Münchener Post - Japan Unveils Emergency Cybersecurity Package Following GMO Internet Attack

The Japanese government has approved an emergency countermeasure package designed to strengthen national cybersecurity defenses, following a series of high-profile unauthorized access incidents that compromised major corporate systems. Prime Minister Sanae Takaichi announced the new measures during a Cabinet meeting on November 6, directing officials to implement robust security protocols and expand the state’s capacity for Active Cyber Defense (ACD).

The emergency package, which was compiled in approximately one week following Takaichi’s instructions, addresses what officials describe as fundamental flaws in existing basic security measures. The government identified unaddressed system vulnerabilities as the primary cause of recent information leaks and unauthorized access incidents. To combat these threats, the new framework is built around four main pillars: ensuring the thorough implementation of basic cyberdefense measures through artificial intelligence; strengthening information gathering, sharing, investigative, and analytical capabilities; strategically responding to cyberattacks; and enhancing support for victims to prevent further damage.

A significant component of the package involves the expansion of Japan’s Active Cyber Defense capabilities. ACD allows police and the Self-Defense Forces to infiltrate computers used by attackers to disable their ability to carry out cyberattacks. Although a related law authorizing such "neutralization measures" took effect in October, it was not originally designed to respond to requests from private companies. The recent attacks have forced government officials to determine how to handle such situations and integrate them into the existing legal framework.

The decision to roll out this package was influenced heavily by an unauthorized access attack against GMO Internet Group Inc., one of Japan’s largest internet infrastructure providers. Masatoshi Kumagai, the group’s chief executive officer, publicly requested the institute of ACD on X (formerly Twitter) on October 24. This request highlighted a gap in the government’s ability to respond to private sector crises, prompting officials to scramble for solutions.

During the Cabinet meeting, Takaichi emphasized the need to expand intelligence-gathering capabilities and instructed officials to revise relevant legislation. She stated, "We will further strengthen our intelligence-gathering capabilities," while considering the expansion of information collection in cyberspace during peacetime as part of ACD efforts. At a previous ministerial meeting on October 26, Takaichi had already signaled a shift in strategy, stating, "We will strategically select and implement every available response option, including the neutralization measures." A government official described this pledge as a deterrent to attackers.

The ruling Liberal Democratic Party also contributed to the urgency of the situation by submitting a proposal to Takaichi on October 23 titled "On the eve of a cyber emergency." The political pressure was compounded by comparisons from Masaaki Taira, the former minister in charge of cybersecurity, who likened the spread of cyber infections to the early stages of the COVID-19 pandemic. Taira compared the situation to the Diamond Princess cruise ship quarantined in Yokohama Port in early 2020, noting that "infections are spreading" rapidly.

The government has allocated 10 billion yen ($63 million) from this fiscal year’s reserve funds to support these cybersecurity measures. Officials believe it is highly likely that artificial intelligence has been used in the recent cyberattacks and warn that damage could intensify as AI systems become more advanced. The primary concern is the potential for attacks on critical infrastructure, which could disrupt social and economic activities.

The package also includes a proposal to examine access-restriction measures by telecommunications carriers. This would potentially allow carriers to block access to websites where personal information has been posted online. However, because such measures could infringe on citizens’ rights, they are expected to be considered cautiously.

Despite the comprehensive nature of the new package, officials close to Takaichi acknowledged its limitations. They noted that the measures are not designed to produce immediate results and that "what can be done is limited." The government continues to monitor the situation closely as it works to prevent further unauthorized access incidents and protect critical systems from evolving threats.

A.Schneider--MP