Event Summary
The Indonesian Law Ministry has finalized the draft Cybersecurity and Cyber Resilience Bill (RUU KKS) as of 1 October 2025, and submitted it to the House of Representatives for prioritization in the 2026 legislative agenda. This bill responds to increasing cyberattacks and aims to establish a comprehensive framework for managing cyber threats, including regulations for digital product providers, guidelines on artificial intelligence ethics, and procedures for responding to cyber incidents. However, it emphasizes state-centric national security over individual digital rights, introduces concepts like “digital treason” with penalties of up to 20 years’ imprisonment for attacks threatening sovereignty, and controversially assigns investigative roles to the Indonesian National Armed Forces (TNI). Critics argue this fosters legal ambiguities, overlaps with existing laws such as the Electronic Information and Transactions Law, and conflates cybersecurity with cybercrime enforcement, potentially eroding civilian oversight and democratic norms. The draft builds on prior versions from 2019 and early 2024 but retains these structural flaws, prompting calls for revisions to prioritize human-centric protections.
The bill continues the militarization in Indonesia’s cybersecurity domain as part of a broader trend of expansion of military reach in civilian areas of governance. Since late 2024, the government has progressively integrated TNI into cyber operations, beginning with the creation of a dedicated military cyber force in November 2024 following a high-profile data breach at the TNI’s Strategic Intelligence Agency. This was reinforced by the TNI Law revision in early 2025, which expanded non-war military roles to include cyber threat management without clear threat-grading criteria, potentially justifying TNI probes into non-state threats like journalistic leaks. Similar concerns arose in October 2025 when civil society groups, including Kontras, highlighted 85 TNI-related violence cases in the prior year, warning that cyber bill provisions could enable broader crackdowns on dissent.
If enacted without revisions, the RUU KKS poses significant long-term threats to Indonesia’s enabling environment by accelerating the militarization of cyberspace, potentially entrenching authoritarian tendencies and weakening democratic safeguards. Key actors affected include citizens, whose digital rights—such as privacy and freedom of expression—are often sidelined in favor of state interests, potentially exposing them to disproportionate penalties, which could deter online activism.