Japan authorizes military and police to launch cyber counterattacks starting October

From October, Japan’s new Cyber Defense Law permits its Self-Defense Forces and police to neutralize large-scale cyber attacks at their source, focusing on threats from state actors such as China, Russia and North Korea.

Japan will activate a Cyber Defense Law in October that empowers its Self-Defense Forces and police to launch offensive cyber actions against the origins of large-scale attacks, a move driven by Prime Minister Sanae Takaichi’s hard-line security agenda. Jun Osawa of the Sasakawa Peace Foundation notes that the law authorises counter-attacks even absent a declared war, addressing a gap where cyber incursions fall below the threshold of conventional conflict.

The statute targets state-sponsored actors from China, Russia and North Korea, whose groups such as Salt Typhoon, Volt Typhoon, Flax Typhoon, Russian General Staff units and Lazarus have been listed in the latest Defence White Paper. Recent ransomware strikes on Nagoya Port, Asahi Holdings and a supply-chain breach at Kojima Industries underscore the urgency, while advances in frontier AI enable fully automated attack chains.

The opposition’s Constitutional Democratic Party supported the bill, reflecting a rare political consensus, but civil-rights groups and the liberal Tokyo Shimbun have raised concerns about potential overreach and surveillance. Experts like Mihoko Matsubara of NTT argue that the law leaves small and medium-sized enterprises vulnerable, even as Japan enjoys a comparatively low ransomware infection rate among developed economies.