The US warned Japan over the course of a year that Chinese state hackers had infiltrated its defense networks before Tokyo took sufficient action to try to secure them, according to current and former US officials.

Senior US national security officials grew increasingly concerned that sensitive information that the US shares with some allies could be at risk as a result of the breach, which was discovered several years ago. That prompted multiple US delegations since 2020 to fly to Tokyo to warn Japan, according to the officials, who asked not to be identified discussing the sensitive matter.

Still, the US saw insufficient evidence Japan was taking action to secure its networks despite warning of a problem, said a former intelligence official. General Paul Nakasone, director of the National Security Agency and commander of US Cyber Command, was among US officials who visited Tokyo to flag the issue.

But Japan wanted proof of the infiltration, said the former official, who added that intelligence is sometimes too sensitive to share specifics. Japan also was reluctant to let the US into its networks, the former official said.

Only after Anne Neuberger, deputy national security advisor for cyber and emerging technology, visited Japan in mid-November 2021 did the US and Japan chart a successful way forward, according to the officials. Japan has since set about boosting its cybersecurity defenses, although the US is eager to see it do still more, according to statements from both countries this year, in addition to national security experts.

The breach and the US warnings were reported earlier by the Washington Post, which cited multiple current and former US and Japanese officials it didn’t identify.

‘Not Confirmed’

Yasukazu Hamada, Japan’s defense minister, declined to comment on the Washington Post report, telling reporters in Tokyo on Tuesday that it doesn’t comment on individual cyberattacks and how they are handled.

“I won’t comment on the details due to the nature of the matter,” Hamada said. “We have not confirmed that classified information held by the Defense Ministry has been leaked due to a cyberattack.” The Embassy of Japan in Washington didn’t immediately respond to messages requesting comment.

Tensions between the US and China are increasing due in part to concerns of a potential Chinese invasion of Taiwan, which would likely be accompanied by cyberattacks, particularly in the early stages.

In 2019, the US and Japan agreed that a cyberattack against either country in Japan could, in certain circumstances, constitute an armed attack. The US has about 56,000 troops based in Japan, according to the US Defense Department.

In August 2021, Yasuhide Nakayama, who was then Japan’s state minister of defense, said he and Nakasone were “opening a new chapter in our joint efforts in cyberspace” as part of a visit to US Cyber Command to discuss security challenges in cyberspace and bilateral cooperation, according to US Cyber Command.

Japan established a Cyber Defense Group in 2014, as part of its Self-Defense Forces. But amid a growing spate of cyberattacks, it reorganized and launched a full cyber defense command in March 2022, along with a commitment to engage in offensive cyber operations and plans to expand to 4,000 people by the end of 2027, according to Japan’s Ministry of Defense.

In addition to visits to Japan by both Nakasone and Neuberger, then National Cyber Director Chris Inglis also visited Japan in December 2022.

In a statement provided to Bloomberg News, the US Defense Department described the US-Japan Alliance as the cornerstone of peace and security in the Indo-Pacific and said it was strengthening cyber cooperation as part of “Alliance modernization efforts”.

In January, the US and Japan agreed to “intensify collaboration to counter increasingly sophisticated and persistent cyber threats” following security talks to strengthen the alliance in Washington DC.

“The United States welcomed Japan’s initiatives to bolster its national cybersecurity posture,” said a joint statement, citing the creation of a new organization to coordinate whole-of-government cybersecurity policies and a new framework set to “provide a foundation for a wider range of US-Japan cooperation.”

--With assistance from Isabel Reynolds.