JAMES L. SCHOFF, DOUGLAS E. RAKE, JOSHUA LEVY
SUMMARY
In both Japan and the United States, there is a growing recognition that national security and alliance security involve more than just military concerns and extend to new technology areas and their economic effects. Looming over the two allies is a wide-ranging question of how to enable greater science and technology (S&T) research collaboration for commercial and defense purposes, involving such fields as artificial intelligence (AI), quantum information science (QIS), cybersecurity, and space utilization. Competing domestic political and economic considerations in each country make this a particularly complex challenge for policymakers, who can be expected to treat the international sharing or sale of assorted technologies differently. Still, there is little doubt that it is in the mutual interest of Japan and the United States to harmonize their approaches and find acceptable ways to enable deeper and broader S&T collaboration—and to do so expeditiously.
This paper outlines a series of observations and recommendations intended to advance U.S.-Japan S&T collaboration with national security implications.
Although the United States and Japan have a productive S&T relationship, there are significant gaps in terms of scale and scope when comparing their capacity to control and protect classified and sensitive information in dual-use technology areas.1 This is attributable to a combination of structural factors (such as the outsized role of U.S. defense and intelligence budgets), legal differences, and cultural and historical factors such as greater sensitivity in Japan to blurred lines between military- and commercial-application research.
This situation imposes notable limits on the ease of bilateral defense trade, Japan’s eligibility for partnership in certain sensitive U.S. government–funded research activities, and the allies’ ability to jointly make use of private sector research and development (R&D) with potential dual-use applications. As intensified technology competition with China drives new public and private investment in all of these areas, the allies will miss a strategic opportunity to leverage new resources if they do not take steps to address these restrictions.
A primary limiting factor for the participation of Japanese nationals in U.S.-sponsored sensitive scientific research is the inability for Japanese investigators or private sector engineers and scientists to receive domestic security clearances independent of a national defense program. This could be remedied by an amendment to Japan’s Specially Designated Secrets law similar to language in U.S. Executive Order 13526 that expands the law to include “scientific, technological, or economic matters relating to the national security.”
Although security clearances are the first hurdle, a review of similar U.S. agreements with other countries and existing military information agreements with Japan reveals other areas that many U.S. officials still consider to be insufficient when it comes to Japan’s security clearance process and information security regime. If Japan wants to reach a substantially equivalent level with the United States and conclude a new foundational information sharing agreement, it should consider several steps including:
clarifying its designated security authority in the government (possibly by creating a “special secretariat” (tokubetsu no kikan) within the Cabinet Office with interagency representation), creating a process for settling legal disputes in a classified manner, and
developing a cadre of security professionals within the Japanese government (similar to the GS-0080 class in the U.S. government).2
The Japanese government should also consider extending a justification for “scientific, technological, or economic matters relating to the national security” as an amendment to the Foreign Exchange and Foreign Trade Act (FEFTA)—or some similar action—that would strengthen the government’s ability to control private exports of certain technology research information and private sector hiring of foreign nationals in select situations to address potential insider threat risks. Altogether, this would raise the bar for industrial security in Japan and make it easier for the allies to establish general licensing arrangements that could facilitate the exchange of controlled goods and a wider range of sensitive information in a timelier manner than is currently possible.
While there have been agreements that allow Japan and the United States to share some sensitive and even classified information, there is a persistent view in the United States that Japan needs a more robust system for properly handling and protecting such information, particularly with respect to potential advanced S&T collaboration.3 This paper explains why perceptions can often matter as much as the tangible rules and procedures that exist when it comes to expanding information and technology sharing.
Japan requires a more holistic approach that considers high-priority security issues in the development of a legal framework, with sufficient penalties, along with an improved system that strengthens protocols and procedures for the classification of information, technologies, systems, methodologies, and intellectual property. This should include more secure ways of handling and protecting sensitive and classified information, materials, and technologies, as well as other physical aspects such as storage, limited access areas, and the like. Of equal importance is the selection, vetting, and training of those individuals who may receive clearances, enabling them to access classified information or materials. This points to the need for the development of a more robust security culture in key institutions that will probably include changes in some of the physical and digital facilities of these organizations.
It is clearly in the interest of both Japan and the United States (as well as other close partners) that Japan be seen as having the kind of information protection regime that can enable an intensification of S&T collaborations that all parties agree is essential to protect their common security interests. Thus, associated with some Japanese reforms, there should be a public relations dynamic that calls attention to these changes and reinforces this reputation publicly over time. In other words, the Japanese government and private firms should strive to get the credit they deserve for recent and future improvements.
Of course, all of this must ultimately be planned and implemented by Japanese parties to conform to Japanese law, its polity, and cultural norms. These reforms can be accomplished in such a way to provide confidence in Japan’s system on the part of the United States and other such allies. This will provide the essential foundation for greater sharing of sensitive and even classified information, as well as facilitating the growth of collaborative R&D in priority areas that have already been identified as worthy of greater joint efforts.
Additionally, in order to promote more synergy between public and private sector entities and between the defense and commercial sectors, the allies should consider establishing a bilateral public-private interdisciplinary body to work in support of high-level U.S. and Japanese policymakers. This council could draw from top laboratories and corporations to help policymakers leverage allied S&T collaboration in new ways and delineate clear priorities amid fiscal constraints.
INTRODUCTION AND PURPOSE
U.S.-Japan science exchanges and collaboration have a long history. Since the mid-1960s, the two countries have worked together on natural resources and medical sciences, followed by energy and outer space, and expanding more recently to include chemistry, computer science, and telecommunications.4 The political and foreign policy context for this collaboration has evolved with time as perceived political priorities and opportunities ebb and flow amid occasional direct competition. Throughout this half-century, however, there has not been the kind of bilateral alignment that is on display today in terms of 1) a widely perceived need for S&T collaboration with allies, 2) policymaker interest in pursuing this collaboration, 3) specific areas of priority research focus, and 4) overall strategic goals for such collaboration.
In early discussions, officials from the administrations of U.S. President Joe Biden and Japanese Prime Minister Yoshihide Suga have highlighted three main goals for U.S.-Japanese S&T cooperation: 1) mitigating climate change and its impacts, 2) being able to better control pandemics, and 3) staying ahead of (or keeping pace with) China in a wide range of critical technologies and domains of scientific discovery.5 The first two objectives lend themselves relatively easily to multilateral collaboration and open information sharing. The third goal is more pertinent in a bilateral context and suggests that more substantive allied cooperation involving protected information is in the offing.
This concept of China as a so-called pacing threat has been referenced by U.S. secretaries of defense serving both Biden and former president Donald Trump.6 It is also an underlying premise for U.S. legislative initiatives that will change the way Washington funds and directs high-tech research in the future.7 For example, one bill with broad support would authorize a reconfigured National Science Foundation (NSF) to spend $81 billion over the next five years, much of which is intended for research in AI, robotics, high-performance computing, and other technologies.8
The case for U.S. S&T collaboration with Tokyo is clear. Japan is the third-largest investor in R&D behind the United States and China, and Japanese companies fund more R&D in the United States than any other country’s firms.9 Japan is also the third most prolific patent filer in the world, behind China and the United States.10 Pooling resources, data, and talent would benefit both allies. The question is not whether bilateral S&T collaboration is a shared strategic opportunity but rather how to adapt it to keep up with new geopolitical realities and the rate of technological change.
The allies are already moving in this direction. The Japan-U.S. Joint High-Level Committee on Science and Technology Cooperation meeting in May 2019 called for greater bilateral collaboration in areas such as AI, QIS, and outer space.11 Later in 2019, the governments released a joint statement that outlined a more detailed agenda for bilateral collaboration on QIS, building on previous bilateral initiatives in nuclear energy, high-energy density science, and big data.12 Then, at their April 2021 summit, Biden and Suga announced the launch of a new “partnership for competitiveness and innovation,” officially called the U.S.-Japan Competitiveness and Resilience (CoRe) Partnership, which provides a framework for new initiatives.13
Both governments recognize that scientific and technological advances in these and other areas (such as cybersecurity, uses of the electromagnetic spectrum, and even critical infrastructure protection and emergency response) can have a dramatic effect not only on economic prosperity but also national security. As a result, U.S.-based research in such areas is increasingly classified or export controlled, even though existing bilateral S&T cooperation agreements—and, in many cases, certain aspects of domestic law—frequently do not allow the allies to fully leverage their S&T talent and resources for mutual benefit. Policymakers in both countries must consider ways to facilitate this cooperation if they want to realize the expressed goals of the CoRe partnership.
Beyond bilateral initiatives, the United States and other nations are also looking to form multilateral clubs (such as the UK’s proposed club of democratic countries [D10] or the Global Partnership on AI) that involve standard setting or even R&D for certain cutting-edge technologies that can help them outcompete China and enhance confidence in the trustworthiness of their communications and innovation networks.14 Some of these initiatives have explicit military connections (such as the U.S. Department of Defense’s International Science and Technology Engagement Strategy or Allied Prototyping Initiative [API]), while others seek to identify and more tightly control access to emerging, foundational, or critical commercial technologies.15
Japan’s ruling Liberal Democratic Party (LDP) is similarly promoting the idea of a new economic security law that could help Japan collaborate more with trusted international partners, bolster innovation, and increase engagement in standard setting.16 The Japanese government is already taking steps to enhance the country’s ability to protect valuable information within the private sector and research community, which could facilitate its participation in any multilateral clubs that might form around technology and innovation imperatives.17 These trends suggest a need to harmonize allied approaches to research conduct—or at least make them more compatible—so that the innovation ecosystem is able to grow while maintaining mutual confidence in the protection of sensitive information.
Douglas E. Rake
Douglas E. Rake is the president and chief executive officer of Racke Strategies & Technologies, Inc. (RST). Rake and his company concentrate on the formulation and execution of strategies for the development and growth of international collaborations in science and technology research and development as well as their related applications and market entry.
Unfortunately, the complexity of domestic rules governing high-tech trade and research in the United States and Japan (especially when it involves international partners) makes it difficult to know what adjustments could be made that would meaningfully expand bilateral S&T collaboration opportunities in a reliable way. This paper is intended to help policymakers in both countries decide which reforms are most likely to effectively expand U.S.-Japan collaboration on S&T research, development, and application in areas of common interest and shared security priorities.
This paper’s objectives include:
clarifying for both specialists and nonspecialists the policies and legal frameworks that govern U.S.-Japan S&T research cooperation in sensitive technology areas, including identifying both formal and informal barriers to bilateral collaboration;
identifying areas of poor research protection compatibility and examples of missed opportunities for bilateral R&D collaboration (with a specific focus on security clearances and information security);
recommending policy adjustments that can facilitate U.S.-Japan collaboration in the near term and identifying issues that might require further study and debate over longer time horizons; and
building upon ongoing work by the Carnegie Endowment for International Peace, Racke Strategies and Technologies, and others that is helping to design an improved public-private process to take full advantage of the alliance’s collective S&T resources and apply them purposefully for mutual strategic benefit (known as the Japan-U.S. Strategic Science, Technology, and Innovation Initiative, or JUSSTII).
