Cybercrime, the Metaverse, and the Law: Shaping Cybersecurity for the Way We Live Professor, Graduate School of Social Sciences, Chiba Unicersity Yoshiaki NISHIGAI

Criminal law was originally created to deal with tangible acts and objects. However, in modern society, where intangible information and digital technologies play a major role, new legal approaches are needed. We spoke with Professor Yoshiaki Nishigai of the Graduate School of Social Sciences—who holds an engineering degree but now specializes in ‘information criminal law’—about cybersecurity, cyberbullying, and how criminal law should evolve for the metaverse era.

Criminal Law in a Digital Society: Can Justice Keep Up with Algorithmic Innovation?

Japan’s criminal laws lag behind cybercrime

What kind of research are you conducting in the area of cybersecurity?

I am researching what kinds of actions in cyberspace should be subject to criminal penalties to ensure cybersecurity. For example, the concept of ‘unauthorized access’ is a particularly complex and nuanced area of study, with multiple interpretations and implications.

I also examine how criminal law should respond to offenses that infringe upon the information systems and networks of companies and organizations—not only in cyberspace but also in the physical world. For example, we need to explore how criminal law can address cyberattacks as well as the physical world. There, we need to explore how criminal law can address cyberattacks on critical infrastructure, such as power grids and transportation systems, from both a punitive and preventive perspective. The goal is to prevent large-scale disruptions caused by such attacks.

There was a recent case where a cyberattack on a hospital disrupted its operations

It is entirely conceivable that a hospital network could become unavailable due to such an attack, making it impossible to treat critically ill patients and forcing emergency transfers to other facilities—potentially resulting in patient deaths. In the physical world, if a person dies due to disrupted medical treatment, charges such as murder or manslaughter may be applicable. However, when it comes to cyberattacks on critical infrastructure, it can be difficult to establish a direct causal relationship, making it unclear whether the same legal provisions can be applied.

If fatalities occur and only lesser charges, such as negligent homicide, can be pursued, it would raise serious concerns. I believe we must establish legal frameworks that allow for proportionately severe penalties that reflect the seriousness of cyberattacks and their potential consequences.

It is true that Jana’s criminal law needs further development.

Furthermore, in cyberspace, the government is also exploring the possibility of active cyber defense—for example, identifying the source of a cyberattack and disabling the attacker’s server. However, current laws do not clearly specify who is authorized to engage in such defensive actions, nor do they define the legal boundaries of such responses*. I believe it is essential to clarify the extent to which countermeasures can be deemed justifiable under Japanese criminal law. We must avoid a situation in which any form of retaliation is permitted without legal constraints.

*On May 16, 2024, a law was enacted to ensure the safe and stable use of cyberspace—particularly to protect national security and critical infrastructure—enhance cybersecurity response capabilities, and establish effective governance.

How does criminal law address collective personal attacks online?

When it comes to crimes in cyberspace, the Panel Code was recently revised following a case in which one took their own life due to collective online bullying.

As of 2022, the penalties for the crime of insults have been strengthened, with the maximum sentence increased to one year of imprisonment. However, under Japanese law, the crime of insults is primarily defined as an act that damages a person’s social reputation. The psychological harm suffered by the victim is not a central factor in determining the severity of the offense.

I’ve also seen a lot of debate about whether simply increasing the statutory penalties for misdemeanor offenses is sufficient, especially in cases where the act causes serious mental damage—potentially even leading to suicide

That’s true. One of the major challenges with online attacks—such as so-called ‘flaming’—is that they often involve a large number of perpetrators. This makes it difficult to apply existing legal concepts like complicity and highlights the limitation of traditional criminal law in addressing such cases.

When discussions around legal reform first started, I published an article suggesting that instead of relying on the existing crime of insults, we should consider establishing a new criminal category—something like a ‘cyberbullying offense.’ While the penalties have been increased this time, we still need to ask whether the current legal framework is sufficient to deal with serious online abuse. It may be time to consider new legal concepts that better reflect the nature and impact of cyberbullying.

