Beyond Self-Claiming: Why Independent Third-Party Certification is the Non-Negotiable Backbone of Indonesia’s Digital Economy

JAKARTA — As Indonesia’s digital economy experiences exponential growth, the nation faces a silent yet escalating crisis of digital trust. In an ecosystem where financial transactions, lending approvals, and administrative verifications occur within milliseconds across vast geographical distances, the mechanisms proving who is behind a screen are coming under intense scrutiny.

During a recent high-profile discussion titled "Increasingly Digital, Who Guarantees We Are Increasingly Safe?" held in Jakarta, leading legal scholars, cybersecurity experts, and victims of data breaches converged on a critical consensus: the security and legal validity of digital transactions in Indonesia can no longer rely on internal verification systems or self-serving claims made by platform operators. Instead, the country must urgently transition toward independent third-party verification through certified Electronic Certification Providers (Penyelenggara Sertifikasi Elektronik or PSrE) and Certified Electronic Signatures (Tanda Tangan Elektronik or TTE Tersertifikasi) to establish undeniable legal proof.

Main Facts: The Core Vulnerability of Indonesia’s Digital Landscape

The central argument emerging from the Jakarta forum exposes a dangerous legal and technical loophole in how digital platforms operate across the archipelago.

1. The Fallacy of "Self-Claiming": Under Article 15 of the Electronic Information and Transactions (ITE) Law, the security of an electronic system holds zero weight in a court of law if it relies merely on the "self-claiming" practices of the platform operator. Without external validation, platforms essentially act as both players and referees in their own security architectures.
2. The Legal Shield of PSrE and TTE: True legal certainty requires an independent third-party framework grounded in asymmetric cryptography managed by verified PSrEs. These certified systems ensure that non-repudiation is maintained—meaning a user cannot deny having performed a transaction, and a platform cannot falsely attribute a transaction to a user.
3. The FinTech Cost-Cutting Dilemma: Consumer advocates and victims have revealed that many digital platforms—particularly in the peer-to-peer (P2P) lending (pinjol) sector—intentionally bypass third-party PSrE integration to slash operational costs, exposing millions of consumers to catastrophic data exploitation and financial fraud.
4. Regulatory Overhaul in Motion: Recognizing these systemic vulnerabilities, the Ministry of Communication and Digital (Kemenkomdigi) is actively drafting a comprehensive revision of Government Regulation (PP) Number 71 of 2019 to introduce stringent frameworks for national digital identity and high-risk digital transactions.

Chronology: How the Digital Verification Crisis Unfolded

To understand how Indonesia arrived at this critical juncture, it is necessary to examine the evolution of the country’s digital regulatory framework alongside the expansion of its digital economy.

• The Early Era of E-Commerce and the ITE Law (2008–2016): When Indonesia first enacted UU ITE (Law No. 11/2008), the primary focus was on establishing basic legality for electronic documents and digital signatures. However, technology outpaced the law. As platforms proliferated, they developed proprietary, closed-loop verification systems. Users accepted "Terms and Conditions" that gave platforms absolute autonomy over data verification, planting the seeds for future disputes.
• The Codification of PP 71/2019: Government Regulation No. 71 of 2019 concerning the Implementation of Electronic Systems and Transactions was introduced to regulate electronic operators. While it laid foundational rules for electronic systems, it lacked granular mandates regarding mandatory third-party cryptographic verification for high-risk financial sectors, leaving wiggle room for platforms to prioritize speed and low overhead over rigorous security.
• The Rise of P2P Lending and the Data Breach Epidemic (2020–2023): Propelled by the COVID-19 pandemic, digital financial services exploded. P2P lending platforms onboarded millions of unbanked and underbanked citizens. Driven by hyper-growth and intense competition, compliance standards slipped. Internal databases became soft targets, leading to widespread data harvesting, leaks, and identity theft.
• The Constitutional Court’s Intervention: The legal landscape shifted when the Constitutional Court (Mahkamah Konstitusi) emphasized the absolute necessity of robust technical implementing regulations to safeguard personal data. The court ruled that multiple layers of protection are mandatory to prevent systemic digital abuse.
• The Present Day (2024–2025): High-profile cases of synthetic identity fraud and unauthorized loan disbursements—such as those brought to light by legal advocates and victims—have forced policymakers, legal experts, and tech specialists to publicly demand an end to internal self-verification, culminating in the recent forum discussions and the ongoing revision of PP 71/2019.

Supporting Data and Expert Perspectives

The transition from convenience-first to security-first infrastructure requires dissecting the technical and legal realities articulated by Indonesia’s foremost experts.

The Legal Perspective: Edmon Makarim on Non-Repudiation

Former Dean of the Faculty of Law at the University of Indonesia (FH UI), Edmon Makarim, dissected the legal inadequacies of current platform practices. In digital commerce, transactions occur between strangers who lack physical proximity or face-to-face interaction. Traditional identity confirmation methods are therefore obsolete.

"Based on Article 15 of the ITE Law, the security of an electronic system has no legal evidentiary power if it relies solely on the self-claiming of the management," Edmon stated firmly during the forum. "An independent third party based on asymmetric cryptography through a verified Electronic Certification Provider (PSrE) is required."

