Texas-Japan Economic Summit

I want to thank the Texas-Japan Economic Summit, the Japanese Consulate, and fellow panelists David Boone, Joel Malone, and Ed Shaw for the opportunity yesterday to participate on the Defense and Security Panel. Topics covered included doing business in Japan, the Japan-US Alliance, cyber security issues, and preparations for the 2020 Olympics. Here are some of my notes from the talk compiled from a number of open source materials:

Introduction

Japanese efforts demonstrate its ambition to have a more proactive military posture and expand the scope of the Japan-US alliance. Under the Abe administration, Japan’s cyber-defense capabilities have been enhanced due to cyber security tensions between the US’ relationships with China, Russia and North Korea. The reinterpretation of Article 9 in the Japanese Constitution to “collective self-defense” is reflective of the broader trends of change and new assertiveness in its national security trajectory – to defend other allies, not doing so could endanger Japan. The Senkaku Islands and the Chinese encroachment is an understandable reason why Japan is seeking a deterrence capability.

Impetus towards improving cyber security In 2014 and 2015 the number of cyber attacks in Japan passed the 25 billion mark, with 40% traceable back to China. Notable incidents of cyber warfare between China-Japan were data breaches in the defense industry, the Diet and the Japanese Pension Service (PII 1.25M like OPM), using classic spear fishing attacks. Revised and amended their cyber strategy CYBERSECURITY BASIC ACT and BASIC POLICY OF INFORMATION INFRASTRUCTURE PROTECTION (CII Protection). Expanded National Center for Incident Readiness Strategy for Cyber Security monitoring role and established a Computer Security Incident Response Team CSIRT. Two of their principle objectives towards upgrading their cyber defenses: • Reestablish confidence in Japanese government to protect against cyber attack • Avoid embarrassment in the 2020 Olympics – all implementations are geared towards this date, with emphasis on: o National Security, International Peace and Stability, Int’l Partnership o Securing: Infrastructure , Internet of Things and botnets. Securing ministries and other critical corporations o Outreach, Training and Sharing amongst: Government, Business Academia o Improving capacity in Cyber Coordination, Detection and Response China is a leading practitioner of “gray zone tactics” or actions designed to change the status quo through steps, though consequential, they deliberately calculated to remain below the level that would trigger an armed response. Weaken rival nations, steal intellectual property, and signal disapproval from ruling party. Also to demonstrate that the USA can’t meet up to its treaty obligations to defense.

• Governing Principle: Proactive contribution to peace in cyberspace • No treaty will protect from gray zone tactics… a country must develop own capacity for proactive defense as well as a capacity for retaliatory response

Some questions addressing the Japan-US Cyber partnership

Relative to cyber, what is the level of coordination between the US and Japan and how do they determine originating sources? – Government and business?

Every year, they hold a Japan US Cyber Dialogue where Japan and US governmental agencies get together and set priorities in improving cooperation and mutual cyber defense.

• Information Sharing - Japans Nat’l Center of Incident Readiness Strategy for Cyber security will join DHS’ Automated Indicator Sharing Programs

• Enhancing National Efforts - Improving industrial control systems and training between Ministry of Economy and Industry and DHS

• And reaffirmed commitments of the 2020 Olympics between the NISC and DHS

• Robo Taxis and Olympic Games

• Share Info on Botnets and the security of IOT

• Strengthening International Stability in Cyberspace

• 5th UN Group of Experts on IT Security

• G7 Ise-Shima Cyber Group

• Building developing nation’s security to enhance overall security

Assist Japan to increase its cyber-defense capacity through legislation, technology and training

• Amendment to Cybersecurity Basic Act to lower priority ministriesCybersecurity Audit, Fact Finding Activities, Network Monitoring extending out from Government to Incorporated Admin Agency and Special/Authorized Corp

• Basic Policy of Critical Information Infrastructure Protection (CII Protection) 13 sectors/agencies 5 areas coordinated by the NISC, 5 Government Ministries/AgencySafety, sharing, incident response, risk management, CIIP Basis improvements

• Estimated Japan only has 265K/350K cybersecurity workers needed and 160K need additional training

• Continue US-Japanese Cyber Dialogues and cooperation• Provide stronger cooperation on 2020 Tokyo Olympics