Indonesia’s Election Commission, Alibaba Cloud collaboration revealed in court

INDONESIA: During a recent hearing held by the Central Information Commission (KIP) of Indonesia on 13 March, it was revealed that the General Election Commission of the Republic of Indonesia (KPU) had indeed collaborated with the Chinese internet giant, Alibaba Cloud.

This acknowledgement came to light during a dispute over information in court proceedings.

Initially, the Commissioner of the Central Information Commission (KIP), Arya Sandhiyudha, in the hearing, asked about the truth of the collaboration with the KPU RI.

“So, is it true that the KPU has cooperation with Alibaba Cloud?” Arya asked, as reported in the press release on the official website of the Central Information Commission last Friday (15 March).

The KPU RI, as the respondent in the information dispute case, confirmed the collaboration during the hearing.

This revelation was considered a significant fact in the proceedings of the Central Information Commission.

The hearing involved KPU as the respondent in an information dispute related to election data.

On the other side, the petitioner was the Legal Entity of the Foundation for Advocacy of Indonesian Constitutional Rights (Yakin).

The petitioner requested the KPU to disclose information regarding the Permanent Voter List (DPT) data and election result data, including total votes, valid votes, and invalid votes.

The requested data spanned presidential elections, legislative elections, and local elections from 1999 to 2024.

Furthermore, the petitioner demanded that the data be provided in raw and complete format, ranging from the national to the village or neighbourhood level.

They requested electronic raw data in formats such as database exports or .csv files.

While three disputes were initially submitted by the petitioner, only one dispute, registered as case 003, was deemed open by the KPU RI. This case pertained to the request to disclose the DPT and election result data.

Two other dispute cases, registered as case 001 and case 002, were exempted by the KPU.

However, case 002 was subjected to a consequence test, leading the Central Information Commission’s Honorary Council to request a re-evaluation, along with a consequence test for case 001.

In case 001, the petitioner requested real-time data in raw format, such as daily .csv files, for publication on the official website of the KPU RI or direct delivery to the petitioner daily.

In case 002, the petitioner sought detailed information on the KPU’s information technology infrastructure, specifically related to the 2024 elections, including topology, physical servers, cloud servers, networks, and cybersecurity measures such as Content Delivery Networks (CDNs) and DDoS protection.

The petitioner also requested details of the Alibaba Cloud services used, including the procurement process and contracts between the KPU (or its representatives) and Alibaba Cloud.

Weak data security and foreign cloud service usage concern in election systems

Prior to these revelations, the Institute for Policy Research and Advocacy for the Community (ELSAM) and Cyberity had raised concerns about the weak data security in the Election Recapitulation Information System (Sirekap) for the 2024 elections.

According to Arif Kurniawan, Chairman of Cyberity, the election systems utilized cloud services hosted in China, France, and Singapore, owned by the internet service provider giant, Alibaba.

Arif highlighted that data and email traffic were controlled and regulated outside Indonesia, particularly in China.

Wahyudi Djafar, Executive Director of ELSAM, expressed concerns about the threats and risks associated with the confidentiality, integrity, and availability of data processed by Sirekap.

He emphasized the use of an IP address associated with Alibaba Cloud Private Ltd (Aliyun) in Singapore for Sirekap, suggesting potential data storage overseas.

He urged the KPU to clarify and explain these issues to ensure transparent elections and public trust in the electoral process.

Renowned telematics expert Roy Suryo commented on the KPU’s acknowledgement of its collaboration with Alibaba, expressing relief that the truth was finally acknowledged.

However, he viewed this acknowledgement as just the tip of the iceberg in revealing potential falsehoods or corruption within the KPU.

Roy criticized the KPU’s decision to disclose this information during a court hearing, considering previous statements by KPU officials denying any affiliation with foreign companies.

He expressed disappointment with the lack of transparency from the KPU in providing information to the public.

He highlighted discrepancies between the KPU’s past denials and the recent revelation of their collaboration with Alibaba.

He also criticized the KPU’s justification for hiding this information, as it contradicted Regulation No. 1 of 2021 of the Central Information Commission, which mandates the disclosure of procurement information.

Roy urged the KPU to be transparent and truthful about its collaborations to maintain public trust.

He warned that denying facts could undermine public confidence in the electoral process.