THE U.S. INFORMATION SECURITY SYSTEM FOR SCIENCE AND TECHNOLOGY
THE U.S. GOVERNMENT’S APPROACH TO MANAGING CLASSIFIED INFORMATION
Because a considerable share of U.S. R&D on cutting-edge technologies is funded by the federal government, often the results may be subject to government information controls. Despite the military connotation, U.S. government information classification is not exclusive to the Department of Defense (DOD). In fact, the three general levels of classification—top secret, secret, and confidential—reflect the government’s evaluation that unauthorized disclosure “reasonably could be expected to cause . . . exceptionally grave damage,” “serious damage,” or “damage” to the United States’ national security.18 The existing classification regime was promulgated by Executive Order 13526, signed by then president Barack Obama in 2009.19 It delegates original classification authority to the heads of many government departments and cabinet-level agencies,20 including individuals with job descriptions as diverse as the head of the National Aeronautics and Space Administration (NASA), the secretaries of defense or energy, the U.S. trade representative, and the Environmental Protection Agency administrator.21
Executive Order 13526 also explicitly identifies “scientific, technological, or economic matters relating to the national security” as a legitimate classification category. Indeed, many kinds of research are considered pertinent to national security and are determined by their respective departments and agencies to be classified as state secrets. This research is often conducted at the national laboratories belonging to the Department of Energy (DOE) and other U.S. government research institutions (though it also takes place at private research facilities and with academic institutions). Further, such research is usually sponsored by the DOD and/or the DOE. Though the order does state that “basic scientific research information not clearly related to the national security shall not be classified,” there are few legal guidelines that distinguish between basic research that does and does not relate to national security. Regularly, material that is classified is not available to non-U.S. nationals unless a specific determination is made to share that information.
Under certain circumstances, foreign nationals can be granted limited access to specific types of classified materials. For example, under the DOD’s National Industrial Security Program Operating Manual (NISPOM),
compelling reasons may exist to grant access to classified information to a non-U.S. citizen. Such individuals may be granted a Limited Access Authorization (LAA) in those rare circumstances where the non-U.S. citizen possesses unique or unusual skill or expertise that is urgently needed to support a specific U.S. Government contract involving access to specified classified information and a cleared or clearable U.S. citizen is not readily available.22
However, an LAA is restricted in several ways pertaining to scientific research exchanges. An LAA does not grant the recipient access to information marked as top secret, restricted data (RD), no foreign nationals (NOFORN), or communications security (COMSEC). It is plausible that an LAA could be granted to a Japanese researcher or scholar for the purposes of DOD- or DOE-sponsored research if they are granted an appropriate clearance in Japan.23 However, because of the ad hoc nature of the LAA program and its urgency requirement, it is not likely to be appropriate for developing a sustained research collaboration program. It also lacks a spirit of mutual benefit that would be necessary to sustain long-term bilateral S&T cooperation related to shared security interests.
Over sixty-five years of defense cooperation, the United States and Japan have developed a series of agreements and procedures for sharing sensitive and classified information with each other, particularly when it relates to military information, defense equipment, and information pertaining to nuclear energy.24 Currently, military and intelligence secrets are shared between the Japanese and U.S. governments under the framework of the General Security of Military Information Agreement (GSOMIA) signed in 2007.25 This agreement allows for those who have received “personnel security clearance” from their respective governments to participate in the transfer of classified military information (CMI). Each side agrees to protect CMI in a “substantially equivalent” manner as the other, including in storage, transmission, and vetting of those provided access (such as government or military officials and contractors or sub-contractors) via a personnel security clearance system.
Joshua Levy
Joshua Levy is a James C. Gaither Junior Fellow in the Carnegie Asia Program.
At present, the definition of CMI could conceivably include scientific information and technology generated by Japanese or U.S. government entities, as long as that information is clearly “defense-related.”26 More broadly, the U.S. government has developed a set of guidelines and procedures for sharing CMI and other sensitive information with other countries.27 Technical data, applied R&D, controlled unclassified information, and other components of so-called international programs related to defense or national security are subject to the National Disclosure Policy (NDP).28 Such disclosure is not limited to defense-related material and could apply to a wider range of research linked to national security. However, there are five basic disclosure criteria that must all be met before sensitive or classified information can be shared with non-U.S. entities or personnel:
The disclosure must be consistent with U.S. foreign policy objectives vis-à-vis the recipient country or region.
It must be consistent with U.S. military and security objectives.
The recipient nation will “afford the information substantially the same degree of protection as the United States provides” (in terms of both intent and capacity).
The benefits to the United States of sharing the information should be equal to or greater than the value of the information itself.
The disclosure must be limited to the minimum necessary to accomplish the sharing objective.29
The third criterion is a major focus of this paper, so it is worth outlining some additional details for how this determination is made. Regarding intent, the existence of a GSOMIA with that country is generally considered sufficient for a favorable opinion. For the issue of capacity, the U.S. National Disclosure Policy Committee (NDPC) sends officials to visit partner nations, examines those countries’ security programs, and reports on their findings. In addition, the U.S. intelligence community is also asked for its assessment of foreign security programs and compliance with U.S. standards. Sometimes the NDPC also requests special investigations of a foreign government’s practices regarding specific technologies or capabilities. Endorsing sufficient capacity is sometimes incorporated into a foundational information-sharing agreement, such as an industrial security annex (ISA) to a bilateral GSOMIA.30
Overall, the NDPC places significant emphasis on how a partner nation decides whom to trust within the government and how personnel security clearances are issued. Special attention is paid to “access by contractors under third-party control or influence,” and these contractors are required to have the same level of personnel security clearance as their government-official counterparts (along with a “need to know”).31 The foreign country’s legal framework must “bind contractors to the provisions” of their bilateral security agreement related to CMI and other protected information, meaning that whatever criminal penalties apply to unauthorized disclosure of the information by foreign government officials should also apply to contractors.
DEPARTMENT OF DEFENSE PROGRAMS
In the interest of fostering international research collaboration on sensitive topics (and for the purpose of advancing national security), the DOD runs and sponsors various research programs involving other countries. For example, in 2018 the undersecretary of defense for research and engineering, along with the UK Ministry of Defense, piloted the Bilateral Academic Research Initiative (BARI) to advance basic research in the field of AI-augmented human decisionmaking.32 Between the two governments, the team of researchers at academic institutions in the United States and in the United Kingdom received grants amounting to just shy of $5 million. Though still a pilot program, initiatives like BARI serve as an important precedent for basic-research collaboration across national borders. Should it succeed, the BARI pilot project could serve as a template for future collaboration between U.S. and allied research teams.
The DOD sponsors and funds several other research collaboration efforts, which are governed by rules and procedures outlined by the NDP.33 Such cooperative R&D can take the form of data and information exchange programs, engineer and scientist exchange programs, specific cooperative projects (such as U.S.-Japan bilateral work on the SM-3 Block IIA missile), and foreign comparative testing to explore the compatibility of U.S.- and foreign-made defense equipment.
The Coalition Warfare Program (CWP), for example, funds basic and applied research in technologies to address “strategic technology gaps.”34 The CWP requires collaborative efforts by U.S.-based and foreign-based teams and does not cover more than 50 percent of an investigation’s costs (thus requiring an ally to share the burden of additional research).35 Similarly, the API is a program for pooling R&D funding and expertise with other countries.36 Both CWP- and API-sponsored projects require government-to-government international agreements. Consequently, on a case-by-case basis, it may be necessary for participating individuals and/or organizations to earn security clearances in their home countries. The U.S.-based teams can, under certain circumstances, receive funding from both the CWP and API.
In fiscal year 2020, the DOD identified several priority areas for its investments, among them quantum science, defensive and offensive hypersonics, directed energy, AI, and biotechnology. Additionally, the fiscal year 2021 National Defense Authorization Act (NDAA) allocated over $105 billion for research, prototyping, and associated evaluation programs. Of that, over $8 billion was appropriated for basic and applied research, much of which will be conducted through academic institutions and the armed services’ research laboratories. Appropriations for offensive and defensive hypersonic technologies exceeded $1.5 billion; directed energy research and prototyping programs received over $480 million; and quantum research initiatives were allocated over $200 million.37
The NDAA also increased annual funding for the Joint Artificial Intelligence Center (JAIC) that coordinates ongoing AI research—among many other activities—to $132 million.38 All of these areas have also been identified by the Japanese and U.S. governments as high-priority areas for expanding bilateral science, technology, and systems R&D. Some of this work, however, will fall outside of the CMI designation yet still involve access limitations and dissemination controls, so cooperation may be difficult to accommodate under existing U.S.-Japan information sharing agreements.
DEPARTMENT OF ENERGY PROGRAMS
Though it is not often referred to or viewed as such, the DOE is effectively the United States’ department of science. Responsible for managing the network of national laboratories and many of the researchers who work in those facilities, the DOE participates in and funds both classified and unclassified research. In addition to managing research conducted at national laboratories, the DOE also serves as a grant-awarding institution. It regularly issues funding opportunity announcements (FOAs) to seek competitive submissions from the general scientific community for funding in specific fields.
Some of the department’s classified work takes place in connection with the nuclear weapons stockpile (such as the Stockpile Stewardship and Management Program or related initiatives), or through contracts with the DOD, the intelligence community, and law enforcement agencies in addition to other occasional government sponsors. Such work is consistently carried out by the three biggest national laboratories: Lawrence Livermore National Laboratory, Los Alamos National Laboratory, and Sandia National Laboratories. All three work under the DOE’s National Nuclear Security Administration (NNSA). Similar work is performed by national laboratories administered by the DOE Office of Science, including Oak Ridge National Laboratory, Pacific Northwest National Laboratory, and others.
It is important to note that these facilities work on sensitive and nonsensitive research projects alike—that is, both classified and unclassified work takes place at national laboratories overseen by NNSA, the DOE Office of Science, and other DOE offices (like the Office of Nuclear Energy). In many instances, this is possible because facilities within the campuses are physically segregated such that classified and sensitive work can be appropriately protected and isolated in limited access areas away from researchers who may not have the appropriate personnel security clearances.
