According to the National Security Strategy (NSS) announced by the Shinzo Abe administration in December 2013, it was noted that the security environment surrounding Japan was becoming even more severe, and “cyber-attacks” were recognized as one of the new threats to the peace and security of Japan. The NSS reported that risks of cyber-attacks to fundamental infrastructure and defense systems had become serious issues, and enhancement of cybersecurity and protection of cyberspace were raised as one of the most significant security priorities. However, a question remains over whether Japan can exercise its right to self-defense in the event of cyberattacks under its current Constitution.
Japan’s Right to Self-Defense Against Cyber-Attacks
Based on this recognition, the Japanese government enacted the Basic Act on Cybersecurity on November 6, 2014. The law clarifies Japan’s cybersecurity policy and responsibilities of the national and local governments as well as individuals. In accordance with the law, the Cybersecurity Strategic Headquarters (CSH) was established with a view to effectively and comprehensively improving Japan’s cybersecurity strategy. Moreover, the National Information Security Center was upgraded as the National center of Incident readiness and Strategy for Cybersecurity (NISC) under the CSH in 2015.
On May 16, 2019, Prime Minister Shinzo Abe stated in the Plenary Session of the House of Representatives that “Under the Constitution, Japan will be allowed to exercise force for self-defense” when cyberattacks that can constitute armed attacks on Japan occur. Regarding the definition of armed attacks, the prime minister explained that they are “cases in which extremely serious damage on par with that caused by attacks by physical means arises, and the attacks are made by the other party in a systematic and premeditated manner”. As for the conditions for exercising Japan’s right to self-defense against cyberattacks, Abe mentioned that “It should be judged on a case-by-case basis based on factors such as international circumstances, the other party’s explicit intention, the means employed in the attacks, and responses to them”.
Under the current Constitution, the threat or use of force as a means of settling international disputes is restricted by Article 9. Still, the Japanese government has explained that Japan possesses the right to self-defense, and the right to exercise individual and collective self-defense is constitutional on the basis of the Peace and Security Legislation. The three conditions for use of force as measures of self-defense under the legislation are: (1) When an armed attack against Japan occurs or when an armed attack against a foreign country that is in a close relationship with Japan occurs and as a result threatens Japan’s survival and poses a clear danger to fundamentally overturn people’s right to life, liberty and pursuit of happiness, (2) When there is no other appropriate means available to repel the attack and ensure Japan’s survival and protects its people, (3) Use of force limited to the minimum extent necessary.
Japan’s Use of Force in Cyberspace Under International Law
The use of force as measures of self-defense against cyberattacks can be justifiable in the light of international law, especially the law concerning the use of force (jus ad bellum) and the laws of armed conflict (jus in bello). With regard to jus ad bellum, Article 2 (Paragraph 4) of the Charter of the United Nations illegalizes the use of force in international conflict resolution in general, but exercise of the right of individual and collective self-defense until the United Nations Security Council takes appropriate measures can be regarded as legitimate as stipulated in Article 51. In exercising the right of self-defense, the use of force needs to satisfy some criteria for justification, such as “necessity” and “proportionality” as with the case of the judgement by the International Court of Justice (ICJ) on the conflict between Nicaragua and the United States in 1986.
It would seem that Japan’s three conditions for the use of force formulated in the Peace and Security Legislation can be consistent with these criteria. Likewise, the use of force as measures of self-defense against cyber-attacks would need to satisfy the so-called “Webster formula” or the “Caroline test” as a legal principle that requires “a necessity of self-defense, instant, overwhelming, leaving no choice of means and no moment for deliberation.” In addition to jus ad bellum, the use of force as measures for self-defense against cyber-attacks should adhere to jus in bello in cyberwarfare as examined in the so-called Tallinn Manual.
Japan’s right to exercise individual and collective self-defense can be justifiable in the light of the Japanese Constitution and international law. On the basis of the domestic and international legal frameworks, the Japanese government has attempted to increase its defense expenditure for the development of cybersecurity equipment and personnel. In the 2020 fiscal year, the Japanese Ministry of Defense plans to invest some 25.6 billion yen (237.12 million dollars) for the development of cybersecurity, including development of application of artificial intelligence (AI) to the cybersecurity defense system. The defense budget for the AI-powered anti-cyber-attack system that can automatically detect harmful emails and judge the level of cyber-attack threats was estimated to some 30 million yen (277,711 dollars). Moreover, the Japanese Defense Ministry intends to expand its Cyber Defense Group from 220 to 290 staff members and acquire Cyber Information Gathering System for 3.4 billion yen (31.5 million dollars).
Furthermore, Japan has sought to expand its cybersecurity cooperation with the United States and its partner states. The Defense Ministry seeks to secure and develop a cyber workforce by dispatching the Self-Defense Forces member staff to U.S. Cyber Commander Education Courses. In response to the threat of Chinese cyber-attacks, Japan and the European Union have deepened their cybersecurity cooperation by launching the “Japan-EU Cyber Dialogue”. Japan has also facilitated bilateral cybersecurity collaboration with Israel in order to combat cyber terrorism. Thus, Japan’s cybersecurity strategy has been evolving and its cybersecurity networks have been globalized overtime. Given the nature of cybersecurity in modern military operations and tactics, it can be considered that Japan would exercise its right to individual or collective self-defense in response to an external or foreign cyber-attack that could be judged as an armed attack against Japan or a foreign country that is in a close relationship with Japan.