Tokyo Rail Surveillance Cameras: Privacy & Security Report

Introduction

Look up the next time you ride a Tokyu train. Some of the ceiling lights are not just lights. A few of those LED tubes have a small camera module at one end, with a memory card and a 4G modem in the same housing. Newer versions of the device add a microphone, a speaker and a handful of other sensors. The device is called IoTube, it was made by a Tokyo company named MOYAI, and it is one of the reasons a large share of Tokyo-area commuters are now on camera on the way to work.

In about a decade, in-car cameras have become standard on many Tokyo-area lines. JR East had them in all of its roughly 8,500 Tokyo-area conventional cars by March 2019 and all of its roughly 1,300 Shinkansen cars by October 2021 [5]. Tokyu finished fitting IoTube to all 1,247 of its cars, apart from the Kodomonokuni line, in July 2020 [19]. Since October 2023, a transport-ministry rule has required cameras in new cars on busy lines [10].

This article looks at what those cameras can actually do, how AI is being added to them, whether they belong in the same category as the Flock license-plate cameras, a heavily contested surveillance technology in the United States, what Japanese law allows, and how exposed they are to attackers. My argument is simple. The hardware can do more than railways say they use it for. Japan already tried identity tracking in stations and backed away from it. And the larger security exposure is likely everything behind the lens: the mobile network, the cloud dashboards and the staff apps.

One caveat up front. Neither MOYAI nor the railways publish details of how their systems are secured, so the security section works from product specs and from what is known about connected cameras generally. It does not describe any known flaw in these particular devices.

Who Runs Which Cameras

There is no single "Tokyo subway camera." Every railway buys its own system, and since trains constantly run through from one company's tracks onto another's, a single commute can take you past several of them.

The light-tube camera is mostly a Tokyu story. Tokyu announced in 2019 that it would put IoTube, sold with SoftBank's 4G data service, in every car by July 2020, usually four per car and two or three on its smaller lines. Video goes out over 4G; Tokyu says it does not use Wi-Fi for these units [1]. Because Tokyu cars run through onto Tokyo Metro and other companies' lines, and the cameras keep recording there [9], plenty of people who think of themselves as subway riders have been filmed by one. Keio followed in 2022, fitting every car with the ceiling-unit version of the second-generation IoTube Pro.4G, which separates the camera from the light tube [12]. Keikyu came later with the IoTube Pro.4G, supplied through NTT Communications as "THEASIGHT for IoTube." All 790 of its cars are due to have one by March 2027, with live viewing from the ground and AI analysis built in [2].

The subway operators went more conventional. Tokyo Metro announced in 2017 that it would mount cameras above the doors of every car, starting in fiscal 2018, and did not name a supplier. It said only designated staff could watch recordings and that footage would be managed in cooperation with police and the railways that run through onto its lines [3]. In 2021 it said in-car cameras were still being added as new cars arrived and older ones were refurbished [22]. Toei announced ceiling cameras for all its cars at the same time, to be fitted as cars were renewed [4]. JR East has finished every Tokyo-area conventional car and every Shinkansen car, and Shinkansen control centers can watch car video live on most trains [5]. It planned to trial the same live link on one Yamanote line train by the end of fiscal 2023, and in late 2024 said it was aiming to bring it to the Yamanote line from fiscal 2025 [5][63].

MOYAI, founded in 2018 and based in Tokyo's Minato ward, filed for bankruptcy in September 2026 [6]. One of its investors said in 2024 that IoTube had the most installations of any in-car camera among the major Tokyo-area railways [7], and MOYAI's own product page credits it with helping catch an arsonist and, citing one railway customer, with bringing both groping and false groping accusations down to zero [8]. Those are the companies' own claims.

Tokyu chose the light-tube design to install cameras faster and more cheaply [13]. IoTube drops into a standard fluorescent socket, so in most cars nobody has to run new cable, and at Tokyu's 2020 media briefing, installation cost was put at about a quarter of a conventional camera system [9]. Fitting a car took about 30 minutes, against two weeks of work per car for Tokyu's older wired cameras [19]. A camera built into a light tube is also less conspicuous than a typical dome camera, which matters legally, as the section on the law explains.

The government has since made cameras compulsory. After the 2021 knife attacks on Odakyu and Keio trains, the transport ministry changed its technical rules. Since October 2023, new cars on Shinkansen lines and on lines carrying 100,000 or more passengers per kilometer per day must have recording cameras. Live feeds to control rooms are optional because of the cost, and each railway decides how to run its own system [10].

What the Cameras Can See and Do

MOYAI's announcements for its newer IoTube Pro models list an 8-megapixel 4K sensor behind a fisheye lens, an SD card for recording, a 4G LTE modem with live streaming, and a quad-core 1.5 GHz chip meant for running AI on the device itself [11][12]. There is also a microphone and a speaker for two-way talk, which MOYAI counts among eight built-in sensors along with thermal, temperature and humidity, a 3D accelerometer, smoke, CO2 and a Bluetooth Low Energy beacon [11]. The older model it replaced had a 2-megapixel, 160-degree camera recording at 15 frames per second onto an SD card that looped over itself, and AI analysis was an optional add-on [13][14][15][16].

