What is the Legal Framework for Addressing Cybercrime in Japan, and How Should Businesses Protect Themselves?

Japanese Attorney at Law - Bengoshi L.L.

• 9 min read

Cybercrime represents a pervasive and escalating threat to businesses globally, causing significant financial losses, operational disruptions, and reputational damage. Japan, with its highly digitized economy and advanced technological infrastructure, is by no means immune to these risks. Understanding the legal framework in place to combat cybercrime in Japan, as well as implementing robust protective measures, is crucial for any company operating within or transacting with the country. This article outlines Japan's approach to cybercrime legislation, its alignment with international efforts like the Convention on Cybercrime, and essential strategies for businesses to safeguard their operations and assets.

The International Context: The Convention on Cybercrime (Budapest Convention)

Recognizing the transnational nature of cybercrime, international cooperation is paramount. The Council of Europe's Convention on Cybercrime, also known as the Budapest Convention, adopted in 2001, stands as the most significant international treaty in this field. It aims to:

  • Harmonize the domestic criminal substantive law elements of offenses and connected provisions in the area of cybercrime.
  • Provide for domestic criminal procedural law powers necessary for the investigation and prosecution of such offenses as well as other offenses committed by means of a computer system or evidence in relation to which is in electronic form.
  • Set up a fast and effective regime of international co-operation.

Japan actively participated in the drafting process of the Budapest Convention and ratified it in 2012. The Convention requires signatory states to criminalize a range of misconduct, including:

  1. Offenses against the confidentiality, integrity, and availability of computer data and systems:
    • Illegal access (hacking) (Article 2).
    • Illegal interception of non-public transmissions of computer data (Article 3).
    • Data interference (damaging, deleting, deteriorating, altering, or suppressing computer data without right) (Article 4).
    • System interference (hindering or interrupting the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering, or suppressing computer data without right) (Article 5).
    • Misuse of devices designed or adapted primarily for the purpose of committing these offenses (Article 6).
  2. Computer-related offenses:
    • Computer-related forgery (Article 7).
    • Computer-related fraud (Article 8).
  3. Content-related offenses:
    • Offenses related to child pornography (Article 9).
  4. Offenses related to infringements of copyright and related rights (Article 10).

The Convention also provides for procedural powers such as expedited preservation of stored data, search and seizure of computer data, and real-time collection of traffic data, along with mechanisms for international cooperation (e.g., mutual legal assistance). An Additional Protocol to the Convention concerning the criminalisation of acts of a racist and xenophobic nature committed through computer systems was adopted in 2003.

Japan has a multi-layered legal framework to address various forms of cybercrime, significantly enhanced and updated in response to its obligations under the Budapest Convention and the evolving threat landscape.

Key Legislation:

  1. The Penal Code (刑法 - Keihō): Japan's Penal Code includes several provisions relevant to cybercrime:
    • Obstruction of Business by Damaging a Computer (Article 234-2): Criminalizes acts of damaging a computer or its electromagnetic records used for business, or providing false information or illicit commands, thereby causing operational failures or unintended operations and obstructing business.
    • Unauthorized Creation or Damaging of Electromagnetic Records (Articles 258, 259): Addresses the creation of unauthorized electromagnetic records related to rights, duties, or certifications, and the destruction or damage of such records.
    • Computer Fraud (Article 246-2): Criminalizes the act of illegally profiting by providing false information or illicit commands to a computer used for office work, creating or altering electromagnetic records of gains or losses, or by acquiring illicit gains through such altered records.
    • Other general provisions (e.g., fraud, defamation, obstruction of business) can also apply to acts committed using computer systems.
  2. The Act on Prohibition of Unauthorized Computer Access (不正アクセス行為の禁止等に関する法律 - Fusei Akusesu Kōi no Kinshi tō ni Kansuru Hōritsu): Enacted in 1999 and subsequently amended, this is Japan's primary anti-hacking law.
    • It criminalizes unauthorized access to specific computers (those protected by access control features like ID/password systems).
    • It also prohibits acts that facilitate unauthorized access, such as acquiring or improperly storing another person's access credentials, or providing such credentials to third parties with the intent to enable unauthorized access.
    • Penalties include imprisonment and/or fines.
  3. The Act on the Protection of Personal Information (APPI) (個人情報保護法 - Kojin Jōhō Hogohō): While not a cybercrime law per se, the APPI imposes significant obligations on businesses handling personal information, including security management measures to prevent data leaks, loss, or damage. Data breaches resulting from cyberattacks trigger specific reporting obligations under this Act. (Discussed further below).
  4. Copyright Act (著作権法 - Chosakukenhō): Contains provisions addressing online copyright infringement, including the illegal uploading or downloading of copyrighted works and the circumvention of technological protection measures.
  5. Act on Regulation of Transmission of Specified Electronic Mail (Anti-Spam Act) (特定電子メールの送信の適正化等に関する法律 - Tokutei Denshi Mēru no Sōshin no Tekiseika tō ni Kansuru Hōritsu): This law regulates unsolicited commercial electronic mail (spam), requiring sender identification, opt-out mechanisms, and prohibiting deceptive practices.
  6. Legislation against Online Child Sexual Exploitation: The Act on Punishment of Activities Relating to Child Prostitution and Child Pornography, and the Protection of Children addresses the production, distribution, and possession of child pornography, including online.
  7. Telecommunications Business Act and the Provider Liability Limitation Act: These laws are relevant to the obligations of internet service providers (ISPs) and other telecommunications carriers, including issues related to intermediary liability and the disclosure of information concerning individuals who have made infringing or illegal transmissions.

