During a press briefing on Tuesday, Chief Cabinet Secretary Minoru Kihara said that the time was right to allow offensive cyber operations as the country faced its “most complicated national security environment” since the Second World War.

Japan’s post war constitution has limited the country's participation in wars. However, as the geopolitical landscape has changed since 1946, the law has been re-interpreted over the decades to allow it to carry out defensive military manoeuvres.

Japan’s shift towards offensive cyber defense is a further change in this position. Speaking in English, Kihara told the press at the briefing that sophisticated cyber attacks were having a “huge impact on safety and people’s daily life.”

“The government has decided to use active cyber defence to disable attackers and make this measure available on October 1st,” Kihara said.

“In the post war period, Japan is facing the most complicated national security environment, and society as a whole is proceeding with digitalization.

Given the threat – cyberattacks are having a huge impact on people’s lives – this is quite an important threat for national security,” he added.

Japan’s “hack back” laws: privacy concerns

The new laws now allow authorities to preemptively identify and neutralize hostile infrastructure, mandate incident reporting by critical infrastructure operators, and enable coordination between the NPA, the intelligence agencies, and Japan’s military, which is called Self-Defense Forces (SDF).

Kihara added that in the event of a cyberattack, the new laws would enable the SDF and cyber officers to access attackers' servers and disable them.

Addressing privacy concerns, Kihara claimed that the government would take a measured, responsible approach to “active cyber defence,” which many have essentially interpreted as “hacking back.”

“There are some specific requirements and procedures so we can collect information about harmful cyberattacks and sources,” he said.

“The cyber management committee will carry out an examination when active cyber defence is carried out. We pay due respect to privacy, and we are going to carry out legal measures.”

Japan’s "Active Cyber Defense" law was passed in 2025 and is rolling out in incremental stages through 2027.

“We will no longer be sitting ducks”

Last month, one of the key architects of the new powers, former government security adviser Shigeru Kitamura, told Cybernews that the laws represent an effort to catch up with other nations and enable Japan to act more as an equal intelligence partner.

​​“We will no longer be sitting ducks. We now have the capability to disrupt and turn off the infrastructure of those who seek to harm us,” he said.

“Until now, even if we identified a server preparing to launch a devastating virus against critical infrastructure such as banks and power plants, our authorities have been legally powerless to prevent it. We were forced to watch the arrows flying towards us. This ends now,” he added.

Momentum for the new laws has only hardened following last year's attack on the nation’s leading beer manufacturer, Ashai, whose operations were temporarily suspended following a breach that is thought to have been carried out by Russian-linked Qilin.

But global events have also sharpened the urgency: rising tensions around Taiwan and China’s growing assertiveness in the South China Sea pose a significant threat to Japan's trade and security.

The conversation on this topic is live. Join in the discussion.

The International Institute for Strategic Studies believes at least 26 nations can attack online,

In 2023, it conducted a study ranking nations into three tiers of cyber power. Only the US was considered a premium “tier one” world leader in this area.

Tier two countries, which are considered to have world-leading strengths in some of the categories, include France, Israel, and the United Kingdom. Russia and China also fall in this category and receive a special mention for their “rapidly evolving capabilities.”

Japan currently falls into tier three, which classifies countries as having strengths in some areas but “significant weaknesses” in others. Other countries mentioned in this tier include Iran, India, North Korea, Singapore, and the UAE.

Unlock more exclusive Cybernews content on YouTube.