February 2024

US-Japan: Advancing
Cybersecurity and Resiliency
in the Age of Uncertainty
Mark Bryan Manantan, Editor
Emily Goldman Ph.D. | Mihoko Matsubara | Benjamin Bartlett Ph.D.
Andrew J. Lohn | Mina Takazawa•1U.S. Cyber Diplomacy
in Southeast Asiaand the Indo-Pacific
Benjamin Bartlett, Ph.D.

As of now, the U.S. has played a relatively minor role inproviding cybersecurity capacity-building assistance to Southeast
Asia. Major efforts to provide capacity-building assistance tothe region, outside of more globally-focused capacity-building
projects, began under the Trump administration and havebeen continued and built upon by the Biden administration.
These efforts appear to be part of a wider strategy to engage
with Southeast Asia to counter Chinese influence in the region.
However, cooperative efforts on cybersecurity between the U.S.
and Southeast Asia are not yet strongly institutionalized, and it
is unclear whether a new administration will continue to buildon the Biden administration’s efforts. Also, Japan already plays amajor role in providing cybersecurity capacity-building assistanceto the region, it may be better for the U.S. to focus on areas where
it can provide a unique contribution or that clearly align with its
new “Persistent Engagement” cyber strategy.

• 43

Gaining Momentum: US-ASEAN Cyber Cooperation
The first major project the U.S. sponsored in SoutheastAsia
began in 2016 in cooperation with Singapore. The SingaporeUnited States Third Country Training Program (TCTP)
Cybersecurity Workshops have occurred at least five times sincethen, covering topics such as the development of cybersecurity
strategies, incident management frameworks, public outreachcampaigns, and responsible state behavior in cyberspace.28
The two countries also jointly enacted the U.S.-Singapore
Cybersecurity Assistance Program in 2019, which provided
ASEAN member-states with industry perspectives on how toraise the capability and maturity of their Computer Emergency
Response Teams (CERTs).29 Singapore has been a major partner
for the U.S. when it comes to cybersecurity: In 2021 the twocountries signed three Memoranda of Understanding (MoUs)
about enhancing cybersecurity cooperation, building on an earlier
MoU that had been signed in 2016.30
Other projects in Southeast Asia funded by the U.S. include
the 2018-2022 Malware Mitigation Assistance program, run by theGeorge C. Marshall European Center for Security Studies, which
educated participants from Indonesia, the Philippines, Thailand,and Malaysia about North Korean illicit cyber activities31; theUnited States Trade and Development Agency helped Thailand
comply with international standards for data protection andcybersecurity, which ran in 202132; another project is Building
Cyber Hygiene Capacity in Thailand, the Philippines, andIndonesia, a program run by the Cybersecurity and Infrastructure
Security Agency in 2023 which invited participants from multiple
sectors to learn about various cybersecurity-related issues.33 TheU.S. has also instituted joint programs with Japan and the EU,
such as the 2018 Japan and U.S. Joint Training for Industrial
Control Systems Cybersecurity34 and the Japan-U.S.-EU Industrial
Control Systems Cybersecurity Week for the Indo-PacificRegion.35

44 •Although cooperation between the U.S. and Southeast
Asia on cybersecurity capacity-building is still not heavily
institutionalized, leaders of the U.S. and ASEAN member-states
did release a Statement on Cybersecurity Cooperation at the Sixth
ASEAN-U.S. Summit in November 2018. In this statement, theyagreed to cooperate to maintain a secure information technology(IT) environment and capacity-building. They also reaffirmed theapplicability of international law to cyberspace36 and establishedthe ASEAN-U.S. Cyber Dialogue in 2019. The Dialogue has
occurred three times, covering topics such as 5G technologies,
the applicability of international laws and cyber norms, andthe potential for regional cooperation including cybersecurity
capacity-building.37,38
Increased cooperation between the U.S. and Southeast Asian
countries on cybersecurity has coincided with a rising sentiment
within Washington, D.C. that the U.S. needs to do more tocounter an increasingly assertive China, as exemplified by theelevation of the U.S.-ASEAN relationship to Comprehensive
Strategic Partnership by the Biden administration in 2022.39
However, it remains to be seen if future US administrations willcontinue to invest in deeper cooperation with Southeast Asia.
A major factor potentially hindering U.S. cybersecurity
cooperation among potential and current partners in Southeast
Asia and the wider Indo-Pacific (except for Australia) is areluctance on the part of the U.S. to share information on cyberthreats and cyber incidents. This is largely because the U.S. isworried that its partners would leak the shared information,
which in the worst case scenario could reveal U.S. sources and its
methodologies among its adversaries.40 But despite the potential
risk of leakage, the US should still find ways to share information.
This include sanitizing information in a manner that makes therevelation of sources and methods less likely. Additionally, the US
must also provide clear guidelines among partners and allies toprotect the shared information.

