Japan’s parliament has passed a new law enabling active cyberdefence measures, allowing authorities to legally monitor communications data during peacetime and neutralise foreign servers if cyberattacks occur.
Instead of reacting only after incidents, this law lets the government take preventive steps to counter threats before they escalate.
Operators of vital infrastructure, such as electricity and railway companies, must now report cyber breaches directly to the government. The shift follows recent cyber incidents targeting banks and an airline, prompting Japan to put a full framework in place by 2027.
Although the law permits monitoring of IP addresses in communications crossing Japanese borders, it explicitly bans surveillance of domestic messages and their contents.
A new independent panel will authorise all monitoring and response actions beforehand, instead of leaving decisions solely to security agencies.
Police will handle initial countermeasures, while the Self-Defense Forces will act only when attacks are highly complex or planned. The law, revised to address opposition concerns, includes safeguards to ensure personal rights are protected and that government surveillance remains accountable.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