Additionally, all work carried out at the national laboratories is governed by detailed classification guidance with no flexibility that is issued by the funding agency. Such guidance may amount to few or no restrictions—or there could be an extensive set of instructions that limit who inside and outside the laboratory is able to access project information. Moreover, any time unclassified information is shared with people outside of the laboratory, every PowerPoint slide, memo, or dataset must be clearly marked with an explanation for why that information is allowed to leave the confines of that particular facility.39
With respect to international collaboration and unclassified work, the DOE is subject to the same regulations as other agencies, including export controls. Indeed, chapter 25 of the DOE Acquisition Guide explicitly notes that the fundamental research exemption identified by National Security Decision Directive 189 (NSDD-189) “does not take precedence over statutes.”40 That is, DOE-funded research materials, results, and documents ought to be reviewed by the department’s Office of Classification prior to publication or dissemination to ensure that they do not contain export-controlled or classified national security information. The prepublication terms are generally negotiated on a case-by-case basis between the department and the researchers with DOE funding.41
In some instances, as part of its collaboration efforts, the DOE may choose to establish a strategic partnership project (SPP, formerly known as a work-for-others agreement) with another federal or nonfederal entity.42 In this case, research work may be conducted in tandem by DOE laboratories and other government agencies, private corporations, or foreign entities. SPPs are required to meet the following criteria:
The project must be consistent with or complement the identified laboratory’s mission.
The project must not adversely affect the performance of other laboratory programs.
The project must not place the identified laboratory in direct competition with the domestic private sector.
The project must not adversely affect the future performance of the laboratory.
If the above criteria are satisfied, then the department may consider establishing an SPP. Notably, laboratories cannot use government resources to conduct an SPP without an appropriate and explicit allocation of funds to the project. Moreover, in the same spirit as the above criteria, any laboratory that expends 20 percent or more of its regular operating budget on SPP-related activities is subject to greater regulatory scrutiny.43 Intellectual property and data resulting from an SPP can be protected as propriety information of the partner. Additionally, the partner retains the right to elect the title to inventions and intellectual property generated by an SPP, though the partner may opt for a limited government license.
Parallel to SPPs, the DOE also participates in cooperative research and development agreements (CRADAs) with nonfederal entities. Unlike SPPs, CRADAs require the nonfederal entity to provide funding for research or make in-kind contributions that may include, but are not limited to, personnel, equipment, services, or intellectual property.44 The partner entity may pay up to 100 percent of associated costs. SPPs, by contrast, may simply involve a nonlaboratory entity paying the laboratory to conduct research work. CRADAs allow the partner entity and the laboratory to share generated intellectual property, though each party retains title to its own inventions. Oftentimes, the partner has the option to negotiate an exclusive license to the laboratory in question. Data generated as a result of the cooperative investigation can be protected from public disclosure for up to five years.45
Finally, third-party researchers and institutions can sign a nonproprietary user agreement (NPUA) with many of the national laboratories. NPUAs allow third-party “users” to utilize DOE or laboratory equipment for experiments, provided the users pay for their own experimental costs.46 Under this structure, users generally commit to openly publish the results of any investigation. Consequently, NPUAs are not used for classified work and users are frequently academic institutions. Under an NPUA, the DOE retains unlimited rights to access data generated by the investigation, but the user retains title to the underlying intellectual property. If the users wish to keep the results and resultant intellectual property of the investigation as proprietary information, they can negotiate access with laboratories or the department on a full cost recovery basis. User agreement proposals are evaluated by a merit review process.47
The DOE has collaborated with Japanese entities on advanced research topics in the past and continues to do so. In June 2021, the DOE and Japan’s Ministry of Education, Culture, Sports, Science and Technology (MEXT) signed a project arrangement to promote R&D on quantum communication, computing, and other aspects of QIS.48 The FOA was facilitated by a series of overlapping and concentric international cooperation agreements. From the most fundamental to the most accessory, the legal frameworks included:
the 1988 U.S.-Japan Agreement on Cooperation in Research and Development in Science and Technology;
establishment of the bilateral Civil Nuclear Energy Research and Development Working Group in 2012;
the 2013 DOE-MEXT Implementing Arrangement Concerning Cooperation in Research and Development in Energy and Related Fields;
a 2015 DOE-MEXT Project Arrangement concerning high energy physics;49
a 2015 Implementing Arrangement Between the Department of Energy and the Ministry of Economy, Trade and Industry of Japan Concerning Cooperation in Research and Development in Energy and Related Fields; and
a 2019 DOE-MEXT Project Arrangement concerning high energy density science.
During research collaboration activities and visits to department facilities, foreign individuals and entities are supposed to be screened by the department according to the Science and Technology Risk Matrix.50 Managed by the DOE Federal Oversight Advisory Body, the S&T Risk Matrix evaluates the sensitivity of the subject matter and the nationality of the foreign individual/entity to determine if or what kind of access should be allowed to facilities and information.51 Thus, some “sensitive country foreign nationals” may be permitted to access certain facilities or participate in certain programs but not others depending on the level of sensitivity. For instance, a Chinese researcher might be barred from visiting an NNSA-managed laboratory or participating in stockpile stewardship but might nevertheless be allowed to participate in research pertaining to solar photovoltaic cells.52
It could be worthwhile to examine U.S. arrangements with Israel in more detail, given the two countries’ close collaboration on science. Despite Israel’s inclusion on the department’s sensitive country list, the relationship occasionally involves classified information.53 The same is true to some extent with India, which is also on the sensitive country list but recently concluded an ISA with the United States that allows for a wider range of defense technology cooperation. The key difference in these cases—in terms of why Washington allows for more permissive information sharing—is that both countries are recognized for having a well-developed and robust system for protecting classified information, including an effective process for vetting and training people or organizations that are granted clearances.54
GOVERNMENT-SUPPORTED UNCLASSIFIED SCIENCE AND TECHNOLOGY RESEARCH
The NSF is an independent agency of the U.S. federal government that funds basic and applied physical and social scientific research. As an independent agency, it does not report to a higher-level government entity as, for instance, the National Institutes of Health reports to the Department of Health and Human Services.
Although the NSF does collaborate with other government institutions, the vast majority of its funding is directed toward colleges, universities, and other academic entities.55 In fiscal year 2020, 80 percent of the NSF’s $7.9 billion budget was awarded to educational institutions for research to be conducted by their scholars. A further 13 percent was awarded to small business, nonprofit institutions, and private industry.
While the NSF funds work in many areas of basic and applied sciences that may be deemed sensitive, the agency’s policy states that “NSF grants are intended for unclassified, publicly releasable research.”56 As a consequence, NSF grantees are not granted access to classified information by proxy of winning a funding award.57 However, the NSF notes that, in line with other statutes concerning the protection of classified information, if a grantee’s research produces information or results that may be deemed classifiable, it is incumbent upon the grantee to notify the appropriate NSF program officer or federal government representative promptly.
As competition between the United States and China intensifies, the U.S. Congress and executive branch agencies have become increasingly concerned about protecting sensitive U.S. research efforts from Chinese exploitation. In response, they have placed new restrictions on who can be eligible for NSF funding and pressed for tougher scrutiny to maintain so-called research integrity. This term goes beyond the underlying veracity and soundness of the research itself to include ensuring that researchers have no undisclosed or compromising connections to rival nations, such as China.
A 2019 “Dear Colleague” letter from the director of the White House’s Office of Science and Technology Policy, for instance, stressed the importance of establishing and coordinating disclosure requirements for researchers applying for federal funding.58 New guidelines and rules for stricter enforcement of conflicts of interest, participation in foreign talent recruitment programs, and affiliations with other research institutions have been prescribed for the NSF in a December 2019 report by JASON, an independent scientific advisory group.59 Thus, although the NSF does not conduct personnel security clearance background checks in the traditional sense, the enhanced disclosure requirements serve as a soft security measure.
Additionally, since the publication of the JASON report, the NSF has created the Research Security Strategy and Policy Group, led by a new chief of research security, to work with the Office of the
Inspector General on auditing these disclosures for potential grant fraud.60 An initial audit of past grants found up to 8 percent contained anomalies (such as subsequent publication of NSF-funded research crediting another entity in addition to the NSF that was not disclosed on the NSF grant proposal).61 This produced several cases that have subsequently been referred to the Federal Bureau of Investigation (FBI) for further investigation.62
In the same vein, the NSF ended foreign participation in its Intergovernmental Personnel Act (IPA) assignment program, whereby the NSF would assign outside personnel to rotate through various research institutions, including government agencies and private and public universities.63 Now, all such rotating personnel must be U.S. citizens. NSF employees are also barred from participating in foreign talent recruitment programs, though this policy presently does not extend to include NSF grantees who are employees of third-party institutions.
Despite its increasing focus on research security, the NSF continues to maintain robust international cooperation programs, although it is possible that information protection requirements will be enhanced in the future.64 Among several hundred international cooperation awards funded by the NSF, many are in conjunction with Japanese researchers and agencies. Projects include researcher exchanges on topics as diverse as exascale computing technologies for data analytics and deep learning; biobased materials science; investigations of computational analysis of solid oxide electrolysis for energy storage; and network-of-networks organization for creating roadmaps for future investigations and demonstrations of quantum technologies.65
These projects collectively receive millions of dollars in NSF funding, which Japanese agencies usually match by funding their own researchers who are collaborating with U.S. partners. Information is supposed to flow freely between these bilateral teams, but the NSF is considering the inclusion of stricter information protection requirements on grantees for experiment data, prepublication information, and the grant proposals themselves.66 Congress is pushing for this as well.67 Any mismatch in information handling protocols could complicate research collaboration. It would be especially unfortunate if this problem arose just as Congress, which is looking to vastly increase funding for the NSF, has singled out Japan as a priority innovation partner.68
PRIVATE-SECTOR CONSIDERATIONS AND CLASSIFIED PATENTS
For all the focus on how government funds are spent on basic research in the United States (and efforts in recent years to increase that spending), the private sector supports most S&T research (see figure 1). At one point in the 1960s, during the Cold War, federal government R&D spending peaked at nearly 2 percent of the country’s gross domestic product. In recent decades, though, the ratio has dropped below 1 percent while private industry spending has grown. Nondefense high-tech firms are the most prolific spenders on R&D (see figure 2), although only a relatively small portion is dedicated for basic research and shared publicly. The huge amount of private sector money spent on R&D means that governments must continue to stay connected to the private R&D infrastructure and help companies protect their valuable intellectual property spanning a wide range of end uses.
Private sector technology R&D is ostensibly beyond the reach of U.S. government classification control. There is, however, a process whereby the government can issue classified patents, which serve similarly to restrict access and increase penalties for unauthorized disclosure. In 1951, Congress passed the Invention Secrecy Act.69 If the commissioner for patents of the U.S. Patent and Trademark Office determines a patent application contains intellectual property that would threaten U.S. national security should it become public, the commissioner can issue a secrecy order to the patent filer. This restricts the ability of the patent filer to publish the intellectual property enclosed in the patent application. That is, the secrecy order applies to the subject matter itself and not merely the contents of the application. Usually, if the patent is subject to a secrecy order, the U.S. Patent Office will not issue the foreign patent license that is regularly issued upon the receipt of a patent application. This limits the patent filer’s ability to seek patent protection in foreign jurisdictions.
