Information security education for students in Japan

Introduction

This article aims to introduce the current situation of elementary and secondary school education on
information security in Japan, as well as to provide a brief introduction to the environment
surrounding Japanese students. “Courses of Study” have been stipulated as the general standard for the
curriculum to ensure that Japanese children receive the same level of education wherever they are in
Japan. These Courses of Study are stipulated by a law called the School Education Act under the
jurisdiction of the Ministry of Education, Culture, Sports, Science and Technology (MEXT). The
Courses of Study provide the purpose and the general content of all subjects that students study
according to their stage of development in school, and range from kindergarten to upper secondary
schools. The current Course of Study was presented by the MEXT in 1958 and has been revised every
10 years. The most recent revisions were in 2008 for kindergartens, elementary schools, and lower
schools, and in 2009 for upper secondary schools and schools for Special Needs Education. This
revision was stipulated in the Central Council for Education’s report on “Improving Courses of Study
for Kindergartens, Elementary Schools, Lower and Upper Secondary Schools, and Schools for Special
Needs Education,” which was based on the revision of the School Education Act.

1. Current state of information and communication technology (ICT) use by Japanese students

1-1. Increase of information security threat

According to Figure 1, which shows infection rates by country/region in 2013, Japan has been one of
the relatively healthier countries in the world. However, the environment surrounding ICT in Japan has
been changing day by day, and information security threat has increased too. It can be said that about
147 million viruses have been detected so far; nearly 18 million new malware were found in the
second quarter of 2013.

Figure 1 Infection rate by country/region

1
The number of young people who have their own mobile phone has been on the rise in Japan. Of the
47.4% of young people in elementary school to upper secondary school, 24.1% of elementary school
students and 46.2% of lower secondary school students have their own mobile phone, the Cabinet
Office has reported. Even though less than half of the students have their own mobile phones, malware
that targets mobile phones or smart devices continues to spread. Other than the problem previously
mentioned, as the cyber security threat associated with social media dissemination like Facebook and
Twitter rises, it will become increasingly difficult to protect against such threats.

1-2. Use of ICT by the younger generation

The number of Internet users in Japan reached 96.52 million at the end of 2012, an increase of 420,000
users from the end of 2010, and the Internet population penetration rate was 79.5%. In addition, Figure
X shows that the Internet population penetration rate between the ages of 13 to 19, corresponding to
students of lower and upper secondary school in Japan, reached almost 100% (97.2%), and the rate for
ages 6 to 12, corresponding to elementary school students, is even about 70%. Students are coming
into contact with ICT equipment at an increasingly early age. The percentage of young people who
started using a personal computer in elementary school is 82.7%, with 10.8% starting to use them in
junior high school. According to the Cabinet Office survey, the percentages of Internet use in the
United States for ages 6 to 12 and 14 to 17 are about 73.06% and 84.83% respectively, while in Korea
the percentages of use are about 86% for ages 3 to 9, and 99.9% for teenagers.

10 thousand people %

Figure 2 Transition in the number of Internet users and the population penetration rate

2
 Figure 3 Transitions in age groups of Internet users and the population penetration rate

2. Awareness of information security

According to the statistics of the Ministry of Internal Affairs and Communications, those who reported
anxiety due to using the Internet, who were “worried” and “feeling a little uneasy,” accounted for
about half (48.7%). In detail, 72.2% were “concerned about virus infection,” 59.3% were “uncertain
how far security measures should be taken,” and 36.4% were “unable to specifically understand threats
to security.” These results show that anxiety about information security is still high among Japanese
people.

Figure 4 Matters of concern among households that use the Internet (multiple answers permitted)

As described above, Japanese people suffer from anxiety about information security, but about 90%
(88.2%) of Japanese people are planning to introduce some sort of information security measures.
However, as of now, in terms of countermeasures, such as a concrete plan on what needs doing to
eliminate concerns about information security, has been left to each individual. This is not limited to
adults; currently, the presence or absence of the implementation of information security measures, and
guidelines on how to use the Internet, is left to even children of elementary and junior high school age
to figure out.

3
 Figure 5 Implementation of information security measures among households (multiple answers
permitted)

3. Information security education in the school curriculum

The importance of computer education in Japan was first emphasized in 1985, with related Ministry
notices issued in 1988 and 1989. The Course of Study based on the 1989 notice, “Basic information”
was first established in the Lower Secondary school curriculum as an optional subject. After that,
“Information and Computers” became a compulsory subject under the Course of Study subject
“Technology and home economics” based on the notification of 1998, and the subject “Information”
was introduced in upper secondary school as a common subject. With the enforcement of “Basic Law
on the Formation of an Advanced Information and Telecommunications Network Society (IT Basic
Law)” in 2001, “e-Japan Strategy,” “New IT Reform Strategy” and “i-Japan Strategy 2015” were
developed as national ICT strategies.

