Amnesty International has raised concerns about privacy and freedom of expression following reports that Indonesia has deployed spyware from Israel, Luxembourg, and Malaysia.

According to Amnesty International's joint investigation with Asian, Israeli, and Western media, Indonesia, Southeast Asia's largest economy, deployed a series of invasive surveillance tools and spyware between 2017 and 2023. These tools targeted opponents, media, and activists.

These tools were procured from a network of brokers, resellers, and suppliers in Luxembourg, Israel, Malaysia, and Singapore and used by companies and government agencies such as the National Police and the National Cyber and Crypto Agency (BSSN), Indonesia's primary signal intelligence agency, as per Amnesty.

"The shadowy trade in spyware to Indonesia adds another dangerous tool of potential intimidation. This cannot continue," said Carolina Rocha da Silva of Amnesty's Security Lab in a statement.

When contacted by AFP, the Indonesian Ministry of Communication and Information, the National Police, and the BSSN did not immediately respond. Among the companies implicated in the investigation is Luxembourg-based Q Cyber Technologies SARL, which has been linked to the Israeli company NSO Group, known for its Pegasus spyware used to target journalists and government officials.

In 2021, the then Minister for Foreign Affairs, Jean Asselborn, cautioned NSO Group which is based in Tel Aviv, Israel, and operating in Luxembourg.

Jean Asselborn had sent a letter to the directors of these entities, emphasising in the strongest possible terms that "Luxembourg rigorously upholds all export control obligations and will not tolerate activities by these entities from Luxembourg that contribute to human rights violations in third countries."

New investigation

The investigation revealed that these companies have complex ownership structures and can hide their exports, making it difficult to monitor as products arrive directly or indirectly in Indonesia.

In statements to Amnesty, the Israeli group NSO stated that it conducted the necessary checks before approving sales. Israel's Defense Export Controls Agency (DECA) mentioned that it authorised cyber exports to foreign governments solely for the purpose of combating terrorism and maintaining law and order. Despite Indonesia and Israel not maintaining formal diplomatic relations, the Palestinian cause in the archipelago garners widespread support.

Amnesty has urged Indonesia to better protect its citizens against surveillance and mass intrusions. "We call on the Indonesian government and parliament to implement substantial regulations immediately, including a prohibition on highly invasive spyware as these can never be used in a manner consistent with human rights," stated Usman Hamid, executive director of Amnesty Indonesia, in a statement to AFP.