Coordinating Ministry for Economic Affairs THE INDONESIA ICT CONSULTATIVE FORUM: 2014 REVIEW AND 2015 PRIORITIES

Coordinating Ministry for Economic Affairs THE INDONESIA ICT CONSULTATIVE FORUM: 2014 REVIEW AND 2015 PRIORITIES December 2014

CONTENTS WELCOMEMESSAGE...2 ACKNOWLEDGEMENTS...4 EXECUTIVESUMMARY...6 BACKGROUNDOFIICF...8 OBJECTIVES...10 STRUCTURE...11 KEYMILESTONES...13 KEYTHEMES...15 EnablingTheBenefitsOfCloudComputingInIndonesia...15 SecuringIndonesia sdigitalenvironment...17 EBCommerceInIndonesia...22 BestPracticesInEncouragingTradeAndInvestmentInIndonesia sictindustry...28 CONCLUSIONANDNEXTSTEPS...33 APPENDIX...35 AppendixA:DecreeRegardingTheEstablishmentOfIndonesiaICTConsultativeForumIICF)Team AppendixB:MinutesFrom1stExecutiveMeeting IICFApril1,2014) AppendixC:MinutesFrom2ndExecutiveMeeting IICFJune24,2014) AppendixD:MinutesFrom3rdExecutiveMeeting IICFOctober2,2014) AppendixE:SupplementaryMaterials

WELCOMEMESSAGE Indonesiahasenjoyedremarkableeconomicgrowthinrecentyears.Newtechnologies haveplayedapowerfulroleinconnectingandempoweringindonesia scitizens.asan example,mobilephoneownershipinindonesiaisestimatedat300millionactive mobiletelephonenumberswithover120percentpenetrationrate.however,interms ofusinginformationandcommunicationtechnologyict)formoreproductive economicactivities,indonesiastilllagsbehindpeercountriesduetolimitationsin connectionspeedandlocalcontent. AsIndonesiabeginsanewchapter,therearetremendousopportunitiestouse advancesintechnologytodevelopaknowledgerbasedeconomy.theimpactreaches farbeyondtheictindustry.technologycanhelpimprovegovernmentservices, education,andhealthcare.torealizethesebenefits,itiscriticaltodeveloparobust ICTecosystemwhereinnovationandentrepreneurshipcanthrive.Collaborative platformssuchastheindonesiaictconsultativeforumiicf)enablegovernmentand industrytoimprovemutualunderstandingintheareasofinnovation,investment,and regulation.together,wecandevelopprogressiveictpoliciesthatwillhelpindonesia grow. In2014,theIICFfocusedonadialogueabouttheissues.Wedeepenedourmutual understandingofregulatorydevelopments,learnedtogetheraboutemergingglobal ICTissues,andidentifiedopportunitiestogrowthelocalICTindustry.Thepublication ofthisreporthighlightsthiswork,outlinesrelatedpolicyconsiderations,andlaysout nextstepsfortheiicfin2015.inthecomingyear,welookforwardtodeliveringpolicy resultsbasedonourmutuallearningthispastyear. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page2of35

Welookforwardtoworkingtogethertoensureourcollectivevisionofaninnovative, prosperous,anddynamicictecosysteminindonesiabecomesareality. December2014 EddySatriya CoRChair,IICFExecutiveCommittee DeputyAssistantforICTandUtility,CoordinatingMinistryfor EconomicAffairs ElizabethHernandez CoRChair,IICFExecutiveCommittee ICTCommitteeChair,USRASEANBusinessCouncil TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page3of35

ACKNOWLEDGEMENTS ThisreporthasbeenacollaborativeeffortbetweentheCoordinatingMinistryfor EconomicAffairsCMEA)andtheUSRASEANBusinessCouncilUSABC).Wewouldlike tothankthecmeaandusabcstafffortheirstrongsupportofthisprojectthroughout theprocess.inaddition,wewouldalsolikethankthemanyindividualsand organizationsinvolvedfortheircontributionstothispublication,inparticular:cisco, Google,HP,Intel,Microsoft,Qualcomm,andSeagate. Wearegratefulforallthosewhocontributedtheirexpertisetomakethisyear s activitiesrichandinformative,includinglukyekowuryanto,deputyministerfor InfrastructureandRegionalPlanning,CMEA;C.Triharso,DirectorofElectronicsand TelematicsIndustry,MinistryofIndustry;Fetnayeti,DirectorofDomesticBusiness DevelopmentandEnterpriseRegistration,MinistryofTrade;Ismail,DirectorofSpecial Telecommunication,BroadcastingandUSO,MinistryofCommunicationand InformationTechnology;Prakoso,DeputyAssistantforCoordinationof TelecommunicationandInformatics,CoordinatingMinistryforPolitical,Legaland SecurityAffairs;ErmaDewiPujawati,DirectorofInternationalBusinessCooperation, BKPM;LollyAmaliaAbdullah,DirectorofCooperationandFacilitation,Ministryof TourismandCreativeEconomy;DidiSumedi,DirectorofImport,MinistryofTrade; TonySenoHartono,NationalTechnologyOfficer,Microsoft;ZainuddinH.Nasution, SectionHead,DepartmentofBankingResearchandRegulationDPNP),Financial ServiceAuthorityOJK);HasyimGautama,SectionHeadofSecurityManagement, DirectorGeneralofInformaticsApplications,MinistryofCommunicationand Informatics;JonathanSelvasegaram,CorporateAttorney,DigitalCrimeUnit,Microsoft; MarcoOgliengo,ManagingDirector,Zalora;BudiGandasoebrata,DirectorandVP, VeritransIndonesia;BertVerscheldeandErikvanderMare,EuropeanCenterof InternationalPoliticalEconomy,BrusselsECIPE);AlexanderRusli,PresidentDirector andceo,indosat;irnipalar,director&countrymanager,mastercardindonesia; TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page4of35

ShintoNugroho,HeadofPublicPolicyandGovernmentRelations,GoogleIndonesia; EddyThoyib,ExecutiveDirector,IndonesianICTSocietyMASTEL);NurulIchwan, DeputyDirectorforManufacturingIndustryPromotion,IndonesiaInvestment CoordinatingBoardBKPM);ChrisZull,SpectrumDirector,AsiaPacific,GSMA;and DavidSiow,RegionalManager,ProductsComplianceandCertification,Cisco. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page5of35

EXECUTIVESUMMARY TheadvancementofICTisoneofthekeypillarsoftheIndonesiangovernment s effortstoaccelerateandexpandtheindonesia seconomicdevelopment.tohelpdrive towardsthisgoal,theindonesiaictconsultativeforumiicf)wasconceivedasajoint initiativebetweenindonesia scoordinatingministryforeconomicaffairscmea)and theusraseanbusinesscouncilusabc).theaimoftheiicfistoserveasa collaborativeplatformbetweengovernmentandindustrytodevelopindonesia sict industryandtosupportthecreationofaknowledgerbasedeconomyinindonesia.in theiicf squarterlyexecutivecommitteemeetingsin2014,maindiscussiontopics includedcloudcomputing,cybersecurity,ercommerce,andencouragingtradeand investmentinindonesia sictindustry. ThefocusofthediscussiononcloudcomputinginIndonesiawasmanagingthetension betweendatalocalisationrequirementsandtheirdownstreameffectsoneconomic competitiveness.cybersecuritywasalsoamajorconsideration,withfraudidentified asthemostprevalentcyberthreattothecountry.theprivatesectorsharedexisting fraudpreventionsolutionswhiletheministryofcommunicationandinformation Technology smcit)directorateofinformationsecuritypresentedonexisting governmentmeasurestocombatcyberthreats.inordertoenhancecybersecurity, recommendationsweremadetostrengthenlegalframeworks,technicaland proceduralmeasures,organizationalstructures,capacitybuildinginitiatives,and internationalcooperation. ThepotentialforeRCommercegrowthislimitedinIndonesiabyfraudconcerns,lackof secureinfrastructureforonlinepayments,andlowcreditcardpenetrationrates.to exploitthebenefitsofictandmobilerandwebrbasedretailapplications, recommendationsweremadetosecureonlinetransactions,utilizeinnovative paymentsolutionssuchasmobilemoney,anduseeducationcampaignstoaddressthe TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page6of35

fraudrrelatedconcernsofconsumers,merchants,andbanks.extendingercommerce supporttosmes,whotypicallyfacegreaterconstraintsinadoptingict,wasalsoakey discussionpoint. Lastly,inordertoencourageITinvestmentinIndonesia,theindustrysharedbest practicesinsimplifyingandexpeditingproductcertificationandcompliancewhile maintainingconsumersafety.othertopicsofdiscussionrelatedtosupporting broadbanddevelopmentinindonesiaandtaxationpolicies.theiicfrecognizedthe needforshapingtheregulatoryframeworktocreateabusinessrfriendlyenvironment inindonesiathatwouldattractgreaterinvestmentstothecountry,andfacilitate greatercertainty,predictability,andeaseofdoingbusinessinthecountry. Initsinauguralyear,theIICF squarterlymeetingscenteredonbuildingastrong foundationforicttothriveinindonesia.astheiicfentersitssecondyear,wepropose forthefocustobeonunderstandingtheimpactofictacrosskeysectors,inparticular, ergovernment,erhealth,ereducation,erbanking,andbigdataapplications,aswellas streamlininggovernmentandregulatoryprocessesimpactingbusinessoperationsin Indonesia. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page7of35

TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page8of35 DevelopmentofICTshould continuetobeacceleratedin ordertoimprovethenation s competitivenesstocreatea knowledgerbasedeconomy BMasterPlanfortheAcceleration& ExpansionofIndonesianEconomic Development2011B2025 BACKGROUNDOFIICF RapiddevelopmentsinInformationandCommunicationTechnologyICT)present substantialgrowthopportunitiesformultiplesectorsacrossindonesia.withahighly competitivetelecommunicationsmarketandhighmobilepenetrationrates,disruptive technologiessuchasthemobileinternet,cloudtechnology,andbigdatapresent leapfroggingopportunitiesfortherapidlygrowingcountry.beyondincreasingthe competitivenessofthelocaleconomy,theseictapplicationscreatemoreinclusive growthbyextendingthereachofformalbankingservices,education,andhealthcare, aswellasbyloweringthebarrierstoentryforsmes. GiventhattheadvancementofICTisoneof themaineconomicactivitiesthatsupports themasterplanfortheaccelerationand ExpansionofIndonesianEconomic Development2011R2025MP3EI),the governmentofindonesiagoi)sawthe needforanintegratedandcoordinated forumbetweenthegovernmentof IndonesiaandtheICTindustrytoencourage innovationandgrowthintheictecosystem. Inaccordancewithnationalpriorities,theIndonesiaICTConsultativeForumIICF)was conceivedasajointinitiativebetweentheusraseanbusinesscouncilusabc)and Indonesia scoordinatingministryforeconomicaffairscmea).thisforumservesasa collaborativeplatformbetweengovernmentandindustrytodevelopindonesia sict industryandsupporttheimplementationofmp3ei.

ThepurposeofthisreportistohighlightkeyfindingsfromthequarterlyIICFmeetings heldin2014.itincludesthekeythemesdiscussed,policydesignconsiderationsforthe incomingadministration,andrecommendationsforthe2015iicfagenda. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page9of35

OBJECTIVES DevelopacommonunderstandingonICTRrelatedregulatorydevelopments, schemes,andinvestmentpoliciesinindonesia.understandtheunderlying principlesbehindgovernmentpoliciesallowsthebusinesscommunitytooffer solutionsthataresuitedtotheindonesiancontext. FacilitatethesharingoftrendsandbestpracticesintheICTindustryatthelocal, regional,andgloballeveltoachievethesharedgoalofcreatingaknowledgerbased economyinindonesia. CoXCreate winxwin policiesthroughindustryconsultationinthedevelopmentof ICTpolicyandregulationinIndonesia,offeringgovernmentincentives,and leveragingonprivatesector sexpertiseandinnovationtopromotegrowthand solvechallengesfacedinictradoption. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page10of35

STRUCTURE TheIICFconsistsofaSteeringCommittee,anExecutiveCommittee,andWorkStreams Figure1).!! Steering!Committee!! Figure!1:!IICF!Structure! TheSteeringCommitteeischairedbytheDeputyMinisterforInfrastructureand RegionalPlanningintheCoordinatingMinistryforEconomicAffairsCMEA)and comprisesgovernmentofficialsatthedeputyminister,directorgeneral,anddeputy ChairmanlevelEchelon1). TheSteeringCommitteeistaskedtoprovidedirectiontotheExecutiveCommitteein termsofdeterminingandformulatingrecommendationsforictactivitiesandtoassess theexecutionofactivitiescarriedoutbytheexecutivecommittee.!!! TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page11of35!

TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page12of35 Executive!Committee TheExecutiveCommitteeiscoRchairedbyEddySatriya,DeputyAssistantforICTand UtilityinCMEA,andElizabethHernandez,theICTCommitteeChairofUSABC.The committeecomprisesgovernmentofficialsatthedeputyassistantanddirectorlevel Echelon2),andprivatecompaniesfromUSABC sictcommittee,theamerican ChamberofCommerceAmCham)Indonesia sit&teleconnectivitycommittee, MASTEL,andKADIN. TheExecutiveCommitteeistaskedtodevelopandexecuteIICFworkplansand determineactivitiesfortheworkstreamleaders.intheexecutivecommittee QuarterlyForums,committeemembersandICTassociationsmeettodiscussnew initiativesandpolicyandregulatoryissues. TheresultsofthequarterlyforumswillbereportedtotheCoordinatingMinisterfor EconomicAffairs,aswellasMinistersfromrelevantMinistries,throughtheChairman ofthesteeringcommittee. Work!Streams! TheworkstreamsaredirectedbytheExecutiveCommitteeandprovideanavenueto discussissuesindepth.eachworkstreamisledbyamemberfromusabc sict Committeeandwillprovidedetailedinputsandtimelyupdates.Giventhatthisisa consultativeforum,thescopeofeachworkstreamisopenandsubjecttochange.in 2014,theidentifiedworkstreamswere: RegulatoryInsights Leaders:Google,Cisco IncentivizingLocalization Leader:Intel EmergingDigitalTrends Leaders:Microsoft,Qualcomm Examininglocalandglobal regulationsandbestpractices thatadvancesustainable,longr termgrowthintheictsector Identifyingopportunitiestogrow thelocalictindustry Updatesonglobalindustrytrends andrelevancetotheict ecosysteminindonesia.

KEYMILESTONES 1 st ExecutiveCommitteeForum,April1 st 2014 IntroductionoftheIICFconcept,goals,andstructure Workstreamleadersintroducedtheir2014focusareasandplans o RegulatoryInsights:Theimportanceofindustryconsultationtodevelop robustandtimelyregulationsthatwillincreasethecompetitivenessof Indonesia sictsector. o IncentivizingLocalization:Theneedforgovernmentleadershipin stimulatinginvestmentinterest. o EmergingDigitalTrends:TrendsinIndonesia sdigitallandscapeandthe impactofcloudcomputingontheindonesiangovernmentand businesses. DiscussionofIICFnextsteps o Inclusionofthefinancialservicescommitteeduetotheinherent overlapbetweenensuringaccesstofinancialservicesandrealizing Indonesia sictpotential o Considerationforinfrastructurerequirementshardandsoft)andSMEs accesstothem o Considerationforsecurityandprivacyinachangingdigitallandscape 2 nd ExecutiveCommitteeForum,June24 th 2014 MinistriessharedtheirtopICTRrelatedissues o Riseofcybercrimeandexistinggovernmentinitiativestosafeguard Indonesia sdigitallandscape o Financialinstitution susageofictinriskmanagementanderbanking servicesandthecyberthreatstheyface o TheIndonesianBroadbandPlan2014R2019anditsinfrastructureand securityneeds TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page13of35

Industrysharedexistingsolutionstocombatcybercrimeandsafeguardingonline transactions 3 rd ExecutiveCommitteeForum,October2 nd,2014 VisionforIndonesia sictecosystem:thethreekeypillarsareinfrastructure, paymentsystems,andbuildingcontentandinvestment. SupportingIndonesia sercommercemarket o Developingarobustandsecurepaymentinfrastructure o Adoptinginnovativepaymentsolutions o FormalizingSMEsupportineRCommerce EncouragingtradeandinvestmentinIndonesia sictindustry o Productcomplianceandconsumersafety o Fiscalpoliciesandtheproposedluxurytaxonimportedmobilephones o SupportingbroadbanddevelopmentinIndonesia:Developingstandards andinfrastructure TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page14of35

KEYTHEMES EnablingtheBenefitsofCloud ComputinginIndonesia Indonesia sescalatingonlinepopulationand highmobilephonepenetrationrates positionsittowellreapthebenefitsof cloudcomputing.thisrevolutionary developmenthasbeenidentifiedbythe EmergingDigitalTrendsworkstreamasan areathatwillcreatesignificantnew opportunitiesforconsumers,governments, andbusinessesinindonesia. Torealizethefullpotentialofcloud computing,itiscrucialfortheregulatory regimetokeeppacewithrapid developmentsintheindustryandto implementpositivepolicies. BenefitsofCloudComputingin Indonesia JobCreation:CloudRrelated jobsexpectedtogrowby 102%between2012and2015. SMEGrowth:Highlevelsof computingpowerandlower costsofproduction RuralAccess:Improved remoteaccesstohealthcare, education,andergovernment services EmergencyPreparedness& DisasterRelief:Improved communicationanddata sharing ConsequencesofEconomyX widedatalocalisation MeasuresonCompetitiveness GDP:R0.8% DomesticInvestments:R2.3% Exports:R1.7% Source:ECIPE2014).TheCostsofData Localisation:TheFriendlyFireonEconomic Recovery. C Akeyissueinpolicydesignisbalancinglawenforcementandsecuritywithindustry growth.managingthistensioninfluencestheextenttowhicheconomiesofscalecan bereapedintheprovisionofscalableservicesthrougharelativelysmallnumberof strategicallylocateddatacentres. TheindustryismindfulthattheMinistryofCommunicationsandInformation Technology smcit)regulationno.82of2012regardingtheimplementationof ElectronicTransactionsandSystemsrequirementfor electronicsystemsoperatorsof TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page15of35

publicservices tosetupalocaldataanddisasterrecoverycentreisforthepurposeof lawenforcementanddataprotection.however,policymakersshouldconsiderthe economicconsequencesofdatalocalizationrequirementsandrelateddataprivacy andsecuritylawsthatexcludeforeignsuppliersofdataanddownstreamgoodsand serviceproviders. DatalocalizationandprocessingrequirementsfaceacomplexinterRrelationship betweencrossrborderdataflows,supplyrchainfragmentation,anddomesticprices.it isnotjustinternetcompaniesthatareaffected,companiesinthefinancial,retail, logistics,manufacturing,andcommunicationssectorsallusepersonaldataacrosstheir supplychainsandaresimilarlyimpacted. Indonesianbusinessesrelyonaccesstopersonaldatatoefficientlydesign,produce, sell,anddelivergoodsandservices,makingglobalanddomesticdataanewformof currencythatsmescanleverageontobecomeglobalplayers.furthermore,itislikely thatsmeswillbethefirsttobedisplacedfromthemarketastheylacktheresources toadapttotheregulatorychanges. PolicyConsideration:Inordertomaximizethebenefitsofcloudcomputing,itis importanttostrikeabalancebetweendataprotectionmeasuresandthe downstreameffectsofdatalocalizationrequirementsofgdp,investments,and welfare.therealsoneedstobeaclearerlegalstandingondatacentresin IndonesiaandmorecoordinationbetweentheMinistryofCommunicationand InformationTechnologyMCIT),theFinancialServicesAuthorityOJK),andother relatedgovernmentinstitutions. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page16of35

TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page17of35 CyberCrimeinIndonesia RankedtenthinSymantec s globallistascountry accountedfor2.4%ofworld s cybercrimesin2011. Ofthe39millionattacksin 2012,35%originatedfrom outsidethecountry,while65% camefromwithin. 86%ofInternetusersin Indonesiareportedbeing victimsofcybercrimein2010. Source:DAKAAdvisoryReport SecuringIndonesia sdigitalenvironment Indonesia srapiddevelopmenthasbeenaccompaniedbythewidespreadadoptionof ICTbythedomesticeconomyandcivilsocietyatlarge.Thisnaturallyleadstoincreased cyberthreatstoallaspectsofsociety,includingthefreeandaccurateflowof information,trust,andsocioreconomies. Boostingthecountry sresiliencetocyberthreatsnecessitatestheinvolvementof multiplestakeholdersfromgovernmentregulationandindustryinteresttouser awarenessandtheeducationalsystem. AccordingtoresearchbyDAKAAdvisory, Indonesiaiscurrentlymoresusceptibleto lesssophisticatedcybercrimeslikefraud andothercontentrrelatedchallenges.the MCIT sdirectorateofinformationsecurity identifiedthefivetopareasofvulnerability inindonesiatodayasmalware,phishing, mobilethreats,socialmedia,and hacktivism. DuringtheExecutiveCommitteeMeetingin June2014,therewasconsensusamongparticipantsthatcybercrimesstemmainly fromalackofawareness.anmcitrepresentativesharedthatunlikeprivatesector companieswhotypicallyabidebyiso27001standardsforinformationsecurity Management,manyministriesandpublicagenciesremainunawareofsuchstandards andfailtoadopttheappropriatesecuritymeasures.inaddition,users insufficient knowledgeonitsecuritymakesthemespeciallyvulnerabletodeceptivewebsitesand SMSRandemailRphishing.Manyareunawareoftheexistenceofsecuritysolutionsfor theirmobiledevicesandtherisksassociatedwithhavingasocialmediaaccount.

