Rethinking Japan's Economic Security Beyond an Anti-Espionage Law

​A Japanese Perspective on Democratic Intelligence Governance: Lessons from the New York Times Report and Estonia's Digital Decision-Making Infrastructure

---

1. Introduction

The importance of economic security and intelligence has grown dramatically in recent years. Russia's invasion of Ukraine, intensifying geopolitical competition, and the weaponization of global supply chains have fundamentally changed the security landscape for democratic nations.

Semiconductors, advanced electronics, software, and other dual-use technologies have become strategic assets. As a result, governments are increasingly challenged to protect critical technologies without undermining legitimate economic activity, scientific research, or international trade.

Against this backdrop, debates over anti-espionage legislation have intensified in Japan. Calls for stronger criminal penalties against espionage have become more frequent, particularly following reports that strategic goods manufactured in Japan may have reached Russia through third countries.

However, this debate raises a more fundamental question:

Can the leakage of strategic goods really be prevented simply by enacting an anti-espionage law?

We believe the answer is no.

The challenge is not merely the absence of criminal sanctions. Rather, it lies in the institutional architecture through which governments identify, assess, and manage security risks arising from perfectly legal commercial activities.

The Japan–Estonia/EU Association for Digital Society (JEEADiS) has long advocated a different approach.

Instead of concentrating greater investigative powers in a single intelligence organization, JEEADiS proposes a data-driven intelligence architecture based on four principles:

• Democratic oversight of intelligence activities
• Separation between intelligence analysis and law enforcement
• Cross-government digital governance
• Data-driven risk assessment supported by interoperable information systems

Under this proposal, a future National Intelligence Bureau (NIB) would serve as an intelligence analysis organization without arrest or search powers. Law enforcement would remain the responsibility of existing judicial authorities, thereby preserving democratic accountability while strengthening national intelligence capabilities.

This institutional philosophy differs significantly from traditional discussions that focus primarily on expanding criminal law.

An opportunity to reconsider this issue emerged after The New York Times described Japan as a "paradise for Russian spies." The article generated considerable public debate by arguing that weaknesses in Japan's legal framework had enabled Russian procurement networks to obtain Japanese electronic components.

Subsequently, the Japanese security and intelligence media outlet Seculligence published a detailed analysis that challenged this interpretation. Rather than framing the issue as simply the absence of an anti-espionage law, the article argued that the real challenge lies in managing the gray zone between legitimate commercial activities and national security risks.

This distinction is critically important.

In this paper, we examine the NYT report together with the Seculligence analysis, explore the institutional limitations of Japan's current framework, and discuss what Japan can learn from Estonia's multi-layered approach to strategic goods control—including its Strategic Goods Act, the Stratlink digital decision-making platform, and the broader architecture of democratic intelligence governance.


2. Why the New York Times Report Matters

The New York Times argued that Japan has become an attractive operating environment for Russian intelligence and procurement networks seeking advanced electronic components and semiconductor-related technologies.

According to the report, commercially available Japanese products have continued to reach Russia despite international sanctions, often through intermediaries located in third countries.

The article attributes part of this vulnerability to Japan's relatively limited legal framework concerning espionage, suggesting that the country lacks the kinds of comprehensive anti-espionage laws found in several Western nations.

Its provocative description of Japan as a "paradise for Russian spies" attracted significant international attention.

There is no doubt that the diversion of strategic goods to sanctioned states represents a serious security concern.

Since Russia's invasion of Ukraine, democratic countries have significantly strengthened export controls over dual-use technologies, recognizing that components originally designed for civilian applications may also support military capabilities.

Japan has also expanded its export control measures through the Foreign Exchange and Foreign Trade Act (FEFTA) and other economic security legislation.

Nevertheless, controlling the movement of dual-use goods remains extraordinarily difficult.
Modern supply chains span multiple jurisdictions.

Products frequently pass through distributors, trading companies, and intermediary countries before reaching their final users.

Many electronic components identified in the NYT report are not military equipment; they are commercially available products used in automobiles, medical devices, industrial machinery, and consumer electronics around the world.

This reality illustrates the central challenge.

The issue is not simply whether a product is exported.

