The revision of the Law on the Indonesian National Police (National Police Bill) poses a significant threat to the respect, protection, and fulfillment of digital rights in Indonesia. We believe that the expansion of police authority in the digital space severely endangers the right to privacy, the right to access information, and freedom of expression.
The latest draft of this bill is heavily influenced by securitization, which is even more dangerous than Law No. 1 of 2024 on Electronic Information and Transactions (ITE Law). Notably, the ITE Law has already been criticized for massive digital rights violations since it was first enacted in 2008. These violations include the criminalization of activists and journalists who voice their opinions on social media, the revictimization of online gender-based violence (OGBV) victims, censorship of critical content and websites, and internet shutdowns in Papua.
Our skepticism toward the police institution is well-founded and substantiated. Although Indonesian citizens have human rights safeguards enshrined in the constitution, several laws, and police regulations, in practice, the police frequently violate human rights. Throughout 2023, the National Human Rights Commission (Komnas HAM) received 771 complaints of human rights violations by the police, making it the leading agency in terms of reported violations.
One example occurred in 2022 when Benni Eduward Hasibuan, an anti-corruption activist from Medan who actively posted content on YouTube, was arrested by the police following a complaint by a police officer using the ITE Law. During the investigation, Benni received threats and intimidation from the police. After being detained, the police allegedly allowed violence by other detainees against Benni. There are even indications that the police ordered the detainees to assault Benni.
This track record is further evident from the lack of transparency and accountability in police actions restricting freedom of expression, the right to information, and privacy. Various restrictions are also implemented without the three-part test (legality, legitimate aim, and necessity- proportionality). The frequent disregard for human rights by the police could worsen with the presence of four articles that expand police authority.
Internet Shutdowns and Throttling
The National Police Bill grants the state the authority to shutdown and throttle internet access. Article 16 paragraph 1(q) states that the police have the authority to: “conduct actions, blocking or shutdown, and throttling access to cyberspace for national security purposes.” This provision is hazardous because such actions violate the principles of proportionality and necessity required in human rights restrictions, including freedom of expression and the right to information.
The police have coordinated with the government to execute massive internet shutdowns and throttling in Papua from August to September 2019. The police claimed that these actions were taken to maintain security and prevent the spread of disinformation that could incite protests in Papua, allowing the public to access valid information. The government stated that the internet shutdowns were based on Article 40 paragraph 2(b) of Law No. 19 of 2016 on Electronic Information and Transactions (Second ITE Law), which reads:
“…the government has the authority to terminate access and/or order Electronic System Operators to terminate access to Electronic Information and/or Electronic Documents containing unlawful content.”
This government action was subsequently challenged by civil society in the State Administrative Court (PTUN). In June 2020, the court ruled that President Joko Widodo and the Minister of Communication and Information had committed an unlawful act. According to the judge, the phrase “terminate access” did not grant the government the authority to carry out total internet shutdowns and throttling. The judge ordered them to cease and refrain from repeating internet throttling and shutdowns across Indonesia.
The phrase “terminating access” was further narrowed in interpretation in Law No. 1 of 2024 (Third ITE Law). In the explanation section of Article 40 paragraph 2(b), it is added:
“The term ‘terminating access’ means blocking access, closing accounts, and/or deleting content. This includes ‘terminating access’ by blocking social media accounts.”
Therefore, it is clear that no current laws or regulations in Indonesia grant the state the authority to shutdown or throttle internet access. The multifaceted phrase “terminating access” in the ITE Law has been narrowed and can no longer be interpreted as internet shutdown.
The only regulation that can be used to justify internet shutdowns is Government Regulation in Lieu of Law (Perppu) No. 23/1959 on the Declaration of Emergency, which allows the “Civil Emergency Authority” to “…terminate the transmission of news or conversations via telephone or radio.” However, this regulation is outdated and would be difficult to apply, as a state of emergency must be directly declared by the president based on specific indicators.
Despite this, monitoring by SAFEnet using the Internet Outage Detection and Analysis (IODA) tool showed that there were still 63 internet disruptions in Papua in 2023. Although the government did not acknowledge any shutdown orders, internet disruptions often coincided with social-political protest moments. The existence of Article 16 paragraph 1(q) in the National Police Bill would make the previously covert internet shutdowns and throttling by the government explicit. These disruptions are likely to increase, especially under the pretext of “national security.”
Supervision and Security of Cyberspace
Article 14 paragraph 1(b) assigns the police the task of “supervising and securing cyberspace.” This provision is extremely dangerous as it could lead to mass surveillance in the digital space. Such mass surveillance infringes on the privacy rights of netizens. The supervision and security measures accompanied by threats of summoning and prosecution could create a chilling effect, where netizens are afraid to express themselves for fear of legal repercussions.
