Assessing Japan’s cybersecurity policy: change and continuity from 2017 to 2020

Through close observation of Japanese cybersecurity policy between 2017 and 2020, I demonstrate that changes made to the policy during the period were kept to a modest level largely by the resilience of existing constraints on the use of force. Investigating a set of key Japanese government documents such as the Cybersecurity Strategy, National Defence Programme Guidelines and Midterm Defence Programme, I show that, while Japan did much to reduce its vulnerability to hostile cyber operations and enhance long-term security through organisational overhaul and operational redesign, the developments turned out to be more cumulative than revolutionary in nature. That is, Japan’s traditionally defensive defence posture continued to retain the restrained core of its cyber strategy, observable in the status-quo orientation of the legal system and compliance with the way the international community expects countries to behave in cyberspace. As such, I contend that structural impact will only emerge across government-led performance in the long run. The modest changes reflect Tokyo’s established preference to adopt a patchwork approach to enduring problems in cyberspace.