In the war room of cyberspace, Japan has spent decades fighting with one hand tied behind its back. Now, as state-sponsored hackers penetrate defence networks and crash critical systems with increasing ease, the country is finally cutting the rope. From October 1st, Japanese authorities will be permitted to do what other major powers have done for years: hack back.
Japan's government decided to allow its Self-Defense Force to conduct offensive cyber-operations, starting on October 1st. The decision represents not merely a policy adjustment, but a fundamental rupture with the constitutional framework that has governed Japan's defence posture since 1946. Japan's armed forces are called the "Self-Defense Forces" due to Clause 9 of the constitution Japan adopted in 1946, in which the nation renounced participation in war or developing the capacity to wage it. In the decades since, Japan has re-interpreted the clause in ways that allow it to participate in military activities that contribute to its defence.
The trigger for this shift is unmistakable. Cyberattacks have ceased to be a technical nuisance and have become a direct threat to Japanese sovereignty. A report by the Washington Post showed that the U.S. National Security Agency discovered Chinese military hackers had compromised Japan's defence networks back in 2020, described as "one of the most damaging hacks" in Japan's history. More recently, Japanese financial systems have been targeted, and iconic companies like Asahi brewery have fallen to coordinated attacks. Rising tensions around Taiwan and China's growing assertiveness in the South China Sea pose a significant threat to Japan's trade and security.
Chief Cabinet Secretary Minoru Kihara explained the government believes the time is right to allow offensive operations because online the nation faces "the most complicated national security environment" since World War II, and because "society as a whole is proceeding with digitalization." The argument carries weight: a future conflict, security analysts predict, may not begin with missiles but with cyber attacks on commerce and power grids.
The regulations themselves attempt to navigate the tension between security necessity and constitutional constraint. A government cyber-management committee will have the power to approve or deny applications to commence cyber-ops. If authorised, Japan's police and SDF will "attack and disable" infrastructure used to run cyberattacks, while working to ensure citizens' privacy. The oversight is designed with teeth; lawmakers introduced amendments to address public concerns, including penalties of up to 2 million yen or four years' imprisonment for any official found misusing surveillance powers.
Yet the policy carries genuine risks that reasonable authorities dispute. Successfully executing offensive cyber operations requires high-confidence attribution—no easy feat in the obfuscated world of cyberspace. Acting on flawed intelligence could result in unintended consequences, including hitting civilian infrastructure or foreign neutral systems. Japan also faces a practical constraint that undermines capacity: Japan faces a shortage of cybersecurity professionals. Scaling up operations under the new law will require significant investment in human capital, training, and cross-agency coordination.
Public opinion remains conflicted. A recent Asahi Shimbun poll found that while 62% of respondents supported stronger cyber defences, only 37% were comfortable with preemptive hacking. The concern centres not on the principle but on implementation: can a government committee truly operate with the speed required to defend against attacks moving at digital pace, whilst keeping the measure from becoming a tool for broader surveillance?
For Japan, this October decision settles a long constitutional argument. The nation has consistently reinterpreted Article 9 to allow military action in service of defence. This cyber authority extends that logic into new terrain. Whether the safeguards hold, and whether Japan can build the expertise to wield such power responsibly, remains an open question. The international environment has already moved on; the question now is whether Japan can catch up without losing the democratic restraint that distinguishes it from actors it faces.