C

OVID-19 is not the only threat Indonesia is facing as cyberattacks are also on the rise, with hackers seeking to exploit the vulnerabilities of Indonesia’s digital security during the outbreak.

The pandemic has created the perfect opportunity for hackers to force their way into computer networks as companies and office workers shift to online platforms while working remotely and new users dive into Indonesia’s cyberspace, warned Institute for Policy Research and Advocacy (ELSAM) deputy director Wahyudi Djafar.

“The potential impacts of cyberattacks is massive as they can cause both economic losses and disrupt important infrastructure used for communication,” he said on Monday.

His concerns are set against the backdrop of two recent cyberattacks in Indonesia, namely the so-called Zoombombing of lewd images that disrupted a National ICT Council (Wantiknas) webinar and the data breach of 15 million users of the homegrown e-commerce unicorn Tokopedia.

Wahyudi also warned that sensitive health data on COVID-19 might be prone to cyberattacks, with the government lacking transparency on who can access the data and how it is preventing illegal access to such information.

In 2017, ransomware called WannaCry rendered patients’ online information inaccessible in Jakarta’s Dharmais and Harapan Kita hospitals.

Indonesia’s prevailing regulations are “far from sufficient” to face the storm of cyberattacks during the pandemic, with provisions failing to stipulate consumers’ rights in case of a cyberattack, Wahyudi said.

Therefore, he called on the government to optimize the use of the Electronic Information and Transactions Law (ITE) and other relevant regulations to act against cybercrimes, pending a deliberation of the long-awaited data protection bill at the House of Representatives.

Platform providers should also educate their consumers on how to use their applications safely, Wahyudi said.

While digital usage in Indonesia is among the highest in the world, digital literacy is still relatively low, Communications and Information Ministry Director General of Information Applications Samuel Abrijani Pangerapan said in a statement on Feb. 28.

Globally, a recent study by accounting firm PricewaterhouseCoopers’ (PWC) cybersecurity team revealed that hackers had intensified their phishing attempts threefold to exploit people’s fears and vulnerability as they worked and conducted most of their activities from home during the pandemic.

Indonesia is no stranger to cyberthreats, with the Cyber Body and National Encryption Agency (BSSN) recording 12.9 million cyberattacks in 2018. The agency reported that the number of cyberattacks also grew by an average of 15 percent every year.

Most recently, the government’s PeduliLindungi surveillance application, which is used to trace and track suspected patients as well as confirmed COVID-19 cases, sparked concerns over the safety of its personal data. The Communications and Information Ministry later clarified that the application was safe to use and pledged to delete users’ data once the pandemic was over.

Communications and Information Minister Johnny G. Plate said his office would continue to ramp up cybersecurity and protect personal data with the BSSN, although he did not provide details on how this would be achieved.

“The government will continue to ensure that the digital economy, especially e-commerce, can run well and smoothly without being disrupted by data hackers or data breaches,” he said recently after holding a virtual meeting involving the ministry, the BSSN and Tokopedia.

The minister also urged the public to regularly change passwords and use the one-time password (OTP) feature to better protect their personal accounts.

Ride-hailing giant Gojek’s chief information security officer, George Do, told The Jakarta Post in an exclusive interview last month that the quarantine period should compel the public to step up security measures on their devices and prompt organizations to undergo a digital “security paradigm shift”, citing Gojek’s use of cloud storage to interact with employees as an example.

“First, everyone needs to be familiar with phishing and social engineering and the basic understanding to never, under any circumstance, share one’s username and password with somebody else,” he said, adding that organizations also needed to be aware of malware and ransomware.