Key takeaways

  • In the week of October 20, 2026, two Japanese parties put forward emergency cybersecurity proposals. The ruling Liberal Democratic Party (LDP) handed Prime Minister Sanae Takaichi an 11-page plan titled "Prepare for AI saturation attacks", and Team Mirai, a newer party led by AI engineer Takahiro Anno, gave the digital minister seven sets of measures under the slogan "AI against AI".
  • They agree on more than the headlines suggest: AI for defense, better-paid government security experts, the My Number card for identity checks, deleting unneeded ID images, and help for small businesses and leak victims.
  • They differ on who carries the burden. The LDP centers on state capability: a cyber response headquarters led from the Prime Minister's office, attribution, takedowns and, controversially, considering the use of domestic communications data. Team Mirai centers on accountability: a cyber accident investigation board, security duties for vendors, fines for grossly negligent leaks, easier lawsuits, and legal protection for good-faith security research.
  • Tested against this year's breaches, where half of the largest have not said how the attackers got in and one in three hit a vendor, Team Mirai's proposals address those two gaps more directly. The LDP's carry far more weight, because it governs.
  • Both are proposals, not policy. The LDP's is the one the government has said it will act on.

Two proposals in four days#

LDP Team Mirai
Who The party's National Cybersecurity Strategy Headquarters, chaired by former digital minister Masaaki Taira Party leader Takahiro Anno and Diet affairs chief Takayama
Title "Proposal for a fundamental strengthening of cybersecurity: the eve of a cyber emergency, prepare for AI saturation attacks" "Emergency proposal to protect the public from AI-era cyberattacks and repeated data leaks: AI against AI"
Dates Compiled Oct 20, approved by the party Oct 22, handed to the Prime Minister Oct 23 Draft on Anno's blog Oct 12, handed to the digital minister Oct 23
Format Three-page summary, 11-page text with action items for 11 ministries and agencies Seven areas with about 20 measures, published as "version 1.0" to be updated
How it was made Party headquarters deliberations Draft published for comment, plus AI-run interviews with 1,562 people, 290 of them experts or businesses
Response The Prime Minister said the government would build a structure led from her office and speed up ministries' work Anno plans a cross-party study session with experts on November 4

We did not find formal proposals from other parties in the same period.

Who does what: the proposed headquarters, the NCO and JPCERT/CC#

The LDP's central demand, a cyber response headquarters (サイバー対処本部), is easy to confuse with bodies that already exist. In short:

What it is What it does in a breach wave like this one
JPCERT/CC An independent, non-profit coordination center, Japan's national computer emergency response team. Not a government agency Works with victims and others on the technical response, coordinates vulnerability handling with vendors, and publishes advisories such as its warning on this wave with attack patterns and IP addresses. It has no power to order anyone; organizations come to it voluntarily
National Cybersecurity Office (NCO) A government office in the Cabinet Secretariat, set up in July 2025 under the active cyber defense law Sets cyber policy and coordinates ministries. It receives incident reports from designated critical infrastructure operators, analyzes attack information, and issued its own warnings this month
Proposed cyber response headquarters A political-level body led from the Prime Minister's office, with the NCO as its secretariat Would meet quickly when serious damage occurs and push all ministries to act together. The LDP also wants the NCO to be able to direct ministries' initial response in serious incidents

In other words, the headquarters would sit above the NCO and give its work the Prime Minister's authority. It would not replace the technical work JPCERT/CC does with individual organizations, and the proposal does not change JPCERT/CC's role.

Where they agree#

  • AI on the defensive side. The LDP wants a "Project YATA-Shield" to use AI for finding and fixing vulnerabilities, and a direct line to OpenAI, Google and Anthropic to check government systems. Team Mirai wants guaranteed access to frontier models, test environments for open-weight models, and support for a domestic security AI model that keeps sensitive data in Japan.
  • People. Both want government pay rules that let agencies hire top private-sector security experts. The LDP's version is what became METI's AI penetration testing team at IPA.
  • Identity checks. Both want the My Number card's electronic authentication to replace uploaded photos of driver's licenses, after Times Car. The LDP goes further and asks the government to consider making the card compulsory. Team Mirai would promote it while keeping alternatives.
  • Keeping less data. Both want rules or guidance so companies stop keeping ID images they no longer need, a point we made in our analysis of data minimization.
  • Small businesses. The LDP would expand the government-backed Otasuketai service and build a shared 24/7 monitoring network for supply chain companies. Team Mirai would offer free vulnerability assessments and "subsidy tokens" for AI security tools.
  • Victims. Both want a one-stop route to the credit bureaus. The LDP talks of one-stop notification; Team Mirai of a free one-stop credit freeze that would make lenders hold new credit. The LDP also asks for a safe way to notify leak victims, since genuine notices are now hard to tell from phishing.

