REGULATION OF COMPUTATIONAL BIOLOGY SUPERCOMPUTING ACCESS IN JAPAN

INTRODUCTION

Computational biology supercomputing access refers to the regulated use of high-performance computing (HPC) infrastructure for biological research, genomic analysis, molecular modelling, protein structure prediction, drug discovery and large-scale biomedical data processing.

Japan operates advanced supercomputing infrastructure, including Fugaku, managed by RIKEN's Center for Computational Science, and specialized genomic computing facilities operated by research institutions and universities.

Access to these systems raises important legal issues concerning research eligibility, cybersecurity, genomic-data protection, intellectual property, international technology transfers, research confidentiality and national security. Japan does not have one comprehensive statute exclusively governing computational biology supercomputing access. Instead, several laws, institutional regulations and research-governance policies operate together.

1. JAPANESE LEGAL AND REGULATORY FRAMEWORK

A. ACT ON THE PROMOTION OF INFORMATION PROCESSING

The Act on the Promotion of Information Processing provides an institutional and policy framework for developing Japan's information-processing infrastructure and technological capabilities.

It supports the development of advanced computing infrastructure and the responsible use of information-processing technologies.

B. BASIC ACT ON CYBERSECURITY, 2014

The Basic Act on Cybersecurity (Act No. 104 of 2014) establishes the national framework for cybersecurity governance.

Its relevance includes:

Protection of critical computing infrastructure.

Cybersecurity coordination.

Institutional security responsibilities.

Information-system risk management.

Cooperation between government, research institutions and private organizations.

C. ACT ON PROHIBITION OF UNAUTHORIZED COMPUTER ACCESS, 1999

This legislation prohibits unauthorized access to computer systems through protected access-control mechanisms.

Section 3 prohibits unauthorized computer access, while other provisions address improper acquisition and provision of authentication credentials.

Unauthorized entry into university genomic computing systems or supercomputing facilities may therefore create criminal liability.

D. ACT ON THE PROTECTION OF PERSONAL INFORMATION (APPI)

The APPI regulates personal information processing, including identifiable genomic information.

Research institutions must consider:

Lawful collection and processing.

Appropriate security safeguards.

Restrictions on third-party provision.

International transfers.

Purpose limitation and transparency.

Special protections for sensitive information.

Academic research institutions may benefit from statutory research-related exceptions, but these do not create a blanket exemption from the APPI.

2. ACCESS AUTHORIZATION AND ELIGIBILITY REQUIREMENTS

Japan's Fugaku supercomputer operates through the High Performance Computing Infrastructure (HPCI) framework.

Researchers must submit research proposals and obtain project approval before receiving authorized access.

Access categories include general research projects, junior researcher projects and industrial-use projects.

The approval process may consider:

Scientific merit and research objectives.

Institutional affiliation.

Project feasibility.

Resource requirements.

Security and compliance considerations.

Appropriate project leadership.

The University of Tokyo's Human Genome Center also maintains specific regulations governing access to its genomic supercomputing facilities.

Its regulations require formal applications, approval by the competent institutional authority, individual user accounts and compliance with data-management responsibilities.

3. INTERNATIONAL ACCESS AND TECHNOLOGY TRANSFER CONTROLS

Japan's Foreign Exchange and Foreign Trade Act (FEFTA) is particularly important when foreign researchers seek access to advanced supercomputing infrastructure.

Providing access to supercomputers and associated technical information may constitute the provision of controlled technology under applicable export-control rules.

Universities and computing institutions must examine whether access by non-residents or researchers falling within specified categories requires additional security review or authorization.

The HPCI framework also requires security export-control documentation for relevant project members.

International collaboration therefore requires appropriate examination of researcher eligibility, institutional affiliation, technical information access and applicable export-control restrictions.

4. GENOMIC DATA SECURITY AND RESEARCH CONFIDENTIALITY

Computational biology projects frequently involve human genomic datasets, medical records and biological research information.

Institutions must implement appropriate access controls, authentication, encryption, data-management policies and incident-response procedures.

The APPI remains applicable to identifiable genomic information even when it is processed for academic research. Research-related exceptions must be interpreted within their statutory limits.

Research institutions must also comply with applicable ethical guidelines concerning human genomic and genetic analysis research.

5. CYBERSECURITY, INTELLECTUAL PROPERTY AND INSTITUTIONAL LIABILITY

Supercomputing facilities must protect research infrastructure against unauthorized access, malicious software, data theft and service disruption.

