Freedom on the Net 2022 - Indonesia

/ 100
Obstacles to Access 14 / 25
Limits on Content 17 / 35
Violations of User Rights 18 / 40
48 / 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the research methodology and report acknowledgements.


Internet freedom remained under threat in Indonesia, though some conditions improved. Internet access in Papua was again disrupted, with some disruptions coinciding with events related to Papuan independence. Meanwhile, government critics, journalists, and ordinary users continued to face criminal charges and harassment in retaliation for their online activity. Journalists, news outlets, and think tanks faced more technical attacks for their online reporting. After the coverage period, authorities escalated their efforts to force technology companies to comply with a law that imposes takedown and registration requirements, briefly blocking some platforms.

Indonesia has made impressive democratic gains since the fall of an authoritarian regime in 1998, establishing significant pluralism in politics and the media and undergoing multiple, peaceful transfers of power between parties. However, the country continues to struggle with challenges including systemic corruption, discrimination and violence against minority groups, conflict in the Papua region, and the politicized use of defamation and blasphemy laws.

Key Developments, June 1, 2021 - May 31, 2022

  • Internet disruptions continued to occur in Papua and West Papua, often alongside government activities in the region (see A1 and A3).
  • Protesters against a mine in the Central Java village of Wadas who used social media to coordinate experienced connectivity restrictions, and some were arrested (see A3 and B8).
  • In October 2021, the Constitutional Court rejected a lawsuit against the use of Article 40 of the Electronic Information and Transactions (ITE) Law to restrict internet access in Papua and West Papua amid protests in 2019 (see A3).
  • A court sentenced YouTuber Muhammed Kece to 10 years’ imprisonment on false information charges in April 2022 over videos that authorities deemed blasphemous (see C3).
  • Fewer internet users or physically attacked for their online activities than in previous years (see C7).
  • The Indonesian government is suspected of buying spyware produced by Cytrox to surveil journalists and activists (see C5).

A Obstacles to Access

A1 0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 3 / 6

Internet penetration in Indonesia has steadily increased, driven largely by rapid growth in the number of mobile subscriptions. The country’s low number of fixed-line subscribers stems from the lack of infrastructure, which limits coverage and keeps the price of monthly subscriptions high.

In February 2022, DataReportal reported that Indonesia’s internet penetration rate was 73.7 percent of the total population, with the number of internet users in the country increasing by 2.1 million between 2021 and 2022.1 Mobile phones remain the most popular means for people to access the internet, with over 370.1 million subscriptions in 2022.2

Government projects are underway to improve Indonesia’s internet infrastructure, especially in rural areas. 3 Although the main Palapa Ring project—a three-part network of broadband backbone infrastructure extending thousands of kilometers across the country—was completed in October 2019, funding constraints have limited the development of further base transceiver stations (BTS) necessary to support the project.4 As a result, the construction of 42,00 BTS, which was originally planned to be completed in March 2022, has been delayed to the end of 2022.5

Disruptions to submarine internet cables and other infrastructural issues are common. According to the Southeast Asia Freedom of Expression Network (SAFEnet), at least 18 internet disruptions occurred in Papua in the first three months of 2022.6 Telecommunications providers attributed several brief disruptions, including in September 2021 and March 2022, to cable breaks.7 Other recorded internet disruptions were not acknowledged.8 SAFEnet research has found that infrastructure-related disruptions in Papua and West Papua are often reported when the government is conducting political, legal, and security activities in the region.9

A2 0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 1 / 3

A geographic digital divide persists in Indonesia, with rural residents at a disadvantage.

Despite increasing penetration rates and improved infrastructure, connectivity remains highly concentrated in the western part of the archipelago, particularly on the more urbanized island of Java. The disparity is evident in the information and communication technology (ICT) development index issued by the National Bureau of Statistics, in which the country’s five eastern provinces received the lowest rankings in 2019.10

In 2020, an Association of Indonesian Internet Service Providers (APJII) survey found that internet users in the rural areas of Sulawesi, Papua, and Maluku accounted for just 10 percent of the country’s total internet users.11 The Ministry of Communication and Information Technology (Kominfo) has committed to allocating resources from the Universal Service Obligation Fund, which taxes internet service providers (ISPs) in order to build internet infrastructure in rural and other underserved areas and subsidize internet access in eastern Indonesia.12

Some of the government’s internet infrastructure projects seek to lessen the geographical digital divide (see A1). However, though the Palapa Ring project intended to expand access, for example,13 the persistent lack of connectivity in rural areas despite the project’s completion has prompted calls for the implementation of BTS and other internet infrastructure.14 In March 2022, police temporarily halted BTS construction in parts of Papua after Papuan independence groups killed eight people working on the East Palapa Ring project.15 Kominfo indicated plans to continue development, including by working with residents in conflict areas.16 The limited availability of electricity and connectivity in more than 21,000 villages hindered online home learning activities for students in rural areas during the COVID-19 pandemic.17

Disparities in access also result from the high cost of internet subscription plans. Affordable prepaid packages are less available in underserved areas, such as Papua, Nusa Tenggara, and the Maluku Islands, than they are in more populous areas like Java, where service provider Telkomsel has less of a monopoly. 18 There is a slight gender divide in internet use: According to the 2019 data from the National Bureau of Statistics, the most recent available, 46.9 percent of internet users were women.19