Edmon emphasized that without a PSrE acting as an objective anchor, judicial bodies face immense hurdles in digital dispute resolution. In a court of law, digital evidence must be immutable, verifiable, and free from unilateral administrative manipulation. A platform logging its own data without independent oversight is legally fragile.

The Technical Perspective: Yudho Giri Sucahyo on Multi-Layered Authentication

Cybersecurity expert Yudho Giri Sucahyo approached the crisis from a technical standpoint, arguing that trust in cyberspace cannot be a matter of faith; it must be continuously proven through rigorous architecture.

Yudho highlighted that trust requires multi-tiered authentication processes, moving far beyond simple passwords. A robust verification chain must incorporate captchas, biometric scanners (such as facial recognition and fingerprint scanning), and ultimately culminate in a Certified Electronic Signature (TTE Tersertifikasi).

The danger multiplies exponentially when users switch devices. According to Yudho, a major vulnerability in modern applications is device-migration authentication failure. When a system fails to accurately re-verify the true owner of an identity upon logging in from a new device, it opens the floodgates to Account Takeover (ATO) attacks. Once an account is hijacked, perpetrators can execute illicit financial transactions under the victim’s name, leaving the innocent account holder to deal with the fallout.

Official Responses and Real-World Impact: The Human Cost of Lax Verification

The academic and technical debates surrounding digital security are not abstract; they manifest in the ruined credit scores and psychological trauma of everyday citizens.

The Voice of the Victim: Zico L. Djagardo’s Testimony

Advocate and data leak survivor Zico L. Djagardo shared his harrowing personal experience with systemic verification failures. Zico became a victim of data misuse that cascaded into fictitious financial transactions, ultimately destroying his financial collectibility status within the national banking system through no fault of his own.

Upon investigating his case, Zico uncovered a disturbing industry practice:

"P2P lending platforms acknowledged that their internal verification systems were inadequate, and they deliberately chose not to use third-party verifiers (PSrE / Certified TTE) purely to cut operational costs," Zico revealed.

By cutting corners on cryptographic verification, these platforms expose their users to identity theft. When fraudulent loans are approved using stolen credentials, the platforms often pressure the victims for debt collection rather than fixing their own broken onboarding gates.

Zico advocates for highly detailed regulatory frameworks regarding TTE. He champions the involvement of PSrEs as independent "referees" (wasit) capable of guaranteeing evidentiary parity during disputes between vulnerable consumers and powerful technology corporations.

Government Action: Kemenkomdigi’s Regulatory Overhaul

Acknowledging the urgency of these grievances, the Indonesian government is moving to close legislative loopholes. Aulia, a representative from the Directorate of Digital Space Supervision Strategy and Policy at the Ministry of Communication and Digital (Kemenkomdigi), announced that the ministry is actively processing revisions to Government Regulation (PP) Number 71 of 2019.

The upcoming regulatory update involves multi-stakeholder consultations to address the blind spots exposed by rapid digital expansion. Key focal points of the revised regulation include:

• High-Risk Transaction Protocols: Establishing mandatory, standardized protocols for sectors prone to fraud, such as online lending, digital banking, and high-value e-commerce.
• National Digital Identity Integration: Creating a cohesive framework for a secure national digital identity anchored by certified cryptographic standards.
• Accountability and Compliance: Imposing strict administrative and legal penalties on platforms that bypass third-party verification standards in favor of cost-cutting.

Implications for Indonesia’s Digital Future

The dialogue in Jakarta serves as a wake-up call for Southeast Asia’s largest digital economy. As Indonesia marches toward its vision of a Golden Indonesia (Indonesia Emas 2045), the structural integrity of its digital infrastructure will determine its economic stability.

1. Economic Implications

If platforms continue to bypass PSrE integration to save money, the systemic risk of fraud will soar. Financial institutions will face rising non-performing loans (NPLs) driven by synthetic identity fraud. Conversely, enforcing strict cryptographic verification will build deep consumer confidence, driving higher-value transactions and attracting international digital investments.

2. Legal and Judicial Transformation

The legal system is undergoing a paradigm shift. Courts are moving away from accepting raw, unverified electronic printouts generated by platform logs. Moving forward, digital evidence presented in Indonesian courts will increasingly require validation from independent PSrEs to satisfy the evidentiary standards of the ITE Law and the Electronic Documents Act.

3. Consumer Empowerment vs. Platform Convenience

For years, the tech industry operated under a Silicon Valley ethos of "move fast and break things." In the realm of personal finance and digital identity, breaking things means destroying lives and ruining financial futures. The push for certified TTEs marks a philosophical shift toward user-centric security, where the burden of proof rests on platforms to prove they exercised maximum cryptographic diligence before issuing loans or granting account access.

Conclusion

The message from Jakarta’s digital policy forums is unequivocal: self-certification is dead. As cyber threats evolve and digital fraud grows more sophisticated, Indonesia can no longer afford to let platform operators mark their own homework. By institutionalizing independent third-party verification through certified PSrEs and TTEs, and by enacting robust updates to PP 71/2019, Indonesia can bridge the trust deficit, protect its citizens from predatory digital practices, and build a resilient, legally sound foundation for the future of its digital economy.