ACTIVE CYBER DEFENSE AND CONSTITUTIONAL DETERRITORIALIZATION: CONSTRUCTING NORMATIVE EXCEPTIONS IN JAPAN (2022-2025)

Abstract

In the context of escalating cyber threats, the protection of
critical infrastructure has acquired particular significance for Indo-Pacific states.
In May 2025, the Japanese Parliament adopted the Active Cyber Defense Act,
for the first time granting the government authority for preventive monitoring
of communications metadata, remote access to attacker infrastructure, and
neutralization of malicious servers abroad. The adoption of the law was preceded
by a five-year cyber espionage campaign by the Chinese group MirrorFace,
which conducted over 200 attacks against the Ministry of Foreign Affairs, the
Ministry of Defense, the Japan Aerospace Exploration Agency, and a number
of politicians. The present study examines this law not as a linear expansion of
defense powers, but as a structural rupture in which cyberspace is constructed
as a domain beyond constitutional constraints. The novelty of the research lies
in analyzing the law through the prism of the Copenhagen School securitization
theory and the cyber-securitization concept of Hansen and Nissenbaum. The
article employs methods of discourse analysis, process-tracing, and comparative
analysis of the four pillars of the law. The results demonstrate that the technification
of threat serves as the key mechanism of depoliticization, enabling the removal
of preventive cyber operations from the jurisdiction of Article 9 without formal
constitutional revision, thereby creating a precedent for analogous processes in
other technological domains. The practical significance of the findings lies in
identifying a model of constitutional transformation applicable to the analysis of
emerging security challenges in cyberspace, autonomous weapons systems, and
electromagnetic spectrum operations.