A3 0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 4 / 6

Residents of the Central Java village of Wadas reported connectivity disruptions for three days in February 2022 amid protests against a mine construction project. Parliamentarians who visited the protests also reported restricted connectivity. Wadas protesters reported difficulty accessing their Twitter accounts that same week, though it remains unclear how this was accomplished (see B8).20

In October 2021, the Constitutional Court—the country’s highest court on constitutional matters—rejected a lawsuit contesting the government's decision to restrict internet access in Papua and West Papua during protests in 2019. The court upheld the use of the ITE Law to restrict connectivity, noting its procedural components.21 The ruling overturned precedent set by the Jakarta State Administrative Court in June 2020 holding that the ITE Law should only be used to restrict online information or documents that are “unlawful,” not to terminate access in its entirety.22

Internet connectivity has been restricted during religious events in order to “avoid and/or ward off hoaxes and negative content” online.23 In March 2022, the government restricted smartphone data packages and video streaming in Bali during the Hindu festival of Nyepi, the “day of silence.” Fixed-line connections, however, were not restricted. 24 The government has suspended mobile connections during Nyepi since 2018.25

Connectivity was unreliable in the Papua region several times during the coverage period, often alongside varying official activity in the region (see A1).26

Most BTS and other components of ICT infrastructure in Indonesia are built by private providers. Therefore, the distribution of BTS largely reflects the market dominance of the major players, led by Telkomsel, a subsidiary of Telkom Indonesia—a majority state-owned company that dominates the telecommunications market and is heavily involved in infrastructure development. Internet infrastructure in Indonesia is otherwise decentralized, with several connections to the global internet.27

The first internet exchange point (IXP), the Indonesia Internet Exchange, was created by APJII to allow internet service providers (ISPs) to interconnect domestically. An independent IXP, Open IXP, was launched in 2005.28

A4 0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 4 / 6

Connectivity is generally provided by large telecommunications companies, some of which are partially state-owned. However, in recent years, opportunities for other entities to enter the market have grown, though mergers may reduce competition in the market.

As of May 2022, there are 2,612 telecommunications service licenses that issued by Kominfo, 687 of which are ISP licenses.29 APJII has criticized the high cost of obtaining an ISP license under the Law on Post and Telecommunication.30

The fixed-line market remains at an early stage of development, with only 12 percent of Indonesia’s villages served by fixed-line broadband.31 The lack of existing infrastructure requires ISPs to invest heavily in development, so only major companies are able to compete. As a result, Telkom Indonesia has dominated this market.32

As the mobile market approaches saturation, three providers serve roughly 90 percent of subscribers.33 As reported in June 2021, market leader Telkomsel, Telkom Indonesia’s mobile subsidiary, had 169.2 million subscribers. In second place was Indosat Ooredoo, with 60.3 million subscribers. XL Axiata served 56.7 million subscribers.34 Indosat Ooredoo merged with service provider Hutchison 3 Indonesia in January 2022, raising concerns about market competition.35 Indosat Ooredoo Hutchison, the merged entity, is the second largest mobile provider in the country.36

A5 0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 2 / 4

Concerns have been raised about the independence of Kominfo as a regulatory body, following the decision to dissolve the Indonesian Telecommunication Regulatory Body (BRTI).

The BRTI, a more independent regulator, was established in 2003 to ensure fair competition among telecommunications providers, resolve industry conflicts, and develop standards for service quality. In 2018, BRTI’s authority was expanded to regulate not only infrastructure, but also issues relating to online platforms. In November 2020, the government decided to dissolve the BRTI to streamline the bureaucracy.37

The Directorate General of Posts and Informatics Operations (PPI) and the Directorate General of Informatics Application (Aptika) oversee internet services regulation under Kominfo. The PPI is responsible for regulating posts, telecommunications, and broadcasting, and its mandate includes supervising private telecommunications providers, regulating the allocation of frequencies for telecommunications and data communications, and issuing ISP licenses. Kominfo restructured Aptika in 2018, reorganizing departments responsible for regulation, granting domain names for government websites, digital economy functions, and blocking and content removal.38

B Limits on Content

B1 0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content, particularly material that is protected by international human rights standards? 3 / 6

Websites are frequently blocked for hosting what the government defines as negative content, a broad term that is used to describe content that is pornographic or defamatory, as well as content that violates social norms or is deemed immoral. 39

Between 2016 and April 2022, Kominfo stated that it had blocked 3,216 illegal financial technology lenders on the recommendation of the Financial Services Authority (OJK).40 As 2021 progressed, Kominfo blocked Snack Video—a competitor to TikTok—TikTok Cash, and VTube for lack of OJK licensing. 41 Kominfo, in cooperation with the Commodity Futures Trading Regulatory Agency (Bappbeti) and domain name registrars, blocked 1,222 illegal commodity-futures trading-sites in February 2022.42 Pornography remains the most commonly blocked category of content, with nearly 1.1 million sites blocked between August 2018 and July 2021 according to Kominfo; 387,000 gambling sites were blocked in the same period.43

Kominfo blocked access to Yahoo, gaming website Steam, and payment processor PayPal, along with several other sites, for several days in July and August 2022, after the coverage period. The websites were unblocked after registering as electronic service operators under Ministerial Regulation Number 5/2020 on Private Electronic System Operators (MR 5/2020) (see B3).44

Kominfo blocked the LGBT+ dating apps Grindr and Blued in 2017 and in January 2018, respectively.45 Kominfo confirmed that these apps were still blocked in November 2020.46