Rather, it is whether a legitimate commercial transaction may ultimately contribute to military applications through complex international procurement networks.

This distinction fundamentally changes the nature of the policy debate.

If the problem arises from lawful commercial transactions, then expanding criminal penalties alone cannot solve it.

Instead, governments require sophisticated mechanisms capable of integrating export licensing data, supply-chain information, end-user intelligence, sanctions databases, corporate ownership structures, and other sources of risk information.

The question therefore shifts from:
"Should Japan enact an anti-espionage law?"
to
"How can democratic governments identify genuinely high-risk transactions without unnecessarily restricting legitimate economic activity?"

This institutional question lies at the heart of both economic security and democratic governance.

As the following sections will demonstrate, it is precisely here that Estonia's institutional design offers valuable lessons—not because Estonia has simply enacted stricter criminal laws, but because it has developed an integrated system that combines legislation, intelligence, digital governance, and interoperable data infrastructure into a coherent decision-making architecture.


3. Japan's Institutional Challenge

The public debate that followed the New York Times article has often been framed as a simple legal question:

Does Japan need an anti-espionage law?

While this question is understandable, it risks overlooking a far more fundamental institutional issue.

Japan already possesses a substantial body of legislation relevant to economic security.

The Foreign Exchange and Foreign Trade Act (FEFTA) provides the legal basis for export controls over strategic and dual-use goods.

The Economic Security Promotion Act, enacted in 2022, introduced new measures concerning critical infrastructure, supply chain resilience, advanced technologies, and patent confidentiality.

In addition, the Act on the Protection of Specially Designated Secrets establishes a legal framework for protecting classified government information.

Taken individually, these laws represent important components of Japan's security architecture.

Yet the challenge lies elsewhere.

The diversion of strategic goods rarely results from a single illegal act.

Instead, it often emerges from a sequence of transactions that are individually lawful but collectively create unacceptable security risks.

A semiconductor may be exported legally to a distributor.

That distributor may legally sell the product to another intermediary.

The intermediary may then redirect the goods to an end user associated with a sanctioned state.

At no point may any individual transaction clearly violate criminal law.

Nevertheless, the overall supply chain may ultimately contribute to military procurement.
This illustrates the fundamental limitation of relying primarily on criminal legislation.

Criminal law is designed to punish identifiable unlawful conduct.

Economic security, however, increasingly requires governments to identify patterns of risk that emerge across multiple lawful transactions.

This is fundamentally an information management problem rather than simply a criminal justice problem.

Accordingly, the central policy challenge is not merely strengthening penalties.

It is improving the government's capacity to integrate fragmented information across institutions, evaluate risks objectively, and support timely decision-making without unnecessarily disrupting legitimate commerce.

In other words, the issue is not the absence of law.

It is the absence of an integrated institutional architecture capable of transforming dispersed information into actionable intelligence.


4. Why Anti-Espionage Laws Alone Cannot Solve the Problem

The debate surrounding the NYT article was significantly enriched by an important analysis published by Seculligence, a Japanese security and intelligence media organization.

Rather than focusing solely on whether Japan should enact an anti-espionage law, the analysis carefully distinguished between two fundamentally different issues that are often conflated in public discussions.

The first concerns espionage conducted through privileged or clandestine activities.
Such cases involve intelligence officers, covert networks, or the unlawful acquisition of protected information.

Criminal law plays an essential role in addressing these activities.

The second concerns the lawful procurement of commercially available dual-use goods.

This was the issue highlighted in the NYT report. 

Many electronic components exported from Japan are not classified military technologies.

They are ordinary commercial products widely used in automobiles, industrial equipment, telecommunications, medical devices, and consumer electronics.

Their military value derives not from the products themselves, but from how they are ultimately used.

This distinction is critically important.

If an item is legally available on the commercial market and exported through apparently legitimate business transactions, criminalizing espionage alone cannot prevent its diversion.

The policy challenge therefore shifts from identifying criminals to identifying high-risk transactions.

This is where many democracies encounter a difficult balancing problem.

Governments must strengthen national security while simultaneously preserving the rule of law, economic freedom, academic research, and technological innovation.

