Japan's active cyber defense statutes took full operational effect on Thursday, authorizing police—and in defined cases the Self-Defense Forces—to access and neutralize hostile servers used in attacks on critical infrastructure after an independent oversight commission signs off.
What switched on October 1
Provisions promulgated in May 2025 under the Act on Prevention of Damage Caused by Wrongful Acts against Important Computers and a companion law amending the Police Duties Execution Act and Self-Defense Forces Act entered force together on October 1, 2026. Critical-infrastructure operators in 15 sectors covering roughly 258 designated businesses must notify authorities about covered systems and report incidents on tightened timelines. Police may intervene on attack infrastructure when the National Security Council process and commission approval align.
Cybersecurity minister Toshiharu Furukawa told a government meeting Wednesday that Tokyo aims for "the world's highest level of resilience," framing Thursday's start as the shift from purely passive defense to measured preemptive action. Communications-data monitoring powers and related bulk acquisition remain scheduled for a later cabinet-set date no later than November 22, 2027, leaving today's launch focused on access, neutralization, and operator reporting.
Operator obligations on day one
Power, railway, telecom, and finance operators among the designated list must route incident reports through sector regulators to the National Cybersecurity Office. Guidance issued in December 2025 under the basic policy requires tabletop exercises and vendor chain mapping before year-end compliance checks. Vendors serving multiple operators face parallel questionnaires on logging and patch cadence because supply-chain intrusions triggered much of the Diet debate that produced the law.
Failure to report covered incidents can trigger administrative orders and public naming under existing cybersecurity basic act penalties, lawyers following the sector said. Operators are not required to grant police persistent backdoors; neutralization remains incident-specific.
Oversight and civil-liberties guardrails
The oversight commission began work April 1, 2026, ahead of operational powers so reviewers could publish procedures for evidentiary preservation when police copy or delete malware on foreign-hosted machines. Privacy advocates remain focused on the 2027 communications-data tranche, but Thursday's launch still drew protest letters citing potential overreach if neutralization requests lack adversary attribution standards.
Police manuals published in redacted form say neutralization includes blocking command-and-control callbacks and deleting malicious payloads without seizing legitimate customer data when alternatives exist. SDF involvement triggers only when police capacity or jurisdiction thresholds in the amended SDF Act are met, a narrower lane than general domestic policing.
What corporate Japan does next
Non-designated enterprises still feel spillover: banks and manufacturers are updating incident retainers and cyber insurance riders to reflect police-led takedowns that may disrupt shared hosting. Multinationals with Japan headquarters are aligning global SOCs to the reporting categories expected by sector ministries. Training providers reported sold-out October courses on evidence handling when third-party infrastructure is touched by government responders.
Thursday's enforcement date was fixed by Cabinet Order No. 46 after months of industry comment on notification forms. The next policy flashpoint is the cabinet order setting communications monitoring start before the November 2027 statutory deadline—a step that will reopen Diet scrutiny even as today's neutralization powers begin their first operational quarter.