Indonesia slargestfashionercommercesite,zalora,highlightedthattheprevalenceof fraudandtheresultingdearthofconsumertrust)limitsercommerce sgrowth potential.regulatorsshouldgobeyondprotectingbanksandconsumers,andprotect merchantsaswell.forexample,inthecaseofa friendlyfraud,theperpetratorsare usuallyconsumersagainstmerchants. ExistingPrivateSectorSolutions Onlinepaymentgateway,VeritransIndonesia,presentedonexistingfraudprevention techniquestosecureonlinetransactions.fromapaymentgateway spointofview,out ofthethreecategoriesoffraud,internalfraudcomparedtoconsumerandmerchant fraud)hasthepotentialtocausethemostdamage.internalfraudoccurswhenthereis abreachofdata,whichcanbeusedforfraudtransaction.currentfraudprevention solutionsinclude:amanualreview,cvv/securitycode,3drsecure,bincheck,velocity ofchange,velocityofuse,andfraudrules. Besidesfraudpreventiontechniques,maintainingasecuredigitalenvironment involvesaddressingissuessuchasweak/defaultpasswords,lackofemployee education,securitydeficiencies,andslowselfrdetection.indicatorsofaninsecure environmentarethelackofawareness,littleincentivetorerengineerprocesses, mergingdifferentpeopleandprocesses,slowadoptionofevolvingtechnology,and unnecessaryexposuretosensitivedata.inthiscase,preventiontechniquesinclude identifyingandisolatingprivilegedusers,auditinguserendpassword,alertand monitoring,andreviewingaccessrules.bestpracticesincludedevaluatingdata wheneverpossible,continuousimprovement,and stopthinkingscope,startthinking risk. MicrosoftalsogaveanintroductionoftheirnewDigitalCrimesUnitthatfocuseson cybersecurityinthreemainareas:malicioussoftwarecrimes,particularlybotnetr driveninternetattacks;piracyandintellectualpropertycrimes;andtechnologyr TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page18of35

facilitatedtowardsexploitationofchildrenandtheelderly.thedigitalcrimesunit protectsconsumersbyadoptinganoffensiveapproachthatusesstrongerprograms likeinformationprotection,accesscontrol,antirmalware,policymanagement, researchandresponse,andsecuredevelopment.microsoftemphasizedthefollowing bestpracticesinprotectingindonesiansagainstcybercrime:investmentinthelatest toolsandtechnologies;proractivedisruption;strongandsecureproductsandcloud services;securebankingitinfrastructure;educationonsafeonlinebankingpractices; andtheuseofgenuinesoftware. CurrentGovernmentInitiatives MCIT sdirectorateofinformationsecuritypointedoutthatinordertosafeguard Indonesia scyberspace,theglobalcybersecurityagendaidrgca)needstobe addressedwithinallpillarsinindonesia:legalframework,technicalandprocedural measures,organizationalstructures,capacitybuilding,andinternationalcooperation. AftertherepresentativesharedexistinggovernmentinitiativesintheseareasFigure 2),theforumparticipantsmadethefollowingrecommendationsinstrengthening thesepillars.!!!!!! TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page19of35

! Figure!2:!Pillars!of!Cyber!Security!in!Indonesia! LegalFramework:TheTelecommunicationsActNo.36/1999onlymentions telecommunicationsinfrastructuresecuritybrieflyanddoesnotdiscussitinthe specificcontextoftheinternet.whilethemorerecentinformationtransaction ElectronicActNo.11/2008providesthebasisforlawenforcement,inorderto prosecutecriminals,itoftenneedstobesupplementedbyotheracts,suchasthe CopyrightLaw,No.28/2014.CurrentlyaregulationonDataPrivacyProtectionisbeing completed.however,thereneedstobeacommonunderstandingonthedefinition andsemanticsof cyberlaw. TechnicalandProceduralMeasures:WhileIndonesiahasdevelopedtechnicaland proceduralmeasurestoaddressvulnerabilities,moreinvestmentisneededtoenhance effortsandresources.therearedebatesregardingwhetherinformationon vulnerabilitiesshouldbedisclosedandpolicymakersaretornindecidingifitis worthwhiletoinvestindevelopingsecuritystandardswhichgobeyondbasiclegal compliance. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page20of35

OrganizationalStructures:WhiletheCoordinatingMinistryforPolitics,Law,and SecuritysDeskforNationalCyberInformationResilienceandSecurityhasbeenbegun operatingandisconstructingaconvergentregulationtobeimplementedbythe incomingadministration,alegalsourceisstillneeded.inaddition,cyberrrelatedissues inindonesiaarenotwellcoordinatedamonggovernmentagencies.whilethedeskis undercoordinationoftheministryofdefence,whichfocusesoncyberdefence,italso addressesothercyber relatedmatterssuchascybercrimes. CapacityBuilding:Moreinvestmentisneededtoenhancecybersecurityexpertise, particularlyinthepublicsector.smesunderthecoordinationofmcitalsorequire assistancefortrainingandeducation,andneedadditionalhelptocomplywithnew legislativemeasures. InternationalCooperation:WhilemaintainingIndonesia ssovereigntyinthecyber worldisimportant,cybercriminals exploitationoftheblurredlegaljurisdictions betweencountriesmakesinterrstaterelationsatoppriority.buildinganinternational frameworkforcybersecuritywithhighrlevelprinciplesisvitalinconductingcybercrime investigation.thismakesitvitaltoholddiscussionsleadingtomemorandumsof Understandingtowardsagreementtocollaborateonspecificareasofcybersecurity throughaseannetworksecurityactioncouncilworkinggroup,international TelecommunicationUnionITU),bilateralcooperation,AsiaPacificComputer EmergencyResponseTeamAPCERT),ForumofIncidentResponseandSecurityTeams FIRST)andotherrelatedforums. PolicyConsiderations: Thereshouldbeasynergeticeffortbetweenregulators,practitioners,and customersinconstructingbettercybersecuritymeasures.thisinvolves managingthetensionbetweenleveragingonnewtechnologytrendsand strictregulations.forexample,ratherthanimposingoverlystrictand TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page21of35

cumbersomeregulations,littlethingssuchaspostingeducationmaterialand warningsofcybercrimeonbanks homepagescangoalongwayinimproving cybersecurity. AkeyenablerofeRgovernmentinitiativesistoenhancethepublicsector s cybersecurityexpertiseandmandatepublicagencies adherenceto standardssuchasiso27001forinformationsecuritymanagement.more coordinationisalsoneededbetweenagenciestofacilitateinformation sharing,avoidduplicateefforts,andpreventregulatorygaps. ThetransRboundarynatureofcybercrimesmakesitcrucialforinternational coordinationinthedevelopmentofaninternationalframeworkfor cybersecuritywithhighrlevelprinciples. EBCommerceinIndonesia WhileB2CeRCommerceinIndonesiacurrentlyaccountsforamere0.1%ofallretail expenditures 1,theindustryissetforsubstantialgrowthowingtofactorssuchasa risingyouthpopulation,risingdisposableincomes,rapidurbanization,andthe increasingadoptionandpenetrationoftechnologysuchastheinternetandmobile phones.tofullyrealizethepotentialofthisnascentindustry,providingregulatory certainty,developingthenecessaryinfrastructure,andfacilitatingtheinclusionof SMEsarekey. 1 ASEANeCommerce:IsASEANataninflectionpointforeCommerce?,UBSGlobalResearch,June13, 2014. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page22of35

AccordingtoZalora,Indonesiaperformsrelativelywellintermsoflogistical infrastructuretoenabletimelydelivery.eventhoughtheproportionoffixed broadbandsubscribersinindonesiaislowcomparedtolargedevelopingcountries,the country shighpenetrationratesformobilebroadbandmakesercommerceaccessible eveninremoteareasfigure3).instead,themajorroadblocktoercommercegrowth inindonesiaisthecombinationofpoorpaymentinfrastructureandalackofconsumer trustinmakingonlinepayments.thisconcernwasechoedbymanyforum participants.!! Figure!3:!Fixed!broadband!and!mobile!phone!penetration! TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page23of35

Developingarobustpaymentinfrastructure IndonesiaisalargelycashRbasedeconomywithlowcreditanddebitcardpenetration. AccordingtoEuromonitor s2013internationaldata,92millionbankaccountsin Indonesiahavelinkedbankcardsoutofapopulationof240million.Thishasprompted manyretailmerchantstooffercashruponrdeliveryservices.accordingtomastercard, cashpaymentsaccountfor37.9%ofercommercetransactions,followedbybank transfers27.5%)andlastly,creditcardpayments10%) 2.Whilecashupondeliveryisa practicalsolutionintheshortrun,itimposessignificantfinancialcostsoncompaniesin theformoflabour,cashhandling,andhigherreturnsofpurchaseditems.these additionalcostswillhavethemostsignificantimpactonresourcerconstrainedsmes. Inordertoincreasecreditcardpenetration,MasterCardandotherindustryplayers emphasizedtheneedformerchants,bankpartners,ojk,anditandpayment companiestoconvenetoaddresspaymentissues.forexample,reducingfraudrrelated concernsthroughaconcertedefforttoeducateconsumersandbanks,increased opennessinawardinglicensestoforeignpaymentprocessors,andtighteningsecurity throughtheuseofonetimepasswordsotps)asafraudpreventiontool. Adoptinginnovativepaymentsolutions InlinewithIndonesia snationalmovementofnonrcashgnnt),mobilepaymentsare anincreasinglyfeasiblepaymentplatformforonlinegoodsandservices.giventhe highmobilephonepenetrationrateinindonesiaandruralpopulations limited physicalaccesstobanksandotherfinancialinstitutions,theprovisionofmobile walletsbytelecommunicationoperatorsextendsercommerceandfinancialservicesto previouslyunbankedindonesians. 2 MasterCardAcceleratesERcommerceIndustryDevelopmentinIndonesia, MasterCardpressrelease, August14,2014. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page24of35

WhileIndonesia sthreemajortelecommunicationoperators Indosat,Telkomsel,and XLAxiata investmentsinmakingmobilemoneyinteroperabletoenablerealrtime transfersacrossindependentnetworksisabigstepinercommerce,customeradoption ofmobilemoneyremainslowduetolowawarenessandthefearofsendingmoneyto thewrongnumber 3.Operatorsshouldworktogethertoraiseawarenessofthe benefitsofelectronictransactionsandeducateconsumersonthesafeguardsthathave beenputinplace,forexample,theceilingonmobilemoneyusageandthereassurance thatthemobiledeviceismerelyadeliverymechanismcashremainsinthebank). GiventhattheeRCommerceandmobilemoneyindustryisstillinitsinfancy,the regulatoryenvironmentisstillbeingformed.asonlineservicesgrowinpopularity,itis necessarytoharmonizeregulatorylicensesacrossdistricts,implementacommon solutionformerchantpayments,anddevelopprocessesforissueslikedispute resolution.panelistsalsohighlightedtheneedforlargeprivatecompaniestoprovide moreefficientanddeliverysystemsforercommerce. ExtendingeXCommercesupporttoSMEs TheSMEsegmentinIndonesiaisgrowingrapidlyandmakesasignificantcontribution tothecountry sgrossdomesticproductgdp).in2011,smescontributiontonational GDPwasabout57.94%orequaltoIDR4.303.571,5Trillion)andthisincreasedto 59.08%orequaltoIDR4.869.568,1Trillion)in2012 4.Thesecontributionshavemade SMEsoneofthekeysectorstoenhanceIndonesia seconomy. 3 VisaMultiBCountryResearchStudy:MobileMoneyInsights,TNSResearch,January2013. 4 PromotingtheSMEsExportsintheOICMemberStates,COMCECCoordinationOffice,June2013. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page25of35

USXASEANBusinessAllianceforCompetitiveSMEsActivitiesfor2014X2015 2014!activities!! Goal:ImproveSMEsaccesstotechnologyandassistincapacitybuilding Smarttechnologyforsmarterbusiness workshop IncollaborationwithIndonesia sannualsme sco.festival,conducted SMEsinaDigital, Borderless,Competitive,andGreenerWorld:DevelopmentTrendsandTools workshop IncollaborationwiththeASEANFoundationandMicrosoft,developedtwobasictraining coursesforyoungentrepreneursonusingicttoolsforbusinessdevelopmentand management. Upcoming!activities!in!2015!! Goal:IncreasedomesticcompetitivenessofASEANSMEsandbetterintegratethemintoregional andglobalvaluechains ASEANOnlineSMEAcademy:ProvidesSMEswithfree,centralized,onlineaccesstorelevant andcountryrspecificinformationforbusinessstartrups,trainingresources,networking platform,tradeandmarketlinkageresources,andfinanceinformation. ERCommerceoffersasignificantopportunityforSMEsthroughenablingaccesstonew markets,expandingthescopeofmarketing,reducingthecostofoperations,and developingnewpartnershipswithsuppliersandothercollaborators.however,smes facesignificantanduniquechallengesinercommerceadoption.first,smesareslow adoptersofercommerceandictingeneral.thisisduetolowcomputerliteracy, limitedknowledgeofercommercemodels,lowawarenessofthebenefitsofict,and uncertaintyaboutthereturnsoninvestments. Second,SMEsneedforbroadbandservicesarenotalwaysservedby telecommunicationserviceproviders.indosatsharedthatfixedservicesareoffered typicallytocorporateandlargersmes,andwhilethecompanyispushingforstrategies tooffercellularservicestosmallersmes,theyfacechallengesisaddressingthefine linebetweensmallersmesandthehighrendconsumermarket. Third,Indonesianbanks rigidstandardsinareassuchasmerchantunderwritinglimits linkagesbetweensmeercommerceactivitiesandbanks.thisisexacerbatedbysmes TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page26of35

TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page27of35 lowcapitalbaseandlackofcollateralpropertytosecureloans.whilebanksare beginningtooffersmallerrsizedloanstosmes,moreneedstobedoneindevelopinga nationallendinginfrastructurethatimprovestheenvironmentforsmestogaingreater accesstotradefinance,reducethecostoffinance,andencouragelending/extension ofcredittosmes. Theprovisionofwholesaleinfrastructurethroughangelandventurecapitalfinancing isanotherwaytocatalyzesmegrowth.oneexampleisindosat scollaborationswith MountainPartnersAGandSoftbankwhichhelpstodevelopICTstartRupsandincrease theirvisibilityandvaluationbyexposingthemtointernationalmarkets.however,the outcomesofsuchinitiativesareerodedbyexistingregulationssuchasthenew NegativeInvestmentListthatcloseseRCommercetoforeigninvestorsandthenew TradeLawthatmandatesforexportstobecarriedoutonlybyregisteredexporters. ThishampersdomesticallyRproducedexportsbySMEs,thushamperingthescalability oftheirservicesfigure4).!!!!!!!!!!!!!!!!!!!! Figure!4:!Share!of!SMEs!contribution!to!total!exports,!1990J2006!

Policy!Design!Considerations! AseRCommerceinIndonesiaisatitsinfancy,involvingallstakeholdersin developingregulationsiscrucialtorealizingitsfullgrowthpotential. HavingadevelopedpaymentindustryisakeyenablertoeRCommercegrowth andthereshouldbeaplatformforstakeholderssuchasbankindonesia,ojk, anditandpaymentcompaniestoconvenetoaddresspaymentissues. SMEsmakeup90%ofbusinessesinIndonesiaandeRCommercepresentsa significantgrowthopportunityforthem.moreinitiativesareneededto ensureinclusionofsmesinthisopportunitysuchasfacilitatingtheiraccessto relatedfinancialservicesandinfrastructure. BestPracticesinEncouragingTradeandInvestmentin Indonesia sictindustry Indonesia sfiscal,regulatory,andlicensingpolicies,aswellasgovernmentsupportfor infrastructure,r&d,andhumancapitaldevelopment,allhaveaprofoundinfluenceon ICTinvestmentandadoption. ProductComplianceandConsumerSafety Thekeyissueregulatorsfaceinproductcomplianceismanagingthetensionbetween consumersafetyandoverlycomplexcertificationandenforcementproceduresthat increasetheburdenofdoingbusinessinindonesia.giventheshortlifercycleofthe timersensitivehandsetindustry,thetimerconsumingcertificationprocesshasresulted inhandsetmanufacturersrechannelingtheirinvestmentselsewhere,thuslimiting accesstoarangeofinnovativeproducts.! TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page28of35

Thefollowingareinternationalbestpracticesinsimplifyingandexpeditingproduct compliancetoenhancetheeaseofdoingbusinesswhileensuringthatsafetyand complianceconcernsareadequatelyaddressed. BestPractice1:Atieredapproach,ordifferentlevelsofadherencetostandards,for differentproducttypescanexpeditethecertificationprocess InSingapore,theInfocommDevelopmentAuthorityIDA)approvesproductsthrough differentregistrationschemesthatdifferbasedonproductrtypeandthelikelihoodof itcausinginterference.similarly,undertheusfederalcommunicationscommission FCC)ApprovalScheme,ClassAdevices,whicharemarketedforcommercialand industrialuse,undergoalessstringentverificationprocesswherethemanufacturer takesthenecessarystepstoensurecomplianceandthesubmissionofrepresentative dataisnotrequired.ontheotherhand,classbdevices,whicharemarketedforusein aresidentialenvironment,aresubjecttostricterrequirementsandgainmarketentry viaadeclarationofconformitywhereproductsmustbetestedinanaccreditedlab thatisbasedoniso17025standards.strictrequirementsarealsoimposedonradior basedproductsthatmustundergoacertificationprocesswhichisauthorizedbythe FCC,basedonthesubmittedrepresentativeandtestdata. BestPractice2:Recognitionofothercertificationstoavoidduplicateprocesses IntheEU,allproductsareregulatedbyEUdirectiveswhichmandatethatoncea productbearingthecemarkingisplacedintheeumarket,memberstatesshall presumecompliancewiththeeudirectivesandshallnotprohibit,restrict,orimpede theplacementofthisproductorserviceintheirmarket,unlesstheyhaveevidenceto thecontrary.intheus,telecommunicationproductswithadeclarationofconformity areexemptedfromfurtherreviewbytheregulator. BestPractice3:PostBmarketsurveillancetoenforcecompliance Asopposedtothetypicalapprovalregimewhereproductcomplianceisverifiedbefore enteringthemarket,theeumarketsurveillanceauthoritiesonlyconductrandom TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page29of35

TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page30of35 BestPracticesinSupporting aneffectivetaxsystem Ingeneral,taxationshouldbe broadrbased Taxesshouldaccountfor sectorandproduct externalities,suchasthe positivebenefitsofmobile Thetaxandregulatorysystem shouldbesimple,easily understandableandenforced Dynamicincentivesshouldbe unaffected Taxesshouldbeequitable,and theburdenoftaxation shouldnotfall disproportionatelyonthepoor Source:GSMA/DeloitteReport compliancechecksaftertheproductsareonthemarket.thisallowsconsumersto havefasteraccesstostaterofrtherarttechnologyratherthanbeingheldupbya backlogofregulatoryapprovals.similarlyintheus,thefccenforcementbureauas wellastheauthorizationlabonlyinvestigatereportsofnonrcompliantproductsbeing imported,aswellasreportedcasesofinterference.insingapore,asapostrsurveillance measure,idamayrequirethesuppliertosubmitthetestresultsorevidenceof equipmentcertificationasproofofconformitywiththeapplicableidatechnical specifications. FiscalPolicies Tariffandtaxationpoliciesimpactthe affordabilityofictproductsandservices andcanbeasignificantbarriertoits adoption.theproposedluxurytaxon importedmobilephonesbytheministryof IndustryandtheMinistryofTradeis intendedtospurgrowthinthedomestic mobilephoneindustryandtoaddress Indonesia stradedeficitbyslowingimports. However,thereareconcernssurrounding thenegativeunintendedconsequencesof ICTRsectorspecifictaxes. Accordingtoa2011DeloitteandGSMAstudy,mobiletelephonyismoreextensive thanfixedaccesstelephonyduetounderdevelopednetworks.giventhatmobile telephonyrepresentstheuniversalaccesstotelephonyandbroadband,handsettaxes willincreasethecostofmobileownershipandexacerbatetheexistingdigitaldivide. Inaddition,currentdecreasesinhandsetandsmartphonepricesoffersignificant opportunitiesintermsofapositivecontributiontogdpandjobs,increasedinnovation

andproductivity,andmoreinclusivesocioreconomicoutcomesthroughincreased accesstomobilerhealth,rgovernment,andreducation.theindonesiacellphone Associationhasindicatedthattheproposed20%luxurytaxcouldleadtoadropin smartphonesalesby50%,anderodethebenefitsofcurrentpricereductions. Conversely,loweringhandsettaxationhasbeenshowntoincreasemobilepenetration andmobilebroadbandpenetration.inaugust2009,thekenyangovernmentremoved the16%vatonmobilephonehandsets.sincethenhandsetpurchaseshaveincreased bymorethan200%andmobileconnectionpenetrationhasincreasedfrom50%to 70%oftheKenyanpopulation.A2014GSMA/Deloittestudyalsoshowedthatwhen mobiletaxeswerereduced,theshortrtermlossingovernmentrevenueswasquickly recoveredinthemediumrtermduetothegrowthinthetaxbasefigure5). Figure!5:!Ability!of!market!to!recover!lost!tax!in!years!following!an!adJvalorem!tax!reduction! SupportingbroadbanddevelopmentinIndonesia WhilebroadbandisakeyenableroftheICTindustry,itfacescurrentchallengesin termsoflimitedbandwidthandlackofbroadbandinfrastructureinruralareas. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page31of35

Currently,Indonesiaonlyhas50MHzofspectrumallocatedforwirelessbroadband. With9operatorsinIndonesiaandlimitedbandwidthavailable,morespectrumneeds tobeallocatedforbroadbandtoaccommodatetheforecastedincreaseindemand. BesideshavingaregulatoryplatformthatwillalsoallowtheaccelerationofICT infrastructuredevelopment,ictstandardsmustbeconstantlyupdatedtoremain relevanttotherapidlychangingtechnologicalenvironmentandtosupportthe emergenceofbandwidthrintensiveapplications. InIndonesia,thecurrentWiRFibandwidthislimitedto20MHzdespitetheavailability oflatestwirfitechnologiesthatsupportbandwidthsof40mhzand80mhzand privateusers accesstoexpandedfrequencybandsof5150r5350mhzand5470 5725 MHz.InorderforIndonesianconsumersandbusinessestofullyexploitthebenefitsof cloudcomputingtechnologies,fasterdatatransfer,andtheotherbenefitsofnew bandwidthrintensiveapplications,theindustryandpolicymakersmustconveneto developbroadbandnetworksandservicesthatmeetindustrystandards. Policy!Design!Consideration:!AwellRdesignedframeworkforcertificationand licensingthatbalancesregulatorycertainty,flexibility,andconsumerprotection isimportant.forwardrlookingfiscalandcustomspolicywillhelpfacilitatethe growthoftheictindustry.industrypartnersshouldbeinvolvedinthe developmentofnationalstandardsforitproductsthathaveclearrequirements, specificationsandguidelines,andenablestheadoptionofthelatesttechnology thatwillbringbenefitstobusinessesandconsumersinindonesia. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page32of35

CONCLUSIONANDNEXTSTEPS EmergingInformationandCommunicationTechnologiesICT)arepowerfulcatalysts forimprovinganation scompetitivenessandcreatingaknowledgerbasedeconomy. ThismakestheIICFacriticalplatformforgovernmentandindustryleaderstoconvene anddevelopacommonunderstandingonregulationsandpolicies,sharedigitaltrends andbestpractices,andidentifyopportunitiesforpublicrprivatepartnershipsto achievethesharedgoalofgrowthintheictindustryandsolvingchallengesinict adoption. InIICF strailblazinginauguralyear,thequarterlyforumscenteredondevelopinga strongfoundationforictdevelopmentinindonesia.underpinningathrivingict ecosystemistheneedforwellrdevelopedbroadband,mobile,andcloud infrastructuresthataresupportedbystrongcybersecuritymeasures.asiicfentersits secondyear,werecommendtheprioritybeonunderstandingtheimpactofictacross Indonesia skeysectorswhilealsoreviewingexistinggovernmentandregulatory processestostreamlinethemforgreaterbusinessefficiencyandenablingtherapid deploymentoficttosupportthebroaderindonesiaeconomy. ArecentMcKinseyGlobalInstitutereport 5 identifiesfivedigitaltechnologiesmost likelytohaveasignificantimpactonsoutheastasiaacrossanumberofimportant sectors:themobileinternet,bigdata,theinternetofthings,theautomationof knowledgework,andcloudtechnology.thereportforecaststhepotentialeconomic impactofthesedisruptivetechnologiesacrosskeysectors 6 inaseantobebetween $220billionand$625billionannuallyby2030Figure6).In2015,weproposetheIICF 5 SoutheastAsiaatthecrossroads:Threepathstoprosperity,McKinseyGlobalInstitute,November 2014. 6 Keysectors:infrastructure,financialservices,education,manufacturing,agriculture,healthcare, governmentservices,andconsumerandretail. TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page33of35

consider basedonstakeholderneeds anagendathataddresseschallengesand opportunitiestorealizingtechnologyrdrivengrowthacrossthesesectors.! Figure!6:!Impact!of!disruptive!technologies!across!key!sectors!in!ASEAN!economies! TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page34of35

APPENDIX APPENDIXA Decreeregardingtheestablishmentof IndonesiaICTConsultativeForumIICF)Team APPENDIXB Minutesfrom1stExecutiveMeeting IICF April1,2014) APPENDIXC Minutesfrom2ndExecutiveMeeting IICF June24,2014) APPENDIXD Minutesfrom3rdExecutiveMeeting IICF October2,2014) APPENDIXE SupplementaryMaterials TheIndonesiaICTConsultativeForum:2014Reviewand2015Priorities Page35of35

!!!!!! APPENDIX!A! Decree%regarding%the%establishment%of% Indonesia%ICT%Consultative%Forum%IICF)%Team%!