Railways have mostly not said which of these features they use.

The fisheye lens is the first thing worth thinking about. With a 4K wide-angle recording, an operator can crop and zoom into any corner of the car after the fact, so a face, a phone screen or a document might be readable on review even if nobody was watching live. Audio is the second. On models that have one, IoTube's microphone is described as being for two-way emergency calls [18], and at least one Japanese railway openly records sound: Hanshin's control room can listen to a car live, and it keeps video and audio for about a week [17]. None of the sources reviewed here says whether IoTube audio is recorded on Tokyo trains. The Bluetooth beacon is the third. Beacons like this are commonly used to detect nearby phones or push content to them. None says whether the beacons are switched on in trains.

Running AI on the device cuts both ways. It can mean less raw video ever leaves the car, and MOYAI has said on-device AI improves privacy [11]. It can also mean the system produces new kinds of data, like attribute guesses, head counts and automatic alerts, that didn't exist before. Access has changed too. Before IoTube, Tokyu staff had to pull the memory card and review it on a dedicated office PC. Now authorized users can watch live or recorded footage from wherever they are [1]. A later version built with NTT Docomo and ITOCHU Techno-Solutions added viewing and downloading on phones and tablets [18].

Tokyu's published privacy measures are stickers in the cars and internal rules limiting who can view recordings [19]. Tokyo's two subway operators said in 2017 that only designated staff would be able to view the footage [20][4], and an English-language news summary at the time reported that it would be kept for about a week and only checked when a problem was reported [21]. Keikyu's announcement does not give a retention period [2]. Tokyu said during its 2019 trial that footage was overwritten after about three days [15], and at the 2020 rollout that each unit's SD card holds 168 hours of video, about seven to ten days of service, before the oldest footage is overwritten [9][13].

Where AI Comes In

AI is already running on Tokyo rail cameras. For now it mostly looks for objects, crowds and hazards, not for who you are.

Tokyo Metro began using image recognition on station cameras in July 2021 to flag suspicious or dangerous objects, and said it would continue after the Games [22]. From October 2024 to January 2025, Odakyu ran footage from 20 existing cameras at two stations through a behavior-recognition system called AI Security asilla, which tried to spot people falling onto the tracks, wheelchair and white-cane users, people standing on platforms for a long time, trouble between passengers and suspicious objects [23]. In April 2026, JR East started using AI on the side cameras of some Sagami line trains to warn drivers on one-person services when someone is too close to the train [24][25]. Tokyo Metro and Mitsubishi Electric scheduled filming for a forward-facing obstacle-detection camera study on the Ginza line from about August to October 2026; Metro's notice says people on platforms may be filmed and that the data is encrypted and used only for the research, such as AI training [26].

Inside the cars, Keikyu says its IoTube units will eventually detect anomalies and measure crowding [2]. Tsukuba Express already does this for crowding. On October 7, 2026, its app started showing a six-level crowding score for each car, worked out by AI from the in-car security cameras with a five-minute lag [27]. That is a useful feature for riders. It is also security footage being put to a second job.

Several of these systems use behavior recognition. Asilla, for example, analyzes what people in the frame are doing and raises an alert when it detects a behavior it has been set to look for [23]. That approach looks at actions rather than identities, but which behaviors count as worth flagging is a judgment built into the system. Japan's Personal Information Protection Commission (PPC) has warned that registering people in a face-recognition watchlist for "suspicious" behavior can sweep in people whose movement looks different because of a disability [28].

The clearest example of security cameras being tested for a different purpose came from JR Central. It scheduled a test for January 10 to 16, 2026, in cars 1, 6 and 8 of N700S trains between Tokyo and Shin-Osaka, of whether its Tokaido Shinkansen in-car security cameras could be used for marketing. The cameras were to capture full-body images, faces included, and AI would extract clothing and belongings to estimate passengers' age, gender and reason for travelling. JR Central announced the test in advance and said passengers who avoided those cars would not be included, that the estimates would not identify anyone, and that the data would go to Mitsubishi Electric only for the test and be deleted afterwards [29][30]. Even with those limits, it shows footage from cameras installed for passenger safety being considered for another use. For context, the PPC's 2023 report says that extracting face data from ordinary security footage after the fact and matching or analyzing it is a use outside the original purpose, which generally needs consent or a legal exception [28].

The equipment makers have marketed the technology for more than security. NTT Docomo, ITOCHU Techno-Solutions and MOYAI launched their IoTube partnership explicitly for marketing, foot-traffic analysis and monitoring [31]. MOYAI's digital-signage product uses AI to estimate the number, age and gender of people walking past and choose content by time of day [32]. IoTube is the same product line installed in train cars. Which of its functions are used on trains is up to each railway.

