Japan-U.S. security talks likely to highlight Tokyo's cyber-defense woes
By Ruairidh Villar TOKYO (Reuters) - Top U.S. security officials meet their Japanese counterparts on Thursday as concerns are growing that the hosts cannot protect themselves from malicious internet hackers. Cyber security is on the agenda when the military and diplomatic chiefs of the two countries hold their first joint meeting in Japan. But even Japanese officials acknowledge they cannot keep up with the proliferating threat of attacks on computer networks from private or state-sponsored hackers. "Cyber attacks are getting more and more sophisticated, and sometimes we cannot defend against them using the systems we currently have in place," said Kazunori Kimura, the Defense Ministry's director of cyber-defense planning. "I don't have enough people, equipment or money to do the job," Kimura told Reuters TV. "Attacks using viruses have become increasingly difficult to detect." Attacks so far appear mostly to have allowed intruders to snoop and steal files, experts say. But the attacks could become more dangerous, paralyzing essential computer or communications systems. Japan's lack of effective cyber defense overhangs Thursday's meeting of Secretary of State John Kerry and Defence Secretary Chuck Hagel with their counterparts, Foreign Minister Fumio Kishida and Defense Minister Itsunori Onodera. The "2+2" meeting aims to set a framework for revising the treaty allies' security guidelines to "update and renovate them" in line with "new challenges" that have arisen in the more than 15 years since the Cold War-era agreement was first revised, said a senior State Department official. This includes co-operation in space and cyberspace, where the two sides are seeking agreement on "enhanced information security," the official told reporters en route to Tokyo. The Japan-U.S. Security Consultative Committee Meeting comes at a delicate time for both countries' relations with China, a country often accused of being a leading proponent of internet hacking. U.S. relations with China have been strained by Washington's accusations that Beijing engages in cyber theft of trade secrets. China rejects the accusations and is itself angered by revelations by fugitive former U.S. spy agency contractor Edward Snowden of U.S. electronic surveillance activities in China and Hong Kong. At the same time, relations between Japan and China are at their lowest ebb in years over disputed islands in the East China Sea controlled by Japan. Japan suffered well publicized cyber attacks in the past, such as breaches of parliament and military contractor Mitsubishi Heavy Industries Ltd in 2011. In fact, attacks on the Japanese government are continuing constantly. Government networks were hit by some 3,000 potential attacks a day in 2012, more than double the number of previous year, says the Cabinet Secretariat, which staffs a small, 24-hour cyber-surveillance team. "The Defense Ministry gets hacked every day, but all they do is watch and then after the fact simply report that there has been an attack," said an outside contractor for the ministry, who declined to be identified because of the sensitivity of discussing the issue. Partly this is a result of Japanese laws that do not allow victims to "hack back" at cyber-attackers. "We can't even investigate who is doing the hacking," said Itsuro Nishimoto, chief technical officer at LAC Co, a Tokyo-based IT security firm that says it monitors 750 clients, including government entities and businesses. But the outside contractor said the problem runs much deeper. "There's no one at the Defense Ministry who understands cyberspace," he told Reuters TV. "It's more than a problem of money or staff - they just don't have any interest in it." Japan has taken some steps to beef up its cyber defense, such as setting up a Cyber Security Group in the Defense Ministry, expected to be operational next year. The ministry and Japan's military "are developing intrusion-prevention systems and improving security and analysis devices for cyber defense," according to this year's defense white paper, although it says further enhancements are needed to keep up with the escalating threat. The Defense Ministry is seeking a budget increase to centralize its loose array of about 100 cyber analysts. But so far it only monitors its own internal network, which safeguards secrets from ballistic missile-defense to joint technology development with the United States. Japan's friends are wary. "We've got some concerns about Japan's cyber security," said a British official involved in cyber security. London and Tokyo recently signed a joint weapons-development treaty. "Japan has the structures in place - it's very good at that," the official said. "But it needs more situational awareness. It has zero capability." (Additional reporting by Lesley Wroughton and Kiyoshi Takenaka; Writing by William Mallard; Editing by Neil Fullick)