• 45

The China Factor in the US-JapanCybersecurity Cooperation
Along with cybersecurity cooperation, the U.S. is also
trying to limit the influence and spread of Chinese technology
in Southeast Asia and the wider Indo-Pacific through initiatives
such as the Digital Silk Road. To this end, it has been cooperatingwith its ally and partner Japan. For example, in April 2021, thetwo countries announced the U.S.-Japan Competitiveness andResilience (CoRe) Partnership.41 Under this partnership, theU.S. and Japan have agreed to cooperate on a number of issues
related to digital technologies, such as promoting Open Radio
Access Network (RAN) for cellular networks, which allows
for interoperability between cellular equipment from different
vendors. One major advantage the Chinese supplier Huawei has
is that it can provide equipment and services across the entire 5G
protocol stack; by making sure that the equipment of different
vendors is interoperable, it is easier for non-Chinese firms tocompete.42
The U.S. and Japan agreed to develop and promoteinternational technical standards both bilaterally and throughthe Quad. International technical standards can influence which
products will have better opportunities in the international market.
It also impacts interoperability between different countries’
products and services and can create international ethical andnormative conventions. For these reasons, China has been working
hard to establish more influence over international technicalstandards-setting in recent years.43
The U.S. and Japan also agreed to support quality
infrastructure development in the Indo-Pacific, which will givethem opportunities to promote their favored IT infrastructuretechnologies. One way that Japan has competed with China
when it comes to infrastructure in Southeast Asia is by focusing

46 •on “quality”.44 Given U.S. dominance in areas such as cloudcomputing, there are real opportunities for it to do likewise.
However, quality is not the only factor that matters. One otherissue is price: China offers generous financing for its technologies.
The U.S. is increasingly willing to take steps to counter this byproviding loans of its own.45 The second, more difficult, challenge
is that Chinese technologies are often employed as surveillance
tools which the U.S. and Japan, for normative and ethical reasons,are unwilling to offer.46 Unfortunately, surveillance technologies
are appealing to a number of Southeast Asian governments.
When it comes to countering Chinese influence and building
cybersecurity capacity in Southeast Asia, the U.S. and Japan could
benefit from stronger coordination. One difficulty is that IT- andcyber-diplomacy are not entirely coordinated within each country.
Both have bureaucratic organizations pursuing their own IT- andcyber-diplomacy-related projects. It would be helpful to have asingle organization in charge of coordinating these efforts in eachgovernment, which could then serve as a point of contact for theother organizations. For cybersecurity specifically, the obviousorganizations are the Cybersecurity and Infrastructure Security
Agency (CISA) in the U.S. and the National center of Incident
readiness and Strategy for Cybersecurity (NISC)47 in Japan.
Future Areas of Cooperation
Of course, before the two countries can successfully
cooperate on cyber capacity-building assistance and other formsof cyber diplomacy in Southeast Asia or the wider Indo-Pacific, akey question that needs to be resolved is how large a role the U.S.
should play, particularly given that Japan is already heavily activein the region. At the very least it would be helpful for the U.S. tofigure out in what areas it could offer additional value on top of
Japan’s efforts.

• 47

More importantly, given the U.S. turn toward a strategy of“Persistent Engagement”, where the goal is to anticipate youradversaries and make them react to you, it is an open question
whether these efforts, which are partly reactive and focused on
responding to Chinese actions and influence, are the best use of
American resources. This is not to say that the U.S. should eschew
cyber cooperation or cyber diplomacy, but instead it may bebetter to adjust the form of cooperation that fits its new overall
strategy. As a starting point, it may want to explore introducing
the concept of Hunt Forward Operations among its trusted allies
in the region.

Cybil, “Singapore-United States Third Country Training Programme (TCTP)
Cybersecurity Workshops - Cybil Portal,” February 22, 2021, https://web.archive.org/
web/20230803154534/https://cybilportal.org/projects/singapore-united-states-thirdcountry-training-programme-tctp-cybersecurity-workshops/.
29
Cybil, “US-SG Cybersecurity Technical Assistance Programme - Cybil Portal,” December
2, 2020, https://web.archive.org/web/20230803175522/https://cybilportal.org/projects/us-sgcybersecurity-technical-assistance-programme/.
30
Aqil Haziq Mahmud, “More Cybersecurity Cooperation between Singapore, US in Public,
Defence and Financial Sectors,” Channel News Asia, August 23, 2021, https://web.archive.
org/web/20230804142738/https://www.channelnewsasia.com/singapore/singapore-us-moucybersecurity-cooperation-public-defence-finance-2130121.
28

48 •