The CCEL and the Thin Line Between Cyber Defence and Pre-emption: Japan's Legal and Strategic Pivot

The CCEL and the Thin Line Between Cyber Defence and Pre-emption: Japan's Legal and Strategic Pivot

Speakers: Andrea Monti, Adjunct Professor, Leonardo da Vinci University and Sapienza University of Rome

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=kOvrC8gQZ8

Overview

In an increasingly digitized and interconnected world, the traditional boundaries between cyber defense, intelligence operations, and law enforcement are rapidly eroding. Andrea Monti's talk, "The CCEL and the Thin Line Between Cyber Defence and Pre-emption: Japan's Legal and Strategic Pivot," delves into the profound legal and strategic implications of this shift, particularly through the lens of Japan's recently enacted Cyber Security Basic Act amendment, commonly referred to as the CCEL (Cyber Countermeasure Enabling Law). Monti, an adjunct professor specializing in cybersecurity law, dissects how semantic reinterpretations of "cyber security measures" are being leveraged by states, including Japan and Italy, to justify actions that, in traditional legal frameworks, would be considered offensive or even acts of war.

The core of Monti's argument centers on the growing reliance of governments on the private sector for advanced cyber capabilities, often for operations that require plausible deniability. This outsourcing strategy, while offering states flexibility, places private companies in a precarious legal position, exposing them to significant risks such as criminal liability or extradition requests from hostile jurisdictions. The talk meticulously unpacks the complexities arising from blurred lines of attribution, national sovereignty, and the pragmatic functions of information warfare, urging both public and private entities to confront the evolving legal landscape with heightened awareness and proactive measures.

This presentation is highly relevant for policymakers, legal professionals, incident responders, and cybersecurity executives navigating the intricate ethical and legal challenges posed by state-sponsored cyber operations. It highlights a global trend where nations are strategically adapting their legal frameworks to project power in cyberspace, often pushing the boundaries of international law and traditional notions of sovereignty, with profound consequences for all stakeholders involved.

Background

▶ Watch: Introduction and talk agenda (0:00)

The evolution of cyber capabilities has fundamentally challenged the traditional concept of state monopoly on force. Historically, states held exclusive power over military and law enforcement actions, making it difficult for private entities to amass comparable physical power. However, the advent of digital technologies has served as an equalizer, enabling non-state actors, such as sophisticated ransomware gangs like REvil, to achieve capabilities once exclusive to nation-states. This shift has necessitated a re-evaluation of how national security and defense are managed in the digital domain.

Monti highlights that the private sector has become an indispensable, yet legally ambiguous, partner for governments in cyber operations. This partnership is driven by two primary factors: the superior technical capabilities often found in the private sector and the need for plausible deniability for sensitive state-sponsored activities. The REvil case, cited as a rare publicly documented investigation, exemplified this public-private alliance, where the FBI, NSA, military, and private sector collaborated in a "hack-back" operation to dismantle the ransomware network. This operation, while successful, immediately raised questions about its legality, setting the stage for discussions around the legitimacy of such actions.

The problem is further exacerbated by a deliberate semantic ambiguity surrounding terms like "cyber security" and "cyber warfare." While "cyber security" traditionally implies defensive, neutral, and technical measures, "cyber warfare" evokes aggression, geopolitical stakes, and state-level conflict. States are increasingly exploiting this linguistic fluidity to reframe offensive cyber operations as "defensive reactive actions" or "active cyber security measures," thereby sidestepping challenging legal and political hurdles. This strategic re-labeling allows nations to engage in pre-emptive or retaliatory cyber actions without officially declaring an act of war, maintaining operations "below the threshold of a formal act of war" and avoiding the public relations fallout associated with kinetic conflicts. Japan's constitutional limitations under Article 9, which restricts offensive military capabilities, further contextualizes its strategic pivot to active cyber measures, illustrating a broader global trend of legal reinterpretation to adapt to new geopolitical realities.

