'Japan's CIA' Uses U.S. Microsoft Service for Spy Tips, Raising Fears of Confidential Information Leaks

1. Overview

Controversy spread in Japan and abroad after it became known that the National Intelligence Bureau of Japan, launched on July 31, 2026, was using Microsoft Forms, a U.S. service, to receive tips about espionage and threats. The “third blank” in the title refers to item 3 on the form, “Information Provided” (情報提供内容). Like item 1, “Theme,” and item 2, “Subject,” it is marked with an asterisk to indicate that a response is required. Tipsters therefore have to enter the actual details of their tip in this field before they can submit the form.

At the center of the controversy is the fact that the field most likely to contain sensitive information is hosted on a general-purpose service run by a foreign company. The form says that “details such as your name and email address are not automatically collected unless you provide them directly,” but users cannot see which country’s servers the submitted content is stored on or under what conditions. Questions that began on Japanese social media shortly after the bureau’s launch led to commentary from security specialists and criticism on personal blogs, and eventually to a report by Sankei Shimbun. The National Intelligence Bureau’s position is that “we do not think using an overseas service is automatically a problem.”

2. The National Intelligence Bureau and Its Tip Line

The National Intelligence Bureau was established on July 31, 2026, when the Act for the Establishment of the National Intelligence Council (Act No. 28 of Reiwa 8) came into force. It was formed by reorganizing the Cabinet Intelligence and Research Office and is an intelligence agency directly under the Prime Minister’s Office. The Yomiuri Shimbun reported that the bureau aims to strengthen intelligence-gathering and analysis capabilities and break down barriers between government ministries, with a staff of about 730. The Cabinet Public Affairs Office’s account also announced that the National Intelligence Council and National Intelligence Bureau had been established that day as the “first step” in the intelligence reforms pursued by Prime Minister Takaichi since taking office. A post on FM Korea described the bureau as the “Japanese CIA,” launched with great ambition by the Takaichi Cabinet.

Through the Cabinet Secretariat website, the National Intelligence Bureau accepts information about “threats to our country or the people of Japan.” The issue is that the link on the information page leads not to a government domain but to a Microsoft Forms address (forms.cloud.microsoft). Personal blogger Tōru Kageyama (影山透) noted that the predecessor Cabinet Intelligence and Research Office had used a form built on the Prime Minister’s Office domain, and argued that the nature of the system’s underlying platform had changed.

3. Reactions on Social Media

The controversy flared up on X (formerly Twitter) on August 1, the day after the bureau’s launch. User おなか (@HNamachiri) wrote that it was “funny in a roundabout way” that the National Intelligence Bureau’s tip line used Microsoft Forms, adding that if the Prime Minister had put so much effort into this project, the government should at least have shown more enthusiasm, even if only for appearances. The same user went on to criticize the fact that a channel for receiving information about threats to Japanese citizens used a cloud service run by a giant foreign company, while also warning users not to enter personal or confidential information. Similar reactions followed. Some sarcastically said that all the espionage tips received would end up in Microsoft’s cloud; others said there was too great a gap between the form’s disclaimers and the information it was meant to collect. Some also asked why the government had not done what the Board of Audit had done and used its own form.

Lernen (@lernen_kasumi) initially wrote “Google Forms” before correcting it to Microsoft Forms. They explained that although it was difficult to suggest an alternative, it was disappointing to see a foreign platform used for tips that could involve national security, even if the platform belonged to an ally. In response, some said the government should make the effort to provide dedicated government regions such as AWS GovCloud or Azure Government. The discussion was compiled on Togetter and reposted under the same title on Japan’s Reddit community r/newsokuexp. One Reddit post noted that people were uneasy and asking, “Was there no better way?”

4. Security Commentary and Criticism on Blogs

In early August, impressions on social media gave way to more detailed summaries of the issues. On August 2, Tōru Kageyama posted an article on note outlining five problems with the current form:

• Anonymity: Because the communication encryption is decrypted at Microsoft’s gateway servers, it does not remain encrypted only between the tipster and the National Intelligence Bureau. Even if the form is configured not to record names, traces such as IP addresses and connection times remain in the provider’s infrastructure.
• Authenticity verification: Microsoft Forms is free for anyone to use, making it easy to create a fake form that looks identical. Phishing attacks abusing this domain have also been repeatedly reported.
• Reliance on foreign infrastructure: Because the service is operated by a U.S. company, the handling of data is subject to U.S. law. In 2023, a group reportedly linked to China exploited a Microsoft signing key to access the email accounts of more than 500 people across 22 organizations. In a 2024 report, the U.S. Cyber Safety Review Board (CSRB) concluded that the intrusion could have been prevented.
• One-way communication and inability to submit evidence: The predecessor form stated that responses would generally not be sent, and file attachments were allowed only for signed-in users, meaning anonymous tipsters could not submit supporting evidence.
• Japanese-only: Foreign nationals and people submitting tips from abroad are effectively excluded.

He proposed six improvements: returning to a government domain (go.jp), adding an anonymous submission channel such as SecureDrop, providing tipsters with guidance on protecting themselves, offering multiple submission routes, supporting multiple languages, and ensuring transparency in the system’s operation. Citing the CIA’s Tor site, MI6’s Silent Courier, and Germany’s BND SecureDrop, he also said that in his research he had not found any intelligence agency using a general-purpose office software’s survey feature as a tip line.

