On 3 November 2026, Bareskrim Polri named three suspects in an investigation into alleged unlawful interception, data deletion and illegal access. The case remains under investigation, and no court has determined guilt. It raises a question about when the state may lawfully intercept communications.
Wiretapping concerns more than public officials. Employees, journalists, businesses and ordinary people use networks that may be intercepted. Contact with someone under investigation may also draw others into an inquiry.
Investigative power is not unlimited. Indonesian law distinguishes authorised interception from conduct outside statutory authority. Unlawful interception may attract criminal liability where offence elements are established. Not every procedural irregularity is a crime.
Understanding Wiretapping Under Indonesian Law
The Criminal Procedure Code (“Law No. 20 of 2025”) defines wiretapping as covertly obtaining personal information for law enforcement. It includes listening to, recording, diverting, obstructing, altering or connecting communications, installing network or concealed recording equipment, and noting electronic transmissions over wired, wireless and internet networks. Searches of stored data and subscriber-record requests are separate legal acts.
Article 40 of the Telecommunications Law prohibits interception of information transmitted through telecommunications networks. Article 42 protects customer confidentiality but allows operators to record and provide information for criminal proceedings on written requests from the Attorney General and/or National Police Chief for specified offences, or investigator requests for offences authorised by law. This concerns operator-held information, not general interception.
Article 31(3) of the ITE Law exempts law enforcement interception requested by the Police, prosecutors or other institutions empowered by law. Paragraph (4) leaves procedure to a separate statute. Article 258 of the Criminal Code, effective from 2 January 2026, criminalises specified unlawful interception of non-public electronic transmissions. Paragraph (3) excludes only paragraph (1) for conduct under legislation or official orders within Articles 31 and 32. Paragraph (2) separately criminalises the dissemination of intercepted conversations or recordings. Legality depends on authority, purpose and compliance with statutory limits.
When May Authorities Legally Intercept Private Communications?
Authority must come from legislation. Article 136 of the Criminal Procedure Code allows investigators to intercept for investigations, but paragraph (2) leaves the rules to a separate interception law that has not been enacted. Article 31(4) of the ITE Law also anticipates separate legislation. Neither provision permits unrestricted monitoring.
The Terrorism Law provides a sector-specific example. Article 31 of Law No. 5 of 2018 permits investigators, on sufficient preliminary evidence, to intercept communications suspected of being used to prepare, plan or commit terrorism offences, or locate a person or network. Prior determination by the district court head is required on written application by the investigator or superior. The one-year period may be extended once for a further year. Results remain confidential and restricted to terrorism investigations, with reporting and accountability to the investigator’s superior and a report to the ministry. Article 31A permits interception first in urgent circumstances, provided a court determination is requested within three days. Other institutions may have sectoral powers, with different procedures.
Four situations should be distinguished.
- Interception expressly authorised by legislation.
- Interception beyond the authority granted.
- Interception without required approvals or safeguards.
- Access to private data through another legal act, such as a device search.
The second and third may attract liability if the offence elements are met. Decision No. 20/PUU-XIV/2016 links the use of electronic information as evidence in law enforcement to requests by institutions authorised under Article 31(3) of the ITE Law.
What Legal Safeguards Protect Individuals From Unlawful Surveillance?
Existing safeguards include criminal liability for specified unlawful interception and sector-specific controls such as court authorisation, duration limits and confidentiality in terrorism investigations. Indonesia has yet to enact a comprehensive framework for interception authorisation, oversight and accountability.
The Constitution protects communication and access to information under Article 28F, personal security under Article 28G(1), and recognises that rights may be limited by law under Article 28J(2). Article 17 of the ICCPR, ratified by Law No. 12 of 2005, also prohibits arbitrary or unlawful interference with privacy and correspondence.
Possible reforms include oversight, proportionality tests, audits, retention rules and remedies. The Wiretapping Bill (RUU Penyadapan) is not yet law. On 5 November 2026, the Chair of DPR Commission III said it would be pushed for discussion after the Asset Forfeiture Bill is completed.
Practical Public Awareness Checklist:
- Is there a specific statutory basis?
- Is the institution legally authorised?
- Were the required approvals and procedures satisfied?
- Is interception confined to its lawful investigative purpose?
- Is the information handled and used as the law requires?
- Can suspected unlawful interception be challenged or reported?
These questions help distinguish lawful investigation from conduct beyond statutory authority. Because interception may remain confidential, notice or its absence alone cannot establish legality. Anyone with credible concerns should seek legal advice.
Interception requires a clear legal foundation and must remain within statutory limits. Accountability protects public security and individual privacy. Individuals and businesses handling confidential communications should understand these safeguards and seek advice if unlawful interception is suspected.
