Data Resilience in Indonesia (Learning from Facebook)

Jakarta – Indonesia is currently rocked by a Facebook data leak scandal. Over a million Indonesian users have been exposed. Will Facebook wash its hands of this? Who will be held responsible?

Currently, the government, both the Ministry and DPR, have begun taking action. The question is, why is this action curative, and what preventive measures have been taken?

The next intriguing question is, why, in the discourse and discussions about policy direction, is there talk of allowing data centers overseas? Wouldn't recovery be more difficult in such cases, since Facebook's data center for Indonesian users doesn't have to be in Indonesia?

On a broader and more massive scale, this could very well have occurred secretly without anyone's knowledge, not just through the Cambridge Analytica app, and not just on Facebook. It's entirely possible that numerous similar Cambridge Analytica apps are already circulating online and across various online platforms.

Big data analytics technology and algorithms are capable of handling not only structured data but also unstructured data such as text, including slang, images, and videos effectively and efficiently.

The big data analytics paradigm views the trillions of data that are massively distributed and produced in social media and other interaction media in cyberspace, including online commerce, as a gold mine of information that can be used for various purposes.

Facebook office in Indonesia (Photo: detikINET/Agus Tri Haryanto)

In fact, eagle eye–eagle eye–activities are not only carried out by Cambridge Analytica, but also by many big data analytics companies in the world for various purposes.

Just like Christopher Wylie, the young data scientist student who developed the algorithm behind Cambridge Analytica, I am sure our students and young data scientists in Indonesia also have similar abilities.

The same is true for programming students and coders pursuing data science degrees. Not only is there bare (unencrypted or unprotected) and free data strewn across social media and cyberspace, but the issue currently attracting the most attention among Indonesians is e-KTP, where various personal data is collected by the government and potentially transferred to certain parties.

Not unlike e-government, e-procurement, e-health, and especially the recent rise in e-commerce, particularly online transportation, all of these telematics applications can only function if your personal data is first entered into the database.

Have the relevant institutions and industries truly guaranteed the security and privacy of the data of all members of the public and users of these services, both technically and through their information security management processes and standards? Who guarantees this? What's the proof? The public should not be misled, and they have the right to know the results of independent audits of such matters.

The reality on the ground further reinforces the lack of control by those responsible for data security and privacy. Precedents for this have existed and have become increasingly prevalent recently, including the leaking of mobile phone numbers to telemarketers.

Skandal privasi Facebook melibatkan kebocoran data pengguna Indonesia. Foto: GettyImages

In fact, it is suspected that the banking sector and third parties collaborate in violating privacy by disseminating customers' personal data without the data owner's knowledge.

As a result, many of us, including detikINET readers, feel that various product promotions are appearing via short messages or broadcast messages to instant messages, SMS mobile phones, email, and so on, in credit card and unsecured credit offers.

On the other hand, research by the Indonesian Consumer Foundation (YLKI) at the Seminar on Personal Data Protection Regulations at the Faculty of Law, Padjadjaran University, in Jakarta some time ago showed that the majority of telecommunications and banking operators have not been fully consistent in implementing personal data protection.

There's still a lack of consistency between them. For example, the privacy policy on a bank's website is limited to employee recruitment purposes. Even more concerning, some banks post privacy policies on their websites, but when opened, they're completely blank.

Telecommunication operators in Indonesia are even worse off. Only one operator has implemented privacy education. The rest implement data protection through a customer registration and data clarification process, particularly for postpaid numbers.

Privacy is an individual right and must be protected by the state, especially since privacy is regulated by five international legal instruments, particularly human rights legal instruments.

For example, the 1948 Universal Declaration of Human Rights (UDHR) and the 1966 Convention on Civil and Political Rights (ICCPR), where privacy is grouped into a fundamental right to one's personal life and this right must be protected by the state (Alfredsson and Asbjorn Eide (ed), The Universal Declaration of Human Rights).