Between 2016 and July 2020, Netflix was inaccessible to Telkom Indonesia and Telkomsel customers, despite the absence of a formal blocking notification from Kominfo.47 The ministry did not intervene when the provider first blocked Netflix in early 2016, claiming that Netflix was operating without proper licensing and was exposing users to violent and pornographic content. In January 2020, the Indonesian Consumers Protection Foundation urged Kominfo to force Netflix to remove negative content from its platform or otherwise block it.48 In July 2020, the service provider unblocked Netflix after the platform agreed to fulfill some requirements, particularly regarding content and takedown requests.49

In July 2020, Kominfo stated that it planned to purchase more sophisticated technology to block more categories of negative content and websites.50 In January 2018, Kominfo launched Cyber Drone 9, a crawler system driven by artificial intelligence (AI) tools that is designed to proactively detect content violations. A specialized task force monitors the system and reviews the material it flags for blocking; the blocking itself is still carried out by ISPs. Each ISP may employ its own software for blocking and thus may deny additional sites at its own discretion.

B2 0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content, particularly material that is protected by international human rights standards? 2 / 4

The government routinely requires platforms and content hosts to remove negative content posted by users.

In August 2021, Kominfo requested that 20 YouTube videos and 1 TikTok video uploaded by Muhammad Kece be removed for containing blasphemy.51 Kece was later arrested and sentenced to ten years in prison for blasphemy (see C3). Meanwhile, in September 2021, Kominfo requested that YouTube remove a video deemed to promote LGBT+ content on YouTube Kids.52 Also in September 2021, Kominfo announced that it was streamlining procedures for reporting content to social media companies by coordinating with other government agencies.53

In April 2021, during the previous coverage period, Kominfo requested that YouTube block 20 videos uploaded by Joseph Paul Zhang, who proclaimed he was the 26th prophet of Islam. Kominfo used MR 5/2020 as one of the legal references to justify the takedown (see B3).54 In December 2020, Kominfo also requested YouTube take down a parody song of “Indonesia Raya,” the national anthem, considering the song to be an “insult” and hate speech towards Indonesia. The two minors who made the video were later arrested (see C3).55 In August 2019, YouTube reportedly restricted a satirical video about Papua on the request of the Indonesian government.56

The government reported that it restricted 565,449 pieces of inauthentic social media content throughout 2021, mostly related to the COVID-19 pandemic.57 In September 2020, Kominfo removed 233 pieces of content on digital platforms relaying false information on that December’s regional elections.58 As of April 2021, 20,453 pieces of social media content related to terrorism and radicalism had been taken down.59

Kominfo has demanded that some apps be removed entirely from app stores, or that certain pieces of content be blocked. In March 2021, the illegal Snack Video app was removed from Google’s app store on the request of Kominfo (see B1).60 In January 2020, the ministry announced that it had blocked 1,085 fintech-specific apps from the Google app store in 2019, and 1,356 similar apps from other app stores.61

In February 2021, the Criminal Investigation Department (Bareskrim) of the Indonesian National Police (Polri) launched a Virtual Police program to monitor social media and chat apps for hoaxes and incitement. As of April 2021, the program reportedly sent warnings to remove content to 200 social media accounts that post hate speech and potentially infringe on Article 28(2) of ITE Law.62 A civil society organization, KontraS, reported that the warnings were mostly directed towards active government critics, and users immediately deleted content that was flagged.63

Platforms that do not remove banned content risk being blocked entirely. For example, Tumblr was blocked in March 2018; it was subsequently unblocked that December after removing “adult content.”64

In the second half of 2020, TikTok stated that it removed more than 89 million videos, of which around 3.8 million videos were from Indonesia.65 Reuters reported that between 2018 and mid-2020, ByteDance—the Chinese operator of TikTok—censored Indonesian content on its news aggregator app, BaBe, that expressed “negative” information about the Chinese government.66

B3 0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 1 / 4

Regulations that grant the government the ability to restrict online content are largely not grounded in democratic principles and procedures. Research from Article 19 has found that opaque content moderation practices undermine user trust and may drive government regulation.67

Amendments from 2016 to the ITE Law strengthened the legal foundation for blocking content and limiting internet access.68 Under Article 40 of the amended ITE Law, Kominfo can directly prevent access to online content, or order ISPs to do so.69 Article 26 of the amended law also established a “right to be forgotten” for Indonesian citizens, whereby electronic system providers, such as Google, are required to delete irrelevant information about an individual on Kominfo’s request. The ministry, however, needs to provide a court order. There are concerns that Article 26 could hamper the public’s right to information.70

A 2014 decree under the ITE Law expanded official powers to allow the blocking of negative content on websites.71 A separate statute provides a legal framework to block content considered pornographic.72 The precursor of the amended ITE Law, Kominfo’s Regulation No. 19 of 2014 on Control of Websites Containing Negative Content, set technical guidelines for blocking web content. However, it does not establish transparency and accountability in blocking procedures.73

MR 5/2020 took effect in November 2020 (see C6).74 MR 5/2020 requires that private electronic system operators (ESOs)—defined as any foreign or domestic entity that operates electronic systems for Indonesian users—ensure that their electronic systems do not contain or facilitate prohibited content, broadly defined as any content that violates domestic law, creates community anxiety, or disturbs public order. After receiving a notice from Kominfo to remove prohibited content, ESOs have 4 hours in “urgent” situations and otherwise have 24 hours to comply. ESOs that fail to remove prohibited content will be fined or blocked (see B6). In May 2021, MR 5/2020 was amended by Ministerial Regulation No. 10 of 2021 (MR 10/2021), adding an obligation for ESOs to register with the government within six months of the launch of a designated online system.

