The Jakarta Post
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsCybersecurity governance: From bureaucracy to real-world threats
We have the blueprints to defend our digital sovereignty, but without real enforcement power, adequate funding and urgency on AI and quantum threats, the next massive breach is already penciled in.
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
Set as preferred source
The logo of the National Cyber and Encryption Agency (BSSN) is seen on the agency’s office in Jakarta on March 15, 2019. (JP/Dhoni Setiawan)
A
cross Southeast Asia, rapid digitization has quietly rewritten the rules of state legitimacy and national defense. How each government handles cybersecurity reveals who is actively building resilience and who is simply improvising under pressure.
Singapore set the regional standard early. Since launching its Cyber Security Agency in 2015, the city-state has systematically built a cohesive ecosystem of clear laws, skilled personnel and global partnerships. Malaysia took a pragmatic operational path, dividing responsibilities between CyberSecurity Malaysia and the National Cyber Security Agency while leaning on strong public-private coordination.
Thailand and Vietnam moved aggressively on legislation, passing sweeping frameworks in 2019 and 2018 that allowed them to scale their institutional defenses quickly. Meanwhile, Cambodia, Laos and Myanmar are still establishing baseline Computer Emergency Response Team (CERT) capabilities and early legal structures.
Then there is Indonesia: caught awkwardly between genuine ambition and persistent structural vulnerability.
On paper, Jakarta has made notable progress. Consolidating national cybersecurity authority under the National Cyber and Crypto Agency (BSSN) in 2017 brought critical infrastructure protection, cryptographic standards and incident response under one roof. The passage of the Personal Data Protection (PDP) Law in 2022 signaled that lawmakers finally grasped the scale of the digital economy they needed to protect.
The actual track record, however, tells an uncomfortable story that diplomatic language cannot soften. In 2021 alone, a breach at national health insurance provider BPJS Kesehatan exposed the personal data of roughly 279 million citizens, followed quickly by the leak of 2.3 million voter records from the General Elections Commission.
The following year saw major data exposures at state-owned giants PLN and Pertamina. By mid-2024, the Brain Cipher ransomware attack paralyzed the Temporary National Data Center (PDNS), laying bare the fragility of centralized public infrastructure.
