On 14 November, Aso Taro, the vice president of Japan’s ruling Liberal Democratic Party, called for Japan to be included in the AUKUS trilateral security partnership with Australia, the United Kingdom and the United States. This ‘JAUKUS’ proposal is nothing new. Since the inception of AUKUS in September 2021, Japan has been viewed as the leading candidate for additional membership due to its solid alliance with the US and membership of other security partnerships, including the Quad. In August, the UK House of Commons Foreign Affairs Committee recommended the inclusion of Japan and South Korea into Pillar 2 of the agreement.

While it’s a natural strategic choice for Japan to join in advanced military technology cooperation under AUKUS Pillar 2, a fundamental stumbling block is Japan’s lack of effective counter-espionage laws.

Japan currently has some laws dedicated to preventing espionage. One is the Unfair Competition Prevention Act (UCPA) which sets the maximum criminal punishment as imprisonment for not more than 10 years or a fine of not more than 20 million yen for the illicit transfer or disclosure of trade  secrets. The Act on the Protection of Specially Designated Secrets (PSDS) that was passed by the Abe administration in 2014 allows the government to designate certain information related to national security and diplomacy as special secrets and sets the maximum punishment at imprisonment for not more than 10 years or a fine of not more than 10 million yen for leaking such secrets.

There are three deficiencies there. One is Japan’s weak punishment for espionage compared to other AUKUS members. The US has the Espionage Act 1917 with the maximum punishment of death or imprisonment for any number of years. With the National Security Legislation Amendment Bill 2018, Australia punishes espionage, defined as ‘dealing with security classified or national security information to be communicated to a foreign principal’ with at least 10 years imprisonment, up to imprisonment for life. Its 27 newly introduced offences cover a preparatory offence punished by imprisonment for 15 years and interference, as separated from espionage, for up to 20 years. Despite significant domestic opposition since 2015, the UK parliament finally updated its counter-espionage law in July 2023, following Australia’s path.

The second problem is the limited coverage of espionage. The UPCA only criminalises actions for ‘the purpose of obtaining an unjust profit or causing damage to the secret holder’ (Article 21). There is no articulation of foreign principals or foreign states. Article 24 of the PSDS criminalises obtaining, or attempting to obtain, secrets for foreign states (it says ‘gaikoku’ without definition). The PSDS criminalises disclosure of secrets, obtaining such secrets and conspiring, abetting, or inciting others to commit such acts. Other forms of espionage, such as possession and concealment, making a record or copy, or communicating and publishing secrets are out of its purview.

Finally, Japan needs to set up broader rules and regulations to protect its business and education sectors from espionage. Australia’s Foreign Relations Act 2020 created a framework for the Commonwealth to review and cancel arrangements between state and territory entities and foreign governments. The Foreign Influence Transparency Scheme Act 2018 requires registration and disclosure of activities undertaken on behalf of foreign principals. The University Foreign Interference Task Force established in 2019 guides Australian universities in providing training courses on foreign interference. As the largest academic funding body, the Australian Research Council articulates its policy and acknowledgement of the risks associated with foreign interference.

Japan lacks such measures. It has promoted economic security measures, including protection of critical infrastructure, resilient supply chains and development of advanced technology, culminating in the Economic Security Promotion Act in May 2022. But measures to expand the coverage of espionage and foreign interference and protecting its research organisations and universities are limited. Japanese universities reluctantly commit to voluntary scrutiny of foreign researchers as they have no internal intelligence capabilities. The Science Council of Japan strongly opposes its own government’s intervention while it has not adopted any official position on foreign interventions.

Overall, despite huge security legislation reforms under the Abe administration, Japan still lives in either pre-war trauma or the post-war euphonism. Domestic backlash against the SDS in 2014 often raised ‘remember the Security Maintenance Law 1925’, which the then government used to arbitrarily arrest and even torture anti-government protesters and communists.

Upon its defeat in 1945, the Japanese government deleted Article 85 of the criminal law which said ‘a person who engages in espionage for the enemy or aids and abets the espionage of the enemy shall be sentenced to death or to imprisonment for life, or to imprisonment for not less than five years. The same shall apply to those who leak military secrets to the enemy’. This was deleted because the concept of ‘enemy’ no longer existed in the Japanese constitution. Article 9 of Japan’s Constitution renounces war as a sovereign right of the nation.

If Japan wants to join a JAUKUS or a ‘Six Eyes’, it has to share not only strategic interests or values, but rules. However, no one waits for Japan. AUKUS members see AUKUS as a critical opportunity to create ‘a seamless defence industrial base across the three countries’. This will lead them to remove almost all barriers among themselves but setting up high fences against others. Australia is taking further actions to amend its defence control legislation to smoothen its AUKUS partnership while the US Congress carefully scrutinises the possibility of sophisticated submarine technologies leaking from Australia to others. Embodying Abe’s political credo of graduating from the post-war regime is essential element to the realisation of JAUKUS.