Generally, the commissioner for patents determines whether a patent contains such information in consultation with officials in branches of the armed forces, the National Security Agency, the DOE, NASA, and the Department of Justice. Potentially secret patent applications are checked against the Patent Security Category Review List (PSCRL), which outlines the types of technologies that may be deemed national secrets. The PSCRL however, is a classified document.70 A 2009 Freedom of Information Act request revealed that, at that time, twenty-two “groups” of technologies were considered subject to potential classification. However, the remainder of the document was redacted, giving little indication to those applying for patents if their inventions could be subject to secrecy orders.
There are three types of secrecy orders that the commissioner can issue:71
Type I: Foreign patent filings may be permitted for certain countries. Such an order permits patent applications that pertain to some military and space technologies. Notably, because the United States and Japan have reciprocal security arrangements, Type I secrecy orders may allow for U.S. inventors to apply for patents in Japan. This type of order is the most permissive and is intended to control the dissemination of the subject information while still allowing for its utilization.
Type II: The contents of the patent filing should be treated as if it were classified or classifiable technical information. As a result, Type II orders allow for the disclosure of technical information in accordance with NISPOM. Type II orders are usually issued to those who have or are subject to a DOD security agreement.
Type III: The contents of the patent filing should be treated as if they were classified or classifiable technical information. Type III orders generally prohibit the disclosure of the subject matter without the express permission of the commissioner. This type of order is issued when one of the above two types would not be appropriate. Type III orders are usually issued to those who do not have a DOD security agreement.
Secrecy orders last for a period of one year and can be repeatedly renewed by the commissioner. At the end of fiscal year 2020, 5,915 patents were subject to secrecy orders, forty-five of which were newly issued.72
There are also other private sector considerations related to information security and international collaborations. Increasingly, the U.S. government is collaborating with private industry to improve cybersecurity practices and protect Americans’ personal information and trade secrets. However, because the U.S. government seeks out vulnerabilities to conduct its own intelligence gathering and cyber espionage activities, the various government agencies that discover, develop, and use so-called zero-day exploits are required to balance the imperatives of its classified missions and interests against the public interest in disclosing the existence of such exploits to developers who could patch these vulnerabilities.
To balance these competing interests, the government established the Vulnerabilities Equities Process (VEP) in 2008 (last publicly updated in 2017).73 If the constituent members of the Equities Review Board determine that the disclosure of a discovered, classified vulnerability will satisfy a certain public interest without damaging military, operational, intelligence, commercial, law enforcement, or diplomatic interests, the vulnerability can be disclosed and reported to a software developer to be rectified. The Equities Review Board can also choose to inform “allied government entities of the vulnerability at a classified level.”74 In the case of Japan, however, it is not clear how Japanese authorities could share relevant information with certain private companies that might need to take countermeasures. As this paper explains later, Japan’s information security system does not extend into the private sector as extensively as does the U.S. system.
Additionally, because of the United States’ robust defense and civilian research infrastructure and bases, many firms from around the world choose to locate R&D facilities in the United States. Though the U.S. government does award research contracts involving classified information to non-U.S. firms, companies that are subject to foreign ownership, control, or influence (FOCI) are required to satisfy certain conditions to ensure the security of that information.75 A firm is considered to be under FOCI if it satisfies any of a number of conditions, including but not limited to: large tranches of equity or debt obligations being held by a foreign entity or entities; a non-U.S. citizen or citizens being on the board of directors or in senior executive or management positions; a foreign entity or entities having the power to appoint or control the board of directors; significant revenue or income reliance on foreign markets or entities; and other personnel or financial involvement with foreign entities.
Firms that are deemed to be subject to FOCI are required to pursue at least one of a number of remedies to mitigate that FOCI.76 A FOCI firm may pursue a board resolution, the least onerous of the possible remedies, to ensure that foreign entities that may control or exert influence on the firm do not have access to any classified information. Because this is the least restrictive mitigation instrument, it is unavailable to FOCI firms that have foreign nationals on their board of directors. Firms can opt to create a special security agreement (SSA), whereby a largely independent, wholly U.S.-subsidiary firm is established to create distance between the foreign entities of potential concern from the new firm that would handle the classified contract and information. It must be demonstrated to the Defense Counterintelligence and Security Agency (DCSA), which is responsible for FOCI firm administration, that the new entity would be financially viable.77 Finally, a FOCI firm could opt to create a voting trust or proxy agreement, whereby the foreign entities place several of their authorities over the firm (such as voting rights, corporate management, mergers, or declarations of bankruptcy) in a trust of DCSA-cleared U.S. citizens. Because this, in effect, requires the foreign entity to relinquish control of the firm, it is the most restrictive option and the one that is pursued least frequently.78
PERSONNEL CLEARANCE PROCESSES IN THE UNITED STATES
The process by which the U.S. government evaluates its military and civilian personnel—as well as private citizens—to issue security clearances has evolved over time, but it has suffered repeated criticism for being inefficient. For example, unsatisfied with the performance of the government’s background investigation process, Congress and the Obama administration pushed reforms in 2016 that consolidated those activities in the National Background Investigations Bureau (NBIB) within the Office of Personnel Management (OPM). At that time, the backlog for investigations was over 570,000 cases, up from 328,000 cases the year before.79 But NBIB was unable to turn the situation around, and the backlog grew to 700,000 in 2017 with an average investigation period of 450 days.80 The security clearance backlog peaked at 725,000 in 2018. By then, there were calls in Congress for additional reforms.81 A massive cybersecurity breach at OPM in 2018 sealed the fate of NBIB, and its operations were transferred to DOD starting in 2019.82
Since 2019, the newly established DCSA (created by Executive Order 13869) combined NBIB with the Pentagon’s own Defense Security Service to assume responsibility for roughly 95 percent of all federal government background investigations.83 That amounts to about 2 million background investigations each year.84 Under DCSA, the personnel security investigation mission was broadened to include insider threat analysis and a continuous evaluation and vetting program, with an estimated 675,000 industry employees enrolled in continuous vetting.85 DCSA also has an industrial security mission in its organization’s roots, and it oversees implementation of the National Industrial Security Program (NISP) and NISPOM (established via Executive Order 12829 in 1993 and subsequently updated by Executive Orders 12885 and 13691).86 The DCSA director reports to the undersecretary of defense for intelligence.
The NISP was created to make sure that U.S. industry is properly prepared and effectively carries out its responsibility to protect classified information in its possession when performing work on government contracts. DCSA clears over 12,000 contractor facilities for hosting classified materials belonging to the DOD and thirty-three other federal agencies, including NASA, the State and Commerce Departments, the NSF, and others.87 In the first half of fiscal year 2020, DCSA processed 130,000 industry requests for personnel investigations. It oversees 844,000 contractors with clearance eligibility, of whom about 455,000 are enrolled in a continuous evaluation program.88
The NISP is supported by a public-private advisory committee called the National Industrial Security Program Policy Advisory Committee (NISPPAC), which combines government agency representatives with those from private companies (like General Dynamics or ManTech) and research entities (like the Massachusetts Institute of Technology or the RAND Corporation) who review and recommend changes to industrial security policy.89 NISPPAC is a forum where relevant government agencies can update industry about proposed modifications to current practice and where industry can seek clarification, push back against proposals, or suggest different priorities based on their understanding of the needs in the field and compliance challenges.
CONTROLLED UNCLASSIFIED INFORMATION
In many settings, the U.S. government has an interest in restricting access to certain types of information even where it cannot be classified. Since 2010, when Obama issued Executive Order 13556, such information can be deemed as controlled unclassified information (CUI).90 The original intention of the order was to harmonize various unclassified dissemination control standards that were being used by the many agencies of the U.S. executive branch. Agencies throughout the government are each individually responsible for determining what is considered CUI, but standards for the handling of that information are meant to be uniform.
The bulk of CUI in the United States has no connection to national or economic security. It frequently covers personal information, personnel records, health records, or other information protected by law from public release. Important exceptions to this rule include critical infrastructure, nuclear, intelligence, and export-controlled research.
As part of the United States’ export control regime on sensitive technologies, the Export Administration Regulations (EAR) and International Trafficking in Arms Regulations (ITAR) are the two primary statutes that govern R&D. The latter pertains to military and aerospace technologies more narrowly and is administered by the State Department, while the former concerns almost all other sensitive technologies (such as communications, nonmilitary nuclear, industrial, biological, or chemical) and is managed by the Department of Commerce. The DOD and other agencies also play an active role in the U.S. export control regime.91
So-called export-controlled research largely falls under the purview of the Department of Commerce’s Bureau of Industry and Security (BIS), which can determine such research to be CUI and subject to export control licensing requirements. This has implications on research that may be conducted by foreign nationals and involve foreign funding.
Most basic research that is conducted at universities falls under the fundamental research exemption and is subject to less restrictive (or no) controls on the export of sensitive technologies or software.92 If none of the following conditions are violated, then scientific research can be regularly conducted by foreign nationals and with foreign funding unless explicitly prohibited by Title 15 of the Code of Federal Regulations (CFR), Chapter VII §734.6-10. The conditions that must hold include the following:
The principal investigator(s) must intend to publish the results of fundamental research such that they are regularly available to the wider scientific community. Such publications include books, academic journals, and the like. That is, the results of such research must not be considered proprietary to a firm or other such organization.
There must not be any ex ante limitation by research sponsors of any publication of research results or quid pro quo side deals between the sponsor and principal investigator(s).
Federally funded research must pass a prepublication process to determine whether any sensitive research is contained in the research results. Such research can be found not to be eligible for the fundamental research exemption at the discretion of the reviewing agency.
There must not be any material transfer of goods that are the products of fundamental research across borders. Only the results may be published and made available to the broader scientific community.
The fundamental research must take place within the borders of the United States.93
For research that does not fall within the above parameters—particularly corporate R&D—resultant technology and software may be deemed CUI and be subject to certain export controls by the BIS.94 In the case that research and its outcomes are determined to be CUI, international information sharing is still possible. CUI is eligible for the marking REL TO [country], which means release to nationals specified, and interested parties can apply to the BIS for export licenses for such information. Such applications are considered on a case-by-case basis, and there still can be a need-to-know requirement in some situations.95 Moreover, the disclosure of CUI to nonexecutive branch entities should be regulated and managed by a written agreement, and disclosure of CUI to foreign entities should also be limited according to a written agreement and other specific criteria.96
In order to ease the process of arriving at an agreement, international research partners can adhere to the same standards for protecting CUI as specified by the Department of Commerce’s National Institute of Standards and Technology (NIST). NIST’s Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171 Rev. 2) mandates that information deemed as CUI Basic be protected in the same manner as information with security classifications “at higher than moderate confidentiality” as identified in the Standards for Security Categorization of Federal Information and Information Systems (FIPS PUB 199) and the Minimum Security Requirements for Federal Information and Information Systems (FIPS PUB 200).97 These requirements concern over a dozen different families of practices and procedures to protect CUI including how to control access to CUI, how to audit information systems, and how to physically protect CUI, among others.