JR East Tried Facial Recognition. It Didn't Last.

In July 2021, as part of security for the Tokyo Olympics, JR East switched on face-recognition cameras at some Tokyo-area stations. The system was built to pick out three kinds of people: wanted suspects; anyone staff flagged as suspicious, for example for loitering; and people who had served prison time for serious crimes committed on JR East property. The plan for that last group was to get release information from prosecutors through the victim-notification system and add the faces to a watchlist. If the cameras flagged someone, guards would approach and could ask to search their bags [33].

JR East had not told the public about the ex-offender category. When it came out in a September 2021 newspaper report, the company dropped it the same day [33][34] and said nobody had actually been registered [35].

The wanted-suspect part kept running for four more years. A guard checked each match by eye and called police if needed. The "suspicious person" category stayed in the plan, but JR East later said no one was ever registered under it [38]. The Japan Federation of Bar Associations asked for the system to be shut down [36]. JR East turned it off in July 2025; the shutdown became public in October 2025 when news outlets asked about it. JR East cited the end of a vendor contract and a review of how well the system worked, and said it had proceeded with advice from the PPC and the transport ministry [37][38]. It did not disclose which stations had it, how many cameras were involved, or whether any police reports came out of it [38].

After the ex-offender category came to light, Seijo University professor Makoto Ibusuki pointed out that Japan had no law regulating facial recognition in public spaces, and no national rules even for ordinary security cameras, only some local ones, and that face-recognition errors had already caused wrongful arrests overseas [34]. The 2026 privacy-law amendment discussed below creates Japan's first rules aimed specifically at face data of this kind [47]. Criticism also focused on disclosure: the public learned about the ex-offender category and its data source only from press reports [33][34], and when the system was shut down, JR East did not say what it had achieved [38].

Two different technologies often get lumped together here. Face identification scans everyone who walks past against a watchlist. Face authentication is when you choose to let a machine confirm you are you, like at an airport gate. The PPC's 2023 report deals with identification, and the 2026 amendment exempts face data collected with the person's consent from its new right to stop use [28][47]. JR East's newer work uses authentication. From November 2025 to March 2026 it tested opt-in face-scanning ticket gates at Niigata and Nagaoka Shinkansen stations with NEC and Panasonic Connect, with about 500 Shinkansen commuter-pass holders who signed up as volunteers. It wants walk-through gates within ten years [39][40]. Because people enroll themselves, this raises different issues from watchlist scanning, but it still means a database of face templates linked to Suica commuter passes, which would need strong protection.

Is This Japan's Version of Flock?

Not on the evidence available, and the reason has to do with how Flock works.

Flock Safety sells automatic license-plate readers to American police departments and private organizations [41][43]. According to Straight Arrow News's 2025 report, it ran more than 40,000 cameras in over 5,000 U.S. communities. Every car that passes is logged: plate, make, color, and sometimes details like bumper stickers, so officers can follow a vehicle's movements over time, often without a warrant [41]. The real problem is less any single camera than the shared, searchable network behind them, and the record so far shows why. Audit logs from public-records requests turned up more than 4,000 searches between June 2024 and May 2025 that listed immigration enforcement as the reason, many of them run by local and state police on informal requests from federal agents, even though Illinois law and Flock's own policy banned that use. Some departments said the label had been entered in error or that the searches were for criminal investigations, but the audit data show ICE was able to use the network indirectly through local and state police despite both the state ban and the company's policy [41][42]. In Washington State, researchers found Border Patrol had what looked like back-door access to the data of at least ten police departments that had never agreed to share with it [43]. In April 2026 the ACLU, the ACLU of Virginia and the Electronic Frontier Foundation filed a brief asking a federal appeals court to reverse a lower-court ruling and hold that these license-plate systems violate the Fourth Amendment [44].

Tokyo's train cameras capture more of each person than a plate reader does, but they lack the two things that make Flock a civil-liberties problem: a searchable identity index and a shared network. A license plate is already a unique ID a computer can read. A face in ordinary video isn't, until someone builds facial-recognition templates from it, and that is exactly the step JR East took in its stations and then abandoned. As far as anything public shows, each railway keeps its own footage for a short time and pulls it up when something happens. Police can obtain it on request, and the subway operators say footage is managed in cooperation with police and the railways that run through onto their lines [3][4]. Because trains run through, you can also be filmed by the cameras of a company you never bought a ticket from. Nothing in the sources reviewed here points to a pooled database that can be searched across railways.

Where the two do look alike is in how data drifts into new uses. Flock data ended up serving immigration enforcement despite the rules. JR Central's security cameras were slated for a marketing test. The scale and stakes are very different, but in both cases data gathered for one purpose was put to, or considered for, another.

