The Institute for Policy Research and Advocacy (ELSAM)

Content

ryul-davidson-PcyrQsX5f4w-unsplash.jpg

Summary

Privacy International is part of a 60+ coalition calling on Facebook and Google to provide equal and better transparency regarding political advertising on their platforms globally.

Media

Key points

We believe it is necessary for both Google and Facebook to:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

This letter is also available in Spanish.

Dear Mr. Zuckerberg and Mr. Pichai,

In the past few years, you have pioneered important transparency tools to help your platform users understand, learn about and contextualise the political advertising they see. We agree that advertiser verification processes and ad repositories are key safeguards against online manipulation and misinformation. However, we are saddened to observe that these benefits have not been equally distributed among your global user base.
Each platform operates fluctuating and often widely differing transparency standards for different countries. While some users benefit from seeing political advertising in an ad repository, others do not. Where some users are offered detailed information about a political ad, others are not. There are no legitimate or otherwise publicly disclosed reasons justifying this difference in treatment.
The combined effect of these inconsistent policies is to create a two-tiered user base within each platform, with a wide regulatory gap separating the transparency haves and have-nots. We first highlighted these problems in 2019. While some progress has been made since, we are disappointed to conclude that the transparency divide persists.
Online transparency should not be a privilege of the few, but the right of all. To that end, the changes we believe are necessary are as follows:

Accelerate the expansion of full transparency tools to all countries where you operate to ensure that the least favoured countries benefit from the same level of transparency as the most favoured countries
Develop, and make public, a plan of action setting out commitments and related timescales to roll out full transparency tools globally
Disclose the full array of criteria, both past and present, used to select countries qualifying for higher transparency standards

The above changes, which we believe to be fair and reasonable, are only a starting point to begin to correct the current platform-created inequality between users. By contrast, the benefits are conclusive: heightened transparency standards for millions of users worldwide, and increased legitimacy of online political advertising for the sake of fair and informed decision-making by voters.
We urge you to take responsibility as two of the most influential platforms in online political campaigning, and empower users and voters with heightened ads transparency.

Yours sincerely,

Access Now
Africa Freedom of Information Centre (AFIC)
Aliansi Jurnalis Independen/Alliance of Independent Journalists (AJI)
Amnesty International
ApTI
Article 19
Artículo 19 México y Centroamérica
Asociación por los Derechos Civiles
Asociación para una Ciudadanía Participativa, ACI Participa
Associação Data Privacy Brasil de Pesquisa
Asociación para el Progreso de las Comunicaciones (APC)
Association for International Affairs (AMO) in Prague
Association pour le Developpement Integré et la Solidarité Interactive (ADISI-C)
Citizen D
Centre for Independent Journalism Malaysia (CIJ-M)
Collaboration on International ICT Policy for East and Southern Africa (CIPESA)
Civil Liberties Union for Europe
Bytes for All (B4A)
Datos Protegidos
Defend Democracy
Dejusticia
Democracy Reporting International (DRI)
Derechos Digitales
Digital Rights Foundation
ELSAM
Electronic Frontier Finland
Electronic Frontier Norway
epicenter.works
EU Disinfo Lab
Fundación Acceso
Fundación Huaira de Quito-Ecuador
Fundación Internet Bolivia
Fundación Karisma
Freedom Forum
Free Media Movement (FMM)
Global Forum for Media Development
Global Witness
Hiperderecho
Homo Digitalis
Instituto Brasileiro de Defesa do Consumidor
InternetLab
Intervozes - Coletivo Brasil de Comunicação Social
IPANDETEC Centroamérica
Irish Council for Civil Liberties (ICCL)
Laboratorio de Datos y Sociedad (DATYSOC)
Media Foundation for West Africa (MFWA)
Media Institute of Southern Africa MISA- Zimbabwe
Media Matters for Democracy
Merit Legal Advocacy & Human Rights Initiative (MELAHRI)
OBSERVACOM
Paradigm Initiative (PIN)
Privacy International
R3D: Red en Defensa de los Derechos Digitales
SFLC.in
Stiftung Neue Verantwortung (SNV)
Sursiendo, Comunicación y Cultura Digital AC
TEDIC
The Tor Project
Unwanted Witness
Usuarios Digitales
Venezuela Inteligente
Who Targets Me
World Wide Web Foundation
Xnet

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

The Association for Civil Rights (ADC) is a non-governmental organisation based in Buenos Aires that promotes civil and social rights in Argentina and other Latin American countries. It was founded in 1995 with the aim of fostering a legal and institutional culture to guarantee fundamental rights, based on respect for the constitution and democratic values.

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Dejusticia

The Center for Law, Justice and Society (Dejusticia) is a Colombia-based NGO that works to strengthen the rule of law and promote human rights in Colombia and across the developing world. It produces research to contribute to action for social change, and carries out advocacy through campaigns, litigation, education and capacity-building.

Country of Operation

Region of Operation

Website

Dejusticia

Derechos Digitales

Founded in 2005, Derechos Digitales is a non-profit organisation based in Chile that works across Latin America. Its main objective is the development, defense and promotion of human rights in the digital environment. Its work focuses on issues around freedom of expression, privacy and personal data, and copyright and access to knowledge.

Country of Operation

Chile

Region of Operation

Website

Derechos Digitales

Digital Rights Foundation

Digital Rights Foundation (DRF) is a research and advocacy NGO based in Pakistan that focuses on how Information and Communication Technologies (ICTs) can support human rights, democratic processes and digital governance. It works towards a world where all people, and especially women, are able to safely exercise their right of expression.

Country of Operation

Pakistan

Region of Operation

Website

DRF

Fundación Karisma

Founded in 2003, Fundación Karisma is a civil society organisation dedicated to supporting and disseminating the good use of technologies in digital environments, social processes and public policies in Colombia and the region, with a human rights focus. It also undertakes legal and technological activism in coalitionwith local, regional and international partners.

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Hiperderecho is a non-profit Peruvian organisation dedicated to facilitating public understanding and promoting respect for rights and freedoms in digital environments. It seeks to spread the liberating capacity of technology to develop or enhance digital spaces so that all Peruvians can exercise their rights and strengthen their citizenship.

Country of Operation

Peru

Region of Operation

Website

InternetLab

InternetLab is an independent research center that aims to foster academic debate around issues involving law and technology, especially internet policy. Our goal is to conduct interdisciplinary impactful research and promote dialogue among academics, professionals and policymakers. We follow an entrepreneurial nonprofit model, which embraces our pursuit of producing scholarly research in the manner and spirit of an academic think tank. As a nexus of expertise in technology, public policy and social sciences, our research agenda covers a wide range of topics, including privacy, freedom of speech, gender and technology.

Country of Operation

Brazil

Region of Operation

Website

InternetLab

Red en Defensa de los Derechos Digitales

The Red en Defensa de los Derechos Digitales (R3D) is a Mexican organisation dedicated to the defence of human rights in the digital environment. It uses various legal and communication tools for policy research, strategic litigation, and advocacy and campaigns, with particular attention to freedom of expression, privacy, and access to knowledge.

