Japan Active Cyber Defense Law (Cyber Response Capability Enhancement Act, Law No. 42 of 2025)

Mechanism

The Cyber Response Capability Enhancement Act and its companion arrangement law operate as a paired statute. The substantive Act creates three new legal authorities that, taken together, mark Japan's first departure from the constitutional "defensive-only" cyber posture that has constrained SDF and NPA cyber operations since the post-war settlement:

1. Communications-information utilisation. Designated communication carriers operating cross-border or transit infrastructure landing in Japan (submarine cables, peering points, large IXPs, hyperscaler regional fabric) must accept monitoring of foreign-origin traffic metadata under warrants issued by a newly statutory independent oversight body. The statute is engineered to align with Article 21 communications-secrecy guarantees by ringfencing inspection to foreign-foreign and foreign-Japan traffic with national-security relevance.

2. Access and neutralisation measures (access-and-disable). Authorises the National Police Agency and the Self-Defense Forces, under unified Cabinet command, to access attacker command-and-control infrastructure located abroad and take pre-emptive disruptive action against imminent serious cyber attacks on Japanese critical infrastructure or the state — the first explicit offensive-cyber legal basis in Japanese domestic law.

3. Critical-infrastructure obligations. Operators in designated sectors face new mandatory incident-reporting timelines, government cooperation duties (including provision of network telemetry on request), and a coordinated response role through the National Cybersecurity Office.

Institutional implementation runs in parallel: the NISC was reorganised in July 2025 into the National Cybersecurity Office (NCO) headed by a new National Cyber Director (vice-ministerial rank, "Cabinet Cybersecurity Officer") within the Cabinet Secretariat. Phased entry into force runs through November 2027, with the access-and-disable authority among the latest provisions to be operationalised pending subordinate Cabinet Orders and the establishment of the oversight body.

Downstream implications

• First JP cyber-statute filing in register. All 14 prior Japan

entries are METI / semiconductor / industrial-policy instruments — this is the first cybersecurity-class action and the first to touch the Cabinet Secretariat / NISC / NCO institutional axis.

• Allied-supply-chain read-through. The ACD Law operationalises the

cyber leg of the US-Japan-Korea trilateral cybersecurity framework (Camp David 2023) and IPEF Pillar IV; expect tighter cyber-incident information-sharing flows with CISA and Korea's KISA, and joint attribution coordination on PRC and DPRK state-aligned actors.

• Cloud / submarine-cable / transit providers. Hyperscalers and

carriers operating Japan-landing infrastructure (NTT, KDDI, SoftBank, Equinix, AWS, GCP, Azure regional fabric) face new monitoring-access duties; expect commercial-contract carve-outs and re-routing optionality to be repriced for Japan-transit traffic vs. Singapore / Hong Kong alternatives.

• Pairs with EU / DE / AU cyber-statute wave. Sits in the same

2024-25 cyber-regulation cluster as the EU Cyber Resilience Act (Regulation 2024/2847), EU Cyber Solidarity Act (Regulation 2025/38), Germany's NIS2UmsuCG, and Australia's Cyber Security Act 2024 — forming a coordinated G7 allied cyber-regulation architecture.

• OT / IoT vendor compliance load. Critical-infrastructure

reporting and cooperation duties extend to ICS / OT vendors and managed-security service providers serving Japanese critical-infrastructure operators; expect a downstream wave of Cabinet Order rulemaking through 2026-27.

Open questions

• Final scope of "designated communication infrastructure" and the

warrant-issuance procedure for the new oversight body — subordinate Cabinet Orders are still pending.

• Operational doctrine for cross-border access-and-disable: will Japan

require host-government consent for attacker-infrastructure neutralisation, or will it adopt a US-Cyber-Command-style defend-forward unilateral posture?

• Coordination architecture with US Cyber Command, USCG, and Korean

Cyber Operations Command under the trilateral framework — expect follow-on bilateral or trilateral MOUs operationalising joint attribution and joint-disruption protocols.

• Interaction with Japan's existing Telecommunications Business Act

Article 21 communications-secrecy regime — the statute's constitutional resilience will likely face Supreme Court review.