Key Findings

▶ Watch: How terminology shapes cyber conflict perception (8:10)

Andrea Monti's analysis reveals several critical findings regarding the convergence of cyber defense and pre-emption:

• Outsourcing and Plausible Deniability: Cyber security, particularly advanced and potentially offensive operations, is increasingly outsourced to private firms. This trend is driven by the private sector's superior technical capabilities and the inherent need for governments to maintain plausible deniability for sensitive or legally ambiguous actions.
• Semantic Reframing as a Political Tool: A significant finding is the deliberate exploitation of linguistic ambiguity by states. By framing offensive actions as "cyber security measures" or "active defense," nations can legitimize operations that would otherwise be considered hostile or illegal under international law. This reframing allows states to bypass traditional legal constraints and avoid direct escalation.
• Sovereignty Infringement through "Hack-Back": The practice of "hacking back," particularly when targeting infrastructure located in another sovereign country, constitutes an infringement of that country's sovereignty. Even when disguised as "active cyber security measures," such cross-border operations, if unauthorized by the receiving nation, violate established international legal norms like mutual legal assistance treaties.
• Japan's Strategic Pivot: The CCEL law in Japan, alongside proposed restructuring of its intelligence services (moving them under the Prime Minister's cabinet), signifies a major strategic shift. This pivot aims to provide a legal framework for offensive cyber capabilities, effectively allowing Japan to conduct "active cyber security measures" that originate from abroad, thereby navigating the limitations imposed by Article 9 of its constitution which traditionally restricts offensive military actions.
• Legal Peril for the Private Sector: Private companies cooperating with state-led cyber operations face significant legal risks. Without specific legal immunity provisions, their involvement in "active cyber security measures" could be deemed criminal under various jurisdictions, potentially leading to extradition requests or criminal charges. This underscores a critical gap in legal protection for private entities engaged in what governments define as national security operations.
• Attribution Dilemma and Escalation: The inherent difficulty in definitively attributing cyber attacks to specific state actors (attribution problem) is a major policy challenge. Publicly attributing an attack to a state actor forces an escalation, potentially to an "act of war," which most nations seek to avoid. This dilemma often leads to a preference for covert or deniable retaliatory actions.
• Incident Response as Strategic Decision: For the private sector, incident response decisions, especially those involving any form of active defense or "hack-back," now carry profound strategic implications beyond mere technical remediation. These decisions can inadvertently entangle companies in geopolitical conflicts or expose them to legal liabilities.

Technical Deep Dive

▶ Watch: Attribution problem: When cyberattacks become acts of war (16:00)

Monti's technical deep dive is less about specific code or exploit details and more about the legal and strategic architecture underpinning modern cyber operations, particularly the mechanisms states employ to justify and execute actions in the gray zone between defense and pre-emption.

The central technicality discussed is the semantic reframing of cyber activities. Traditionally, "cyber security" is perceived as a neutral, defensive, and purely technical endeavor, focusing on protection and resilience. However, Monti explains how states are actively redefining this term to encompass "active cyber security measures" or "pre-emptive actions" that are, in essence, offensive operations. This linguistic manipulation provides political legitimacy for actions that would otherwise be classified as cyber warfare, which implies aggression, geopolitical intent, and potential acts of war. The speaker emphasizes that while the terminology changes, the underlying nature of a hostile attack or crime remains the same.

A key mechanism enabling this reframing is the strategic use of plausible deniability. Governments often outsource offensive cyber capabilities to the private sector not only for technical expertise but also to create a buffer that allows them to deny direct involvement. This "gray area" of private operations is crucial for maintaining relationships and avoiding international incidents. Monti references the EncroChat investigation, where French and Dutch police, in cooperation with secret services, deployed a fake update to inject Trojan horses into devices used by criminals. This operation was justified under a specific article of the French criminal procedural code, "secret def," which allowed the concealment of investigative techniques and methods, thereby maintaining deniability regarding the full extent of state-sponsored hacking. This highlights how legal frameworks can be adapted to obscure the true nature of cyber operations.

