Japan defense forces used USB drives with China-linked virus: Nikkei probe

Japan’s Ground Self-Defense Force used USB drives infected with a virus linked to Chinese hackers on computers with access to classified information for nearly a year, according to a Nikkei investigation. The force did not disclose this security breach, despite the widespread availability of similar infected devices online. This revelation raises concerns over cybersecurity practices within Japan’s defense agencies and potential vulnerabilities to foreign cyber espionage.

The investigation by Nikkei Asia found that USB drives containing a virus associated with Chinese hacking groups were used by the Ground Self-Defense Force over a period of approximately 11 months. These infected drives were employed on computers with access to sensitive and classified information, potentially exposing critical data to unauthorized access. The force reportedly chose not to disclose the incident to higher authorities or the public, even as similar devices were readily obtainable online, increasing the risk of further breaches.

Officials from Japan’s Ministry of Defense have confirmed that the USB drives in question were used within certain units, but they have not yet provided detailed information on the scope of the infection or the measures taken afterward. Cybersecurity experts suggest that the virus could have enabled remote access or data exfiltration, posing a serious threat to national security. The Defense Ministry has stated it is conducting an internal review of cybersecurity protocols related to the incident.

Implications for Japan’s National Security Posture

This incident highlights vulnerabilities within Japan’s defense cybersecurity framework, especially regarding the use of external storage devices. The use of infected USB drives by a key military branch raises concerns about the potential for foreign cyber espionage and data breaches. It underscores the importance of strict cybersecurity protocols and the need for comprehensive audits to prevent similar incidents in the future. The revelation could also impact Japan’s diplomatic relations with China, given the attribution of the virus to Chinese hacking groups.

Cybersecurity Risks in Military Operations

Japan’s Self-Defense Forces have historically faced challenges in cybersecurity, with increasing digital threats from state-sponsored actors. Previous reports have indicated vulnerabilities in defense networks, but this case is notable for involving physical media—USB drives—that bypass network defenses. The incident occurs amid broader concerns over Chinese cyber activity targeting Japan and other allies, emphasizing the need for enhanced security measures within military and government agencies.

“Using infected USB drives within a defense force indicates significant lapses in cybersecurity protocols and could have severe consequences if exploited by foreign actors.”

— an anonymous cybersecurity expert

Details of the Infection and Damage Remain Unclear

It is not yet confirmed how many devices were infected, whether any data was exfiltrated, or if the virus was actively exploited by Chinese hackers. The scope of the breach and the specific security measures taken afterward are still under review, and officials have not provided detailed technical assessments.

Japan to Conduct Internal Cybersecurity Review

The Japanese Defense Ministry has announced an internal investigation into cybersecurity practices related to the incident. Experts expect increased scrutiny of USB device usage and stricter security protocols in the coming months. Further disclosures may follow as authorities assess the full extent of the breach and implement corrective measures.

Key Questions

How did the USB drives become infected?

It is believed that the USB drives were either pre-infected before use or became compromised through online availability and potential tampering. The exact method is still under investigation.

Could this breach have compromised classified information?

Yes, given that the infected drives were used on computers with access to sensitive data, there is a concern that classified information could have been accessed or exfiltrated by malicious actors.

Has the Japanese government taken any action following this revelation?

The Defense Ministry has announced an internal review of cybersecurity protocols and is assessing the scope of the incident. Further actions are expected based on the investigation’s findings.

Is China responsible for the virus?

According to reports, the virus is linked to Chinese hacking groups, but official attribution remains under review pending further technical analysis.

Will there be policy changes to prevent future incidents?

It is anticipated that Japan will strengthen cybersecurity measures, including stricter controls over external devices and enhanced monitoring of digital security practices within defense agencies.

Source: Nikkei Asia