In June 2022, after the coverage period, Kominfo announced that ESOs would have to register under MR 5/2020 within one month.75 In July 2022, after the registration deadline had passed—with major ESOs including Amazon, Yahoo, Bing, Steam, and PayPal still unregistered—Communications Minister Johnny G. Plate warned that unregistered platforms would be blocked.76 Several platforms were then briefly blocked (see B1). The Legal Aid Institute Jakarta announced plans to sue over enforcement, citing harm to users and a legal interpretation it called overly broad.77

In March 2022, Reuters reported that the government had formulated fines for platform owners who fail to comply with its content removal requests, with affected operators conceivably facing fines worth millions of rupiah.78 The fines had not yet entered into effect as of the end of the coverage period.

Kominfo shares the total number of websites restricted through official press briefings but does not provide further details on which sites are blocked and why. Four multistakeholder panels, established by the ministry to respond to public complaints about arbitrary and nontransparent blocking, completed their terms in 2015 and were not renewed.79 Besides Kominfo, several other government agencies restrict online content under the ITE Law, including the National Cyber and Encryption Agency (BSSN). 80

In May 2020, two private television stations, iNews and RCTI, sought judicial review of the Broadcasting Law to the Constitutional Court, requesting that the court reformulate the law to regulate competitor streaming platforms like Netflix and YouTube.81 The court rejected the lawsuit in January 2021;82 as of May 2022, the parliament has not discussed the revision of the bill that will regulate the implementation of television streaming platforms, even though it was considered a legislative priority in 2021.83

B4 0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 2 / 4

The government’s broad definition of negative content that can be blocked or removed and its intensifying pursuit of legal actions for online activity contribute to an environment of self-censorship among journalists and ordinary users alike.84 Many social media users have expressed their fear of the ITE Law. An April 2022 survey from Indikator Politik Indonesia reported that 62.9 percent of respondents thought that today's society is increasingly afraid to express opinions.85

Increased online harassment, as well as technical attacks against journalists, activists, and online news outlets, further this environment of caution (see C7 and C8). Civil society organizations have also raised concerns that the Virtual Police program will drive users to increasingly practice self-censorship (see B2).86

Authorities have increasingly targeted online discourse that is critical of the government by labelling it hate speech, which could potentially limit the willingness of journalists and users to criticize the government online.87 Although the government has issued Guidelines for the Implementation of the ITE Law, which ostensibly reduces the criminalization of online expression (see C2),88 internet users continue to be detained and prosecuted for their online speech (see C3).

B5 0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 1 / 4

Coordinated manipulation of online content by the government, its allies, and other political actors has distorted the information landscape. Manipulated content and disinformation, which has spread online since the 2014 presidential election, continues to proliferate, particularly during moments of political tension or emergencies, such as protests and the COVID-19 pandemic.89

Research released in November 2021 indicated that political and economic elites, including from the Indonesian Democratic Party of Struggle (PDI-P) and the Great Indonesia Movement Party (Gerindra), continued to manipulate public opinion on social media through paid commentators, also called “buzzers,” during the coverage period. The research found that some buzzers were paid between 2 million and 7 million rupiah ($140 and $488) per campaign.90

Paid commentator networks manipulate trending topics and hashtags on Twitter, often to suppress hashtags that appear organically. In April 2022, the antigovernment #MahasiswaBergerak (“students on the move”) hashtag and the progrovernment #SayaBersamaJokowi (“I’m with Jokowi [President Joko Widodo]”) hashtag were prominently seen as students protested the postponement of the 2024 general election; both may have been supported by automated accounts.91

Previously, reports from the Oxford Internet Institute released in 2019 and 2020 identified Indonesia as a country where buzzers and automated accounts manipulate information on social media on behalf of political parties and private contractors.92 The founder of Drone Emprit,93 a social network analytics company, also stated that buzzers contribute heavily to trending topics on political issues, such as hashtags used during a popular student demonstration in September 2019.94

Indonesia Corruption Watch (ICW), a think tank, reported the government budgeted 90 billion rupiah ($6.4 million) to hire buzzers to promote the government’s policies in a 2020 report.95 During the initial spread of COVID-19 in March 2020, progovernment buzzers reportedly were mobilized to spread online content criticizing the plans of the Jakarta governor, an opposition figure, to lock down the capital.96

In June 2020, three seemingly inauthentic accounts accused comedian Bintang Emon of using drugs after he criticized the court for sentencing an attacker of a Corruption Eradication Commission (KPK) member to one year in prison.97 In October 2019, researchers at the British Broadcasting Corporation (BBC) and the Australian Strategic Policy Institute discovered a network of bots originating in Jakarta that distributed progovernment propaganda in Papua across multiple social media platforms and websites.98 Facebook and Twitter closed the accounts.99

A network of online news sites has also been utilized by political actors to spread propaganda. In January 2020, Reuters journalists discovered that the military was operating and funding a network of 10 news sites that publish progovernment propaganda while criticizing critics and human rights advocates.100 Among their tasks was to mobilize support for the government’s response to the 2019 Papua protests, including for the state’s use of violence (see A3 and B8).

B6 0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 1 / 3

Users do not face significant economic and regulatory barriers to publishing content online. However, financial sustainability concerns and registration requirements aimed at combating “prohibited online content” have created constraints to publish.