Everyone with access to CUI must undergo mandatory training—whether they are inside or outside the government—and NIST has created detailed processes for organizations to assess their preparedness for protecting CUI and to address advanced persistent threats (particularly cyber threats).98 NIST and DOD acquisition officials work closely with private industry representatives to build in some flexibility for the protection methods, which allows them to tailor their approach so that technology solutions are not overengineered. Some CUI might require “expensive [and] exquisite capabilities” to protect against unlawful access, but Pentagon officials have said that they “don’t want companies spending money to buy security that [they] don’t feel will be necessary to protect the Department of Defense information and national security information.”99
Because CUI is created by so many agencies that are granted the prerogative by different statutes, the penalties and sanctions associated with unauthorized disclosure of CUI are wide ranging. Violations of export controls in the dissemination of CUI research are subject to the 2018 Export Control Reform Act. Pursuant to section 4819 of that title, the U.S. government can impose criminal and/or civil penalties. Criminal sanctions include a fine of not more than $1 million and/or a prison sentence of not more than twenty years per violation. Civil sanctions include a fine of not more than $300,000 per violation. The secretary of commerce can also revoke licenses or bar individuals/entities from participating in the United States’ export licensing regime.100
Moreover, because CUI covers such a vast breadth of information—from human resources information to nuclear naval propulsion technologies—the process for accessing CUI varies widely. As a rule, information that is deemed CUI does not require a security clearance to access. However, there are cases where an individual would need a security clearance to access the systems or facilities that maintain the CUI, thereby necessitating a security clearance, or where the specific CUI of interest requires a security clearance and background investigation under a particular statute or regulation. In all cases, those handling, processing, storing, or maintaining CUI must have a lawful government purpose when doing so.101
It is important to note that CUI is a marking that can only be applied to information that is created for or by the government and needs to be protected pursuant to a law, rule, or government policy. That is, research on sensitive topics may be controlled but cannot be deemed CUI unless the research was conducted by or for the government and/or is subject to a government contract or agreement. Nevertheless, BIS may at some point decide that sensitive research should be subject to export controls and subsequently be treated in a manner similar to CUI—or even receive the CUI marking—in line with the U.S. government export-licensing regime. This is a process of which corporate export control compliance offices are keenly aware.102
THE JAPANESE INFORMATION SECURITY SYSTEM FOR SCIENCE AND TECHNOLOGY
Since World War II, Japan’s treatment of national security and military secrets has been the subject of intense scrutiny by academics, opposition parties, and the general populace. Concerns that the pacifist and democratic legal protections established after World War II could be undermined have dogged the dominant LDP and curtailed reform initiatives. The LDP has managed to strengthen the national security establishment over the years, for example by elevating the former Defense Agency to the Ministry of Defense (MOD) and allowing the use of outer space for defensive purposes, among other moves. But often, these reforms have exacted a high political cost or been watered down from the LDP’s original proposals. In other cases, they have been stymied altogether, such as former prime minister Shinzo Abe’s attempts to revise Article 9—the clause of Japan’s constitution that renounces war—that were opposed by most Japanese citizens.103
The Abe government did make progress in 2013 with the establishment of a National Security Council (NSC) similar in function to the U.S. body of the same name, as well as the passage of the Act on the Protection of Specially Designated Secrets (SDS). These deliberately paired moves were intended to strengthen the prime minister’s ability to manage national security policy by improving the decisionmaking process and upgrading control over sensitive information. The original proposals came under fire from a skeptical public worried about the government’s newly proposed capacity to keep some state secrets classified nearly indefinitely and with limited independent oversight. Although the legislation was modified to ameliorate criticism, it officially took effect that December amid some public protest and diminished support for the cabinet.104 The United States welcomed both moves as important progress toward facilitating classified information sharing.
DESIGNATING SECRETS IN JAPAN
In part to assuage public worries about the scope of the government’s classification powers, the SDS law narrowly defines the kinds of information that can be designated as national secrets. It enumerates four classes of information: military defense (such as defense operations, plans, cryptology for defense, and defense equipment); diplomacy; counterintelligence (to prevent “harmful activities” in Japan); and terrorism.105 Notably, unlike the American legal bases for classification, the SDS law does not offer classification authority for information related to a broadly defined category of national security, which could include economic or technology factors. The SDS list is quite specific, and it is considered a positive list, meaning that items not listed do not qualify.106
Moreover, the SDS law does not identify classification authority for scientific information pertaining to national security interests outside the scope of “military defense” or weapon secrets. So, nonmilitary work in such areas as materials science or cryptographic encryption cannot be classified by the government. The act does protect R&D information related to defense equipment. However, to date, this has been interpreted to cover only existing equipment or specific weapon systems with appropriated funding. It does not apply to scientific inquiry or R&D for technologies or products that could potentially have a military application in the future (so-called dual-use technologies).107
As a result, the number of ministries authorized to designate state secrets is relatively small, limited to only the Ministries of Defense; Foreign Affairs; Economy, Trade and Industry; and Justice, as well as the National Police Agency, the Cabinet Secretariat and NSC, and a few other related agencies.108 Japan’s MEXT, for example, does not have the authority to designate state secrets, even though it oversees the Japan Atomic Energy Agency and is Japan’s largest government provider of S&T research grants—between fiscal years 2012 and 2019, it was responsible for at least 50 percent of research appropriations. Moreover, those ministries and agencies with the authority to designate secrets do so relatively rarely—only 569 times across the entire government over the first six years since the SDS law went into effect.109 Japan’s MOD is responsible for 335 of those instances, followed by the Cabinet Secretariat at eighty-seven and the National Police Agency at forty-three.110
PERSONNEL CLEARANCE PROCESSES IN JAPAN
The SDS law also outlines the process by which government employees and private contractors receive personnel security clearances to view and handle classified information. Japan’s Cabinet Secretariat sets the standards for this process (based on the SDS law) and provides oversight for the sake of uniformity, but each ministry or agency is responsible for issuing individual clearances. The process of these clearance assessments in Japan is mostly similar to the U.S. process, with candidates filling out detailed personal information forms and undergoing background checks for verification. Both countries use similar criteria for determining an individual’s suitability to hold a clearance.
Each ministry’s personnel office utilizes its own records and coordinates with the National Police Agency, the Public Security Intelligence Agency, and the Cabinet Intelligence and Research Office to check criminal records and investigate any credible allegations of substance abuse or other potentially compromising behavior or personal relations.111 Reassessments are necessary every five years if individuals continue to require a clearance. Eligible government contractors can also seek clearances for as long as their work on a specific contract requires classified access.
Still, because the SDS law places strict limits on who can classify information and what can be classified, the number of cleared individuals is relatively small compared to the United States. In 2019, for example, Japanese government ministries and agencies evaluated about 23,000 individuals for clearances related to the SDS law (compared to well over 1 million comparable investigations in the United States).112 Only 320 were eligible contractors, with the rest government employees. Just two people failed to gain a clearance (less than .01 percent), compared to an average denial rate in the United States intelligence community of roughly 1 percent.113 By the end of 2019, just under 135,000 people in Japan were eligible to access SDS information, of whom only 3,403 were not in government.
Moreover, because the SDS law only covers scientific or technical information that is directly related to military equipment (not Japan’s broadly defined national security), the government does not have authority to grant a security clearance to a civilian researcher or private sector employee outside of that context. MEXT, for example, does not have the authority to issue a clearance to someone under its jurisdiction. This has significant implications for potential Japanese technical cooperation with the United States in nonmilitary fields that U.S. policymakers deem sufficiently sensitive to be kept secret, including some classified R&D involving certain areas of quantum computing, materials science, AI, space systems, and other advanced technologies. Similarly, it is unlikely that the Japanese government could issue a clearance to individuals in the private sector so that domestic companies can use classified cybersecurity information shared by friendly governments to protect themselves from zero-day attacks.114
Although U.S. authorities are often reluctant to share classified information or conduct joint projects with other countries, in some situations they clearly do want to pursue this approach. In fact, the U.S. DOD published in late 2020 its International Science and Technology Engagement Strategy, precisely because it aims to “strengthen alliances and attract new partners” for the DOD S&T enterprise in line with the National Defense Strategy.115 This goes beyond collaborative work on specific weapons systems or even defense-focused laboratories to include a wider range of private sector and university resources. “Through these alliances,” the report notes, “we may unite the allied S&T community to rise to the challenge posed by strategic competitors such as Russia and China.” Moreover, in 2021, the Senate Foreign Relations Committee approved a draft bill known as the Strategic Competition Act that proposes establishing a “United States-Japan national security innovation fund to solicit and support private sector cooperation for new technologies that could benefit the United States and Japan’s mutual security objectives.”116
GOVERNMENT-SUPPORTED RESEARCH IN JAPAN
Since 1995, Japan’s Cabinet Office has overseen the preparation of five-year basic plans for S&T promotion, which guide policymaking and funding.117 Japan’s sixth five-year plan approved in 2021 reflects considerable continuity from its predecessor plan, with a notable added emphasis on increasing public funding, incorporating digital transformation, stimulating S&T innovation for problem solving by fusing the natural sciences with humanities and social science in education, and enacting “technology outflow countermeasures.”118 The Japanese government has a variety of tools at its disposal to help achieve its goals.
As in any country, government funding for S&T research is complicated and involves many stakeholders (see figure 3). The Council on Science, Technology and Innovation (CSTI) (highlighted in teal) is ultimately responsible for the basic plan, with support from a secretariat staffed by about one hundred people pulled in from various ministries and agencies. Japan’s MEXT is the biggest government player, acting essentially like the custodian or administrator for many of Japan’s most capable science and research organizations (including the Japan Science and Technology Agency (JST), the Institute of Physical and Chemical Research (RIKEN), the Japan Aerospace Exploration Agency (JAXA), the Japan Atomic Energy Agency (JAEA), research universities, and more).
The Ministry of Economy, Trade and Industry (METI) and the Ministry of International Affairs and Communications (MIC) are becoming more engaged and influential on this front as well. To some extent, a competition for resources and policy direction is migrating up to CSTI and playing out at the NSC (which, in 2020, added an economic security office to the National Security Secretariat headed by a cabinet councilor).119 As in the United States, a key question is how to find the right balance between technonationalism and technoglobalism in areas of scientific exploration and technology development. Governments want to give every reasonable advantage possible to domestic industry and invention, but they also need open markets in other countries and as large and collaborative a global innovation ecosystem as possible. A related question is whether enhanced cooperation among like-minded countries in these areas could help strike that balance. If this is a likely result, how could Japan ensure that it is a full partner in the effort? These and similar questions are fueling internal debate over funding, program design, and where to draw the line on certain potential dual-use technologies related to AI and QIS (among others areas).
