Japanese officials censor U.S. security critic

TOKYO -- A U.S.-based network security expert claimed he was censored by Japanese government officials when he attempted to give a speech in Tokyo last week about problems with the nation's controversial online citizen registry network, called Juki Net.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Ejovi Nuwere, chief technology officer of SecurityLab Technologies, was scheduled to give a presentation on security issues related to Juki Net at the PacSec.JP/core04 security conference in Tokyo on Nov. 12.

Instead, just 30 minutes before he was scheduled to go on stage, Nuwere cancelled his talk after officials from Japan's Ministry of Internal Affairs and Communications (MIC) demanded that he remove a slide from his presentation that outlined his conclusions about the security of Juki Net.

"They have this mentality that if no one knows there is a problem, there is no problem," Nuwere said.

Juki Net is a national network of databases that contain the names and personal details of nearly every person residing in Japan. It has been surrounded by controversy, particularly over security concerns, since even before its launch in 2003.

One of Juki Net's strongest critics has been the prefectural government of Nagano in central Japan. Last year, Nagano hired a three-person team of security experts, including Nuwere, to conduct an audit of the system's security. The group successfully compromised servers that maintained Juki Net information via terminals at public facilities.

Part of Nuwere's aborted presentation was based on his findings from these tests. This concerned MIC officials, who told conference officials that they objected to Nuwere's use of a picture and a diagram showing the construction of Nagano's network, as well as several other slides, according to Nuwere.

"They were afraid that I would reveal how I compromised the system," Nuwere said.

In the days before the speech was due, MIC had raised several concerns about the presentation. On the morning of Nov. 11, Nuwere offered to discuss those concerns in a meeting with MIC officials but did not receive a response, he said. When officials asked Nuwere on Nov. 12 to cut the slide outlining his conclusions, he cancelled his talk.

MIC officials requested that the slide be removed because of concerns that information in Nuwere's presentation might help hackers break into Juki Net, said Mabito Yoshida, director of the IT Security Office at MIC's Information and Communications Policy Bureau. "His withdrawal (from the conference) was unexpected," he said.

Nuwere said his presentation did not contain any information that would have helped hackers. As a security professional, he said, he knew what not to disclose. Furthermore, he was bound by a nondisclosure agreement with the Nagano prefectural government, he said.

MIC officials did not meet with Nuwere in person. Negotiations between Nov. 10 and Nov. 12 were conducted through representatives of Secured Infrastructure Design Corp. K.K. (SIDC), one of the conference organizers.

MIC officials wanted to know the contents of Nuwere's presentation ahead of time to avoid "incorrect information" appearing publicly, said Satoshi Uchida, an SIDC sales executive who acted as an intermediary between Nuwere and MIC officials. But Nuwere would not accept the changes that MIC officials requested, he said.

The changes that MIC officials requested would have rendered the talk devoid of any worthwhile information, said Dragos Ruiu, a computer systems security auditor who chaired the PacSec conference selection committee. Nuwere's original presentation was mainly positive, encouraged dialog on the system's security issues, and was peer-reviewed by Ruiu more than a month before the conference began. It contained no content that would aid hackers, he said.

"It seems that they (the MIC) never wanted the presentation to be made," Ruiu said.

Officials went so far as to pressure event sponsors into trying to prevent Nuwere from giving his original presentation or speaking at all, Ruiu said. "It was made clear that if Nuwere went ahead, things would become unpleasant," he said.

Looking back, Nuwere said the episode disappointed him because the MIC was unwilling to listen to opinions that differed from theirs.

"The greatest danger to Juki Net is the MIC and their thinking," Nuwere said. "They think they can censor people ... and that's going to be bad for Japan."