Topic III: A New Framework of Collaboration between Industry, Academiaand Government to Cope with Threats in Cyberspace(1) Current Threats and the Need for
Additional Undertakings
Although Japan achieved some positive
results in its efforts dealing with threats incyberspace, these efforts focused on measuresagainst each specific case that had happened.
Japan has not yet been able to take proactive
and comprehensive measures against theever-shifting pattern of threats to ensure future
threats to be neutralized before it happens.
Industry, academic institutions, and law
enforcement agencies such as the police, wereplaying key roles in coping with cyber threats
while accumulating a wealth of knowledge
and experience in dealing with them.
However, each of these sectors was acting
independently in promoting their variousmeasures. Sufficient efforts were not made forthe coordinated integration and analysis ofsuch knowledge and experience in order toformulate effective countermeasures. In theStrategy to Make Japan "the Safest Country in
the World", approved by the Cabinet in 2013,
and also at the Advisory Council for NPA on
Cyber Security9, it had been noted many times
that a new organization needed to be created.
The National Cyber-Forensics &Training
Alliance (NCFTA) in the United States ofAmerica, a non-profit organization attaining
positive results within the framework ofcollaboration between industry, academia andgovernment, was suggested as a model.

Chart III-1 Challenges in dealing
with threats in cyberspace
Having knowledge and real-time information of
the threat from cyberspace

Industry

No effective measures, such as arrest ofHowever, suspects, are available.

Having high level skills and knowledge fromresearch.

Academicinstitutions

However, Have no real experience handling threats
in cyberspace
It is possible to make a specified case that is
related to a specific threat ineffective by
understanding the details through investigationand other police activities

Law enforcement
agencies

The threat of the entire scope ofHowever, cyberspace has not been thoroughly
understood(2) Outline of the NCFTA
With the aim of effectively coping withincreasingly complex threats in cyberspace,
the NCFTA was established in 1997 in theU.S.A. The NCFTA brings together law
enforcement agencies, private industry, andacademia to share and analyze real-timeinformation on the threats, so that multiple
sectors can work jointly towards cyber threats.
The results that the NCFTA obtains by
integrating and analyzing the information it
collects are provided to law enforcement
agencies and private companies. The NCFTA
also has training programs for investigators.
The NCFTA's proactive and comprehensive
efforts within the framework of collaboration
between industry, academia and government
have produced positive results. For example,
the NCFTA helped seize criminal proceeds
and prevent potential losses in theinvestigation of cyber financial crime. TheNCFTA is highly admired inside and outside
the U.S.A., with initiatives modeled after theNCFTA having been undertaken in othercountries.

9: The Advisory Council on Cyber Security has been heldby the NPA since FY2001 to generate discussion byexperts on cooperation between industry and government
agencies, particularly the police in order to ensure thesecurity and reliability of info-communications network.

- 28 -public with the information that the JC3
integrates, the JC3 helps create a safe andsecure Internet environment for the public. Inorder to maximize its potential, the JC3 isbuilding relationships with the NCFTA andother organizations overseas for the purposesof sharing information and cooperating witheach other.
II. Cooperation between the Police and theJC3
In January 2013, the police formulated theImmediate
ActionProgramfortheReinforcement of the Abilities to Cope withCybercrimes. Based on this program, thepolice have been strengthening partnerships
with private businesses in order to cope withcybercrimes. After the inauguration of theJC3, the police began to use the JC3 as a hub
for collaborating with an increasing number ofpartners in industry and academia on a routine
basis, not just cooperating with individualcompanies after each case but also aiming at
the development of a new framework ofcollaboration between industry, academia andgovernment. At a forum held by the JC3 inFebruary 2015 and other opportunities, thepolice have actively exchanged views andinformation with experts from industry andacademia
regardingfinancialcrimes,information leakage and other issues.

Chart III-2 Structure of the NCFTA(database)(3) A New Framework of Collaboration
betweenIndustry,AcademiaandGovernment in JapanI. Establishment of JC3
After considering the circumstances, theNPA and other entities deliberated on theestablishment of a new organization, resulting
in the establishment of the Japan Cybercrime
Control Center (JC3). The center started
operations on November 13, 2014.
At the JC3, the separate information andexpertise of industry, academia andgovernment agencies are collated and theresults are provided to each sector to identify
any sources of threats in cyberspace. The JC3
aims to prevent cybercrimes by mitigating andneutralizing cyber threats. By providing theAcademicinstitutions
Information on the actual
situations of threatIndustry(end users)

Victim information, etc. Integration

Related expertiseand analysis
of information

R&D
Knowledge to prevent
damage/loss
Investigation
information, etc.

Wide range of victim andinvestigation information

JC3Industry(security providers)Training
Overseascollaboration

Information accumulated
through businesses

Understanding
the entire scope of the case

PoliceUnderstanding the entire scope of the threat in cyberspace enables the addressing of issues- 29 -It is expected that close cooperation with
the JC3 will make it possible for the police totake proactive and comprehensive measuresagainst threats in cyberspace. For example,
information about malware will be integrated
at the JC3 from industry, academia andgovernment agencies for analysis to identify
the relevant command-and-control servers.
This will enable the police to exercise theirstatutory authority of investigation forneutralizing these servers and preventing any
potential losses. The police will in turn share
information related to their investigations of
the threats with the JC3 to contribute to theefforts by industry and academia to enhancecyber security. Efforts will be accelerated
toward the creation of a safe and secure
cyberspace by adequately and promptly
utilizing information shared through the JC3
for effective police operations.

JC3 Forum 2015

- 30 -