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC) is a Paraguayan non-governmental organisation that develops open civic technology, supported by its work in communications and alternative advocacy. It also promotes and defends digital rights in favour of a free Internet culture, with the aim of establishing a collaborative society where digital rights are exercised and respected.

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

The Institute for Policy Research and Advocacy (ELSAM) is a civil society organisation that works to enhance the democratic political order in Indonesia by empowering civil society. Founded in 1993, it actively participates in efforts to promote human rights through policy and legal research, advocacy, and training.

Country of Operation

Region of Operation

Website

Influence key stakeholders

Unwanted Witness

Founded in 2012, Unwanted Witness is a Ugandan-based civil society organisation that seeks to create secure, uncensored online platforms for human rights activists. It aims to contribute to good governance through effective online activism, networking and capacity-building. It also advocates for the strengthening of mechanisms related to freedom of expression and accountability.

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

The role of social media and search platforms in political campaigning and elections has come under scrutiny. Concerns range from the spread of disinformation, to profiling of users without their knowledge, to micro-targeting of users with tailored messages, to interference by foreign entities, and more. Significant attention has been paid to the transparency of political ads, and more broadly to the transparency of online ads.

Notably, in the lead up to the 2019 EU Parliamentary elections Facebook, Google, and Twitter, as well as the Interactive Advertising Bureau and others, agreed to take a series of steps to prevent online disinformation on their respective platforms. These measures are reflected in a self-regulatory Code of Practice on Disinformation and the companies provided the European Commission with monthly updates on their progress.

PI is campaigning for 1) platforms to give all users heightened ad transparency and 2) for transparency into targeting and funding of ads to be meaningful.

Learn more

Democratic engagement is increasingly mediated by digital technology, from campaigning to election results transmission. These technologies rely on collecting, storing, and analysing personal information to operate. They raise novel issues and challenges for all electoral stakeholders on how to protect our data from exploitation.

The regulation of online political ads in Indonesia

staff — Fri, 22 Jan 2021 11:36:07 +0000

The regulation of online political ads in Indonesia

Podcast: Data exploitation in reproductive rights in Indonesia

caitlinb — Mon, 21 Sep 2020 13:02:31 +0000

Podcast: Data exploitation in reproductive rights in Indonesia

An open letter to Google

tech-admin — Wed, 08 Jan 2020 15:19:16 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

Content

Pi-Android-mock-up-3-1-photo correct.png

Summary

Privacy International and over 50 other organisations have submitted a letter to Alphabet Inc. CEO Sundar Pichai asking Google to take action against exploitative pre-installed software on Android devices.

Media

Key points

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

You can find the letter below. Add your voice to this campaign by signing our petition if you believe that its time Google stopped enabling exploitation.

Note: This letter is also available in French and Spanish

Dear Mr. Pichai,

We, the undersigned, agree with you: privacy cannot be a luxury offered only to those people who can afford it.

And yet, Android Partners - who use the Android trademark and branding - are manufacturing devices that contain pre-installed apps that cannot be deleted (often known as "bloatware"), which can leave users vulnerable to their data being collected, shared and exposed without their knowledge or consent.

These phones carry the "Google Play Protect" branding, but research shows that 91% of pre-installed apps do not appear in Google Play – Google’s app store.

These pre-installed apps can have privileged custom permissions that let them operate outside the Android security model. This means permissions can be defined by the app - including access to the microphone, camera and location - without triggering the standard Android security prompts. Users are therefore completely in the dark about these serious intrusions.

We are concerned that this leaves users vulnerable to the exploitative business practices of cheap smartphone manufacturers around the world.

The changes we believe are needed most urgently are as follows:

Individuals should be able to permanently uninstall the apps on their phones. This should include any related background services that continue to run even if the apps are disabled.
Pre-installed apps should adhere to the same scrutiny as Play Store apps, especially in relation to custom permissions.
Pre-installed apps should have some update mechanism, preferably through Google Play and without a user account.
Google should refuse to certify a device on privacy grounds, where manufacturers or vendors have attempted to exploit users in this way.

We, the undersigned, believe these fair and reasonable changes would make a huge difference to millions of people around the world who should not have to trade their privacy and security for access to a smartphone.

We urge you to use your position as an influential agent in the ecosystem to protect people and stop manufacturers from exploiting them in a race to the bottom on the pricing of smartphones.

Yours sincerely,

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Coding Rights is a Brazilian-based think tank that aims to advance the enforcement of human rights in the digital world. Its goal is to ensure that policy-making affecting technological development and digital rights is informed by actual technological knowledge, and that technological development is guided by fundamental human rights.

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

The Foundation for Media Alternatives (FMA) is a non-profit service institution that supports citizens and communities—in particular civil society organisations and other development stakeholders—in their strategic use of Information and Communication Technologies (ICTs). It was founded in 1987 and is based in Manila.

Country of Operation

Philippines

Region of Operation

Website

FMA

Fundación Karisma

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Country of Operation

Peru

Region of Operation

Website

Red en Defensa de los Derechos Digitales

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Region of Operation

Website

Influence key stakeholders

Unwanted Witness

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

When you buy a brand new lower cost phone (like a Tecno Y2 or MYA 2 for example), it's likely to come pre-installed with insecure apps and an outdated operating system. What this means is that your or your loved ones could be left vulnerable to security risks or to having their data exploited.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Lettre ouverte à Google

tech-admin — Tue, 07 Jan 2020 15:23:23 +0000

Target Profile

Google

Audiences and Purpose

Change

We campaign for solutions

Content

Pi-Android-mock-up-1-1-photo.png

Summary

Privacy International et plus de 50 autres organisations ont soumis une lettre au PDG d'Alphabet Inc., Sundar Pichai, demandant à Google de prendre des mesures contre les logiciels préinstallés sur les appareils Android qui exploitent les données des utilisateurs.

Media

Key points

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Vous pouvez trouver la lettre ci-dessous. Ajoutez votre voix à cette campagne en signant notre pétition si vous pensez qu'il est temps que Google cesse d'activer l'exploitation.

Ce contenu est également disponible en anglais et en espagnol.

Cher M. Pichai,

Nous, les organisations signataires, sommes d’accord avec vous :
la vie privée n’est pas un luxe, offert seulement à ceux qui en ont les moyens.

Pourtant, les « Android Partners » – qui utilisent la marque déposée Android – fabriquent des téléphones avec des applications préinstallées qui ne peuvent pas être supprimées (connues sous le nom de bloatware). Ces applis rendent les utilisateurs très vulnérables : leurs données sont collectées, partagées et exposées sans leur consentement ou même sans qu’ils en aient conscience.

Ces téléphones portent le label « Google Play Protect » alors qu’une étude montre que 91 % des applis préinstallées ne sont pas proposées sur Google Play – Google App Store.

