The Japanese government is considering introducing a sovereign cloud for highly classified information, but has not indicated any formal decision on a specific provider or type of cloud at this stage. The government plans to reach conclusions on procurement, contracting and operating methods by the end of 2026.
The Japanese government is formally considering a sovereign cloud concept for handling highly classified information and has set out a policy for introducing a cloud environment based on information security and autonomous operation. No specific US provider or product has been publicly identified at this stage, and the government remains in the phase of designing a procurement model that meets different requirements for each classification level.
The US Department of Defense has contracted with 4 companies through JWCC and is building commercial cloud environments that support everything from unclassified information to Secret and Top Secret. The UK Ministry of Defence has adopted a policy of expanding cloud use up to SECRET and TOP SECRET and is reportedly developing a Secret Community Cloud. These initiatives are precedents that may influence Japan’s deliberations.
The CLOUD Act is not understood to mean that the US government has unrestricted access to data. The relevant considerations include not only the location of the data but also legal jurisdiction and contractual terms. The UK-US data access agreement provides for the disclosure of information under specified investigative conditions and does not fully resolve the challenges surrounding data sovereignty.
The key issue for Japan’s highly classified sovereign cloud will be how to build a data platform aimed at enabling the use of AI and faster decision-making. It has been pointed out that, drawing on examples from Japan and overseas, 7 issues need to be examined, including data classification, key management, operational governance, the supply chain and an exit strategy.