Event Summary: Mapping the Future of US-Japan Cybersecurity Cooperation: Adapting Collaboration under New Administrations

Download Event Summary: Mapping the Future of US-Japan Cybersecurity Cooperation: Adapting Collaboration under New Administrations

Abstract

On March 10, 2025, the US-Japan NEXT Alliance Initiative convened its seventh hybrid bilateral cybersecurity dialogue, this time on adapting collaboration under new administrations. Senior Director Jim Schoff welcomed around 19 American and Japanese specialists to the event from both governments, think tanks, and the private sector. Ms. Mihoko Matsubara, Chief Cybersecurity Strategist of NTT Corporation (and Sasakawa USA non-resident scholar) gave a presentation on potential areas of cooperation between the US and Japan vis-à-vis Japan’s new cybersecurity legislation. Her colleague, Mr. Dave Beabout, CISO at NTT Security Holdings, gave his opening remarks on the need for operational collaboration between the two countries to maintain telecom resiliency as a component of critical infrastructure. Mr. Schoff then moderated a discussion section where participants covered a range of related topics including flux within the US government, multilateral allied information sharing, and cybersecurity threats.

Opening Remarks

Ms. Mihoko Matsubara, Chief Cybersecurity Strategist at NTT, kicked off the event with a presentation entitled “Adapting Collaboration Under New Administrations.” Her presentation explained key elements of public and private partnerships, telecommunication information, and neutralization of cyberattacks through the lens of the Diet’s new cybersecurity legislation on Active Cyber Defense (ACD), approved by the Cabinet on February 7, 2025.[1]

On public and private sector partnerships, Ms. Matsubara noted that the new mandate will require critical infrastructure companies in Japan to submit a list of their IT assets and report cyber incidents to a singular reporting point with the government. Both measures are meant to  provide a strengthened National center of Incident readiness and Strategy for Cybersecurity (NISC) (i.e., a National Cyber Office　国家サイバー統括室) with a better understanding of the threat landscape across Japan’s critical infrastructure, as well as let them warn critical infrastructure companies of potential cyberattacks. Additionally, the government will establish a Public-Private Collaborative Council for the sharing of classified and unclassified threat intelligence on cyber threats.

For telecommunication information, the government will also help launch an Oversight Committee on Cyber, Telecommunication, and Information (サイバー通信情報監理委員会)　　 to monitor if the government collects and uses information properly. The oversight committee will be highly independent, similar to the Fair Trade Commission, with its members appointed by the prime minister but reporting the findings such as the number of cases requested for response, approved, and post-approved to the Diet.

On neutralization of cyberattacks, she explained the functions and differing jurisdictions between the National Police and Self-Defense Forces (SDF). The police are primarily responsible for the neutralization of cyberattacks, though such intervention requires approval by the oversight committee in advance, except for emergencies. Additionally, if an operation involves foreign computer servers, the foreign minister’s approval is needed. She added that there are some conditions under which authority could be handed from the police to the SDF. For example, if there is an advanced, organized, and apparently deliberate attack against a central or local government entity or critical infrastructure by a foreign adversary, the prime minister could order the SDF to conduct cyber operations. She also described an initiative underway for the construction of a new joint coordination center to provide a liaising space for the police and SDF, and the center is reportedly in the Ichigaya area, Tokyo, nearby the Ministry of Defense (MOD). Going forward, the National Cyber Office will be launched under a Cabinet Cyber Director　内閣サイバー官 (vice minister level) who will also be a part of the National Security Secretariat. She said that it was viewed as necessary for Japan to have this active cyber defense legislation to enhance Japan’s cybersecurity posture as part of national security, because  Japan grew increasingly concerned about Russia’s ongoing hostilities against Ukraine, as well as China’s stepped-up pressure on the Taiwan Strait.

Ms. Matsubara closed with a call for alliance vigilance, saying that the allies should keep in mind that hackers do not care whose administration it is, and adversaries never stop attacking. She urged both countries to operationalize cooperation between the public and private sectors with particular emphasis on cyber threat intelligence sharing.

Thanking his colleague for her presentation and insights, Mr. Dave Beabout, CISO at NTT Security Holdings, gave his opening remarks on operational collaboration between allies in cybersecurity operations, noting the uniqueness of the telecom sector within critical infrastructure stemming from its great dependance on other providers and countries. Mr. Beabout warned that until now the conversation on operational collaboration between the US and Japan has been relatively passive, but in the future it will be more central to maintaining strong cybersecurity. He highlighted the dangers to resiliency such as physical destruction of cables and the ability to joint threat hunting at the seams, saying that from a policy perspective the allies have only been looking internally but stressed that collaboration is most important. He noted that if there is a need to reach out and “touch” an international server for a cybersecurity operation, it could “trip over” a friendly operation already in progress if there is not sufficient coordination. This could be particularly true in the context of a potential Taiwan contingency. He emphasized the importance of allied scenario planning concerning cross border supply chains and stressed the critical link between communications, power, and water in cybersecurity. It is important to appreciate this intersection and work actively to protect them.

Discussion Summary

During the discussion section, participants posed questions and comments building upon the presentations. The dialogue focused primarily around two main themes: ways in which to improve public-private sector collaboration, and offensive cyber operations by allies and partners. Senior Director Schoff primed the discussion by asking where operationalizing the allied agenda of cybersecurity can have practical value and forward progress. He said that perhaps a potential vehicle in operationalizing cybersecurity could be in alliance security cooperation, leveraging the current efforts to upgrade command and control relationships between a new Japan Joint Operations Command (JJOC) for the SDF and an upgraded US Forces Japan (USFJ) based in Japan.

