Hearing that authorities will "access the attacking server and neutralize it" does not make clear what that actually involves. Does it mean destroying the server itself? Stopping the program being used in the attack? Or changing settings so the attacker can no longer get in? On October 1, 2026, it was revealed at a National Public Safety Commission press conference that the police authority for access and neutralization measures took effect that day. The Self-Defense Forces were also given duties related to access and neutralization measures on the same day, as the Ministry of Defense explained at a press conference the following day, October 2. However, these announcements concern the launch of new authority and duties. They are not announcements that any specific attacking server has actually been taken down.
To understand access and neutralization measures, it helps to separate three questions: which functions of the computers used in an attack are stopped or changed, who carries out the operation, and under what conditions it is permitted. Under the new system, measures such as stopping or deleting attack programs and changing access settings are envisioned, but the police and the SDF cannot operate servers freely. The law sets requirements, including the risk of serious harm, urgency, the entity carrying out the measure, and approval procedures.
What role does an attacking server play in a cyberattack?
A server is a computer that provides functions and services to other computers over a network. One example of a server used in cyberattacks is a "C2 (Command and Control) server," which sends instructions for information gathering or attacks to hijacked devices. A C2 server issues the commands, and it is distinct from the devices that operate on those commands. An "attacking server," then, is not necessarily a computer operated directly by the attacker.
Identifying the server used in an attack is also a separate matter from identifying the attacker. A server run by a legitimate administrator may be hijacked by a third party and abused in an attack. For that reason, a server's administrator cannot automatically be regarded as the attacker. Access and neutralization measures take these realities of computer use into account and target the functions being used in the attack.
A House of Representatives Research Bureau explainer describes the legal framework for active cyber defense in terms of public-private cooperation, the use of communications information, and access and neutralization. While the use of communications information is a mechanism for analyzing communications to detect signs of attacks, access and neutralization involves reaching the target computer over communication lines and taking measures to prevent harm. Its distinguishing feature is that it goes beyond monitoring and analyzing communications to change the operation and settings of the devices used in attacks.
How do stopping, deleting, and changing settings differ?
Computers operate by running programs, which are sets of written processing instructions. But a program stored as a file is in a different state from a program that is actually running. Stopping an attack program and deleting it therefore differ in both target and effect. There is also a method that leaves the program itself untouched and instead changes settings so that the attacker can no longer access the server.
Figure 4 in the House of Representatives Research Bureau explainer lists, as examples of access and neutralization measures, stopping or deleting installed attack programs and changing settings so attackers can no longer access attack servers. The operations and their expected effects can be organized as follows. Note that this is a technical classification of measures the system envisions, not an exhaustive list of everything permitted by law.
| Operation | What is changed | How it helps prevent harm |
|---|---|---|
| Stop | The operation of a running program | Halts the attack program's transmission of communications and similar activity |
| Delete | The attack program's file | Removes the program used to carry out the attack |
| Change settings | The state in which the attacker can access the server | Makes the access route the attacker is using unusable |
Suppose, for example, that an attack program on a server keeps sending attack traffic outward. Stopping the running program would halt that traffic. Deletion, by contrast, removes the stored program file and is distinct from stopping a running process. Even if an attack program is deleted, the attack as a whole will not necessarily end if other programs or attack bases remain.
Changing settings is a measure to cut off the access route the attacker is using. For example, if an attacker can reach a server run by a legitimate administrator, changing its settings to disable the intrusion route could be considered. This differs from blocking all of the server's communications or erasing all stored data. Nor does closing a specific access route guarantee the security of the entire server.
All of these measures prevent harm by stopping or restricting functions used in the attack. The key point is that the goal is not to destroy the server as a piece of equipment, but to act on the program operations and access routes that lead to harm. What operations are actually performed is judged according to the circumstances of the attack and the harm to be prevented.
Orders to administrators versus direct action by police officers
When a device being used in a cyberattack is found, it has long been standard practice to contact its administrator and ask them to stop the malicious program or change settings. The new legislation adds, separately from such voluntary requests, a mechanism to order necessary measures under the law and a mechanism for police officers to carry out measures themselves. The amended Police Duties Execution Act allows both orders to administrators and direct action by police when certain requirements are met.
The officers who actually carry out the measures are police officers designated as "cyber harm prevention measure enforcement officers." The Commissioner General of the National Police Agency designates them from among officers belonging to the National Police Agency or prefectural police. Enforcement officers act under the direction of the Commissioner General or the prefectural police headquarters chief, and can order computer administrators and other relevant parties to take necessary measures. They may also carry out access and neutralization measures themselves when the legal requirements are met.
Even when the same attack program is being stopped, the entity carrying it out differs depending on whether an administrator does the work under a police order or an enforcement officer operates the system directly. However, orders to administrators and direct action by officers are each methods the law permits, and the system is not one in which direct action is allowed only after an administrator refuses an order. In either case, the requirements set by law, such as the risk of serious harm and urgency, must be met.
