T

echnical issues at two major airports in Southeast Asia have shown that ASEAN’s member states are woefully unprepared for cyberattacks, experts have said.

Indonesia’s Soekarno-Hatta International Airport and Malaysia’s Kuala Lumpur International Airport experienced last week major disruptions that served as a wake-up call for member countries to have precautionary measures in place to prevent such incidents from occurring again.

Last Friday, the check-in system for three international flights at Terminal 3 of Soekarno-Hatta airport experienced technical problems.

Meanwhile, Kuala Lumpur airport experienced various network failures that affected its flight information display system, check-in counters, baggage handling system, Wi-Fi connection and credit card systems at retail and food and beverage stores, Bernama news agency reported.

Preliminary findings by Malaysia Airport Holdings Berhad indicated that the disruptions were due to network equipment failure, The Star reported, citing a statement from Malaysia’s National Cyber Security Agency on Saturday.

Meanwhile, Indonesia’s National Cyber and Encryption Agency (BSSN) is reportedly planning to establish a crisis management center that would make quick and simultaneous decisions related to potential cybersecurity threats or other disruptions.

A researcher at the Centre for Strategic and International Studies (CSIS), Fitriani, said that while the incidents at Kuala Lumpur airport did not necessarily constitute a cyberattack, ASEAN countries had experienced actual cyberattacks in the past, most notably in 2016 when a group of hackers, allegedly from China, attacked the website of Vietnam Airlines and leaked client information and posted derogatory messages targeted at Vietnam and the Philippines.

ASEAN, she said, had since 2006 taken several steps to prepare for cyberattacks, launching the ASEAN Cyber Incident Drill (ACID), an exercise involving the computer emergency response teams of ASEAN countries.

“It has been working pretty well, but they are not the ones who make cyberpolicy,” Fitriani said on Monday.

At the regional level, member countries established the ASEAN Telecommunications Ministers Meeting (TELMIN) in 2012. In addition, the ASEAN Ministerial Conference on Cybersecurity, a cross-pillar cooperation mechanism, was initiated by Singapore.

“In ASEAN, not all countries are interested and pay attention to the cyber sector. ASEAN countries are more inclined to pay attention to the problem of disinformation and misinformation, like hoaxes and fake news, but only a few look at how infrastructure is connected online,” Fitriani said.

She said both aspects of cybersecurity were equally challenging, yet some ASEAN governments only cared about disinformation in terms of maintaining law and order domestically.

“Also, it is easier to find proof of misinformation and disinformation than it is to find proof of [cyber] attacks on infrastructure, because it requires that cyberforensic experts study it,” she said.

Indonesia Cyber Security Forum (ICSF) chairman and cofounder Ardi Sutedja said the government did pay attention to the protection of critical information within cyberinfrastructure systems, including everything handled by both the private sector and the government, such as the financial, logistics and healthcare industries.

“The problem is that [the government] just hasn’t been able to integrate all of those into one integrated management platform under their coordination,” he said.