A ransomware attack on Indonesia’s National Data Centre (PDN = Pusat Data Nasional) reveals significant vulnerabilities in Indonesia’s digital security. The attacks influenced more than 200 government institutions including the immigration systems and education sectors. It encountered bottlenecks in the checkpoints and disrupted student enrolment.
Unfortunately, the bulk of data has not been backed up yet. However, the government estimates that full restoration will be completed by the end of 2024. This long maintenance calls the need to improve infrastructures and resources.
According to the MIT Technology Review which examines four categories -critical infrastructure, cybersecurity resources, organizational capacity, and policy commitment-, Indonesia was the last ranking among the world’s 20 largest in the Cyber Defense Index 2022/2023.
The Weakness of the Indonesian Government in Digital Data Protection
The government websites well known have weak digital data protection, therefore Teguh, ethical hacker, mentions that children who learn to hack often use government websites as their testing ground.
The weakness of these websites can be seen in the last three years. Numerous government websites have detected “intrusions.” From early 2022 to February 2023, the Director-General of Informatics Applications at the Ministry of Communication and Information Technology (Ditjen APTIKA Kominfo), Samuel Abrijani, stated that 683 government websites had been infiltrated by online gambling. Of these, 461 were affiliated with the go.id domain and 222 with the ac.id domain. These numbers have increased over time.
By September 6, 2023, gambling content had infiltrated 9,052 government websites, meaning that in approximately six months, 8,369 sites were hacked. Additionally, a hacker named Bjorka caused significant concern for the Indonesian government by successfully breaching government data, including 150 million Indonesian population data, 1.3 billion SIM card users, and secret letters from the State Intelligence Agency (BIN) to President Jokowi.
In 2024, Kominfo urged government agencies to migrate to the National Semesta Data Center (PDNS), which is envisioned as Indonesia’s cybersecurity cornerstone. Unfortunately, the migration of government websites to PDNS has not been accompanied by adequate digital security preparedness.
Consequently, the integrated data becomes an easy target for hackers seeking significant gains. These hackers see a jackpot potential in the Indonesian government’s negligence. This situation also indicates that the IT human resources, particularly those related to cybersecurity responsible for securing government websites, are of low quality.
There are three motives behind the hacking of government websites:
Firstly, economic motives: hackers seek to gain financial benefit through ransom from the government. In the case of PDN, the hacker requires an amount of around AUD12.3 million. Although the government refuses to pay and focuses on maintenance of the systems.
Secondly, educational motives: due to the perceived weaknesses of government websites, IT learners exploit them for experimentation. Although it is worth noting that hacking government websites is never justified, it would be better if they informed the cybersecurity staff about the vulnerabilities and ways to enhance security. The responsible government should also be open to accepting such feedback.
Thirdly, political motives: the prevalence of gambling sites indicates that hackers aim to damage the government’s reputation through its websites.
Comprehensive Approach to Secure Digital Data
To address these issues, the government must take a comprehensive approach for three reasons. Firstly, the government must regain access to PDNS. Secondly, the government must enhance IT human resources, particularly those skilled in cybersecurity. Thirdly, the government should develop alternative strategies for data storage and management backups.
The government can take several steps: conducting thorough security audits of the PDNS system, providing cybersecurity training to IT staff at both central and regional levels, improving cybersecurity-related infrastructure, both software and hardware, regularly updating data security systems with the latest security measures, establishing policies for data breach mitigation plans (this policy should be implemented across all government domains), and collaborating with external parties to enhance data security.
The Flaw of Implementing PDP Law
Despite the need of the Indonesian government to take necessary measures to secure their digital security, the PDNS systems also reveal the weakness of Indonesian digital security regulations. In 2022, Indonesia passed the Personal Data Protection (PDP) Law. Under this law, the government can impose sanctions on companies which fail to protect their customers’ data. However, the government itself is the actor who cannot protect the personal data of its citizens.
The Call of Digital Literacy
In doing so, each citizen also needs to understand how to protect their personal data. Indonesia Digital Literacy Report 2022 revealed that only half of the respondents illustrated as having a good literacy in personal data protection. This depicts that overall Indonesians still lack understanding of private data protection.
This situation reinforces the government to advance the resources and infrastructure in digital protection while improving citizen’s awareness to protect their own personal data. By doing this, the Indonesian government might have a good start to implement the PDP Law, otherwise, the government might end up being a hackers testing ground.
Authors:
Ramita Paraswati (Alumni, Master of Political Science, Universitas Islam Internasional Indonesia ; Founder, Indonesia, Women, Peace, and Security Centre)
Amsa Nadzifah (Master of Development Studies, University of Melbourne; Founder of Yayasan Literasi Desa Tumbuh)