On August 4, the security research lab of security outlet Rocket Boys published an article narrowing the issue to data location. According to the article, Microsoft’s public materials show an example in which Forms used by a commercial Japanese tenant has customer data provisioned in the Americas; for many regions other than some areas such as the EU and EFTA, the default storage location is described as the United States. The outlet did not claim that using external SaaS or storing data overseas was automatically inappropriate or illegal. Instead, it argued that users are not told where the data is stored, whether it is transferred overseas, which parties process it, how long it is retained, or how it is deleted—even though the form includes fields such as address, age, and occupation, as well as a free-text field where sensitive information may be entered. It characterized the issue as one of design and accountability for disclosures, not as a data leak or unauthorized access.

5. Sankei Report and the National Intelligence Bureau’s Response

The controversy was reported in South Korea on October 9, when Yonhap News relayed a report by Sankei Shimbun. Sankei reported that the National Intelligence Bureau used a Microsoft system as a channel for receiving tips about espionage and other activities, raising concerns about violations of information sovereignty and leaks of confidential information. It cited the U.S. CLOUD Act, enacted in 2018. The law allows U.S. authorities to access information held by major U.S. technology companies on servers at home or abroad if they determine that there are security-related grounds, such as risks of terrorism or cybercrime. The law’s origins are said to lie in a 2013 case in which U.S. investigators obtained a warrant for emails in an MS account as part of a drug investigation, but Microsoft refused to hand over data stored on a server in Ireland.

Sankei wrote that, while Europe and other regions were reducing their reliance on U.S. IT companies in the name of information sovereignty, Japan’s storage of sensitive information such as espionage tips on Microsoft servers was concerning. Asked about the issue, a National Intelligence Bureau official responded, “We do not think using an overseas service is automatically a problem.” Nothing in the reported coverage indicates that the official provided specific details about the storage location or contract terms.

6. Authenticity Debate

The central issue is whether receiving national security tips through a foreign company’s general-purpose survey service falls within the ordinary use of cloud services, or whether it undermines the very purpose of a tip line: protecting those who submit information. No reports have confirmed that the form was hacked or that information was actually leaked, so the debate is limited to questions of design and disclosure.

6.1. The View That There Is No Problem

This position starts from the view that using external SaaS should not be treated as inherently wrong. As Rocket Boys also noted, the use of cloud services, including Microsoft 365, is already commonplace among government agencies, and overseas storage is not automatically illegal. It is standard practice to manage risk in cloud services through a combination of contractual terms, data-processing conditions, access controls, audit logs, and encryption. It is also possible that the government has a separate agreement with Microsoft. The fact that such measures are not visible to users does not necessarily mean that no safeguards exist.

The form itself also includes some basic safeguards. It states that names and email addresses are not automatically collected, and the official said that using an overseas service is not in itself a problem. Since no leak or unauthorized-access incident has been reported so far, the counterargument is that it is excessive to distrust the tip line based only on what might happen.

6.2. The View That It Is Unsuitable as a Tip Line

The opposing side questions the nature of the channel. Tips about espionage, contact with foreign powers, or the internal affairs of companies and research institutions could put tipsters at risk if exposed. If encryption is decrypted on the provider’s servers, the provider retains IP addresses and connection times, and connection records may also remain on workplace networks, then anonymity cannot be considered structurally guaranteed. The existence of the U.S. CLOUD Act and the 2023 intrusion that exploited a Microsoft signing key further heighten concerns about reliance on a foreign provider’s infrastructure.

There is also the issue of authenticity. Anyone can create a Microsoft Form, creating a contradiction in which the government tells people to “beware of domains other than go.jp” while directing tipsters to an address for a private service. If a fake form is created, tipsters’ identities and submissions could be handed directly to hostile forces. The gap is also considerable compared with examples from other countries. The CIA operates a Tor site, MI6 launched Silent Courier in 2025, the BND uses SecureDrop, and MI5 uses its own form on the government portal GOV.UK. These comparisons appear in both Tōru Kageyama’s and Rocket Boys’ articles; Kageyama said he could not find any cases of a general-purpose survey feature being used as a dedicated tip line. Given all this, the argument goes, can it really be considered an adequate design to mark the most important field—the “third blank”—as required without telling users where the information will be stored?

At present, there is insufficient information to determine the extent of the actual risk. The Japanese government has not explained the terms of its contract with Microsoft or the location where the data is stored.

7. Trivia

• An FM Korea post introduced a screenshot of the form with the caption “The tip line is Microsoft Forms lol,” and included a comparison with the South Korean National Intelligence Service’s tip page. The screenshot showed a two-step process requiring identity verification by mobile phone or I-PIN. This contrasts with the Japanese form’s notice that names and email addresses are not automatically collected.
• According to an article also introduced by Togetter, when the bill to establish the National Intelligence Bureau was under discussion, some people noted that its English name, National Intelligence Agency of Japan, would make the acronym NINJA.
• Lernen, one of the accounts that posted early in the controversy, mistakenly called Microsoft Forms “Google Forms” before correcting the post.