What police say happened
On 5 November, Indonesian police named a fourth suspect, a senior official identified only as SU, in the alleged wiretapping of President Prabowo Subianto. Reuters, carried by Al Jazeera, reported that investigators allege SU headed the Criminal Investigation Agency's information and technology unit from 2021 to 2026. The cybercrime director, Suhermanto, said the other two suspects "got approval from SU" before tapping. Police also say the two later sought his approval to delete interception records. Three senior officers were arrested earlier in the week, including former national police chief Listyo Sigit Prabowo. Police say 13 officers and five criminal and IT experts have been questioned. The motive is still unclear. Reports differ on how SU's earlier career is described, and he had not been detained because of a health condition. These are allegations, not findings of guilt.
The strongest case for broad interception powers
Police and intelligence agencies have a serious argument. Terrorism, organised crime and large-scale fraud are fought through communications data, and speed matters. A warrant process that takes days can lose a suspect. Indonesia also has a real scam problem, which is the stated reason for tighter SIM controls. A regulator that makes it harder to mass-register anonymous numbers is responding to a genuine harm.
That case is worth stating fairly. The scandal, however, is not a story about too little interception power. It is a story about a power that, on the police's own account, was approved inside the same unit that ran it. Records of it could then be deleted with the same internal sign-off.
What the process is supposed to look like
Open magazine's reporting describes the rules investigators cite. A written request goes to the head of criminal investigations, who seeks permission from the head of the district court where the tap will run. Urgent cases need a sworn statement and a report within 24 hours. Unrelated material must be destroyed, and the destruction documented.
The case shows the weak point in that design. The record of destruction is created and held by the agency doing the tapping. If the alleged account is right, deletion with internal approval is exactly how an unauthorised tap becomes unprovable. An outside auditor, with a right to see logs before they can be destroyed, would have made that harder.
Why the SIM database raises the stakes
Since mid-2026, Indonesia has required facial verification for new mobile numbers. Komdigi Regulation 7 of 2026, enacted on 19 January 2026, governs subscriber registration on cellular networks. According to a summary by China's CAICT, activation follows verification of the number, the national ID (NIK) and a facial biometric. Each person is capped at three prepaid cards per operator, and facial recognition accuracy must be at least 95%, with a six-month transition period.
The policy goal is defensible. The consequence is that every new number is now tied to a verified face and a national ID. A person who gets a legitimate tap warrant can be identified instantly. A person who is tapped illegitimately can be tracked, matched to a face and located. Interception has always been a serious power. A face-verified identity layer makes each intercepted number more revealing, and so makes any misuse of that power more damaging.
The pro-innovation position is not to scrap the registry. It is to attach safeguards proportionate to what the registry now holds.
The missing regulator
The obvious safeguard is an independent data protection authority, and Indonesia does not have one. Hogan Lovells reported in August 2026 that, nearly four years after Law 27 of 2022 on Personal Data Protection, the authority has not been established. Petitioners in Constitutional Court case 236/PUU-XXIV/2026 want implementing regulations issued within two years of a ruling. On 27 July the communications ministry, speaking for the President, opposed the petition. It said a court deadline was unnecessary and that draft regulations had reportedly been submitted to the President for approval.
According to the case's reporting, Commission I of the House is now pressing the government to speed up the agency, and there are calls for a dedicated wiretapping bill. Both are sound instincts. They should not be treated as the same thing, though. A data authority regulates how personal data is processed. It does not by itself decide when a state may intercept communications. That needs a statute.
What proportionate reform looks like
A good interception law would be short and specific:
- Prior judicial authorisation for every interception, with narrow emergency exceptions and mandatory after-the-fact review.
- Immutable logs held outside the police, so that deletion by the operator of the tap cannot erase the evidence.
- Independent audit by a body with the power to inspect, compel records and report publicly in aggregate.
- Transparency reporting by telecom operators and agencies, as is common in other democracies.
- Data minimisation and access logging for the face-verified SIM database, enforced by a data authority that is not subordinate to the ministries it supervises.
None of this slows legitimate law enforcement. It makes it harder to run an unauthorised tap, and easier to catch one when it happens.
The takeaway
If the allegations hold, this episode is a case study in how internal approval fails as a safeguard. A wiretap went to the very top of the state, and the reported control was the sign-off of a colleague. Indonesia has chosen to build a national biometric identity layer under every phone number. It should now finish the oversight architecture that a layer like that needs: an independent authority, a statute for interception and external audit. Delay on those makes each later scandal worse.