A look at how government funding is distributed by ministry in Japan reveals that MEXT provides by far the most awards for S&T research, followed by METI (see figure 4).120 The recent growth in the “others” category is mostly due to increased allocations to the Ministry of the Environment. Data from the United States shows there is no simple bureaucratic counterpart for MEXT—the largest funders of R&D are the U.S. DOD and the Department of Health and Human Services. Further, the large share of funding disbursed by the Department of Health and Human Services can be accounted for by continuous and generous funding of the National Institutes of Health by Congress (see figure 5).121 Still, due to strong existing relationships among various agencies and departments (such as NASA-JAXA, NSF-JST, DOE-JAEA, DOE-METI, and U.S. national laboratories and universities with several top universities in Japan), there is an ample foundation of bilateral collaboration upon which to build further.
Another illuminating comparison is how research is funded and conducted in Japan as opposed to the United States (figure 6). Although the data differ in terms of funding scale, the pattern of funding flows reveal the similarities and differences in how each country operates.122 One key difference is the relatively smaller role that Japanese government funding plays in the national picture. Another is how little Japanese government research funding goes to the business sector directly, compared to the United States. In addition, international contributions (from the rest of world) are minimal in Japan, although there is a concerted effort underway in Japan to expand the international component of its scientific endeavors. This presents an opportunity for allies.
Japan’s so-called Moonshot Research and Development Program is a good example of this opportunity for engagement.123 While the Moonshot Program is still organized domestically, this multi-goal-oriented initiative is actively recruiting international collaborators. Some of these goals involve AI, robotics, quantum computing, and sustainable resource circulation. The Japanese government’s new push to realize a carbon neutral society by 2050 will add funding and perhaps a greater sense of urgency to research in this latter area. The government’s push for digital transformation and creation of a new digital agency should be another opportunity for closer U.S.-Japan cooperation, especially involving the private sectors.
These themes are all emphasized in the sixth basic plan, which revolves around a central vision of a so-called Society 5.0 (which is a vision for a human-centered society where high integration of cyberspace and physical space can promote economic development and solve social problems). A growing number of Japanese officials believe that there are scientific and technological components of Society 5.0 (primarily in AI, quantum computing, and data flows) that could be exploited by China to Japan’s disadvantage, unless Tokyo takes steps to protect certain advancements.124 They see a consensus with the United States and European Union emerging (even if details remain murky) and are considering drafting a national economic and technology security strategy to guide the policy response.125 The Japanese government has already decided to bolster domestic research integrity by imposing stricter disclosure rules for university researchers applying for public funds, so that any connections to Chinese funders or programs can be discovered before grants are awarded.126
Finally, even though direct Japanese government funding support for private sector R&D is relatively low in Japan, the government does support domestic industry actively and coordinates closely with business leaders on regulatory and trade issues. Like other governments, Tokyo provides subsidies and tax incentives for domestic consumption of new technologies in the auto, communications, and energy industries.127 The government has also used public funds to support domestic tech firms teetering on the verge of bankruptcy, such as when it merged the display businesses of Sony, Hitachi, and Toshiba to form Japan Display in 2012.128 Japan also provides regular support to its semiconductor industry in the form of manufacturing grants, tax incentives, and preferred loans (as do several other countries, although nowhere close to the scale of support that China provides its domestic semiconductor firms).129
PRIVATE SECTOR R&D AND EXPORT CONTROLS
As in the United States, most domestic spending on R&D in Japan comes from the private sector and is largely beyond government control (aside from the aforementioned subsidies and so-called administrative guidance).130 In recent years, private sector R&D spending in Japan has exceeded that of the government by at least a factor of four.131 From an alliance perspective, no other country’s firms spend more on R&D in the United States than Japan, both through their own work at U.S.-based affiliates and subsidiaries as well as in partnership with other U.S. firms, universities, and even government-affiliated institutes (such as NASA’s Ames Research Center).132
Japan’s FEFTA provides the government with various traditional tools for managing private companies’ interactions with other countries.133 The most applicable tools for technology security involve export controls and investment restrictions, but there are some gaps in how the law is applied that limit coverage in important ways when considering compatibility with the United States. Although an underlying purpose of the law is to support “the maintenance of peace and security in Japan and in the international community,” it is limited to “the minimum necessary control or coordination of foreign transactions.”134
Additionally, most circumstances that allow Japan’s cabinet to decide to impose export or investment restrictions relate to fulfilling obligations under international treaties and the maintenance of international peace and security (such as upholding arms control agreements or restricted trade in wild flora and fauna). Among these situations are transactions “designed to provide technology pertaining to the design, manufacture or use of specific kinds of goods.”135 This is considered a kind of service transaction that would require METI permission in order to transfer technology information. To date, this has been interpreted within Japan to relate only to multilateral arms control regimes such as the Wassenaar Arrangement and the Nuclear Suppliers Group.136 The Japanese government thus has a much more limited scope for determining what constitutes export-controlled research than does the U.S. government.
Moreover, cabinet-imposed restrictions technically only apply to transactions between residents and non-residents, so a foreign national scientist living and working legally in Japan for more than six months would be exempt from such restrictions.137 For these reasons, the Japanese government does not have a reliable and flexible measure of legal control over the export of research data or technology design information not clearly considered dual use for the sake of arms control. In these cases, the government relies heavily on the private sector’s protection of company trade secrets.
Additionally, METI permission is not required for a Japanese company to hire a foreign national to participate in Japan-based R&D for the firm, or what U.S. law considers a deemed export, if that employee will have any access to controlled technology.138 In this situation, the United States makes its designation based on the nationality of the prospective employee, not merely their residence.
Japan’s FEFTA does provide the cabinet with an ability to intervene in special cases regarding international financial transactions, investments, imports, or exports “when it is particularly necessary in order to maintain peace and security in Japan.”139 But legal interpretation to date in Japan has not applied this concept of “peace and security” as justification for commercial export-controlled research. So far, it has primarily been used for the deployment of economic sanctions and trade restrictions vis-à-vis North Korea.140
Japan has taken steps in recent years to upgrade the protection of domestically produced technology, sometimes at the urging of the United States. After Washington moved to strengthen its foreign direct investment rules in 2018, for example, Tokyo amended its FEFTA in 2020 to lower the purchasing approval thresholds (from 10 percent to 1 percent ownership of the company involved) and introduced a prior notification requirement.141 This applied to certain sectors of the economy that could pose a potential national security threat including critical infrastructure (such as electricity, gas, communications, or transport infrastructure) and added new categories of data processing (including semiconductors and data storage), software related to information processing, and telecommunications businesses (like those related to internet use and mobile communications).
An interesting test of the new rules occurred in March 2021, when Chinese tech powerhouse Tencent Holdings became a major shareholder, with a 3.65 percent stake, in Japan’s Rakuten, an e-commerce giant that has diversified into telecommunications and fintech businesses. The fact that the Japanese government was not given prior notification confused U.S. officials, who assumed that this kind of transaction would be covered by the amended law—however, purely financial investments are exempt from the notification requirement.142 Although it makes sense for Japan to welcome foreign investment that does not seek access to nonpublic technology or does not take an activist approach in the management of the company, the challenge lies in monitoring this situation indefinitely. The Japanese government can force divestment ex post if it finds evidence that a foreign company like Tencent has shifted from having a purely financial interest to being an activist shareholder in the Japanese firm. But effectively policing this dynamic will likely require more resources for intelligence gathering and surveillance.143 Information sharing in this area of corporate counterintelligence by the U.S. and Japanese governments could also help.
In addition to tighter scrutiny of legitimate foreign investment, Japan has also taken steps to bolster the private sector’s capacity to protect trade secrets and technology from foreigners carrying out industrial espionage. The Japanese government amended its Industrial Competitiveness Enhancement Act in 2018 to create a set of uniform standards for domestic industrial security and a process to certify that Japanese firms were meeting high standards.144 U.S. officials saw this as a positive step but, unlike NISPOM in the United States, Japan’s new certification process only covers unclassified material and companies’ proprietary information, not the protection of classified material in the private sector.145 As such, the 2018 amendments by themselves are unlikely to be sufficient grounds for adding an ISA to the U.S.-Japan GSOMIA.
Another area of asymmetry between the two countries is Japan’s lack of a secret or classified patent system—or, for that matter, a classified court system that can help adjudicate civil or criminal cases that might involve classified information. Among G20 nations, only Japan and Mexico lack a secret patent system, although Japan is considering ways that it might be able to introduce something to protect invention secrecy.146 Many difficult questions remain unanswered, such as which ministry or office will be given the power to classify patents and based on what authority. The U.S. DOD, for example, can issue clearances to a company and/or researchers following the issuance of a patent secrecy order so that they can continue their R&D work. Japan does not have a mechanism for doing this unless it is for a specific military-use item.
ALLIANCE COOPERATION IN THEORY AND PRACTICE
When comparing the United States and Japan, it is important to note that for all of the laws, guidelines, executive orders, regulations, and procedure manuals that help make up the U.S. information protection apparatus, the behavior of people involved is still the most important component. Because any sort of mistake can be professionally or criminally costly, there is a general tendency to overclassify information and require higher-level assurances than might seem necessary based on a strict reading of the rules. For example, even though Executive Order 13526 specifically limits the number of people with original classification authority to relatively few senior officials, the reality is that any Defense or State Department desk officer with a clearance must decide regularly whether to start drafting a memo and initiate a paper trail on the “high side” (the classified portion of their computer) or the “low side” (the unclassified portion). There is a bottom-up process of classification that takes place every day throughout the U.S. government and among its contractors that usually defaults to overprotecting information.147
When it comes to sharing information with government officials or engineers from another country, U.S. officials are generally more comfortable doing so if their foreign counterpart exhibits a similar approach toward protecting classified information. There are times when a government determination to share classified information with a partner like Japan goes through a formal interagency process that fully evaluates the relevant rules, risks, and potential rewards. More often, though, these judgements take place informally at various levels throughout the alliance. As a result, decisions about sharing information with Japan are often imprecise assessments of Japan’s need to know or what benefits the United States would accrue, in addition to an individual’s or an office’s trust and confidence in its Japanese counterpart.
A similar dynamic plays out in the private sector when it comes to the advice provided by legal departments or compliance officers within a company that are unsure whether some research that they are conducting is export controlled. Researchers or engineers of a Japanese firm (subsidiary) in the United States who conduct AI or QIS research with U.S. partners might want to share research results with their headquarters back in Japan. First, however, they will consult with their legal department to see if it thinks an export license might be required (as a firm’s proprietary research is not eligible for the fundamental research exemption). In many cases, the answer is not obvious, so the safest route usually results in restricting information sharing until a clear approval can be confirmed.
