Indonesia's cybersecurity needs more than a law

Indonesia first attempted to pass a cybersecurity law in 2019, and the effort has only now gained formal traction. In March, President Prabowo Subianto submitted a presidential letter to the House of Representatives, triggering deliberation on the draft of the Cybersecurity and Cyber Resilience (KKS) Bill. A working committee met in late May, and three further sessions are scheduled before the legislative term closes in July.

By the time this bill passes, Singapore will have had its Cybersecurity Act for the better part of a decade, having passed it in 2018 and revised it in 2024 after finding that the original version did not anticipate how quickly the threat environment would shift, and built up years of enforcement practice in between. Malaysia enacted its own cybersecurity law in 2024.

The gap matters not as a point of embarrassment but as a question of whether the intervening years produced any clarity about what works, what does not, and what Indonesia should do differently.