The closest Japanese counterpart to Flock is on the roads, not the rails. The police N-system is a network of plate readers at roughly 2,000 roadside sites that photographs every passing car and checks it against lists of wanted and stolen vehicles [45]. Police have told courts it records only plate numbers, not drivers' faces; critics such as media-law scholar Yasuhiko Tajima doubt that [45]. When the system was challenged in 2001, the Tokyo District Court upheld it but added a warning: if readers covered the road network and the data piled up, it could expose the details of people's private lives and become a real surveillance problem [28]. Two decades later, Japan's privacy regulator used the same reasoning about networked facial recognition, listing the ability to track one person across many places among its key risks [28]. Japanese courts and regulators have already described a concern similar to the one raised about Flock. Whether rail cameras ever move in that direction is an open question.

What the Law Allows

Japan's main privacy law, the Act on the Protection of Personal Information (APPI), treats video of an identifiable person as personal information. Facial data precise enough for software to match counts as an "individual identification code," which is also personal information [46].

That doesn't mean a railway needs your permission to film you. For an ordinary security camera, the purpose is considered obvious, so the operator doesn't have to publish it, though posting a notice that cameras are operating is described as desirable [46]. The PPC's 2023 report on face-recognition systems puts it more strongly: when a camera captures images that can identify a person, operators must make it easy to recognize that the camera is operating, for example with a sign, and tiny cameras, or cameras built into other equipment, can count as collecting data by deception if there's no clear notice [28]. A camera built into a light tube appears to fit that description, and IoTube cars carry stickers telling riders the car has security cameras [1][19].

The law also limits what happens to footage afterwards. According to the PPC, taking ordinary security footage and later extracting face data from it, or matching it against other databases, is a new use that needs consent or a legal exception. Police requests are one such exception. A warrant or a formal police inquiry counts as a request "based on laws," so the railway can hand footage over without asking you, though the PPC tells operators to check that they are not handing over information unrelated to the request. Article 23 requires safeguards for personal data such as a face database. Ordinary footage that isn't organized into a searchable database falls outside that duty, but the PPC says it should be protected the same way, and for networked cameras it specifically calls for access controls, leak prevention and monitoring of access logs [28].

Courts add another layer. Japanese case law, going back to Supreme Court rulings in 1969 and 2005, recognizes a right not to be photographed without good reason. When neighbors or customers have sued over security cameras, judges have weighed where the camera was, why it was there, how it filmed, whether it was needed and how the footage was handled. Factors that weighed in a camera's favor included being fixed in place, visible and signposted, keeping footage only for a limited time (retention in the cases the PPC reviewed ranged from 90 hours to 45 days), and limiting who could view it. In a 2015 Tokyo case, a court ordered cameras taken down partly because the owner had other ways to get the same result [28].

Facial recognition has gotten its own attention. In March 2023 a PPC expert panel, set up partly in response to attacks on trains and in stations, published guidance for using it in big public spaces like stations and airports. Operators should say publicly that face identification is in use and why, and put notices at entrances that point to fuller information. The watchlist should be limited by written criteria to people genuinely likely to commit the crimes in question. Everyone who doesn't match should be deleted promptly, a human should confirm every hit, and the AI should be checked for bias by gender or skin color, since discriminatory results could break the law's ban on improper use. The panel also wanted a privacy impact assessment and a trial run before any launch, and suggested big stations publish transparency reports on police requests [28].

Some of those expectations are now becoming law. An APPI amendment passed the Diet on July 10, 2026, and was promulgated a week later. It creates a new category, "specific biometric personal information," aimed at body features that can be collected cheaply without the person noticing, which in practice mostly means face templates pulled from camera footage [47]. Anyone handling that data will have to tell people who runs the system, that face data is being processed, for what purpose, which body features are used and how to request disclosure. Legal commentary on the new law says a plain "face recognition in use" sign is unlikely to be enough. The data can no longer be shared with third parties under Japan's opt-out route. And people get a new right to demand their face data stop being used, without having to prove anything was done wrong, with exceptions for things like legal requirements and protecting life or property. Ordinary video that is never turned into face templates, and crowd counting that doesn't try to identify anyone, stay under the old rules.

Both houses of the Diet added resolutions asking that notices go near the devices, and the upper house added that they should be where the people being scanned can actually see them. Most of the amendment takes effect within two years, and the PPC is writing the detailed rules now. During debate, critics pointed out a practical catch: to make an operator stop using your face data, you may first have to provide your face so it can be found [47]. One more rule is worth knowing. The transport ministry's 2023 requirement for recording cameras in new cars leaves the details to each railway [10]. As reported, it requires cameras that record; the coverage describes no requirements on how long footage is kept, whether it is encrypted, or whether AI can be run on it.

Could Someone Hack In?