!!!!!!! APPENDIX!B! Minutes%from%1st%Executive%Meeting% %IICF% April%1,%2014)% %! % % %

Welcoming Remarks 1 st Executive Meeting Indonesia ICT Consultative Forum April 1 st, 2014 Luky Eko Wuryanto, Deputy Minister for Infrastructure and Regional Planning, Coordinating Ministry for Economic Affairs CMEA) o Opened the forum, encouraging the sharing of perspectives, the involvement of higher officials and focused on outcomes that will result in concrete improvements Alex Feldman, President, US-ASEAN Business Council USABC) USABC looks forward to an ongoing and long-term programme. Indonesia is one of the top five countries when it comes to tech use, including mobile technology, Facebook, and Twitter. The Indonesia ICT Consultative Forum aims to spur ICT in industry in Indonesia, as well as connect Indonesia to opportunities outside the country. 2014 is a big year: o The Council s 30 th anniversary o Indonesia s Parliamentary Elections o USABC is launching ASEAN Matters for America and American Matters for ASEAN o USABC s CEO Mission to Vietnam and the Philippines, where CEOs will meet with the President and members of cabinet and leaders of business community. This follows a CEO Mission in 2013 to Indonesia and Malaysia. Indonesia is half the population of SE Asia and more than half of its economic activity. As economic activity continues, ICT will play a critical role in growth and Indonesia s success. Getting policies right is critical to ensuring people benefit and growth continues across the world. There are opportunities in the region, as demonstrated through entrepreneurs in the region making headlines through development of apps and games that are becoming some of the most popular in the world. Indonesia has a lot to gain in this sector, and there is great excitement for this new collaborative platform. Presentation on IICF Concept & Plan Eddy Satriya, Deputy Assistant for ICT and Utility, CMEA Purpose

The Indonesia ICT Consultative Forum IICF), an initiative started by the US-ASEAN Business Council s ICT Committee and Coordinating Ministry of Economic Affairs aims to create a collaborative platform between government and industry to support Indonesia s long-term policy of building a local ICT industry and toward fulfillment of a shared goal of creating an innovation and knowledge-based economy in Indonesia. Currently, every ministry has their own pilot projects involving ICT applications, thus these experiences can be shared and learned from. The Forum will also serve to improve mutual understanding in the areas of innovation, investment and regulation and will assist in the development of future ICT policy in Indonesia. He welcomes comments on the draft decree and proposes that the forum name IICF can still change. Implementation Several objectives of the work streams include reducing coordination issues and providing timely information before policies are made. In addition, they can be used to promote local ICT industries. Structure The forum will be comprised of a Senior Official Committee including representatives from the Government of Indonesia, as well as the USABC and local stakeholders. The Senior Official Committee will report findings to the relevant Ministers on current ICT issues as identified by the Executive Committee. Under the Senior Official Committee is the Executive Committee which will be led by co-chairs from USABC s ICT Committee and CMEA. The Executive Committee is responsible for providing a fora for ICT policy discussion, annual work plans, and identifying new initiatives, etc. Under the Executive Committee are the three work streams that will organize regular activities and provide timely updates on the relevant issues. Schedule Key milestones have been identified including: 1) Mid/late April Executive Dialogue Launch and Panel Discussion 2) June Executive Committee workshop/meeting 3) September Executive Committee workshop/meeting 4) Nov 16/Dec 8 Senior Official/Ministerial Committee and Indonesia Business Mission Elizabeth Hernandez, ICT Committee Chair, US-ASEAN Business Council

Key purpose of the IICF is to ensure greater predictability, so that companies can see where the government is coming from and how the business community can help meet the common objective of a vibrant ICT sector in Indonesia. Shared objectives Government and companies want the same thing a vibrant ICT sector. IICF envisions working toward shared objectives, not as individual companies or ministries, but as thought leaders toward development of an innovative, knowledge based community with local ICT industry development as an enabler to achieving this goal. Workstreams Workstreams are tools to discuss relevant issues in depth and serve as a starting pointing. Given that this is a consultative forum, the scope is open and subject to change. Identified work streams are: o Emerging Digital Trends The transformational nature of ICT is an enabler for economic growth. This includes new areas like: cloud computing and analytics, as well as others new styles of IT. These new trends need to be understood and regulatory frameworks need to be aligned with the new trends, thus providing an environment to expand business and create a knowledge base. To be led by Microsoft and Qualcomm. o Incentivizing Localization This workstream looks at how to increase investment interest. There is a need to level playing field and remove barriers, but also incentives need to be in place encourage investments. In turn, greater ICT investment leads to job creation. To be led by Intel. o Regulatory Insights Initially, regulatory framework changes triggered the need for forum. IICF wants to understand challenges and looking forward to share best practices from other countries who are also creating a domestic ICT industry. This information exchange helps address Indonesia s needs and allows companies to be more effective. To be led by Google. Outcomes - Today is an outcome. At a minimum, the outcome IICF hopes to achieve are regular dialogues to minimize surprise. Such that if new regulations come up, there is a chance for consultation to allow companies to prepare operations to remain in compliance of the new policies. Beyond sharing of information, there can be a sharing of best practices and development of a roadmap toward the vision to create a knowledge base. Response from Eddy Satriya, Deputy Assistant for ICT and Utility, CMEA Last September during USABC s ICT Business Mission to Indonesia this Forum was first conceived in order to create a robust ICT ecosystem. Predictability A win-win can be established using the input of government local incentives, timely regulation and using the expertise of companies.

Outcomes: In addition to reporting our findings from the work streams, we should consider other measures of success including other metrics or media involvement. Participation: Attendees ideas and interaction are welcome. Questions to consider: Which workstream is of most value? What topics would you like to hear from experts about? Work stream leaders presentation on objectives & plans Emerging Digital Trends - Ruben Hattari Microsoft) and Nies Purwati Qualcomm) Purpose: Provide updates to stakeholders on global industry trends; international best practices; case studies; government policies for long term growth in the ICT sector. Cloud technology: how it can help government and businesses, like SMEs. o Used in healthcare, politics and education to improve the sectors o Important for SMEs in Indonesia given their desire for flexibility, collaboration, mobility and low costs. Also, considering around 90% of industries in Indonesia are SME, this amounts to a large number of companies. o Broadband connectivity is difficult given Indonesia s large and dispersed geography/size, particularly in Eastern Indonesia where connectivity is needed. Concerns: cyber security, online privacy Potential technology, such as smart cities and smart phones, will be discussed in this workstream, as well as policy challenges that new technology creates. Incentivizing Localization, Deva Rachman Intel) Local demand - The education sector has the biggest need for ICT industry Local government needs to add input but also the upcoming new government [national election coming up] requires leadership in this area as localization needs to be in line with Medium Term National Plan 2019. Regulatory Insights, Shinto Nugroho Google) Regulatory insight Government needs to be in dialogue with private sector as another source of information on how to make regulations that will continue to create jobs and opportunities. Companies can share their good and bad experiences in regards to the impact regulations had on the ICT sector. Timeliness Government needs robust regulations to help Indonesia build human resources to increase competitiveness. Q & A Suggestion that high-level meetings be moved forward to allow recommendations for ICT industry to be put forward for the incoming government and ask for chance to present to the new leadership.

Presentation: Cloud Computing and Its Impact on Our Lives Speaker: Tony Seno Hartono, National Technology Officer, Microsoft Key points Cloud computing touches all aspects of our life social, economic, political, healthcare Cloud technology provides choices Private, Public, Hybrid Public/Private) and Community clouds exist. Each option provides a different level of privacy. o Clouds allow for automization, massive scalability and connectivity, which is relevant given Indonesia s size/population/dispersed islands. Therefore, the Indonesia government should create positive policies for cloud computing given these important benefits. o Allow software developers to use the online market to download and get revenue, or regional governments with no infrastructure to manage infrastructure using eservices. ISO 31,000 Risk Management framework can help make decisions about public/private cloud and when to use each. Some require services on premise, others off-premise or some in-between. Need to have back-up/baskets depending on expected service level agreement SLA) and solutions need to be designed accordingly. Digital trends in Indonesia Young demographic in Indonesia - 54 million students = cloud computing opportunity. Population growth will increase internet use, particularly the 12-34 year olds users who are often with a higher education. Growth is primarily in mobile phones High social media use. Opportunities for cloud computing in education, healthcare, and politics Shared responsibility - Government and citizens working together provide highest ROI thus internet access should be shared responsibility between government and citizens. Challenge of internet connectivity o TV Band White Spaces Use unused frequency spectrum of TV for data o Potential to provide all citizens with free internet access to equalize access The power of cloud computing to transform government services such as healthcare and education. Thus, we should maximize benefits of cloud computing.

Open Discussion Regulatory environment AmCham Indonesia Stresses the importance of getting the regulations right. A study assessing US investment in Indonesia showed that over the last 9 years over 65 billion USD has been put into Indonesia. And projections over the next 3-5 years expect an additional 61 billion. It showed that with every 1 job created, an additional 10 Indonesian jobs were created showing a multiplier effect on investment and job creation. The IT sector is particularly relevant as it creates jobs, forms the backbone of other sectors investment i.e. manufacturing) thus compels US investment. This group is critical to getting this right which is a challenge given that technology changes quickly. Companies look for: 1) Good regulatory environment; and 2) Infrastructure. If the regulatory environment is wrong, the problem is compounded by 10 i.e. 10 Indonesian jobs not created because investment doesn t come in). Creating local demand Ministry of Industry Focuses on start-up companies in ICT Asks how to collaborate between the government and private sector on ICT issues. Proposes for next meetings: o Look at how ICT has increased investment in Indonesia o Look at how to grow the local ICT industry. The benefits of cloud computing are known but the ministry struggles with how to support ICT growth and grab the local market. o Proposes looking at practices to grow local ICT industry in other countries looking at bad practices and also incentives needed to support ICT. Workstream on incentivizing localization will address the creation of local demand and will bring best practices, case studies. i.e. Vietnam). These case studies will be from closer to Indonesia and other emerging economies. Security Concerns expressed regarding data security with cloud computing. Point of view that certain data may be considered strategic thus making data security and protection very important. Security and privacy are important issues that must be addressed. However, this is a period of transitioning from data in a physical way to where data is on the cloud. There are different levels of data security and privacy such that government data is different and private. Today, data doesn t have boundaries such that data is a new form of currency. We need to think that data is accessible globally by banks

or enterprises and need to maximize this digital economy, particularly to the benefit of SMEs to facilitate turning them into global players. Financing / SMEs Local industry needs to be supported, especially in ICT because it is hard for start-ups to get funding from banking institutions. Start-ups usually get funding from venture capital firms and telcos. Investment is needed but also there are lots of SMEs who need coordination under Ministry of Industry and Communication. In this context, the ministry is concerned about security but cannot avoid new technologies so instead require assistance for training and education. Ministry is challenged by all the new concerns and balancing the need for technology with the need to comply to legislative measures because this is the way forward. Financial services Bank of Indonesia Recommends inviting Indonesia Financial Authority OJK) to join IICF Regulates non-banks and banks. Given cross-over with financial services, Financial Services Committee should also be included. Infrastructure requirements KOMINFO There is a need for a responsive regulatory environment and asks what this new environment would look like. But also raises concern on what infrastructure is needed and the funding required; what infrastructure is needed to ensure is internet free and once it is built how to maintain good quality infrastructure and continuity of infrastructure operators. Need to collaborate with other systems like transport and logistics. However, it s also important to consider the soft infrastructure i.e. human capital. Hard and soft infrastructure are both needed. There is currently US government support for entrepreneurship support in Indonesia such that companies can help with training, entrepreneurship, and promotion of hackathons in tech space. Discussion of IICF Next Steps Workstream leaders will make respective work plans. Companies are encouraged to sign up, if they haven t already. Also, there is a need to reach each out to different agencies so these meetings can be taking place on a regular working level. There is a need for case studies, experts and guest speakers to share more information on this ICT transition in Indonesia.

Appendix Resources Presentation: IICF Concept & Plan Draft decree Presentation: Cloud Computing and its Impact on Economy ASEAN Matters for America report Partners in Prosperity: US Investment in Indonesia Attendees GOI Luky Eko Wuryanto, Deputy Minister for Infrastructure and Regional Planning, CMEA Eddy Satriya, Deputy Assistant for ICT and Utility, CMEA Coordinating Ministry for Politics, Law and Security Ministry of Industry Ministry of Trade Fiscal Policy Agency, Ministry of Finance Ministry of Communication and Informatics Bank of Indonesia BKPM Ministry of Tourism and Creative Economy Partners Didie Soewondho, Vice Chairman of Telecommunication, Information Technology and Broadcasting, KADIN Eddy Thoyib, Executive Director, MASTEL Andrew White, Managing Director, AmCham Indonesia Sri Lakkundi, ICT Committee Co-Chair, AmCham Indonesia Jim Caruso, Economic Counselor, US Embassy Phil Nervig, Economic Officer, US Embassy USABC Members Nazrya Octora, Associate Consultant, APCO Worldwide Seow Hiong Goh, Executive Director, Global Policy & Government Affairs, Cisco Systems

Satria Gunayoman, Consultant, Cisco Systems - HD Asia Advisory Shinto Nugroho, Head of Public Policy and Government Relations, Google Indonesia Agung Yudhawiranata, Analyst - Public Policy & Government Relations, Google Indonesia Suren Velappu, Director of Corporate Affairs, South East Asia, Hewlett-Packard Elizabeth Hernandez, Vice President of Corporate Affairs, Asia Pacific Japan, Hewlett-Packard Ananta Gondomono, Governmental Programs Lead Indonesia, IBM Darryn Lim, Director, Trade and Innovation Policy, Microsoft Nies Purwati, Director of Government Affairs Indonesia, QUALCOMM Claudia Chan, Head of Government Relations, Asia Pacific and Japan, Seagate Ruben Hattari, Director of Corporate Affairs-Indonesia, Microsoft Tony Seno, National Technology Officer, Microsoft Deva Rachman, Corporate Affairs Director, Intel Indonesia Corporation Arnold Djiwatampu, Motorola Solutions Alexander Feldman, President, US-ASEAN Business Council Kathy Santillo, Regional Managing Director, US-ASEAN Business Council Desi Indrimayutri, Senior Country Representative, US-ASEAN Business Council Shay Wester, Manager, US-ASEAN Business Council Caroline Tanjaya, Country Representative, US-ASEAN Business Council

!!!!!!! APPENDIX!C! Minutes%from%2nd%Executive%Meeting% %IICF%% June%24,%2014)% %! % % %

!!!!!!! APPENDIX!D! Minutes%from%3rd%Executive%Meeting% %IICF%% October%2,%2014)% %! % % %

Third Indonesia ICT Consultative Forum IICF) Minutes Thursday, October 2, 2014 JW Marriott, JW Meeting Center Level 2) Co-Chaired by: Eddy Satriya, Deputy Assistant for ICT and Utility, CMEA Surrendren Velappu, Director of Corporate Affairs for ASEAN, HP on behalf of Elizabeth Hernandez) Welcoming Remarks. By Eddy Satriya CMEA) and Surendren Velappu HP) Eddy Satriya CMEA) The first meeting set the discussion priorities and direction for IICF. The second meeting discussed ICT-related regulations. Today, we will be discussing more specific issues of e-commerce and the ICT investment climate in Indonesia. Hopefully, in the next meeting, we can discuss specific applications that will support social development in Indonesia. This will be in line with the ehealth and eeducation priorities set out by the new government. Surendren Velappu HP) The IICF is an important platform for government and industry to develop a mutual understanding in the areas of innovation, investment, and regulation; which is critical in achieving the shared objective of building an innovative, knowledge-based economy in Indonesia. This is the third out of four forums to be held this year. The previous sessions have been valuable to our ICT committee members, and we believe, for the Government of Indonesia as well. We look forward to coming back in December for the final forum for this year. Our last session addressed the government s cyber security concerns and several private sector experts shared existing solutions for data protection, cloud security, securing online banking transactions, and fraud prevention. The government officials sharing of regulatory measures intended to safeguard cyber security furthered private sector s understanding of certain regulations. In today s third IICF meeting, we hope to continue this constructive discussion about the development of future ICT policy in Indonesia, particularly in areas of e-commerce and promoting trade and investment. In today s forum, we hope to accomplish the following outcomes: i) Sharing of best practices and identifying current barriers and opportunities to promote ICT development ii) Identify opportunities for public-private partnerships to address gaps and challenges in the industry iii) Determine future areas of work and research that will be useful in developing policy inputs for the incoming new administration Vision of Indonesia s ICT Ecosystem. By Alexander Rusli Indosat) Driven by technology, the ICT arena is dynamic and changes rapidly. This necessitates constant dialogue between government stakeholders and private sector representatives; and more platforms for discussion, such as the IICF, are needed. A robust ICT Ecosystem comprises of three key pillars: i) Infrastructure

Broadband is a key enabler of the ICT industry. Currently, Indonesia only has 50MHz of spectrum allocated for wireless broadband. With 9 operators in Indonesia and limited bandwidth available, more spectrum needs to be allocated for broadband to accommodate the forecasted increase in demand. Having a regulatory platform that allows the acceleration of ICT infrastructure development is essential. ii) Payment Systems Payment systems go beyond mobile services and even offer vouchers. An operator such as Indosat has 250,000 payment outlets that provide entry and exit points for money, thus making people more bankable. In terms of mobile money, Indosat s view is that it should be a transition to bank payment. A limit of USD 500 should be imposed on mobile money, and beyond that sum, people need to visit a bank. However, challenges remain in maintaining control. With Indonesians already utilizing mobile and online banking, there is an opportunity to extend this trend to the growing e-commerce industry. Currently, three large operators have mobile products and we do not understand why we should be competing with banks that have other service offerings, which are also awarded with mobile licenses. iii) Content and Investment Developers are a key aspect of the ecosystem and their skills are already being exported by Indonesia. Investment is also crucial and having angel investors and incubators are necessary to develop ICT startups. In a collaboration with Mountain Partners AG, Indosat has an incubator program called ideabox that cultivates new applications and increases their visibility and valuation by exposing them to the market. In our first initiative, we selected 3 out of 50 candidates. In the subsequent round, out of 150 registrants, we selected 7. We realized that many startups have poor business skills and through the incubator, we can help them market their ideas to the international market quickly. We are limiting our selected candidates to 10 due to the resource-intensive nature of incubation. Indosat and Softbank have also collaborated to set up a fund that provides companies with capital. However, we found it difficult to find startups that are ready for investment. Q & A Chan Kok Long idea/ipay88): One of the key drivers of e-commerce growth in ASEAN countries are SMEs. However, in Indonesia, there is no formalized link between SMEs and big companies like Apple and Google, which provide essential support in terms of infrastructure and telecommunications. How does Indosat link with SMEs to support them? Indostat has two lines of service: cellular and fixed. Fixed services are usually offered to corporates and larger SMEs. To my knowledge, Indosat is the only operator that is pushing for the SME segment. However, there are challenges in providing services to smaller SMEs due to the fine line between them and the high end consumer market. While Indonesia s high smart phone penetration 25%) offers opportunity, it is difficult to demonstrate its value to SMEs. The government and private sector see the opportunity for SMEs in providing useful applications such as banking services. Even though the current rate of SME growth is not ideal 6-7%), it is still higher than consumer growth 4%). Currently, there are many applications being offered, however the education process is time-consuming and we need to

achieve a critical mass. In this area, the government and banks have been helping by offering smaller sized loans. We totally disagree with the government s proposal to use IMEI. When a phone is delivered, theoretically, it should be assigned to a unique IMEI number. However, because operators seldom Surendren Velappu HP): An important issue to address is the proliferation of illegal devices in Indonesia. Is it that easy for illegal devices to get into Indonesia? Is there an opportunity for the private sector and the government to collaborate to solve this problem? use the IMEI number, except for the occasional high-level tracing, it ends up being stored as latent data. Handset manufacturers need access to these IMEI numbers, and smaller handset manufacturers do not have this access. This results in a duplication of IMEI numbers or no IMEI numbers at all. This makes it very tough for the government to enforce a regulation that mandates an IMEI number for every phone. Furthermore, there are about 500 million active phones, and this is discounting phones that are duplicated or have no IMEI numbers. Instead, the act should ensure that defective phones do not come in at all. You are right in saying that there are more regulations put in place for imports and the process now takes 3 to 4 months. In our experience, we were trying to import Xiaomi, whose phones are limited in supply. By the time Xiaomi was awarded a permit, the supply was redirected to other countries and the launch was cancelled. In this time-sensitive industry, which has a short life cycle, having unpredictable permits make life difficult for handset manufacturers. Furthermore, the creation of a single ASEAN market extends to mobile devices and a provision for every phone to have an IMEI number is not practical. Moreover, it is very time consuming for the telco to consistently check against the database. Hotman Simbolon Citi): The question is related to customer protection in the telephone industry. When fake SMSes are reported, the police will attempt to track the sender through IMEI numbers. However, often times, this IMEI number is duplicated or does not exist. It feels like the telecom industry does not care for customer protection even though it is important in this environment. What are your thoughts on this? Using the IMEI number for tracking purposes is ineffective. This is because illegal phones that pass through the border without meeting the standards typically do not have IMEI numbers. This is especially for low-end Chinese phones that are used widely in Indonesia. A better approach is to put in place a better border control mechanism that ensure that imported phones comply with the standards. Hotman Simbolon Citi): The limits imposed on mobile phones in Indonesia are not applicable overseas and this sometimes results in excessive payments. Is it possible to develop a network like MasterCard where all the ICA industry members operate in a single regulated network that can be used directly overseas?

Your phone has two balances, reload and mobile money. In Indonesia, the central bank explicitly states that your reload balance is not allowed to be used as mobile money and that profits cannot be made from mobile money. Your question on roaming fees refers to reload money. In November, Indostat is planning for all our products to have only 1 roaming partner overseas. While this is a gamble, it provides leverage for us to negotiate a fixed maximum amount and have greater control over customer experience and to avoid bill shocks. Currently, a lot of roaming occurs between operators here and in other countries, and typically, we can only achieve one good deal with the partners and have to pay full rates for the remaining. While the difference is substantial, the customer sometimes choose the expensive roaming partner based on recommendations by their friends. Eddy Thoyib Mastel): As the chairman of ATSI how do you see the trend of the Over-the-top content OTT) business and the decline of the telco s core business? Is there any plan from ATSI on how to protect you and other telcos from this declining trend? Given that members all have different positions on this issue, it is difficult for me to provide a statement that is representative of ATSI. But there is consensus in that, as owners of the infrastructure, telcos should be given a share of the revenue from OTT ads and that the government should be a facilitator of giving telcos an equitable position on OTTs and their space. Since four months ago, all the operators in ATSI have been approached by content owners who say that operators should not push ads at the top and bottom of the mobile device since they are already making revenue by selling ad spaces. At Indostat, we believe that traditional voice and SMS mechanisms have disappeared as an internet IP-based voice like Skype theoretically can have better quality than a circuit switch connection that is technologically limited. Indostat s fund and incubator ensures we are part of this trend. One of the more successful companies who is also our partner, Softbank, does not receive their valuation and revenue from the telco business and instead, rely on other income streams. This mindset shift is important for Indostat, but unlike Softbank which started off as a software company that bought over a telco, Indosat is a telco company with telco people that is owning that space. Dhenu idea): Currently, we see that telcos provision of mobile wallets is facing resistance from the bank. How do you think the telco s model helps Bank Indonesia s national movement on using noncash? Although the banks seem to be in disagreement to push for this, to achieve the cashless society vision, the different stakeholders need to be open to discussing the use of mobile money to drive GDP. Instead of transferring funds through the post office, it is now transferred through smart devices. In response, banks are now saying that as long that it is only used as a delivery mechanism and the money sits within the bank it is fine. We all know that central banks around the world are conservative institutions and rightly so as they manage the core activity in every country, which is money. Which is why in these kind of activities, I push the idea of banks being more open.

Kathy Santillo USABC): This year, as a result of our annual discussion with the ASEAN Economic Ministers, we signed on a SME Business Alliance. In collaboration with USAID we have done workshops throughout ASEAN countries. In 2015, we are looking at putting together an SME Online Academy and HP is one of the leaders of that initiative. Discussion 1: Supporting Indonesia s e-commerce Market Speakers: Irni Palar MasterCard Indonesia) Moderated by: Shinto Nugroho Google) E-commerce in Indonesia is growing fast reach 8 billion in three years; 40 percent growth), but the industry is still young and more coordination and engagement with the government is needed. MasterCard has engaged with merchants, bank partners, and consumers directly in driving the e- commerce business The use of card payment in e-commerce is still very low: 75% of transactions in e-commerce is paid in cash upon delivery and only 20% is by bank transfer. This is because the penetration of credit card in Indonesia is very low 15.6 million cards or 6 percent of the population). Given that people typically hold multiple cards, there are only approximately 7-8 million of credit card holders in Indonesia. In terms of security, the government is set on providing a means for safe transactions. For examples, credit cards now use the One Time Password OTP) to increase security. The challenge is that Indonesians like to change their phone numbers. While debit cards have a higher penetration rate, it is less secure and often used for ATM only. Similar to credit cards, debit cards are also linked to outdated phone numbers. Another means by MasterCard to ensure safety and security is through a virtual card number VCN) which you can request from the bank. This is being developed by BNI and the user can get a separate 16 digit credit card number that makes transactions more secure. All players have to be prepared to realize the targets set by the ASEAN Economic Community. In terms of technology, banks should start exploring ways to build partnerships with industry players. MasterCard is part of the e-commerce association and are trying to educate the market, introduce new programs, developing new technologies and payment solutions, and connecting with more merchants. Growing the e-commerce industry has to be a joint effort. Discussion: What is on your policy wish list to grow the e-commerce industry? Irni Palar MasterCard Indonesia) Government and the public sector need to work together to create policy that works, especially in the implementation phase.there has to be more discussions on payment between BI, OJK and the private sector to give more room for card transactions to grow. Nurul Ichwan BKPM) The e-commerce industry is growing in Indonesia but we need more distributed growth between big companies and the SMEs. This is because during times of crisis, SMEs play a key role in keeping the economy afloat. Collaboration between government and the private sector, especially SMEs, to seek for more opportunities in AEC. SMEs, particularly those looking to expand overseas, need help from big companies to provide education and training, and also for companies like MasterCard and Google to provide more efficient payment and delivery platforms.

