keeps Japanese Warriors from Active Defense Operations? Asian Security, 17(3), 331–348. Online: https://doi.org/10.1080/14799855.2021.1896495

KATAGIRI, Nori (2022): Assessing Japan’s Cybersecurity Policy: Change and Continuity From 2017 to 2020. Journal of Cyber Policy, 7(1), 38–54. Online: https://doi.org/10.1080/23738871.2022.2033805

KOO, Soo-Kyung (2013): Cyber Security in South Korea: The Threat Within. The Diplomat, 2013. augusztus 19. Online: https://thediplomat.com/2013/08/cyber-security-in-south-korea-the-threat-within/

KOSUKE, Takahashi (2024): Why Japan Is Lagging Behind in Cyber Defense Capabilities. The Diplomat, 2024. május 24. Online: https://thediplomat.com/2024/05/why-japan-is-lagging-behind-in-cyber-defense-capabilities/

LOTTAZ, Pascal (2023): Japan’s New Security Strategy, Part 2: The Ongoing Debates. The Diplomat, 2023. június 8. Online: https://thediplomat.com/2023/06/japans-new-security-strategy-part-2-the-ongoing-debates/

Malpedia [é. n. a]: APT41. Online: https://malpedia.caad.fkie.fraunhofer.de/actor/apt41

Malpedia [é. n. b]: MirrorFace. Online: https://malpedia.caad.fkie.fraunhofer.de/actor/mirrorface

MARTIN, Alexander (2023): Japan’s Cybersecurity Agency Breached by Suspected Chinese Hackers: Report. The Record, 2023. augusztus 29. Online: https://therecord.media/japan-cybersecurity-agency-breached-report

MATSUO, Miki (2024). Unaddressed Challenges for Defense Policy Reform in Japan. Center for Strategic and International Studies, 2024. május 9. Online: https://www.csis.org/analysis/unaddressed-challenges-defense-policy-reform-japan

MITRE [é. n.]: APT41. Online: https://attack.mitre.org/groups/G0096/

NAJAH, Redouan (2024): Japan’s NSS in the Age of Cyber Warfare: A Historical Transformation. Japan Up Close, 2024. július 8. Online: https://japanupclose.web-japan.org/policy/p20240708_1.html

NAKASHIMA, Ellen (2023): China Hacked Japan’s Sensitive Defense Networks, Officials Say. The Washington Post, 2023. augusztus 8. Online: https://www.washingtonpost.com/national-security/2023/08/07/china-japan-hack-pentagon/

NATO (2023): Individually Tailored Partnership Programme between NATO and Japan for 2023–2026. Online: https://www.nato.int/cps/en/natohq/official_texts_217797.htm.

NATO (2025): Emerging and Disruptive Technologies. Online: https://www.nato.int/cps/fr/natohq/topics_184303.htm?selectedLocale=en

Notice Regarding Results of Security Incident Investigation. Fujitsu, 2024. július 9. Online: https://www.fujitsu.com/global/about/resources/news/notices/2024/0709-01.html

ONODERA, Yoshifumi – TANAKA, Hiroyuki – SHIMAMURA, Naoto (é.n.): Cybersecurity 2024: Japan. In Chambers Global Practice Guides. Online: https://org-www.morihamada.com/en/insights/publications/2024-60

OSAWA, Jun (2024): Direction of Japan’s New Cybersecurity Policy. Asia-Pacific Review, 30(3), 63–78. Online: https://doi.org/10.1080/13439006.2023.2295707

PAGANINI, Pierluigi (2020): Mitsubishi Electric Corp. Was Hit by a New Cyberattack. Security Affairs, 2020. november 20. Online: https://securityaffairs.com/111201/hacking/mitsubishi-electric-cyberattack.html

PERNIK, Piret (2023): NATO-Japan Deepening Cooperation in Cybersecurity and Critical Technologies. Japan Up Close, 2023. március 24. Online: https://japanupclose.web-japan.org/policy/p20230324_2.html

SINHA, Sharat (2024): Japan Cyber Threat Landscape, Elevandi & Future Matters Center of Excellence, Online: https://www.elevandi.io/hubfs/custom-video-thumbnails/Japan%20Cyber%20Threat%20Landscape%20-%20Sharat%20Sinha%20-%20March%202024.pdf

SIRIPALA, Thisanka (2024): Japan’s Rush to Play Cyber Defense Catchup. The Diplomat, 2024. június 14. Online: https://thediplomat.com/2024/06/japans-rush-to-play-cyber-defense-catchup/

SMITH, Sheila A. (2024): How Japan is Viewing the North Korea-Russia Alliance. Council on Foreign Relations, 2024. június 27. Online: https://www.cfr.org/expert-brief/how-japan-viewing-north-korea-russia-alliance

SOESANTO, Stefan (2020): Japan’s National Cybersecurity and Defense Posture. Policy and Organizations. Zürich: Center for Security Studies (CSS), ETH Zürich. Online: https://doi.org/10.3929/ethz-b-000437790

Strategic Command (2024): Strategic Command Shares Cyber Expertise With Japan. Gov.uk, 2024. február 20. Online: https://www.gov.uk/government/news/strategic-command-shares-cyber-expertise-with-japan?utm_source=chatgpt.com

TELYCHKO, Veronika (2024): Kimsuky APT Campaign Detection Targeting Japanese Organizations. SOC Prime, 2024. július 10. Online: https://socprime.com/blog/kimsuky-apt-campaign-detection-targeting-japanese-organizations

TOMONAGA, Shusei (2024a): MirrorFace Attack against Japanese Organisations. JPCERT/CC Eyes, 2024. július 16. Online: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html

TOMONAGA, Shusei (2024b): Recent Cases of Watering Hole Attacks, Part 1. JPCERT/CC Eyes, 2024. december 19. Online: https://blogs.jpcert.or.jp/en/2024/12/watering_hole_attack_part1.html

VOO, Julia et al. (2020): National Cyber Power Index 2020. Methodology and Analytical Considerations. China Cyber Policy Initiative Reports. Cambridge: Harvard Kennedy School, Belfer Center for Science and International Affairs. Online: https://www.belfercenter.org/sites/default/files/2024-09/NCPI_2020.pdf

VOO, Julia – HEMANI, Irfan – CASSIDY, Daniel (2022): National Cyber Power Index 2022. Cambridge: Harvard Kennedy School, Belfer Center for Science and International Affairs. Online: https://www.belfercenter.org/publication/national-cyber-power-index-2022

Jogi források

Japán Alaptörvénye (The Constitution of Japan). 1946. május 3. Online: https://japan.kantei.go.jp/constitution_and_government_of_japan/constitution_e.html

- 2014. évi 104. Kiberbiztonsági kerettörvény (The Basic Act on Cybersecurity). Online: https://www.japaneselawtranslation.go.jp/en/laws/view/4618

- 2022 évi 70. törvény a japán távközlési vállalkozásokról szóló 1984. évi 86. törvény egyes rendelkezéseinek módosításáról (revised Telecommunications Business Act). Online: https://www.japaneselawtranslation.go.jp/en/laws/view/3648/en