Photo/Illutration Prime Minister Shigeru Ishiba, second from front right, addresses a meeting of experts on improving response capabilities in cyber security at the prime minister’s office on Nov. 29. (Takeshi Iwashita)

The need to prevent cyberattacks against critical infrastructure is undeniable. However, collecting and analyzing communication data for this purpose raises legitimate concerns about potential privacy violations. To implement a robust cyber defense system, it is crucial to foster broad public understanding and ensure the system is meticulously designed to prevent any undue infringement of rights.

A government panel of experts has compiled recommendations for legislation to implement “active cyber defense.” Even the “secrecy of any means of communication” guaranteed by Article 21 of the Constitution can be legally restricted for the “public welfare” to prevent cyberattacks that can disrupt the fundamental systems and assets that society and the economy rely on to function.

This imperative, the panel argues, should authorize the use of extensive communication data even in normal times.

Prime Minister Shigeru Ishiba asserted that “improving our cyber response capabilities is an increasingly urgent issue,” and directed ministers to compile related bills as soon as possible, with plans to submit them to the regular session of the Diet to be convened early next year.

The recommendations specify that surveillance for cyber defense should focus on communications involving foreign entities--either originating abroad, passing through Japan or destined for foreign countries. This policy is based on the view that domestic communications between individuals and businesses within Japan should be excluded. This surveillance would primarily target metadata, such as IP addresses and transmission times, rather than the content of the communications themselves. Accessing the content of emails, for example, is deemed inappropriate by the panel.

To prevent arbitrary government operation and misuse of collected data, the legislation itself should explicitly and specifically define the scope and targets of surveillance. Relying on ministerial ordinances or guidelines for such crucial determinations should be deemed inappropriate.

The recommendations assert that granting the government the authority to access and neutralize servers used by potential cyber attackers is “indispensable” for preventing or mitigating damage. This authority, they argue, is crucial to proactively disrupt threats before they can impact critical infrastructure.

While the police will be the primary actors in active cyber defense operations, the Self-Defense Forces could be called upon to act in certain circumstances, according to the panel. However, the recommendations leave many crucial details unresolved, including how roles and responsibilities will be divided between the two organizations, who will have the authority to initiate and command operations and what procedures will govern such actions.

To ensure oversight of these new powers, the panel has proposed establishing an independent third-party organization to monitor government activities related to active cyber defense. However, the specific roles, responsibilities and authority of this oversight body remain to be defined. It is crucial that this entity be truly independent and empowered to effectively curb any potential abuse of power.

While the recommendations outline basic principles, the task of fleshing out specifics for the new system is left to the government. The main opposition parties generally support the policy initiative. The Democratic Party for the People is calling for swift legislation to enable the government to engage in active cyber defense, and the Constitutional Democratic Party of Japan also recognizes the necessity of such legislation. Nippon Ishin (Japan Innovation Party) also advocates strengthening cyber defense.

With the Ishiba administration backed by a minority ruling coalition, the passage of this legislation depends on the cooperation of the opposition. This means opposition parties also bear the responsibility to ensure the legislation protects citizens’ rights and erases public anxiety about the envisioned cyber defense system.

--The Asahi Shimbun, Dec. 3

Related News