Enzelin Sariah Ministry of Trade) The Ministry of Trade wants to build a conducive ecosystem for the e-commerce industry so that all players in the sector can operate in a safe environment and allow for the industry to improve in terms of quantity and quality. We also found repeat purchases on e-commerce sites to be the norm and this facilitates Indonesians purchase of locally manufactured products. The Ministry of Trade supports SME development as 90 percent of business in Indonesia is SMEs. In the future, SMEs can also benefit from the growing e-commerce industry in Indonesia. Discussion: What are some challenges that you face in Indonesia s e-commerce industry? Fredrik Thomassen Zalora) In general, it is good to do e-commerce business in Indonesia as the market is growing rapidly. The infrastructure is also adequate. Compared to a delivery time of 4 days in Oslo, delivery time in Jakarta is 3 hours and in more remote places like Papua, it is one week. Mobile speed also acceptable 5 percent of transaction is mobile) and in terms of logistics, Zalora s IT infrastructure is partly in Indonesia where good personnel is not difficult to find. Facebook ad specialists are also cheaper in Indonesia as compared to Singapore. However, payment remains a roadblock. 50 percent of customers continue to pay by cash upon delivery. This is because the banking regulations are not yet mature. Having more rules and regulations that guarantee customer safety will benefit this industry. Another concern is the regulatory environment that keeps changing. There is a demand for Indonesian manufactured products, however, the law disallows Zalora from exporting locally manufactured products. Chan Kok Long idea/ipay88) Banks are the missing key component in the e-commerce ecosystem. There is a strong correlation between bank operations in e-commerce and e-commerce growth. For example, Malaysia has much higher growth in e-commerce than Indonesia because banks in Malaysia are more open. My wish as a payment provider gateway is to have a forum where all banks, payment companies and IT companies convene to solve issues on payment. The payment companies in Indonesia s e- commerce sector should organize education sessions with the banks. If banks were less worried about risk, security, fraud, the e-commerce industry will grow even more rapidly. Irni Palar MasterCard) When I met with one of the big PT s he mentioned that it is difficult to connect e-commerce merchants to banks due to the banks rigid standards in areas such as merchant underwriting. Education and communication with banks must increase and MasterCard will talk to other payment players to conduct these sessions. Discussion: The ICT sector grows so fast that sometimes regulations cannot catch up. What do you think of this? Irni Palar Mastercard) Technology is rapidly developing. On the other hand, regulations are trying to catch up with the growth of technology and the industry itself. For Indonesia, e-commerce is still in its infancy. This makes the involvement of all stakeholders important in helping the government develop the appropriate regulations. The government must involve industry players in the policy making process because they know exactly what the problems are and what kind of regulations are needed to solve those problems. Hotman Simbolon Citi)

Suggestion: there should be modules for SME education on e-commerce. Shinto Nugroho Google) Possible collaboration on SME education on e-commerce with the SME Business Alliance initiated by the US-ABC and USAID. Discussion 2: Encouraging Trade & Investment in Indonesia s ICT Industry Moderated by: Eddy Thoyib Mastel) Investment Updates in ICT Sectors 2009 to 2014) by Nurul Ichwan BKPM) Foreign Direct Investment in the global ICT sector slowed down but started to grow again in 2013. Much of this investment did not go to ASEAN. ASEAN only received 5% of USD388 billion invested globally in 2009-2013 in the ICT sector. USD18 billion of investment went to the ICT sector of ASEAN in 2009-2013 but Indonesia only received 5%. USD888 million or 85% of FDI realization since 2010 in Indonesia s ICT sector came from Singapore. Both FDI plan and FDI realization in Indonesia s ICT sector have been slowing down since 2010. BKPM is worried that the FDI plan and FDI realization in Indonesia s ICT sector will not improve in the near future. Since 2010, 99.6% of total FDI in the ICT sector have been located in Java. The domestic investment plan and realization in Indonesia s ICT sector have been slowing down since 2011. Since 2010, almost 100% of total domestic investment have been located in Java. McKinsey predicts that Indonesia will become the 7th largest economy offering an additional USD1.3 trillion market opportunity from the growing middle class. There will be 90 million additional consumers in 2030. Indonesian consumers also have the highest consumer confidence index among the G20 countries. Indonesia is the most promising country for overseas business according to the Japan Bank for International Cooperation Survey 2013. Poor infrastructure remains a challenge but there has been progress through programs like MP3EI, Palapa Ring, etc. Another challenge is the increasing labor cost. The Government has issued Presidential Instruction No.9/2013 that sets a minimum wage based on productivity. This is in addition to the criteria of decent living KHL) and economic growth. The government provides investment incentives such as the 5-10 years tax relief facility and 50% for a further 2 years reduction of income tax. These are applied only to 5 pioneer industries including the communication devices industry. Mobile Phone Taxes: Implications for Encouraging Investment by Chris Zull GSMA) The GSMA represents the interests of mobile operators worldwide. Spanning more than 220 countries, the GSMA unites nearly 800 of the world s mobile operators with 250 companies in the broader mobile ecosystem, including handset and device makers, software companies, equipment providers and Internet companies, as well as organizations in industry sectors such as financial services, healthcare, media, transport and utilities. The GSMA also organizes industry-leading events such as Mobile World Congress and Mobile Asia Expo. GSMA leads the global conversation on mobile taxation as part of our Digital Inclusion programme. Over the last decade, we ve produced numerous studies that describe and measure the mobile taxation barrier. There are a number of consumer taxes applied to mobile ownership: Value Added Tax VAT ) or General Sales Tax GST ), customs duty and excise taxes on imported goods, special taxes on handsets, special communication taxes on mobile usage, other telecoms specific taxes, such as SIM activation

taxes or other taxes on connection, other special taxes, for example tax on mobile operators gross revenues. In 2011, a study in 111 countries showed that the proportion of Total Cost of Mobile Ownership TCMO) accounted for by tax had increased to an average of 18.11% Deloitte/GSMA 2011, Global Mobile Tax Review ). Handset costs act as a barrier to the benefits of mobile usage and taxes constituted 23% of this cost on average. In eleven countries, tax constituted over 40% of the handset cost. Indonesia currently has 317 million mobile connections, 29.3% of which are mobile broadband. With the right regulations in place, we expect mobile broadband to account for 70.3% of a total of 436 million connections GSMA Intelligence, Indonesia data Q2 2014). However, the government s plan to introduce a 20% luxury tax on mobile devices will increase the cost of device acquisition and will hurt the lower income consumers. It is also a barrier to access to mobile services. Lowering handset taxation will increase mobile penetration and mobile broadband adoption. The Kenyan government demonstrated this when they removed the 16% VAT on mobile phone handsets in 2009. After the removal of the VAT, handset purchases have increased by more than 200% while mobile connection penetration has increased from 50% to 70% of the population in Kenya since the beginning of 2009. Airtime taxes also hamper usage and mobile operators investment. In 2009, the Croatian government imposed a 6% tax on mobile gross revenues related to voice and text messages. This increased the consumer taxation as a proportion of total cost of mobile ownership to 28%. The next year after that, Croatia suffered the first ever fall in voice and text message volumes. Falling revenues and reduced demand led to a reduction in investment in network expansion. Reduced access to mobile phones as a result of higher luxury tax may have negative impacts on economic growth. A study showed that a 10% increase in mobile penetration can increase the GDP of a country by 1.38%. A 2014 study showed that when mobile taxes were reduced, the short-term loss in government revenues was quickly recovered in the medium term due to growth of the tax base GSMA/Deloitte 2014, Mobile taxes and fees A toolkit of principles and evidence ). Government should align tax policies to these key principles: o o o o o Taxation should be broad-based Taxes should account for sector and product externalities, such as the positive benefits of mobile The tax and regulatory system should be simple, easily understandable and enforced Dynamic incentives should be unaffected Taxes should be equitable, and the burden of taxation should not fall disproportionately on the poor Product Compliance in International Markets by David Siow Cisco) Product compliance is an important concern for regulators worldwide to ensure that safe products are delivered to consumers. There are best practices in simplifying and expediting product compliance that we will discuss. In the EU, once a company compiles with the EU regulations, it is very easy to place a product in its countries. In the EU, all products are regulated by the EU Directives. The EU Directives are adopted by 28 EU member states + 4 EFTA countries. Once a product bearing the CE marking is placed in the EU market, member states shall not prohibit, restrict or impede the placement of this product or service

in their market or territory. Products bearing CE mark cannot be stopped at customs and can freely travel into the EU and within the EU. In the EU, market surveillance and market enforcement is the responsibility of each member state. Market Surveillance Authorities do random compliance checks AFTER products are already placed on the market. This is opposite to a typical approval regime where product compliance is verified BEFORE entering the market. In the US, most of the products enter the market based on the Declaration of Conformity. Non-radio and non-computer peripheral products will go through a verification process while radio-based products will go through certification process. In the certification process, test reports are sent for reviews and then grants are provided by the regulator. Telecom products with a declaration of conformance do not need to be further reviewed by the regulator. Test reports from any accredited test labs are based on ISO 17025. As part of the importing process, the importer completes a FCC 740 Form. In the US, importers are responsible for the products. The FCC Enforcement Bureau as well as the Authorization lab investigate reports of non-compliant products being imported, as well as reported cases of interference. In Singapore, there are products are approved through different registration schemes depending on the type of product and their likelihood to cause interference. For post market surveillance in Singapore, IDA may require the supplier to submit the test results or evidence of equipment certification as proof of conformity with the applicable IDA Technical Specifications. Many companies operating in Indonesia today face challenges in complying with regulatory requirements. The examples provided from the EU, US and Singapore illustrate how improved policies and procedures have been adopted internationally to enhance the ease of doing business while ensuring that safety and compliance concerns are still adequately addressed. These are examples that regulators in Indonesia can study and model after so that it can improve the overall business climate in the country, and thus help attract more investments into Indonesia. Improved processes can also allow consumers in the market to have faster access to state-of-the-art technology rather than be held up by backlog of regulatory approvals Q & A Nies Purwati Qualcomm): When investors come to Indonesia and find problems in realizing their investment, is there any way for them to communicate these problems to BKPM? In order to accelerate the problem-solving process, can BKPM establish a forum to facilitate discussion between investors and related ministries/agencies? Nurul Ichwan BKPM) In the investment realization period, investors might face some problems. As long as they submit the information and seek the assistance of BKPM, BKPM will provide support in solving those problems. There are two approaches in providing the support: i) BKPM will try to understand the real problem. This is important as a reference for other investors who might face similar problems during the implementing stage of investment. ii) BKPM will communicate the problem to the related ministries to find solutions. For this, the Deputy Chairman of Investment Controlling & Realization will invite investors and relevant ministries.

Agung Yudhawiranata Google Indonesia): FDI are focused in Java. Is there any program or plan from BKPM to help spread the FDI? Nurul Ichwan BKPM ) Investment follows the market. As long as a market can be created in any part of Indonesia, investment will come. The problem is that most of the market in Indonesia is located in Java island. Even though other islands like Sumatera, Papua, or Kalimantan have natural resources, these resources mean nothing without buyers. This situation encourages BKPM to do more investment promotion on downstream industry to process the natural resources spread in Sumatera, Kalimantan and Papua. Building processing industries outside Java will also attract the market there as processing industries will need human resources and suppliers. Another positive impact will be the interaction between the industry and the local communities. Connectivity is not only an inter-island issue but also a problem even in Java. An example is the automotive industries concentrated in greater Jakarta. Therefore BKPM is now focusing also on promoting investment in infrastructure to build better connectivity. Phil Nervig US Embassy): This morning we talked about developing the e-commerce industry. Developing the e-commerce industry requires more venture capital. The problem is, in the new Negative Investment List, e-commerce is closed for foreign investors. Nurul Ichwan BKPM) The closing of certain sectors from Foreign Direct Investment in the Negative Investment List is proposed by technical institutions with their own considerations. Personally I don t know why the Ministry of Communication and Information proposed e-commerce to be closed. I think it is because the e-commerce business is closely related to the SMEs and we want our SMEs to have collaboration with domestic direct investors in the e-commerce business. At the moment the government is still building the readiness of Indonesian e-commerce business players. Another example is the animation sector. It is closed until Indonesia has the expertise and the talents in animation to make sure that local players still have the opportunity to develop the sector. Chris Zull GSMA) Clearly the impact of closing sector like e-commerce in the Negative Investment List is negative.

Surendren Velappu HP): It is a fact that ICT investment in Indonesia is going down. In general, Indonesia is not of interest in the global ICT supply chain. If Indonesia wants to attract the global ICT supply chain to invest in the country, there must be some fundamental prerequisites. The most important is having a stable regulatory environment. Right now it is difficult to find a way to market Indonesia. There is no clear regulatory environment. ICT investment is not like multi-billion dollars oil and gas investment, they are generally small but of high value. How can BKPM influence the regulatory ministries to differentiate the ICT investment against other investment in the natural resources processing industry? Nurul Ichwan BKPM) BKPM is under the Coordinating Ministry for Economic Affairs. There are inter-ministerial meetings to discuss business sectors to be opened or closed for foreign investment and the impacts to the economy of Indonesia. Telecom tower is an example. It has been closed for years but still there is no domestic investment coming to the sector. But it is still closed until today because it is a sensitive area. As technology is moving very fast, a country like Indonesia which is not yet advanced in technology needs to protect the interest of the country while at the same time develop the readiness of Indonesian players. We need the development of ICT but at the same time we don t know what we are going to do to protect our people in the fast-moving sector. The closing of certain business sectors should not always be seen from the economic equation but also from the perspective of readiness. Ilham Habibie DeTIKNas) In the coming six months, DeTIKNas and other stakeholders will start the implementation of the Indonesia Broadband Plan IBP) in 5 selected regencies as pilot projects. Detiknas welcomes companies that want to take part in the discussion on the implementation of the Indonesia Broadband Plan.

!!!!!!!!!!! APPENDIX!E! Supplementary%Materials%! % % %

o. 3/2014 THE COSTS OF DATA LOCALISATION: FRIENDLY FIRE ON ECONOMIC RECOVERY Matthias Bauer Hosuk Lee-Makiyama Erik van der Marel Bert Verschelde www.ecipe.org info@ecipe.org Rue Belliard 4-6, 1040 Brussels, Belgium Phone +32 0)2 289 1350

ECIPE OCCASIONAL PAPER When you can measure what you are speaking about, and express it in numbers, you know something about it; but when you cannot express it in numbers, your knowledge is of a meagre and unsatisfactory kind. Lord Kelvin SUMMARY This paper aims to quantify the losses that result from data localisation requirements and related data privacy and security laws that discriminate against foreign suppliers of data, and downstream goods and services providers, using GTAP8. The study looks at the effects of recently proposed or enacted legislation in seven jurisdictions, namely Brazil, China, the European Union EU), India, Indonesia, South Korea and Vietnam. Access to foreign markets and globalised supply chains are the major sources of growth, jobs and new investments in particular for developing economies. Manufacturing and exports are also dependent on having access to a broad range of services at competitive prices, which depend on secure and efficient access to data. Data localisation potentially affects any business that uses the internet to produce, deliver, and receive payments for their work, or to pay their salaries and taxes. The impact of recently proposed or enacted legislation on GDP is substantial in all seven countries: Brazil -0.2%), China -1.1%), EU -0.4%), India -0.1%), Indonesia -0.5%), Korea -0.4%) and Vietnam -1.7%). These changes significantly affect post-crisis economic recovery and can undo the productivity increases from major trade agreements, while economic growth is often instrumental to social stability. If these countries would also introduce economy-wide data localisation requirements that apply across all sectors of the economy, GDP losses would be even higher: Brazil -0.8%), the EU -1.1%), India -0.8%), Indonesia -0.7%), Korea -1.1%). The impact on overall domestic investments is also considerable: Brazil -4.2%), China -1.8%), the EU -3.9%), India -1.4%), Indonesia -2.3%), Korea -0.5%) and Vietnam -3.1). Exports of China and Indonesia also decrease by -1.7% as a consequence of direct loss of competitiveness. Welfare losses expressed as actual economic losses by the citizens) amount to up to $63 bn for China and $193 bn for the EU. For India, the loss per worker is equivalent to 11% of the average month salary, and almost 13 percent in China and around 20% in Korea and Brazil. The findings show that the negative impact of disrupting cross-border data flows should not be ignored. The globalised economy has made unilateral trade restrictions a counterproductive strategy that puts the country at a relative loss to others, with no possibilities to mitigate the negative impact in the long run. Forced localisation is often the product of poor or one-sided economic analysis, with the surreptitious objective of keeping foreign competitors out. Any gains stemming from data localisation are too small to outweigh losses in terms of welfare and output in the general economy. 2 No. 3/2014

ECIPE OCCASIONAL PAPER INTRODUCTION Over the past few years, there has been a widespread proliferation of regulatory restrictions of the internet, in particular for commercial use. Whereas governments earlier endeavours to increase control over the internet had the implicit aim of keeping information outside state borders, this new breed of regulation aims at keeping data in. With the pretext of increasing online security and privacy, some governments are requiring mandatory storage of critical data on servers physically located inside the country, i.e. data localisation. Also, some data protection and security laws create barriers to cross-border data transfers to such an extent that they are effectively data localisation requirements. The belief that forcing personal information, emails and other forms of data from leaving the country would prevent foreign surveillance or protect citizens online privacy is flawed in several ways. First, many of the recent legislative proposals pre-date the surveillance revelations, and are not designed for addressing these issues. Second, information security is not a function of where data is physically stored or processed. Threats are often domestic, while storing information in one physical location could increase vulnerability. Thirdly, data localisation is not only ineffective against foreign surveillance, it enables governments to surveil on their own citizens. Moreover, users and business do not access data across borders with the purpose of evading domestic laws, while legal obligations do not always depend on where a server is physically placed. As a result, data localisation, or discriminatory privacy and security laws to similar effect, has spawned severe protest from advocates for open internet and the global trading system. Forced localisation is often the product of poor or one-sided economic analysis, with the surreptitious objective of keeping foreign competitors out, or creating a handful of new jobs in e-commerce, data centres or consultancies. However, any job gains as a result of data localisation are minuscule compared to losses in terms of jobs and output in other parts of the economy. Access to foreign markets through trade liberalisation and globalised supply chains are major sources of growth, jobs and new investments in particular for developing economies. Given the nature of today s globally interconnected economy, poorly designed national policies that increase data processing costs have a severe economic impact as many sectors of the economy rely on digitally supplied services and goods. Manufacturing and exports sectors are also dependent on having access to a broad range of services at competitive prices such as logistics, retail distribution, finance or professional services which in turn are heavily dependent on secure, cost-efficient and realtime access to data across borders. When data must be confined within a country, it does not merely affect social networks and email services, but potentially any business that uses the internet to produce, deliver, and receive payments for their work, or to pay their salaries and taxes. This paper aims to quantify the economic losses that result from data localisation requirements and related data privacy and security laws that discriminate against foreign suppliers of data. It does so by using a computable general equilibrium model CGE) called GTAP8 see Annex II), which is a well-acknowledged methodology that is frequently used for trade and economic impact analyses by academia and policymakers worldwide. The study looks at the effects of the recently proposed or enacted legislation in seven jurisdictions, namely Brazil, China, the European Union EU), India, Indonesia, South Korea and Vietnam. Some of these countries have conducted quantitative impact studies notably the EU) measuring institutional or firm-level costs. 1 Yet, no public study by a market regulator has investigated 3 No. 3/2014

ECIPE OCCASIONAL PAPER the effects on exports, gross domestic product GDP) and consumer welfare as a result from proposed data localisation requirements or privacy laws. OVERVIEW OF RELEVANT INTERNET AND PRIVACY REGULATIONS The analysis looks at a number of recently introduced or proposed measures with respect to data localisation by conducting a survey in each of the aforementioned countries jurisdictions. The measures are assumed to alter the costs of engaging in commercial activities in the selected countries a brief description of all measures in each country can be found in Annex I). The way in which these primarily privacy and security related measures operate is of principal importance for accurate data modelling. For instance, data localisation requirements are effectively disruptive bans of data processing and hence the foreign provision of that service into the domestic territory. The ban can be introduced economy-wide e.g. China, Vietnam), or selectively to a particular sector e.g. only financial services in Korea). Besides data localisation, a number of administrative regulatory barriers could be introduced through additional legal obligations that increase compliance costs, such as stricter consent requirements, a right to review personal information held by firms, the requirement to notify a market regulator and/or data subjects in case of potential security breaches. Some measures are institutional such as the requirement to appoint a data privacy officer DPO) within the organisation; while others increase business risks by introducing sanctions for non-compliance in many cases with ambiguous laws), or a government s right to access a business proprietor s or its clients data. Overall, compliance with these measures increases the operational expenditure of firms which raises domestic prices and non-tariff barriers NTB) on imports. Therefore, in order to measure the actual or potential costs of introducing these measures, for this paper we have estimated the costs of all data localisation measures using two different scenarios: Scenario 1, which is based on the actual proposed regulations as defined in Table 1, including data localisation in each country as per today. Scenario 2, which is based on the actual proposed regulations, but with the addition of a data localisation requirement applied to all sectors in each country. TABLE 1: OVERVIEW OF REQUIREMENTS IN LEGISLATIVE PACKAGES Brazil China EU28 India Indonesia Korea Vietnam Data localisation requirement No Yes No Partial Yes Partial Yes Consent required for data collection Yes Yes Yes Yes Yes Yes No Consent required for transfer to third parties Yes Yes No Yes No Yes No Right to review No No Yes Yes Yes Yes No Right to be forgotten Yes Yes Yes No No Yes Yes Breach notification No Yes Yes No Yes Yes No Impact assessment No Yes Yes No No No No Data privacy officers No No Yes No No Yes No Sanctions for non-compliance Yes Yes Yes Yes Yes Yes No Government access required Yes No No Yes No No Yes Data retention requirement Yes No No Yes No No Yes 4 No. 3/2014

ECIPE OCCASIONAL PAPER CONCEPTUAL MODELLING The scenarios are calculated using several economic shocks caused by data restrictions. If new regulations restrict businesses and individuals from using data in a reasonable manner prices of any good or service that uses data in its production would also increase. For example, the input costs for a logistics company would increase as they can no longer process data on its customers or shipments using their existing IT suppliers or infrastructure, or are faced with some compliance costs for doing so. This new cost is passed on to its customers who may be manufacturers, exporters and consumers. Thus, increased regulation leads firstly to domestic productivity losses for various sectors of the economy. Secondly, it creates an additional trade barrier against data processing and internet services, or any service to a lesser extent also goods) that depends on the use of data for delivery. Thirdly, as the competitiveness of the economy changes, investments both domestic and foreign) will be affected. Finally, the effectiveness of R&D is affected to the extent that product development depend on customer and market data to compete in the market place. The first shock, which measures the effect on productivity, is created using a so-called augmented product market regulatory PMR) index for all regulatory barriers on data, including data localisation, to calculate domestic price increases or total factor productivity TFP) losses. 2 It sets out what domestic companies will have to pay additionally for sourcing domestic data services by first estimating the general effect of administrative burdens in data processing services on prices and TFP in each sector of the economy. Data processing services is an important input for production and by using existing indexes from the OECD measuring administrative barriers in services over time, we evaluate the extent to which these administrative barriers in data services affect other parts of the economy through the use of data services. For example, the telecommunications sector is very data intensive with 31% of its inputs being data-related) and should be more heavily affected by regulation; similarly, data processing is 5 to 7% of the total inputs used by business/ict and financial services. 3 The index is then raised based on the regulatory barriers as given in Table 1 for each country. Not all of these measures are equally restrictive, and their relative importance is therefore weighted according to their relative cost impact. 4 By benchmarking the resulting index against the estimate prior to the legislation and data processing intensities for all sectors, we compute the price and TFP changes for all sectors in each country as a result of data localisation and administrative barriers. The second methodology computes cost differences between countries as a result of data localisation requirements in each of the countries. Two types of data are primarily used namely the Data Centre Risk Index, 5 and an empiric observation of cost differences. 6 The first source ranks countries according to a number of risk factors that affect the costs of operating a data centre a ranking that closely follows the general cost structure across countries of setting up a centre as a consequence of data localisation measures. The observations of actual costs are broadly in line and thereby confirm the Risk Index. These costs are up-front trade costs each firm will need to incur when investing in and exporting to one of our selected countries see Annex II). These trade costs are allocated across all sectors in each economy based on the intensity with which each sector uses data services. The final numbers are interpreted as the additional costs a firm will need to pay for using data services when entering one of the countries in which data localisation laws are implemented. The third shock occurs on investment, which forms a major driver for economic growth for developing countries in particular. However, as the regulatory environment imposes more 5 No. 3/2014

