Members of the public access the 2024 general election supervisory application on Nov. 28 in Jakarta. - Antara
JAKARTA: An alleged data breach has hit the General Elections Commission (KPU), raising concerns about the vulnerability of the poll body’s digital security system, which analysts say can potentially compromise the upcoming elections’ integrity.
Claims of a breach in the KPU’s voter roll came to light on Tuesday (Nov 26), after an account named Jimbo posted on online hacker platform BreachForums that they were looking to sell 204.8 million pieces of unique data from the Indonesian voters list.
As proof of authenticity, the poster shared 500,000 pieces of data, which included the full name, sex, date and place of birth, marital status, full address and ID and family card numbers of voters.
The claim has since caused a stir among observers, who fear that the public might lose trust in the KPU’s digital security or the entire election process if it is validated.
The election organiser is working closely with a task force that consists of officials of the National Cyber and Encryption Agency (BSSN), the National Police’s cybercrime unit, the National Intelligence Agency and the Communications and Information Ministry to validate the breach claim, according to KPU chair Hasyim Asy’ari.
He also alluded to the possibility that the breach did not come from the KPU’s database.
“The 2024 election voter roll, in the soft copy form, exists not only in the KPU’s data centre, but also with other parties,” Hasyim said on Wednesday.
Communications and Information Minister Budi Arie Setiadi echoed Hasyim, saying that political parties participating in the elections and their candidates also have access to the voter roll.
“Law enforcement authorities, the BSSN and the KPU are currently coordinating [to identify] the perpetrator and their motives,” Budi said during a meeting with lawmakers on Wednesday.
However, observers were unconvinced that the data was breached from other sources aside from the KPU. They pointed to the fact that Jimbo included a screenshot on their BreachForums post that indicated that they had successfully accessed the KPU’s website as an administrator.
“[Jimbo’s admin] account can be used to change the voting recapitulation, which of course would harm [the election process] and could even cause chaos on the national scale,” Pratama Persadha, chairman of data security watchdog CISSReC, said in a statement.
The KPU data breach claim was the latest in a string of similar incidents over the past year, which largely targeted websites or databases of government bodies.
The breach claim came as the KPU prepares its logistics for the 2024 election, which it said was close to completion roughly two months before 204 million Indonesians, including 1.7 million diaspora voters, are expected to cast ballots on Feb 14.
KPU chair Hasyim said on Tuesday (Nov 28) that the preparation had been divided into two phases. The first one focused on the production and distribution of ballot boxes, voting booths, vials of ink and seals.
Meanwhile, the second phase included the printing and distribution of forms and ballot papers for the presidential and legislative elections.
The first phase had reached 98 per cent of the country’s total domestic need, and most of the voting materials are currently being distributed to the KPU’s regional offices. The production of the ballots, meanwhile, only started on Nov 18 and is slated to finish by Jan 16 next year.
For overseas voters, Hasyim said the commission was expecting to complete the production of all supplies by early December, before shipping it to 95 countries days later.
“Based on this data, we’re optimistic that we can finish the logistics preparation on the assigned deadline,” Hasyim said.
Despite the KPU confidence of finishing the logistics preparation on time, its Jakarta regional office reported difficulties in securing enough space to store the materials. The Jakarta KPU usually uses city-owned sports halls (GOR) to stockpile the election equipment ahead of voting day.
The commission also uses such halls for voting booths and places to recapitulate ballot papers after the polling. There are 11 GORs undergoing renovations which are slated to finish by December.
“But, as of Nov. 24, there has not been any progress,” said Jakarta KPU commissioner Nelvia Gustina on Tuesday (Nov 28), as quoted by kompas.com
The KPU also encountered a stumbling block in Hong Kong and Macau, as the Chinese government has yet given permission to set up voting booths for the February voting day in both cities. Such a condition might force the Indonesian diaspora in the region to vote by mail.
“The problem is that there is a chance that not all the ballots will reach voters in Hong Kong and Macau, who are mostly migrant workers,” KPU commissioner Idham Holik said on Tuesday, as quoted by kompas.com. “This is because the workers’ employers don’t always open their mailboxes,” he continued.
Idham added that the Overseas Election Committee (PPLN) in Hong Kong and Macau was consolidating with their respective overseas supervisory committee regarding the situation. - The Jakarta Post/ANN