The Act on Prohibition of Unauthorized Computer Access establishes criminal restrictions against unauthorized system access. The Penal Code may also apply to electronic-record manipulation and obstruction of computer-based business operations.

The Copyright Act protects qualifying software, databases and computational research materials. The Unfair Competition Prevention Act may protect confidential technical information and trade secrets.

Institutional responsibility may arise where inadequate security controls, improper account management or unauthorized disclosure causes legally recognizable harm.

6. IMPORTANT JUDICIAL PRECEDENTS AND CASE LAWS

There is no reported Japanese Supreme Court judgment specifically determining access rights to computational biology supercomputers. The following decisions provide relevant direct or analogous legal principles.

A. ANALOGOUS AUTHORITIES CONCERNING COMPUTER ACCESS

1. Supreme Court of Japan, 8 August 2007 – Unauthorized Access and Electronic Record Case

The Supreme Court considered an appeal involving violations of the Unauthorized Computer Access Act and the creation and use of false electronic records. The decision is relevant to the criminal consequences of unauthorized access and manipulation of electronic information.

2. Tokyo District Court, 25 March 2005 – Unauthorized Access Case (Heisei 16 (Toku-wa) No. 752)

The defendant accessed a protected computer server by exploiting a technical vulnerability. The court considered whether the conduct constituted unauthorized computer access. The decision illustrates that technical sophistication or claims of identifying security weaknesses do not automatically justify unauthorized access.

3. Osaka High Court, 27 March 2007 – Unauthorized Access and Electronic Record Case

The court considered unauthorized use of another person's online account credentials and the creation of false electronic records. Its principles are relevant to credential misuse, user-account security and unauthorized manipulation of supercomputing resources.

B. ANALOGOUS AUTHORITIES CONCERNING SOFTWARE AND DATA GOVERNANCE

4. Supreme Court of Japan, 19 December 2011 – Winny Case (2009 (A) No. 1900)

The Supreme Court considered whether the developer of file-sharing software was criminally liable for copyright infringement committed by users. It examined the developer's knowledge and intention concerning the software's unlawful use. The decision is relevant to computational software developers and the distinction between providing legitimate research infrastructure and intentionally facilitating unlawful conduct.

5. Supreme Court of Japan, 31 January 2017 – Google Search Results Case (2016 (Kyo) No. 45)

The Court considered the balance between individual privacy rights and the public interest in providing search results. Its reasoning is relevant to the handling and disclosure of sensitive genomic information stored or processed through supercomputing infrastructure.

6. Supreme Court of Japan, 24 September 2002 – Privacy Rights Judgment (2001 (O) No. 851)

The Supreme Court recognized that an individual's interest in preventing unjustified disclosure of private information is legally protected. This principle is relevant to confidentiality obligations involving identifiable genomic datasets and medical research information.

LEGAL SIGNIFICANCE: These decisions provide analogous principles concerning access authorization, software responsibility, electronic records and privacy. They should not be described as judgments directly regulating Fugaku or genomic supercomputing access.

7. REGULATORY COMPLIANCE AND ENFORCEMENT

Research institutions, universities and private biotechnology companies should establish comprehensive compliance arrangements.

Essential measures include:

Obtain formal project and institutional access approval.

Maintain individual user identification and authentication.

Conduct security export-control assessments for relevant foreign participants.

Protect identifiable genomic and medical information under the APPI.

Maintain research-data access logs and appropriate audit trails.

Follow software licensing and intellectual property requirements.

Establish procedures for reporting cybersecurity incidents.

Ensure ethical approval before processing research data requiring institutional review.

Maintain appropriate backup and recovery arrangements.

Suspend unauthorized accounts and investigate suspected security breaches.

Institutions should also establish clear agreements addressing research ownership, confidentiality, permitted data use, publication rights and responsibility for security incidents.

CONCLUSION

Japan's regulation of computational biology supercomputing access operates through a combination of cybersecurity legislation, personal information protection, export controls, intellectual property law and institutional access regulations. The Fugaku and Human Genome Center frameworks demonstrate how formal project approval, user eligibility, security documentation and responsible data management are implemented in practice. Although Japanese courts have not established a dedicated body of case law concerning genomic supercomputing access, judicial decisions involving unauthorized computer access, software distribution and privacy provide important analogous principles. Effective governance requires secure infrastructure, lawful international collaboration, transparent research authorization and strong protection of genomic information.