Ces applis préinstallées peuvent avoir certaines autorisations du fabricant qui les laissent fonctionner en-dehors du système de sécurité Android. Ces autorisations, définies par l’appli elle-même (incluant l’accès au microphone, à la caméra et à la géolocalisation), ne déclenchent aucune notification d’alerte de sécurité d’Android. Les utilisateurs n’ont absolument pas connaissance de ces intrusions majeures.

Nous sommes préoccupés par le fait que les utilisateurs de téléphones bon marché sont livrés à ces pratiques commerciales inquiétantes dans le monde.

Les changements que nous demandons en urgence sont les suivants :

Les personnes devraient pouvoir désinstaller sans restriction les applis sur leurs téléphones. Cela implique également toutes les fonctionnalités cachées qui continuent alors que l’appli est désactivée.
Les applis préinstallées devraient être examinées et validées selon le même protocole que les applis Play store, et notamment sur les autorisations du fabricant.
Les applis préinstallées devraient proposer une mise à jour systématique, de préférence via Google et sans compte d’utilisateur.
Google devrait refuser toute certification à un appareil qui ne répond pas à ces exigences de la vie privée, quand des fabricants ou des vendeurs ont tenté d’exploiter les données des utilisateurs sans leur consentement.

Nous, les signataires, pensons que ces changements justes et raisonnables auraient un impact considérable pour des millions de personnes dans le monde, qui ne devraient pas avoir à renoncer à leur vie privée et à leur sécurité en achetant un smartphone.

Nous vous demandons, puisque vous êtes un acteur influent du système, de mieux protéger les personnes et d’empêcher les fabricants de les utiliser abusivement, dans cette course effrénée aux bas prix des smartphones.

Je vous prie d'agréer, Monsieur, l'expression de nos sentiments distingués.

American Civil Liberties Union (ACLU)

Afghanistan Journalists Center (AFJC)

Americans for Democracy and Human Rights in Bahrain (ADHRB)

Amnesty International

Asociación por los Derechos Civiles (ADC)

Association for Progressive Communications (APC)

Association for Technology and Internet (ApTI)

Association of Caribbean Media Workers

Australian Privacy Foundation

Center for Digital Democracy

Centre for Intellectual Property and Information Technology Law (CIPIT)

Citizen D

Civil Liberties Union for Europe

Coding Rights

Consumer Association the Quality of Life-EKPIZO

Datos Protegidos

Digital Rights Foundation (DRF)

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate of the Oxford Martin School, University of Oxford

DuckDuckGo

Electronic Frontier Foundation (EFF)

Forbrukerrådet // Norwegian Consumer Council

Foundation for Media Alternatives

Free Media Movement (FMM)

Freedom Forum

Fundación Karisma

Gulf Centre for Human Rights (GCHR)

Hiperderecho

Homo Digitalis

IJC Moldova

Initiative for Freedom of Expression- Turkey (IFox)

Irish Council for Civil Liberties

Media Foundation for West Africa

Media Institute of Southern Africa (MISA)

Media Policy and Democracy Project (University of Johannesburg)

Media Policy Institute (MPI)

Media Watch

Metamorphosis Foundation for Internet and Society

Open Rights Group (ORG)

Palestinian Center For Development & Media Freedoms (MADA)

Panoptykon

Paradigm Initiative

PEN Canada

Philippine Alliance of Human Rights Advocates (PAHRA)

Privacy International

Public Citizen

Red en Defensa de los Derechos Digitales (R3D)

Syrian Center for Media and Freedom of Expression (SCM)

TEDIC

The Danish Consumer Council

The Institute for Policy Research and Advocacy (ELSAM)

The Tor Project

Unwanted Witness

Vigilance for Democracy and the Civic State

Repeating Image and Text

More about our partner

La Asociación por los Derechos Civiles

Country of Operation

Argentina

Region of Operation

Asociación por los Derechos Civiles

Website

Coding Rights

Country of Operation

Brazil

Region of Operation

Website

Coding Rights

Digital Rights Foundation

Country of Operation

Pakistan

Region of Operation

Website

DRF

Foundation for Media Alternatives

Country of Operation

Philippines

Region of Operation

Website

FMA

Fundación Karisma

Country of Operation

Region of Operation

Website

Fundación Karisma

Hiperderecho

Country of Operation

Peru

Region of Operation

Website

Red en Defensa de los Derechos Digitales

Country of Operation

Mexico

Region of Operation

Red en Defensa de los Derechos Digitales

Website

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Country of Operation

Paraguay

Region of Operation

Website

TEDIC

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Region of Operation

Website

Unwanted Witness

Country of Operation

Uganda

Region of Operation

Africa

Website

Unwanted Witness

Our campaign

Achieved Results

Following from this campaign, Google announced that the JioPhone Next, a new low-cost phone launched with Reliance in India, will receive the latest Android operating system and security updates.

Buying a brand new low-cost phone can leave you with an outdated operating system and exploitative apps.

While buying the most recent iPhone can give you a secure operating system and reliable encryption, buying a brand new lower cost phone may leave you facing an array of security risks.

We don't think privacy should be a luxury. That's why we advocate for companies to provide the latest security features and privacy protections for low cost phones, as well as high cost phones.

Learn more

Being in a vulnerable situation should not involve greater exposure to government and corporate surveillance.

You might think you own your phone - but there is data on there you can't access, you can't delete, and possibly is being silently leaked to companies you've never heard of.

Filling the gaps on the understanding of cybersecurity and human rights across the world

caitlinb — Tue, 22 Oct 2019 12:17:56 +0000

Filling the gaps on the understanding of cybersecurity and human rights across the world caitlinb Tuesday, October 22, 2019

The pressing need to fix our cybersecurity (mis)understandings

Despite all the efforts made so far by different, cybersecurity remains a disputed concept. Some states are still approving cybersecurity laws as an excuse to increase their surveillance powers. Despite cybersecurity and cybercrime being different concepts, the confusion between them and the broad application of criminal statutes is still leading to the criminalise legitimate behaviour.

All of this represents a sizable challenge for experts, human rights defenders and other stakeholders around the world. Some of these challenges have to do with the interaction between security and privacy, with decision makers willing to sacrifice our fundamental freedoms in the name of a vague idea of security. Closely related is the question of who or what are we protecting: Is it the state? The economy? The reputation of the powerful?

Filling the gaps around the world

In Privacy International, for a long time we have been documenting cases and advocating on these issues.

A particular concern from our side is what and who should be protected, and how to reduce our attack surface, especially for those at risk, such migrants or LGBTQ+ persons, who are being put at risk through the use of surveillance techniques and deficient privacy and security practices in apps targeting those audiences.

Strong principles and safeguards should always apply when governments intend to affect our right to privacy. As we have said before, cybersecurity means protecting individuals, networks and devices, where privacy and security should go together, not choosing one over the other.