ECIPE OCCASIONAL PAPER market limitations, investments made by both domestic and foreign entities will decrease. In GTAP8 this is introduced as a change in rate of return on investments see Annex II). Furthermore, a final shock occurs as an additional effect on the return on investment, which is derived from research and development. A survey by Xu, Zhu, Gibbs 2004) provides the share of firms in developed and developing countries respectively that uses online sales, advertising or electronic data interchanges EDI).7 These numbers are also consistent with industry reports on the share of firms that uses CRM customer relationship management) applications for data mining of their customers.8 The relation between R&D expenditure and return is given by several studies notably Hall, Foray, Mairesse, 2009; Ortega, Argilés, 2009, Rogers, 2009), based on empirical evidence. THE OUTCOME OF THE SIMULATIONS The outcome of the simulations shows that the impact on economic activity in all economies is considerable. Figure 1 summarizes the results of the two scenarios outlined above. The realistic Scenario 1 naturally gives lower overall outcomes than Scenario 2 except for China, Indonesia and Vietnam where economy-wide data localisation has already been introduced or is being considered and is hence included already in Scenario 1). India suffers the lowest GDP effects as a result of our simulations in the realistic scenario 1. However, this would increase drastically if India were to implement a data localisation requirement. Brazil also has relatively low GDP losses 0.2%) based on Scenario 1 but this effect quadruples if data localisation is applied. Both the EU and Korea also report substantial differences between the two scenarios as a result of economy-wide data localisation. FIGURE 1: GTAP SIMULATIONS ON GROSS DOMESTIC PRODUCT GDP) FOR SELECTED COUNTRIES. CHANGES IN % 6 No. 3/2014

ECIPE OCCASIONAL PAPER Overall, for some countries these losses are rather sizable. In many cases, the effects on GDP are sufficient to eradicate the economic gains produced by most trade agreements they have negotiated or are currently negotiating, e.g. Transatlantic Trade and Investment Partnership TTIP) or Trans-Pacific Partnership TPP) for instance, in the case of Brazil, Vietnam and Korea current growth projections would be dented by at least one-third figure 2). The GDP loss in Scenario 1 is sufficient to put the EU back into decline figure 3) also, the European Commission projects a GDP growth of one percent in seven years approx. 0.14% year-on-year) from its European Cloud strategy, whereas data localisation leads to at least 1% decline in just one year for the EU. FIGURE 2: PROJECTED GDP GROWTH 2014); ADJUSTED FOR SCENARIO 2 CHANGES IN % 7 No. 3/2014

ECIPE OCCASIONAL PAPER FIGURE 3: PROJECTED GDP GROWTH FOR THE EURO ZONE ACCUMULATED CHANGES IN % SINCE 2013 As explained above, the GTAP model also allows for an outcome analysis on investment for each country. Figure 2 sets out the results which show that considerable changes in domestic and foreign investments can be expected as a result of the deteriorated regulatory environment. The figure shows that Brazil and the EU would suffer most from lower investments under both scenarios. One potential reason is that both economies are very investment intensive in those services and goods) sectors which rely on data services the most. Other countries such as China, India and Indonesia would experience an equal loss in investment under both scenarios albeit still substantial. Korea reports a large difference between both scenarios. FIGURE 4: GTAP SIMULATIONS ON INVESTMENTS FOR SELECTED COUNTRIES. CHANGES IN % 8 No. 3/2014

ECIPE OCCASIONAL PAPER Figure 5 finally sets out the changes for trade, both in terms of total exports, goods exports and services exports. First we note that the exports effects are lower than the investment changes reported in Figure 2. A second interesting issue with regards to the trade effects is that for some countries such as Brazil, China and Indonesia, but also Korea and Vietnam the negative effects on goods exports are greater than for services. This is most likely due to the fact that none of the selected countries are services-driven economies, with the exception of the EU where the services exports losses are greater. FIGURE 5: GTAP SIMULATIONS ON EXPORTS FOR SELECTED COUNTRIES. CHANGES IN % Overall, the welfare losses that are incurred are mostly derived from higher prices and displaced domestic demand that cannot be met by supply. Table 2 finally sets out the total and per capita nominal costs for each scenario based on our GTAP calculations. One can see that the welfare losses in China 61.6-63.8 bn US$) and the EU 80-193 bn US$) are greatest, followed by Korea 5.3-15.9 bn US$), Brazil 4.7-15 bn US$) and India 3.1-14.5 bn US$)) Both Vietnam and Indonesia are least affected in nominal terms, although this does not mean that their economies would not suffer significantly, in particular noting the changes in GDP and variance in median incomes of some of the countries. TABLE 2: WELFARE EFFECTS FROM DATA LOCALISATION AND PRIVACY BARRIERS IN CURRENT US$ Brazil China EU28 India Indonesia Korea Vietnam Scenario 1-4.7 bn. -61.6 bn. -80 bn. -3.1 bn. -2.7 bn. -5.3 bn. -1.5 bn. Scenario 2-15 bn. -63.8 bn. -193 bn. -14.5 bn. -3.7 bn. -15.9 bn. -1.5 bn. Scenario 1 per worker) Scenario 2 per worker) -48.9-80.7-333.9-6.7-24.9-218.6-31.5-156.1-83.6-805.6-31.5-34.1-655.7-31.5 Table 2 also gives numbers on the welfare costs of data regulation per worker. This negative effect also varies substantially. Nominal figures for the EU and Korea seem large whereas 9 No. 3/2014

ECIPE OCCASIONAL PAPER those for Vietnam, India and Indonesia seem low. Yet, it should be taken into account that the average worker s salary is much lower in the latter countries. To give an example, using comparable average workers salaries across countries the negative welfare effect would still cost the Indian worker almost 11 percent of one average month salary. Similarly, for China, this impact would come down to almost 13 percent, and even much higher for Korea and Brazil around 20 percent for both economies. CONCLUSION Industry and internet advocates have warned against an Internet which is fragmented along national borderlines. Some of them are going as far as calling balkanisation the greatest threat to the Internet today, even greater than censorship. 9 One comprehensive study by Chander and Lê 2014) from the California International Law Centre established that data localisation threatens the major new advances in information technology not only cloud computing, but also the promise of big data and the Internet of things. 10 It is not unlikely that future trade agreements will include disciplines against data localisation requirements, as there are often less trade-restrictive measures available to address privacy and security. However, the more immediate effect of data localisation measures the impact on economic recovery and growth is even more dangerous. As this study has shown, this impact is a direct consequence of the complex relations between cross-border data flows, supply chain fragmentation and domestic prices. These are complexities that are generally not understood by policymakers, who are often in the field of security and privacy law, rather than international trade. The findings regarding the effects on GDP, investments and welfare from data localisation requirements and discriminatory privacy and security laws are too considerable to be ignored in policy design. It is also reasonable to assume that SMEs and new firms are the first to be displaced from the market, as they lack resources to adapt to the regulatory changes. In the current security policy context, many regulators and privacy advocates stress the importance of discretion to tackle problems at a national level e.g. NetMundial 2014 draft conclusions) 11. The economic evidence however proves that unilateral trade restrictions are counterproductive in the context of today s interdependent globalized economy. The selfincurred losses make data localisation a policy that unilaterally puts the country at a relative loss to others while the possibilities for offsetting the negative impact through trade agreements or economic stimulus are relatively limited over the long term. 10 No. 3/2014

ECIPE OCCASIONAL PAPER ANNEX I Brief overview of proposed and enforced acts reviewed Brazil The Brazilian internet law Marco da Civil started out its life as a crowdsourced legislative proposal in 2009. While it emphasised the fundamental principles of internet freedom and net neutrality, following revelations that Brazilian entities had been subject to US surveillance, new privacy related amendments were made to the bill, including strict consent requirements for data collection, internet users right to be forgotten and a clear data localisation provision the controversial article 12, which was later withdrawn. China The existence of a plethora of overlapping data privacy laws has traditionally made compliance a very difficult issue in China. Driven by an increasing number of reports on identity theft and illegal trade in personal data, 12 rather than surveillance concerns, China has however taken steps towards privacy reforms the Resolution relating to Strengthening the Protection of Information on the Internet of December 2013 includes general rules for internet service providers ISPs) and other businesses prohibiting the collection of personal data without consent and the illegal transfer or sale of personal information to third parties. 13 In the same year, the Standardisation Administration and the General Administration of Quality Supervision, Inspection, and Quarantine published new national standards that prohibit overseas transfers of data to an entity absent express user consent, government permission, or other explicit legal or regulatory permission. Despite the voluntary character of these guidelines, they serve as regulatory baseline for law enforcement and are de facto data localisation laws for all business sectors. 14 The People s Bank of China PBOC) has also issued a Notice to Urge Banking Financial Institutions to Protect Personal Financial Information, 15 which explicitly prohibits off-shore storing, processing or analysis of any personal financial information of Chinese citizens; meanwhile the Ministry of Industry and Information Technology MIIT) has banned collection of personal data without consent or without specific and clear purpose. 16 The Telecommunications and Internet Personal User Data Protection Regulation also requires regular risk impact assessments to be conducted by data processors. The European Union In January 2012, the European Commission proposed a reform of the EU s data protection regime, which is currently based on the 1995 Data Protection Directive. The aim of the new proposal, dubbed the General Data Protection Regulation GDPR), is to establish a single European-wide data protection law. Aside from simplifying administrative procedures and centralizing supervisory authority, GDPR also introduces strict consent requirements, a right to review, a right to be forgotten, and the obligation for businesses to appoint a data protection officer DPO) and perform an annual data protection impact assessment DPIA). If implemented, the GDPR reform could lead to a stoppage of cross-border data flows from the EU to important data processing countries such as the US and India, which are deemed to have adequate data privacy safeguards in place under the EU s current regime. Aside from GDPR, the Commission has also adopted a strategy for Unleashing the Potential of Cloud Computing in Europe. The strategy aims to unify rules and standards related to cloud computing within Europe. If these standards will be designed in a way that decreases 11 No. 3/2014

ECIPE OCCASIONAL PAPER the interoperability with other countries regulatory regimes, this could lead to a de facto data localization. India In 2011, the Indian Ministry of Communications and Technology implemented certain provisions of the 2000 Information Technology Act by publishing privacy rules. These Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules introduced a strict consent requirement that only allows for sensitive personal data to be transferred abroad when necessary or when the individual s consent has been obtained. 17,18 These rules also introduced the right to access and review personal information that a company holds. The mercantilist intent of the law is clear, as the government of India issued a clarification to emphasise that the rules do not apply to its expanding outsourcing business. 19 The laws have also been amended with a data retention requirement with duration at the discretion of the government) for intermediaries that so far has not been implemented. National media in India have reported that the National Security Council Secretariat NSCS) is considering proposals that incorporate strong elements of data localisation, mandating all email providers to set up local servers, or that all data generated from within India should be hosted in these India-based servers and this would make them subject to Indian laws. The strategy also includes creating an Indian email service and ensuring Internet traffic data is routed within India as much as possible, including precedents of forced data localisation for selective cases and services, e.g. BlackBerry mail services in 2012. 20 Indonesia ata protection is covered by Law No. 11 of 2008 regarding Electronic Information and Transaction the EIT Law ) and Government Regulation No. 82 of 2012 regarding the Provision of Electronic System and Transaction Reg. 82 ), which went into force on 15 October 2012. In order to collect and process data, the data controller needs a legitimate reason for collection and the individual s consent. 21 Regulation 82 further requires a broad and undefined group of companies, electronic systems operators for public service to set up a data centre and disaster recovery centre in Indonesian territory for the purpose of law enforcement and data protection. The scope of this requirement is unclear however, as electronic systems operators for public service are not clearly defined. Draft Regulation Concerning Registration Procedure of Electronic System Provider and January 2014 Draft Regulation with Technical Guidelines for Data Centres contain same ambiguity, although a ministry spokesperson was quoted saying: [the draft] covers any institution that provides information technologybased services. 22 Korea In the Republic of Korea, the Personal Information Protection Act PIPA) has been in force since 30 September 2011 and covers all sectors. In addition, the sector-specific Act on Promotion of Information and Communication Network Utilisation and Information Protection IT Network Act ) regulates the collection and use of personal data by IT service providers. 23 Under these acts, every data handler including businesses, individuals and government agencies) must appoint a data protection officer DPO), and consent must be obtained both 12 No. 3/2014

ECIPE OCCASIONAL PAPER for the initial collection and processing of personal data and prior to any transfer abroad or to third parties. PIPA gives individuals the right to review and delete personal data that pertain to them and obliges data handlers to notify the data subjects without delay in case of a data breach. If the number of individuals affected exceeds 10,000, the data handler must also notify the relevant authorities. In addition, Korea prohibits the outsourcing of data-processing activities to third parties in the financial services industry. Banks can therefore only process financial information related to Korean customers in-house, either in Korea or abroad. Vietnam In 2013, the Vietnamese government issued Decree 72, on Management, Provision, and Use of Internet Services and Information Content Online, which came into effect on September 1 st. 24 The Decree s main aim seems to have been to tighten the government s grip on the Internet and limit free expression, 25 with a broad range of prohibitions under article 5 including opposing the state. The Decree requires ISPs to obtain a license and to register with the Ministry of Information and Communications before providing online services, and all organisations establishing general websites, social networks and companies providing services across mobile networks are required to establish at least one server inside the country containing the entire history of information posting activities on general information websites ) and sharing on social networks. 13 No. 3/2014

ECIPE OCCASIONAL PAPER ANNEX II Description of the GTAP8 model 1. The Model The model applied in this study is GTAP 8, a computable general equilibrium CGE) model. 26 The most recent model setting accounts for inter-sectoral linkages between 129 regions while capturing inter-regional trade flows of 57 commodities. The framework thus allows for a general equilibrium analysis of the economic effects e.g. GDP effects and changes in trade flows) resulting from the regulation of cross-border data flows. In this model, regional production is characterized by constant returns to scale and perfect competition. Private demand is represented by non-homothetic consumer demands. The structure of foreign trade is based on the so-called Armington assumption, which implies imperfect substitutability between domestic and foreign goods. The most recent GTAP 8 dataset includes national input-output data as well as trade, tariff and demand structures. The model s base data are primarily benchmarked to 2007. Trade data are based on 2004 and 2007 values while the reference year of protection data is 2007 see Narayanan et al 2012). 27 Like any applied economic model, this model is based on a number of assumptions. In order to account for recent changes in regional macroeconomic variables, the GTAP 8 dataset on the global economy is extrapolated to 2014. The exogenous variables used for the extrapolation are macroeconomic variables, i.e. the size of GDP, total population, labour force, total factor productivity and capital endowment as provided by the well recognised database of the French research center in international economics CEPII), which is documented by Fouré et al 2012). We apply the estimates of these macroeconomic data projections in order to calculate the best estimate of the global economy in 2014. Preferences and production structures as described by the model s structural parameters have been left unmodified. The model we use in this study is comparative static. This model does not account for endogenous productivity growth and may thus under-predict welfare effects, economic growth and increases in trade flows that result from the imposition of NTB s due to regulations of crossborder data flows. 28 The interdependence between, on the one hand, productivity growth and, on the other hand, exports, imports and investment is neglected in static CGE models. 2. Treatment of Investment GTAP is a pure real goods model that does not account for financial instruments. Thus, the standard GTAP model does not take into consideration supply-side impacts of capital market conditions. In the model, investors are represented by a global bank allocating regional savings and investments around the world. Investment itself is represented by a stock of capital goods CGDS), which is treated as a commodity that is purchased by the global bank and allocated to regions following a return-equalising rule. The capital goods commodity does not employ any primary factors of production. It rather absorbs a mix of intermediate goods such as construction, machinery equipment, vehicles, and services etc. In addition, capital goods cannot be traded across regions. Instead regional capital goods formation is determined be regional savings, which are absorbed by the global bank and reallocated to regions thereafter. 29 For a detailed description of the treatment of capital goods in GTAP see Malcom 1998). 14 No. 3/2014

ECIPE OCCASIONAL PAPER In order to estimate the economic impact of decreasing returns on capital due to data localisation barriers to trade, we follow an indirect expected rate of return approach. It is assumed that the global bank allocates investment across regions in such a way that risk-adjusted rates of returns are equalised across regions. Thus, in GTAP a change of the expected rate of return in a given region results in corresponding changes in the amount of regional investment. The underlying assumption is that equilibrium rates of returns on investment are equal across regions and equal to a global rate of return. In addition, it is assumed that expected returns in a specific region will fall as the amount of investment rises. Thus, a difference between the global rate of return and a region s rate of return triggers a reallocation of investment across regions until regional rates of investment are equalised again. The difference between riskadjusted regional rates of return can be read as a region-specific risk premium decreasing the region s attractiveness to investors. In line with this assumption, an increase in regional investment risk reduces capital goods formation and decreases demand for factor inputs to investment in the region concerned. At the same time, investment would increase in regions not affected by decreasing investor appetite. The results of our experiment only have indicative character, meaning that we are not able to forecast the precise investment effect due to data localisation barriers to trade mainly for two reasons: 1) The shortcomings in the treatment of investment in GTAP and 2) the transformation of expected returns on investment into investors risk appetite, which is an empirical problem in general. Yet, the methodology we apply allows us to forecast and trace the direction of investment flows. 15 No. 3/2014

ECIPE OCCASIONAL PAPER BIBLIOGRAPHY Andriamananjara, Dean, Feinberg, Ferrantino, Ludema, Tsigas 2004), The Effects of Non- Tariff Measures on Prices, Trade, and Welfare: CGE Implementation of Policy-Based Price Comparisons, USITC Economics Working Paper No. 2004-04-A. Asia Sentinel, Indonesia May Force Web Giants to Build Local Data Centers, 27.01.2014, accessed at http://www.asiasentinel.com/econ-business/indonesia-web-giants-local-datacenters/, 12.04.2014. Cassells, Meister, Cost and trade impacts of environmental regulations: effluent control and the New Zealand dairy sector. The Australian Journal of Agricultural and Resource Economics 45 2), p. 257-274, 2001 A. Chander, U. P. Lê, Breaking the Web: Data Localization vs. the Global Internet, Working Paper 2014-1, California International Law Center, 12.03.2014, accessed at http://ssrn.com/ abstract=2407858, 20.03.2014. Christensen, L., A. Colciago, F. Etro and G. Rafert 2013) The Impact of the Data Protection Regulation in the EU, Intertic Policy Paper, Intertic. Covington & Burling LLP, China Releases New National Standard For Personal Information Collected Over Information Systems, E-alert Global Privacy & Data Security, 15.02.2013, accessed at http://www.cov.com/files/publication/.../china_releases _New_National_Standard_for_Personal_Information_Collected_Over_Information_Systems.pdf, 12.04.2014. G. Cheah, Protection of personal financial information in China, Norton Rose Fulbright, October 2011, accessed at http://www.nortonrosefulbright.com/knowledge/publications/56148/protection-of-personal-financial-information-in-china, 12.04.2014. China Copyright and Media, National People s Congress Standing Committee Decision concerning Strengthening Network Information Protection, 28.12.2012, accessed at http:// chinacopyrightandmedia.wordpress.com/2012/12/28/national-peoples-congress-standing-committee-decision-concerning-strengthening-network-information-protection/, 20.01.2014. China Copyright and Media, Telecommunications and Internet Personal User Data Protection Regulations, 16.07.2013, accessed at: http://chinacopyrightandmedia.wordpress. com/2013/07/16/telecommunications-and-internet-user-individual-information-protection-regulations/, 20.01.2014. L. Clark, Tim Berners-Lee: we need to re-decentralise the web, Wired, 06.02.2014, accessed at http://www.wired.co.uk/news/archive/2014-02/06/tim-berners-lee-reclaim-the-web, 20.03.2014. Cushman & Wakefield, Data Centre Risk Index 2013, accessed at: http://www.cushmanwakefield.pt/en-gb/research-and-insight/2013/data-centre-risk-index-2013 DLA Piper, Data Protection Laws of the World, accessed at http://files.dlapiper.com/files/ Uploads/Documents/Data_Protection_Laws_of_the_World_2013.pdf, 15.04.2014. Elffers, Heijden, Hezewijk, Explaining Regulatory Non-compliance: A Survey Study of Rule Transgression for Two Dutch Instrumental Laws, Applying the Randomized Response Method, Journal of quantitative criminology, volume: 19 2003), pp. 409 439, accessed 16 No. 3/2014

ECIPE OCCASIONAL PAPER from [http://igitur-archive.library.uu.nl/fss/2007-0206-201216/64.%20explaining%20regulatory%20non-compliance.pdf ], 2003 Frost & Sullivan, Insights into Big Data and Analytics in Brazil, 2014 Koszerek, D., Havik, K., McMorrow, K., Röger, W., Schönborn, F. 2007), An Overview of the EU KLEMS Growth and Productivity Accounts Foure, Benassy-Quere, Fontagne 2010), The world economy in 2050: a tentative picture, CEPII Working paper 2010-27. Hertel, Tsiga, Structure of GTAP. In Global Trade Analysis : Modeling and Applications. Ed. Thomas W. Hertel, Purdue University. Cambridge University Press. 1997 Hunton & Williams LLP, Recent Data Breach Events in China, Privacy and Information Security Law Blog, 31.12.2013, accessed at https://www.huntonprivacyblog.com/2013/12/articles/recent-data-breach-events-china/, 20.01.2014. Hunton & Williams LLP, Outsourcers Exempt from India s Privacy Regulations, Privacy and Information Security Law Blog, 24.08.2011, accessed at https://www.huntonprivacyblog. com/2011/08/articles/outsourcers-exempt-from-indias-privacy-regulations/, 18.03.2014. Jorgenson, Ho, Stiroh, Information Technology and the American Growth Resurgence Cambridge, MA: MIT Press), 2005 Library of Congress, Global Legal Monitor: Vietnam: Controversial Internet Decree in Effect, 06.09.2013, accessed at http://www.loc.gov/lawweb/servlet/lloc_news?disp3_l205403690_ text, 13.12.2013. Malcolm, G. 1998), Modeling Country Risk and Capital Flows in GTAP, GTAP Technical Paper No. 13. V. Manuturi, B. Gokkon, Web Giants to Build Data Centers in Indonesia?, 15.01.2014, The Jakarta Globe, accessed at http://www.thejakartaglobe.com/news/web-giants-to-builddata-centers/, 02.03.2014 C. C. Miller, Google Pushes Back Against Data Localization, Bits Blog New York Times, 24.01.2014, accessed at http://bits.blogs.nytimes.com/2014/01/24/google-pushes-backagainst-data-localization/, 27.03.2014. Narayanan, G., Badri, Angel A. and McDougall, R., Eds., Global Trade, Assistance, and Production: The GTAP 8 Data Base, Center for Global Trade Analysis, Purdue University, 2012 Rakotoarisoa, M. A. 2011), A Contribution to the Analyses of the Effects of Foreign Agricultural Investment on the Food Sector and Trade in Sub-Saharan Africa. M. Palmedo, Vietnam s Decree 72 on Internet Services Aims to Fight Piracy, Raises Human Rights Concerns, infojustice.org, 02.09.2013, accessed at http://infojustice.org/archives/30620, 27.03.2014. PTI, RIM finally sets up Blackberry server in Mumbai, 20.02.2012, accessed at http:// timesofindia.indiatimes.com/tech/tech-news/rim-finally-sets-up-blackberry-server-in- Mumbai/articleshow/11963492.cms, 20.03.2014. 17 No. 3/2014

