Indonesia Caught Spying: Secret Spyware Deal Exposed

According to Amnesty International, Indonesia has been covertly acquiring spyware through a complex network of intermediaries spanning from Israel to Greece, Singapore, and Malaysia. The organization asserts that its investigation has uncovered a systemic issue: many countries are unable to adequately regulate and ensure transparency in the export of dual-use technologies, which include surveillance programs and the equipment on which they are installed. The use of such technologies poses a serious threat to human rights.

During the investigation, Amnesty International utilized open-source intelligence, including commercial trade databases and infrastructure mapping, to trace purchases from 2017 to 2023. The Indonesian National Police and the National Cyber and Crypto Agency were identified as the buyers.

The suppliers included Q Cyber Technologies, associated with the infamous NSO Group, the Intellexa consortium, Saito Tech (also known as Candiru), FinFisher and its subsidiary Raedarius M8, as well as Wintego Systems.

However, these acquisitions were often made through circuitous routes via intermediary organizations established under the guise of nominal secretaries. Identifying the true owners of such firms proved extremely difficult, especially in offshore zones like Singapore.

“When the real owners hide using such methods, monitoring the supply chains of dual-use goods becomes virtually impossible. This significantly impedes public oversight of government procurements,” the investigation notes.

Furthermore, the nonprofit organization discovered that certain spyware platforms were linked to domains and infrastructure used for malicious purposes. “Among such malicious domains were websites mimicking resources of opposition political parties, as well as major national and local media, including from the provinces of Papua and West Papua, which report on human rights violations,” the human rights defenders write.

Despite references to media in West Papua, where a long-standing separatist confrontation continues, Amnesty acknowledged that it lacks data on specific individuals who might have been subjected to surveillance. Nor are there direct evidences of these technologies being used against individual targets. However, such secrecy could very well be part of the developers’ design.

Experts indicate that Indonesia simply lacks effective regulations that could prevent the misuse of spy programs.

The investigation was conducted with the participation of several other organizations, including Israel’s Haaretz, Australia’s Inside Story, Indonesia’s Tempo, the research collective WAV, and Woz.