This has also been an important challenge for our international partners. The Privacy International Network has been working to frame cybersecurity and human rights as a ‘perfect match’ in Latin America, countering dangerous government narratives on cybersecurity in Africa.

And this work is still ongoing. This year, our partners’ work has been focused on the relation between security and privacy, and on improving policy makers’ ability to work on privacy and cybersecurity issues.

In Peru, our partners from Hiperderecho published a series of articles called “Seguridad es Privacidad” (Security is privacy), analysing how Peruvian laws have been constantly undermining the right to privacy in favour of security, including a timeline of developments that started almost 25 years ago, in 1995.

Beyond its thorough revision of the Peruvian surveillance framework across multiple domains, Hiperderecho’s approach is clear and direct: We don’t need to ‘balance’ privacy and security, we need to understand that actually in most contexts Privacy is indeed the best public policy to achieve Security. Just as Miguel Morachimo, Hiperderecho’s executive director, said in his article: “Privacy for all is an excellent public policy to achieve security. Only with secure and tamper-proof technologies, clear rules and limits and strict necessity and proportionality criteria we can be truly secure.”

In Kenya, our partners from the Centre for Intellectual Property and Information Technology Law (CIPIT) of the Strathmore University decided to take a practical approach and aim directly at policy makers with a checklist for legislative drafting & interpretation in Kenya. The guide aims to address the ongoing trend of quick and reactionary legislative processes that are happening around the world, equipping decision makers with up-to-date knowledge on international standards on privacy and security in the digital world.

An interesting aspect of CIPIT’s guide is that it offers specific ways to address different interests and rights at stake, to reconcile and maximise them instead of adopting a zero-sum game where one issue (security, in this case) has to prevail over other rights. This usually happens almost by default, sometimes without identifying legitimate interests, alternative means to achieve the stated goals, or safeguards to prevent from misuse, among other necessary elements to develop regulations on this area.

In Indonesia, our partners from ELSAM developed a guide to map and identify issues related with cybersecurity and human rights, to help the development of cybersecurity regulations in the country, from both a legal and a technical perspective.

After analysing the current national framework on the issue, and comparative policies, legislations and best practices, ELSAM highlighted a number of necessary elements that the Government needs to keep in mind when designing a national cybersecurity framework, including: regulating and setting a vision for policy development, identifying and prioritising critical infrastructure, forming a team dedicated to incident response, and conducting a threat assessment and developing a recovery plan.

ELSAM’s report also confirms two things: first of all, that in some countries like Uganda, Thailand, Pakistan, Vietnam and Egypt, cybercrime laws have been misused by governments against activists, journalists and other human rights defenders. Secondly, it helps highlighting that presently there is not an internationally agreed concept of cybersecurity, confirming something we stated at the beginning of this article: that cybersecurity remains a disputed concept.

What next?

If we want to move the conversation forward, we need to seriously address the role of human rights in this process, not as an afterthought, but as an essential element in cybersecurity policy. Beyond generic claims for human rights protections, there is a pressing need to elaborate on how those protections should look like and how to embed them by default and by design in all the regulations and practices that they generate.

In relation with cybercrime, beyond avoiding its use to expand surveillance powers, there are important challenges to address: How to interpret them? What type of crimes should they cover? How to implement the Budapest Convention in a manner consistent with human rights?

In general, the global discussion is very far from over. There are diverse debates and forums around cybersecurity in different venues, including international organisations, high corporate levels, standards bodies, and national governments, among others. Different groups of experts, high-level commissions, forums and events are dealing with cybersecurity discussions, and the scenario is only getting more complex.

For example, the role of disinformation and the weaponization of data wasn’t present in the cybersecurity agenda 5 years ago, and now many cybersecurity policies and laws are increasingly covering related issues, in many cases with disastrous effects for our fundamental rights.

We need to understand and prevent real threats to cybersecurity instead of criminalising technical research or independent journalism. We need to develop law policies and technologies that enable people instead of repressing them. Instead of vague national security concerns, what we need to do is to put people and their rights at the centre of these debates.

Learn more

Cyber Security

More about our partner

The Institute for Policy Research and Advocacy (ELSAM)

Audiences and Purpose

Helping partners and other NGOs know our stance

What Pi is calling for

Technologies, laws, and policies contain modern safeguards to protect people from exploitation.

People and communities empowered to protect their data and rights, resist and object to exploitation by governments and industry.

Data should be protected

Responsible security

Hacking Safeguard 2 Security and Integrity of Systems

Change

Content

Impact

News and Analysis

Reports

State of Privacy Indonesia

tech-admin — Sat, 26 Jan 2019 15:33:28 +0000

State of Privacy Indonesia tech-admin Saturday, January 26, 2019

Introduction
Right to Privacy
Communication Surveillance
Data Protection
Identification Schemes
Policies and Sectoral Initiatives

Introduction

Acknowledgment

The State of Privacy in Indonesia is the result of an ongoing collaboration by Privacy International and The Institute for Policy Research and Advocacy (ELSAM).

Key privacy facts

1. Constitutional privacy protection: The constitution does not explicitly mention privacy.

2. Data protection law: Indonesia currently has no data protection law.

3. Data protection agency: Indonesia currently has no data protection law agency.

4. Recent scandal: the purchase of an internet censorship system by the Ministry of Communication and Information Technology triggered fears of surveillance.

5. ID regime: Indonesia has a biometrics-based identity card scheme, e-KPT required to obtain passports, driving licenses and the state health insurance card.

Right to Privacy

The constitution

Indonesia's Constitution does not explicitly mention privacy. However, Article 28(g) protects the right to dignity and “to feel secure”, concepts that are often related to the right to privacy in national constitutions:

“(1) Every person shall have the right to protection of his/herself, family, honour, dignity, and property, and shall have the right to feel secure against and receive protection from the threat of fear to do or not do something that is a human right.”

Article 28(f) guarantees the right to communication, though it does not mention privacy:

“Every person shall have the right to communicate and to obtain information for the purpose of the development of his/her self and social environment, and shall have the right to seek, obtain, possess, store, process and convey information by employing all available types of channels.”

Regional and international conventions

The Indonesia has ratified a number of international human rights treaties with privacy implications. These include:

Communication Surveillance

Introduction

In 2014, there were 29.6 million fixed phone subscriptions in Indonesia, corresponding to just over 30 subscriptions per 100 people, according to statistics collected by the International Telecommunications Union. That year, there were 319 million mobile subscriptions, representing approximately 116.8 subscriptions per 100 people.

According to the International Telecommunications Union (ITU), 20.4 % of Indonesians used the internet in 2016. We Are Social, a social media consultancy, put this figure slightly higher at 72.7 million Indonesians using the internet as of 2015, representing a penetration rate of 28 % of the population.

Indonesians are active users of social media platforms. The most popular platforms in the country are Facebook, WhatsApp and Twitter, according to the same study.