Expanding investigative powers without sufficiently precise institutional safeguards risks producing unintended consequences.

Japan has already experienced such a lesson.

The Ohkawara Kakohki case, widely regarded as one of the country's most serious miscarriages of justice involving export control enforcement, demonstrated the dangers of broad regulatory interpretation and inadequate institutional checks.

Executives were arrested on allegations of illegal exports, only for the criminal case to collapse after serious flaws in the investigation became evident.

The case highlighted an important democratic principle:
National security institutions must themselves be subject to institutional accountability.

This lesson has significant implications for intelligence reform.

JEEADiS has therefore proposed a National Intelligence Bureau (NIB) designed as an organization dedicated exclusively to intelligence collection, integration, and strategic analysis.

Unlike traditional security agencies, the proposed NIB would possess no arrest powers, no search authority, and no direct law enforcement functions.

Its role would be to provide objective, evidence-based intelligence assessments to the competent authorities responsible for export licensing, customs enforcement, police investigations, and judicial procedures.

This institutional separation reflects a fundamental democratic principle.

Intelligence organizations should inform decisions—not replace judicial processes.
Law enforcement should remain subject to existing legal safeguards, judicial oversight, and democratic accountability.

Viewed from this perspective, the debate should move beyond a binary choice between stronger or weaker anti-espionage legislation.

The more important question is how democratic governments can build institutional systems capable of identifying complex security risks while maintaining public trust, protecting civil liberties, and supporting legitimate economic activity.

It is precisely this broader institutional perspective that makes Estonia's experience particularly instructive.
​

5. Estonia's Multi-layered Security Architecture

The Estonian experience demonstrates that effective economic security cannot be achieved through criminal legislation alone.

Instead, Estonia has developed a multi-layered institutional architecture, in which different legal and administrative instruments perform complementary functions while sharing information through interoperable digital infrastructure.

Rather than relying on a single anti-espionage law, Estonia addresses security risks through several mutually reinforcing layers.


5.1 Criminal Law: Responding to Espionage

At the foundation of this framework lies the Estonian Penal Code, particularly the provisions beginning with Section 231, which criminalize espionage, treason, collaboration with foreign intelligence services, and other offences against the security of the state.

These provisions provide law enforcement authorities with the legal basis to investigate and prosecute genuine espionage activities.

Their purpose is clear:
to punish illegal conduct directed against the constitutional order and national security.

Importantly, however, these criminal provisions are not intended to regulate ordinary commercial transactions.

A company exporting commercially available electronic components under lawful export procedures is not, by that fact alone, committing espionage.

This distinction reflects an important principle of democratic legal systems:
criminal law addresses unlawful behaviour, whereas legitimate economic activities should remain protected unless specific legal restrictions apply.


5.2 The Schengen Information System (SIS): Shared Situational Awareness

A second layer consists of Estonia's participation in the Schengen Information System (SIS).

Unlike criminal legislation, SIS is not an investigative authority. Nor is it an intelligence agency.

Instead, it functions as a shared European information infrastructure that enables participating states to exchange alerts concerning wanted persons, missing individuals, stolen property, forged identity documents, entry bans, and other security-related information.

For Estonia, SIS substantially expands situational awareness beyond national borders.

Potential security risks identified in one Schengen member state become rapidly visible to others, enabling border authorities and police agencies to respond consistently across Europe.

This illustrates another important institutional principle.

Effective security increasingly depends not only on national capabilities but also on trusted cross-border information sharing among democratic partners.


5.3 Strategic Goods Governance: Managing Lawful Risks

Neither criminal law nor shared police information, however, is sufficient to address the challenge highlighted by the New York Times.

The procurement of dual-use goods frequently occurs through lawful commercial transactions.

Consequently, Estonia has established a third institutional layer through its Strategic Goods Act, which governs the licensing, control, and monitoring of exports involving military and dual-use items.

The objective of this legislation differs fundamentally from criminal law.

Rather than punishing offences after they occur, it seeks to prevent unacceptable security risks before exports take place.

Export licensing therefore becomes a process of strategic risk assessment rather than a purely administrative procedure.

This shift—from punishment to prevention—is one of the defining characteristics of Estonia's economic security model.