Critical minerals are vital components in today’s rapidly growing clean-energy industry. They’re used in advanced technologies like electric vehicles and batteries, wind turbines, solar panels, fibre-optic cables and semiconductor chips. But the supply chain for critical minerals could now be at risk.

Global supply chains are a complex system of suppliers and customers, and are extremely delicate under pressure. They can be easily disrupted by major events like conflicts, natural disasters and pandemics.

Critical minerals are being consumed in greater volumes than ever before, and the level of demand will only increase over the next 10 to 20 years, and beyond. Critical minerals are in high demand in industries such as the automotive sector that are making modern batteries, by governments searching to secure supplies of rare-earth metals, and by renewable-technology manufacturers searching for necessary inputs, but there is much that needs to happen to build supply chains.

Mineral resource projects are largely at the early stage of commercialisation, and significant investment is needed to strengthen processing and manufacturing capabilities to meet demand.

The governments of Japan and the Five Eyes countries (Australia, Canada, New Zealand, the United Kingdom and the United States) are aware that critical minerals, including rare-earth elements, will be increasingly needed as the world shifts from fossil-fuel systems to renewable energy sources. The partner nations are also clear about the challenges and opportunities, especially given that the supply chains for several critical minerals have only one or few dominant key players.

Australia is fortunate to possess some of the world’s largest recoverable resources of cobalt, lithium, vanadium, manganese and zirconium. Australia and Canada are known for efficient processes and upstream resource extraction and production. Japan has the technology, and the US wants more critical minerals to supply its ever-expanding high-tech industries.

We must now think bigger than unilateral supply chains. The good news is that this model doesn’t require a whole new set of skills or capabilities. In a recent Forbes article, Deloitte Australia discussed the critical steps needed for taking action on opportunities and establishing whole value chains by working more closely together.

The renewable energy supply chain, for example, is at risk because it relies on a small number of countries. The production and use of solar energy are dependent on three primary value chains: collection, conversion and storage—with the latter critically dependent on lithium-ion batteries and subject to a concentrated supply chain.

Currently, 50% of the raw material for lithium-ion battery production comes from Australia. Around 90% of the processing occurs in China, and 53% of the battery assembly is done in Japan. In addition to supplying raw material, however, Australia is capable of processing an estimated 42% of global lithium. South Korea and Japan manufacture around 20% of global lithium-ion related products, and there’s potential for them to use existing infrastructure to expand their production capacity. The US, Japan and South Korea collectively account for 50% of global battery cell production. They are also responsible for nearly 82% of the global battery assembly production, of which 53% is done in Japan.

To capitalise on this immense potential, expand lithium-ion production facilities and reorchestrate the renewable energy supply chain, it’s imperative that Japan and the Five Eyes coordinate and blend their complementary and critical capability together. By shifting from unilateral to multilateral value chains, the partners can reduce risk and collectively help to sustainably meet the growing demand.

An alliance can effectively build a resilient supply chain network at every value-added stage by leveraging the competitive strengths and expertise of each partner and region. That would provide not only benefits from diversification, but also enable shared risk-sensing, multi-tier demand forecasting, and supply planning and optimisation. Additional benefits include shared risk exposure and aligning trading rules among partner nations.

Getting this network up and running will require a thorough assessment of supply networks and value chains; analysis of risks to help define the partners’ requirements; integrated planning and supply assurance among the partners; and development of efficient governance and trade vehicles to make the task of reorchestrating value chains simpler.

If this endeavour is approached in an orchestrated way, a powerful critical minerals industry and associated supply chains can be unlocked, presenting a more reliable and secure value proposition and laying the foundations for a strong, prosperous and sustainable future.

The looming UK decision on 5G and Huawei has profound consequences for the UK, for the four other members of the Five Eyes intelligence-sharing group (the US, Canada, Australia and New Zealand) and for the future technological landscape of Europe. But it’s in danger of happening while those around it are distracted by bigger disasters.

The bad news is that, if what Britain’s top cybersecurity official, Ciaran Martin, outlined when he spoke at last month’s CyberSec conference in Brussels is any measure, the UK seems intent on defending the wisdom of a decision made a decade ago, despite all the changes in the strategic and technological landscape since then.

Martin sent some interesting signals in his speech. Apparently, it’s not that important who the 5G technology vendors are, because Russians successfully hacked the UK telecommunications system  even though ‘those networks didn’t have any Russian kit in them’. So, ‘From the point of view of managing corporate risk, or, in our case, national risk, it essentially doesn’t matter whether the vulnerabilities are deliberate or the result of honest mistakes.’

This shows very woolly thinking. It’s familiar logic for those following gun control: US gun advocates’ bumper stickers used to say, ‘Guns Don’t Kill People. People Do.’ They always forgot to add, ‘But people with guns kill plenty more people than people without guns.’