ECIPE OCCASIONAL PAPER Thanguvalu, S. M. and Rajguru, G. 2004), Is There an Export or Import- Led Productivity Growth in Rapidly Developing Countries? A Multivariate VAR Analysis, Applied Economics, Vol. 36, pp. 1083-1093. UK Ministry of Justice 2012) Impact Assessment for the Proposal for an EU Data Protection Regulation, London: UK Government. US Bureau of Economic Analysis, Input and Output Accounts Data, 2007 Xu, Zhu, Gibbs, Global technology, local adoption: A cross-country investigation of Internet adoption by companies in the United States and China, Electronic Markets, 2004 ENDNOTES 1. European Commission, Staff Working Paper, SEC 2012) 72 final 2. OECD 2013), Product Market Regulation Database, www.oecd.org/economy/pmr 3. Data on TFP and prices for each sector are taken from EUKLEMS, whereas intensities of data services for each sector are based on US input/output use tables from the US Bureau of Economic Analysis BEA). 4. Christensen, L., A. Colciago, F. Etro and G. Rafert, The Impact of the Data Protection Regulation in the EU, Intertic Policy Paper, Intertic, 2013; UK Ministry of Justice, Impact Assessment for the Proposal for an EU Data Protection Regulation, UK Government, 2012 5. Cushman & Wakefield, Data Centre Risk Index 2013, accessed at: http://www.cushmanwakefield.pt/en-gb/ research-and-insight/2013/data-centre-risk-index-2013 6. Frost & Sullivan, Insights into Big Data and Analytics in Brazil, 2014 7. Xu, Zhu, Gibbs, Global technology, local adoption: A cross-country investigation of Internet adoption by companies in the United States and China, Electronic Markets, 2004 8. Computer Economics, 2011 9. L. Clark, Tim Berners-Lee: we need to re-decentralise the web, Wired, 06.02.2014, accessed at http:// www.wired.co.uk/news/archive/2014-02/06/tim-berners-lee-reclaim-the-web, 20.03.2014. 10. A. Chander, U. P. Lê, Breaking the Web: Data Localization vs. the Global Internet, Working Paper 2014-1, California International Law Center, 12.03.2014, accessed at http://ssrn.com/abstract=2407858, 20.03.2014. 11. Netmundial draft conclusions, section I, art 4 12. Hunton & Williams LLP, Recent Data Breach Events in China, Privacy and Information Security Law Blog, 31.12.2013, accessed at https://www.huntonprivacyblog.com/2013/12/articles/recent-data-breach-eventschina/, 20.01.2014. 13. China Copyright and Media, National People s Congress Standing Committee Decision concerning Strengthening Network Information Protection, 28.12.2012, accessed at http://chinacopyrightandmedia.wordpress.com/2012/12/28/national-peoples-congress-standing-committee-decision-concerning-strengtheningnetwork-information-protection/, 20.01.2014. 14. Covington & Burling LLP, China Releases New National Standard For Personal Information Collected Over Information Systems, E-alert Global Privacy & Data Security, 15.02.2013, accessed at http://www.cov.com/ files/publication/.../china_releases _New_National_Standard_for_Personal_Information_Collected_Over_Information_Systems.pdf, 12.04.2014. 15. G. Cheah, Protection of personal financial information in China, Norton Rose Fulbright, October 2011, accessed at http://www.nortonrosefulbright.com/knowledge/publications/56148/protection-of-personal-financial-information-in-china, 12.04.2014. 16. China Copyright and Media, Telecommunications and Internet Personal User Data Protection Regulations, 16.07.2013, accessed at: http://chinacopyrightandmedia.wordpress.com/2013/07/16/telecommunicationsand-internet-user-individual-information-protection-regulations/, 20.01.2014. 18 No. 3/2014

ECIPE OCCASIONAL PAPER 17. A. Chander, U. P. Lê, Breaking the Web: Data Localization vs. the Global Internet, Working Paper 2014-1, California International Law Center, 12.03.2014, accessed at http://ssrn.com/abstract=2407858, 20.03.2014. 18. Sensitive personal data includes physical, physiological and mental health conditions, medical records and history, and sexual orientation. The definition also includes biometric data, passwords and financial information such as bank account details, credit and debit card details. 19. Hunton & Williams LLP, Outsourcers Exempt from India s Privacy Regulations, Privacy and Information Security Law Blog, 24.08.2011, accessed at https://www.huntonprivacyblog.com/2011/08/articles/outsourcersexempt-from-indias-privacy-regulations/, 18.03.2014. 20. PTI, RIM finally sets up Blackberry server in Mumbai, 20.02.2012, accessed at http://timesofindia.indiatimes.com/tech/tech-news/rim-finally-sets-up-blackberry-server-in-mumbai/articleshow/11963492.cms, 20.03.2014. 21. DLA Piper, Data Protection Laws of the World, accessed at http://files.dlapiper.com/files/uploads/documents/data_protection_laws_of_the_world_2013.pdf, 15.04.2014. 22. Asia Sentinel, Indonesia May Force Web Giants to Build Local Data Centers, 27.01.2014, accessed at http://www.asiasentinel.com/econ-business/indonesia-web-giants-local-data-centers/, 12.04.2014. 23. DLA Piper, Data Protection Laws of the World, accessed at http://files.dlapiper.com/files/uploads/documents/data_protection_laws_of_the_world_2013.pdf, 15.04.2014. 24. Library of Congress, Global Legal Monitor: Vietnam: Controversial Internet Decree in Effect, 06.09.2013, accessed at http://www.loc.gov/lawweb/servlet/lloc_news?disp3_l205403690_text, 13.12.2013. 25. M. Palmedo, Vietnam s Decree 72 on Internet Services Aims to Fight Piracy, Raises Human Rights Concerns, infojustice.org, 02.09.2013, accessed at http://infojustice.org/archives/30620, 27.03.2014. 26. Hertel, Tsiga, Structure of GTAP. In Global Trade Analysis : Modeling and Applications. Ed. Thomas W. Hertel, Purdue University. Cambridge University Press. 1997 27. For further information on original data and model components see Hertel and Tsigas 1997). 28. The static GTAP 8 model does not account for the effects of trade liberalization on domestic industries productivity growth. Trade liberalization, however, may cause productivity to rise. See, e.g., Thanguvalu and Gulasekaran 2004 who study export and import led productivity growth in developing countries. The authors find empirical evidence that increasing imports have a positive effect on long-term output growth. 29. See Malcolm 1998) and Rakotoarisoa 2011). 19 No. 3/2014

Meetingthecybersecurity challengeinindonesia An#analysis#of#threats#and#responses A#report#from#DAKA#advisory Commissioned#by

Contents DAKA$advisory Foreword 4 Abouttheproject 5 Executivesummary 6 Part1.Introduction 8 The#rise#in#cyber#dependence# 8 The#view#from#Indonesia# 10 Part2.Dependencyanditsconsequences 13 Global#cyber#threats# 15 Cyber#threats#to#Indonesia# 17 The#cost#of#cyber#crime#in#the#world#and#in#Indonesia# 20 Part3.Thestateofcybersecurity 23 Global#initiatives# 23 Regional#and#national#measures# 24 Part4.TheIndonesianresponse 26 Legislative#initiatives# 26 Key#stakeholders# 26 Part5.ThefutureofcybersecurityinIndonesia 31 Opportunities#and#threats# 31 Recent#cyber#security#initiatives# 32 Strengths#and#weaknesses# 32 Recommendations# 33 Cover&photo:& &istockphoto.com/loops7 Meeting$the$cyber$security$challenge$in$Indonesia 3

Foreword DAKA$advisory I#have#been#fortunate#to#have#had#two#tours#of#duty#in#Jakarta#and#I#often# When#I#left#Indonesia#in#1997,#contact#with#friends#and#family,#was#done#by# His&Excellency Mark&Canning, British&Ambassador to&indonesia. Just#a#few#years#on,#it s#impossible#to#imagine#our#daily#life#without#the#ins ternet#and#the#opportunities#it#offers#for#immediate#connection#with#anyone,# S over#55#million#internet#users#many#of#whom#are#part#of#the#facebook#and# Twitter# community)# and# nearly# 50%# of# Jakarta s# population# owns# a# smart# internet#has#brought#us#s##reading#the#news#as#it#happens,#keeping#in#touch# growth,#it#also#offers#the#potential#for#threats#and#fraud#that#could#not#have# the#nature#of#cyber#security#means#we#can t#tackle#it#alonew#and#the#response# should#not#just#consist#of#state#involvement,##but#a#variety#of#interested#parts ners,#from#industry,#civil#society#as#well#as#internet#experts#coming#together# and# determines# how# we# will# tackle# these# threats# yet# ensure# a# balance# of# cyber#security#agenda#is#the#belief#that#cyberspace#should#remain#an#open# S S ers#and#representatives#of#the#internet#technical#community#and#civil#society# This#was#followed#by#the#Budapest#Cyber#Conference#in#2012,#and#we#are# together#on#cyber#security,#for#the#security#and#prosperity#of#the#citizens#of# 4 Meeting#the#cyber#security#challenge#in#Indonesia

About#the#project DAKA$advisory Meeting the cyber security challenge in Indonesia: An analysis of threatsandresponses# is# a# report# from# DAKA# advisory# written# by# Kim# S S The#aim#of#the#report#is#to#raise#awareness#of#cyber#security#and#the#potential# S the#report#does#not#use#a#consulting#framework#per#se,#a#swot#strengths,# weaknesses,# opportunities,# threats)# approach# was# used# in# deriving# the# To#uncover#cyber#security#threats#and#responses#in#Indonesia,#and#those#that# affect#it#from#a#global#perspective,#daka#advisory#conducted#extensive#desk# would#like#to#thank#the#following#people#and#organisations#for#their#contribus tions#listed#alphabetically#by#surname): # # # # # # # # # # # # # # # # Mohammad# Guntur,# Senior# Vice# President,# IT# Strategy,#Architecture# &# Planning#Group,#Bank#Mandiri,#Indonesia Bambang#Heru,#Director,#Directorate#of#Information#Security,#Indonesia Benjamin#Keller,#Vice#President,#Service#Operations,#XL,#Indonesia Indonesia for#the#digital#agenda Rudi#Lumanto,#Chairman,#Indonesia#Security#Incident#Response#Team# on#internet#infrastructure,#indonesia Security,#Standard#Chartered#Bank,#Singapore Directorate#of#Information#Security,#Indonesia Marco#Obiso,#Cybersecurity#Coordinator,#International#Telecommunication# Jaziar# Radianti,# PostSDoctoral# Researcher,# Centre# for# Integrated# Team,#Indonesia# of#indonesia,#indonesia Daniel# TS# Simanjuntak,# Deputy# Director# for# WMD# and# Conventional# Weapons,#Ministry#of#Foreign#Affairs,#Indonesia# Winston#Tommy#Watuliu,#Police#Colonel#and#Head#of#IT#&#Cyber#Crime# Section,#Indonesian#Police,#Indonesia Meeting$the$cyber$security$challenge$in$Indonesia 5

DAKA$advisory Governments,#businesses#and#civil#society#around#the#world#are#increasingly# seizing# the# opportunities# associated# with# information# and# communications# technologies#icts)#to#gain#a#competitive#position#or#improve#on#their#socios ICTs# are# an# integral# part# of# a# modern# society# and# several# international# such#as#sweden,#illustrate#the#potential#of#going#digital#by#embracing#icts# As# global# and# domestic# economies,# as# well# as# individual# businesses# and# civil# society# at# large,# increasingly# look# to# ICTs# to# improve# their# wellsbeing,# it# also# means# that# cyber# threats# can# affect# all# aspects# of# society,# including# development# marches# on,# and# those# that# cannot# adapt# their# strategies# to# encompass#cyber#security#are#increasingly#vulnerable#to#a#growing#number# from#the#educational#system#and#user#awareness#to#government#regulation# For# example,# its# recognition# of# using# ICTs# to# improve# future# growth# pross this# stimulated# a# rapid# uptake# of# mobile# devices# and# social# media# usage# among#the#population,#from#which#the#country#now#has#a#broader#base#to#furs at#the#national#level,#including#a#further#supply#of#services#and#the#demand# To#uncover#cyber#security#threats#and#responses#in#Indonesia,#and#those#that# affect#it#from#a#global#perspective,#this#report#is#based#on#a#combination#of# extensive#desk#research#and#interviews#with#a#mix#of#international#and#local# S To#better#understand#the#current#cyber#security#situation#in#Indonesia,#parts# 3#through#5#provide#an#overview#of#current#initiatives#and#key#stakeholders#in# the#country#before#evaluating#its#current#weaknesses#and#proposing#steps#in# order#to#meet#the#cyber#security#challenge#and#seize#the#full#socioseconomic# Opportunities:#There#is#a#strong#link#between#the#adoption#of#ICTs#and#soS 6 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory Threats:#Higher#cyber#dependency#naturally#leads#to#an#increase#in#risk#and# there# are# a# wide# variety# of# threats# to# governments,# businesses# and# civil# S larly#vulnerable#to#certain#types#of#cyber#threats,#primarily#nonspolitical#cyber# S Responses:# By# classifying# cyber# threats# as# either# politically# motivated# or# nonspolitical#in#nature,#it#appears#that#almost#all#crosssnational#agreements# S tally,# the# current# response# environment# within# Indonesia# also# emphasises# Waysforward:#As#Indonesia#continues#to#develop#rapidly#and#increase#its# cyber#dependency#in#the#process,#the#country#will#become#more#vulnerable# to#a#growing#number#of#sophisticated#threats,#some#of#which#may#be#politis Strengthsandweaknesses:#When#assessing#Indonesia s#current#environs ment# for# cyber# security# preparedness,# strengths# include# recognition# of# its# are#the#regulatory#framework,#capacity#building#in#terms#of#awareness,#and#a# lack#of#coordination#among#the#multiple#agencies#involved#in#cyber#security,# Recommendations: six#suggested#steps#towards#achieving#greater#cyber#security#in#indonesia: Make#cyber#security#a#priority,#at#home#and#abroad Assess#what#needs#to#be#done# Strengthen#the#regulatory#environment Coordinate#a#stronger#multiSstakeholder#approach What#gets#measured#gets#done:#develop#a#cyber#security#strategy Meeting$the$cyber$security$challenge$in$Indonesia 7

DAKA$advisory 1Introduction The#international#dimensions#of#cyber#security,#therefore,#cannot#be#ignored# with#an#assessment#of#global#trends#followed#by#an#evaluation#of#their#aps Theriseincyberdependence A#basic#framework#to#gauge#levels#of#cyber#dependence#across#the#world#or# in#individual#countries#includes#an#assessment#of#three#distinct#areas:#coms petitiveness#and#the#link#between#icts#and#socioseconomic#factorsw#supplys side#initiatives,#such#as#the#organisational#move#towards#ictw#and,#demands 1 CompetitivenessandtheriseoftheInternet Today,# ICTs# contribute# strongly# to# economic# growth# and# better# social# outs S mestic# economies,# therefore,# must# recognise# the# tie# between# competitives ness# and# the# Internet,# including# in# their# education# and# user# engagement# ICTs# are# at# the# core# of# our# economies# and# societies# and# we# need# to# be# S 2 # 1# #Adapted#from#Kim#Andreasson,#editor,#Cybersecurity:#Public#Sector#Threats#and#Responses:# 8 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory Opportunitiestrumpthreats: The# opportunities# associated# with# going# digital# are# vast# and# there# is# mounting# evidence# around# the# world# of# their# potential# economic# # # # According#to#the#McKinsey#Global#Institute,#a#consultancy#research# across#the#g8#countries#plus#south#korea,#sweden,#brazil,#china# S 3 Because#of#a#combination#of#cost#savings#and#productivity#gains,# 4 # In# Denmark,# the# government# estis S 5 Bank s#2009#report#on#information#and#communication#for#devels opment,#which#found#that#every#10%#increase#in#broadband#penes 6 Demand:Connectivityandtheriseinusage Whether#it#is#online#banking#or#electronic#delivery#of#public#mandates#eS government),# people# are# jumping# at# the# opportunity# to# receive# information# S stituent#demand#is#driven#by#underlying#factors,#such#as#a#decreasing#cost# of#access#and#the#increasing#availability#of#mobile#solutions#through#which#to# the#price#of#access#globally#compared#with#the#previous#year#with#particularly# 3# #McKinsey#Global#Institute,#Internet#matters:# 6# #World#Bank,#Information#and#Communications#for#Development#2009:# Meeting$the$cyber$security$challenge$in$Indonesia 9

DAKA$advisory Figure1:GrowthinInternetandmobileusageinIndonesiaandtheworld 100 Per 100 people 90 80 70 60 50 40 30 20 10 0 Global: Mobile-cellular telephone subscriptions Global: Individuals using the Internet Indonesia: Mobile-cellular telephone subscriptions Indonesia: Individuals using the Internet 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 Year Source:&&ITU&World&Telecommunication&/&ICT&Indicators&database. Supply:ThemovetowardsICTs To# meet# demand# and# improve# productivity,# businesses# and# governments# are#moving#their#processes#online,#hence#also#increasing#their#dependency# by# a# number# of# reports,# including# the# annual# Global# Information# TechnoloS 7 #In#2012,#Sweden#led# which# 142# economies# take# advantage# of# ICT# and# other# new# technologies# Survey,#which#in#2012#found#that# [p]rogress#in#online#service#delivery#cons S 8 TheviewfromIndonesia The#global#framework#can#also#be#used#to#illuminate#the#role#of#ICTs#in#IndoS nesia s#competitiveness#as#well#as#the#supplysside#and#demandsside#factors# S countries#around#the#world,#indonesia#is#currently#rated#as#average#in#both# 10 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory CountrydataforIndonesia Population:#About#248m Capital:#Jakarta,#with#about#9m#people GDP#growth:#About#6%#in#2012 Sources:&CIA&World&FactbookI&Indonesian&Internet&Service&Provider&AssociaK tioni&uni&wef IndonesianICTcompetitiveness Indonesia# recognised# ICTs# as# an# industry# of# the# future# in# the# Presidential# S ICT#should#continue#to#be#accelerated#in#order#to#improve#the#nation s#coms 9 IndonesiandemandforICT In#2012,#the#Internet#overtook#newspapers#to#become#the#second#largest# 10 #Although#the#number#of#Internet# users,#on#average,#remains#low#by#global#standards,#they#are#also#estimated# S ciation#apjii),#the#number#of#internet#users#in#2012#reached#63m,#or#about# 82m#users#or#30%#of#the#population#and#continue#to#grow#to#139m#and#50%# 11 surge#towards#a#digital#society: 12 #The#economy#which#is#forecast#to#grow#by# 10# #The#Jakarta#Post:# 11# #Indonesia#Internet#Service#Provider#Association:## 12# #Accenture,#Ready#for#Indonesia s#digital#future?:# S Meeting$the$cyber$security$challenge$in$Indonesia 11

DAKA$advisory IndonesiansupplyofICT S S vices#along#with#efforts#to#improve#user#access#to#them,#are#among#the#top# 13 # The# primary# interest# for# local# government# institutions# in# particular# is# in# improving# their# S The#local#push#for#online#content#is#illustrated#in#a#recent#report#that#found# several#examples#and#innovative#uses#of#social#media#in#the#supply#of#infors mation#by#local#stakeholders#throughout#indonesia,#including#blogging#nets S 14 13 14 12 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory 2 Dependency S fers#an#overview#of#cyber#threats,#both#globally#as#well#as#those#particularly# S S plex#task#and#despite#renewed#efforts#to#determine#the#costs#of#cyber#crime,# As#the#country#moves# towards# a# world# of# electronic# payments# and#escommerce,#cys ber#attacks#can#have# S SocioReconomicimplications Distributed#denial#of#service#DDoS)#attacks,#a#threat#designed#to#overwhelm# S dent#generated#pansasian#interest#as#many#came#to#see#the#potential#socios S rea#particularly#alerted#japan# #where#many#aspects#of#economic#activities# and#social#life#are#increasingly#dependent#upon#information#and#communicas tion#technology#ict)# #to#the#fact#that#a#threat#to#information#security#could# 15 # the#impact#of#cyber#threats#is#currently#unlikely#to#be#catastrophic,#argues#a# 16 # In#the#medium#to#longSterm,# cosauthors# of# the# report,# and# an# Associate# Director# in# the# Cyber# Security# 15 16# #Ian#Brown#and#Peter#Sommer,#Reducing#Systemic#Cybersecurity#Risk:# Meeting$the$cyber$security$challenge$in$Indonesia 13

DAKA$advisory S Scaleoftheproblem of#development,#and#the#type#and#size#of#the#organisation#involved,#among# S rity#company,#and#the#ponemon#institute,#a#consultancy,#indicate#that#about# 75%#of#organisations#suffer#from#some#sort#of#cyber#attack#or#breach#every# 17 #More#recently,#Symantec s#2012#state#of#information#survey,#which# surveyed#4,506#business#executives#across#38#countries,#found#that#69%#of# organisations#had#experienced#an#information#loss#in#the#past#year#and#had# 18 S S ple# take# a# broader# perspective# to# account# for# trends# such# as# the# ins creasingly#blurring#line#of#what#constitutes#crime#vs#crime#that#is#coms 19 Cybersecurity#is#the#collection#of#tools,#policies,#security#concepts,#seS curity# safeguards,# guidelines,# risk# management# approaches,# actions,# training,#best#practices,#assurance#and#technologies#that#can#be#used# Organisation#and#users#assets#include#connected#computing#devices,# personnel,# infrastructure,# applications,# services,# telecommunications# maintenance#of#the#security#properties#of#the#organisation#and#user s# general#security#objectives#comprise#the#following # Availability # Integrity,#which#may#include#authenticity#and#nonSrepudiation # S S portancew#it#also#accounts#for#both#hardware#and#software#across#the# 17 18# #Symantec,#2012#State#of#Information#Survey:# 19 14 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory Globalcyberthreats ICTs#have#given#rise#to#new#opportunities#but#digital#tools#have#simulS Following# is# an# overview# of# various# global# cyber# threats# across# two# broad# Politicallymotivatedthreats A# common# objective# for# politically# motivated# cyber# threats# is# generally# to# compromise#the#integrity#and#availability#of#information#for#political#purposes,# S out# using# a# botnet,# which# is# a# collection# of# computers# controlled# remotely# such#attacks#from#more#serious#ones,#cyber#warfare#often#indicates#a#cyber# S ample,#stuxnet,#a#malicious#software,#or#malware#as#it#is#commonly#known,# but# increasingly# likely# as# countries# invest# in# cyber# attack# capabilities# and# consider#disruption#through#cyber#means#as#a#potential#alternative#to#diplos S beled#corporate#espionage#and#considered#a#cyber#crime#see#next#section)# but# when# countries# or# individuals# are# targeted,# the# motivation# is# primarily# consultancy,#uncovered#a#malware#which#was#remotely#controlled#to#send#ins About#oneSthird#of#the#infected#computers#are#said#to#be#high#value#targets# S curity#company,#uncovered#an#espionage#program,#termed#operation#shady# RAT,#which#was#designed#to#steal#information#from#corporations#and#governS other#types#of#politically#motivated#threats#because#the#attackers#often#seek# done#by#desfacing#a#website,#meaning#it#is#given#a#new#appearance#by#the# perpetrators#such#as#providing#a#simple#message#taking#credit#for#the#attack,# commonly# cited# examples# of# this# type# of# attack# come# from#anonymous,# a# group#which#supports#free#speech#and#have#been#vocal#in#their#support#of# Meeting$the$cyber$security$challenge$in$Indonesia 15

DAKA$advisory down# websites# that# supported# censorship# of# WikiLeaks,# such# as# those# of# # As#organisations,#their#customers,#and#society#at#large,#went#online,#so#too# S are#other#nonspolitically#motivated#cyber#threats,#such#as#disruptive#bes havior#from#employees,#most#threats#within#this#category#would#fall#under#the# general# header# of# cyber# crime# and# an# important# distinction# from# politically# motivated#threats#is#that#nationsstates#are#unlikely#to#be#behind#them#and#the# of# computer# data# and# systemsw# computersrelated# offencesw# contentsrelated# offencesw# and,# offences# related# to# infringements# of# copyright# and# related# 20 # S S 21 # Although# regional# differences# are# small,# there# is# one# discernable# trend:# In# lesser#developed#countries,#law#enforcement#encounter#acts#against#the#cia# S ticular#for#countries#and#corporations#that#are#heavily#cyber#dependent#for# informed#its#77m#online#users#that#their#personal#information#and#credit#card# 20 21 16 Meeting#the#cyber#security#challenge#in#Indonesia

