Lessons Learned from the UK: Effective Public-Private Partnership for Critical Infrastructure Protection in Cybersecurity

近年，グローバル化の進展と技術革新に伴い国家の安全保障と経済活動の関係が一層密接になっている．2022年5月日本政府は「経済安全保障推進法」を制定した．本法により基幹インフラ事業者に対するサイバーセキュリティ対策が義務化された．これにより事業者の対策が進むことが期待される．しかし，民間企業の人的・財政的リソースが不十分である事，複数の省庁が関わり中核機関が不在である事から，十分な対策が持続的に進むとは言い難い．基幹インフラ保護を強化するためには，官と民の連携が不可欠である．本研究は，筆者が英国政府が実施する日英フェローシッププログラムで学んだ英国の事例を参考に官民が連携して基幹インフラのサイバーセキュリティ対策強化のために必要な要素を明らかにすることを目的とする．まず，経済安全保障推進法が抱える課題を提示，次に英国の政策の中核を担うThe National Cyber Security Centreの成立ちとその役割，官民連携の取組の一つである「インダストリー100」に焦点を当て，官民連携が上手くいくための要因は何かを考察する．最後に，日本が官民連携でサイバーセキュリティ対策を進めるために英国の事例の考察から政府が検討すべき論点を提示する．

In recent years, the relationship between national security and economic activities has become increasingly intertwined due to globalization and technological innovation. In May 2022, the Japanese government enacted the Economic Security Promotion Act, mandating cybersecurity measures for critical infrastructure service providers. This legislation is expected to enhance security measures. However, continuous implementation of sufficient security measures is challenging due to insufficient human and financial resources in the private sector and the absence of a leading government organization coordinating multiple ministries and agencies. Public-private sector cooperation is essential to strengthen the protection of critical infrastructure. This study aims to identify the necessary elements for effective public-private collaboration in promoting cybersecurity measures for critical infrastructures, based on a UK case study learned through the UK-Japan Fellowship Program. Initially, the paper presents the challenges of the Economic Security Promotion Act, then focuses on the origin and role of the National Cyber Security Centre, which plays a central role in the UK’s policy, and on “Industry 100,” a notable public-private partnership initiative. The study examines the factors contributing to successful public-private partnerships. Finally, the paper discusses the issues the Japanese government should consider promoting cybersecurity measures through public-private partnerships.