II Cyber Warfare & Critical Infrastructure
Active cyber defence
Japan's 2025 legal framework that lets police and the Self-Defense Forces remotely access a server used in an attack threatening serious harm and disable the malicious software on it.
How it works
Known in Japanese as 能動的サイバー防御, the framework rests on 2 statutes: the Act on Strengthening Cyber Response Capabilities, Act No. 42 of 2025, and its companion Act No. 43, which amends related laws. The cabinet submitted the bills on 7 February 2025, the Diet passed them on 16 May 2025 and they were promulgated on 23 May 2025. The government's own briefing sets the goal of matching or exceeding the cyber capabilities of leading Western states.
The framework has 3 pillars. The first is public-private cooperation: critical infrastructure operators must register key systems and report cyber incidents to the government, and an operator that ignores a correction order faces a fine of up to 2 million yen. The second is the use of communications data: the government screens foreign-linked traffic automatically for non-content data such as IP addresses to locate attack servers. That screening requires approval from an independent Cyber Communications Information Oversight Commission made up of a chair and 4 members.
The third pillar is access and neutralisation. Officers designated by the head of the National Police Agency may access an attack server and stop or delete malicious programs when an attack risks serious harm to life, health or property and the situation is urgent. If the server is abroad, only the National Police Agency may act, and it must first consult the foreign minister. When a highly organised attack from abroad hits government bodies, critical infrastructure or the defence industry, the prime minister may order the Self-Defense Forces to act jointly with police. In both cases the commission must approve in advance, or be notified immediately afterwards if there is no time.
The rules are phased in. Provisions on public-private cooperation and on access and neutralisation took effect on 1 October 2026. Provisions on the use of communications data must take effect within 2 years and 6 months of promulgation. According to the government briefing, 99.4% of attack-related traffic observed by the National Police Agency in 2024 came from overseas IP addresses, which is the case for letting the law reach servers beyond Japan's borders.
Why it matters here
The framework moves Japan's line of defence from the edge of its own networks to the attacker's server. The open question is whether the power will be used in private-sector cases. On 24 October 2026 GMO Internet asked the government to apply it for the first time to an attack that may have hit 26,739 servers, just 23 days after the provisions took effect. Because the legal threshold includes a risk of serious harm to property, the threat to manipulate orders at more than 70 brokerages brings the case close to that line. Tokyo's response will be the first precedent showing whether financial infrastructure falls within the law in practice.