In Indonesia, privacy is actually implicitly regulated in the Fourth Amendment to the 1945 Constitution, Article 28(g) paragraph 1, and other laws. However, its regulation, and especially its endorsement, is very minimal.

Therefore, this regulation cannot provide protection for the Indonesian people as in Law No. 39 of 1999 concerning Human Rights, Law No. 36 of 1999 concerning Telecommunications, Law No. 12 of 2005 concerning Ratification of ICCPR, Law No. 11 of 2008 concerning Information and Electronic Transactions.

Moreover, in practice, Indonesia has not yet specifically regulated personal data privacy, and it appears not to have been a government priority. This contradicts research by Professor Graham Greenleaf of the University of New South Wales, Sydney, Australia, which states that 89 countries have regulated personal data protection, both online and offline. In Southeast Asia, Indonesia still lags behind other countries. Our current position is only on par with Burma, Laos, and Cambodia.

Therefore, in this digital era, regulating privacy rights and data security is increasingly urgent for all stakeholders in this country. A lack of data resilience in Indonesia will not only result in losses for individuals whose data is leaked, but could also lead to chaos in the country and the spread of various crimes.

Reflecting on the Facebook case, the urgency of personal data protection has emerged. Photo: Reuters

Rekomendasi Resiliensi Data

The author recommends that the government seriously consider and take action on national data resilience, so that data leaks that harm the Indonesian people do not continue to occur.

At the very least, the author recommends, first, that the government not back down from mandating domestic data centers for Facebook, Google, and similar services, especially for Indonesian users. This also applies to online commerce players like Bukalapak, Gojek, Tokopedia, and others.

Moreover, according to the Uptime Institute (the world's most credible data center certification body), in Indonesia there are already dozens of data centers that are certified Tier III and some are already certified by design Tier IV.

It is not correct to conclude that Facebook, Google and others cannot use data centers in Indonesia, because data centers in Indonesia cannot possibly reach Tier IV due to the absence of two different electricity companies independently.

This argument only holds true within the old data center paradigm, which used the TIA942 standard, a standard that is currently underutilized. Singapore also has only one electricity company, and many of these world-class sites use data centers in Singapore.

Second, the government's move to re-register prepaid cards deserves support and appreciation. The public is required to re-register their SIM cards by February 28, 2018, and the cards will be completely blocked by April 28, 2018.

The government needs to take decisive action like this. Ahmad Ramli, Director General of Postal and Information Technology at the Ministry of Communication and Information, is absolutely correct in stating that the re-registration program is intended to provide certainty, security, and convenience to the public.

In the era of digital banking and agile financial technology, it is highly recommended to continue to regulate and endorse the principle of KYC (Know Your Customer), or more broadly, know everybody in their physical existence even though the interaction itself is online.

Third, the public and government need to increase control over the security aspects of various online services and electronic transactions. The regulatory principle of "less regulation is the best" is only appropriate in the context of licensing and ease of doing business. In terms of security, achieving minimum controls according to best practice standards is non-negotiable.

Fourth, we need to encourage the emergence of unicorns in social media, big data analytics, and similar services in Indonesia. At the very least, there should be alternative services such as email, private messaging, video sharing, maps and navigation, and other services provided by companies legally incorporated in Indonesia.

This will reduce Indonesia's dependence on foreign countries and strengthen Indonesia's bargaining position when dealing with Facebook, Google, Alibaba and other online giants.

Last but not least, the government needs to immediately regulate data privacy and implement it consistently. Advances in big data analytics technology and its various potential applications need to be guided to avoid data privacy violations.

Simultaneously, let's educate the public, industry and government agencies about what they can and cannot do in an effort to protect the data and privacy contained therein.

To the public, especially detikINET readers who are familiar with digital services, we also urge you to be more selective in providing personal data to third parties these days.

Please ensure you have read and understand the privacy policies set by third parties. We are the ones who can make our lives more comfortable.

*) Penulis, Dr. Dimitri Mahayana is a Lecturer STEI ITB at Control and Computer System Lab STEI ITB. Published in Detik.com.