A law built for exactly this moment
On August 27, 2026, roughly 18,000 police personnel ringed Indonesia's parliamentary complex in Jakarta as students and civil-society groups marked the one-year anniversary of the deadly August 2025 protests — unrest that killed at least 10 people and led to nearly 7,000 arrests after the death of motorcycle-taxi driver Affan Kurniawan under a police vehicle (FMT; CSIS). Communications and Digital Minister Meutya Hafid announced Komdigi would sharply increase monitoring of the "digital space" for the duration of the demonstrations, warning that "provocation, disinformation, slander, and hate speech" would not be tolerated and would be handled "according to authority and applicable legal provisions" (Warta Ekonomi). Earlier in August, she had separately rejected as disinformation a viral claim that Komdigi was blocking press coverage of the protests, insisting the ministry has never barred media outlets from reporting (ANTARA; Okezone).
What makes this round of monitoring different from the last one is the legal architecture sitting behind it. On June 17, 2026, President Prabowo Subianto signed Law No. 5 of 2026, the third amendment to the 2002 Police Law, into force (official Polri announcement). Buried in the amendment's expanded cyber mandate is Article 16(1)(q), which grants police the explicit authority to take action against, block, cut off, or slow down access to cyberspace for the purpose of domestic security — coordinating with Komdigi to do it, but without a warrant or a named judicial check written into the clause itself. Just over two months later, that provision is no longer hypothetical; it is the backdrop against which every Komdigi monitoring announcement during a protest now has to be read.
The case regulators will make
Indonesia's government has a real argument here, and it deserves to be stated plainly rather than waved away. Livestreamed protest coverage is not automatically accurate coverage: Komdigi's own monitoring during the August 2026 demonstrations found streams optimized for virality and gift-based monetization rather than factual reporting, and a viral video falsely presented as footage of a July 31, 2026 demonstration turned out to be recycled from an unrelated June 12 protest over economic conditions (Okezone). During the 2025 unrest, TikTok and Instagram themselves temporarily suspended livestreaming after platforms were used to broadcast crackdowns alongside documented deepfake manipulation attempts targeting the protest movement (CSIS). A state facing coordinated disinformation during a volatile, already-fatal protest cycle is not inventing a problem. Fast-moving hoaxes can genuinely accelerate violence, and a narrowly tailored, court-supervised takedown power for verified incitement would be a defensible tool.
Article 16(1)(q) is not that. The clause folds "block," "cut off," and "slow down" — three tools of wildly different severity, from targeted content removal to a full regional shutdown — into a single grant triggered only by "domestic security," undefined, with no warrant requirement, no independent sign-off, and no statutory sunset. Digital-rights researchers who tracked the bill through the DPR warned that the absence of clear indicators for when police may invoke the power leaves it open to abuse — concerns raised in coalition with groups including KontraS and Imparsial, urging lawmakers to write in limits before passage, limits that did not make it into the final text. Indonesia has been down this road before and lost: in June 2020, the Jakarta State Administrative Court ruled that the government's 2019 internet shutdown in Papua and West Papua during anti-racism protests was unlawful, finding it ignored the constitutional and human-rights procedures required before restricting information access; the government initially appealed, then dropped the appeal (Jakarta Post). Access Now called it a win "not only for Indonesia and the residents of its Papua and West Papua provinces but also for the rights of internet users in general" (Access Now). That ruling worked precisely because a shutdown ordered without statutory process could be challenged as unlawful after the fact. Article 16(1)(q) narrows that opening: if cutting cyberspace access is now an enumerated police power rather than an ad hoc executive decision, the next court challenge starts from a weaker position.
Why the gap matters more than the announcement
Nothing said on August 27 indicates Komdigi has actually invoked Article 16(1)(q) — the minister's language was about content moderation and monitoring, not a shutdown order, and her denial of the press-blocking rumor suggests the ministry is, for now, sensitive to overreach optics. That restraint is worth crediting. But restraint exercised voluntarily is not the same as a legal constraint, and the entire value of due process in emergency powers is that it doesn't depend on which minister happens to be in office during the next crisis. A shutdown power invoked once during a period of official caution sets a precedent that survives the caution.
The fix is not to strip police of a cybercrime or public-safety mandate — the law's expanded cybercrime-coordination role is a reasonable modernization Indonesia's institutions plausibly need. The fix is to decouple the extreme remedy (network-level blocking or throttling) from the ordinary one (targeted takedown of specific unlawful content) and require judicial authorization, time limits, and public reporting for the former, exactly as the 2020 Papua ruling implied should already be standard. Indonesia's DPR and courts have the tools to draw that line — the PTUN Jakarta precedent already exists. Whether they use them before the next protest cycle, rather than after, is the real test of whether Article 16(1)(q) becomes a rarely-used emergency backstop or a standing invitation to reach for the kill switch.