Surveillance laws

The 1998 Decree of the Consultative Assembly (TAP MPR) No. 17/MPR/1998 asserts various protections around freedom of expression and association and communication, though it does not specifically enshrine privacy as a right.

Law No 39 of 1999 states that Indonesia has a responsibility to honour and implement the Universal Declaration of Human Rights and other international instruments on human rights, which by extension would ensure the right to privacy as per Article 12.

Law No. 36 of 1999 states in article 4 that “the state has authority on telecommunication and the government has power to its development,” which could be construed as giving the government a wide mandate over communications content. Article 21 states:

“A telecommunications operator is prohibited from engaging in telecommunications operations business, which violates the public interest, morals, security or public order.”

Article 41 of this law, also known as the “Law of Telecommunication", states:

“In order to prove the truth, the use of telecommunications facilities at the request by users of telecommunications services, the providers are obliged to record the use of telecommunications facilities used by the users, and to record the information in accordance with laws and regulations.”

Article 42 outlines the procedure for access to intercepted communications:

“For the purposes of the criminal justice process, telecommunication service providers may record the information sent and/or received by telecommunication service providers and provide the information as needed, by:

Written request from General Attorney and/or the Chief of Indonesian Police for specific criminal acts;
Request from investigators for specific criminal acts in accordance with applicable law.”

Furthermore, written requests for information must include “[o]bjects that were recorded; b. Recording period; and c. Period of time to report the results.”

In 2006, the MCIT issued Ministerial Regulation 11/PER/M.KOMINFO/ 02/2006 of 2006 to facilitate intelligence and law enforcement's direct access to telecommunications networks. Article 1(9), for example, provides that “lawful interception” means the interception of information activities conducted by law enforcement agents for the purposes of law enforcement, the results of which are sent to a monitoring center controlled by law enforcement agencies.

A provision for communications interception is included in Law No. 11 of 2008 on Electronic Information and Transactions (EIT). Article 31(4) calls for the government to issue a regulation on the matter of wiretapping. The EIT also contains a provision (Article 26) that prohibits the use of any personal data through electronic media without the consent of that person.

The Law on State Intelligence passed in October 2011 broadly authorizes the Indonesian State Intelligence Agency (BIN) to engage in eﬀorts “to prevent and/or to fight any eﬀort, work, intelligence activity, and/or opponents that may be harmful to national interests and national security” (article 6). This may include communications surveillance. Civil society advocates in Indonesia had denounced the draft bill, which was nevertheless passed.

In December 2014, the Parliament released a proposed list of bills to be considered priorities. The list included a number of bills relating to communications surveillance and privacy, including the Draft Bill on Interception Procedure, the Draft Bill on Mutual Legal Assistance, the Draft Regulation on Protection of Personal Data in Electronic Systems (passed in December 2016), and the Draft Presidential Regulation on a National Interception Center.

There is a general requirement under Government Regulation 82 that the electronic system operator must appoint a certified expert in the fields of electronic systems and information technology. The term “electronic system operator” is defined to mean any person, state official, business entity or society that provides, manages and/or operates, jointly or singly, an electronic system for the users of the electronic system for the operator's interest and/or others.

Surveillance actors

Intelligence/security agencies

The Indonesian government's law enforcement and intelligence functions are spread across a number of civilian and military agencies, each of which has some capacity for communications surveillance. These include:

The Strategic Intelligence Agency ('Badan Intelijen Strategis', BAIS): this agency is under the command of the Indonesia National Armed Forces Headquarters.
The State Intelligence agency ('Badan Intelijen Negara', BIN): formerly BAKIN, BIN is responsible both for co-ordinating information sharing and operations between other intelligence agencies, and is directly answerable to the President.
The “National Crypto Agency” (Lembaga Sandi Negara): this is a non-ministerial government agency engaged in protecting the security of state secret information, and in gathering signals intelligence. Its operations and structure are mandated by Presidential decree.
The Indonesian National Police (Kepolisian Negara Republik Indonesia): the nation's official police force also has communications surveillance capacities.
The Corruption Eradication Commission (KPK): according to Law number 30 of 2002, the KPK can carry out communications interception, though this has been challenged in court in 2003 by two Public Election Commissioners who alleged they had had their communications intercepted by the KPK.

A number of smaller operational units, like the Special Forces Unit (Komando Pasukan Khusus, or Kopassus), reportedly have communications surveillance capacities. In 2013, it was reported that the government was establishing a Central Intelligence Committee, which would be coordinated under the State Intelligence Agency (BIN).

Surveillance capabilities

Dual-use equipment

In 2013 UK-based surveillance company Gamma TSE sold the Indonesian military US$ 6.7 million worth of equipment as part of the military's weapons modernisation effort. The House Commission on Defense and Information assured legislators that the mysterious equipment would not be used for “purposes outside the TNI’s duties and functions”.

As early as 2005, Indonesian officials were soliciting the advice of a close partner of Gamma, Germany-based Elaman, to create a technical surveillance unit (TSU), according to a white paper published as part of the WikiLeaks SpyFiles. The nature of these technologies and/or advisory services is unclear.

A freedom of information request filed by members of the German parliament revealed that German companies obtained licenses to sell surveillance technologies to Indonesia in 2004, 2010, 2011 and 2012.

IMSI catchers

In response to a freedom of information request by Privacy International, Swiss authorities revealed that companies in Switzerland had received a license to export mobile phone monitoring technology, most likely an IMSI catcher, to Indonesia.

A Motherboard investigation has also revealed the UK had granted licenses to export telecommunications interception technology to over a dozen companies. Indonesia was among the countries to whom those companies were granted the right to export. Among those licenses, 33 were explicitly for IMSI catchers and two of those 33 licenses pertained to exports for Indonesia.

Intrusion malware and other software

In August 2012, researchers at the Citizen Lab scanned IP addresses and fingerprints for the characteristic command-and-control protocol of FinSpy, an intrusion malware sold to governments, on Indonesian servers. Among the observed servers was an IP address owned by Indonesia ISP Biznet. Researchers documented evidence of four additional command-and-control servers in Indonesia in March 2013 on three IP addresses belonging to Biznet, PT Matrixnet Global Indonesia, and PT Telkom.

Research by Citizen Lab showed Indonesia used FinFisher and based its server in Australia.

Foreign government surveillance

In February 2014, the New York Times reported that Australia’s signals intelligence agency, DSD, had infiltrated an Indonesian mobile phone company and stolen nearly 1.8 million encryption keys used to protect communications.

In 2015, documents released by NS whistleblower Edward Snowden dating from 2009 revealed that New Zealand's Government Communications Security Bureau (GCSB) had also been spying on communications of neighboring countries, including Indonesia.

Internet crawling

The Ministry of Communication and Information Technology contracted state-owned company PT Industri Telekomunikasi Indonesia to implement an internet censorship stystem aimed at identifying and blocking websites containing pornography and content deemed reprehensible. Following concerns that the government would use deep-packet inspection to identify the content, the ministry issued a statement to say the system would only conduct crawling.