Lowering the barriers between criminal law and other fields without being confined to the logic of criminal law

This issue seems to involve questions such as what constitutes a ‘flaming incident,’ what qualifies as an insult, and how to understand the connection between a loss of social standing and the emotional impact on the individual. How do you approach this kind of complexity?

As specialization deepens both in the legal field and in society more broadly, our perspectives can easily become narrow. This makes it harder to recognize where the real issues lie and how they might be resolved. But by learning from the viewpoints of other disciplines and reexamining what we take for granted, we often find new paths forward. When I was an undergraduate student in the Faculty of Engineering, I belonged to a lab that encouraged interdisciplinary research. We actively drew on knowledge from other fields to create new ideas and approaches. That experience probably shaped my current mindset. I believe what’s important is not to think of the hurdles between disciplines as ‘too high to overcome.’ Whether the barrier is high or low isn’t really the point—it’s more important not to be afraid to cross it.

Incidentally, I am currently co-hosting a research group where researchers in both copyright law and criminal law come together to explore these issues. Within each legal field, discussions tend to follow a particular trajectory shaped by internal logic and background. So, when you present those discussions to people in another field as if they were self-evident, you may encounter pushback. Because the ‘common sense’ of the two fields differs, it often takes time for the discussions to align—but it’s precisely in that space where new ideas can emerge.

Of course, research should build upon the accumulated insights of those who came before us. But I also believe that one of the joys of research lies in ‘creating new concepts.’ I see no contradiction between the two. I hope that law students and early-career researchers will find a theme they are passionate about—something they can devote themselves to for the next 20 or 30 years—and pursue research that brings forth new perspectives and has real value for society, rather than simply following in the footsteps of others.

The Metaverse: A new place for people to live

I heard that you are also researching the relationship between the metaverse and criminal law. Could you tell us more about that?

Until I completed my master’s degree, I was part of a lab that focused on VR and MR technologies—essentially the very foundations of what we now refer to as metaverse. As the metaverse continues to develop, it’s becoming clear that crimes similar to those in the physical world can also occur in virtual environments. For example, someone might steal a digital item owned by another person or engage in acts like sexual harassment. However, it’s not always possible to apply existing criminal law concepts, such as theft or trespassing, directly to acts committed in virtual spaces.

In the future, the metaverse is expected to evolve into more than just a space for business and entertainment. It may increasingly function as a public space. Some people might even choose to live primarily in the metaverse rather than in the physical world. For instance, they could attend school, receive medical treatment, or access welfare services there. In that sense, the option of living in the metaverse emerges. It may sound like a science fiction story, but I think metaverse researchers sincerely see it as a foreseeable future.

If someone were to spend decades living in the metaverse and then suddenly had their account suspended by a third party, it would be equivalent to losing their place in life. How the law should respond to such situations may become an important issue in the future. It’s not a question that can be answered easily or immediately, but I hope to help develop a criminal law framework that is truly for people—regardless of whether they live in physical space, cyberspace, or somewhere in between.

Beyond the dichotomy between technology and law

The goal is not simply to impose criminal law on areas where rules have yet to be established but to consider what kind of legal frameworks are needed to build a society in which people can live with peace of mind.

Whenever new technologies emerge, they inevitably bring about new problems or unforeseen accidents. In such moments, there is often a reflexive reaction—people say, “Without this technology, there would have been no harm, so let’s ban or strictly regulate it.” And while banning it might prevent further harm, it may also stifle future innovations that could have real benefits.
Coming from an engineering background, I would not like to see technological progress halted by overly rigid regulation. Instead, I hope to explore what kinds of legal systems can help society improve as new technologies are introduced and what legal interpretations are needed to support that process.

Both technology and law systems are ultimately human creations designed to serve the public good. Therefore, rather than framing things as a choice between advancing technology or enforcing regulation, I want to focus on whether we can take approaches that truly support those in need and contribute to building a better society.
That said, I am not conducting research driven by a sense of justice that says, “It should be this way!” I personally believe that by maintaining both a calm, neutral perspective and a strong passion, we can uncover various issues and think about what should be done beyond existing frameworks. This would be the job of a researcher.