Japan Weighs Website Blocking After GMO Data Leak, Raising Communications Privacy Concerns

A data leak brings an exceptional measure into focus

Japan plans to consider website blocking in an emergency cybersecurity package after attackers published personal information stolen in a cyberattack involving GMO Internet. On October 27, the Ministry of Internal Affairs and Communications asked domestic telecommunications providers to prevent access to the site carrying the information, citing a realistic risk of further harm.

The request went to major telecommunications operators through an industry association. It sought a measure that would require providers to check where users were connecting and refuse connections to the targeted website. That approach brings two forms of privacy into the same dispute: protecting people whose information has been stolen and protecting internet users from scrutiny of their communications.

The website subsequently became inaccessible after its domain was suspended. A provider in the United States was believed to have taken that action. Blocking by Japanese telecommunications companies apparently was not carried out.

The government now intends to examine the legal issues surrounding blocking and other ways to prevent stolen information from being misused. No timetable for completing that examination or adopting the emergency package has been given.

What happened after the information appeared?

The incident involved services related to foreign exchange margin trading, commonly called FX, within the GMO Internet Group. These services allow customers to trade currencies using money deposited as security. The immediate concern in the blocking debate is the publication of personal information obtained through unauthorized access.

The sequence places the government request between the release of the information and the website becoming unavailable:

• Before October 27: Unauthorized access affected GMO Internet Group services related to foreign exchange margin trading.
• October 27: Attackers posted personal information obtained in the incident, and the communications ministry asked domestic providers to block access to the site.
• After the publication: The site's domain was suspended, making it inaccessible. A provider in the United States was believed to have intervened.
• Following the incident: The government planned to include consideration of blocking in an emergency cybersecurity package.

The distinction between a request and an implemented restriction matters for understanding what happened. Providers were asked to prepare a barrier to access, while action affecting the site's domain appears to have removed the immediate need for that barrier.

Why the government wanted access stopped

Personal information can continue to harm its owners after the original intrusion has ended. Once published, it can be copied and passed to other people. Depending on what the information contains, criminals may use it to make fraudulent messages more convincing or to target individuals for further abuse.

The communications ministry's stated concern was a realistic risk of secondary harm. In plain terms, that means damage caused by the use or spread of stolen information after the theft itself. Stopping people from reaching the publication site could reduce opportunities to obtain the data while other action is taken.

Chief Cabinet Secretary Kihara addressed the privacy harm caused by making personal information public online. He said:

It should not be permissible for personal information to be published online and privacy rights to be infringed.

His statement explains the government's reason for seeking intervention. People whose information has been exposed cannot retrieve every copy themselves, and each additional download can make containment harder. The practical pressure on authorities is therefore to act quickly enough to limit further circulation.

How blocking reaches other internet users

Website blocking places the restriction at the telecommunications provider, rather than removing the information from the website itself. A provider identifies a connection intended for the targeted destination and prevents it from going through. The user does not have to agree to that restriction.

To identify which connections to stop, providers must check users' communication destinations. That is why the proposal concerns people beyond the customers affected by the GMO incident. The operation involves examining connections across a provider's users to find those heading to the selected site.

Japan's Constitution and other laws protect the secrecy of communications. This protection covers the confidentiality of communications, including information about their destinations. A destination can itself reveal something private, even when the contents of a message are not being examined.

The policy choice therefore involves protecting different people through measures that pull in different directions. Authorities want to restrict access to stolen information, while telecommunications providers must consider their obligations to preserve the secrecy of users' communications. The proposed legal examination will have to address both responsibilities.

Why earlier proposals were treated cautiously

Japan has exceptionally accepted blocking for websites carrying child sexual abuse material, described in the debate as child pornography sites. The justification has been the severe and lasting harm to children when such material continues to circulate, alongside the need to limit interference with communications secrecy.

Proposals to use blocking against piracy websites and online casinos were also considered, but their introduction was shelved. Those precedents help explain the sensitivity of using the same measure in response to a theft of personal information.

The GMO incident would bring blocking into a different setting: an urgent attempt to contain damage after a cyberattack. The government is considering how a measure previously accepted only in exceptional circumstances might fit into its response to serious information leaks.

Criticism of the request has focused on whether the danger was sufficiently immediate and whether other ways of stopping publication had been exhausted. Calls for clear legal rules reflect a practical concern: providers need to know when they may restrict access, what conditions apply and how the decision can be reviewed.

The request also faces a transparency problem

The government made the request without prior discussion within government or in the Diet, Japan's national legislature. The communications ministry has also not publicly acknowledged making it, despite the account of the October 27 approach to providers.

That lack of acknowledgment leaves the public with an incomplete explanation of the decision. The legal basis for the request, the reasoning behind its urgency and the conditions attached to it are central to assessing whether the action was justified.

The concern is particularly sharp because the proposed restriction would have been carried out by private telecommunications companies. Those companies would have had to act on a government request while taking account of legal protections for their users.

Some have regarded the request as an appropriate response to an immediate privacy threat. Critics have described it as rushed and called for a public explanation before blocking becomes a more regular part of cybersecurity policy. The dispute is about both the need to protect victims and the process used to authorize restrictions.

What the domain suspension changes

The suspension of the suspected attackers' domain made the website inaccessible through its usual address. A domain is the name used to reach a website. Suspending it disrupts that route, while blocking by Japanese telecommunications providers would restrict connections made through their networks.

In this case, action affecting the domain appears to have resolved the immediate access problem before domestic blocking was implemented. The website was later described as deleted, although the specific account of how access stopped points to the domain suspension and a suspected intervention by a provider in the United States.

The episode makes the relationship between blocking and other countermeasures central to the government's review. Authorities will need to consider how quickly each option can work, which organizations can take action and when a restriction imposed through domestic providers is warranted.

The emergency package is still at the consideration stage for blocking. Its central task is to turn an urgent response into rules that people can understand: when intervention is justified, who authorizes it and how communications privacy is protected while authorities try to contain a damaging leak.

Key Points

• Japan plans to examine website blocking as part of an emergency cybersecurity package following the GMO Internet incident.
• The communications ministry requested blocking on October 27, when attackers published stolen personal information.
• The request reached major domestic telecommunications providers through an industry association.
• The targeted site's domain was later suspended, and domestic blocking apparently was not implemented.
• Blocking requires providers to check communication destinations, raising concerns under Japan's protections for communications secrecy.
• The ministry has not publicly acknowledged the request, and no timetable has been given for the legal review.