Japan Considers Extending Cyber Defense Monitoring to Domestic Communications

Domestic communications become the next focus

Japan is considering expanding its active cyber defense laws to allow authorities to collect communications data from exchanges taking place entirely within the country, extending a framework that currently covers communications between foreign locations and between Japan and overseas.

Prime Minister Sanae Takaichi instructed ministers at a November 6 cybersecurity meeting to examine amendments that would strengthen the government's ability to gather information about cyberattacks. The ruling parties have recommended including domestic communications, and the government plans to take that proposal into account.

The proposal comes alongside an emergency cybersecurity package backed by 10 billion yen, about $63 million, from fiscal 2026 reserve funds. That package includes artificial intelligence to detect threats, specialist teams to respond to attacks and assistance for affected companies.

The central issue is the reach of government information gathering. An exchange between two locations in Japan falls outside the communications monitoring categories in the current active cyber defense framework. Changing that boundary would bring a new category of communications within its potential scope.

For businesses, the developing system also brings practical obligations. A rollout covering 258 critical infrastructure operators across 15 sectors requires information about important computer systems and reports of serious cyber incidents. Financial services, aviation, electricity, telecommunications, ports and credit cards are among the sectors involved.

Japan is therefore pursuing several changes at once: broader legal powers, stronger technical capabilities and closer cooperation with companies that run essential services. The proposed expansion to domestic communications remains under consideration, with no date given for submitting or passing an amendment.

What active cyber defense involves

Active cyber defense, often shortened to ACD, seeks to identify and disrupt cyberattacks before they cause serious damage. It goes beyond waiting for an organisation to discover a breach and then helping it recover.

Japan's framework includes gathering information about threats and, under legal conditions, allowing police or the Self Defense Forces to enter servers used by attackers and stop malicious programs. A server is a computer that provides services or data to other computers. Attackers can use one to send instructions to harmful software inside a victim's network.

Stopping such a program can interrupt an attack. Finding the relevant server, however, requires information about how the attack is operating and which systems are involved. That helps explain why the government is examining its intelligence gathering powers alongside its ability to take disruptive action.

The domestic communications proposal concerns where authorities may gather communications information. The server intervention provisions concern what authorities may do against infrastructure used for an attack. Both form part of active cyber defense, but they perform different jobs.

Why the domestic boundary matters

The existing framework distinguishes between communications linking foreign locations, communications linking Japan with another country, and communications taking place entirely within Japan. The first two categories are covered; the third is excluded from this monitoring framework.

Cyberattacks can involve several computers rather than a single direct connection between an attacker and a victim. A compromised machine can relay instructions or malicious traffic. For investigators, the location of the computers carrying that traffic affects which legal powers are available.

Extending the framework to domestic exchanges would widen the information authorities could potentially examine when tracing an attack through systems inside Japan. The practical reach would depend on the wording of the amendment and its operating rules, including the data covered, the conditions for access and the handling of collected information.

Domestic communications also involve people and companies using services within their own country. Rules governing selection, access, retention and oversight will therefore be central to understanding how an expanded system would work in everyday life.

An emergency package after business attacks

Takaichi's government approved its emergency measures at a meeting she chaired following a series of major personal data breaches. A ransomware attack targeting GMO Internet Group prompted her to order the package the preceding week.

Ransomware is malicious software used to hold data or computer systems hostage, usually alongside a demand for payment. An affected business may need to contain the intrusion, determine which systems are safe and restore services while investigating whether information has been taken.

The emergency package covers four areas: security improvements using artificial intelligence, stronger intelligence gathering, strategic responses to attacks and better support for victims. Part of the 10 billion yen allocation will strengthen police intelligence gathering capabilities.

The government also plans a team of cybersecurity specialists to counter attackers. A separate rescue team drawn from the public and private sectors will assist companies that have suffered attacks, while another unit will advise businesses facing potential threats.