None of the sources reviewed for this article reports a vulnerability or breach involving these cameras. That doesn't prove much, since none of the companies involved publish detailed security information. The old in-car camera was a sealed box: to see the footage, someone had to climb into the car and pull the card. The new ones are cellular IoT devices connected to cloud platforms and phone apps, and connected cameras are a frequent target of attacks, as the cases below show.

Start with the unit in the ceiling. It holds recent video (about a week's worth on Tokyu's units), its firmware and a SIM, so it can be stolen or tampered with, its memory card read if it isn't encrypted, or its firmware exploited if there's a bug. Encrypted storage, signed firmware updates and tamper detection are the usual answers. The 4G link carries video out of the car. The danger there is a device that ends up reachable from the open internet, or traffic that isn't properly encrypted; a private mobile network with no inbound connections largely solves that. Cloud platforms such as SoftBank's SecuLight and ITOCHU Techno-Solutions' THEASIGHT can store footage and manage devices for entire fleets [12][19], which makes them the most valuable target: one stolen login or one misconfigured setting could expose thousands of cameras at once. Multi-factor authentication, tight permissions and audit logs are the baseline defense. Then there are the viewing apps on staff laptops, phones and tablets, which can be lost or phished, and the outside AI companies, like Mitsubishi Electric in the JR Central and Tokyo Metro projects, that receive footage during trials. Each one widens the circle of people holding the data. On models with a microphone and speaker, there is also a two-way audio channel, which in the wrong hands could mean eavesdropping or a fake announcement.

Railways say little about the details. Tokyo Metro's notices about its AI trials state that data is encrypted at rest and in transit and only moves between secured devices [26]. Tokyu has said its IoTube cars don't use Wi-Fi, and Tokyu and its partners have said footage is encrypted on the SD card and when sent over 4G, and obfuscated so outsiders can't view it [9][14][19]. Tokyu has also said maintenance can be done remotely over the network [14]. None of these sources gives technical detail: which encryption is used, who holds the keys, how logins are protected, or how remote maintenance and firmware updates are secured. MOYAI's announcements cited here don't address those points either.

Japanese data on connected devices shows why those details matter. Under the government-backed NOTICE program, NICT scans IP addresses at participating internet providers for connected devices with guessable passwords, vulnerable firmware or existing infections. In April 2025 alone it flagged about 4,119 devices with high-risk firmware flaws, and up to 1,011 a day believed to be already infected with the Mirai botnet [48]. In 2023 NICT traced a burst of suspicious traffic to network cameras in the transport ministry's own public river-monitoring system. The same year it stumbled on a nursery school's parent camera feed that anyone could watch [49]. In late 2025, a Yomiuri Shimbun investigation found live feeds from Japanese network cameras turning up on foreign websites, in some cases because no password had been set, and the communications ministry warned camera owners to check their settings [50][51]. Outside Japan, a 2021 command-injection bug in Hikvision cameras was picked up by a Mirai-based botnet, and researchers still counted about 80,000 unpatched units online a year later [52]. In 2025, CISA disclosed a zero-day in Edimax cameras that several botnets were already using; the affected model was a legacy product likely past the end of vendor support [53]. The communications ministry's warning tells camera owners to check that product support is continuing [51]. MOYAI's bankruptcy raises that question for IoTube. Tokyu's SoftBank service includes maintenance and operation [19], but the device itself was developed by MOYAI [1], and the bankruptcy report does not say who will support units already installed [6].

So what would an attack on Tokyo's train cameras most likely look like? Probably not a clever exploit against the camera. The easier path is a phished staff account or a misconfigured cloud dashboard, either of which could expose a whole fleet's footage. If any unit were directly reachable from the internet with a known firmware bug, automated botnet scanners would find it, though devices on a private cellular network are generally much harder to reach than a home webcam. The most serious scenario is a targeted one: an insider, or an intruder with a stolen login, using the viewing tools to learn one commuter's routine. That's why limits on who can watch footage, and records of who did, matter as much as encryption.

Putting the evidence together, the risks to these cameras are mostly potential rather than demonstrated. None of the sources reviewed here reports a vulnerability or breach involving them. Tokyu's units do not use Wi-Fi, encrypt footage on the card and in transit, and let the operator set viewing permissions per user [1][9][14][19], and Tokyo Metro says its AI-trial data is encrypted and moves only between secured devices [26]. Those measures cover part of what the PPC recommends for networked cameras, namely access control and protection against leaks; the transport ministry's railway guideline asks operators to keep authentication logs for their systems in general [55], but none of the sources reviewed here says whether the railways monitor access to camera footage this way, the other item on the PPC's list [28]. The retention periods railways have published, about a week, sit toward the short end of the 90-hour to 45-day range in the court cases the PPC reviewed [13][17][21][28]. What remains open is what hasn't been disclosed: how the encryption and logins work, how long copies saved to the cloud are kept, whether IoTube audio is recorded or its beacons are on, and who will maintain IoTube's firmware after MOYAI's bankruptcy.