Surveillance oversight, checks and balances

The Ministry of Communication and Information Technology (MCIT) is responsible for policymaking around the telecommunications industry. The Ministry's functions include the “formulation of national policy, policy implementation, and technical policies in the field of communication and informatics, including the postal, telecommunications, broadcasting, information technology and communications, multimedia services and the dissemination of information.”

The Directorate General of Post and Telecommunication (DGPT), which falls under MCIT, is responsible for licensing and legal compliance, apparently also in relation to surveillance, and supervision of operators. Another industry regulatory body, albeit with a less clear function, is the Indonesian Telecom Regulatory Authority. It is responsible for developing regulatory policy around telecommunications, including through public consultation.

On October 2016, the Indonesian Parliament introduced the right to be forgotten with an amendment to Law No. 11 of 2008 on Electronic Information and Transactions. The amendment requires electronic system operators to delete irrelevant electronic information and/or documents under their control at the request of the relevant person, once a court decision has approved the request.

Surveillance case law

Privacy International is not aware of any surveillance case law in Indonesia. Please send any tips or information to: research@privacyinternational.org

Examples of surveillance

A 2015 poll revealed that Indonesians consider technology to have had a mostly negative impact on privacy rights and think there is a lack of sufficient legal safeguards in the country to protect privacy.

Indonesia has seen both high-level surveillance scandals and widespread reports of surveillance against activists, journalists and other public citizens. In 2011, Human Rights Watch revealed systematic surveillance of activists and journalists in West Papua, a highly militarised region of the country that has witnessed significant separatist activities. According to leaked documents, Indonesia’s Special Forces unit 'Kopassus' had been illegally surveilling “a broad swathe of Papuan political, traditional, and religious leaders, and civil society groups.” Kopassus has also been accused of torture and other grave crimes.

Activists and journalists routinely allege physical and communications surveillance.

Data Protection

Data protection laws

The Communications and Information Ministry is aiming to have the House of Representatives debate the draft of the personal data protection bill, it was listed in the 2018 national priority legislation programme.

In December 2016, the Minister of Communication and Informatics issued a Regulation on Personal Data Protection in Electronic Systems. It is an implementing regulation for the Electronic Information Law and Government Regulation 82. The regulation provides detailed instructions on how to properly acquire and collect, process and analyse, store, display, announce, transmit, disseminate and/or provide access to, and/or delete personal data. The Regulation also provides for sanctions for companies failing to comply.

Currently, data protection is regulated under the constitution. Article 28G that reads:

“Every person shall have the right to protection of his/herself, family, honour, dignity, and property, and shall have the right to feel secure against and receive protection from the threat of fear to do or not do something that is a human right.”

According to ELSAM in their publication "Protection of Personal Data in Indonesia, A Proposal for Policy Institutionalisation from the Human Rights Perspective", protection of personal data have also been included in various pieces of legislation in Indonesia, including:

Law No. 1 of 1946 on the Criminal Code (KUHP);
Law No. 8 of 1981 on the Criminal Procedure Code (KUHAP);
Law No. 8 of 1997 on Corporate Documents (Corporate Documents Law);
Law No. 10 of 1998 on Banking (Banking Law);
Law No. 8 of 1999 on Consumer Protection (Consumer Protection Law);
Law No. 23 of 1999 on Bank of Indonesia (Bank of Indonesia Law);
Law No. 31 of 1999 on the Eradication of the Crime of Corruption (Anti-Corruption Law);
Law No. 36 of 1999 on Telecommunications (Telecommunications Law);
Law No. 39 of 1999 on Human Rights (Human Rights Law);
Law No. 30 of 2002 on the Commission for the Eradication of Corruption (Anti-Corruption Commission Law);
Law No. 15 of 2003 on Stipulation of GR in Lieu of Law No. 1 of 2002 on the Eradication of the Crime of Terrorism (Anti-Terror Law);
Law No. 18 of 2003 on Legal Advocates (Advocate Law);
Law No. 29 of 2004 on the Medical Practice (Medical Practice Law);
Law No. 23 of 2006 on Population Administration (Population Administration Law);
Law No. 21 of 2007 on the Eradication of the Crime of Human Trafficking (Anti-Human Trafficking Law);
Law No. 11 of 2008 on Electronic Information and Transaction (EIT Law);
Law No. 14 of 2008 on Freedom of Information (FOI Law);
Law No. 21 of 2008 on Islamic Banking (Islamic Banking Law);
Law No. 35 of 2009 on Narcotics (Narcotics Law);
Law No. 36 of 2009 on Health (Health Law);
Law No. 43 of 2009 on Archiving (Archival Law);
LawNo.44 of 2009 on Hospitals (HospitalLaw);
Law No. 8 of 2010 on the Prevention and Eradication of the Crime of Money Laundering (Anti-Money Laundering Law);
Law No. 18 of 2011 on the Amendment of Law No. 22 of 2004 on the Judicial Commission (Judicial Commission Law);
Law No. 21 of 2011 on the Financial Services Authority (Financial Services Authority Law);
Law No. 9 of 2013 on the Prevention and Eradication of the Crime of Terrorism Funding (Financing of Terrorism Law);
Law No. 7 of 2014 on Commerce (Commerce Law);
Law No. 18 of 2014 on Mental Health (Mental Health Law); and
Law No.36 of 2014 on Medical Personnel (Medical Personnel Law).

Accountability mechanisms

There is currently no specific accountability mechanism to which data protection breaches can be referred. However, the EIT law states that complaints on criminal allegations regarding personal data should be submitted to officers from the Ministry of Communication and Information.

Data breaches: case law

Privacy International is not aware of any case law related to data breaches in Indonesia. Please send any tips or information to: research@privacyinternational.org

Examples of data breaches

Privacy International is not aware of any examples of data breaches in Indonesia. Please send any tips or information to: research@privacyinternational.org

Identification Schemes

ID cards and databases

In 2010, the Indonesian government launched the e-KPT (Karty Tanda Penduduk), a new biometrics-based identity card to replace the former cards. The ID card registration involves taking a photo, a digital signature, ten fingerprints, both iris images and biographical information, including religion. The project was launched to address voter fraud and terrorism.

The e-KPT is required to obtain passports, driving licenses and the state health insurance card. In August 2016, the Home Affairs Minister called for all citizens to apply for an e-KPT before 30 September, as over 22 million Indonesians had not yet registered for it.

In 2018, the religion minister proposed the launch of a marriage card for muslims married couples to replace the marriage books currently in place.

Voter registration

According to the Asia Foundation, in 2009 up to 20 % of the electorate was unable to vote due to inaccurate voter rolls. As of 2014 there was still a large discrepancy between election commission voter registration figures and ID card data from the Ministry of Home Affairs.

Currently, voters can vote with either their e-KTP or a residence certificate issued by the Civil Registry and Demography Agency. According to the Regional Elections law, the e-KTP will become mandatory in order to vote in elections starting in 2019.

