TOKYO - Japan's nationwide emergency alert system lacks the capability to encrypt data transmitted via satellites and verify the source, making it vulnerable to fake data that could activate the warning system, an expert said Sunday.
A source at the Ministry of Internal Affairs and Communications admitted the flaw in the government's satellite-based J-Alert system, which issues early warnings to municipalities nationwide about natural disasters, including earthquakes and tsunamis, as well as overseas missile launches.
The vulnerability could be exploited to issue false alerts and disrupt people's lives.
Yudai Kirishiki of Unknown Technologies Inc., a Tokyo-based cybersecurity firm, confirmed that the J-Alert system has no function for authenticating data sources using electronic signatures, based on an analysis using a system receiver used by a local government that later turned up for sale on the secondhand market.
Kirishiki also found that the receivers were unable to detect fake information formatted like J-Alert data and transmitted from elevated locations, using drones for example, demonstrating that "a third party can send a false warning."
An official of the Civil Protection Office of the ministry's Fire and Disaster Management Agency declined to provide details "from a security standpoint" but told Kyodo News that the government is "constantly working to ensure stable operations" of the system and will continue to "appropriately respond" to the matter.
Regarding the circulation of used data receivers on the secondhand market, the official called it "very regrettable," noting that the government had provided municipalities with detailed disposal instructions in late July.
When Japan started operating the J-Alert system in 2007, cyberattacks on the satellite communications system were not considered a real threat, leading the government to delay taking countermeasures.
Government entities such as the Japan Meteorological Agency and the Cabinet Secretariat transmit emergency data via satellite to receivers operated by municipalities and other public organizations, which then relay alerts to residents via television, radio, smartphones and other devices.