Previously, the police launched the Virtual Police program in 2021, based on Circular No. SE/2/11/2021 on Ethical Culture Awareness to Create a Clean, Healthy, and Productive Indonesian Digital Space. Through this program, the police monitor social media activities and issue warnings to netizens whose content is deemed to contain hoaxes or hate speech, thus violating the ITE Law.
If such content is found, the police will warn the netizen, asking them to delete the potentially unlawful content within 24 hours and not repost it. If the suspected infringing or hoax content is not removed, the police will issue a second warning. If there is still no response, the police will summon the account owner for clarification. Enforcement actions will be taken as a last resort.
From February 23 to April 12, 2021, the police claimed to have issued warnings to 200 netizens. There is no accurate data on the number of netizens warned to date. However, despite criticism from digital rights activists, the police have never officially announced the cessation of this mass surveillance program. The expanded police duties in cyberspace could legitimize such mass surveillance practices.
Wiretapping
The Draft Police Law grants the police the authority to conduct wiretapping. Article 14 paragraph 1(o) states that the police have the authority to “conduct wiretapping within the scope of police duties in accordance with the laws regulating wiretapping.” The problem is that there is currently no clear law regulating wiretapping.
A civil society consortium investigation found that the police were suspected of procuring Pegasus zero-click spyware in 2017-2018. This spyware can infiltrate the target’s mobile devices or laptops and access everything the target views on their devices. Pegasus can even activate the microphone and video while the device is not in use, recording everything without the target’s knowledge.
These findings are a serious alarm for civil society in Indonesia. According to SAFEnet’s monitoring and reports, critical groups such as activists and journalists are often targets of digital attacks. In 2023, SAFEnet recorded 80 attacks targeting activists, NGO staff, journalists, academics, and media workers.
A mass hacking case occurred in Indonesia in 2022, targeting the WhatsApp and social media accounts of 37 journalists and former journalists from NarasiTV, an independent media outlet often critical of the government. Additionally, hacking incidents against labor activists, pro-democracy activists, and students a day before protests are commonplace in Indonesia.
The existence of articles legitimizing wiretapping practices raises concerns that digital repression against critical groups will increase. Moreover, there are no stringent regulations governing the mechanisms and limitations of wiretapping to ensure respect for human rights.
Police Involvement in Smart Cities
The Indonesian government currently aims to develop 100 smart cities. Article 14 paragraph 2(c) of the Draft Police Law grants the police authority to be involved in the administration of smart city systems to ensure “security, safety, order, and smooth traffic.” The inclusion of this article raises concerns as it could lead to privacy violations if misused. The rationale of managing traffic with advanced cameras could instead result in mass surveillance and endanger critical groups.
Since 2021, the police have launched the Electronic Traffic Law Enforcement (ETLE) program. By 2022, ETLE cameras were operating in 34 provinces across Indonesia. These cameras have continued to evolve and become more sophisticated. In May 2024, the police launched a new ETLE system with facial recognition features in Yogyakarta, enabling the identification of all traffic violators. This is highly concerning, as in several countries such as Myanmar, Thailand, and Hong Kong, facial recognition cameras have been used to apprehend demonstrators. In Medan, a demonstrator opposing the Job Creation Law in 2020 was also arrested after being caught on CCTV.
The ETLE policy already has a legal basis in Law No. 22 of 2009 on Road Traffic and Transportation (LLAJ Law). Article 272 of the law states that electronic devices can be used to support traffic violation enforcement, with the results serving as evidence in court.
Therefore, if the goal is merely to optimize ETLE implementation, adding articles on police involvement in smart city traffic systems becomes unnecessary and irrelevant. Furthermore, there are currently no clear mechanisms for transparency and accountability. As technology advances, the deployed tools will become increasingly sophisticated, such as facial recognition cameras that could be used for mass surveillance of critical groups.
Conclusion
The National Police Bill is filled with problematic articles. If it is truly passed with these problematic articles, the National Police Bill will further restrict civil liberties in the digital realm. The articles in the National Police Bill could even be more dangerous than the ITE Law in their implementation. Moreover, the police have a poor track record in protecting digital rights. This track record can be seen from the criminalization of legitimate online expressions, internet shutdowns and throttling in Papua, the Virtual Police mass surveillance program, the alleged procurement of Pegasus, cyber-attacks on critical groups, and the implementation of electronic traffic law enforcement systems utilizing facial recognition technology.
Recommendations to the government and the Indonesian House of Representatives (DPR RI):
- Halt the discussion of the National Police Bill in the DPR RI for the 2019-2024 period;
- Remove Article 16 paragraph 1(q) concerning internet access shutdowns, Article 14 paragraph 1(b) concerning cyber space surveillance, and Article 14 paragraph 1(o) concerning wiretapping;
- Clarify and tighten the definitions as well as the mechanisms for transparency and accountability in Article 14 paragraph 2(c) concerning smart cities.
