The Defense Ministry is considering imposing penalties for low-security leaks involving contractors that develop defense equipment, as no such penalties currently exist.
The ministry hopes to compile the policy by the end of this year as part of efforts to strengthen data security amid a spate of cyberattacks on defense-related companies.
The five main types of classified information handled by the Ministry of Defense include (1) Special Defense Secrets, categorized based on a Japan-U.S. agreement for the protection of classified military information in the Mutual Defense Assistance Agreement; (2) Defense Secrets, designated under the Law on the Protection of Specially Designated Secrets; (3) Ministry of Defense Secrets, outlined in the ministry's internal regulations; (4) "controlled information;" and (5) "information to be kept within a ministry section."
Leaks of Special Defense Secrets and Defense Secrets carry criminal penalties, including up to 10 years in prison. Punishments in the form of damages for breach of contract can be imposed for leaking Ministry of Defense Secrets.
However, leaks of the remaining two types of information have carried no penalties, and companies have only been required to ensure that the data is protected.
In a cyberattack against Mitsubishi Electric Corp. that was uncovered in January, "controlled information" on the performance of an HVGP (Hyper Velocity Gliding Projectile) that the ministry planned to deploy for the defense of remote islands was allegedly leaked.
The ministry plans to include a penalty clause in contracts in order to hold contractors accountable for information leaks categorized either as "controlled" or "to be kept within a ministry section."
However, completely preventing cyberattacks is difficult. Strengthening penalties alone would only increase the burden on defense-related companies, making them reluctant to accept orders.
The ministry is determined to strengthen measures to protect information rather than leaving it up to companies to handle alone.
It will consider dispatching a joint unit of Ground, Maritime and Air Self-Defense Forces called the Cyber Defense Group to deal with cyberattacks that are deemed to be difficult for companies to manage.
Meanwhile, there have been cases in which confidential information has been included in materials provided by the ministry at the time of bidding, before contracts have been awarded, and also a case in which ministry information provided to a company for its study purpose was accessed illegally.
The ministry plans to implement harsher penalties for such leaks and also require companies to have stringent data security controls in place before awarding contracts.
Read more from The Japan News at https://japannews.yomiuri.co.jp/