So too with cybersecurity. Without access to vendor knowledge and cooperation, it’s possible to hack systems. But hacking is easier and less discoverable if you do have the access to system designers—and even better if they have to cooperate with you.

Despite all the denials, this is just what hackers at the Chinese Ministry of State Security have with Huawei, Beijing’s anointed national champion for 5G technology.

It’s on the public record that Beijing’s National Intelligence Law requires Huawei—and every other Chinese company—to cooperate with the ministry and every other state intelligence agency for the Chinese state’s purposes. Similarly, under the State Security Law, all ‘enterprises and institutions, and other social organisations have the responsibility and obligation to safeguard national security’—and under the Chinese Communist Party, ‘national security’ is a very broad, politically driven concept.

Chinese CEOs understand their obligations to Beijing well. As Sogou’s CEO put it, ‘If you think clearly about this, you can really resonate with the state. You can receive massive support. But if it’s your nature to go your own way, to think that your interests differ from what the state is advocating, then you’ll probably find that things are painful, more painful than in the past.’

As former Australian prime minister Malcolm Turnbull noted in a recent speech:

If a state-sponsored adversary has enduring access to staff, software or hardware deployed into a target telecommunication network, then they only require the intent to act in order to conduct operations within the network. Traditionally, cyber security is premised on raising the cost for an adversary to such an extent that the adversary will not find it worthwhile to compromise a network. When an adversary can persistently and effortlessly pre-position, the effective cost of activity is greatly reduced.

Martin goes on though, to even more dubious ground. He doesn’t just defend the oversight regime the UK directed the top secret Government Communications Headquarters to provide for Huawei systems and products back in 2008 and 2010, he extolls it as a model: ‘Our regime is arguably the toughest and most rigorous oversight regime in the world for Huawei. And it’s proving its worth.’

Martin tells us there’s more good news: Huawei has accepted all the UK’s findings about the flaws in the security of its components, its design and production approach, and its software.

In fact, according to Reuters, Huawei has committed to address all of them, with the catch being that the company expects this to take ‘between three and five years’ and some US$2 billion.

What’s the problem? It’s in another part of Martin’s speech. It turns out that 5G, among its other impacts, ‘hugely accelerates the pace of technological change’. Huawei itself has said, ‘Enhancing our software engineering capabilities is like replacing components on a high speed train in motion.’

So, the world’s leading oversight regime of Huawei is fixing 2018’s problems between now and 2023. But it is already being outpaced by Huawei’s product development cycle, and, as technological change in communications accelerates, this will only get worse.

Given these factors, no oversight regime—even a UK version on steroids—will be able to manage Huawei 5G systems and software embedded in a nation’s critical digital infrastructure.

If EU nations are looking for insights and guidance from the UK experience, that’s the big one. Don’t follow the UK down a failing path.

Meanwhile, Huawei continues to get product development advice and insights into UK agency knowledge through the UK model.

It also uses the UK ‘brand endorsement’ to say that those who see major national security problems from embedding this Chinese 5G national champion into their own national digital infrastructure are jumping at shadows.

I wonder if Martin has taken that line in discussions with his Five Eyes partner, Mike Burgess, head of the Australian Signals Directorate, who has said there is no way to safely manage high-risk vendors in 5G networks.

Burgess has advised that:

Historically, we have protected the sensitive information and functions at the core of our telecommunications networks by confining our high-risk vendors to the edge of our networks.

But the distinction between core and edge collapses in 5G networks. That means that a potential threat anywhere in the network will be a threat to the whole network.

If the UK’s top cybersecurity official is talking down these risks, imagine what the UK’s economic ministries are doing.

Chinese state media has been helping here, campaigning hard to influence UK government thinking by flagging large new investments in the City of London and post-Brexit Britain. That state media product has gone into the UK debate word for word through the UK’s Telegraph newspaper, which ran a paid supplement, discreetly labelled as such, from the CCP’s China Daily on 21 February.

The negatives for the UK if it does exclude Huawei have been made less obvious, although Beijing’s punitive economic measures against a growing list of nations are clear enough.

At the core of UK thinking is a depressingly misplaced assessment. Martin sets his thinking in the context of globalised technology, and says, ‘There are limitations to what even a continent of the size and wealth of Europe can do on its own in an age where the US and China dominate tech development.’

A UK decision not to exclude Huawei would bring this world a few steps closer.

Martin seems to have forgotten that, when it comes to communications technologies, Europe has two globally significant firms with strong 5G technologies and patents—Nokia and Ericsson.

Let’s hope others in the UK government remember this, along with the fact that, at US$17.2 trillion in 2017, the GDP of Europe is bigger than China’s at US$12.24 trillion—and Europe’s plus America’s is some US$36.6 trillion. That’s a lot of heft and opportunity to set against Chinese threats and promises.