Although Japan overall is well trusted and highly valued by the U.S. government and military, its legal structure and culture of information protection is often seen as not equivalent to the U.S. system.148 This results in situations where less information is shared than might otherwise be the case, or additional hurdles or requirements are sought to compensate for this lack of confidence. For example, Japan is not part of Washington’s most trusted circle of intelligence confidants (the so-called Five Eyes network), is not considered part of the U.S. National Technology and Industrial Base (like Canada, the UK, and Australia are), and is not on a short list of countries that Washington exempts from stricter scrutiny of inward investments.149 The United States does not have an ISA to its GSOMIA with Japan as it does with Sweden, India, and others.150
In practice, substantive challenges to information sharing remain. The United States and Japan collaborate on a variety of highly classified military projects in the defense arena, including the F-35 joint strike fighter and the SM3-Block IIA interceptor missile. Information sharing, however, is kept to the bare minimum necessary to carry out the work. In the case of the SM3 missile (often touted as a successful example of co-development), each government funds its own nation’s contracted work on the separate components—the only information shared relates to areas of interface between those components.151
Due to the lack of a foundational agreement on defense technology cooperation (such as an ISA to the bilateral GSOMIA), each cooperative project requires its own negotiation of a special program security agreement.152 The U.S. Defense Technology Security Administration often decides that it must confirm individual security clearance approvals given to Japanese contractors working on the project.153 The existence of the U.S.-Japan GSOMIA mitigates this to some degree on simple defense exports, but not when it comes to collaborative research or co-development projects. All of this adds time, cost, and inconvenience to joint projects, and it contributes to an overall lack of eagerness from U.S. officials to conduct new co-development projects with Japan.154
Similarly, the State Department’s Defense Trade Advisory Group (DTAG), which is made up of private sector defense trade professionals advising the Bureau of Political-Military Affairs, has considered ways to expand the use of general licenses to reduce licensing challenges and enhance collaboration with foreign firms and countries in international cooperative programs.155 Although the DTAG actively considered including Japan as a country that should be eligible for a general license exemption, the working group assigned to this task eventually recommended only Five Eyes countries for this streamlined procedure.156 The sticking point, according to some DTAG members, was Japan’s insufficient treatment of deemed exports. Japanese rules and practices surrounding the hiring of non-Japanese employees or university researchers were not perceived sufficiently rigorous for blanket export approvals.157
It is useful to consider the case of the United States and India concluding an ISA to their GSOMIA in 2019, given the fact that India remains on the DOE’s sensitive countries list and has maintained a close defense industry relationship with Russia for decades. At a not-for-attribution roundtable organized by the Carnegie Endowment for International Peace, current and former U.S. officials explained their view that Japan would need to make some additional improvements to its government and industrial information security systems and culture before it could strike an ISA deal with the United States (if Japan decided that it wanted such an agreement). Two key items would be empowering a sole designated authority for information and technology security (such as the Indian Ministry of Defense’s joint secretary for defense industry production) and having a cadre of physical and information security professionals within the government to provide support (such as India’s Central Industrial Security Force, which is supported by the Ministry of Home Affairs and the Intelligence Bureau).
Over the past few years, Japan’s legal mechanisms, systems for the protection of sensitive and classified information, and lack of security culture have, at times, resulted in either an unwillingness to engage on some potential collaborations or a very limited view of what can be done in such research partnerships in sensitive areas (like QIS, electromagnetic threats, directed-energy technologies, and some aspects of AI), according to officials from U.S. national laboratories.158 For example, the authors of this paper are aware of two separate groups of Japanese experts who could not obtain the information they needed from U.S. officials and experts during the 2018–2019 period because an adequate answer would touch on classified material: first, national laboratory experts and representatives of the Tokyo Electric Power Company (TEPCO), a private Japanese firm, regarding certain nuclear energy facility security issues, and second, joint METI-DOE-national laboratory experts regarding an electromagnetic pulse resilience plan. Thus, Japan’s lack of a legal framework and attendant system to protect this kind of nonmilitary classified information has limited the allies’ ability to share mutually beneficial information in a timely manner.
Interestingly, the U.S. DOE subsequently engaged with Japanese counterparts at METI and the Ministry of Foreign Affairs (MOFA) to develop a legal framework by which DOE officials could share information related to nuclear energy security that is classified as secret with the Japanese government.159 The allies eventually concluded an agreement between NNSA and MOFA in 2019, although there is “still some work required to be able to implement the agreement.”160 According to DOE officials familiar with the agreement, the U.S. side still has some questions regarding Japan’s security clearance process for people who would have access to this information, as well as how the information would be physically handled (including sufficiently secure safes and doors, as well as personnel training).
On the private sector side, there are a variety of limitations when it comes to unclassified collaborative U.S.-Japan work carried out in the United States. For example, one U.S.-based Japanese firm working as a partner with multiple U.S. universities in 2020 on QIS ran into difficulties sharing research results with the firm’s headquarters in Tokyo due to questions about whether those results should be considered export-controlled research.161 The research agreements that the company has with the universities are “typical peer-to-peer” relationships (covering confidentiality, nondisclosure, and jointly owned intellectual property), with a mutually agreed upon goal and plan for publishing more than 90 percent of the project results. The Japanese company has a team in Japan doing some related work, but the compliance office of the U.S.-based subsidiary was concerned that any sharing of experimental data (prior to publication) might be export controlled. As a result, the research could not benefit from sharing results in real time, and the process of seeking clarification from the U.S. Department of Commerce was still pending after at least seven months.162 There is also an added expense to retain legal advice to pursue that clarification, all of which has a chilling effect on the potential for expanding such collaborative R&D initiatives.
Japanese firms operating in the United States in areas of sensitive dual-use technologies are experiencing heightened scrutiny and added costs related to technology security compliance. When filing patent applications in the United States (via U.S.-based subsidiaries), the U.S.-based researchers and lawyers usually do not share details with the company headquarters in Tokyo due to concerns that the information could be export controlled or even eventually classified.163 One researcher explained that they fill out export-control applications “all the time,” and they are almost always approved (although several reported situations where the hiring of a foreign national at the U.S. subsidiary was prohibited due to deemed export controls).164 Moreover, in one case, a Japanese firm said that a wireless spectrum product it was working on was deemed classified by the U.S. government because of the product’s ability to hide communications, and workers involved in that project had to obtain security clearances.165 This was manageable because the Japanese firm had already set up this particular subsidiary as a separate legal entity and could be treated as a U.S. firm (albeit subject to FOCI) with a special security agreement, although this limits the Japanese parent’s ability to access some subsidiary information.
Another private sector example involves the use of CUI in a joint research project. In 2019, a Japanese tech company aimed to join an unclassified DOE project as a so-called industry partner to a consortium that involved two national laboratories, several university teams, and a large U.S. utility company in the western United States. The energy utility could offer large amounts of real-life data for the researchers to utilize in an attempt to apply AI technology for more flexible and efficient use of the electricity grid, including maximizing the use of renewable energy. However, because the utility’s data was generated from actual customers, it was subject to CUI data protection requirements that the Japanese firm could not satisfy without a costly reconfiguration of its IT system. That cost made the project unattractive to the Japanese company, so it stepped away from the consortium.166
OPTIONS AND RECOMMENDATIONS FOR BRIDGING THE GAPS
Although Japan and the United States have a productive S&T relationship, there are several gaps in their systems that will frustrate closer cooperation if higher information security walls are erected around some emerging technologies in the coming years. In order to bridge these gaps, it will primarily be up to Japan to make improvements in how it protects information, controls technology research, bolsters industrial security, and vets some scientists and engineers. For its part, the U.S. government should take sufficient note of improvements that Japan is making and planning in this arena. When evaluating these steps, Washington can be supportive and look for equivalency in terms of the outcomes rather than insist on equivalent processes.167
Bringing about the changes necessary to allow for the expansion of S&T collaboration between Japan and the United States, particularly in areas involving the development and application of sensitive or classified information and technologies, will require high-level government interactions. It is likely that this will also require changes in the way that Japan protects information and determines what should be classified and who should receive clearances to handle such information. There are many existing cases of allied information sharing and active R&D collaboration involving sensitive and even classified material (for example, in the defense arena). However, the need to collaborate in these areas is growing rapidly along with the recognition that much in the way of advances in S&T are dual use in nature.
If Japan decides to enhance its ability to conduct sensitive dual-use R&D with the United States and/or to facilitate high-end dual-use trade with the United States and a select group of other nations as part of a technology alliance, there are two main categories of steps that it should take. The first category includes specific legal adjustments, regulatory changes, and physical investments that strengthen technology and information security in Japan. These kinds of steps will help bridge the tangible gaps that exist between the allies’ information security systems.
It is highly unlikely, however, that these steps alone will change the perception among U.S. government officials that Japan’s culture of information security is adequate. In order to address the gray areas of discretion that frequently affect decisions about what to share and with whom, the Japanese government should consider steps in a second category that will have a noticeable impact on their security culture, even if it is limited to a few public and private research centers of excellence that can become preferred partners of choice. Though they would also be substantive, there would be a sort of public relations dynamic associated with this type of reform because it will be critical to call attention to these changes and reinforce this public reputation over time.
The following is a list of options and recommendations for bridging the existing information sharing and collaborative research gaps that exist in the U.S.-Japan relationship (by category).
CATEGORY ONE: LEGAL AND PROCEDURAL ISSUES
At present, one of the primary limiting factors for the participation of Japanese nationals in U.S.-sponsored sensitive scientific research is the inability for Japanese investigators or private sector engineers and scientists to receive security clearances independent of a national defense program. An amendment to the SDS law could add a provision similar to the one in U.S. Executive Order 13526 that covers “scientific, technological, or economic matters relating to the national security.” The Japanese government could choose to let METI be the designator in these cases (and the issuer of related clearances) or have this done at an interagency level that involves MEXT, METI, MOD, MOFA, and the Japanese NSC. Another option would be for the government to give MEXT some independent authority when the research includes MEXT-supported projects and institutions. In this way, the United States and Japan might be able to create an initiative similar to the U.S.-UK BARI program or to participate in work supported by the JAIC or conducted by DOE national laboratories. The closer that this type of work gets to defense applications, the more controversial it will be to involve MEXT, but the proposed legal adjustment could allow greater private sector participation as qualified contractors to MOD or METI. Commensurately, the legal penalties for violations by the contractors would need to be equivalent to those for government employees afforded clearances.