Law Enforcement and Specialized Agencies:

  • The National Police Agency (NPA) and prefectural police departments have dedicated cybercrime units responsible for investigating cyber-related offenses.
  • The Public Prosecutor's Offices handle the prosecution of these crimes.
  • JPCERT Coordination Center (JPCERT/CC): This is Japan's national Computer Security Incident Response Team (CSIRT). It collects and analyzes incident information, provides early warnings, and coordinates responses to cyberattacks, working closely with domestic and international counterparts, government agencies, and the private sector.
  • The Information-technology Promotion Agency (IPA) also plays a role in cybersecurity awareness, providing information on threats and best practices for businesses and individuals.

Despite these efforts, enforcement faces inherent challenges due to the borderless nature of cybercrime, difficulties in attributing attacks to specific actors (who often operate from overseas and use anonymizing techniques), the rapid evolution of attack methods, and the complexities of collecting and preserving digital evidence.

Common Cyber Threats Targeting Businesses in Japan

Businesses in Japan, like their counterparts worldwide, face a diverse array of cyber threats:

  1. Ransomware Attacks: These have become increasingly prevalent and damaging. Attackers encrypt a company's critical data and demand a ransom, often in cryptocurrency, for its decryption. Modern ransomware attacks frequently involve "double extortion," where attackers also exfiltrate sensitive data before encryption and threaten to leak it publicly if the ransom is not paid.
  2. Unauthorized Access and Data Breaches: Hackers gaining illicit access to corporate networks to steal sensitive information, including customer personal data, employee records, financial information, intellectual property, and trade secrets.
  3. Business Email Compromise (BEC) / CEO Fraud: Social engineering attacks where cybercriminals impersonate company executives or trusted partners via email to trick employees into making unauthorized wire transfers or divulging sensitive information.
  4. Phishing and Spear Phishing: Deceptive emails, messages, or websites designed to lure employees into revealing login credentials, financial details, or installing malware. Spear phishing involves highly targeted attacks tailored to specific individuals or organizations.
  5. Malware Infections: A broad category including viruses, worms, trojans, spyware, and adware that can disrupt systems, steal data, provide remote access to attackers, or serve as a launchpad for further attacks.
  6. Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks: Overwhelming a company's website, online services, or network infrastructure with a flood of traffic, rendering them unavailable to legitimate users and causing significant business disruption.
  7. Supply Chain Attacks: Compromising less secure third-party vendors or software providers to gain access to the systems of their larger, more secure clients.
  8. Intellectual Property Theft: Targeting research and development data, proprietary algorithms, product designs, and other forms of valuable intellectual property through cyber espionage.

When a cyber incident occurs, particularly one involving personal data, Japanese law imposes specific obligations on businesses:

Data Breach Notification under the APPI:

The Act on the Protection of Personal Information (APPI), significantly amended in recent years (with major changes effective April 2022), mandates reporting obligations for businesses ("personal information handling business operators") in the event of certain types_of personal data breaches.

  • Reporting to the Personal Information Protection Commission (PPC): Businesses must promptly report breaches that involve (or are likely to involve) sensitive personal information, data that could cause property damage if misused (e.g., financial account information), breaches caused by an unauthorized act like a cyberattack, or breaches affecting a large number of individuals (currently 1,000). A preliminary report is typically due within 3-5 days of becoming aware of the incident, followed by a more detailed report within 30 days (or 60 days for malicious incidents).
  • Notification to Affected Individuals: Businesses are also generally required to promptly notify the affected individuals whose personal data has been breached or is suspected to have been breached, unless doing so is difficult and alternative measures are taken to protect their rights and interests.

Failure to comply with these APPI reporting obligations can result in administrative orders and penalties.

