Hedging in Cyberspace: Indonesia Between U.S.–China Cyber Competition
Vol. VII / No. 6 | March 2026
Authors:
Mochammad Jose Akmal – Government Science Graduate, Universitas Diponegoro
Summary
Indonesia’s cyber posture is best understood not as a binary alignment between Washington and Beijing, but as an ongoing effort to preserve strategic autonomy within a deeply transnational digital ecosystem—where infrastructure, vendors, data flows, and intelligence dependencies are globally intertwined. This autonomy is increasingly strained by a threat environment that is expansive, persistent, and operationally significant, extending well beyond what any single vendor report can capture. The 2026 analysis by Unit 42 is valuable insofar as it identifies a state-aligned espionage cluster, TGR-STA-1030, which compromised at least 70 organisations across 37 countries and conducted reconnaissance activities spanning 155 countries, including Indonesia. However, this report should be treated as a single empirical data point rather than as the primary evidentiary anchor. Broader evidence—drawn from publicly reported Indonesian incidents, national disclosures, and regional cybersecurity assessments—demonstrates that Indonesia has experienced repeated and measurable cyber disruptions affecting government systems and critical public services.
Keywords: Cybersecurity, Cyber diplomacy, Strategic hedging, Cyber resilience
State-Backed Cyber Threats and Global Exposure
A more grounded reading of Indonesia’s threat environment is not that a single advanced actor is targeting the country, but rather that it operates within a broader, constantly active ecosystem of cyber espionage, criminal activity, and opportunistic attacks. In that sense, the risk is less about one persistent threat and more about continuous exposure across a wide attack surface.
Palo Alto Networks’ Unit 42 findings reflect this pattern. The group tracked as TGR-STA-1030 did not rely on particularly novel techniques. Instead, it combined phishing—often using government-related lures such as ministry restructuring narratives—with malicious archives hosted overseas and the exploitation of known vulnerabilities rather than zero-days. It also used widely available tools such as Cobalt Strike, VShell, and web shells, targeting services such as Microsoft Exchange, Microsoft OMI, and SAP Solution Manager, as well as vulnerabilities such as CVE-2019-11580 in e-passport and e-visa systems. What stands out here is not sophistication, but accessibility. These are methods and tools that are well understood and widely used. That shifts the focus away from rare, high-end exploits and toward more persistent structural issues—exposed services, weak identity management, and slow patching cycles. In practice, those gaps create just as much risk, especially when they affect systems tied to public administration and national infrastructure.
Indonesian government data support this broader picture. BSSN’s 2023 report records extremely high volumes of anomalous activity, including hundreds of millions of network anomalies, millions of APT-related and ransomware events, and hundreds of confirmed incidents. It also highlights significant exposure on the dark web affecting hundreds of stakeholders, including government entities. The public administration sector appears most affected, with recurring issues such as web defacement, ransomware, and data breaches.
Data from Kominfo-CSIRT in 2024 points in the same direction. It shows sustained anomaly traffic at scale and multiple incidents within a single ministry, where malicious file injection was the most common attack type. None of these figures clearly points to a single actor or campaign. Instead, they show something more structural: compromise is frequent, distributed, and ongoing. That makes the challenge less about attribution and more about resilience—reducing exposure, improving baseline security practices, and treating cyber risk as a constant condition rather than an occasional disruption.
A clear illustration of these risks is the 2024 ransomware attack on Indonesia’s national data centre. According to Reuters, the breach disrupted immigration and airport services, affected more than 230 public agencies across the archipelago, and involved a ransom demand of about $8 million (Rp135.5 billion). Officials further indicated that 98% of the data in one compromised facility had not been backed up. This incident is significant because it demonstrates that cyber threats have escalated to the point of affecting national security and sovereignty. The consequences extended beyond technical disruption to include service outages, administrative paralysis, reputational harm to the government, and substantial recovery costs. It underscores that cyber policy should not be treated merely as an abstract issue of information security, but as a critical component of state resilience and governance.
Geopolitical Context and Why Attribution Must Be Handled Carefully
Indonesia’s cyber posture is shaped by great-power rivalry, but attribution is more complex than political rhetoric suggests. Technical attribution identifies infrastructure, tools, and behaviour; legal attribution assesses whether those facts meet standards for state responsibility; political attribution is the public act of naming an actor. These are distinct. Under international law, political attribution alone does not justify countermeasures—state responsibility requires an internationally wrongful act attributable to a state. Although Articles 4–11 of the ILC’s ARSIWA reflect customary law, cyber operations’ use of proxies, obfuscation, and layered infrastructure makes evidentiary certainty difficult to establish.
This caution is especially important for Indonesia. Diplomatic responses to suspected state-backed activity should rest on evidence robust enough to withstand domestic, partner, and international scrutiny. That does not require silence, but rather calibrated responses: technical mitigation, selective disclosure, bilateral demarches, regional consultation, and, only then, explicit political attribution if the evidentiary threshold is met. Debates reflected in the Tallinn Manual highlight how contested the boundaries are between espionage, sovereignty violations, and unlawful coercion in cyberspace. Accordingly, claims of state sponsorship should not be presumed without clearly articulated and independently justified evidence.