Under MR 5/2020, all ESOs must register their systems with Kominfo (see B3).101 The law also requires ESOs to appoint a local liaison. The regulation allows the government to revoke e-providers and cloud computing providers’ registration and licenses if they do not provide electronic information, data, and access to the government and law enforcement agencies for monitoring and law enforcement purposes (see C6).

Journalists from the provinces of Papua and West Papua often face economic constraints.102 The news site West Papua Media resumed operations in November 2020 after crowdfunding enough money to support the digital security of its journalists.103 The outlet had suspended operations in 2018 for financial reasons. 104

To combat online misinformation, the Press Council, an independent body, created verification process designed to help readers identify reliable media outlets. As of April 2022, there are 1,781 administratively verified media companies.105 Media groups have criticized the verification process as effectively extralegal,106 warning that registration requirements threaten the existence of alternative media.107

B7 0-4 pts
Does the online information landscape lack diversity and reliability? 3 / 4

While Indonesia’s online information landscape remains diverse, concentrated ownership has restricted the variety of content in national and local media.

In 2019, approximately 47,000 media outlets operated online.108 However, the concentration of media ownership has undermined the diversity of viewpoints available to consumers. The owners of some major media outlets are actively involved in politics, contributing to increasingly partisan online news. At the local level, many online outlets have become extensions of certain political parties, hampering their credibility.

Social media platforms such as WhatsApp, Facebook, and Instagram are now key sources of news, which has significantly eroded the market position of mainstream media.109 Indonesia also enjoys a thriving blogosphere. Members of the growing urban middle class are fervent users of social media and communication apps, and local blog and website hosting services are either free or inexpensive.

Tools to circumvent online censorship are largely accessible, and Indonesia is considered one of the world’s largest markets of virtual private network (VPN) services.110 However, research conducted in 2017 found that three tools offering VPN services or anonymous browsing were subject to blocking.111 These tools continued to be blocked at the end of the coverage period.

In response to the increase in manipulated content and misinformation online, over 20 local media outlets and journalists’ associations launched a fact-checking initiative, Cek Fakta, in May 2018.112 In December 2021, the Indonesia Fact-Checking Summit 2021 served as an information-sharing forum for fact-checkers, including from Cek Fakta.113

B8 0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 4 / 6

Platforms and websites used for mobilization were largely available during the coverage period. However, online threats and harassment of protesters and others using the internet to organize limits digital activism (see C7). The government also restricted internet connectivity to quell protests during the coverage period (see A3). Indonesians use online mobilization tools to call for the government to change its policies and practices. is particularly popular in Indonesia; more than 18.8 million users signed petitions on various social issues, including child protection and environmental issues, in 2021.114 Pressure from petitions in 2021 likely contributed to the military abolishing virginity tests for women recruits, presidential amnesty for a professor imprisoned under the ITE Law (see C3), and the accreditation of low-paid teaching staff.115

Although protesters have successfully used online mobilization tools to advocate for change, some face restrictions for their activism. Residents of Wadas who opposed a mine construction project for several years launched a series of protests in early 2022, using social media to mobilize support and build awareness. In response, authorities restricted connectivity during a police response in February 2022 (see A3). Wadas protesters reported difficulty accessing their Twitter accounts that same week, though it remains unclear how authorities limited access.116 Previously, several individuals who participated in or coordinated protests against the omnibus law in 2020 were doxed (see C7).

During the coverage period, despite restrictions on connectivity in Papua and Wadas, users across Indonesia were able to mobilize online. Social media users amplified protesters’ messages online,117 while others crowdfunded to support the demonstrations.118

C Violations of User Rights

C1 0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 2 / 6

Freedom of expression, including online, is nominally protected in the constitution and other laws, but the right is frequently curtailed in practice. The Law on Human Rights, which was adopted shortly after the 1998 transition to democracy, guarantees freedom of expression and other fundamental rights; these protections were strengthened by the Second Amendment of the constitution passed in 2000. The Third Amendment guarantees freedom of opinion.119 The constitution also includes the right to obtain information and communicate freely,120 rights that are further protected by various laws and regulations.121 Indonesia ratified the International Covenant on Civil and Political Rights (ICCPR) in 2005.122

However, the constitution includes language allowing the state to limit rights based on political, security, moral, and religious considerations.123 This wording provides policymakers with ample room for interpretation.124 The limited respect for the legal framework guaranteeing freedom of expression is exemplified by the frequency of prosecutions for online activity, as well as disruptions to internet connectivity and social media platforms.

C2 0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities, particularly those that are protected under international human rights standards? 1 / 4

Several laws impose criminal and civil liability for online activities.

Provisions of the 2008 ITE Law have been used repeatedly to prosecute Indonesians for online expression. The law’s penalties for criminal defamation, hate speech, and inciting violence online are disproportionately harsh compared with those established by the penal code for similar offline offenses.125 Amendments from 2016 to the ITE Law expanded the scope of defamation to include content published unintentionally or by third parties, for instance through the tagging of Facebook posts with another user’s name. 126 Private chat messages can also be considered violations, as the offense of “transmitting” defamatory content applies even when only one person receives the content. The article also broadly covers “all acts other than distributing and transmitting” that make the content accessible to others, which made more users vulnerable to prosecution. The maximum penalties for online defamation were lowered from six years in prison to four, and from a fine of 1 billion rupiah ($69,760) to 750 million rupiah ($52,320), but these penalties remained harsher than most offline defamation sentences.127