Suspicious communications alone are not enough: the serious harm and urgency requirements
For police to carry out access and neutralization measures, merely finding suspicious communications is not enough. Police must recognize a cyberattack, or communications suspected of being one, and there must be a risk that leaving it unaddressed would cause serious harm to life, person, or property, along with an urgent need to act. In other words, it is not just a judgment that an attack is suspected; what harm would result from leaving it alone also matters. Police need not wait until damage actually occurs, but the system does not allow measures based solely on vague danger.
There are also limits on the scope of operations. Permitted measures are those generally recognized as necessary to prevent harm, a constraint based on the principle of proportionality. For example, if stopping a specific attack program is enough to prevent harm, the scope of necessary measures must be judged in relation to that purpose. The name "access and neutralization" cannot be read as automatically allowing destruction of the entire target server or unlimited operations.
Who can act, and through what procedures, also changes depending on where the target computer is located. If there is no reasonable ground to believe the computer is located in Japan, only National Police Agency officers can carry out the measure. In that case, prior consultation with the Minister for Foreign Affairs through the Commissioner General of the National Police Agency is also required. Importantly, this condition applies not only when a computer is found to be overseas, but also whenever there is no reasonable ground to judge that it is located in Japan.
Access and neutralization measures thus involve two separate questions: what can be technically operated, and whether the law permits that operation. To understand the system, it is easiest to first confirm the serious harm to be prevented and the urgency, then distinguish the scope of operations needed to prevent that harm, the entities that can carry them out, and the required procedures. This is, however, a way of organizing the system, not a statement that every actual case necessarily proceeds in this order.
The SDF faces even stricter conditions
The "communications protection measures" granted to the SDF carry additional requirements that differ from police access and neutralization measures. The protected targets are important computers of national administrative organs and local governments, as well as important computers related to critical infrastructure and certain parts of the defense industry. Not every company holding important information is unconditionally covered.
There are conditions on the nature of the attack as well. The target is a particularly sophisticated, organized, and planned cyberattack carried out by a person outside Japan. This requirement does not limit the attacker to foreign governments; the condition is that the attack is carried out by someone outside the country. In addition, there must be a significant likelihood that the attack will lead to a situation that seriously harms the safety of the nation and its people.
Furthermore, there must be special circumstances requiring a response by the SDF. For example, cases where special technology or information held by the SDF is essential to the response are envisioned. A request or consent from the National Public Safety Commission is also required, and the measures are carried out on the order of the Prime Minister. The units that actually carry out the measures are under the direction of the Minister of Defense and respond jointly with the police.
Therefore, the fact that the police authority and the SDF duties both began on October 1, 2026, does not mean the two can act under the same conditions. SDF communications protection measures require, in addition to the target computer, the nature of the attack, and the impact on national security, a special need for the SDF to respond. Police and SDF responses are not simply interchangeable.
Separately, there is also an authority called "SDF computer protection." Under it, SDF personnel on protection duty are given authority under the amended Police Duties Execution Act, applied mutatis mutandis, for certain computers used by the SDF or by U.S. forces in Japan. For U.S. forces' computers in Japan, this applies only when the U.S. side requests it and the Minister of Defense finds it necessary. Because its targets and authority structure differ from communications protection measures, which are carried out jointly with police on the Prime Minister's order, the two should not be confused.
Prior approval is the rule, and notification is required even in emergencies
Access and neutralization measures come with approval procedures in addition to the requirements for carrying them out. As a rule, prior approval must be obtained from the independent "Cyber Communications Information Oversight Commission." A distinction is needed here between the need to act quickly to prevent serious harm and the situation in which there is not even time to wait for the commission's approval. The urgency of the measure itself does not allow prior approval to be skipped.
Exceptions are permitted only when there are special circumstances in which there is recognized to be no time to obtain approval. The government cites, as an example, a situation in which a serious failure is actually occurring at a critical infrastructure operator. In such a case, measures can be taken without prior approval, but the commission must be notified promptly afterward. This describes the situation in which the exception applies, however, and does not disclose any case in which such a measure was actually taken.
This procedure is "post-notification," not "post-approval." The commission can issue recommendations as needed regarding the content it is notified of. Even when prior approval cannot be awaited, the prior consultation with the Minister for Foreign Affairs required depending on the target computer's location is not waived. When the SDF carries out measures, approval procedures with the commission and consultation with the Minister for Foreign Affairs are conducted through the Minister of Defense.
The Cyber Communications Information Oversight Commission is to report to the Diet each year on approval requests, notifications, the number of approvals, and related matters, and to publish a summary. However, the number of approvals is not the same as the number of cyberattacks actually stopped. Even after approval is granted, the implementation status and results of measures must be checked separately.
When individual announcements about access and neutralization measures are made in the future, key points for judgment will be what was being prevented and which function of which computer was stopped or changed. It will also be necessary to distinguish whether the police or the SDF carried out the measure, and whether prior approval was obtained or notification was given afterward under the emergency exception. What the launch of the system on October 1, 2026, means is that new authority and duties can now be exercised under the law, not that any individual attack has been stopped. Evaluating the system's effectiveness will require checking the specific measures and results announced in the future.