What changed on 1 October
The Cabinet Secretariat's National Cyber Directorate says the Cyber Response Capability Enhancement Act (Act No. 42 of 2025) and its companion Maintenance Act (Act No. 43) began operating on 1 October 2026. Two pieces are live now: stronger public-private cooperation, and "access and neutralisation" measures against attack servers. Kyodo reported the same day that laws enabling preemptive measures against hostile servers came into force. Critical-infrastructure operators must report breaches, and an independent oversight commission gives final permission for preemptive measures.
The third tier is not yet in force. According to the Directorate's September 2026 briefing deck, communications-information use starts "next autumn". Recorded Future's analysis puts the statutory deadline at 23 November 2027.
The strongest case for the regime
The case for the law is serious. Japan's 2022 National Security Strategy committed the country to raising its cyber response capability to the level of leading Western states. It named three needs: information sharing with industry, detection of attacker-abused servers using carriers' communications data, and powers to neutralise those servers before an attack lands. The strategy is excerpted in a Cabinet Secretariat briefing hosted by the Ministry of Internal Affairs and Communications. A defender who can only watch an attack arrive from a rented server abroad is structurally disadvantaged. The new law targets attacker infrastructure rather than ordinary users, and the first two tiers do this without reading anyone's messages.
That is also why the 1 October tiers are the easier part. The Directorate's deck says the reporting duty covers 258 operators across 15 critical-infrastructure sectors. The new consultative council is expected to include about 100 organisations. Hogan Lovells describes a two-stage incident report: an initial report promptly, then a detailed one generally within 30 days. That is a bounded, auditable compliance burden on a defined set of companies.
Where encryption enters
The open question sits in the 2027 tier. Japan's Constitution guarantees the secrecy of communications, and carriers have long treated that guarantee as close to absolute. Using communications data to detect attack servers, however carefully designed, tests it.
I found no public statement in the official material I could read, or in the secondary analysis, that addresses encrypted traffic specifically. That absence matters, and nobody should fill it with speculation. What is documented is the design logic. Recorded Future's reading of the statute says that before any official may review acquired data, automated selection must retain only defined "mechanical information" such as IP addresses, timestamps and command information, and delete the rest. No person may examine the data before that selection is complete. Purely domestic communications must be excluded and deleted without human review.
This is the key point for encryption. A metadata-only model does not need to break, weaken or bypass encryption. An IP address, a timestamp and a command-and-control pattern are visible even when the payload is not. If Japan keeps to that model, it can pursue attacker infrastructure without the encryption backdoors that other democracies have debated. That would be a better outcome than a regime that eventually asks carriers or platforms for plaintext.
What a proportionate regime should lock in
The risk is drift, not the current text. Selection rules that start narrow can widen through ministerial guidance. Collection that starts with attack servers can be reused for ordinary investigations. Japan has some structural safeguards. The oversight commission, established on 1 April 2026, approves nonconsensual communications acquisition and ordinarily approves neutralisation measures. It also conducts continuing inspections, may issue recommendations, and must report annually to the Diet. The Directorate has already rehearsed the process: its September 2026 deck says it ran joint exercises with other ministries that included simulated applications for commission approval.
Three things would make the regime hold up under pressure:
- Write the metadata limit into binding rules. The mechanical-information boundary should be in the statute or a Diet-visible ordinance, not in internal practice, and it should state expressly that it creates no duty to decrypt, retain keys or weaken protocols.
- Publish commission statistics. Annual reports should say how many acquisition approvals were sought, granted and refused, and how often the emergency route skipped prior approval.
- Keep the purpose limit. Data acquired for cyber defense should not flow into criminal evidence-gathering without a separate legal basis.
The innovation stake
Japan's technology sector gains from a regime that raises baseline security without compromising the products it builds. Cloud, messaging and fintech firms depend on strong encryption, and a credible commitment not to touch it is a competitive asset. The first year of the neutralisation powers also matters for a second reason. Operators and carriers will learn how often the government acts and whether the oversight commission refuses requests. Those early practices will shape the 2027 tier more than the statute's wording.
The 1 October launch is a reasonable test of active defense with real oversight. The test for encryption comes in 2027. If the metadata-only boundary survives drafting, it can serve as a model. If it does not, Japan will have to explain how it squares that outcome with the secrecy of communications.