In June 2021, President Jokowi announced that he would revise articles of the ITE Law which related to prohibited online content and add an additional article addressing “false information that troubles society.”128 The draft articles, which include a penalty of up to 10 years’ imprisonment and a fine of 10 billion rupiah ($697,600) for “intentionally disseminat[ing]” information deemed false, are broad and vulnerable to misuse.129 As of April 2022, the revision of the ITE Law has not yet been discussed in the parliament.130

Also in June 2021, the government issued guidelines for implementing the ITE Law, which aimed to narrow the scope of defamation and insult charges under the law and introduce protections for media organizations.131 The guidelines do not appear to be consistently applied by local law enforcement.132 Civil society groups noted that guidelines were not a sufficient replacement for revisions to the law.133

Passing the Revision of the Criminal Code Bill (RKUHP) was named a legislative priority in the 2021 National Legislation Program (Prolegnas). The controversial proposals present in the 2019 draft would criminalize insulting public authorities and institutions; writing, promoting, or broadcasting information about contraceptives or abortion; spreading information about or associating with communism; distributing false or inaccurate information; and defamation.134 The bill would also expand the 1965 Blasphemy Law to include six broad provisions of religion-related speech.135 In June 2022, after the coverage period, the government announced its plans to advance the bill.136

In April 2020, the Polri issued a directive allowing officers to charge individuals under the criminal code for spreading COVID-19 misinformation online. The directive also instructed police to charge users for online activities that insult the president and government authorities under the ITE Law.137

Other laws infringe on user rights. The 2008 Antipornography Law loosely defines pornography to enable the ban of many forms of legitimate artistic and cultural expression.138 The 2011 State Intelligence Law prescribes penalties of up to 10 years’ imprisonment and large fines for revealing or disseminating “state secrets.”139 This legal framework provides authorities with a range of powers to penalize internet users, although they are not all regularly invoked in practice.

C3 0-6 pts
Are individuals penalized for online activities, particularly those that are protected under international human rights standards? 2 / 6

Users frequently face civil and criminal penalties for legitimate online activities, though the government issued guidelines for implementing the ITE Law to reduce criminalization (see C2).

In April 2022, a court convicted YouTuber Muhammad Kece of spreading false information and sentenced him to 10 years’ imprisonment. Kece was arrested in August 2021 over YouTube videos that Kominfo deemed to be blasphemous (see B2).140

Online journalists were charged, detained, and convicted for their reporting during the coverage period. In November 2021, Muhamed Asrul, a journalist with, was found guilty of violating Article 27 of the ITE Law and was sentenced to three months in prison.141 Asrul was detained for a 36-day period in January and February 2020 after being arrested for alleged hate speech under Article 28 of the ITE Law; he had written three news articles about corruption allegations involving the son of Palopo’s mayor.142

Several cases against activists charged with spreading false information online were ongoing during the coverage period. In September 2021, for example, presidential chief of staff Moeldoko filed a police report accusing two ICW researchers, Egi Primayogha and Miftah, of defamation under the ITE Law and the criminal code. The researchers reported on Moeldoko’s apparent ties to PT Harsen Laboratories, which produces and offers ivermectin as a COVID-19 treatment.143 No new developments were reported as of June 2022.

Also in September 2021, a senior government official reported Lokataru Foundation director Haris Azhar and KontraS coordinator Fatia Maulidiyanti to the Greater Jakarta Metropolitan Regional Police on charges of defamation under the ITE Law, seeking 100 billion rupiah ($7 million) in damages. The two had posted a YouTube video discussing a study of mine ownership in the Intan Jaya Regency area of Papua. The case remains ongoing as of March 2022.144

Two ITE Law–related cases were dropped during the coverage period. In October 2021, Saiful Mahdi, a lecturer who was convicted of defamation for criticizing university recruitment processes over WhatsApp, received amnesty from President Jokowi. Mahdi received a three-month prison term and a 10-million-rupiah ($697) fine in April 2020 and lost his appeal in September 2021. Mahdi’s amnesty is the second Jokowi issued related to targets of the ITE Law.145 In addition, in December 2021, Stella Monica, who was convicted of defamation under the ITE Law and received a one-year term because she reviewed a beauty clinic critically, was acquitted by an appeals court.146

In January 2021, Kristen Gray, a US citizen, was deported after posting that Bali was “LGBT friendly” on Twitter.147

Police have also cracked down on the circulation of disinformation. From January 2020 to March 2021, 113 individuals were being investigated for spreading false information about COVID-19.148 In July 2021, police arrested Lois Owien, a doctor who was accused of sharing false COVID-19-related information on social media and in a television program. Owien was subsequently released.149 Police also indicated they were monitoring social media for false information campaigns during the coverage period.150

Such incidents have occurred in the wake of numerous controversial judicial proceedings during previous coverage periods. In March 2019, a user was issued a 10-month prison sentence and a heavy fine for allegedly sending four WhatsApp messages critical of a textile company, although the accused claimed the messages were sent from a number that she no longer had access to.151 In January 2019, Papuan independence activist Augustinus Yolemal was sentenced to one year in prison after being convicted of “disseminating hostility against the state ideology” for posting a video on Facebook of him and his son singing songs for Papuan independence.152

C4 0-4 pts
Does the government place restrictions on anonymous communication or encryption? 3 / 4

Anonymous communication is somewhat restricted, although not formally prohibited by law. Users have access to encrypted services, although some Kominfo policies and other regulations have revealed the government’s desire to gain backdoor access to encrypted communication and personal data.

