Jakarta, Indonesia – As Indonesia accelerates its journey into the digital era, the security and authenticity of online transactions have become paramount, yet increasingly precarious. A recent high-level discussion in Jakarta, titled "The More Digital, Who Guarantees Our Safety?", brought together leading experts who underscored a critical vulnerability: the widespread reliance on internal verification systems and self-proclaimed security by digital platforms is insufficient to guarantee legal certainty and protect consumers. The consensus among panelists was clear: independent third-party verification through certified Electronic Certification Providers (PSrE) and Certified Electronic Signatures (TTE) is no longer a luxury, but an essential foundation for legally robust digital interactions. The burgeoning digital economy in Indonesia, characterized by explosive growth in e-commerce, fintech, and various online services, has transformed how individuals and businesses interact. However, this rapid digitalization has also opened new avenues for fraud, data breaches, and identity theft, exposing millions of users to significant risks. The core challenge lies in establishing trust and verifying identity in a virtual environment where traditional face-to-face interactions are absent. Without robust mechanisms to confirm who is on the other side of a transaction, the very fabric of digital trust begins to unravel. The Legal Imperative: Beyond Self-Claiming Security Edmon Makarim, former Dean of the Faculty of Law at the University of Indonesia (FH UI) and a prominent legal scholar in information technology law, articulated the fundamental shift required in the legal framework for digital transactions. "Digital transactions inherently connect parties who do not know each other directly," Makarim explained during the forum. "Therefore, identity confirmation can no longer rely on conventional methods." He delivered a stark warning regarding the legal standing of self-proclaimed security measures. Citing Article 15 of Indonesia’s Law on Electronic Information and Transactions (UU ITE), Makarim emphasized, "The security of electronic systems lacks legal evidentiary power if it merely relies on the self-claiming assertions of the platform operator. What is truly required is an independent third party, underpinned by asymmetric cryptography, operating through a verified Electronic Certification Provider (PSrE)." This legal pronouncement highlights a crucial distinction: while platforms may implement various security features, their internal claims alone do not hold up as irrefutable proof in a court of law. In the event of a dispute, the burden of proof becomes a significant hurdle if the underlying verification process is not independently certified. PSrEs, by contrast, act as trusted third parties that issue digital certificates, cryptographically binding an individual’s identity to their electronic signature or digital transaction. This provides a level of non-repudiation and integrity that internal systems cannot independently offer, thus bolstering the legal validity and evidentiary strength of digital interactions. The principle of asymmetric cryptography, central to PSrE operations, ensures that data integrity and sender authenticity can be verified without sharing secret keys, a cornerstone of modern cybersecurity. The Technical Mandate: Multi-Layered Authentication and the Threat of Account Takeover Beyond legal frameworks, the technical necessity for advanced verification was a key theme. Yudho Giri Sucahyo, an expert in information technology, elaborated on the technical requirements for building trust in the digital realm. He asserted that "trust in cyberspace must be technically proven through a process of multi-layered verification and authentication." This multi-pronged approach, he explained, must evolve beyond simple passwords to include more sophisticated methods such as CAPTCHAs, biometric scanners (fingerprints, facial recognition), and ultimately, Certified Electronic Signatures (TTE). Sucahyo specifically highlighted the critical role of authentication when users transition between devices. The failure of a system to accurately recognize the legitimate account owner on a new device poses an extremely high risk of triggering an "account takeover" (ATO). ATOs occur when malicious actors gain unauthorized access to a user’s account, often by exploiting weak authentication, phishing attacks, or compromised credentials. Once an account is compromised, the perpetrator can initiate fraudulent transactions, access sensitive personal data, and inflict severe financial and reputational damage on the victim. Such incidents, where illegal transactions are executed without the genuine account owner’s knowledge or consent, underscore the inadequacy of basic authentication protocols and the urgent need for more robust, independently verifiable methods. The sophistication of cyber threats today demands an equally sophisticated and resilient defense, making multi-factor authentication not just a recommendation, but a baseline requirement. Real-World Consequences: The Human Cost of Neglected Security The theoretical discussions about legal and technical requirements take on a stark reality when viewed through the lens of actual victims. Zico L. Djagardo, an advocate and a victim of data breach and misuse, shared his harrowing personal experience, illustrating the severe repercussions of insufficient verification systems. Djagardo became a victim of data misuse that led to fictitious financial transactions, ultimately damaging his financial collectability status – a critical metric for creditworthiness in Indonesia. His case brought to light a disturbing practice within certain digital lending platforms, commonly known as pinjol. "The online lending platform acknowledged that their internal verification system was inadequate and deliberately chose not to utilize the services of third-party verifiers (PSrE / Certified TTE) solely to cut operational costs," Zico revealed in a statement received by detikINET. This admission exposes a dangerous trade-off where short-term cost-saving measures by platforms directly translate into significant long-term risks and severe consequences for their users. The allure of lower operational overhead seemingly outweighed the imperative of robust security and legal compliance, leaving consumers exposed and vulnerable. Djagardo’s ordeal highlights the direct link between a platform’s security practices and a user’s financial well-being. The lack of independent verification meant that when fraudulent transactions