Japan must accelerate cyberdefense strategy, former NSA director says

Japan’s cyberdefense strategy must be fast-tracked if the country is to protect itself from the barrage of cyberattacks that have wreaked havoc in recent months, says Michael Rogers, a former commander of the U.S. Cyber Command and ex-director of the National Security Agency.

In an interview with The Japan Times on Wednesday, Rogers praised the Japanese government’s policy on cyberdefense — and Prime Minister Sanae Takaichi’s apparent prioritization of the issue — but warned that having a good plan in writing is only valuable if turned into prompt and decisive action.

“The processes and the policies put in place are a very good foundation, but they also reflect a world and a time that was slightly different than it is now,” Rogers said of Japan’s gradual rollout of cyberdefense legislation. “I think you have to accelerate the pace, and you have to be willing to make some changes.”

Japan’s Active Cyber Defense Act, which gives the police and cyberdefense teams new authority to combat cybercrime — including the ability to neutralize attackers’ servers during a cyberattack or preemptively before one — was first passed in May 2025, with major provisions only coming into effect at the beginning of this month. The full rollout of the law’s provisions is expected to be concluded in November 2027.

The government has declined to make public details of its response to individual data breaches, which have already begun to put citizens’ personal safety at risk. These open cases include data on 1.46 million driver’s licenses that were leaked from the servers of Park24’s Times Car share service and a standoff between GMO Internet Group and a hacker group that is threatening to publish the private information it harvested from the company if a $1 million ransom is not paid.

“If it takes you weeks and months to decide how you’re going to respond to significant cyber events, that is both inefficient and it makes it much less effective,” Rogers said, adding that Japan was essentially “undermining” its active cyberdefense plan by dragging its feet.

Japan is also not helping its case by keeping quiet on countermeasures, Rogers suggested. “I always used to tell people in my old world: ‘Look, we should feel comfortable telling people what we’re thinking about doing.’ What we want to protect is how we’re gonna do it, and those aren’t the same things,” he said.

Michael Rogers, a former commander of the U.S. Cyber Command and ex-director of the National Security Agency, says taking weeks and months to decide how to respond to significant cyber events is both inefficient and much less effective. | COURTESY OF MICHAEL ROGERS

Rogers, who is a senior executive adviser at Japan-based cybersecurity firm Nihon Cyber Defense and has spent decades engaging with Japanese military officials during his time in the U.S. Navy and as an intelligence chief, was reluctant to prescribe specific tactics, but identified potential areas for improvement, including poor cyber hygiene among network administrators in the private sector and Japan’s lack of skilled cybersecurity professionals.

Amid a global cybersecurity expert shortage — an urgent deficit of 4 million workers, according to the World Economic Forum — Japan’s Ministry of Economy, Trade and Industry (METI) reported that the country only had 24,000 registered cybersecurity specialists in 2025. METI has announced a target of taking this number to 50,000 by 2030.

By contrast, the United States is estimated by Cyber Seek, an interactive data tool that tracks the cybersecurity workforce, to have more than 1.3 million cybersecurity professionals.

At a news conference on Thursday, Chief Cabinet Secretary Minoru Kihara acknowledged the importance of securing cyberdefense professionals and noted that their salaries exceed those of general public servants. However, salaries are notably lower in Japan than in the U.S. — the U.S. Bureau of Labor cites the median salary for an information security analyst in 2025 at $129,180 per year versus ¥7 million ($44,340) to ¥9 million for a cybersecurity consultant in Japan, according to recruitment agency Robert Half.

“Clearly money will be part of the solution,” Rogers said. “This is bigger than a money problem.”

Rogers noted that the government bodies charged with fighting cybercrime, specifically the National Police Agency, is set up to address cyberattacks from a law enforcement perspective, which is more geared toward building a legal case against criminals than preventing cybercrimes.

Ultimately, he said, the goal should be to acquire the resources and know-how to anticipate attacks and warn the private sector of incoming threats.

“Part of deterrence is this idea of not only displaying intent and will, but also ensuring that the broader world understands that you have capabilities and that you are prepared to do these kinds of things,” said Rogers.