The attribution problem is another critical technical and strategic challenge. While security experts can often link attacks to state-sponsored actors with high confidence, publicly announcing such attribution is fraught with geopolitical risk. A definitive public attribution could be tantamount to declaring an "act of war," compelling states to escalate. The speaker notes that cyber attacks, unlike kinetic attacks, offer states a way to achieve strategic goals like disruption, destabilization, and coercion without the public relations fallout of casualties or overt military action. This allows operations to remain "below the threshold of a formal act of war," providing a strategic advantage for influence and deterrence.

Japan's CCEL law serves as a prime example of a legal framework designed to facilitate these "active measures." This law, like similar legislation in Italy, provides a domestic legal justification for conducting cyber operations that originate from abroad. From a traditional legal standpoint, such cross-border actions, if unauthorized by the target country, constitute an infringement of national sovereignty. International legal principles, such as mutual legal assistance treaties, dictate official channels for investigations across borders. The CCEL, by allowing "active cyber security measures" against threats originating from outside Japan, effectively blurs the lines between law enforcement, intelligence, and defense operations, creating a unified response capability that bypasses these traditional international legal protocols.

Monti also connects the CCEL with Japan's broader strategic pivot, specifically the proposed restructuring of its intelligence services. Currently under the Ministry of Justice, the plan is to move intelligence under the Prime Minister's cabinet, aligning Japan with the intelligence structures of many other major powers. This shift, coupled with the CCEL, is interpreted as an attempt to "override the limitation of Article 9 of its constitution," which prohibits Japan from having offensive military capabilities. By reframing offensive cyber operations as "defensive" or "active cyber security measures" within a new legal and organizational structure, Japan aims to project state power in cyberspace while maintaining a defensive narrative internationally. This legal reframing is a sophisticated mechanism to avoid international escalation while pursuing national security objectives through cyber means.

Demo / Proof of Concept

▶ Watch: Japan's CCEL and Article 9 constitutional pivot (25:00)

This talk focused on the intricate legal and policy implications of advanced cyber operations rather than demonstrating specific technical exploits or proof-of-concept tools. As such, no live demo or technical proof-of-concept was presented during the session.

Defensive Implications

▶ Watch: Mitigation strategies for private sector involvement (34:00)

The blurring lines between cyber defense and pre-emption, particularly with state involvement, carry significant implications for the private sector and national cybersecurity strategies. Defenders must adopt a multi-faceted approach, integrating legal, strategic, and technical considerations.

First, private companies must exercise extreme caution regarding plausible deniability. While cooperation with state agencies in dismantling criminal networks is often beneficial, publicizing such involvement can backfire. Marketing materials boasting about "cooperation in dismantling this cyber security criminal network" could attract unwanted attention from hostile countries, leading to claims of criminal involvement and potential extradition requests for company personnel. Companies should maintain discretion and avoid self-incrimination.

Second, incident response decisions now have profound strategic implications. Before undertaking any "hack-back" activity or what might be termed "active defense" as part of a private cyber security policy, companies must thoroughly assess the geopolitical and legal ramifications. Such actions are not merely technical; they can infringe on national sovereignty, escalate conflicts, and expose the company to significant liability. This necessitates a shift from purely technical incident response to a more holistic, legally informed strategic response.

Third, forensic due diligence is paramount. To justify any actions taken and to defend against potential accusations of criminal activity, companies must maintain meticulous forensic evidence. Every decision and action, particularly those involving active measures, must be documented with sound evidence to prove legitimacy. This requires integrating robust forensic practices into all incident management processes.

