.png)
Date: 13/05/2024
Where:
Indonesia, South Asian region
Who’s involved:
Indonesian government, i nvestigators with Amnesty International, Haaretz, Inside Story, and others.
What happened?
On May 2nd, Amnesty International’s Security Lab released the preliminary details of its findings regarding the import and availability of cyber-weapons and highly invasive spyware being facilitated by the Indonesian government.
The investigation promises to release details on the sales and deployment of spyware and other surveillance technologies that were conducted from 2017-2023 to various government and non-government entities.
Pegasus (developed in Israel, largely owned by a UK finance company), FinFisher (developed in the UK and Germany), and Predator (developed in Greece and North Macedonia) were among the tools found exchanged in these transactions.
Amnesty publicly named the Indonesian National Police (Kepolisian Negara Republik Indonesia) and the National Cyber and Crypto Agency (Badan Siber dan Sandi Negara) in the release.
Many of these cybersecurity vendors change hands and operate under various trade names in different jurisdictions, which clouds the process of tracing them and the implementation of regulations.
Analysis:
The types of spyware being tracked by Amnesty International’s Security Lab have the capability to read all of the data on a user’s phone, utilize all of their applications, and activate their phone and camera without the user’s knowledge.
Most manufacturers of this spyware claim that it’s only being sold to governments, for the specific use against terrorists and criminals.
These types of spyware are largely illegal for use with very specific exceptions for most of the countries that manufacture them, particularly within NATO and the European Union.
The involvement of Q-Cyber Technologies and NSO Group increases the profile of the case, as their infamous “Pegasus” and “Phantom” spyware products have been verifiably used to track journalists and human rights defenders rather than terrorists and criminals. Pegasus was involved in the abduction and eventual murder of Saudi-American journalist, Jamal Khashoggi.
Pegasus was allegedly used in the summer of 2020 by the Indonesian government when monitoring protests, despite there being no suspected terrorist or criminal activity. Its use was confirmed by two members of the Indonesian parliament.
Despite Indonesia having ratified the International Covenant on Civil and Political Rights (ICCPR) and acknowledging the rights to freedom of expression, peaceful assembly and association, personal security, and protection from arbitrary detention, the nation lacks legislation specifically regulating the lawful use of spyware and surveillance technologies.
Conclusion:
The investigation by Amnesty International’s Security Lab sheds light on how Indonesia has become a significant hub for global spyware, revealing a troubling paradox where European and Israeli companies are providing foreign governments with tools of repression, despite stringent regulations in their home countries. While these tools are illegal for non-specific uses within NATO and the European Union, loopholes in international regulations and domestic laws enable their proliferation elsewhere.
European investment, through companies like Q-Cyber Technologies and others, is playing a supporting role in arming oppressive regimes with advanced surveillance capabilities, thereby undermining human rights protections enshrined in frameworks such as the International Covenant on Civil and Political Rights (ICCPR). Indonesia’s lack of specific legislation regulating spyware usage only exacerbates the issue, leaving journalists, activists, and political opponents vulnerable to unwarranted surveillance.