What about stopping the trains? That looks like the least likely outcome. Japan's rail cybersecurity framework designates train operation management, seat reservations and power management as the critical systems, and train control runs on closed networks of dedicated equipment [54]; in-car security cameras are not among the designated systems. The transport ministry's guideline summary addresses security cameras directly. It lists their spread as one reason railway networks are growing, says a loss of integrity or availability of security cameras is thought to rarely lead directly to a railway accident, and warns that such an attack could be carried out as part of terrorism or crime combined with a physical attack, a new risk it says needs watching [55]. Short of that kind of combined attack, a compromised camera network would mainly be a privacy problem and a possible foothold, unless a railway has made the mistake of putting it on the same network as something that matters more.

What the Government Requires

Railways count as critical infrastructure in Japan, so they sit under a stack of cybersecurity rules. None of the documents reviewed for this article mentions in-car cameras specifically, though the transport ministry's guideline summary addresses security cameras in general, as described above.

The most relevant is the transport ministry's cybersecurity guideline for railways, whose sixth edition came out on April 22, 2026. It covers governance, risk management, supply-chain security, monitoring, backup plans for IT failures and regular drills. The main change in the new edition concerns connected devices: railways buying IoT equipment needed to deliver critical services are now asked to make the JC-STAR security label one of their selection criteria [55]. The published summary doesn't say whether in-car cameras count as such equipment. Otherwise, camera systems and their cloud providers fall under the supply-chain and monitoring parts, the same as any other railway IT. In May 2026 the ministry also brought companies and officials together to talk about transport cybersecurity in an era of much more capable AI [56].

Bigger changes are coming from Japan's new "active cyber defense" laws, passed on May 16, 2025. A National Cybersecurity Office opened in July 2025 to run the new system, and most of the laws are due to take effect by late 2026 [57]. About 257 companies in 15 sectors, rail among them, will have to notify the government when they introduce designated critical computer systems and report serious incidents, and the government can share vulnerability information with the makers of affected products and ask them to take protective measures [58][59]. Train cameras will probably only be covered if they're connected to systems whose failure could disrupt service.

The programs that deal with cameras directly are voluntary. NOTICE, run by the communications ministry, NICT and internet providers, widened its scans in April 2024 from weak passwords to vulnerable firmware and active malware, and warns owners through their providers [60]. It would only catch a train camera if its address belonged to a participating provider. Japan's JC-STAR security label for connected devices has been running since March 2025, and the Tokyo Metropolitan Government now points to it in guidance for its camera subsidies [61]. Beyond the transport ministry's non-binding guideline, though, nothing requires railways to use it. The IPA also publishes a security checklist for network camera systems that could serve as a benchmark for vendors like MOYAI [62]. So far, according to the Railway Technical Research Institute, cyberattacks on Japanese railways have hit office systems and websites, not train operations [54].

Where This Is Heading

More cameras, more live feeds, more AI. Live in-car video is moving from the Shinkansen onto the Yamanote line, and every Keikyu car is scheduled to have it by March 2027. In-car crowding estimates are already here, and Keikyu plans anomaly detection. JR East is looking at expanding its opt-in face gates to more passengers and to the Tokyo area [39], and it is rolling out one-person operation on major Tokyo lines with camera systems to help drivers [63]. The newest IoTube already has edge AI, thermal sensing and beacons built in [11], and MOYAI has said it was looking at 5G and Wi-Fi 6 [64]. On the legal side, the PPC is writing the detailed rules for face data, and most of the amendment is due to take effect by mid-2028 [47].

The big question is whether facial recognition comes back to Japan's railways now that there is a legal framework for it, this time with signs, disclosure and a right to have its use stopped.

In the meantime, a lot of basic facts are still unknown. Is IoTube audio recorded, and who can listen live? Are the Bluetooth beacons switched on in train cars? How long does Keikyu keep footage, and how long do clips saved to the cloud stay there? How is footage encrypted, who holds the keys, and where is that cloud? Which AI features are active, and which companies run them? How many police requests do the railways get each year? Has anyone outside the companies ever tested these systems for security holes? Railways can be asked all of these questions directly. Under the APPI, people can also ask a business to disclose personal data it holds about them, though ordinary footage that isn't organized into a searchable database may fall outside that right [28]. How a railway handles that request, and how long it takes, says a lot about whether Japan's privacy protections work outside the statute book.

Compared with Flock's searchable national network, Tokyo's train surveillance, on what is public, is still fragmented, short-lived and mostly used after something goes wrong. Japanese courts and regulators have already set limits on cameras and warned about tracking, and groups such as the bar federation have pushed back where cameras moved toward identifying individuals. At the same time, the hardware in the ceiling can do more than railways say they use it for, the companies behind it have marketed it for analytics as well as security, and putting cameras on cellular networks has turned a privacy question into a security question too. What railways choose to switch on, and how much they disclose, will shape where this goes.