SIM card registration

In August 2014, it became mandatory for all prepaid SIM card users to register their personal information with mobile operators. Existing prepaid mobile customers were given a six month period to register their mobile line at their operator’s outlets, according to the industry regulator.

A ministerial decree is making it mandatory to register SIM cards with the national ID card (KTP) and the Family Card (Kartu Keluarga) by February 28th 2018. Phone users who fail to register will face suspension of their phone service.

Policies and Sectoral Initiatives

Cybersecurity Policy

According to the Minister for Political, Legal and Security Affairs, Indonesia is experiencing 50,000 cyber attacks every day. In June 2015, the minister announced the creation of a National Cyber Agency with the aim of defending the country against cyber attacks and raising public awareness about the issue. One of the Agency's expected task will be to "monitor all online activity for indications of attack, such as hacking."

Cybercrime

Law No. 11 of 2008 on Electronic Information and Transactions (EIT) defines a number of cybercrimes and sets out punishments for them. Chapter 7 lists the following prohibited acts:

Material against propriety (article 27(1));
Gambling material (article 27(2));
Material amounting to affront and/or defamation (article 27(3)); and
Extortion and/or threats (article 27(4)).

On October 2016 the Indionesian Parlement amended the law. The amendment included a provision on criminal investigations. It allows investigatiors to request information in electronic systems and "to receive reports, investigate and arrest internet users suspected of violating the law." They are also allowed to "access restricted Election Data or Electronic Systems that are engaged in criminal conduct such as cybercrime, and are authorised to carry out raids (without a court warrant)."

Encryption

Privacy International is not aware of any privacy issues related to encryption in Indonesia. Please send any tips or information to: research@privacyinternational.org

Licensing of industry

Indonesia’s largest telecommunications network and service provider is Telekomunikasi Indonesia (Telkom). At 38.2 % of the market share, the mobile phone business segment (particularly prepaid) still accounts for the largest share of Telkom’s revenues, according to Indonesia Investments, an advisory service. Other major providers include Indosat, 3, XL Axiata and Smartfren.

The two largest in terms of subscriber base, Telkom and Indosat, are partially government-owned. The government holds 51% ownership of Telkom and 14 % of Indosat.

Indonesia has over 300 internet providers. Thirty-five of these own network infrastructure, according to RedWing, a tech industry advisory service. Indonesia has at least two internet exchange points. The Indonesia Internet Exchange (IIX) is maintained by the Association of Indonesian Internet Service Providers (APJII). Another internet exchange point, OpenIXP, is operated by the Indonesia Data Center (IDC).

In 2014, the government created the ‘Indonesia Broadband Plan’. Through the project, it hoped to provide broadband internet to 30 % of the Indonesian population by 2019.

E-governance/digital agenda

E-governance was first officially introduced to the Indonesian public administration by Presidential Directive No 6/2001 on Telematics.

A 2014 UN Survey revealed that Indonesia had not reached the same level of e-government penetration that other countries in the same income group had. In May 2015, Indonesian President Joko ‘Jokowi’ Widodo issued Presidential Instruction No 7/2015 to request the creation of an online system to prevent corruption. It would be an “integrated online system for central and local government budgeting, procurement, purchasing, auditing and taxation [and] could strengthen monitoring and improve government accountability.”

The city of Surabaya in East Java has developped a platform to allow its resident to manage their financial matters online.

Health sector and e-health

The e-KPT is needed to obtain a state health insurance card, in order to gain access to free health insurance and a wide range of public health services.

Smart policing

In November 2017, the Indonesian police announced they were working on an advanced CCTV system designed to detect the faces of wanted criminals. Once the system identifies a wanted person, it activates an alarm. The CCTV is expected to be deployed at police stations, airports and harbors.

Transport

Buses are currently the only public transport available in Jakarta and customers uses prepaid tickets that can be purchased in cash at the stations. Jakarta is expected to open the first phase of its Mass Rapid Transit track to the public in 2018.

One focus of Jakarta's Smart City Program (see below) is to ease traffic congestion and improve efficiency of public transport by providing accurate information on services. The privacy implications are not yet clear, but the city appears to be moving towards more digital management of transport and other services.

Google, alongside China's Meituan-Dianping and Singaporean sovereign fund Temasek invested $1.2 billion in the hail-railing service Go-Jek.

Smart cities

In December 2014, the government announced the launch of Smart City Jakarta. An operation centre was created to monitor and respond to complaints from citizens.

Until then, residents had already been using Qlue, an app to report traffic accidents, crimes and natural disasters by submitting location-tagged photos. The new operation centre integrates reports from Qlue. The government plans on integrating the largest government units -- transport, public utilities, health, sanitation, tax and local government -- to the operation centre.

In July 2017, Jakarta hosted the Indonesia International Smart City Expo & Forum, a trade show where stakeholders met to promote the development of smart cities in Indonesia. According to Metro TV News the Indonesian government plans on spending more than US$ 420 billion for "various infrastructure projects including telecommunication infrastructures."

Other cities than Jakarta are turning to smart city intiatives: Bandung was the first city to have a Command Centre, Makassar offers resident a smart cards for cashless transactions and has implemented a surveillance system for road monitoring, Medan is workign on developping a smart transportation system.

Migration

In 2011, Indonesia started issuing biometric passports. The passports contain a chip and personal data including iris scans, fingerprints and dental records.

Emergency response

With regular flooding, seismic activity and volcanoes, Indonesia is a country that is prone to natural disaster. The Indonesia Agency for the Assessment and Application of Technology (BPPT) is collecting data from the environment but also from the public. According to GSMA, which has organised a workshop with the BPPT, the BPPT collects a huge amount of data that it may share with key contacts. A slideshow from the National Agency for Disaster Management also reveals that this agency collects information about the public.

Humanitarian and development programmes

The US Agency for International Development (USAID) is providing support to Indonesia on disaster response. Their Jakarta office includes “information management” as one of their missions. It is unclear whether USAID accesses the data collected in humanitarian and development programmes or whether this is exclusively retained by the Indonesian government.

Humanitarian OpenStreetMap Team (HOT) has worked to develop maps of populations at risk of natural disaster. They have worked with universities, local governments and ACCESS, a USAID programme.

Social media

According to a report from Global Information Society Watch 2014, Papuan activists said they feared being "physcially harmed by security forces" if they posted controversial content on social media and were largely resorting to self-censorship.

List Icon (DO NOT USE)

List Image (DO NOT USE)

Location

The Institute for Policy Research and Advocacy (ELSAM)

Related learning resources

State of Privacy

More about our partner

Content

Reports

Change

We uncover and expose

Summary

A study of privacy and surveillance issues in Indonesia. The State of Privacy project was last updated on January 2019, unless otherwise provided on specific pages.

