Renouncing the Cyber War: Japan’s Risk-Based Approach to Cybersecurity

Article 9 of Japan’s constitution renounces war and allows the use of military force only in self-defense. Thus, Japan can neither use the growing number of cyber tools available to other state actors, nor can it fully adopt the same threat-based approach to its national security narrative. This article addresses a gap in the literature by examining the case of a state that possesses technology, resources, and capabilities but is unable to adopt a threat-based security logic. Using discourse and content analysis methods, I show how Japan has constructed its cybersecurity narrative within a risk-based security framework. I also trace the changes that Japan’s cybersecurity narrative has undergone and explain how cyber risks and narrative constraints have influenced the cyber policymaking process in Japan.