Japan defense forces used USB drives with China-linked virus: Nikkei investigation

Japan’s Ground Self-Defense Force used USB drives infected with a virus linked to Chinese hackers on computers with access to classified information for nearly a year, according to a Nikkei investigation. The military did not disclose this incident during that period, despite the widespread availability of similar infected drives online. This revelation raises questions about cybersecurity practices and transparency within Japan’s defense agencies.

The investigation by Nikkei Asia found that USB drives containing malware associated with Chinese cyber actors were used by Japan’s Ground Self-Defense Force over a period of approximately 11 months. These drives were employed on computers handling sensitive and classified information, potentially exposing critical defense data to cyber threats.

Sources within the defense community confirmed that the infected USB drives were used in operational environments, and that the military was aware of the infection risks but chose not to disclose the issue publicly or internally for an extended period. The malware is believed to be linked to Chinese hacking groups, although official attribution has not been formally announced by Japanese authorities.

It is not yet clear how the infected drives were introduced into the military systems or whether any sensitive information was compromised. The Defense Ministry has declined to comment on the specifics of the incident, citing ongoing investigations and security concerns.

Implications for Japan’s Cybersecurity and Defense Transparency

This incident highlights vulnerabilities in Japan’s defense cybersecurity protocols and raises concerns about transparency and risk management. The use of infected USB drives on sensitive systems suggests potential gaps in security oversight, which could be exploited by foreign cyber actors. The failure to disclose the incident for nearly a year may undermine public trust and accountability in Japan’s defense agencies, especially amid rising cyber threats from China and other nations.

Background of Cyber Threats and Defense Security in Japan

Japan has faced increasing cyber threats linked to China and other state actors, prompting efforts to strengthen cybersecurity measures within its defense forces. Previous incidents have exposed vulnerabilities in military and government networks, leading to calls for improved security protocols and transparency. The use of portable storage devices, such as USB drives, remains a common but risky practice in military environments, especially when security controls are lax or outdated.

This latest revelation by Nikkei Asia adds to concerns about the adequacy of Japan’s cybersecurity defenses and the transparency of its handling of cyber incidents, especially involving foreign-linked malware. It also underscores the ongoing challenge of balancing operational efficiency with security in sensitive military contexts.

“The use of infected USB drives was a serious oversight, but the full extent of the security breach is still under investigation.”

— an anonymous defense official

Unresolved Questions About the Scope and Impact

It remains unclear whether any classified information was actually accessed or stolen through these infected USB drives. The full extent of the malware’s impact on Japan’s defense systems has not been publicly disclosed, and investigations are ongoing. Additionally, details about how the drives were introduced into the military environment and whether similar incidents have occurred elsewhere are still unknown.

Next Steps in Security Review and Transparency Measures

Japan’s Defense Ministry is expected to conduct a comprehensive review of cybersecurity protocols and incident management procedures. There may be increased scrutiny of supply chains and portable device policies within the military. Public disclosures about the incident’s scope and any measures taken to mitigate future risks are anticipated in the coming weeks as investigations progress.

Key Questions

Could classified information have been compromised?

It is not yet confirmed whether any classified data was accessed or stolen through the infected USB drives. The investigation is ongoing, and authorities have not disclosed specific findings regarding data breaches.

How did the USB drives become infected?

The exact method of infection remains unclear. The malware is believed to be linked to Chinese hacking groups, but details about how the drives were compromised are still under investigation.

Has the incident been reported publicly before?

No, the use of infected USB drives was not disclosed publicly by Japan’s defense authorities until the Nikkei investigation revealed the details.

What security measures are being considered now?

The Defense Ministry is likely to review and strengthen cybersecurity protocols, including stricter controls on portable devices and enhanced monitoring of malware threats.

Are similar incidents happening elsewhere in Japan’s government or military?

This specific incident is newly reported, and it is unclear if other similar breaches have occurred. Ongoing investigations may reveal more cases.

Source: Nikkei Asia