How the Cyber Defense Law Coming into Effect in April 2026 Will Change the Japan Self-Defense Forces' Way of Fighting

On April 1, 2026, the main provisions of the revised Active Cyber Defense Act will come into effect. Ten months after its enactment on May 16, 2025, Japan's security framework will gain the ability to "take the initiative" in the invisible battlefield. However, what I focus on is not the text of the law itself. The fact that the National Police Agency and the Ministry of Defense and Self-Defense Forces have gained the "authority to directly neutralize the server from which the attack originates" is, in fact, a turning point that will significantly advance the integration of operational levels within the Japan-U.S. alliance.

From "Siege Warfare" to "Guerrilla Warfare"

Traditionally, Japan's cyber defense has been "siege warfare." It relied on firewalls and perimeter defenses, responding only after being attacked. However, active defense is "guerrilla warfare." It involves reading the enemy's attack patterns, understanding their movement routes, ambushing at vulnerable choke points, and cutting off supply lines. In cyberspace, this means neutralizing the attacker's infrastructure and raising the cost of attacks to build deterrence.

The new law enables the Self-Defense Forces and the police to neutralize relay servers, remotely track stolen files, conduct counter-access to attacking computers, and even carry out DDoS attacks against imminent threats. All of these actions will only be carried out in limited situations where rapid responses to cyberattacks by state or highly organized criminal groups are necessary. However, the interpretation of the term "limited" will be determined through actual operations.

The Overlooked Expansion of the Self-Defense Forces' Role

Many reports focus on the impact on businesses (reporting obligations for critical infrastructure operators, vulnerability responses by IT vendors, etc.). However, from my 25 years of experience in the Japan Maritime Self-Defense Force, I believe the true significance of this law lies elsewhere. It provides a legal foundation for the Self-Defense Forces to execute a persistent engagement strategy that "prevents threats within the enemy's domain" in the cyber realm.

This is a concept introduced by the U.S. military in its 2018 cyber strategy, and it means that Japan can now participate in the same strategic framework. Just as the Maritime Self-Defense Force's escort ships conduct joint operations with U.S. carrier strike groups, the Cyber Defense Force can also operate in the same operational domain as the U.S. Cyber Command.

A Critical Weakness: Personnel Shortages

However, this legal advancement faces serious practical constraints. The issue is personnel.

A 2016 ISC2 survey predicted a shortage of about 170,000 cybersecurity personnel by 2024. The Ministry of Economy, Trade and Industry's estimates from 2020 also indicated a shortage of about 190,000. Even just for cybersecurity personnel related to national security, the shortage is estimated to be in the tens of thousands. In May 2025, the Ministry of Economy, Trade and Industry announced plans to double the number of registered information security specialists with advanced information security capabilities to 50,000 by 2030, but this still falls short of meeting even a quarter of the demand.

Moreover, the problem is not just a lack of technicians. Active cyber defense requires experts who possess knowledge in diplomacy, military affairs, and intelligence. The national security clearance system introduced in May 2025 is an important first step, but it only allows government employees and some private sector employees to access classified information. The establishment of a comprehensive training system is still ahead.

Accelerating Japan-U.S. Cyber Operations Integration

Another strategic significance of this law is the deepening of information sharing and operational coordination between Japan and the United States. The new law allows the Japanese government to actively collect threat information regarding advanced cyberattacks by state actors and highly organized criminal organizations and to coordinate this information centrally. This will improve information exchange with allied nations and like-minded countries.

Specifically, if the U.S. or other countries request Japan to neutralize state-sponsored attackers or organized crime, Japan will be in a position to promote effective international cooperation. Conversely, Japan will also be able to make similar requests to its allies. This marks the substantial beginning of collective defense in the cyber domain.

The Landscape in 2027

The new law will be gradually fully implemented from 2026 to 2027. The National Cybersecurity Office, established in July 2025 (an expansion of the former National Cyber Incident Response Strategy Center), will play a central role in coordinating with relevant ministries and the private sector.

However, my concern is the gap between the legal framework and human capabilities. It is impossible to fill a shortage of 170,000 personnel in just a few years. Cyberattacks by state actors occur 24/7. The "persistent engagement" referred to by the U.S. military means continuously engaging with the enemy, detecting attacks in advance, and preventing them within the enemy's domain. This requires not only advanced technical capabilities but also judgment and analytical skills.

The real challenge is how quickly we can cultivate personnel who can implement the provisions of the law. This will also determine Japan's contribution to the next stage of the Japan-U.S. alliance. A lack of capabilities in the cyber domain could undermine superiority in other domains (land, sea, air). Whether Japan truly becomes an "active" cyber defense nation by 2027 depends on the personnel development over the next two years.

Sources

• Nippon.com "New Legislation Signals Japan's Shift to 'Active' Cyber Defense" (August 6, 2025)
• Baker McKenzie "Japan's New Active Cyber Defense Law: Impact on Businesses" (January 22, 2026)
• Security Brief Asia "Japan enacts Active Cyber Defense Law to neutralize threats" (June 30, 2025)
• ACM Communications "Securing Japan from Online Attacks" (October 7, 2025)
• CSIS "Norms in New Technological Domains: What's Next for Japan and the United States in Cyberspace" (June 17, 2025)