References

1. SoftBank Corp. and Tokyu Corporation. "Tokyu to Install 4G-Enabled LED Tube Security Cameras in All Cars by July 2020." November 2019. softbank.jp
2. Keikyu Corporation. "Introduction of In-Car Security Camera System." 2023. digitalpr.jp
3. Trafficnews. "Tokyo Metro to Install Security Cameras Above Doors in All Cars." March 2017. trafficnews.jp
4. Tokyo Metropolitan Bureau of Transportation (Toei). "Security Cameras to Be Installed Inside All Toei Subway Cars." March 2017. kotsu.metro.tokyo.jp
5. JR East. "Initiatives to Improve In-Train Security." October 2023. jreast.co.jp
6. Tokyo Shoko Research (TSR). "MOYAI (Tokyo), Developer of Security Cameras, Placed in Bankruptcy Proceedings." October 2026. tsr-net.co.jp
7. JA Mitsui Leasing. "Investment in MOYAI, Provider of AI Camera Solutions via IoTube." February 2024. kyodonewsprwire.jp
8. MOYAI Inc. "IoT Sensing & AI" (IoTube product page). moyai-net.com
9. Tetsudo Channel. Tokyu IoTube media briefing. July 2020. tetsudo-ch.com
10. JIJI Press (via Arab News Japan). "Security Cameras Become Mandatory for New Trains in Japan." October 2023. arabnews.jp
11. MOYAI Inc. (via PR TIMES). "MOYAI Develops Edge AI for Real-Time Monitoring of Railway Cars: Strengthening Rail Security and Safety with IoTube x AI." November 2021. prtimes.jp
12. MOYAI Inc. (via PR TIMES). "MOYAI Supplies Keio Corporation with Security Cameras Using 4G/LTE." October 2022. prtimes.jp
13. Mynavi News. "Tokyu Completes Installation of 'IoTube' LED Tube Security Cameras in All Cars." July 2020. news.mynavi.jp
14. Mobile Computing Promotion Consortium (MCPC). MCPC Award 2021 Excellence Award case study: MOYAI and SoftBank, "IoTube"/"SecuLight." March 2021. mcpc-jp.org
15. SoftBank Corp. and Tokyu Corporation. "Tokyu and SoftBank Begin Railway-Industry-First Trial of 4G LED Tube Security Cameras on the Oimachi Line." May 2019. softbank.jp
16. MOYAI Inc. (via IPROS). Product listing: Network Camera "IoTube." ipros.com
17. Hanshin Electric Railway. "Installation of In-Car Security Cameras." July 2023. hanshin.co.jp
18. Impress Cloud Watch. "NTT Docomo, CTC and MOYAI to Offer Wiring-Free IoT Camera Solution." November 2021. cloud.watch.impress.co.jp
19. Tokyu Corporation. "Railway-Industry First: LED Tube Security Cameras with SoftBank 4G Data Service Installed in All Tokyu Cars." July 2020. tokyu.co.jp
20. Tokyo Metro. "Promoting the Installation of Security Cameras in All Tokyo Metro Cars" (release attachment). March 2017. tokyometro.jp
21. RareJob (English-learning news summary). "Security Cameras to Be Installed in Tokyo Subway Cars." May 2017. rarejob.com
22. Tokyo Metro. Tokyo Metro News Letter No. 85, "Efforts Toward the Tokyo 2020 Olympic and Paralympic Games, Vol. 4: Security." July 2021. tokyometro.jp
23. Impress Watch. "Odakyu Applies Behaviour-Recognition AI to Station Camera Footage." October 2024. watch.impress.co.jp
24. JR East. "Introducing a System to Detect Passengers Approaching Trains." November 2025. jreast.co.jp
25. Seibu Railway and JR East. "Seibu Railway Introduces a System to Detect Passengers Approaching Trains Through Technical Cooperation with JR East." April 2026. jreast.co.jp
26. Tokyo Metro. "Acquisition and Analysis of Data from Forward-Monitoring Cameras." July 2026. tokyometro.jp
27. Impress Watch. "TX App Shows Per-Car Crowding Using AI Analysis of In-Car Security Cameras." October 2026. watch.impress.co.jp
28. Personal Information Protection Commission (PPC). Report of the Expert Panel on the Use of Camera Images for Crime Prevention and Safety. March 2023. ppc.go.jp
29. JR Central. "On Conducting a Test Using Tokaido Shinkansen In-Car Security Cameras to Improve Convenience and Comfort." December 2025. jr-central.co.jp
30. AIsmiley. "JR Central Begins Verifying Use of AI with Shinkansen In-Car Security Cameras." December 2025. aismiley.co.jp
31. NTT Docomo. "Docomo, CTC and MOYAI Begin Collaboration on Wiring-Free IoT Camera Solution." November 2021. docomo.ne.jp
32. MOYAI Inc. "Digital Media" (INFODIA digital signage with edge-AI analysis of passers-by). moyai-net.com
33. Bengo4.com. Interview on JR East's facial-recognition cameras. September 2021. bengo4.com
34. President Online. Ibusuki Makoto on JR East's facial-recognition system. 2021. president.jp