occurred, there was no impartial "referee" to definitively prove the true identity of the transacting party. This ambiguity made it incredibly difficult for him to dispute the fraudulent activities and clear his name, underscoring the vital role PSrE could play in establishing clear accountability. He passionately advocated for more detailed regulations concerning Electronic Signatures, referencing a crucial stance by the Constitutional Court (MK). The MK has previously emphasized the necessity of technical implementing regulations to provide "multiple protection" for personal data owners. Djagardo argued that the involvement of PSrE is essential to act as an independent "referee," ensuring equality of evidentiary strength when disputes arise between consumers and service providers. Without such an independent arbiter, the power imbalance often leaves consumers at a significant disadvantage in legal battles against well-resourced platforms. The Economic Imperative: Trust as the Ultimate Currency The decision by some online lending platforms to bypass PSrE and Certified TTE for cost-cutting reasons presents a classic short-sighted economic strategy. While reducing immediate operational expenses might boost quarterly profits, the long-term economic implications of such practices are detrimental. A lack of robust security and verifiable transactions leads directly to increased fraud rates, which in turn results in higher operational losses for platforms, increased chargebacks, and potentially hefty regulatory fines. More significantly, the erosion of public trust can have a devastating impact. When consumers lose faith in the security and integrity of digital platforms, they become hesitant to engage in online transactions, stifling the growth of the digital economy. News of data breaches, account takeovers, and financial fraud spreads rapidly, deterring new users and driving away existing ones. For a developing digital economy like Indonesia’s, where trust is the ultimate currency, such practices threaten to undermine years of progress and investment. Investing in independent verification, therefore, should not be viewed as an expense but as a crucial investment in building a sustainable, secure, and trustworthy digital ecosystem that benefits all stakeholders – consumers, businesses, and the national economy. Government Response: Charting a Course for Digital Identity and Security Recognizing the urgent need for a more comprehensive regulatory framework, the Indonesian government is actively working to address these challenges. Aulia, representing the Directorate of Strategy and Policy for Digital Space Supervision at the Ministry of Communication and Digital (Komdigi), confirmed that the government is currently in the process of revising Government Regulation (PP) Number 71 of 2019. This revision is being conducted in close collaboration with various stakeholders, reflecting a concerted effort to create a more robust and adaptive regulatory environment. The planned revisions to PP 71/2019 are expected to be far-reaching. They will include specific regulations for handling high-risk transactions, which are particularly susceptible to fraud and misuse. Crucially, the revisions will also encompass the implementation of a national digital identity system. This national digital identity aims to provide a unified, secure, and legally recognized digital identity for all Indonesian citizens, streamlining verification processes across various digital services while simultaneously enhancing security. The goal of these regulatory updates is twofold: to establish greater certainty in digital transactions and to provide comprehensive legal protection for both industries and the wider community. A national digital identity, backed by robust PSrE infrastructure and Certified TTE, could significantly reduce identity fraud, simplify online interactions, and empower individuals with greater control over their personal data. It represents a proactive step towards building a truly secure and inclusive digital society, where the benefits of digitalization can be fully realized without compromising the safety and rights of its citizens. Towards a Secure Digital Future: Implications and the Path Forward The discussions and proposed regulatory changes signal a pivotal moment for Indonesia’s digital future. The implications of these developments are profound: Enhanced Consumer Protection: With independent verification and a national digital identity, consumers will gain a stronger legal standing in disputes, better protection against fraud, and increased confidence in digital services. The "multiple protection" framework advocated by Zico Djagardo aligns perfectly with this objective. Increased Industry Accountability: Platforms will be compelled to move beyond self-claimed security and adopt verifiable, legally recognized methods of authentication. While this may entail initial investment, it will ultimately foster a more trustworthy ecosystem, reducing long-term risks and improving brand reputation. Strengthened Legal Certainty: The integration of PSrE and Certified TTE into the legal framework will provide clear evidentiary power for digital transactions, simplifying dispute resolution and fostering a more predictable legal landscape for digital commerce. Foundation for Innovation: A secure and trusted digital identity infrastructure can serve as a bedrock for further innovation, enabling the development of new services that rely on high levels of trust and verification, from advanced fintech solutions to secure e-government services. International Alignment: Adopting internationally recognized standards for digital identity and electronic signatures can facilitate cross-border digital transactions and enhance Indonesia’s position in the global digital economy. The path forward requires continued collaboration between the government, industry players, legal experts, and civil society. Public awareness campaigns will also be crucial to educate users about the importance of secure digital practices and the benefits of using Certified Electronic Signatures and robust authentication methods. As Indonesia continues its digital transformation, ensuring that security and trust are built into the very foundation of its digital infrastructure is not merely a technical or legal challenge, but a societal imperative. The promise of a more digital future must come hand-in-hand with the guarantee of a safer and more secure one for all. Post navigation Garmin Indonesia Soars Past 1.1 Million Active Users, Signaling a New Era of Holistic Wellness in the Archipelago
