Key takeaways

  • On October 27, 2026, Japan's Ministry of Internal Affairs and Communications (MIC) asked telecom carriers, through their industry groups, to block access to the site where the attackers in the GMO Internet breach had posted what they said was customer data, according to TBS and major newspapers.
  • Site blocking means a carrier checks where each user is trying to connect and refuses connections to listed sites. In Japan, that runs into the secrecy of communications, protected by the Constitution and the Telecommunications Business Act. It has been used only for child sexual abuse material, by voluntary industry action since 2011, and was the subject of a bitter fight over manga piracy in 2018.
  • This is the first time, as far as we know, that the government has asked for blocking to protect the victims of a data breach. The carriers have not said whether they did it. The site went offline on October 28, after its domain was suspended, so blocking may never have been needed.
  • In our view, the request mattered more as a precedent than as a measure. It was made by a written request, without a legal basis, in a fast-moving case, and nobody has explained who decided, on what criteria, or what the carriers did.

What the ministry asked#

According to TBS, MIC sent a written request on October 27 to telecom industry groups, including the Telecommunications Carriers Association, whose members include the major carriers. The Yomiuri Shimbun quotes the request as citing a realistic risk that misuse of the published information would spread secondary harm, and asking, "in view of the scale of the social impact of this case," that the sites carrying it be blocked.

The carriers have not said whether they acted. A senior executive at a major carrier told the Yomiuri that the decision was "difficult". Chief Cabinet Secretary Kihara said on October 29 that the government had had "various exchanges" with carriers, but declined to give details of an ongoing case.

The site went offline before any of this became public. GMO said it confirmed at about 04:00 on October 28 that the domain of the attackers' site, including mirrors, had been stopped, after working with "related businesses". The Nikkei's assessment is that, as a result, blocking was in effect never triggered.

Why blocking is a big step in Japan#

Blocking is not like taking down a site, which is done by the site's host or domain registrar. To block, an internet provider has to look at where every user is connecting, through DNS queries or similar, and refuse the connections to the listed sites. That touches every user, not only those who would visit the site.

Japan protects the secrecy of communications in Article 21 of the Constitution and in the Telecommunications Business Act, and the destination of a connection is treated as part of that secret. Carriers can only do this kind of thing with users' consent or where a legal justification applies.

2011: child sexual abuse material#

The only established use is against child sexual abuse material. After several years of debate, internet providers began blocking listed sites in April 2011, using a list maintained by an industry body, the Internet Content Safety Association. The legal justification is necessity (kinkyū hinan): the harm to children is grave and ongoing, and there is no other effective way to stop it. Even then, the arrangement is voluntary, and it took years of discussion to set up.

2018: manga piracy#

In April 2018, the government's Intellectual Property Strategy Headquarters decided on an "emergency measure" against piracy sites, naming three, including Mangamura, as candidates for voluntary blocking. The NTT group announced that it would block them as a temporary step and asked the government to legislate. Telecom industry groups warned that it would violate the secrecy of communications and could amount to censorship, and lawsuits followed. A government study group then tried to agree on a law for blocking, but in October 2018 it could not even produce an interim report, and the discussion was postponed indefinitely.

2026: online casinos#

The question returned this year over illegal online casinos. A MIC expert panel judged blocking to be effective but said legal issues remain, and recommended keeping it as an option and continuing to examine it. According to Jiji Press, its report in July said that before blocking, it should be checked whether less restrictive means had been exhausted.

What is different this time#

A new kind of target. Child abuse images and piracy sites are blocked because the content itself is illegal and keeps causing harm. Here, the content is stolen personal data posted to pressure a company. The harm to the people in the data is real, but it is a different justification from either precedent.

A request, not a law. As in 2018, the government asked; it did not order. There is no statute that lets MIC require blocking, and no public criteria for when it should be asked for. The carriers are left to decide whether they can rely on necessity.

Speed, without explanation. The request was dated the same day the data appeared, and became known two days later through newspapers. MIC has not published it. We do not know which sites were listed, how long blocking would have lasted, or what the carriers did.

Less restrictive means worked. The site went down through its domain, after GMO worked with "related businesses". That is exactly the kind of less restrictive measure the online casino panel said should be tried first.

Our view#

The precedent matters more than the outcome. In this case, blocking may never have been used. But a ministry has now asked carriers to block a site to protect breach victims, by letter, without a legal basis, and without saying so publicly. The next time a leak site appears, the same request will be easier to make, and the next target may be less clear-cut.

If blocking is to be used, it needs rules. In our view, the right place to decide when the secrecy of communications can be set aside is the Diet, with criteria, oversight and transparency, as the active cyber defense law did for police operations against attack servers. A request letter during a crisis is the opposite.

Takedowns first. For most leak sites, the faster and narrower route is the one that worked here: the domain registrar, the hosting provider and, where needed, foreign authorities. Blocking in Japan does not stop anyone using a VPN or a foreign resolver, and does nothing about copies elsewhere.

Victims still need protecting. None of this means the government should do nothing. The people whose data was published face real risks, and the ministry was right to treat that seriously. The question is how, and on what authority.

What this means for readers#

  • If you work at a carrier or ISP, expect more such requests, and agree internally in advance who decides, on what legal basis, and how you will be transparent about it.
  • If your company suffers a leak and the data is posted, focus on takedown through the registrar and host, warn customers not to visit or share the site, and work with the police. Do not count on blocking.
  • If you follow Japanese internet policy, watch whether MIC publishes the request or guidance on future cases, and whether the online casino debate turns into legislation that covers other kinds of sites.

Japanese terms at a glance#

Japanese Reading Meaning
ブロッキング burokkingu Site blocking
通信の秘密 tsūshin no himitsu Secrecy of communications
緊急避難 kinkyū hinan Necessity (legal justification)
要請 yōsei Request (not an order)
電気通信事業者協会 denki tsūshin jigyōsha kyōkai Telecommunications Carriers Association
海賊版サイト kaizokuban saito Piracy site
テイクダウン teikudaun Takedown