Intelligence & security, explained.
Tokyo Tower (PJH/Unsplash)
Engaging US based cloud providers to host Japanese defence data requires security scrutiny, risk scenario planning and deep trust.
Subscribe to The Informer for monthly expert analysis, and to Events for advance notice of visiting world leaders and distinguished guests.
You may unsubscribe from Lowy Institute newsletters at any time. For information on our privacy practices and how to unsubscribe, see our Privacy Policy.
What Japan can learn from Australia’s cloud sovereignty leadWhat Japan can learn from Australia’s cloud sovereignty lead
Japan’s Ministry of Defence is reportedly preparing (Opens in new window) to shift the hosting of classified information from its own environment to a private cloud environment provided by United States based technology providers from Japan’s fiscal year 2027. Combined with cutting-edge Artificial Intelligence (AI), this would let Japan expand its computing and storage capacity and swiftly analyse growing volumes of data.
Developing a “secure and sovereign cloud platform” for government data has been part of an ongoing discussion (Opens in new window) between Japan and the US to strengthen bilateral coordination. It would help Japan streamline how it currently manages (Opens in new window) classified information on separate, offline systems – never hosted on public or commercial cloud – for each Japan Self-Defence Forces (JSDF) branch. Yet, relying on cutting-edge technology held by US big tech firms for core national security functions raises the question of how Japan would maintain sovereignty over its own highly classified information.
Japan can turn to Australia to see a potential path forward. Australia is a similarly technology dependent US ally, which has already taken steps in this direction. In 2024, Australia announced (Opens in new window) a partnership with Amazon Web Services (AWS) to build a top-secret cloud environment for highly classified intelligence and defence information.
Nagoya, Aichi, Japan (Roméo A./Unsplash)
Cloud environments offer three main advantages over on-premise systems: scalability and interoperability, enhanced cybersecurity, and reduced costs. In terms of scalability, cloud enables the scaling of processing power when needed. For example, during active military operations, collecting massive data from satellites to drones, and sharing of joint operation data seamlessly between allied forces. Cloud also enables cybersecurity instant threat detection and automated patching, often within minutes. Such ‘zero trust’ environments matter as weekly cyber attacks continue to grow (Opens in new window), increasingly powered by AI. Focusing on cost reduction, cloud is a significant upfront investment. However, optimising hardware and data storage generally cuts (Opens in new window) enterprise and defence IT spending by 20-40% – real benefit for a budget-constrained Japan.
The US Department of War awarded (Opens in new window) contracts to AWS, Google, Microsoft, and Oracle in 2022 under its Joint Warfighting Cloud Capability (JWCC). In Australia, the Department of Defence, Australian Signals Directorate, and other agencies partner with US hyperscalers such as AWS (Opens in new window), Google (Opens in new window), and Oracle (Opens in new window), plus local providers including Vault Cloud (Opens in new window) and Macquarie Government (Opens in new window), to build air-gapped (cut off from public internet) cloud environments across classification levels.
Japan can turn to Australia, a similarly technology dependent US ally, which has already taken steps in this direction.
Japan’s cloud market presently is dominated by foreign providers (around 70% (Opens in new window)), with only Sakura internet being formally selected (Opens in new window) as a Government Cloud service provider alongside US hyperscalers in March 2026. This foreign dominance is not unique to Japan. Cutting-edge technology is largely dominated by the US and China, so foundational IT infrastructure will often not be domestically owned. Regulatory measures like the US CLOUD Act – which compels (Opens in new window) US tech firms to hand over data, located domestically or overseas, to the US government – raise concerns over forced data transfer and access. Approaching data sovereignty from the traditional lens of absolute control – as with territory – is therefore unhelpful. The answer lies in partnering with trusted providers, diversifying between domestic and foreign options, and establishing legal and technical control mechanisms.
Australia has selected AWS for its top secret cloud; domestic provider Vault Cloud for secret and top secret workloads, and Google, Oracle, and Macquarie Government for lower classification levels. All undergo (Opens in new window) Information Security Registered Assessors Program (IRAP) evaluation and are approved under the Hosting Certification Framework to meet (Opens in new window) Australia’s security requirements. Legal and technical safeguards include a bilateral CLOUD Act Agreement to prevent (Opens in new window) US extraction of Australian data, limited access (Opens in new window) restricted to the highest security clearance, isolation (Opens in new window) from the public Internet and hyperscalers’ global networks, and data encryption (Opens in new window) via cryptographic keys held by the Australian government.
Japan can learn from Australia’s efforts as it explores cloud storage of classified information – already underway as the Japanese government works toward unified cloud classification standards by fiscal year-end. Japan must also decide whether to adopt an air-gapped system. The standard approach, taken by countries like Australia, combines an air-gapped cloud completely cut off from the Internet and low security networks with strict data isolation tools to move classified information securely in and out. Ukraine, however, is an outlier, taking the unconventional approach of moving (Opens in new window) sensitive workloads from physical servers inside the country to commercial cloud infrastructure in allied nations across Europe. Instead of isolated data storage – amid severe cyber and kinetic attacks from Russia – Ukraine chose cross border data management via hyperscale cloud, encryption, and dispersed storage, using high-speed connections for real time data collection, analysis, and dissemination on the battlefield. If “Ukraine today may be East Asia tomorrow (Opens in new window),” then air-gapped systems and localised data may not be the optimal solution.
Japan’s government maintains the assessment (Opens in new window) in its 2026 Defence of Japan white paper that the nation faces the “most severe and complex security environment since the end of World War II,” with an adversary attacking Japanese territory in a regional contingency not out of the question. Deciding what type of cloud solution to adopt – such as air-gapped or cross border data management – will matter as much as the decision to move to cloud at all.
The views expressed are those of the author.
About the author
Rintaro Nishimura
Rintaro Nishimura is a Tokyo based senior associate in the Japan practice of The Asia Group, a Washington based strategic advisory firm.
The most-pressing world events explained by Lowy Institute experts and global contributors, in your inbox, every Thursday.
You may unsubscribe from The Interpreter at any time. For information on our privacy practices and how to unsubscribe, see our Privacy Policy.
