← News Topics
Intermediate

Who Can Stop a Cyberattack?

Day 1: What Can a Government Do That a Company Cannot?

サイバー攻撃を止められるのは誰か ― 第1日：政府は企業にできない何ができるのか

28 October 2026

Monitors with abstract network maps and alert indicators on an operations desk beside a Japanese flag and padlock, with soft server lights behind

In October 2026, GMO Internet reported a breach of its cloud service. Some customers said they had seen unauthorized activity in their trading accounts. GMO shut down the affected service and asked the Japanese government to consider active cyber defense. It wanted the authorities to act against computers used to direct the attack.

2026年10月、GMOインターネットは、自社のクラウドサービスの侵害を報告しました。一部の顧客は、自分の取引口座で不正な操作を見たと言いました。GMOは影響を受けたサービスを停止し、日本政府に能動的サイバー防御を検討するよう求めました。攻撃を指揮するために使われたコンピュータに対して、当局に行動してほしいと考えたのです。

GMO had already taken steps to protect its customers. It disconnected the affected servers from the internet and asked financial firms to block suspicious access. These were prompt, deliberate actions. GMO could control its own servers and ask others to cooperate. But it could not simply log in to a server outside its network and stop what was happening there.

GMOはすでに、顧客を守るための措置をとっていました。影響を受けたサーバーをインターネットから切断し、金融機関に疑わしいアクセスを遮断するよう求めました。これらは迅速で、意図的な行動でした。GMOは自社のサーバーを制御でき、ほかの組織に協力を求めることができました。しかし、自社ネットワークの外にあるサーバーに単にログインして、そこで起きていることを止めることはできませんでした。

Imagine that harmful commands are coming from a server abroad. That server is part of the attack’s infrastructure, but GMO does not control it. Under certain conditions, government authorities could access it over the internet, check what is running there, and delete a program sending the commands. They could also change settings to prevent the attacker from using it again. This is what it means to neutralize the threat. Such action became possible under new laws Japan passed in 2025.

有害な命令が海外のサーバーから来ていると想像してください。そのサーバーは攻撃のインフラの一部ですが、GMOはそれを制御していません。一定の条件のもとでは、政府当局はインターネット経由でそこにアクセスし、何が動いているかを確認し、命令を送っているプログラムを削除できます。攻撃者が再び使えないように設定を変えることもできます。これが、脅威を無力化するということの意味です。そのような行動は、日本が2025年に成立させた新しい法律のもとで可能になりました。

The relevant provisions took effect in October 2026. They give specially designated police officers—and, in certain circumstances, the Self-Defense Forces—the authority to take these measures against computers involved in serious cyber threats. The power belongs to the state and is subject to legal limits. A company cannot turn it on simply by asking for help.

関連する規定は2026年10月に施行されました。それらは、特別に指定された警察官に、そして一定の状況では自衛隊に、深刻なサイバー脅威に関わるコンピュータに対してこれらの措置をとる権限を与えます。その権限は国家に属し、法的な制限を受けます。企業が助けを求めるだけでは、それを発動させることはできません。

GMO asked the government to treat its case as a possible first use of this power. But the authorities must decide whether the legal criteria are met. The request itself does not make an operation lawful or require the government to carry it out. Officials have declined to say publicly what measures they may take in this case.

GMOは、自社の事案をこの権限の初めての行使の候補として扱うよう、政府に求めました。しかし当局は、法的な基準が満たされているかどうかを判断しなければなりません。要請そのものが、作戦を合法にするものでも、政府に実行を義務づけるものでもありません。当局は、この事案でどのような措置をとる可能性があるかを、公表することを拒んでいます。

There is another difficulty. A computer used in an attack may itself be compromised: it may belong to an innocent person or business and have been secretly taken over. Changing that computer could affect its owner’s data or services. If it is abroad, another country’s authority must also be considered. Stopping the attack matters, but so does understanding whose computer the government would be entering.

