P

resident Joko “Jokowi” Widodo signed on May 19 Presidential Regulation (Perpres) No. 53/2017 on the establishment of the Cyber Body and National Encryption Agency (BSSN).

This development is significant for three key reasons. First, it showcases the President’s commitment to nurturing a “digital economy” and safeguarding national interests in cyberspace.

According to estimates from the Indonesian E-Commerce Association, the total market value of the country’s e-commerce has grown 200 percent from around US$8 billion in 2013 to more than $20 billion in 2016.

With the internet and smartphone penetration rapidly increasing, the country’s online retail industry is expected to account for at least 5 percent of Indonesia’s economy by 2020.

Second, the establishment of BSSN comes after a number of high-profile incidents in cyberspace.

These include the website defacement of the largest telcom provider in Indonesia, the suspected hacking of a state-owned bank’s online application, and the worldwide “WannaCry” ransomware attacks.

Moreover, based on annual reports from the Indonesia-Security Incident Response Team on Internet Infrastructure, attacks against websites surged from 12,088 incidents in 2014 to 13,995 incidents in 2015.

Third, the newly-signed regulation consolidates the existing cyber security framework in the country. It transforms the historic National Encryption Agency (Lemsaneg) and merges a directorate for information security under the Communications and Information Ministry into the new agency with an expanded role in cyber security.

Given its importance, President Jokowi has ordered his senior ministers to complete the transformation process for BSSN before the end of September of this year.

Amid complex bureaucratic reforms and high public expectations, the most frequently ask question today is how the new agency will operate in the future.

Based on the Perpres, the BSSN is a civilian and collaboration-oriented institution in nature.

First, it plays a specific role in cyber protection, encryption of high-value information and filtering negative internet content. That said, the new agency is not the lead institution for cyber defense, signals intelligence gathering or law enforcement against cyber-crimes.

The division of institutional responsibilities is in line with recent organizational changes within defense and security establishments.

In May 2015 and July 2016, the Defense Ministry and the headquarters of the Indonesian Military (TNI) formed the Strategic Defense Installation Agency and cyber operation unit for dealing with threats to military cyber infrastructure.

While the State Intelligence Agency (BIN) has commissioned a deputy on information-gathering technology, the National Police headquarters upgraded its small cyber-crime unit into the Directorate for Cyber Law Enforcement in January 2017.

Second, the structure of BSSN is organized in a way to reflect a defensive cyber security doctrine.

Consisting of four deputies, its routine operations incorporate a loop of five core activities, namely the “protection, detection and identification” of cyber threats and network vulnerabilities, “response” to cyber-attacks and “recovery” of affected operating systems.

Hence, the new agency is not envisaged to undertake offensive cyber operations such as intrusive internet reconnaissance and disruption of networks or services.

The incorporation of cyber warfare capabilities will not only complicate BSSN’s operating environment, but also deepen public distrust over potential infringements of individual privacy and commercial secrecy.

Third, the organization of the BSSN represents the Jokowi administration’s strategic objectives in cyberspace. It specifically aims to secure the government’s communication network, protect critical information infrastructure and safeguard the digital economy.

The last objective further shows that e-commerce and other economic activities related to the internet are set to become a pillar of the Indonesian economy in the years ahead.

Moreover, the nascent cyber security agency is likely to concentrate on protecting energy, financial, healthcare and transportation-related information systems, as well as public telecommunications networks.

The operational security of this infrastructure is deemed vital for Indonesia’s economic development and homeland security.

Lastly, the current operating environment ultimately demands that the BSSN adopt a “collaborative approach” to the cyber security framework. Unlike in China and Russia, the Indonesian government could not maintain “absolute control” of cyber security because many of the country’s critical information infrastructures are owned and operated by private enterprises. Contrary to Australia and Germany, it still lacks key enabling technologies to develop an “intelligence-led” cyber security framework.

Given these strategic realities, the new cyber security agency will have to build a benign and mutually beneficial relationship between the public and private sector.

It could provide national guidelines, help build a skilled cyber workforce and undertake regular assessments of cyber security infrastructure.

In addition to state funding, Article 49 of the Perpres allows the BSSN to tap into other legitimate financial resources in support of its institutional role.

This could take the form of a “cyber fund” for collective capacity building programs, research and development of relevant technologies in cyber security.

By and large, the BSSN will play a strategic role in the era of the digital economy. After India and China, Indonesia still has the largest number of citizens who are not connected to the internet.

Under the flag of the Palapa Ring project, the Indonesian government hopes to develop an “information highway” with broadband services for all 514 regency and municipal capital cities across the country.

In a nutshell, the establishment of the BSSN is an important development in realizing the strategic vision of a “digital Indonesia” by 2030.
_________________________

The writer is a homeland security analyst at the Centre for Strategic and International Studies (CSIS), Jakarta.