Under the 1998 notification regarding the subject “Technology and home economics,” the course
“Information and Computers” aims to introduce students to the basic knowledge and technologies for
the appropriate use of ICT, make students understand the relationship between ICT and their life and
information ethics, and develop the ability and attitude to utilize information tools on their own
initiative. Lower secondary school students have to learn the following content: 1) roles that ICT play
in daily/school life and industries (characteristics of information technology devices like computers
and information networks, the relationship between daily life and computers, the impact of
computerization on society and daily/school life, information ethics, etc.); 2) basic frameworks,
functions and operations of computers (to know basic frameworks and functions of computers and be
able to operate them etc.); 3) computer use (to know actual usage and process information by means of
software, etc.); and 4) information and telecommunications networks (to know ways to deliver and
utilize information, to collect, evaluate, treat and transmit information etc.). Students also have the
option of taking a course in either 5) utilizing multimedia through the use of computers, or 6)
4
measuring and regulating computer programs depending on their interests. These curriculums cover all
information education in schools, but as for information security education, education regarding
information ethics is part of mainstream education. Information ethics education has to be learnt
systematically from elementary school to upper secondary school. Following the situation, MEXT
presented model curriculums regarding information ethics education in 2007. This model includes
objectives and learning item examples of each school stage and grade, and classifies them into five
categories: 1) ethics of information-based society, 2) understanding and compliance of laws, 3)
knowledge for safety, 4) information security, and 5) construction of a public network society. The
following table shows how the information security curriculum is organized.

Stage Elementary School

1 2 3 4 5 6
Grade
(age 7) (age 8) (age 9) (age 10) (age 11) (age 12)
Know the basics of information security needed for daily life
● Understand the importance of
Objectives ● Able to use ICT that is not accessed
authentication, and use it
illegally
appropriately
● Do not give your passwords to ● Understand that a person has to keep
Learning
anyone one’s password to oneself
item
● Do not leave your laptop ● Learn how to keep personal information
examples
unsupervised. from being leaked
Implement measures to keep
information secure
Objectives
● Learn how to prevent information from
being crushed and leaked.
● Learn about computer viruses
Learning
● Do not give your laptop to others
item
examples ● Learn the risks of downloading anything
from the Internet.
Stage Lower Secondary School Upper Secondary School
1 2 3 1 2 3
Grade
(age 13) (age 14) (age 15) (age 16) (age 17) (age 18)
Acquire fundamental and basic knowledge of information security
Objectives ● Acquire fundamental knowledge of ● Acquire basic knowledge of information security, then act
information security appropriately
Learning
● Learn how private information that is ● Learn how to protect information by coding, and utilize
item
leaked out could be used for bad ends this knowledge
examples
Implement measures to keep information secure
Objectives ● Learn to develop a proactive plan, emergency responses,
● Learn to build a fundamental security plan
backward incidence regarding information security
● Learn to prevent information leaks caused ● Learn to build proactive plan, emergency response,
by unauthorized access backward incidence regarding viruses
Learning
● Know and implement techniques to protect laptops and
item
information adequately
examples
● Implement measures against network-mediated attacks
(firewalls, etc.)
Figure 6 Information security education

5
4. Challenges

There are some challenges to improving information security education at each stage of education: 1)
at the kindergarten stage, since schools often focus most of their attention on familiarizing students
with ICT, there is a difference between each school’s efforts regarding information education, and
instruction on information ethics is not enough. 2) At the lower secondary school stage, as either of the
two subjects “Utilizing Multimedia” and “Measurement and Regulation of Computer Programs” (as
mentioned above) may be selected by each school, there is a gap in students’ information literacy
when they graduate. 3) At the teacher training stage, where teachers’ ability to teach information
education must be fostered and supported with on-going training. And 4) at all the stages of school
education, instruction regarding information ethics is not enough. In recent years, there have been
many cases of students getting into trouble in this area, like defamation and bullying on the Internet, as
well as crimes and the dissemination of illegal and/or harmful information on the Internet. However,
information security education needs to be addressed by a variety of stakeholders, including teachers,
students, parents, and communities.

REFERENCE:
Ministry of Internal Affairs and Communications, Japan (2013), “White Paper 2013, Information and
Communications in Japan”
Information-technology Promotion Agency, Japan (2013), “White Paper on IT Human Resource”
Information-technology Promotion Agency, Japan (2013), “Information Security Reader”, Jikkyo
Shuppan
Information-technology Promotion Agency, Japan (2013), “White Paper on Information Security”
Microsoft Security Intelligence Report Volume 15, January through June 2013
[Link]
McAfee Threats Report: Second Quarter 2013
[Link]
Cabinet Office (2013), “Survey results about internet usage environment of Youth in Japan”

<Akiko Kohgo>
1771