Japan approves preemptive cyberdefence law
The new legislation permits government monitoring of international IP traffic without accessing message content, aiming to prevent major disruptions from cyber threats.
Japan’s parliament has passed a new law enabling active cyberdefence measures, allowing authorities to legally monitor communications data during peacetime and neutralise foreign servers if cyberattacks occur.
Instead of reacting only after incidents, this law lets the government take preventive steps to counter threats before they escalate.
Operators of vital infrastructure, such as electricity and railway companies, must now report cyber breaches directly to the government. The shift follows recent cyber incidents targeting banks and an airline, prompting Japan to put a full framework in place by 2027.
Although the law permits monitoring of IP addresses in communications crossing Japanese borders, it explicitly bans surveillance of domestic messages and their contents.
A new independent panel will authorise all monitoring and response actions beforehand, instead of leaving decisions solely to security agencies.
Police will handle initial countermeasures, while the Self-Defense Forces will act only when attacks are highly complex or planned. The law, revised to address opposition concerns, includes safeguards to ensure personal rights are protected and that government surveillance remains accountable.
Japan’s move follows a series of high-profile cyber incidents, including attacks on banks, airlines, and even the nation’s own cybersecurity agency. The law is designed to bring Japan’s cyber defense capabilities in line with those of the United States and major European countries, shifting from a reactive to a proactive posture. This is a notable policy change for Japan, which has traditionally maintained a defensive stance in line with its pacifist constitution
