Japan’s government approved an emergency cybersecurity package on 6 November, eleven days after Prime Minister Sanae Takaichi ordered one. Cabinet released about 10 billion yen from reserve funds the same morning. The trigger was a run of breaches: the Personal Information Protection Commission, the privacy regulator, received 2,094 breach reports between 1 April and 16 October, against 1,256 in the whole of the previous financial year. The package calls itself a starting point.
This is a pre-mortem: a check, before the outcome is known, on where a programme is most likely to fail. It asks five fixed questions, uses only public documents and judges the plan on the page, not the people behind it.
The Bet
The bet is that new government teams can reduce breaches whose causes sit inside organisations. The package, published in Japanese, diagnoses many recent cases as unpatched known vulnerabilities, misconfigured websites and weak security in application development, at the organisation or its contractors. Its answer is mostly public capability. The Information-technology Promotion Agency, a government agency that supports security work, is to form a “top gun” testing team in November. Under the National Cybersecurity Office, the cabinet body that coordinates the government’s response, an outreach team will approach organisations at risk and a public-private cyber rescue squad will respond to attacks. A rapid forensics unit is to be created within the police.
The Assumption
The assumption is that the government will hear about attacks in time to act. Everything from the outreach team to the rescue squad and the threat-hunting support depends on the National Cybersecurity Office learning of an incident early. The package asks ministries to collect information from victims “quickly”, with no time limit. Takaichi’s statement set a higher standard: operators of critical infrastructure should aim to report an attack within hours, and at least the same day. She also asked ministers to consider a way for the office to see suspicious traffic to private companies, drawing on other major countries. Both are aims, and neither has a date in the materials reviewed.
The Sequence
Delivery has been set before the funding and the law. The outreach team and the testing team are due in November, and the rescue squad’s secretariat within the fiscal year that ends in March 2027, while the new response teams still carry provisional names. Reserve funds cover what is needed immediately. Takaichi asked the finance minister and others to secure funding for the whole package. She also asked Toshiharu Furukawa, the minister in charge of cyber security, to study amending the Cyber Response Capability Enhancement Law, the law behind the government’s active cyber defence powers. The package lists, as urgent, an examination of telecom operators restricting access to leaked data, including the legal questions.
The Pager
The leadership layer is visible. Takaichi ordered the package, convened two ministerial meetings in eleven days and gave instructions in her own name. The economy, trade and industry minister, Ryosei Akazawa, was asked to bring forward the testing work, and Furukawa to coordinate attribution with allied governments. Ministers are to report progress to the National Cybersecurity Office. The package names offices and no individuals. It says the office will judge whether a victim’s need is urgent enough to send the rescue squad, and the victim must also ask for help. It does not say who makes that call at two in the morning.
The Proof
Eighteen months from now, around May 2028, the test is whether Japan has fewer breaches and learns of them faster. The package’s stated aim is a society with the world’s highest standard of cyber resilience. It sets no figure or date against that aim, and the only way it describes of tracking the package as a whole is ministries reporting progress to the National Cybersecurity Office. A baseline now exists. The privacy regulator has published preliminary breach statistics for the first time, including 830 reports in the first 16 days of October. Which of those figures, or what time from attack to notice, the government will be judged on has not been stated.
Verdict
If the Cabinet attaches a date and a number to its stated aim, for example the time from attack to notice at the National Cybersecurity Office, and publishes it beside the regulator’s monthly breach count, then this package can be judged on results and can claim credit when it meets them. If the same-day reporting goal becomes a requirement with a date, then the outreach team and the rescue squad will have the information they depend on. Offices with a mandate still need a measure to be held to. A package that publishes its measure in advance invites the test it hopes to pass.