Since 2005, Kominfo has nominally required mobile phone users to register their phone numbers with the government by text message when they buy a phone. This rule was widely ignored for years, but in 2017, Kominfo introduced a new regulation requiring SIM card users to register by submitting their national identity numbers and their family card registration numbers, thereby limiting anonymity.153 As of late February 2018, failure to comply with this requirement could lead to the temporary blocking of data services to the unregistered SIM cards. If users fail to register within 15 days of the block’s initiation, the SIM cards can be permanently blocked from any telecommunications services. In 2020, the government announced its plan to roll out the use of biometric data for SIM card registration in 2021.154 There were no updates on the rollout of this plan during the coverage period.

Indonesia mandates international mobile equipment identity (IMEI) registration for devices bought outside of the country. Since April 2020, unregistered devices have been prevented from connecting to networks.155 In June 2019, Kominfo announced plans to require social media users to include their phone numbers when establishing accounts,156 and reportedly considered regulating VPN use through licenses.157

C5 0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2 / 6

Government surveillance of online activities limits the right to privacy. Although this right is constitutionally guaranteed, no specific law stipulates its protection.

Article 40 of Law No. 46 of 1999 on Post and Telecommunication prohibits the interception of information transmitted through any form of telecommunications.158 However, at least 10 other laws, including the ITE Law and seven executive regulations, allow certain government or law enforcement agencies to conduct surveillance, including electronically.159 These include the KPK,160 the National Narcotics Board, and the National Intelligence Service, among others. The laws do not clearly provide for the scope of interception, despite a 2010 Constitutional Court decision that requires government agencies to have detailed and regulated interception procedures.161 The legal framework also fails to provide for judicial or parliamentary oversight of surveillance activity and remedies for those who allege abuse.

The 2016 amendments to the ITE Law revised some provisions governing interception in response to the 2010 Constitutional Court decision, introducing penalties for interception conducted outside the context of law enforcement. The government indicated that further details concerning interception procedures would be addressed in future regulations.162

In previous years, the government announced its interest in passing legislation on surveillance and cybersecurity through the Surveillance Bill, which would authorize the use of wiretapping and other mechanisms to conduct monitoring, and the Cybersecurity and Defence Bill, which would give the BSSN the ability to cut data flows to mitigate cyberthreats.163 Neither bill featured in the National Legislation Programme 2022.164

In May 2018, the parliament adopted amendments to the 2003 Eradication of Criminal Acts of Terrorism Law (CT Law) that give authorities sweeping surveillance powers to fight terrorism, which is broadly defined. Article 31 permits security officials to “intercept any conversation by telephone or other means of communication suspected of being used to prepare, plan, and commit a criminal act of terrorism.”

Authorities monitor social media platforms. In preparation for the 2019 elections, Kominfo created a “war room” in October 2018 that employed 70 engineers tasked with monitoring social media platforms in real time.165 Kominfo reported that it would “take action” if it found users had violated the ITE Law. In January 2018, the BSSN reportedly began to formalize its response to cyberthreats, which included a social media program.166

Reports have linked authorities to the purchase and use of spyware and other sophisticated surveillance tools. In December 2021, the Toronto-based group Citizen Lab identified the Indonesian government as a likely customer of Cytrox, which sells the Predator spyware tool.167 Citizen Lab reported in December 2020 that Indonesia had likely purchased Circles technology.168 The Indonesian government has reportedly used FinFisher spyware, which collects data such as Skype audio, key logs, and screenshots;169 international mobile subscriber identity-catcher (IMSI-catchers) purchased from Swiss and British companies;170 and surveillance products from the Israeli-US company Verint to track LGBT+ rights activists and religious minorities.171

Amid the COVID-19 pandemic, Indonesia rolled out the app PeduliLindungi (Care Protect), which pulls location data using Bluetooth proximity tracking to facilitate contact tracing and allows users to register for and obtain certification of their vaccination.172 The app remained in regular use as of the end of this coverage period.173

C6 0-6 pts
Does monitoring and collection of user data by service providers and other technology companies infringe on users’ right to privacy? 4 / 6

The absence of a comprehensive personal data protection law and an independent data protection authority in Indonesia have made it challenging to identify and act upon infringements of users’ privacy rights. As of the end of the coverage period, the Personal Data Protection Bill had yet to be finalized, possibly due to disagreement between the government and the parliament regarding the independence of the data protection authority that will be established under the law.174

In February 2020, Communications Minister Plate acknowledged that without a comprehensive personal data protection law, identifying data collection practices by digital providers that infringe on users’ right to privacy remains a challenge.175 Data breaches (see C8) and illegal data transfers are the only clear evidence of such infringements.176

Several laws expand the government’s ability to access personal data held by private companies. Governmental Regulation No. 71 of 2019 (PP 71/2019) states that only data related to government administration, defense, and security are subject to data localization requirements;177 it replaced a previous regulation178 that required electronic system providers that offer “public services” to build local data centers.179

MR 5/2020, which became effective in November 2020 and complements PP 71/2019, mandates that ESOs provide authorities “direct access” to their systems and users’ personal data when requested, for monitoring and law enforcement purposes. Any ESOs whose digital content is used or accessed within Indonesia must also appoint an in-country representative to respond to content removal and personal data access orders (see B3 and B6).180

Some international companies are beginning to store user data domestically. Kominfo requested that Google develop a data center integrated with the government’s system to ensure users’ data is held on servers within Indonesia. Due to the potential of cloud computing business in Indonesia, Google and Amazon are reportedly seeking to develop data centers in Jakarta.181

A 2016 Kominfo regulation182 stated that personal data must be encrypted if it is stored in an electronic system, though a separate ministry directive stated that over-the-top (OTT) providers must allow legal data interception for law enforcement purposes, raising concerns about the security of encryption.183 Moreover, a government regulation issued in 2000 requires telecommunications providers to retain records of customer usage for at least three months.184 Some companies have complied with law enforcement agencies’ requests for data.