Table1:Asummaryofthreats Politically#motivated# Description threats Cyber#warfare#and# cyber#terrorism Cyber#espionage Hacktivism threats Cyber#crime,#such#as# corporate#espionage,#ins tellectual#property#theft,# identity#theft,#fraud DAKA$advisory Attacks#by#nationSstates# or#highly#sophisticated# groups#that#target#the# availability#and#integrity# of#data,#potentially#with# Theft#of#information#that# S tiality Defacing#websites#or# blocking#access#to#them# through#ddos#attacks#to# send#a#political#mess sage# Description motivated#crimes#based# on#data#that#is#often# stolen#through#malware# in#which#users#click#on# unknown#linksw#methods# also#include#hacking#for# information#or#collecting# it#on#commonly#used# platforms,#such#as#sos cial#media#websites## Anonymous Source:&Author&compilation&based&on&an&adaptation&from&Kim&Andreasson,&editor,& Cybersecurity:&Public&Sector&Threats&and&Responses. CyberthreatstoIndonesia of#the#country s#internet#usage#make#it#more#vulnerable#to#certain#types#of# The#country#is#currently#in#the#information#awareness#stage#and#has#yet#to# develop#offensive#or#defensive#military#cyber#capabilities#although#it#appears# S ber#warfare,#terrorism#or#espionage#activities#in#the#near#future#as#attackers# increasingly# cyber# dependent,# it# is# likely# these# threats# will# increase# in# the# Politically#motivated#attacks#currently#appear#limited#to#hacktivism,#including# most#recently#in#early#2013#when#prominent#government#websites#were#des Meeting$the$cyber$security$challenge$in$Indonesia 17

DAKA$advisory CybercrimeinIndonesia Indonesia#appears#more#susceptible#than#many#other#countries#to#cyber#crimes# such#as#fraud#and#contentsrelated#challenges,#which#is#indicative#of#the#level# Rahardjo,#who#also#teaches#at#the#Bandung#Institute#of#Technology#and#is#the# corporate#espionage#is#on#the#rise,#foreign#attacks#on#the#indonesian#private# sector#is#currently#of#limited#value#compared#to#more#developed#nations,#which# Instead,# Indonesia# today# is# primarily# a# target# for# less# sophisticated# cyber# crimes#in#which#the#attackers#prey#on#the#lack#of#awareness#among#people# S 22 #According#to#Rudi#Lumanto,#Chairman#of#the#Indonesia#Security# Incident# Response# Team# on# Internet# Infrastructure# IDSSIRTII),# data# show# S ability#in#indonesia#todayw#they#are#in#no#particular#order):# Malware percentage# of# PCs# that# experienced# a# malware# attack# in# the# world# over# a# 23 There# is# a# lack# of# S Because# of# this,# malware# is# a# particular# problem# in# Indonesia# along# with# vary#depending#on#the#type#of#organisation#or#person#targeted,#mr#rahardjo# agrees#that#malware#and#phishing#are#generally#the#biggest#concerns#in#ins Phishing Although# phishing# overlaps# somewhat# with# malware,# several# interviewees# S people#actually#tend#to#provide#their#personal#information#in#response#to#such# S pecially#it#security,#which#makes#them#vulnerable#to#cyber#crime#using#social# 22# #The#Jakarta#Post:## 23# #Sophos,#Security#Threat#Report#2013:# 18 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory these# novices# are# deceived# by# fake# website,# phishing# email,# smssphishing# Mobilethreats S S Perhaps# the# probs the#sheer#number#is# browses#the#internet#via#mobile#phones,#which#is#the#highest#mobile#internet# 24 S crime#report#say#the#rise#of#mobile#access#is#a#particular#problem#as#people# don t# use# a# security# solution# for# their# devicesw# in# fact,# almost# half#44%)# of# 25 # Socialmedia Due#to#the#popularity#of#social#media#platforms,#users#in#Indonesia#may#be# particularly# targeted# by# criminals# looking# to# collect# information# in# order# to# 26 # FaS cebook#is#very#popular#but#there#is#little#mentioning#of#the#kinds#of#security# as#she#compares#security#awareness#in#her#native#indonesia#to#her#adopted# cybercrime#report#shows#that#4#in#10#social#network#users#globally#have#been# Facebook# is# very# popular# but# there# is# little# mentioning# of# the#kinds#of#security# risks#that#come#with# it#and#people#are#not# Compounding#the#problem,#Mr#Lumanto#points#out#that#87%#of#Indonesia s# Hacktivism Cyber#crimes#dominate#current#concernsW#the#lone#exception#is#the#defaceS political#motifs#although#it#can#also#be#seen#as#a#crime#from#a#law#enforces S 24# #The#Jakarta#Post:# 25 S 26# #The#Jakarta#Post:# Meeting$the$cyber$security$challenge$in$Indonesia 19

DAKA$advisory 2013,#60%#of#attacks#on#government#domains#were#web#defacements#folS lowed#by#malware#attacks#at#36%),#according#to#a#government#csirt#govs 27 # Although# hacktivism# is# more# of# a# nuisance# than# a# threat# per# se,# it# still# causes# 28 #After#the#arrest#of#the# 29 The# cost# of# cyber# security# can# vary# des pending#on#the#size#of# the#organisation#and# the# risks# it# faces,# which#in#turn#depend# on#a#number#of#facs ThecostofcybercrimeintheworldandinIndonesia of#cyber#security#can#vary#depending#on#the#size#of#the#organisation#and#the# future#business#opportunities#due#to#cyber#crime#headlines#in#newspapers?# S nancial#loss#from#cyber#crime#and#their#inherent#limitations#before#applying# Questionslinger online#adults#aged#18s64#across#24#countries,#it#estimates#the#global#cost#of# 30 #It#also#notes#that#almost#half# 46%)#of#the#adult#online#population#surveyed#have#been#victims#to#some#sort# 31 #A# report# by# Detica,# a# S 32 recognised#as#the#best#available#estimate#as#of#this#writing,#although#it#des 33 27 28 29# #Jakarta#Globe:# S 30 S 31 32 33# #Ross#Anderson,#et#al,#Measuring#the#Cost#of#Cybercrime:# 20 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory AlackofnumbersinIndonesiatoo this#grey#area,#the#threat#and#vulnerability#report#from#idssirtii#states#that#in# 34 such#as#banks,#cyber#security#must#be#carried#out#at#any#cost#because#banks S total#budget#for#the#ministry#of#communication#and#information#technology#in# S tions#such#as#banks,# cyber# security# must# be#carried#out#at#any# cost# because# banks S EstimatingthecostofcybercrimeinIndonesia Despite#the#fact#that#they#are#often#criticised,#estimates#of#the#cost#of#cyber# S need#to#be#interpreted#with#great#care#as#they#can#vary#massively#depending# This#report#takes#a#similar#view#and#uses#the#same#methodologies#in#order#to# Thecost,usingtheNortonsurvey according#to#an#estimate#of#556m#victims,#which#means#the#average#global# 35 #Because#there#does#not#appear#to#be#any#reliS able#sources#for#the#average#cost#of#cyber#crime#per#victim#in#indonesia,#the# reports#in#2010,#approximately#86%#of#internet#users#in#indonesia#are#victims# 36 #Taking# of#internet#users#in#indonesia,#63m,#the#estimate#for#the#annual#cost#of#cyber# 34 35 S 36# #VIVAnews:# Meeting$the$cyber$security$challenge$in$Indonesia 21

DAKA$advisory S tial#cost#depending#on#the#rate#of#victimisation: Table2:VictimisationratesandestimatesofcybercrimecostinIndonesia Victimisation# 25% 50% 75% rate: S S Sources:&*Based&on&usage&estimates&from&APJII.&**Based&on&Norton&estimates. Thecost,usingtheAnderson,etal,model Anderson,#et#al,#do#not#add#up#the#total#cost#of#cyber#crimeW#instead,#it#uses# categories:#genuine#cyber#crimew#transitional#cyber#crimew#cyber#criminal#ins S particular#line#item,#costs#are#estimated#here#by#using#indonesia s#gdp#as#a# Table3:EstimatesofcybercrimecostintheworldandIndonesia Global Indonesia 1,20% Genuine#cybercrime: Transitional#cybercrime: Cybercriminal#infrastrucS ture: Traditional#crimes#beS coming#cyber: Sources:&*CIA&World&Factbook.&**Based&on&Anderson,&et&al,&model. As#elsewhere#in#the#world,#the#estimates#derived#here#come#with#a#number# of#assumptions#and#should#be#interpreted#with#great#cautionw#however,#if#they# are#anywhere#near#the#true#cost#of#cyber#crime#in#indonesia,#they#do#indicate# 22 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory 3 The#state#of cyber#security S tance# of# global# coordination,# cyber# security# remains# a# nationsstate# issue# illustrates#current#international#responses#as#well#as#the#state#of#cyber#secus Globalinitiatives criminal#and#nonspolitical#in#nature,#one#can#see#that#crosssnational#initiatives# norms#for#behavior#when#it#comes#to#political#attacks,#such#as#cyber#warfare,# S ternational#cooperation#in#regards#to#hacktivism#as#many#countries#share#the# view#that#they#are#also#criminal#acts#as#seen#during#crackdowns#on#wikileaks# UNresolutions S use#of#information#technology,#which#together#with#other#relevant#resolutions,# urges# member# states# to# consider# the# multislateral# dimensions# of# threats# in# ITUandUNODC S 37 #Of#particular#note#is#the#agency s#development#of#the#global#cybersecurity# Agenda#GCA),#a#framework#to#help#countries#take#national#measures#and#also# measuresw#technical#and#procedural#measuresw#organisational#structuresw#cas 37 Meeting$the$cyber$security$challenge$in$Indonesia 23

DAKA$advisory InternationalMultilateralPartnershipAgainstCyberThreatsIMPACT) the# Global# Response# Centre# GRC)# which# helps# realise# the# GCA# through# S 38 BudapestConvention 39 #As#of#SepS ComputerEmergencyResponseTeamCERT)andComputerSecurity IncidentResponseTeamCSIRT) S ForumforIncidentResponseandSecurityTeamsFIRST) Founded#in#1990,#FIRST#provides#a#platform#for#members#to#deal#more#efS fectively#with#security#incidents#by#offering#information#on#best#practices#and# 40 # The# organisation# consists# of# incident# response# teams# across# the# world# from# a# wide# variety# of# actors,# including# the# public# Regionalandnationalmeasures above),#as#well#as#the#arab#league#model#law,#commonwealth#model#law 41,# 42,#and# 43 # Plan# for#2010s2015# includes,#as#a#priority# area,#the#development# of#ict#to# enhance#socioseconomic#growth#while#providing#a#safe#digital#environment# 44 # 38 39 40 41# #Commonwealth#model#law:# 42 43 44 24 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory Individual# countries# have# taken# different# approaches# to# cyber# security,# als though#one#can#argue#that#development#generally#occurs#across#three#broad# and# socioseconomic# growth# and# made# that# explicit# as# part# of# the# country s# leads# to# a# second# effort# to# secure# the# civilian# cyberspace# to# sustain# those# cyber#attack#by#other#states,#terrorists#or#organised#crime#groups#as#one#of# 45 #Although#there#is#some#overlap,#the# third#category#consists#of#those#that#have#expressly#established#military#cas 46 # 45 46 Meeting$the$cyber$security$challenge$in$Indonesia 25

DAKA$advisory 4 The#Indonesian response to#the#three#broad#categories#of#nationalslevel#responses,#indonesia#has#recs ognised#the#tie#between#ict#and#socioseconomic#growth#but#it#has#yet#to#des velop#a#civilian#cyber#security#strategy#or#a#military#doctrine,#although#initial# Legislativeinitiatives S S vides#the#basis#for#law#enforcement#in#regards#to#cyber#crimew#however,#it#is# limited#in#scope#and#other#acts#are#often#used#to#supplement#it#in#order#to# S Keystakeholders sector#entities#to#the#private#sector#and#civil#society,#this#section#introduces# the#local#context#as#each#institution#or#group#of#institutions#are#encouraged# 47 #Based#on#such#recommendation,#acaS demic#institutions#have#formed#an#academic#csirt,#and#other#groups#are#in# S the#lead#organisation#regarding#civil#cyber#security#while#threats#that#concern# 47 S 26 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory MinistryofCommunicationandInformationTechnologyKOMINFO) DG)#of#Post#and#Information#Technology#Implementation,#DG#of#Information# and#public#communication,#human#resources#research#and#development# Agency,#DG#of#Post#and#Information#Technology s#resources#and#tools,#and# the#dg#of#information#technology s#application,#the#latter#of#which#is#particus larly#relevant#to#cyber#security#as#it#is#home#to#the#directorate#of#information# implies,#deals#with#such#issues#as#how#to#implement#secure#information#secus S We# are# now# starts ing# the# socialisation# of# information# secus There#is#a#direct#line#between#Mr#Heru#and#IDSSIRTII,#which#has#two#distinct# 48 #First,#it#monitors#and#provides#an#early#warning#system#of#threats# According#to#Mr#Lumanto,#its#Chairman,#it#is#currently#supporting#the#Ministry# was# initially# less# than# 10bn# Rupiah# when# it# was# established# in# 2007W# hows ever,#in#the#last#three#years#the#annual#budget#has#averaged#around#19bn# CERTs/CSIRTs Based#on#overall#strategy,#IDSSIRTII#is#helping#institutions#or#group#of#instituS web# servers# as# well# as# to# provide# awareness# to# the# students# about# cyber# The# objective# of# the# GovSCSIRT# is# similarly# to# work# with# a# range# of# stakes holders#to#improve#information#security#for#its#government#members#by#pros 49 # Organisationally,# it# falls# under# the# Directorate# of# Information# Security# and# logistically#it#consists#of#a#general#manager#with#teams#for#monitoring,#evaluation# 48 49 Meeting$the$cyber$security$challenge$in$Indonesia 27

DAKA$advisory is# currently# composed# of# 161# central# government# agencies,# 33# provincial# 50 S 51 # IDSSIRTII# is# also# a# Full# Member# of# the# Organisation# of# the# Islamic# ConferS S 52 # Since# we# [IndoneS sia]#have#other#agens cies# handling# the# technical#aspects,#we# to#support#them#from# a# policy# perspective# and#make#cyber#more# MinistryofForeignAffairs Since#we#[Indonesia]#have#other#agencies#handling#the#technical#aspects,# so,#the#ministry#of#foreign#affairs#work#with#domestic#institutions#to#outline# The#second#broad#category#of#work,#given#its#obvious#remit,#entails#the#globS international#dialogue#and#identify#the#relevant#platforms#in#which#to#address# S rums#to#see#how#indonesia#can#play#an#active#part#in#developing#a#compres MinistryofDefence As# elsewhere# in# the# world,# cyber# security# in# Indonesia# is# both# a# national# civilian# concern# and# a# topic# of# interest# to# the# national# security# community,# necessities,# there# is# in# effect# a# global# cyber# arms# race# at# the# moment# and# # S rie#sjamsoeddin,#announced#that#the#country#will#establish#a#cyber#defence# unit,# which# will# be# dedicated# to# securing# military# systems# and# national# IT# 53 #The# cyber# defence# operations# centre# CDOC)# is# meant# to# work#closely#with#an#already#established#cyber#defence#task#force#operated# IndonesianPolice A# 2010# presentation# entitled# Current# state# of# cybersecurity# readiness# and# S 54 50 S 51 52 53 54# #Presentation#by#Ratno#Kuncoro#at#the#Cybercrime#Capacity#Building#Conference#in#the#State#of# S 28 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory As#the#Head#of#IT#&#Cyber#Crime#Section,#Police#Colonel#Winston#Tommy# Watuliu# probably# knows# better# than# anyone# what# needs# to# be# done# to# ims We#still#need#to#upS Further,# although# Mr# Watuliu# calls# his# department s# relationship# with# prosecutors,# and# private# sector# organisations,# such# as# ISPs# and# telecoms S tion#regarding#skills#development#and#establish#a#common#understanding#of# of# Foreign#Affairs,# agrees# that# Indonesia# should# develop# capacity# building# programmes#for#prosecutors#and#judges#regarding#the#criminal#proceeding# Theprivatesector S tors,#which#has#long#resulted#in#the#establishment#of#various#forms#of#publics because# there# is# a# gap# in# security# understanding# between# the# public# and# Despite#some#issues,#however,#all#participants#agree#on#one#thing:#the#imS S nesian#government#realises#that#many#critical#infrastructures#are#owned#and# operated#by#the#private#sector#while#local#companies#recognise#the#need#for# great# advantages,# although# he# says# the# least# successful# strategy# towards# cyber#security#is#one#that#relies#on#people#because#then#it#depends#on#their# such# as# security# tokens,# bestsofsbreed# IT# infrastructure,# systems# and# aps Academiaandcivilsociety awareness,# and# as# the# public# and# private# sectors# face# limitations,# others# S 55 # 55 Academia# and# civil# society# can# contribs ute#to#cyber#security# by# increasing# secus rity# awareness# and# building# a# security# Meeting$the$cyber$security$challenge$in$Indonesia 29

DAKA$advisory S demic,#public#and#private#sector#members,#it#also#represents#a#broad#coms munity# that# undertakes# research# and# promotes# security# awareness# to# the# Another#successful#civil#society#initiative#is#the#Indonesian#ICT#Partnership# S 56 PPPsandregulationvsselfRgovernance: Aglobaldebate PPPs# haven t# worked# because# they# [the# private# sector]# don t# selfs although#he#admits#that#governments#should#work#with#the#private#secs S lustrate#the#limits#of#ppps:# Without#improvements#in#meeting#private# and# public# stakeholder# expectations,# the# partnership# will# remain# less# than#optimal,#and#there#is#a#risk#that#owners#and#operators#of#critical#ins frastructure#will#not#have#the#appropriate#information#and#mechanisms# to#thwart#sophisticated#cyber#attacks#that#could#have#catastrophic#efs 57 S S rity#strategy#establishes#a#new#type#of#public#private#platform#through# which#industry#can#voice#its#concerns,#which#will#allow#the#public#sector# But#international#companies#also#encounter#yet#another#problem,#which# is#in#keeping#up#with#multiple#regulatory#regimes#across#countries#and# 56 57 30 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory 5 The#future#of cyber#security#in#indonesia S puting# and# mobility,# government# and# businesses# around# the# world# are# ins of#mobility,#and#hence#also#a#disproportionate#number#of#current#threats#in# Opportunitiesandthreats High# socioseconomic# growth# means# that# the# threats# will# change# and# new# Based#on#the#experience#in#more#developed#countries,#it#is#likely#that#this#will# lead#to#an#increase#in#sophisticated#threats,#including#politically#motivated#ats tacks#and#various#forms#of#political#and#corporate#espionage#stemming#from# Advanced#Persistent#Threats#APTs),#which#is#a#highly#advanced#form#of#atS If# we# dont# improve#our# capabilities)# we# could# face# a# possible# public# and# 58 # As#a#result,#Indonesia#must#do#more#to#promote#integration#of#cyber#security,# effort#begin#by#identifying#the#country s#current#strengths#and#weaknesses#in# 58# #Reuters:# Meeting$the$cyber$security$challenge$in$Indonesia 31

DAKA$advisory Recentcybersecurityinitiatives The#past#12#months#has#seen#a#number#of#new#cyber#security#initiaS Application#of#Technology#BPPT),#calls#for#a#comprehensive#and#incluS 59 October#2012:#Ministry#of#Communication#and#Information#Technology# 60 # 61 62 S 63 January#2013:#Bandung#Institute#of#Technology#in#cooperation#with#KoS 64 Strengthsandweaknesses One# recent# scholarly# article,# which# assesses# Indonesia s# strengths# and# 65 #It s#a# good#approach#through#which#to#identify#weaknesses#and#develop#a#roads S not# deemed# to# be# a# problem,# a# point# with# which# Mr# Lumanto# agrees:# We# are# also# enhancing# our# international# cooperation# with# many# organisations,# security#experts#and#forum#in#order#to#improve#our#understanding#of#global# 59 2012:# 60 61 62 63 64# #Institut#Teknologi#Bandung:# 65 32 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory Indonesia# is# particularly# weak# in# legislative# measures,# says# Mr# Sucahyo,# S S knowledged# it# is# vulnerable# to# cyber# threats# in# part# because# of# weak# 66 # Mr# Sucahyo# also# says# organisational# structure# is# a# particular# about# a# particular# weakness,# because# the# weakest# link# is# people# and# we# biggest#challenge#and#calls#on#the#government#to#better#prepare#society#for# Fundamentally,#says#Mr#Brown,#effective#cyber#security#is#about#regulation,# priority,# especially# in# developing# countries# that# are# not# as# reliant# on# online# Aninternalassessment To# raise# security# awareness# and# to# track# progress,# Indonesia# has# its# own# framework# for# assessing# domestic# information# security# across# government# begins# with# a# selfsassessment,# followed# by# an# evaluation# of# the# answers# S S curity:#governancew#risk#managementw#frameworkw#asset#managementw#and,# But# the# topic# is# still# realtively# new# and# not# a# priority,# espes cially# in# developing# countries# that# are# not#as#reliant#on#ons scores#were#in#the#technology#and#asset#management#areas#while#the#lows est#scores,#and#hence#the#greatest#weaknesses,#were#in#risk#management# Recommendations S donesian#executives#and#policysmakers#should#consider#the#lessons#learned# elsewhere# and# develop# appropriate# measures# to# meet# the# cyber# security# S 1:Makecybersecurityapriority,athomeandabroad S 66# #The#Jakarta#Post:# Meeting$the$cyber$security$challenge$in$Indonesia 33

DAKA$advisory Mr#Simanjuntak#is#looking#for#a#platform#in#which#to#work#with#the#global#comS munity:# For#cyber#crime,#there#is#a#good#international#frameworkW#we#are#not# matter,#so#when#we#think#about#addressing#the#preparation#gap#it s#no#use# 2:Assesswhatneedstobedone Once#cyber#security#has#been#made#a#top#policy#priority,#the#process#of#deS S standing#of#the#threat,#and#the#potential#business#impact#or#what#the#impact# S 67 #In#addition,#suggests#Mr#Lumanto,#the# government#should#ask#such#industries#to#develop#certain#security#standards# 3:Strengthentheregulatoryenvironment After# identifying# key# objectives,# regulatory# measures# should# be# taken# to# glaring# weakness# in# meeting# the# cyber# security# challenge# by# interviewees# It#is#also#important#to#note#that#a#stronger#regulatory#environment#does#not# necessarily#mean#an#end#to#selfsregulation#or#additional#burden#to#individual# S global#viewpoint,#mr#mui#says#deterrence#is#also#an#essential#step#in#protects S 4:Enhanceawarenessandimproveskills S S sia,#knowledge#is#low#despite#attempts#to#raise#it#and#many#people,#like#mr# Watuliu,#are#calling#for#an#improvement#in#both#public#awareness#and#public# needed#to#improve#awareness,#particularly#as#governments#often#struggle#to# 67 damsw#defence#industrial#basew#emergency#servicesw#energyw#government#facilitiesw#healthcare#and#public# healthw#information#technologyw#national#monuments#and#iconsw#nuclear#reactors,#materials#and#wastew# postal#and#shippingw#transportation#systemsw#and#water:## 34 Meeting#the#cyber#security#challenge#in#Indonesia

DAKA$advisory S tur#and#mr#watuliu,#representing#the#private#and#public#sectors,#both#agree# that#there#is#a#lack#of#cyber#security#skills#when#it#comes#to#digital#forensics# Bandung#should#help,#as#does#the#efforts#by#Mr#Heru#who#aims#to#train#and# certify# 200# people# this# year,# despite# a# cost# of# about# 20m# Rupiah# or# about# remain#limited#and#better#coordination#and#more#resources#appear#needed# 5:CoordinateastrongermultiRstakeholderapproach Although#PPPs#may#not#work#optimally,#the#private#sector#and#civil#society# with# the# education# system# and# that# there# are# important# roles# for# both# appears#to#have#done#about#as#well#or#as#poorly,#depending#on#your#view)# S S S 6:Whatgetsmeasuredgetsdone:developacybersecuritystrategy priority,#indonesia#needs#to#develop#a#strategy#that#recognises#the#sociosecos be#comprehensive#and#set#clear#targets#and#objectives#from#which#progress# Meeting$the$cyber$security$challenge$in$Indonesia 35

AboutDAKAadvisory We#provide#strategic#advisory#and#research#services#and#work#with#a#broad#range#of#clients#from#the# focuses#on#cyber#security,#esgovernment,#measurement#of#the#information#society#and#related#topics# For#more#information,#please#contact#Kim#Andreasson,#Managing#Director,#at: Visit#us#at: Disclaimer advisory,#nor#the#sponsor,#can#accept#any#responsibility#or#liability#for#the#data,#information#or#states #DAKA#advisory#AB#2013

WHITE PAPER: POLICIES ON IMPORTED MOBILE PHONES IN INDONESIA Background Information The proposal to impose a luxury tax on all mobile phones in Indonesia dates back to 2008 when the Ministry of Finance proposed a plan to impose the tax on all electronic goods. In 2012, the Ministry of Finance s Fiscal Policy Office BKF) revisited the proposal as a measure to increase state revenues. In early 2014, both the Minister of Industry MS Hidayat and Minister of Trade Muhammad Lutfi raised the topic, and pressured the Ministry of Finance to finalize the plan. Hidayat argued that imposing a luxury tax on imported mobile phones would serve as an incentive to spur growth in manufacturing. Lutfi, tasked with controlling the trade balance, supported the proposal by arguing that mobile phone consumption in Indonesia has reached an unhealthy level and its import has become one of the major contributors to Indonesia s trade deficit. Therefore, the tax would slow imports and help to address the trade balance. However, the decision on whether the regulation will be issued falls on the Ministry of Finance. Through various interactions with external stakeholders, including government and industry associations, the Ministry of Finance is currently considering imposing the tax for mobile phones valued beyond a particular price threshold. Recently, the Ministry of Finance stated that it is conducting a study to determine that threshold. I. Indonesia s Trade Balance Indonesia faces a fluctuating trade balance, with month-to-month data showing a surge in the deficit followed by a sporadic trade surplus. Addressing the trade balance has become one of President Susilo Bambang Yudhoyono s priorities towards the end of his presidency. The government has since implemented a number of policies to fix the trade balance, yet the fluctuation still can be seen today. According to Indonesia s Bureau of Statistics BPS), a growing oil and gas import bill is the biggest chunk of Indonesia s trade imbalance. Furthermore, in the nonoil and gas import category, mobile phones are not included in the country s ten biggest imports in value. That category is dominated by manufacturing machinery and raw materials for the manufacturing industry. According to the latest BPS data for Fiscal Year 2013, the oil and gas import bill was valued at $45.27 billion, a 6.3 percent increase from the previous year, while non-oil and gas imports dropped by 5.2 percent. The biggest import in the non-oil and gas category is heavy machinery, which was valued at $27.3 billion. In the same year, mobile phone imports were valued at $1.8 billion.