5.4 Stratlink: A Digital Decision-Making Infrastructure

The most distinctive element of Estonia's system is not the Strategic Goods Act itself, but the digital governance platform that supports its implementation.
​
Known as Stratlink, the Strategic Goods Operations Database provides a shared decision-making environment for government agencies involved in export control.​

Estonia Stratlink: Collaborative Decision Platform

Cross-agency export control workflow under the Strategic Goods Act

Decentralized Model

Stratlink Platform

1. Screening

➔

2. Joint Review (X-Road)

➔

3. License Decision

Stratlink is not a centralized database, but a digital decision platform for real-time inter-agency collaboration.

⚖️ Legal Authorities & Roles

DATA CONTROLLER (Final Authority)

Ministry of Foreign Affairs (MFA)

AUTHORIZED PROCESSORS (Reviewing Agencies)

□️ Min. of Defence

□ Min. of Economic Affairs

□️ Internal Security Service (KAPO)

□ Police & Border Guard (PPA)

□ Tax and Customs Board (MTA)

□ Screened Data Points (Transaction Risk)

[Application Data]

• License Status
• Export Declarations
• HS Codes

[End-User Risk]

• End-User Identity (UBO)
• Stated End-Use
• Sanction Lists

⚡ Real-time Verification: Customs clearance matching & Intelligence threat inputs.

□️ Secure Distributed Query via X-Road (Once-Only Principle)

Business Reg.

Customs (MTA)

Sanction Lists

License History

Police / KAPO

MFA / MoD

Under the legal framework established by Estonia's Strategic Goods legislation and the associated database regulations, the Ministry of Foreign Affairs serves as the data controller.
​
Authorized processors include the Ministry of Defence, the Ministry of Economic Affairs and Communications, the Estonian Internal Security Service (KAPO), the Police and Border Guard Board (PPA), and the Estonian Tax and Customs Board (MTA).

Each institution contributes its own specialized expertise.

The Ministry of Economic Affairs evaluates commercial and industrial implications. The Ministry of Defence assesses military risks. KAPO examines potential intelligence connections involving exporters, intermediaries, or end users. Customs authorities evaluate operational compliance at the border.

Crucially, these assessments are not conducted sequentially through isolated bureaucratic procedures.

They are integrated into a common digital environment where relevant authorities can evaluate the same case simultaneously while sharing evidence and risk assessments in real time.

This represents a fundamentally different approach to governance.

The database is not designed to identify whom to arrest.

Instead, it is designed to determine which transactions require closer scrutiny.

In this sense, Stratlink is far more than an administrative database.

It functions as a digital decision-making infrastructure, transforming fragmented information into coordinated governmental action.


5.5 The Institutional Lesson

Taken together, Estonia's system illustrates an important institutional principle.

Different security challenges require different institutional responses.

• Criminal law addresses espionage.
• SIS supports international situational awareness.
• The Strategic Goods Act regulates dual-use exports.
• Stratlink integrates information for evidence-based administrative decision-making.

Each layer performs a distinct function. None attempts to replace the others.

The effectiveness of the overall system arises not from any single institution, but from the integration of legislation, intelligence, digital governance, and inter-agency cooperation.

This layered architecture offers an important lesson for democracies seeking to strengthen economic security while preserving the rule of law.

The objective is not to criminalize every potential security risk.

Rather, it is to ensure that legitimate commercial activities can continue while governments possess the institutional capacity to identify genuinely high-risk transactions before they become national security threats.
​​

6. Lessons for Japan

The purpose of examining Estonia's institutional framework is not to suggest that Japan should simply replicate another country's legal system.

Every nation possesses its own constitutional traditions, administrative structures, security environment, and political culture.

Institutional reform must therefore reflect national circumstances.

Nevertheless, Estonia offers an important lesson that extends well beyond its own legal framework.

The key insight is that economic security should be understood as an institutional coordination problem rather than merely a criminal law problem.

This distinction has significant implications for public policy.

When governments focus primarily on criminal sanctions, institutional attention tends to concentrate on investigations after suspicious activities have already occurred.

By contrast, Estonia's architecture emphasizes continuous risk assessment before harmful transactions take place.