C7 0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? 3 / 5

Score Change: The score improved from 2 to 3 because there were no reports of people facing physical violence in retaliation for their online activities, though journalists and activists faced online harassment.

Online journalists and users regularly face harassment and intimidation in retaliation for their online activities.185 For instance, in February 2022, the social media accounts of Sasmito Madrim, the chairman of the Alliance of Independent Journalists (AJI), were attacked; Madrim’s personal data was leaked.186

In June 2021, Mara Salem, the editor of North Sumatran online media outlet, was shot in his car. Police investigations revealed that the shooter owned a nightclub, which Salem reported was involved in drug distribution. Police reports indicate the murder followed disagreement over bribes paid to Salem by the nightclub owner for more favorable coverage.187

In May 2021, during the previous coverage period, the house of a journalist, Abdul Kohar Lubis, was set on fire. 188 That same month, an online journalist, Mulyono, was beaten and doused with gasoline by his neighbor, who accused him of reporting on a street orchestra concert that took place in their neighborhood during the pandemic. 189

In March 2021, a journalist with, Ahmad Akbar Fua, was doxed after writing about a criminal group that stormed a police station in Konawe, Kendari City, to secure the release of arrestees.190 In September 2020, an individual publicly revealed the home address, family photos, and telephone number of Cakrayuri Nuralam, a journalist who published an article verifying that Arteria Dahlan, a PDI-P politician, was the grandchild of the founder of the Indonesian Communist Party (PKI) in West Sumatra.191

Indonesian internet users report experiencing online harassment related to their identities. SAFEnet received 677 complaints of online gender-based violence in 2021, primarily from women. Some 508 complaints involved the nonconsensual sharing of intimate images, 38 involved sexual harassment, and 28 related to doxing.192 People facing online gender-based violence reported experiencing intimidation, blackmail, and emotional manipulation alongside the harassment.

Internet users in academic communities and protesters have also been targeted for their online activity. According to an October 2020 press report, the personal data of student protester Azhar Jusardi Putra and activists Ernawati and Ardy Syihab were circulated on WhatsApp and social media. Putra’s WhatsApp account was also hacked and his mother received death threats.193 In June 2020, organizer and journalist Tantowi Anwari, a speaker at an online discussion at the University of Lampung titled “Racial Discrimination against Papua, #PapuansLivesMatter,” was doxed and received online threats and harassment (see C8).194

Activists and journalists reporting on and discussing Papua and West Papua consistently face intimidation. In April 2021, the car of the founder of independent news site Jubi, Victor Mambor, was vandalized.195

Maaher At-Thuwailibi, a cleric of the Islamic Defenders Front, died of preexisting health issues at a Polri detention center in February 2021, during the previous coverage period; At-Thuwailibi had been detained for alleged online hate speech and defamation towards an influential cleric. Relatives alleged that his health further deteriorated because of the conditions in the center.196

C8 0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 1 / 3

Civil servants, journalists, activists, civil society groups, and news outlets have experienced technical attacks in recent years. SAFEnet reported at least 193 digital attacks took place in 2021, many targeting activists and journalists. Technological attacks such as hacking, data breaches, and phishing made up more than 80 percent of digital attacks in 2021.197 For example, AJI chairman Samsito Madrim’s social media accounts were hacked in February 2022 and used to spread progovernment misinformation (see C7).198 The websites of government entities and private companies also face hacks and data breaches.

KPK employees, anticorruption activists, and journalists who have publicly discussed the controversial National Insight Test (TWK)—a civics evaluation that state employees are required to pass due to 2019 legislative amendments, which has been criticized for the appropriateness of some of its questions—had their private social media accounts hacked. In June 2021, the whistleblowing platform IndonesiaLeaks faced hacking attempts on its website and its Twitter account after publishing an investigative report on the TWK.199 That same month, the Telegram accounts of KPK senior investigator Novel Baswedan and Intercommission and Agency Network director Sujanarko were hacked.200 In May 2021, ICW reported experiencing several hacking attempts during a virtual press conference that featured eight previous KPK leaders as panelists.201

Individuals and news outlets criticizing the government’s handling of COVID-19 were also subjected to technical attacks. In August 2020, University of Indonesia professor Pandu Riono, who criticized the government’s pandemic response, claimed that hackers posted photos to his Twitter feed of him and a woman they claimed to be his mistress.202 In August 2020, several media outlets and civil society groups—including Tempo,, and the Centre for Indonesia’s Strategic Development Initiatives (CISDI)—were hacked after posting articles that criticized the government’s handling of the coronavirus. Several organizations claimed that hackers erased content from their websites.203

Data breaches are also frequent in Indonesia.204 In May 2021, the Healthcare and Social Security Agency, which administers Indonesia’s universal health coverage program, experienced a massive data breach. The personal data of 270 million participants were leaked and sold in a hacking forum called Raid Forums.205