Cyber Crossroads in the Indo-Pacific

Executive Summary

The Indo-Pacific faces a cyber crossroads. Down one path lies deeper military, intelligence, and economic ties between Washington and its key allies and partners in this strategically vital region. Down another, rising cyber threats from the People’s Republic of China (PRC), North Korea, Russia, and a growing shadow industry of cybercriminals and hacktivists derail these ambitions by compromising critical infrastructure, weakening data security, and undermining democratic institutions. The outcome will depend on the choices Washington and its Indo-Pacific partners make—or fail to make—in the coming years.

The U.S.-China rivalry has long extended to the cyber domain, but in recent years, Beijing has increasingly exploited the gray zone of cyberspace to test, probe, and push other nations as part of a broader campaign to gain influence and shape regional norms and power structures.¹ In recent years, the PRC has sharply escalated its cyber aggression in a dangerous new game that combines traditional operations focused on espionage, intellectual property theft, and data exfiltration with newly assertive disinformation, influence operations, and pre-positioning in critical infrastructure. Adding to the uncertainty, rapid advances in artificial intelligence (AI) could further tilt the balance toward offense in cyberspace in unpredictable and potentially dangerous ways.

Against this backdrop, Indo-Pacific governments have taken historic steps to strengthen their resilience in a cyber landscape that has grown more varied, volatile, and dangerous than ever.

To assess how Washington and its Indo-Pacific partners are navigating this cyber crossroads, the Center for a New American Security’s Technology and National Security Program and Indo-Pacific Security Program led a year-long research project that combined extensive desk research with in-person field research and expert workshops in Japan, South Korea, Taiwan, and the Philippines. This report draws on this research to offer in-depth assessments of the cyber landscapes in all four countries to identify key trends, challenges, and opportunities to strengthen cybersecurity and resilience in partnership with the United States.

The findings offer cause for both optimism and concern. On the one hand, Japan, South Korea, Taiwan, and the Philippines have all undergone notable shifts in elevating cybersecurity as foundational to national security. Japan’s 2022 National Security Strategy made cybersecurity a pillar for the first time, and the government has passed reforms to facilitate information sharing with the United States and shift toward active cyber defense.² South Korea updated its National Cybersecurity Strategy to adopt a Defend Forward cyber posture, mirroring the U.S. shift in 2018.³ Taiwan established a National Institute of Cybersecurity within its Ministry of Digital Affairs, and the Executive Yuan approved a four-year plan to boost digital resilience.⁴ The Philippines finalized a five-year National Cybersecurity Plan.⁵

For its part, the United States has elevated cybersecurity in its foreign policy with expanded information sharing, capacity building, and diplomacy anchored in a new Bureau of Cyberspace and Digital Policy within the U.S. Department of State. Recent years have seen Washington both strengthen its proactive cyber capacities and embrace a “name and shame” approach to call out malign cyber operations from foreign adversaries like Russia and the PRC.

Still, these laudable efforts to bolster cyber policies, personnel, and partnerships have failed to keep pace with rising threats. Washington’s finger-wagging statements and targeted sanctions in the wake of cyber incidents have failed to stem rising threats. To confront growing cyber dangers across the Indo-Pacific, the United States and its partners need a more assertive and coordinated approach that intensifies efforts on two fronts: (1) building capacity within each country to strengthen cybersecurity and resilience, and (2) strengthening cooperation to enable more integrated, proactive cyber defense, collective signaling, and cost inflicting on malign cyber actors.

To that end, this report offers recommendations to government leaders in the United States, along with both country-specific and cross-cutting recommendations for government leaders in Japan, South Korea, Taiwan, and the Philippines. Although many of the recommendations directed toward the four countries could fairly apply to the United States, strengthening domestic cybersecurity and resilience is beyond the scope of this report.