もう一つの難しさがあります。攻撃に使われたコンピュータ自体が乗っ取られている場合があります。無実の個人や企業の所有物であり、ひそかに乗っ取られているかもしれないのです。そのコンピュータを変更することは、所有者のデータやサービスに影響しえます。それが海外にある場合は、別の国の権限も考慮しなければなりません。攻撃を止めることは重要ですが、政府がどのコンピュータに入ろうとしているかを理解することも、同じく重要なのです。

Vocabulary

  1. breach — an incident in which someone gains unauthorized access to a computer system or data. Example: The company reported a breach of its cloud service.
  2. unauthorized — done without permission. Example: The customer noticed unauthorized activity in her trading account.
  3. active cyber defense — government action to identify and stop serious cyber threats, which may include measures against computers used in an attack. Example: The company asked whether active cyber defense could help stop further harm.
  4. infrastructure — the equipment and services that support an activity. Example: Investigators tried to identify the servers that formed part of the attack’s infrastructure.
  5. neutralize — to make something unable to cause harm. Example: Officers might neutralize a threat by preventing a server from sending further commands.
  6. provisions — particular rules or parts of a law. Example: The new provisions describe when officers may take action.
  7. authority — the legal power to make a decision or take an action. Example: The company did not have the authority to access a server it did not control.
  8. criteria — the conditions used to decide whether something qualifies. Example: Officials must determine whether the case meets the legal criteria.
  9. compromised — secretly accessed or taken over by someone without the owner’s permission. Example: A compromised computer may be used in an attack without its owner’s knowledge.

Comprehension Questions

  1. What did GMO do after discovering the attack?
    1. It logged in to a server abroad and deleted a program.
    2. It stopped affected servers and asked financial firms to block suspicious access.
    3. It ordered the police to shut down the attacker’s computer.
    4. It immediately restored the affected service.

    GMOは攻撃を発見した後、何をしましたか？

  2. Why could GMO not take the same measures against a server outside its network?
    1. The server was too far away for an internet connection.
    2. Only financial firms can investigate cyberattacks.
    3. GMO did not control that server or have the authority to change it.
    4. Foreign servers cannot send commands to computers in Japan.

    GMOが自社ネットワーク外のサーバーに対して同じ措置をとれなかったのはなぜですか？

  3. In the article’s hypothetical example, how might authorities neutralize a server used in an attack?
    1. By deleting a harmful program or changing settings that let the attacker use it.
    2. By changing the passwords of every GMO customer.
    3. By permanently disconnecting all Japanese computers from the internet.
    4. By asking GMO to take control of the server.

    記事の仮定の例では、当局は攻撃に使われたサーバーをどのように無力化しうるでしょうか？

  4. What is the effect of GMO’s request to the government?
    1. It automatically authorizes police action.
    2. It proves that the server is abroad.
    3. It requires the government to publish its plans.
    4. It asks the authorities to consider action, but they must decide whether the legal conditions are met.

    GMOの政府への要請の効果は何ですか？

  5. Why might action against a server used in an attack affect an innocent person?
    1. Every server involved in an attack belongs to the victim company.
    2. An attacker may have secretly taken over someone else’s server.
    3. The owner must have approved the attacker’s use of the server.
    4. The owner is automatically responsible for the attack.

    攻撃に使われたサーバーへの措置が、無実の人に影響しうるのはなぜですか？

Discussion Questions

  1. GMO stopped its own servers and asked other companies to cooperate. Why might those steps be insufficient to stop an attacker from causing further harm?

    GMOは自社のサーバーを止め、ほかの企業に協力を求めました。それらの措置では、攻撃者がさらなる被害を及ぼすのを止めるのに不十分になりうるのはなぜでしょうか？

  2. What should authorities check before accessing a computer that appears to be helping an attacker?

    攻撃者を助けているように見えるコンピュータにアクセスする前に、当局は何を確認すべきでしょうか？

  3. If a server belongs to an innocent business but has been taken over by an attacker, how should authorities weigh the need to stop the attack against possible disruption to that business?

    サーバーが無実の企業の所有物だが攻撃者に乗っ取られている場合、当局は攻撃を止める必要性と、その企業への混乱の可能性をどのように天秤にかけるべきでしょうか？

  4. Should a company be able to request government action against a server outside its network? Who should make the final decision, and why?

    企業は、自社ネットワーク外のサーバーに対する政府の行動を要請できるべきでしょうか？最終決定を下すべきなのは誰で、それはなぜですか？

  5. How does the question change when the server is located in another country?

    サーバーが別の国にあるとき、この問いはどのように変わりますか？

Speaking Practice

Speak for 60–90 seconds: A company has stopped a cyberattack on its own servers, but investigators believe a separate server may still be sending harmful commands. Explain what the company can do, what it might ask the government to do, and why the government must examine the situation before acting.

60〜90秒話してください。ある企業は自社サーバーへのサイバー攻撃を止めましたが、調査員は別のサーバーがまだ有害な命令を送っている可能性があると考えています。企業が何をできるか、政府に何を求める可能性があるか、政府が行動する前に状況を調べなければならない理由を説明してください。