A truly strategic approach would not be to hand Huawei, which already benefits from a protected market in China, more global market power.

Instead, it would be to use the UK’s brand and market power deliberately, to work out how the big European providers might thrive and work with partner tech industries—like Australia’s, South Korea’s, France’s, America’s and Japan’s—to produce the prosperity, diversity, resilience and security we all need.

And the value of the Five Eyes partnership would weigh heavily in the scales of the decision too—at a time when the UK needs long-term, trusted friends.

The UK Parliament’s e-mail system was targeted by a sustained brute-force password-guessing attack last Friday, forcing parliamentary staff to temporarily block remote email access and mandate password changes. The ‘rudimentary’ but effective attack resulted in the compromise of at least 90 email accounts. A few members of parliament, including Cabinet ministers, saw their details posted for sale online, and it’s possible that embarrassing personal information has been taken, posing a risk of blackmail. More importantly, the details gathered could be used to penetrate other vital systems. It’s not yet clear who conducted the attack or why they did it, but Conservative Party MP Henry Smith trundled out the usual suspects, from Russia, to North Korea, to an anonymous stranger in a basement. Subsequent commentary has criticised the Parliament’s information security practices, from accepting the use of weak passwords that could be ‘guessed’, to lacking basic and decades-old mitigation strategies like IP filtering and 2-factor-authentication, and finally the 10-hour delay before the Parliamentary Digital Service alerted affected personnel.

Attorney-General George Brandis and Minister for Immigration and Border Protection Peter Dutton have issued a joint media release setting out Australia’s agenda ahead of a Five-Eyes meeting in Ottawa—though 10 points from Gryffindor for ‘Ottowah’. The meeting is set to focus on encrypted communications, data sharing and immigration arrangements. Encrypted messaging has dominated the national security debate recently, due to its massive growth to 40% of CT-related commutation intercepts today, compared to 3% just four years ago. Russia is also facing the encryption debate, with the Russian Federal Security Service threatening to block encrypted messaging app Telegram for refusing to decrypt messages after it was used by terrorists in the St. Petersburg metro attack back in April.

Tech firms aren’t happy with the direction of the encryption debate either, with Google’s Legal Counsel Kent Walker stating that companies are in an ‘untenable’ position—caught between needing to fulfil unwieldy treaty-based international evidence requests (which currently take up to 10 months on average) despite systemic legal ambiguity. In a supporting blog post, he’s called for new regulations that clarify data sovereignty, improve current international evidence sharing processes, and introduce agreed norms when it comes to baseline principles of privacy, human rights and due process. Google has also announced that Gmail will no longer be scanned for advertising profiling data to increase consumer confidence.

In news for any legal scholars following the infosec world, the National Law Review, an American journal, has put out a three-part series providing a rundown on China’s recently implemented Cybersecurity Law. Germany has recently introduced new laws that expand the scope of situations in which German police are allowed to access devices and see messages at the source. The law has run into legal challenges, which argues that the new legislation is in contravention of EU laws. Finally, pending legislation, Canada might see it’s Communications Security Establishment legally empowered (with upgraded oversight) to carry out offensive cyber operations, a move that would significantly expand its mandate.

Cyber cooperation has seen big wins this week, with Canada and China signing an agreement to stop using cyber-attacks for industrial espionage. Multilaterally, Thailand’s Ministry of Foreign Affairs will host a seminar next week to discuss ASEAN’s cybersecurity cooperation and practice in the future. And the World Bank is funding a project to stand up Zambia’s National Cybersecurity Agency, with Israeli cybersecurity company CyGov providing advice and expertise.

WannaCry has continued to infect pockets of unpatched systems this week, striking a Honda factory and forcing the factory to temporarily shut down while fixes were applied. WannaCry has also affected traffic cameras in Victoria. Initial statements from the Victorian government indicated that the overall system wasn’t compromised and that all infringements would remain, but that was later reversed, with the government stating they would ‘quarantine’ and review infringements generated by the affected cameras. The contradiction seems to indicate that the Victorian government is struggling with its communications and decision-making processes in the event of cyber incidents.

The US national security community seems to be embracing open source development communities, with the National Security Agency (NSA) joining GitHub to launch a page that shares the details of 32 different projects. Similarly, the Department of Homeland Security has announced a Kaggle competition for passenger screening, sharing valuable training data and offering a US$1.5 million reward to the team that develops an algorithm for body scanners to automatically identify concealed objects. There’s been some involuntary technology sharing between the national security and open source communities, too, with WikiLeaks releasing more technical documentation on CIA hacking tools from ‘Vault7’ The latest leak has provided details on a toolset called ‘Brutal Kangaroo’, designed to spread through infected USBs and, potentially, infiltrate air-gapped computers.