By way of the extant GSOMIA between the two countries, the United States implicitly acknowledges the equivalence of Japan’s clearance process.168 As clearances are the first hurdle to clear for Japanese investigators to engage in certain scientific collaboration, creating a mechanism that allows them to receive such clearances is a key that opens this door. That said, these authors’ review of the U.S.-India ISA experience and the NNSA-MOFA information-sharing agreement revealed several areas that many U.S. officials still consider to be substandard when it comes to Japan’s security clearance process and information security system. In other words, if Japan wanted to pursue an ISA to its GSOMIA with the United States today (or to fully implement the NNSA-MOFA agreement), U.S. officials would likely seek the following steps or clarifications before endorsing Japan’s system as “substantially equivalent.”
One would be clarification of the “designated security authority” in Japan. For the sake of oversight for the SDS law, Japan did create a Cabinet Committee for Protection and Oversight to support and manage the designation of secrets and clearance processes across the relevant ministries.169 But this group does not seem to be an equivalent organization to the U.S. government’s NDPC. Moreover, the roles and responsibilities for disclosure and quality control that reside in other offices such as the Cabinet Intelligence and Research Office and the Public Security Intelligence Agency should be clarified. Japan’s Cabinet Office includes a variety of special secretariats (tokubetsu no kikan) that are empowered to manage specific policy activities with the participation of various ministries and agencies. It should be feasible for Japan to create some kind of national disclosure secretariat that involves representation from the Justice Ministry, MOFA, MEXT, MOD, METI, MIC, and possibly the National Police Agency (or National Public Safety Commission).
A second step might be creating a process for settling legal disputes in a classified manner. A separate classified court system is probably unnecessary, but some kind of domestic, legally sanctioned process should be developed to handle the occasional case in this regard. Inevitably, if the Japanese government does move to increase the amount of protected information and the number of citizens involved in this arena, then instances of litigation involving classified material (or potentially classified material) will also increase. The government should anticipate this development.
A third step could be establishing a cadre of security professionals within the Japanese government similar to the GS-0080 class within the U.S. government, whose “principal purpose [is] the development and implementation of policies, procedures, standards, training, and methods for identifying and protecting information, personnel, property, facilities, operations, or material from unauthorized disclosure, misuse, theft, assault, vandalism, espionage, sabotage, or loss.”170 This includes personnel security, physical security, information security, and industrial security. With eleven grade positions, this class offers a career path for professionals dedicated to government security that does not exist currently across the Japanese bureaucracy.
The Japanese government could also extend a “scientific, technological, or economic matters relating to the national security” justification as an amendment to FEFTA. This could strengthen the government’s ability to control exports of technology research and the hiring of foreign nationals (deemed exports) in select situations. Combined with the aforementioned recommendation related to the SDS law, these steps would raise the bar for industrial security in Japan and make it easier for the United States and Japan to work out general licensing arrangements that could facilitate the exchange of controlled goods and a wider range of sensitive information in a timelier manner. As one former U.S. government official mentioned, “if we want a real tech alliance, then we need a means for more unfettered access between us.”171
These two amendments (to the SDS Law and FEFTA) would also provide a stronger legal foundation upon which to establish a secret or classified patent process, as it would not only create a valid reason to classify an invention, but also the ability to authorize the inventors to continue their work.
If Japan chooses to refrain from more comprehensive approaches to upgrading information protection, it might be possible to create highly controlled research environments on a smaller scale. For example, Japan created an AI Research Center in 2015 under the National Institute of Advanced Industrial Science and Technology (AIST).172 In 2020, the government began setting up eight special research bases for QIS research (including at AIST and RIKEN).173 Japan could take steps to upgrade the physical security at a couple of key locations (such as AIST) and turn them into designated hubs for dual-use research in collaboration with the United States or other partners. In addition to physical security improvements, enhanced measures for research integrity and trusted workforce development could be implemented for joint work that is not necessarily classified but requires strong security measures.174 Japan already has the ability to conduct a thorough vetting of potential employees (in itself a form of personnel clearances) for businesses such as day care centers and gambling facilities, so it should be possible to establish a few centers of research excellence in Japan that also exemplify the highest standards in physical and personnel security. As more funds, talent, and cutting-edge work are directed toward these research hubs, they will no doubt attract imitators within Japan and help raise the standard for information security.
CATEGORY TWO: STRENGTHENING AND PROJECTING A NEW CULTURE OF INFORMATION SECURITY
Whatever tangible steps Japan takes to upgrade its ability to share and protect sensitive and classified information, it will be equally important to convince would-be international partners that Japan is committed to enforcing its new rules and creating a culture of professional excellence. As such, some of the recommendations in this category relate to actions mentioned in category one, but the important issue at hand is the manner in which that action is carried out.
One key item will be strict and publicly noticeable enforcement of rules and imposition of penalties when appropriate. All countries suffer occasional lapses in security, either through negligence or from criminal activity, but the frequency and severity can be minimized via tough enforcement. To take one recent example, Japan’s Nuclear Regulation Authority determined in March 2021 that TEPCO allowed malfunctioning intruder-detection equipment to remain in use at its Kashiwazaki-Kariwa nuclear power plant for about one year, “even though its security guards were aware the alternative measures were ineffective and, as a result, it may have been impossible to detect intruders for more than 30 days.”175 Here is a prime opportunity for the Japanese government to carry out a high-profile investigation and penalize the company and/or some employees to the fullest extent that the law allows. In the United States, for example, the FBI has in recent years stepped up enforcement of university researchers failing to disclose ties to China and backed up their rhetoric with some high-profile arrests.176
Of course, the primary goal for the government is to avoid security lapses in the first place, so adequate and continuous training is necessary at all levels. This will require a commitment of financial and personnel resources not only at the government level but also at the university and private sector level. This will require patience, persistence, effective communication, and some financial support so that universities and private companies feel like partners in this process rather than simply dragooned into a costly and complicated government program.
Japan’s efforts in this category would benefit from an element of marketing or public relations. For example, the U.S. Justice Department established its China Initiative in 2018 to identify priority trade secret theft cases, develop an enforcement strategy for nontraditional collectors of U.S. technology, and educate universities about potential threats, among other related goals.177 They created a leadership team and publicized the initiative via press conferences and public testimony in Congress. Then they proceeded to publicize and keep a running tally of convictions on a dedicated website (which now lists almost 100 convictions). Japan would probably want to avoid a similarly labeled initiative and choose its own approach suited to domestic laws and politics, but the model of such a focused, well-resourced, and high-profile initiative dedicated to technology security in Japan is worth considering. Japan has already begun to take steps in this direction, but some political resistance that questions the necessity or affordability of these reforms stymies their effectiveness.
UPDATING THE 1988 U.S.-JAPAN AGREEMENT ON COOPERATION IN R&D IN SCIENCE & TECHNOLOGY
Additionally, in order to promote greater synergy between public and private sector entities and between the defense and commercial sectors, the allies should consider establishing a bilateral public-private interdisciplinary body to work in support of high-level U.S. and Japanese policymakers. This council could draw from top laboratories and corporations to help policymakers leverage allied S&T collaboration in new ways and delineate clear priorities amid fiscal constraints. It could be similar to the consultative, private sector–oriented Joint High-Level Advisory Panel established (but later abandoned) by the 1988 U.S.-Japan S&T cooperation agreement, or it could be a separate bilateral commission that proposes joint funding initiatives to the NSCs of both countries for inclusion in annual budget proposals.178
One possible approach was developed by the authors of this paper (see figure 7). The primary benefit of this approach is that it puts a wider range of scientists and technology specialists in closer and more regular contact with policymakers from both countries. Such an approach can tighten the loop that connects national strategic policy priorities, funding choices, and knowledge about the world’s most advanced technologies. If the allies decided to launch a joint innovation fund as envisioned in the U.S. Innovation and Competition Act of 2021, this advisory council could be a valuable resource for both countries.
APPENDIX A: U.S. DEPARTMENT OF ENERGY SENSITIVE FOREIGN NATIONS CONTROL (ATTACHMENT G DE-AC36-08GO2830 MODIFICATION M1130), REPRODUCED
Attachment G – Sensitive Foreign Nations Control
In accordance with the Clause I.92, Sensitive Foreign Nations Controls, this Attachment sets forth the requirements the contract shall comply with under this contract. (Reference DOE Order 142.3, or superseding directives)
Foreign National Access to DOE sites, programs, information and technologies will be approved provided the access is needed to support the program objectives of DOE and/or of U.S. national interests.
Definitions
Assignee – A foreign national who has been approved to access a DOE site, information, or technology for a period of ore than 30 consecutive calendar days.
Foreign National – A person born outside the jurisdiction of the United States, is a citizen of a foreign government, and has not been naturalized under U.S. law.
Host – The DOE or DOE contractor employee responsible for the day-to-day activities associated with the visit or assignment.
Indices Checks – A procedure whereby a request is made to appropriate U.S. Government agencies to determine whether information exists on a particular foreign national.
Legal Permanent Resident (LPR) – One who has the right to reside permanently and work in the United States. An LPR may also be known as a permanent resident alien or Green Card holder.
Security Plan – A security plan is required to address specific site security concerns relating to foreign national visits or assignments.
Sensitive Countries List – A list of countries to which particular consideration is given for policy reasons during the DOE internal review and approval process for visits and assignments by foreign nationals. Countries may appear on the list for national security, nuclear nonproliferation, or terrorism support reasons. Those countries follow:
Algeria
Armenia
Azerbaijan
Belarus
China (People’s Republic of China)
Cuba – Terrorist
Georgia
India
Iran – Terrorist
Iraq
Israel
Kazakhstan
North Korea (Democratic People’s Republic of) – Terrorist
Kyrgyzstan
Libya – Terrorist
Moldavia
Pakistan
Sudan – Terrorist
Syria – Terrorist
Taiwan (Republic of China)
Tajikistan
Turkmenistan
Ukraine
Uzbekistan
Sensitive Visit/Assignment – A visit/assignment will be considered sensitive if:
Sensitive Country (Citizen or Birth)
Sensitive Subject/Sensitive Areas
Secured Facilities (Limited Area, Protected Area, Material Access Area or Exclusion Area)
Represent a company, business, organization or institute from countries identified as sensitive.
Sensitive Country National – A foreign national who was born in, is a citizen of, or is employed by a government, employer, institution or organization, of a sensitive country.
Visit – Access by a foreign national for 30 calendar days or less.
Prior Approvals Relating to Foreign Nationals
Foreign visits and assignments pertaining to DOE programs must be in accordance with DOE Order 142.3, or superseding directives and other DOE policies furnished in writing to the contract. All visits and assignments must be approved in advance by the DOE Approval Authority.
Sensitive visits or assignment requests must be submitted 45 days in advance in order to allow time for an indices check to be completed.
Non-sensitive visits or assignment requests must be submitted 5 days in advance.
Reports relating to Foreign Visits and Assignments
Host Report Requirements – To enable the approving official to evaluate the effectiveness of visits and assignments, and to assist in determining the desirability of future visits and assignments, host reports are required within 5 days of the completion of the visit or assignment.
Courtesy: (carnegieendowment)