Submission on Indonesia's Draft Law on the Protection of Personal Data, 2018

staff — Wed, 19 Dec 2018 16:13:15 +0000

Content

Since 2014 the Indonesian Ministry of Communication and Informatics (MOCI) has been proposing that the Parliament passes a comprehensive data protection law. A first draft data protection law was issued by the Government for public comment in 2015 but no progress was made, and then in early 2018, the Indonesian Government issued a new draft personal data protection law.

While these renewed efforts have positive intentions, a number of concerns ought to be addressed with the aim of strengthening the data protection framework in Indonesia. The Protection of Personal Data Bill proposed has a number of significant shortcomings.

Our analysis of the proposed Bill recommends that to effectively protect privacy and to meet international standards in protecting personal data, consideration must be given to the areas of concern and improvements outlined in our submission.

As the legislative process continues, Privacy International is calling for an open, constructive and consultative process. Privacy International hopes to contribute constructively to the next steps of this process along with the national civil society organisations in Indonesia.

Our priority is to ensure that the highest data protection safeguards are encoded in law and effectively enforced so that people in Indonesia are protected from undue harm and they are able to fully exercise the enjoyment of their fundamental rights and freedoms.

To find out more about privacy and data protection in Indonesia, please refer to ‘The State of Privacy in Indonesia’ (last updated in February 2018).

We take the opportunity to share our guide for policy engagement on data protection "The Keys to Data Protection". The guide is intended to help organisations and individuals improve their understanding of data protection, by providing a framework to analyse the various provisions which are commonly presented in a data protection law.

Repeating Image and Text

Location

Indonesia

Asia

Democracy portfolio country

Off

More about our partner

The Institute for Policy Research and Advocacy (ELSAM)

Country of Operation

Region of Operation

Website

Modernise the Rule of Law and Strengthen Surveillance Safeguards

Our campaign

We must compel governments to promote and respect the highest data protection standards.

Despite increasing recognition of the need for new protections across the world, there is still a lack of legal and institutional frameworks, processes, and infrastructure. Even countries with data protection laws often lack effective implementation and enforcement or have not updated their legislation to address current uses (and abuses) of personal data.

Civil society organisations are needed to engage in these policy processes. Our experience has shown that when civil society is involved, the process is more inclusive, open and richer.

With this objective in mind, PI has developed a guide for civil society. This is a tool for analysing proposed data protection law and assessing existing legislation to identify any shortcomings. It also provides the basis to advocate for comprehensive, enforceable data protection laws to hold the public and private sector accountable.

Please reach out to us via social media or email if you have any feedback on the guide.
@privacyint
info@privacyinternational.org

To keep in touch with our advocacy work on data protection, sign up to our mailing list!

Learn more

Data Protection laws seek to protect people's data by providing individuals with rights over their data, imposing rules on the way in which companies and governments use data, and establishing regulators to enforce the laws.

What PI is fighting for

Modernise Data Protection Law

Advocating for strong data protection around the world.

Will New Government In Indonesia Bring About Surveillance Reforms?

staff — Mon, 02 Feb 2015 12:33:47 +0000

Language English

Late last year, the newly-elected government of Indonesia began to take steps which are almost unheard of today: reforming government communications surveillance powers.

The much-needed development, on the back of the victory of President Joko Widodo, comes at a critical moment in the country's history as the relationships that Indonesians have with technology are changing and growing rapidly. A recent poll revealed that Indonesians consider technology to have had a mostly negative impact on privacy rights and think there is a lack of sufficient legal safeguards in the country to protect privacy. This comes even as Indonesians have a relatively positive view of technology, according to the poll, seeing its benefits in business, innovation, and their everyday lives.

While past changes to surveillance laws only went to expand the powers of government to conduct communications surveillance, the new government now has a unique opportunity to show a willingness to create new laws that better protect the right to privacy, while also reforming existing laws that threaten privacy. Current laws allowing for surveillance suffer from vague language and weak oversight. Indonesian security services have previously been accused of unauthorised conducting surveillance on activists. Recent stories indicate that the Indonesian government's appetite for procuring communications surveillance technology has been increasing. These facts make the proposed changes, while overdue, all the more important.

The Privacy Prolegnas

The Indonesian government's legislative programme, known as prolegnas, sets the legislative priorities for the new government led by the President Widodo. Widodo, elected in 2014, was presented as a change to the past lineage of leaders drawn from the political or military elite. In December 2014 a proposed list of bills to be considered priorities was released, which included a number of bills relating to communications surveillance and privacy. Specifically, these included the Draft Bill on Interception procedure, the Draft Bill on Mutual Legal Assistance, the Draft Bill on Protection of Personal Data and Information, and the Draft Presidential Regulation on [a?] National Interception Center. While these bills are yet to be drafted and their provisions analysed, the inclusion of them in the prolegnas would represent an important step towards much needed reform. Before the bills are drafted, however, the prolegnas must be agreed upon. Right now that is facing problems.

The priorities of the prolegnas appear to be the subject of extensive political debate between two rival coalitions in the legislative body, the ruling Great Indonesia Coalition, led by the President, and the opposition Red-and-White Coalition. It is critical that, even during these debates, that proposals to overhaul surveillance in Indonesia are addressed in a real and substantive way, given Indonesia's past experiences with surveillance.

Past experiences with problems of surveillance technology may have negatively affected Indonesians' appreciation of technology. In 2011 internal military documents exposed the Indonesian miitary's surveillance of peaceful activists, politicians, and clergy in the province of Papua without any form of judicial warrant. Indonesia has also been tied to the purchase of advanced surveillance technology from Gamma Group that allows for access to devices and networks. Recent revelations, spurred by PI's work in Switzerland, show that companies in Switzerland had received a license to export mobile phone monitoring technology known as IMSI Catchers to Indonesia. It is unclear how any of these capabilities are regulated by Indonesian law.

The Promise of a New Government

The last landmark piece of Indonesian legislation relating to privacy was a 2011 reform of the intelligence gathering activities in Indonesia. The State Intelligence Law allowed for expansive scope of surveillance through vague wording, allowing for "significant intelligence gathering over opponents of national stability". This law came into force in spite of significant protest from civil society that the law allowed the Indonesian intelligence agency to intercept communications without the approval of a court.

Given this history, it is understandable why Indonesians are so concerned. As the new government considers bills on interception, the previous mistakes cannot be repeated.

To ensure that the reforms are meaningful, civil society organisations must be consulted on the drafting of these bills. Organisations such as ELSAM and ICJR are essential participants in this process, as their work in the past has done a lot to benefit Indonesians' understanding of the policies surrounding technology. Questions should also be asked as to whether the State Intelligence Law remains fit for purpose.

While the devil will be in the details for the new proposals, even the intention is a welcome sign. Too often Indonesians have witnessed their government purchasing and using surveillance technology without making the changes necessary to operate them in accordance with the law. Now is an opportunity to reverse that trend.

Large Image (DO NOT USE)

List Image (DO NOT USE)

List Icon (DO NOT USE)

What PI is fighting for

Learn more

Communications Surveillance

Location