Indonesia’s cyber defense strategy and its challenges

Indonesia’s cyber defense strategy and its challenges Yono Reksoprodjo ;  An Advisor to the TNI Commander, A Lecturer at the Indonesian Defense University (Unhan)

JAKARTA POST, 01 November 2012

A fast-growing economy has allowed Indonesia to increase its budget for infrastructure, education and defense. The government has proposed Rp 77 trillion (US$8 billion) for defense in 2013, up from Rp 72.54 trillion in 2012 and more than double the 2009 mark of Rp 33.67 trillion. The defense budget will be spent on the Minimum Essential Forces (MEF) defense strategy, which has been developed based on financial constraints rather than threats.  The defense budget does not reflect the country’s size and unique geographic terrain to cover, the spread of people to protect and the volume of natural resources to control. In short, the ratio of our defense capability and coverage in the region remains far from achieving a fair balance of strength with its neighboring countries. In a show of commitment to fulfilling the mosaic of the MEF blueprint defense strategy, the Defense Ministry allocated funds to acquire 44 Leopard tanks, 24 F-16 jet fighters and some warships.  Nevertheless, we should look into the psychological aspect of this arms buildup; the purchase of more conventional hardware may increase the risk of an arms race in the region.  But military modernization should not and cannot ignore asymmetric warfare capabilities, especially due to the tight budget. The Indonesian Military (TNI), known in the past for its guerrilla warfare strategy, needs to delve deeply into its creativity and develop a comprehensive approach to asymmetric warfare strategy. An asymmetric strategy combined with conventional military capability may form a hybrid warfare strategy that is believed to suit modern wars. The modern era has seen the emergence of new non-state adversaries that have brought up complexities not only on rules of engagement but also the application of warfare strategies. The al-Qaeda attack in 2001, the breakup of the Soviet Union up to the Arab Spring show that many conventional military warfare strategies are no longer adequate to solve conflicts. In the late 1950s, the US department of defense began to employ information communication technology to cope with the potential of a nuclear standoff during the Cold War. ARPANET, later known as the backbone of Internet, came as a result of collaboration between the US military and academic institutions to bring forth the era of the cybernetics network to modern society. It has been growing rapidly into a vital international data communications backbone with utilizations going beyond business communications and financial data exchange. Military, economic, cultural and socio-political information in many nations is swiftly exchanged through the cyber network.  Striking the strategic center of gravity through the cyber network is defined as asymmetric warfare.  The implementation of network-centric systems and the use of tactical unmanned machines for hybrid warfare strategy purposes, as well as the growing reliance of civilian society in maintaining its daily activities, has offered channels within the cyber network system as means of attack. Indonesia’s MEF buildup strategy has provided opportunities for combining conventional hardware with a cyber warfare strategy. Indonesia is rich in human resources with expertise in information and communication technology (ICT). Unfortunately, the military’s ICT human resources lack the capabilities and opportunities despite their creativity and capacity. The reason is the fact that the TNI has long relied on supplied facilities purchased from sourced vendors while neglecting their own self-development and utilization of home-grown products. Being online in Indonesia today is simple and cheap. A military cyber operation may only require a rental computer in a local Internet café at a meager Rp 10,000 per hour; this war machine is capable of shutting down important strategic systems of an adversary.  The most expensive part of the operation, in terms of time and cost, is preparing the capable military human resources while at the same time preparing its civilian counterpart within the strategic management level and developing commanders with proper capabilities to run cyber operations to go beyond the expertise of attacking a system, but also how to defend and exploit them. Learning from indications of concerted cyber attacks directed at Georgia and Estonia launched from Russia in 2007-2008, which Russia later denied, a method of Distributed Denial of Service (DDoS) attack managed to cripple the communication and information systems of both target countries.  Estonia received the brunt of the attack, as it is the most wired country in Europe, and the country’s financial and communications systems were hit hard. Within a week, citizens of Estonia, unable to access funds kept in various banks and conduct commercial transactions, resorted to chaos and looting.  Although there has been no proof of a country being taken over physically by a cyber attack the disturbances created have shown it is something to worry about. Such an event may occur in Indonesia mainly because not many are aware of the critical dangers of such an attack.  Indonesia has developed more cyber network infrastructure in order to link the communication and information exchange. Today, around 55 million people in Indonesia are connected through cyber space by cellular networks only. The main business activity in Indonesia remains concentrated in Jakarta. So imagine Jakarta comes under a cyber attack.  Research conducted by the Indonesia Defense University (Unhan) found that the weakest link in the Indonesian cyber network lies within its financial sector through its Internet banking system. The potential loss of a non-working bank for one day would easily reach Rp 1 trillion, and if that attack solely hit its ATM system, the potential loss might reach up to Rp 100 billion. Imagine if the attack lasted for one month.  This is a direct threat to national stability and will further directly endanger the capability of the Indonesian defense forces. In a military conflict situation, the financial aspect is one of the important key factors as a driving factor for combat logistics thus showing the connection between the civilian financial sector and the military. That is why financial institutions are high on the list along with the military’s own center of gravity. The formation of the Defense Ministry and TNI’s Cyber Defense Task Force that is taking shape today may not be able to work alone. They have to involve the Indonesian communication and financial sectors to start building up awareness of their vulnerability as key cyber warfare targets.  The Defense Ministry and TNI need to work closely with other ministries, the National Police and strategic interests governing bodies in order to draw the baseline of common understanding of terms and to define an operable rule of engagement in dealing with cyber warfare, which may look like a common cyber crime. The Defense Ministry and TNI will also have to prepare means of coordination with friendly countries as part of efforts to reduce the potential of a cyber attack by proxy.  A good awareness and mitigation program through human and vital-resources readiness, steady communication and regular exercises among institutions will help Indonesia strengthen its defense capability and beyond. ●