Other Reporting and Cooperation:

  • Reporting to Law Enforcement: While not universally mandated for all cyber incidents, reporting significant cyberattacks (e.g., ransomware, BEC, major data theft) to the police is strongly encouraged and often necessary for investigation and potential prosecution.
  • Cooperation with Authorities: Businesses are expected to cooperate with investigations conducted by the police, prosecutors, the PPC, and other relevant regulatory bodies.
  • Sector-Specific Requirements: Industries such as finance, healthcare, and critical infrastructure may be subject to additional, sector-specific cybersecurity regulations and incident reporting requirements imposed by their respective regulators (e.g., the Financial Services Agency - FSA).

Essential Cybersecurity Measures for Businesses

Protecting against the multifaceted cyber threat landscape requires a comprehensive, multi-layered "defense-in-depth" strategy. This involves a combination of technical, organizational, and legal measures:

A. Technical Safeguards:

  1. Network Security: Implement and maintain robust firewalls, intrusion detection/prevention systems (IDS/IPS), secure network segmentation, and secure configurations for all network devices.
  2. Endpoint Protection: Deploy advanced endpoint security solutions (antivirus, anti-malware, EDR) on all computers, servers, and mobile devices.
  3. Access Control: Enforce strong password policies, mandate multi-factor authentication (MFA) wherever possible, and apply the principle of least privilege (granting users only the access necessary for their roles).
  4. Data Encryption: Encrypt sensitive data, both when it is stored (at rest) and when it is being transmitted (in transit).
  5. Patch Management: Establish a rigorous process for promptly identifying and applying security patches and updates to all operating systems, software applications, and firmware.
  6. Secure Data Backups: Regularly back up critical business data and ensure that backups are stored securely (e.g., offline or in a segregated environment) and are periodically tested for restorability. This is crucial for resilience against ransomware.
  7. Vulnerability Management: Conduct regular vulnerability scanning and penetration testing to proactively identify and remediate security weaknesses in systems and applications.

B. Organizational and Procedural Measures:

  1. Comprehensive Information Security Policy: Develop, implement, and regularly review a clear and comprehensive information security policy that is communicated to all employees and relevant stakeholders.
  2. Employee Cybersecurity Awareness Training: This is one of the most critical defenses. Conduct regular and engaging training for all employees on identifying and avoiding common cyber threats like phishing, social engineering, malware, and on practicing good cyber hygiene (e.g., password security, safe Browse).
  3. Incident Response Plan (IRP): Develop a detailed IRP that outlines roles, responsibilities, and procedures for detecting, analyzing, containing, eradicating, recovering from, and conducting post-mortem analysis of security incidents. This plan should be regularly tested and updated.
  4. Third-Party Risk Management (TPRM): Implement a program to assess and manage cybersecurity risks associated with vendors, suppliers, and other third-party service providers who have access to the company's data or network.
  5. Data Governance and Minimization: Establish clear policies for data classification, handling, retention, and secure disposal to minimize the amount of sensitive data at risk.
  6. Physical Security: Implement appropriate physical security measures to protect IT infrastructure, data centers, and sensitive documents from unauthorized physical access.
  1. Stay Informed of Legal Requirements: Keep abreast of evolving Japanese cybercrime laws, data protection regulations like the APPI, and relevant international standards and best practices.
  2. Review Contracts: Ensure that contracts with IT service providers, cloud vendors, and other third parties include appropriate cybersecurity clauses, data protection obligations, and incident notification requirements.
  3. Consider Cyber Insurance: Evaluate the potential benefits of cyber insurance to mitigate financial losses arising from certain types of cyber incidents (e.g., costs of data recovery, business interruption, third-party liability).
  4. Engage Legal Counsel: Retain or consult with legal counsel specializing in cybersecurity, data privacy, and incident response to advise on compliance, prepare for incidents, and manage legal aspects during and after an attack.

D. Information Sharing and Collaboration:

  1. Industry Collaboration: Participate in industry-specific Information Sharing and Analysis Centers (ISACs) or other forums to exchange threat intelligence, best practices, and lessons learned.
  2. Cooperation with Authorities: Establish relationships with law enforcement and national CSIRTs like JPCERT/CC to facilitate rapid information sharing and coordinated response in the event of a major incident.

Conclusion

The legal framework for addressing cybercrime in Japan is continually evolving, with domestic legislation being progressively aligned with international standards such as the Budapest Convention. Businesses operating in this environment face a sophisticated and dynamic array of cyber threats that can have severe operational, financial, and reputational consequences. Moreover, legal obligations, particularly concerning the protection of personal information and data breach notification under the APPI, require diligent attention.

Effective cybersecurity is no longer solely an IT department concern; it is a fundamental aspect of corporate governance and risk management. A proactive, multi-layered defense strategy that combines robust technical safeguards, sound organizational procedures, comprehensive employee training, and astute legal and compliance oversight is essential for businesses to protect their valuable assets, maintain customer trust, and navigate the complex challenges of the digital age in Japan and beyond.