December 1, 2023
JAKARTA – An alleged data breach has hit the General Elections Commission (KPU), raising concerns about the vulnerability of the poll body’s digital security system, which analysts say can potentially compromise the upcoming elections’ integrity.
Claims of a breach in the KPU’s voter roll came to light on Tuesday, after an account named Jimbo posted on online hacker platform BreachForums that they were looking to sell 204.8 million pieces of unique data from the Indonesian voters list.
As proof of authenticity, the poster shared 500,000 pieces of data, which included the full name, sex, date and place of birth, marital status, full address and ID and family card numbers of voters.
The claim has since caused a stir among observers, who fear that the public might lose trust in the KPU’s digital security or the entire election process if it is validated.
The election organizer is working closely with a task force that consists of officials of the National Cyber and Encryption Agency (BSSN), the National Police’s cybercrime unit, the National Intelligence Agency and the Communications and Information Ministry to validate the breach claim, according to KPU chair Hasyim Asy’ari.
He also alluded to the possibility that the breach did not come from the KPU’s database.
“The 2024 election voter roll, in the soft copy form, exists not only in the KPU’s data center, but also with other parties,” Hasyim said on Wednesday.
Communications and Information Minister Budi Arie Setiadi echoed Hasyim, saying that political parties participating in the elections and their candidates also have access to the voter roll.
“Law enforcement authorities, the BSSN and the KPU are currently coordinating [to identify] the perpetrator and their motives,” Budi said during a meeting with lawmakers on Wednesday.
However, observers were unconvinced that the data was breached from other sources aside from the KPU. They pointed to the fact that Jimbo included a screenshot on their BreachForums post that indicated that they had successfully accessed the KPU’s website as an administrator.
“[Jimbo’s admin] account can be used to change the voting recapitulation, which of course would harm [the election process] and could even cause chaos on the national scale,” Pratama Persadha, chairman of data security watchdog CISSReC, said in a statement.
The KPU data breach claim was the latest in a string of similar incidents over the past year, which largely targeted websites or databases of government bodies.
Nearly finished
The breach claim came as the KPU prepares its logistics for the 2024 election, which it said was close to completion roughly two months before 204 million Indonesians, including 1.7 million diaspora voters, are expected to cast ballots on Feb. 14.
KPU chair Hasyim said on Tuesday that the preparation had been divided into two phases.
The first one focused on the production and distribution of ballot boxes, voting booths, vials of ink and seals. Meanwhile, the second phase included the printing and distribution of forms and ballot papers for the presidential and legislative elections.
The first phase had reached 98 percent of the country’s total domestic need, and most of the voting materials are currently being distributed to the KPU’s regional offices. The production of the ballots, meanwhile, only started on Nov. 18 and is slated to finish by Jan. 16 next year.
For overseas voters, Hasyim said the commission was expecting to complete the production of all supplies by early December, before shipping it to 95 countries days later.
“Based on this data, we’re optimistic that we can finish the logistics preparation on the assigned deadline,” Hasyim said.
Officials of the Jombang Regency Elections Commission (KPU) check vials of ink designated for the 2024 presidential election on Nov. 24 at the commission’s warehouse in Jombang regency, East Java. (Antara/Syaiful Arif)
Despite the KPU confidence of finishing the logistics preparation on time, its Jakarta regional office reported difficulties in securing enough space to store the materials.
The Jakarta KPU usually uses city-owned sports halls (GOR) to stockpile the election equipment ahead of voting day. The commission also uses such halls for voting booths and places to recapitulate ballot papers after the polling.
There are 11 GORs undergoing renovations which are slated to finish by December. “But, as of Nov. 24, there has not been any progress,” said Jakarta KPU commissioner Nelvia Gustina on Tuesday, as quoted by kompas.com.
The KPU also encountered a stumbling block in Hong Kong and Macau, as the Chinese government has yet given permission to set up voting booths for the February voting day in both cities. Such a condition might force the Indonesian diaspora in the region to vote by mail.
“The problem is that there is a chance that not all the ballots will reach voters in Hong Kong and Macau, who are mostly migrant workers,” KPU commissioner Idham Holik said on Tuesday, as quoted by kompas.com.
“This is because the workers’ employers don’t always open their mailboxes,” he continued.
Idham added that the Overseas Election Committee (PPLN) in Hong Kong and Macau was consolidating with their respective overseas supervisory committee regarding the situation.