35. JIJI Press. "JR East Drops Detection of Released Prisoners by Security Cameras After Being Told It Was Inappropriate." September 2021. jiji.com (archived copy)
36. Japan Federation of Bar Associations (JFBA). "President's Statement Calling on Railway Operators to Stop Using Facial Recognition Systems." November 2021. nichibenren.or.jp
37. TBS NEWS DIG. "JR East Stops Operating Face-Recognition Security Cameras Introduced for the Tokyo Olympics." October 2025. newsdig.tbs.co.jp
38. Sakigake Shimpo / Kyodo News. "JR East Stops Face-Recognition Cameras at Stations Meant to Detect Wanted Suspects." October 2025. sakigake.jp (archived copy)
39. Newswitch. "JR East Trials Walk-Through Face-Authentication Gates." April 2025. newswitch.jp
40. Payment Navi. "Why JR East Is Testing Face-Authentication Gates at Niigata and Nagaoka." November 2025. paymentnavi.com
41. Straight Arrow News (reporting by 404 Media). "ICE Illegally Gains Informal Access to Nationwide License Plate Camera Network." May 2025. san.com
42. Atlanta Press Collective. "Flock Safety's License Plate Readers Used for Immigration Enforcement by Metro Atlanta Police Departments." June 2025. atlpresscollective.com
43. University of Washington Center for Human Rights. "Leaving the Door Wide Open: Flock Surveillance Systems Expose Washington Data to Immigration Enforcement." October 2025. jsis.washington.edu
44. American Civil Liberties Union (ACLU). "Schmidt v. Norfolk" (case page and amicus brief, U.S. Court of Appeals for the Fourth Circuit, No. 26-1227). April 2026. aclu.org
45. Best Car Web. "Is the N-System Legal?" bestcarweb.jp
46. Nishimura & Asahi. Data Protection Newsletter on camera images and the APPI. May 2022. nishimura.com
47. Business Lawyers. "What Is Specific Biometric Personal Information?" September 2026. businesslawyers.jp
48. National Institute of Information and Communications Technology (NICT). "Security Status of IoT Devices Seen Through IoT Device Surveys." Presentation to the Information and Communications Council, June 2025. soumu.go.jp
49. Toyo Keizai Online. Tsubata Takehiro (NICT), "Even Nursery School Security Cameras Have Leaked Footage: Network Cameras at Offices and Homes Are Being Hijacked." December 2025. toyokeizai.net
50. The Yomiuri Shimbun (via Asia News Network). "Security Camera Live Footage from Japan Leaked to Overseas Websites." November 2025. asianews.network
51. Ministry of Internal Affairs and Communications (MIC). "Caution on Network Camera Security Settings: To Camera Administrators." December 2025. soumu.go.jp
52. CYFIRMA. "Over 80,000 Hikvision Cameras Exposed Online." August 2022. cyfirma.com
53. SecurityWeek. "Edimax Camera Zero-Day Disclosed by CISA Exploited by Botnets." March 2025. securityweek.com
54. Railway Technical Research Institute (Kawasaki Kunihiro). "Cyber Threats and Countermeasure Approaches for Railway Operation Control Systems." Presentation at the IEEJ Power and Energy Society Conference, 2025. iee.jp
55. Ministry of Land, Infrastructure, Transport and Tourism (MLIT). Safety Guideline for Information Security in the Railway Sector, 6th Edition (Summary). April 2026. mlit.go.jp
56. MLIT. Cybersecurity policy page. 2026. mlit.go.jp
57. Splunk Japan. "Preparing for Active Cyber Defense." splunk.com
58. PwC Japan. "Legislating the Security Clearance System and How Japanese Companies Should Respond, Part 5: What the Active Cyber Defense Laws Require of Core Infrastructure Operators." October 2025. pwc.com
59. Business Lawyers. "Overview of the Active Cyber Defense Laws and Their Impact on Private Companies." May 2025. businesslawyers.jp
60. Business Network. "MIC, NICT and ICT-ISAC Launch New NOTICE." April 2024. businessnetwork.jp
61. Minato City. "Information Security for Security Cameras" (notice by the Tokyo Metropolitan Government, posted with the ward's security camera subsidy guidance; covers JC-STAR). April 2026. city.minato.tokyo.jp
62. Information-technology Promotion Agency (IPA). Security Requirements Checklist for Network Camera Systems. ipa.go.jp
63. JR East. "Safety and Transport Stability Measures for One-Person Operation on Major Tokyo-Area Lines." November 2024. jreast.co.jp
64. Impress K-tai Watch. "Docomo Partners with CTC and MOYAI." November 2021. k-tai.watch.impress.co.jp