BeerCon2 - Day 1

### Overview In "Tokyo Take Down: How 10 Seconds Can Change the World," speaker Ben Ellis explores the cybersecurity posture of Tokyo and Japan at large. He examines how Tokyo's hyper-focus on convenience, efficiency, and ubiquitous automation leaves the city uniquely exposed to cyber and physical disruption. Through the narrative of an everyday Tokyo resident named Han Liu, Ellis illustrates how seemingly small digital manipulations can cause massive compounding chaos across transportation, retail, and municipal infrastructure.

### Key Topics - **The Paradox of the City of Convenience:** Tokyo's reliance on pervasive automation—such as dense networks of vending machines, high-speed transit systems, and at-the-door convenience stores—prioritizes usability over robust security. - **Disruption Scenarios Through Daily Routine:** A walkthrough of Han's day highlights attack vectors including ATM card skimming by the Yakuza, RFID/FeliCa skimming from Pasmo transit cards, transit gate timing delays at Shinjuku Station, and tampering with pedestrian crossing signals at Shibuya. - **Municipal and Industrial Infrastructure Risks:** Potential tampering with subway station gates causing fires or closures, false emergency siren/earthquake alarms, and the vulnerability of legacy dam control systems and flood prevention systems. - **The Japanese Cybersecurity Landscape:** A cultural background characterized by an aging population, a history of "job for life" shifting to insider threat risks, victim-shaming around disclosing breaches, an absence of basic cyber hygiene education, and leadership gaps.

### Technical Details - **Smart Card & Payment Exploits:** Pasmo transit cards utilize Sony's FeliCa system (an RFID/NFC technology) designed for high-speed transactions (a tenth of a second) and extended operational range. While efficient for high passenger volume, the range facilitates drive-by skimming with minimal transaction recording. In 7-Eleven's mobile payment app ("7pay"), a lack of two-factor authentication led to a 55 million yen loss (~£400,000). - **High-Density Flow Manipulation:** Shinjuku Station handles an estimated 3.5 million people daily (~900,000 per rush hour) with around 200 ticket gates operating on 2-second throughput cycles. Slowing gate processing by just 8 seconds to 10 seconds causes catastrophic bottlenecks, reducing throughput from 1,000 passengers per 10 seconds to 200. - **Legacy OS and Cyber Preparedness Metrics:** Ellis cites that Tokyo's flood and dam control systems run legacy operating systems. He highlights a Harvard University 2020 global ranking placing Japan 9th overall in cyber capabilities and 20th in attack monitoring. A cited survey of 1,794 Japanese companies noted roughly 90% view their cyber defenses as insignificant, while the 2018 Cybersecurity Minister famously admitted to never having used a computer.

### Takeaways Japan faces an acute cybersecurity talent shortage. Although agencies like the National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and the Cybersecurity Council have emerged alongside initiatives to train engineers, training output remains insufficient. Ellis encourages international cybersecurity professionals to look to Japan as a critical frontier where infosec expertise is urgently needed to protect an innovative but vulnerable technological ecosystem.