A Japanese participant said that Japan’s government gave primary cyber-defense responsibility to the national police over the SDF, as the most common cyber-attacks are not those that would trigger SDF involvement (i.e., major threats to national security or armed attacks). An American participant added that confidence in the reliability of gathered data related to cybersecurity and harmonized data formatting is imperative for allies to be operationally integrated, laying the foundation for either a better defense posture or a collaborative response. They added that given the US administration’s drive to reduce the federal budget and headcounts, this would have some impacts on public-private partnerships in the United States and also between Japan and the US. Additionally, given this new direction, it will take time to gain an understanding about how the scaled-back system will work. Private sector sharing will become more important to avoid waiting for government help.

Another participant queried the group, asking if there were international models of public and private sector partnerships that could serve as a guide for the alliance, offering the UK as one potential example. A Japanese participant said that intelligence sharing between the US and UK could be considered as the gold standard, but it relied on the experience of people who knew how to handle classified or sensitive information, which the Japanese industry currently lacks in sufficient quantities. An American participant replied that Australia has top-tier public-private sector communication, stressing that its government dismantled a previous more rigid system that penalized the private sector, and in its place built a new model around trust and incentives (i.e., if information is shared in, information will be shared out). He continued, saying the government can be helpful in this information sharing relationship if it receives information and sends it back enriched with helpful alerts that were not public information. A Japanese participant concurred, saying that cybersecurity in a public-private context relies heavily on reciprocity, and the allies should make an agreement that supports this principle.

Regarding international agreements, an American participant wondered if classified military industrial information falls under a General Security of Military Information Agreement (GSOMIA) that the US and Japan established in 2007. Another participant explained that the industrial side is governed more often by agreements tied to specific defense industrial or procurement projects, and usually this means that information must pass between private firms indirectly via government channels. Participants agreed that more direct cybersecurity information sharing among private firms (with government involvement) should be possible, although one participant cautioned that a closer relationship between the US and Russia could reduce Japan’s interest in such information sharing.

Another participant added that in Australia, there are former defense/intelligence employees working in the critical infrastructure sector and those relationships carry over and help strengthen the country’s cybersecurity. The Australian public-private sector relationship is made stronger by these connections because those workers know whom to call within the government and when, effectively using the “break in case of emergency” function. They added that the American Joint Cyber Defense Collaborative (JCDC) within the Department of Homeland Security (DHS), functions similarly as an inter-sector information sharing platform. They continued, saying the structure of sharing is key as both sectors are critical to maintaining cybersecurity and that JCDC functions well since participants trust the validity and reliability of information they are consuming. A Japanese participant said Japan’s government has learned this important lesson and is not generally following the JCDC format.

The conversation shifted as participants began discussing best practices for offensive cyber operations conducted by the allies against malicious threats. An American participant said his understanding from officials going into the new Trump administration was that the “gloves were coming off,” meaning the administration was going to utilize more aggressive capabilities generally avoided by the previous administration. He said those tools were held back out of concern for potentially adverse or unintended consequences, but this was becoming less of a concern as adversaries continue to cross the line of acceptability.

An American participant asked for clarification on the roles of what he understood to be a new position created by Japan’s ACD legislation known as “Cyber Harm Prevention Officers.” A Japanese participant explained that the position was known as a “Cyber Communication Protection Officer,” whose role is to actively neutralize immediate threats, if necessary, and then engage in a reporting process afterwards. He added that that job description could evolve over time, given how new it is.

An American participant’s final comment stressed the importance of joint preparation and response. He said that while the thinking in cybersecurity often focuses on building stronger defenses, there should be more emphasis on resiliency and “getting back up” after being “knocked down.” He believed that an allied exercise simulating recovery and “building back” creatively was crucial to maintaining a secure cybersecurity environment.

NEXT Steps

Senior Director Schoff closed the event by thanking the participants for their insightful comments and good discussion. This seventh “Mapping the Future of Alliance Cybersecurity” roundtable comes as NEXT prepares to debut its second interactive cybersecurity infrastructure map covering Japan’s cyber landscape. This new addition to NEXT’s page on the Sasakawa USA website will be the counterpart to the US mapping tool that was published in 2024. The publication of the new alliance mapping tool this summer will complete the Initiative’s mission to map out the US-Japan cybersecurity landscape to facilitate greater mutual understanding and support effective collaboration.

The US-Japan NEXT Alliance Initiative is a forum for bilateral dialogue, networking, and the development of joint recommendations involving a wide range of policy and technical specialists (in and out of government) to stimulate new alliance connections across foreign, security, and technology policy areas. Established by Sasakawa Peace Foundation USA with support from the Nippon Foundation, the goal is to help improve the alliance and how it serves shared interests, preparing it for emerging challenges within an increasingly complex and dynamic geostrategic environment. Launched in 2021, the Initiative includes two overlapping lines of effort: 1) Foreign & Security Policy, and 2) Technology & Innovation Connections. The Initiative is led by Sr. Director James Schoff.

[1] The Lower House of Japan’s Diet approved the ACD bill on April 8, 2025, and the bill is expected to be enacted by the end of the current ordinary Diet session. The government is planning to fully introduce an active cyber defense system in 2027.

Download Event Summary: Mapping the Future of US-Japan Cybersecurity Cooperation: Adapting Collaboration under New Administrations