Prevailing Japanese interpretations of its pacifist constitution and cyberspace exist in an existential clash. They are incompatible, given current Japanese interpretations of its Article Nine:

“Aspiring sincerely to an international peace based on justice and order, the Japanese people forever renounce war as a sovereign right of the nation and the threat or use of force as means of settling international disputes. In order to accomplish the aim of the preceding paragraph, land, sea, and air forces, as well as other war potential, will never be maintained. The right of belligerency of the state will not be recognized.”

In 1959, the Japanese Supreme Court ruled that Japan has the right to self-defense and upheld the constitutionality of the U.S.-Japan Security Treaty. While Article 9 of the Japanese Constitution renounces war, the court's interpretation allowed for the establishment of the Self-Defense Forces. Self-defense is one of the definitions and prerequisites to sovereignty. No state can renounce its right to defend itself.

The Constitutional article, most likely drafted and proposed by the Supreme Commander of Allied Forces, Japan, Gen Douglas MacArthur and his staff, was meant as a check on Japanese militarism and to ban adventurism. The first sentence of the article bans ‘war’ as a right. But there is no international right to war – only self-defense. The second sentence is certainly harder to reconcile with a state’s right to defend itself. That is why Japan maintains ‘self-defense’ forces and not an army or navy. But such word play is sophistry. Japan either has the right to defend itself or it doesn’t (it doesn’t matter what the armed forces are called).

Since the 1950s, Japanese self-defense forces have existed to defend Japan. Such forces seem to enjoy widespread support in Japan by all the major parties, short of the communist party. In short, Japan has chosen to be a sovereign state since the 1950s – until the age of the internet. Japan is not a sovereign state if it doesn’t develop the means to defend itself – including in cyberspace. Yet Japan today is a technologically advanced, mature, peaceful liberal democracy operating with the digital defenses of a barely sovereign power.

The realities of cyberspace include the following:

1. Cyber effects are immediate: once a button is pushed in, say Beijing, the effect occurs instantaneously in Tokyo. There is no international waters or airspace in which Japan can intercept malicious code, bound to commit cyberspace attack inside Japan.
2. Defenses must be pre-planned; there is no time in cyberspace to develop consensus or conduct judicial review and then order defenses to protect against an attack.
3. Preemption involves, inescapably, the violation of the sovereignty of the malicious cyber state about to attack. No state can avoid violating the sovereignty of another state in cyberspace if a state conducts cyberspace attack preemption (a state can’t defeat an incoming cyberspace attack at its ‘shores’).
4. Preemption is legal under international law under certain circumstances – a recognized form of self-defense.
5. Cyberspace favors the offense.

Japan currently interprets its constitutional limits in cyberspace that nullify many rights to self-defense – to the point that Japan is denying itself sovereignty. Japan currently:    

1. Prohibits itself from conducting espionage (cyberspace intelligence collection) and cyberspace preemption.
2. Limits itself to passive cyber defense currently.
3. Lacks a unified federal cybersecurity structure and authority with no clear roles and responsibilities (yet) to defend against various forms of cyberspace attack.
4. Operates without a security clearance system equal to Western standards, excluding itself from full membership in the Five Eyes intelligence alliance, preventing Japan from joining the ‘Five Eyes’ community, which would allow it to receive from allies the highly classified malicious code the Peoples Republic of China uses to penetrate Japanese networks.
5. Maintains no means to discern foreign information operations conducted inside Japan, let alone reveal them publicly or contest them; Japan conducts no counter information operations.

This is more than noble restraint – it is a form of resignation. Such restraint invites greater cyberspace aggression; it does not inspire reciprocity from cyberspace adversaries.

Japan’s Cyber Reforms Necessary to Defend Its Sovereignty

Japan is a small cyber power. It must think asymmetrically to address the enormous challenge of malicious PRC cyber power.

• Japan needs to afford itself signals intelligence and human intelligence authorities, which are passive elements of self-defense. Historically, intelligence collection has afforded stability and security to a state – alerting would-be victims of impending aggression. For Japan to eschew SIGINT and HUMINT is a strange formula:  Japan has acquired TLAM cruise missiles (how are they targeted?) but has denied itself intelligence capabilities to alert itself of foreign (including cyberspace) threats. This is intellectually inconsistent.
• Japan needs to develop offensive cyberspace capabilities and conduct defensive (cyberspace attack) operations to effect its self-defense. Japan must develop a level of deterrence in cyberspace; this inevitably involves the violation of adversary sovereignty.
• Japanese cyber defensive and offensive forces must sit together (literally) to share information and coordinate immediate defenses and responses. They cannot be separated physically or legally.
• Japan needs to develop clear roles and responsibilities among its cyber agencies; it must adopt strong cyber hygiene standards for both government and private industry.
• The National Police Force needs authorities to conduct cyberspace undercover operations, including abroad.
• Japan would likely benefit from the Prime Minister appointing a Cyber Shogunate to effect these strong standards.

There are also broader reforms which would aid Japanese cyberspace defense:

• Japan needs to develop an Artificial Intelligence sharing agreement with the United States to add to the collective liberal democratic competition in AI with the PRC.
• Japan ought to develop a Silicon Valley – a magnet for technology development and venture capital and invite tech companies from the Five Eye states to assist in its development.
• Japan needs to build a cyber workforce. It needs so many cyber forces it may want to consider hiring Five Eye citizens, cleared for such work, to assist in its classified preparations. Japan should create cyberspace reservists from its former self-defense forces as well as allow public-private exchanges (1–2-year tours) to advance public-private cyber expertise and raise standards overall.

Japan must not make the mistakes the United States made in cyberspace:  slow to act; unprepared to respond to easily anticipated cyber provocations; reluctant to violate the sovereignty of the malicious cyberspace states when acting in self-defense; unwilling to defend deterrence by hitting back in cyberspace.

Currently, Japan has not decided if cyber-attacks on its critical infrastructure that cause permanent damage is necessarily armed conflict. (But if such attacks are not armed conflict in current Japanese thinking, why doesn’t Japan attack North Korean cyberspace networks, which holds stolen Japanese money and fuels the North Korean nuclear weapons program?) Unless and until Japan decides such activity is indeed an act of armed conflict, Japan is logically free to conduct such activities in its self-defense.

In Japan today, a judge decides if a cyber-attack is armed conflict in Japan – not the Commander in Chief of the Self Defense Forces. This is a formula for restraint and ambiguity and erodes Japanese sovereignty.

Cyberspace poses unique challenges for the liberal democratic states. Japan is currently unprepared both literally and intellectually to defend itself in cyberspace. As long as Japan denies itself rights of self-defense in cyberspace, Japan is at risk of losing its sovereignty.

James Van de Velde, Ph.D., is a Professor at the National Defense University. The views expressed in this article are those of the author and do not reflect the official policy or position of the National Defense University, the Department of Defense, or the U. S. Government.