June 20, 2023
JAKARTA – We cannot overstate the severity of the allegations by whistleblower group Indoleaks that the government may have illegally used spyware to snoop on its own citizens.
It is not unusual for modern states to have surveillance tools for security purposes. Technology is making the world smaller, and new cybersecurity threats are emerging on a daily basis, posing new security challenges. It is imperative that the state has the technology to meet these challenges.
That, however, does not give the government carte blanche to encroach on our privacy. We must have clear rules governing the use of surveillance technologies, which have become increasingly sophisticated and powerful, making them even more prone to abuse.
The Indoleaks report is hardly surprising. Toronto-based digital security think tank CitizenLab previously accused the government of using a spyware program called FinFisher to snoop on its citizens in 2016. The spyware, produced by Lench IT Solutions, was commonly used by repressive regimes.
The National Crypto Institute (Lemsaneg), which was expanded into the National Cyber and Crypto Agency (BSSN) in 2017, was a client of that spyware, according to CitizenLab. The agency used an Australian server to disguise its surveillance operations in Indonesia.
Beyond FinFisher, Indonesia is accused of using two other powerful spyware programs: Predator and Circles.
A CitizenLab report indicated that a server believed to a Circles client belonged to PT Radika Karya Utama, a technology company that won at least two contracts to procure “zero-click intrusion systems” for the National Police. The police, according to the IndoLeaks report, claim to have used zero-click technology for security purposes but have refused to confirm whether they have used spyware such as Predator, Circles or Pegasus.
IndoLeaks suspects that Pegasus, a potent zero-click spyware produced by the notorious NSO Group, has been used by the state apparatus since at least 2018. It has found evidence of a potential shipment of network equipment from Q Cyber Technologies, the parent company of NSO, to Indonesia via London, to corroborate its suspicion.
The NSO Group and other global spyware companies claim they sell their products only to government agencies and strictly for security and public safety purposes. However, human rights organizations have found that such spyware has been used by repressive governments to track activists, journalists and opposition groups to suppress critical voices.
House of Representatives security commission member Effendi Simbolon told Tempo in 2020 that the state used Pegasus to hunt for terrorist groups during Operation Tinombala in Poso, Central Sulawesi, in 2016. Israeli news outlet Haaretz also reported in 2018 that Pegasus was being used in Indonesia for the surveillance of lesbian, gay, bisexual, transgender and queer (LGBTQ) groups.
It is deeply concerning to see how Indonesian democracy has been breaking down over the last few years. The latest revelation by IndoLeaks shows that our law enforcement agencies, which are not immune to political interests or oligarchic co-optation, continue to increase their capacity to spy on citizens.
We demand full transparency from the government on whether and to what extent spyware has been used, lawfully or otherwise. The key question that arises from the IndoLeaks revelation is whether our civil rights have been trampled upon, not to mention the danger that these tools will be used in attempts to sway the 2024 election.
We are calling on policymakers to rigorously and transparently regulate the use of these powerful programs to prevent abuses and to audit the companies that are granted contracts to use them. Spyware technology will only grow in sophistication, which is why strong regulation needs to be in place now.
If not, we are leaving ourselves open to dystopia.