Where they differ#

Question LDP Team Mirai
Who leads A cyber response headquarters led from the Prime Minister's office, with the NCO as secretariat and authority to direct ministries in serious incidents A legal definition of large-scale cyber events, letting the state instruct businesses, grant temporary regulatory exceptions and send experts, for limited periods
Learning from incidents NCO to collect and analyze attack information and issue clear, unified advice; police to return attackers' techniques to companies A cyber accident investigation board with legal authority to investigate the causes of serious incidents; machine-readable advisories companies can check with AI
Vendors Help vendors improve their response; audit government cloud vendors; make products' and security providers' security levels visible for procurement Make secure design and vulnerability handling a vendor duty, starting with government procurement; move to memory-safe languages; for important systems, review before deployment and keep records of software components, maintenance contractors and access rights
Companies' duties Stricter management guidelines for listed companies, a CISO, incident response plans, better disclosure in securities reports Mandatory MFA and vulnerability testing, with a grace period; director liability; CISO as an expectation for listed companies
Penalties Strict enforcement by the privacy regulator against late or understated reports; publicize the new criminal penalty for attackers An administrative surcharge for serious leaks caused by gross negligence; consider statutory damages and opt-out class actions
Security researchers Train "white hackers" in government No punishment for good-faith vulnerability research; disclosure and bug bounty schemes
State powers Build active cyber defense capacity in the police and Self-Defense Forces; attribution and international takedowns; consider using domestic communications data Not addressed
Encryption Speed up post-quantum cryptography migration, citing 2030–2031 targets abroad; build a quantum key distribution network Privacy-enhancing technologies such as secure computation

Testing them against the data#

Our analysis of this year's 37 largest breaches found two things that matter most for policy: 18 of the organizations have not said how the attackers got in, and 11 of the breaches were at a vendor or platform holding other companies' customer data.

The silent notices. Team Mirai's accident investigation board is the most direct answer to the first problem. Like an aviation or rail accident board, it would investigate serious incidents with legal authority and publish lessons, regardless of what the company itself chooses to say. The LDP's answer runs through the government: the NCO aggregating information and the police sharing attackers' techniques. That can work, and JPCERT/CC's advisory with attack patterns and IP addresses shows how valuable it is when it happens. But it depends on what companies choose to share privately, and in the same week METI's minister said details collected from companies would not be disclosed because they could help attackers.

The vendors. Team Mirai's proposals on vendor duties, pre-deployment review and records of software components and maintenance contractors speak directly to the second problem: the breaches at Studio, email delivery services, e-commerce platforms and NEC's contractor. The LDP's measures in this area are softer: helping vendors improve, making security levels visible for buyers, and recommending the supply chain security rating scheme to large companies managing their contractors. Its strongest vendor item is for the government's own cloud.

The ID images. Both proposals respond to the Times Car breach, and both would push companies toward the My Number card. In our view, the more immediate gain is the part they share: not keeping images that are no longer needed. Times Car has already shown that the business case for keeping them did not survive a serious look at the risk.

Our analysis#

Capability versus accountability#

The two documents reflect different ideas of what is missing. The LDP sees a capability gap: Japan needs a headquarters to direct the government's response, better intelligence, AI, people and the power to act against attackers. Team Mirai sees an accountability gap: the costs of weak security fall on the people whose data leaks, not on the companies and vendors that could have prevented it, so it proposes duties, fines, lawsuits and an independent investigator.

In our view, Japan needs both, but this year's breaches point more often to the second. Most were not sophisticated state operations. They used known vulnerabilities, exposed APIs and admin functions, often found faster with AI. A headquarters can make ministries move faster, but it does not make a company patch, delete data it no longer needs, or tell others what went wrong.

Two proposals to watch closely#

Two items deserve more debate than they have received.

The LDP asks the government to consider using domestic communications data to prevent damage, where the foreign-related data allowed under the active cyber defense law is not enough. That law limited the government to communications with a foreign link, with an independent commission overseeing its use, precisely because of privacy concerns. Extending it to purely domestic communications would be a significant change, and it would need a clear case that the existing powers have fallen short.

Team Mirai's legal safe harbor for good-faith research would change how Japan treats people who find and report flaws, which today can expose them to the Unauthorized Access Prohibition Act. It fits a point we made about the government's new team: what separates ethical hacking from crime is permission and rules, and a clear legal route for good-faith research would put those rules in law.

Who will act#

The LDP governs, and the Prime Minister has already said she will act on its proposal; parts of it, such as the IPA team, are already under way. Team Mirai's proposals will need allies. Some overlap with the LDP's and could move on that basis, such as identity checks, data minimization and help for victims. Others, such as fines, class actions and an independent investigation board, would change who pays when things go wrong, and are likely to meet more resistance from business.

What this means for readers#

  • If you run security for a Japanese company, expect more pressure on disclosure and governance under either proposal: securities report disclosure and stricter guidelines from the LDP, or director liability and fines from Team Mirai. Neither is law yet.
  • If you are a vendor, watch the procurement rules. Both parties would start there: the LDP by making security levels visible to buyers, Team Mirai by making secure design a requirement.
  • If you collect ID images, plan to stop keeping them once checked. Both parties want it, and in our view it is one of the items most likely to move first.
  • If you find vulnerabilities, follow the safe harbor debate. It would be the first legal protection of its kind in Japan.

Japanese terms at a glance#

Japanese Reading Meaning
緊急提言 kinkyū teigen Emergency proposal
サイバー有事前夜 saibā yūji zen'ya "The eve of a cyber emergency"
AIのサイバー飽和攻撃 AI no saibā hōwa kōgeki AI cyber saturation attack
サイバー対処本部 saibā taisho honbu Cyber response headquarters (proposed)
サイバー版事故調査委員会 saibā-ban jiko chōsa iinkai Cyber accident investigation board (proposed)
課徴金 kachōkin Administrative surcharge, a fine-like penalty
善意の脆弱性調査 zen'i no zeijakusei chōsa Good-faith vulnerability research
信用凍結 shin'yō tōketsu Credit freeze