The United States has announced that it signed a framework allowing private-sector companies to conduct cyberattacks overseas under their own command. A series of attacks on Japanese companies has also been reported, drawing attention to future developments.
The US government is reported to have signed a National Security Presidential Memorandum allowing private-sector companies that pass a screening process to conduct cyber surveillance operations and cyber effects operations against overseas cybercrime organizations under government direction and supervision. The targets are cross-border criminal groups targeting the United States through ransomware, phishing, financial fraud, sextortion and other activities. The framework applies only to organizations that are not foreign government agencies or organizations under their complete command.
In Japan, it has been reported that a ransomware attack on Nichirei affected its logistics network and that stolen data was published on the dark web. Asahi Group Holdings has also previously suffered a similar attack, which halted production lines and logistics-related systems. In 2024, the KADOKAWA Group was hit by a cyberattack, leading to a prolonged suspension of the Niconico video service.
As part of Japan's legal framework, the Cybersecurity Response Capability Enhancement Act was enacted in 2025, requiring information sharing between private-sector infrastructure operators and the government. At present, however, only the police and Self-Defense Forces are able to access attackers, and a system operated in the same way as the US framework is considered difficult to implement in the short term. Over the medium to long term, some observers believe there may be scope to consider using private-sector resources under government supervision.