Those teams address different moments in an incident. Advice can help a business act when a threat first appears; specialist intervention can support the response to an active attack; recovery assistance can help an affected company work through the consequences. Artificial intelligence will also be used to identify weaknesses in computer systems.

Infrastructure operators face new duties

The National Cybersecurity Office in the Cabinet Secretariat and the Cabinet Office published implementation materials on September 30 explaining the rollout of the cyber response legislation. Organisational arrangements and cooperation with critical infrastructure operators began on October 1.

The system covers 258 designated operators in 15 sectors. Their services connect cybersecurity to daily life: a disruption can affect payments, electricity, communications, transport or the movement of goods through ports.

Covered operators must notify the minister responsible for their sector about designated important computer systems, including product names. The implementation schedule sets March of the following year as the deadline for systems already in use. Newly introduced systems must be reported within four months.

The government plans to compare those inventories with information about vulnerabilities that have not yet been made public. A vulnerability is a weakness in software or equipment that an attacker could exploit. Knowing which operator uses an affected product allows officials to send a targeted warning to the company that needs it.

Serious incidents must reach the government

From October 1, covered operators must report serious cyber incidents affecting their designated important computer systems to both the minister responsible for their sector and the prime minister. Incidents include the execution of malicious software and unauthorised access.

The obligation gives the government a route to learn about serious attacks across essential services. Technical details from an incident can then be shared with other operators, with attention to the affected organisation's privacy, so they can strengthen their defenses against similar activity.

A planned information sharing council is expected to include about 100 organisations, mainly critical infrastructure operators. Its purpose is to connect government threat information with the companies responsible for protecting operational systems.

The government's approach combines two kinds of information: what products an operator uses and what threats are being detected. An inventory can identify who needs a warning, while incident information can explain what that operator should look for in its own systems.

How sensitive warnings will be shared

Government threat information may contain details that reveal an intelligence source or identify a particular company. Before distributing it to operators, officials plan to remove confidential details or anonymise identifying information, a process described as sanitisation.

A useful warning might retain the technical signs of an attack while removing details about how authorities obtained them. The aim is to get actionable information to businesses quickly while protecting sensitive material.

More sensitive information will be shared through arrangements involving classified information, individual companies or restricted circles known as Trusted Groups. These arrangements create different channels according to how widely information can be distributed.

For operators, the practical value lies in receiving a warning that is specific enough to act on. Product names, technical indicators and knowledge of a company's systems can help turn a general alert into a focused check or repair.

A rollout with several separate milestones

Japan's legal changes, organisational preparations and technical operations follow different schedules. Parts of the legislation took effect in October, while the implementation timetable places operational use of communications information in the autumn of the following year or later.

The main milestones described in the government rollout and subsequent announcements are:

• September 30: The National Cybersecurity Office and the Cabinet Office published implementation materials.
• October 1: Organisational arrangements and cooperation with designated infrastructure operators began, including serious incident reporting obligations.
• November 6: Takaichi instructed ministers to examine amendments strengthening information gathering for active cyber defense.
• March of the following year: Existing designated computer systems must be reported under the implementation schedule.
• Within four months of introduction: Operators must report newly introduced designated systems.
• Autumn of the following year or later: Operational use of communications information is scheduled to begin.

The phased approach means companies face reporting and preparation requirements before every element of communications information gathering is operational. The proposed inclusion of domestic communications would require a further legal change alongside that rollout.

The Bottom Line

• Japan is considering adding entirely domestic communications to its active cyber defense information gathering framework.
• Takaichi ordered examination of legal amendments at a November 6 ministerial meeting, following a ruling party recommendation.
• An emergency package allocates 10 billion yen from fiscal 2026 reserve funds for cybersecurity measures, including stronger police intelligence capabilities.
• Specialist response teams, business rescue support and artificial intelligence are part of the package.
• The infrastructure rollout covers 258 operators across 15 sectors, with system inventories and serious incident reporting duties.
• Communications information operations follow a later timetable than the initial organisational and reporting measures.