This shift—from ex post enforcement to ex ante decision support—is perhaps the most valuable lesson for democratic governments confronting increasingly complex supply chains.

Japan has already established many of the institutional components required for such an approach.
The Ministry of Economy, Trade and Industry (METI) administers export licensing.
The Ministry of Finance oversees customs administration.
The Ministry of Foreign Affairs coordinates sanctions and international diplomacy.
The National Police Agency and the Public Security Intelligence Agency monitor security threats.
Other ministries contribute expertise concerning technology, industry, and critical infrastructure.

The challenge is therefore not the absence of institutions.

Rather, it is the limited integration of information across those institutions.

Most administrative procedures still rely heavily on sequential consultations between organizations.

Information often remains fragmented across separate databases, making it difficult to establish a comprehensive picture of emerging risks in real time.

From this perspective, the central lesson from Estonia is not its criminal law.

It is its ability to transform multiple administrative perspectives into a shared digital decision-making process.

Japan's future institutional reforms should therefore focus less on creating new organizations with broader coercive powers and more on strengthening the government's capacity for evidence-based coordination across existing institutions.

This approach is fully compatible with democratic governance, judicial oversight, and respect for legitimate economic activity.


7. Toward a Data-Driven Intelligence Architecture for Japan

If the primary challenge is institutional integration rather than institutional absence, the next question becomes:

What kind of architecture should support democratic decision-making?

JEEADiS has proposed a model that may be described as a Data-Driven Intelligence Architecture.

The concept does not seek to centralize governmental authority.

Nor does it advocate expanding investigative powers beyond existing constitutional arrangements.

Instead, its objective is to improve the quality, timeliness, and consistency of governmental decision-making through trusted information sharing and structured intelligence analysis.
At the center of this architecture is a proposed National Intelligence Bureau (NIB).

Unlike many traditional intelligence organizations, the proposed NIB would possess no arrest powers, no search authority, and no prosecutorial functions.

Its principal mission would be to collect, integrate, analyze, and distribute intelligence relevant to national security and economic security.

In practical terms, the NIB would function as an analytical hub connecting information generated by multiple ministries and agencies.

Rather than making administrative or judicial decisions itself, it would provide objective intelligence assessments that support the competent authorities responsible for export licensing, customs inspections, law enforcement, diplomatic action, and national security policy.

This institutional separation reflects an important democratic principle:
Intelligence should support governmental decision-making, not replace it.

A digital platform comparable in concept to Estonia's Stratlink could further strengthen this architecture.

Rather than serving as a repository for administrative documents alone, such a platform would integrate information relating to export licensing, sanctions, customs declarations, corporate ownership, supply-chain relationships, end-user verification, and intelligence concerning high-risk entities.

Risk assessments could then be generated through structured data analysis rather than fragmented administrative judgment.

This approach would also contribute to protecting legitimate business activities.

Instead of imposing broad restrictions affecting entire industries, governments could identify genuinely high-risk transactions through evidence-based screening, thereby reducing unnecessary regulatory burdens on compliant companies.

One area where this approach would be particularly valuable is economic security.

JEEADiS has proposed a scenario-based intelligence framework in which security risks are classified according to domains and threat categories.

Within the Economic Security Domain, examples include disruptions to semiconductor supply chains, restrictions on critical mineral exports, attempts to acquire strategic companies through investment, and coordinated efforts to weaken technological resilience.

These developments are often visible only when information from multiple government organizations is considered together.

A data-driven intelligence architecture would enable such information to be integrated into a common operational picture, supporting faster and more consistent governmental responses.

Ultimately, the objective is neither stronger surveillance nor broader criminalization.

It is the construction of an institutional environment in which democratic governments can make better-informed decisions while preserving transparency, accountability, and the rule of law.

Such an approach reflects the broader transformation now occurring in many advanced democracies.

National resilience increasingly depends not only on legal authority but also on the quality of digital governance, institutional interoperability, and evidence-based policy coordination.

For Japan, the future of economic security may therefore depend less on whether it enacts an anti-espionage law than on whether it can build the digital institutional architecture necessary to govern complex security risks in an increasingly interconnected world.​