What Hedging Looks Like In Practice
Hedging should be treated as a concrete portfolio strategy, not a vague commitment to “balance.” For Indonesia, this means sustaining cyber cooperation with both the United States and China while ensuring neither becomes indispensable in a way that would constrain policy autonomy. In practice, that requires diversified procurement across ecosystems, dual-track training for government and CERT personnel, conditional intelligence sharing that preserves data sovereignty, and rules that avoid vendor lock-in. Interoperability and auditability should be non-negotiable procurement criteria. These measures translate hedging from rhetoric into an actionable governance model.
Indonesia already has the foundations for this approach. Public records indicate cyber cooperation with both Washington and Beijing, including a US–Indonesia letter of intent and an Indonesia–China MoU on cybersecurity capacity and technology. While this does not imply policy equivalence, it demonstrates that Jakarta maintains multiple external cyber channels. The central policy issue, then, is not whether Indonesia hedges, but whether that logic is embedded in procurement, training, and incident-response frameworks—so that when partner expectations diverge, Indonesia preserves option value and safeguards its policy autonomy.
Private-Sector and Supply-chain Dynamics
Any serious cyber strategy for Indonesia must start with a simple premise: resilience is built on a diverse ecosystem—government, telcos, cloud providers, integrators, academia, and private security firms. The state can set strategy and legal baselines, but operational control—telemetry, patching, identity, and incident response—largely sits with private actors. Indonesian business guidance already reflects this shift: Kadin’s 2025 white paper prioritises critical infrastructure resilience, governance, talent, public–private partnerships, standardisation, and strengthening the domestic cybersecurity industry—reducing dependence on foreign tools and opaque vendor ecosystems.
Procurement, therefore, becomes cyber policy. CISA frames ICT supply-chain risk management as core to resilience, with tools like the KEV catalogue to prioritise actively exploited vulnerabilities, while highlighting phishing and supply-chain compromise as persistent entry points. For Indonesia, this translates into embedding vendor vetting, code provenance, patch SLAs, privileged-access controls, and audit rights into public procurement—especially for government systems, aviation, data centres, and critical infrastructure.
Indonesia’s own incidents reinforce this approach. Kominfo-CSIRT’s 2024 report shows response efforts depended on forensics, backup restoration, endpoint protection, vulnerability assessment, and coordination with BSSN, law enforcement, and the wider cybersecurity community. Resilience, therefore, is not just prevention—it requires robust recovery architecture, disciplined backups, segmentation, and a tested incident-response capability.
ASEAN and the Limits of Regional Multilateralism
ASEAN is a pragmatic platform for reducing bilateral exposure, but it should not be overstated. Its cyber strategy offers useful institutional scaffolding—such as the ASEAN CERT Maturity Framework, prospective regional CERT cooperation, and coordinated incident-response mechanisms. However, persistent capability asymmetries, uneven public–private information sharing, and limited transparency constrain effectiveness.
Indonesia should therefore engage ASEAN selectively, focusing on achievable outcomes: standardised incident taxonomies, baseline CERT coordination, joint exercises, and norms of responsible behaviour rather than rapid strategic convergence. Multilateralism helps dilute the influence of any single external power and expands Indonesia’s ability to shape rules collectively.
That said, effective regionalism requires more than rhetorical support for “ASEAN centrality.” It depends on harmonised incident definitions, agreed emergency coordination channels, and routine interoperability exercises that incorporate the private sector, reflecting the operational reality that cyber defence extends beyond government institutions.
Policy Recommendations
Indonesia should spell out what “hedging” actually means in its cyber policies. In practice, that requires clarity on what kinds of cooperation are allowed, what data can be shared, which technologies are acceptable, and where the limits lie. These boundaries should not remain abstract—they need to be enforceable through auditable contracts with vendors and by ensuring the state retains control over critical logs and metadata. At the same time, more capabilities should be built at home. Universities, CSIRTs, and local firms can take on a larger role in training, digital forensics, and secure procurement so that resilience does not depend entirely on external platforms. This direction is already consistent with patterns seen in public-sector incidents, BSSN priorities, and the private sector’s growing focus on resilience.
It is also important to distinguish between cooperation and dependence. Working with the United States on intelligence can improve early warning and incident response, while engagement with China on infrastructure may still be useful under clear and transparent rules. The key is that neither relationship should limit Indonesia’s room to act—data sovereignty, the ability to switch vendors, and the avoidance of concentration in critical systems must remain intact. In that sense, hedging is less about staying neutral and more about preserving flexibility under changing conditions.
At the regional level, capacity-building should focus on what is realistically achievable. ASEAN initiatives—such as joint exercises, shared CERT practices, and cross-border protocols—still matter, but progress is likely to come from narrower steps first. Common training programs, shared terminology, and baseline standards for public institutions and critical infrastructure operators within Indonesia are more practical in the near term. Compared to an ambitious, fully integrated regional framework, this incremental approach is more workable and better aligned with ASEAN’s institutional limits.
Conclusion
Indonesia’s cyber challenge extends well beyond its position between the United States and China. Its digital infrastructure faces a layered threat environment that includes espionage, ransomware, phishing, exploitation of known vulnerabilities, and supply chain-related risks. Evidence from BSSN, Kominfo-CSIRT, Reuters reporting on the national data centre attack, CISA guidance, and Unit 42’s global campaign converges on a clear conclusion: cyber resilience is now a core issue of national security and state capacity. Hedging remains a viable strategy, but only if it is operationalised through disciplined procurement, mature incident response, legal clarity around attribution, and regional cooperation that reinforces—rather than compromises—strategic autonomy.