Fourth, the private sector should anticipate a growth of state requests for cooperation. In many countries where public cyber security apparatuses are less developed, governments will increasingly lean on private sector expertise. Companies must be prepared to cooperate in a safe and legally sound manner, understanding that without specific legal immunity provisions, they remain accountable for their actions. This necessitates careful internal policy development and legal review.

Fifth, contractual drafting becomes an essential mitigation strategy. By carefully designing contractual obligations, companies can attempt to shift the burden of liability for their actions. This is a complex task that requires specialized legal expertise. Furthermore, supply chain security is critical; minimizing the number of third-party vendors and assessing their security posture is vital, as smaller companies or solo professionals may represent weak links more susceptible to pressure or leaks of sensitive information.

Sixth, companies must review relationships with all vendors and cybersecurity partners. Unintended disclosures of classified or sensitive information can occur through routine marketing or technical communications. Internal policies, not just in legal departments but across technical teams, must be revised to prevent such leaks.

Seventh, legal review must be involved from the beginning of any government request for intervention or any CISO-ordered "retaliation." This proactive engagement ensures that decisions are legally sound and compliant. The speaker advocates for a "different kind of lawyer"—one who is fast, understands technology, and is passionate about bridging the gap between law and tech—to provide real-time, effective legal advice during cyber incidents.

Finally, senior management training is crucial. Often, senior leadership views cybersecurity as a purely technical matter. However, recent regulations, such as the EU's NIS Directive, impose specific liabilities on CEOs and senior executives for cybersecurity failures. This provides a strong incentive for management to understand the strategic and legal implications of cyber risk, including the outcomes of incidents like the Shadow Brokers leaks, which can expose company vulnerabilities or confidential government cooperation, leading to class actions or reputational damage. By integrating active cyber security measures into standard incident management processes, companies can ensure a coherent chain of command and reporting, while also minimizing the amount of sensitive information stored to limit potential future liabilities.

Key Takeaways

• Semantic Reinterpretation is a Geopolitical Tool: States are strategically redefining "cyber security" to legitimize offensive actions as "active defense" or "pre-emptive measures," blurring the lines between crime, defense, and acts of war for political expediency and plausible deniability.
• Hacking Back Carries Significant Legal Risks: Engaging in "hack-back" operations, especially across national borders, infringes on the sovereignty of other nations and can expose private companies to criminal charges, extradition, and civil liability without specific legal immunity.
• Japan's CCEL Marks a Strategic Pivot: Japan's Cyber Countermeasure Enabling Law (CCEL) and proposed intelligence reforms indicate a deliberate move to establish a legal framework for offensive cyber capabilities, challenging constitutional limitations (Article 9) and traditional international legal norms.
• Private Sector Requires Robust Legal Safeguards: Companies cooperating with state-led cyber operations must implement stringent contractual agreements, internal policies, and legal oversight from the outset to mitigate accountability risks and protect themselves from potential legal repercussions.
• Integrated Legal and Technical Strategy is Essential: Effective cybersecurity for the private sector now demands a holistic approach, integrating legal expertise with technical incident response, rigorous forensic documentation, and strategic awareness from senior management.
• Attribution Remains a Complex Dilemma: The inherent difficulty in definitively attributing cyber attacks to state actors complicates international response, often forcing states to operate below the threshold of formal warfare to avoid unwanted escalation.

About the Speaker(s)

Andrea Monti is an Adjunct Professor at Sapienza University of Rome and Leonardo da Vinci University, where he teaches cyber security, digital identity, and privacy. As a lawyer, Monti has a unique perspective, having been actively involved in the Italian hacking community since its early days. He has authored several books on these topics, including "Spaghetti So Far: The History of Italian Hacking Community," which chronicles his personal experience. His legal practice began with defending individuals he refers to as "smart kids that didn't like to have closed door," now known as computer criminals. This blend of technical background, legal expertise, and historical involvement in the hacking scene provides him with a deep and nuanced understanding of the intersection between technology, law, and policy in the cybersecurity domain.