Indonesia s 10 Biggest Non-Oil and Gas Imports in Value 1 Type of Goods 2013 Import Value in USD Billion) % of Total Non-Oil and Gas Import Machinery and Mechanical 27.3 19.3 Equipment Machinery and Electrical 18.2 12.9 Equipment Steel Raw Material) 9.5 6.8 Vehicles and Spare Parts 7.9 5.6 Plastic Goods 7.6 5.4 Chemical Material 7 4.9 Steel Finished Goods) 4.7 3.4 Grains incl. Rice, Wheat and 3.6 2.6 Corn) Food and Beverages 3 2.1 Cotton 2.5 1.8 II. Indonesia s Manufacturing Sector The government has also emphasized boosting exports as a solution to the fluctuating trade balance. However, a strong manufacturing base is required in order to support manufacturing-based exports. Indonesia hopes to become an exporting hub for the region, hence the government s push for investors to build manufacturing facilities in the country. In order to realize this goal, improvements and reforms to the supporting ecosystem including infrastructure, labor productivity, regulatory certainty, education and R&D are critical to strengthen the competitiveness of the manufacturing sector. Indonesia has acknowledged that innovation is an important aspect in establishing a manufacturing industry and the government is progressing in its R&D investment by doubling the R&D investment in five-year period from 2007 to 2012. In line with improving Indonesia s innovation through R&D, the government has also established National Innovation Committee KIN) that reports directly to the president. These initiatives have led to Unilever, RIM and Nissan to build R&D hubs in Indonesia. The government has also made progress in education and has improved enrollment rates, literacy rates and average years of schooling in hopes that such improvement will lead to more skilled labor in the country to supply the manufacturing industry. However, the government needs to maintain the positive trends while also reforming more supporting factors to be able to establish a strong manufacturing industry. The World Bank has published several reports stating that Indonesia s infrastructure spending is insufficient and should be doubled to cater to the growing nation, especially the middle class. The total investment in infrastructure is currently less than 4 percent of GDP half of what the nation needs. Beside the lack of infrastructure, investors are also faced with low labor 1 Indonesia Bureau of Statistics 2014), Indonesia s Export and Import Data 2013.

productivity. According to the World Economic Forum s 2014 Global Competitiveness Index, Indonesia is ranked 103 out of 148 countries on labor productivity. The same report ranked Indonesia on the low-end on the education index. The American Chamber of Commerce Indonesia AmCham Indonesia) has also conducted a survey that shows the biggest challenge for investors in Indonesia is regulatory uncertainty that makes it difficult for long-term and highvalue investment decisions, such as manufacturing. Investors in the manufacturing sector also face a high cost of importing raw materials as Indonesia still imposes high tariffs for them. Indonesia ICT Society Mastel) reported that the IT-specific manufacturing sector faces an additional cost of 7.5 to 15 percent to import raw materials. A more balanced taxation policy designed to support the manufacturing sector would make Indonesia a more attractive investment destination and encouraging investors to locate manufacturing facilities in the country. III. Access to Technology and Beyond Indonesia s e-commerce sector has enjoyed unprecedented growth. The Association of Indonesia s Internet Service Providers APJII) predicts that Indonesia s e-commerce market will be valued at $25 billion in 2016 from the current $12 billion. The contributing factor to this impressive growth is the consumer s access to technology, which leads to a more global market, knowledge and people. The growth of Indonesia s e-commerce has benefited many due to its multiplier effect, including financial services online payment system), logistics sector product delivery system), Internet service providers access to e-commerce market) and developers. Indonesia s small and medium businesses have also benefited from the growing e-commerce sector, empowering these entrepreneurs with access to an otherwise unreachable market. In Indonesia, mobile phones have become the single most important tool to provide access to technology. APJII s report shows that Indonesia has 83.6 million Internet users; and nearly two thirds of them access the Internet through mobile devices. However, only 8 percent of mobile phone users access the e- commerce market on their mobile, indicating a massive untapped growth potential. A Presidential Regulation on the country s broadband plan has recently been signed. Imposing a new tax on cellphones would raise the cost of mobile ownership, undermining the goal of increasing broadband penetration and developing online public services e-health, e-education and so on). IV. Indonesia s Growing Black Market Mobile phones are now an integral part of Indonesians daily life. The demand for mobile phones has grown around 20-25 percent annually in recent years. 2 2 IDC 2014), IDC: Smartphone Market Share 2014.

Indonesia has strong consumer spending, but those consumers expect a stable price. Dramatic price fluctuations can eventually lead to a growing demand in the grey market, where consumers will find illegally imported goods at a fraction of the price. Retailers often pass the increased tax cost to the consumer while the same consumer in Indonesia can easily access grey and black market mobile phones. Indonesia Mobile Phone Association APSI) has reported that 40 percent of all mobile phones in Indonesia are purchased in the black or grey market while Indonesia Consumers Agency stated that black and grey market products dominate 70 percent of the market share. The proposed tax on cellphones would significantly increase the gap between the price of legal products and illegal ones, encouraging illegal imports. V. International Best Practices A GSMA and Deloitte study 3 in 2012 analyzed how Brazil was able to increase its long-term state revenue by reducing the tax burden on mobile broadband services. Brazil s mobile broadband services sector was one of the most heavily taxed, increasing the cost of use of mobile broadband services by 40 percent and the average price of mobile handset by 57 percent. The study demonstrated how a one percentage point reduction in the tax burden could lead to expanded penetration of mobile broadband services and a beneficial impact on economic activity. Over five years, the one percent reduction in tax could lead to up to one million more subscribers, which represent a two to four percent increase in the overall tax base. Another GSMA study 4 also analyzed how Uruguay in 2007 abolished an airtime tax that accounted for 30-50 percent of calling costs. After being abolished, the country s mobile phone service penetration doubled from 65 percent in 2006 to 141 percent in 2011. VI. Conclusion and Recommendations Increased access to technology encourages growth in the broader economy. It empowers entrepreneurs and small business, connecting them rapidly to a global market. Benefits include enhanced information flows and improved access to banking and other financial services. The government s proposal to impose a luxury tax on mobile phones would have an insignificant impact towards the government s fiscal pressure, unstable trade balance and the slow growth of the IT manufacturing sector. If anything, it would encourage consumers to find alternative markets for mobile phones, increasing the threat of a growing grey and black market in Indonesia. Representatives from the government, industry and consumers, should hold a joint discussion to produce better alternative policies and initiatives that would achieve the government s target while at the same time benefit the industry and most importantly, the public as a whole. One possible avenue to consider is to conduct a study of how access to technology could affect the overall Indonesian economy. The study could also be used as a platform to find win-win solutions to 3 GSMA and Delloitte 2012), Brazil Mobile Observatory 2012,, http://www.gsma.com/spectrum/wp-content/uploads/2012/10/gsma_brazil_obs_web_09_12-1.pdf 4 GSMA 2012), Mobile Telephony and Taxation in Latin America.

boost Indonesia s access to technology while helping the nation in fixing the trade balance and increase investment in the manufacturing sector. Such a study could also be used as a basis and reference for any other future luxury tax policies in Indonesia.

KEMENKO PEREKONOMIAN REPUBLIK INDONESIA Indonesia ICT Consultative Forum IICF) Coordinating Ministry for Economic Affairs US-ASEAN Business Council

Project Description The Indonesia ICT Consultative Forum or IICF is an initiative of the Coordinating Ministry of Economic Affairs & US-ASEAN Business Council s ICT Committee that organizes and promotes the exchange of views between ICT industry representatives and appropriate government officials who are involved in developing ICT policy within Indonesia.

Objective The IICF aims to create a collaborative platform between government and industry to support Indonesia s long-term industrial policy of building a local ICT industry and shared goal of creating an innovation and knowledge-based economy in Indonesia.

Mandate for the Forum To establish a joint consultative body Indonesia ICT Consultative Forum ) on Indonesia s ICT ecosystem comprising Government of Indonesia officials and representatives of the international and domestic ICT private sector. This Forum will serve to improve mutual understanding in the areas of innovation, investment and regulation and will assist in the development of future ICT policy in Indonesia.

Implementation Arrangement The IICF is developing a work program according to priorities identified by industry and the government. The 2014 IICF Work Plan identifies three work streams that will guide efforts to address these priorities. The work streams are as follows: Regulatory Insights Incentivizing Localization Emerging Digital Trends Examining local and global regulations and best practices that advance sustainable, longterm growth in the ICT sector Identifying opportunities to grow the local ICT industry Updates on global industry trends and relevance to the ICT ecosystem in Indonesia.

Ministers GOI Senior Official Committee USABC Proposed Structure of the Forum Co-Chair CMEA Executive Committee Co-Chair USABC ICT The IICF will consist of a Ministerial Committee and an Executive Committee Regulatory Insights Incentivizing Localization Emerging Digital Trends Activities

About the Structure The IICF will consist of a Senior Official Committee and an Executive Committee. The Senior Official Committee provides an opportunity to report findings of the Executive Committee and propose recommendations to senior level officials. The Executive Committee will comprise of government officials at the DG and Director level, private sector representatives and ICT associations. The committee will meet quarterly or on an as needed basis. The committee will identify possible new initiatives to support and address policies and regulatory issues that may arise in the development of Indonesia s ICT ecosystem and the growth of the local ICT industry. The Executive Committee will prepare recommendations to be presented to Ministers or other senior government officials for their consideration. The Executive Committee will be Co-Chaired by a representative from the Coordinating Ministry for Economic Affairs CMEA) and a representative of the US-ASEAN Business Council s USABC) ICT Committee. The committee will define the agenda for the IICF and its annual work plan, determine the schedule of meetings and facilitate the IICF. The Executive Committee may create smaller focus groups, which may include officials from other government ministries and agencies, experts from academia and think tanks, and prominent ICT leaders, to review a particular policy or area in more detail and propose regulatory approaches that will assist development of the ICT sector.

Executive Committee Forums will serve to provide fora for discussing policies and regulatory issues that arise in the development of Indonesia s ICT ecosystem, knowledge-based economy and the growth of the local ICT industry. Senior Official Committee Dialogue with senior level officials and business leaders to be determined mid-year or end year, followed by reporting at Ministerial level. Key elements for 2014 events/ activities include: Committees & Key Elements of Activities Frequency Quarterly, including a Ministerial level event Format Half-day dialogue Content Focus on a key topic that is supported by work streams Participation Government officials at the DG and Director level, private sector representatives and ICT associations Outcomes Deliverables developed by the three work streams

Proposed Schedule and Milestones in 2014 1 st Week of March: Small Team Meeting CMEA & USABC ICT Committee Late March: Inter ministerial coordination and team formation Milestone 1 Mid/late April executive committee dialog & workshop) Milestone 2 June executive committee) Milestone 3 September executive committee) Milestone 4 November 16/ December 8 ministerial committee Indonesia Business Mission)

PROPOSED ACTIVITIES IN 2014 HOW ICT HELPS INCREASE INVESTMENT IN INDONESIA Date APRIL 2014 JUNE 2014 SEPTEMBER 2014 NOVEMBER 2014 Event Dialogue Launch and Panel Discussion Workshop Workshop Presentation and Dialogue Session Type Executive Committee) Executive Committee) Executive Committee) Senior Official Level) Topic Note: all topics tentative) Data Storage in a Changing World How the choice of data storage affects trade, investment and growth in a country Existing international standards on cloud computing Cybersecurity and Data Privacy Cloud Computing Approaches by Sector Healthcare Financial services Other industries ICT & Education National Digital Literacy and ICT human development Addressing the gap in IT human capital building in the national curriculum Creative Industries - developing entrepreneurs and job creation Presentations of findings and the recommendations from Executive Committee events/activities Outcomes Report findings Report findings Report findings Direction for next steps and 2015 Forum IICF) plan

KEMENKO PEREKONOMIAN REPUBLIK INDONESIA THANK YOU

Cloud Computing and its Impact in Our Live Tony Seno Hartono National Technology Officer Microsoft

Cloud Computing Framework by NIST Hybrid Clouds Deployment Models Private Cloud Community Cloud Public Cloud Service Models Software as a Service SaaS) Platform as a Service PaaS) Infrastructure as a Service IaaS) Essential Characteristics Broad Network Access Resource Pooling On Demand Self-Service Rapid Elasticity Measured Service Common Characteristics Massive Scale Homogeneity Virtualization Low Cost Software Resilient Computing Geographic Distribution Service Orientation Advanced Security Based upon original chart created by Alex Dowbor - http://ornot.wordpress.com

Cloud Computing Provides Choices Dalam Premis Lokasi Luar Premis Heterogen Infrastruktur Homogen CapEx Model Bisnis OpEx Sendiri Kepemilikan Sewa Sendiri Manajemen Pihak Ketiga Fundamental Skalabilitas Pemrograman Aplikasi Otomasi Manajemen Layanan Ketersediaan Layanan Multi Sewa Fundamental

Cloud Risk Decision Framework based on ISO 31000 Download Online here 4

Hybrid Cloud Sistem off premise/public Cloud - Portal Publik - Email - Komunikasi Sistem on premise/private Cloud - Data rahasia - Aplikasi finansial dsb 5

Indonesia Digital Landscape

Indonesia 2013) 17,508 islands, 33 provinces, 167 active volcanoes Area 1,9M Km Square 3 time zone Population GDP GDP Growth GDP/ Capita Urban Population Median Age Teachers Students Global Finance

Digital Landscape Overview Demographics by Gender Source: emarketer, Indonesia Online, March 2013 Demographics by Age Demographics by Education Source: APJII, Profil Internet Indonesia, December 2012 8

Digital Landscape Device Used Location by Device Type Reasons to go Online Internet Spending per Month Source: APJII, Profil Internet Indonesia, December 2012 9

Twitter & Facebook http://semiocast.com/en/publications/2012_07_30_twitter_reaches_half_a_billion_accounts_140m_in_the_us http://en.wikipedia.org/wiki/facebook_statistics

Total Indonesia Population Data BPS 2010 http://sp2010.bps.go.id/index.php/site/tabel?tid

Politics Jumlah pemilih di tahun 2014 Jumlah pemilih muda di 2014 17-30) Jumlah pengguna internet di Indonesia 2012 Dengan jumlah pemakai umur 17-30) 2012 153 juta jiwa 33 juta jiwa 55 juta jiwa 37 juta user KPU.GO.ID

Politics Boosting Transparency, Credibility and popularity among the masses Direct Personal Connection with Voters Cheap & Measurable ROI

Education : ICT Impact Survey UGM, 2013 Students of SMA, SMK & MA at Yogyakarta were surveyed on 2013 ICT Support program for the underprivileged group is feasible Shared investment Government provide infrastructure, Household provide CPE) provides best ROI for Government and Households Internet access provides better future lifetime salary for the students Delay providing internet at home has negative impact to the future lifetime salary

TV Band White Spaces interest is accelerating

TVWS Trial in Yogyakarta Plan) 28 Km 17 42 Km

Healthcare Share responsibility between Citizen and Government Use Technology to educate, change behavior, enable Citizen Hospital as the last resort

Government

Komunik asi& Kolabora si Pendukung Program Unggulan Akunting/ Pariw Educ POS utk isata ation UKM Modernisasi Perkantoran Tata Naskah Digital Citizen Dinas Media Service Elektronik Analytic 360⁰ Execu tive Dashb oard Koordinasi Pengawasan Pembinaan ISB Source: bkp.go.id

Execute Dashboard for Government

Increase Productivity Case Management Growth Projections Use a stylus to annotate, highlight text or as laser pointer while presenting

Citizen Complaint Handling Name : Tugimin KTP : 27094357823049587234 Alamat : Jl Berliku no 123, Klaten KUR Bank Sisa 4123412341 BRI Rp 12,345,678.90 Tgl Pupuk Qty kg) 1 Mar 2014 ZA 50 16 Aug 2014 NPK 75 Tgl SPBU Qty l) 23 Jun 2014 Kolong jembatan 15 16 Sep 2014 Pinggir kali 10 Citizen Relationship Management CRM) Information Service Bus Complaint handling Tidak rahasia Jalan Sekolah Lain-lain Rahasia Corruption whistleblowing Multi-channel Call centre SMS Internet E-mail/surat Dinas Pertanian, Perkebunan, Peternakan Bank pelaksana Kredit Usaha Rakyat Kartu cerda s PT Pupuk Indonesia Distributor pupuk e-ktp Kartu cerda s Pertamina Cab Jateng SPBU Kartu ASKE S ASKES Cab Jateng Rumah Sakit Dinas Pendidikan Sekola h Murid bebas biaya sekolah

Penerapan Manajemen Risiko Dalam Penggunaan Teknologi Informasi oleh Bank Umum

Agenda Pengenalan E-Banking Jenis-Jenis E-Banking Risiko-Risiko E-Banking Ketentuan di Bidang TI Pengaturan BI Mengenai Manajemen Risiko TI : PBI No. 9/15/PBI/2007 2

Pengenalan Electronic Banking E-Banking) 1) Apa Itu E-Banking Layanan yang memungkinkan nasabah Bank untuk memperoleh informasi, melakukan komunikasi dan melakukan transaksi perbankan melalui media Elektronika, contohnya : ATM, Phone Banking, Electronic Fund Transfer, Internet Banking, Mobile Phone, dll. Sumber : PBI No.9/15/PBI/2007 3

Pengenalan E-Banking Mengapa E-Banking Keuntungan Bagi Bank : Memperpendek antrian pada bank sehingga pelayanan yang diberikan akan dapat lebih optimal. Menghemat overhead cost layanan kepada nasabah. Sebagai competitive advantage. Keuntungan Bagi Nasabah : Mempermudah nasabah untuk mendapatkan informasi seperti saldo, daftar transaksi yang sudah dilakukan dan melakukan transaksi seperti pembayaran telepon, kartu kredit, transfer, dll. Menghemat waktu & biaya 4

Jenis-jenis E-Banking 1) Informational: pelayanan jasa Bank kepada nasabah melalui media elektronik baik internet, mobile phone, telelpon, dll dan tidak terdapat eksekusi transaksi. Communicative: pelayanan jasa Bank kepada nasabah melalui media elektronik dalam bentuk komunikasi atau melakukan interaksi dengan Bank penyedia layanan secara terbatas dan tidak terdapat eksekusi transaksi. Transactional : pelayanan jasa kepada nasabah melalui media elektronik dimana terdapat eksekusi transaksi 5

Jenis-Jenis E-Banking 2) Kartu Prabayar E- money ATM Internet Banking Kartu Debet Jenis dan Device E-Banking Mobile Banking Kartu ATM Kartu Kredit EDC / Point of Sales Electronic Fund Transfer Phone Banking 6

Risiko-risiko Layanan E-Banking 2) Skimming, ATM Palsu, Malware Man in the middle attack, key logger, phishing, website palsu, Distributed Denial of Service Attack DDOS) Pencurian, tapping Skimming, EDC Palsu, Wiretapping Social Engineering Card Trapping, Skimming, Theft, Hacked 7

Ketentuan di Bidang TI Penerbit : Kementerian Komunikasi dan Informatika Undang-Undang No.11 Tahun 2008 tentang Informasi dan Transaksi Elektronik. Peraturan Pemerintah No. 82 tahun 2012 tentang Penyelenggaraan Sistem dan Transaksi Elektronik. Penerbit : Bank Indonesia Peraturan Bank Indonesia No.9/15/PBI/2007 tanggal 30 November 2007 tentang Penerapan Manajemen Risiko dalam Penggunaan Teknologi Informasi oleh Bank Umum. Surat Edaran No.9/30/DPNP tanggal 12 Desember 2007 tentang Penerapan Manajemen Risiko dalam Penggunaan Teknologi Informasi oleh Bank Umum. 8

PBI No. 9/15/PBI/2007 9

Pengaturan BI Mengenai Manajemen Risiko TI Ketentuan Umum Ruang Lingkup Manajemen Risiko Pengawasan Aktif Dewan Kecukupan Kebijakan dan Kecukupan Proses Sistem Pengendalian Intern Komisaris dan Direksi Prosedur Penggunaan TI Manajemen Risiko atas atas Penggunaan TI Penggunaan TI Penerapan Manajemen Risiko TI ASPEK Bab 3 Bab 1 Bab 2 Manajemen Pengembangan dan Pengadaan Operasional TI Jaringan Komunikasi Pengamanan Informasi Business End User Electronic Penggunaan Continuity Plan Computing Banking Penyedia Jasa TI Bab 5 Bab 4 P E L A P O R A N Bab 6 Lain-lain,Sanksi, Ketentuan Peralihan, Ketentuan Penutup PBI No.9/15/PBI/2007 Bab 7-10 10

Pengaturan BI Mengenai Manajemen Risiko TI : Ruang Lingkup Management Oversight Pengawasan Aktif Dewan Komisaris dan Direksi Sistem Pengendalian Intern atas Penggunaan TI Internal Controls Policies & Procedures Kecukupan Kebijakan dan Prosedur Penggunaan TI Kecukupan Proses Identifikasi, Pengukuran, Pemantauan, dan Pengendalian Risiko Penggunaan TI Risk Management Processes Penerapan manajemen risiko harus terintegrasi dalam setiap tahapan penggunaan TI sejak proses perencanaan, pengadaan, pengembangan, operasional, pemeliharaan hingga penghentian dan penghapusan sumber daya TI Penerapan manajemen risiko tersebut disesuaikan dengan tujuan, kebijakan usaha, ukuran dan kompleksitas usaha Bank. PBI No.9/15/PBI/2007 11

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 1) I. Pengawasan Aktif Dewan Komisaris & Direksi Bank wajib menetapkan wewenang dan tanggung jawab yang jelas pada setiap jenjang jabatan yang terkait dengan penggunaan TI Wewenang dan tanggung jawab Dewan Komisaris Wewenang dan tanggung jawab Direksi IT Steering Committee PBI No.9/15/PBI/2007 12

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 2) II. Kecukupan Kebijakan dan Prosedur Penggunaan TI 1. Memiliki kebijakan dan prosedur penggunaan TI 2. Menetapkan limit risiko 3. Memiliki rencana strategis TI dijabarkan dalam rencana bisnis bank PBI No.9/15/PBI/2007 13

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 3) III. Proses Manajemen Risiko Terkait TI mencakup identifikasi, pengukuran, pemantauan dan pengendalian atas risiko terkait penggunaan TI 1. Melakukan proses manajemen risiko, atas aspek-aspek : Pengembangan dan Pengadaan Operasional Jaringan Pengamanan TI Komunikasi Informasi Business End User Electronic Penggunaan Continuity Plan Computing Banking Penyedia Jasa TI Apabila Bank menggunakan jasa pihak lain, Bank wajib memastikan penyedia jasa tersebut menerapkan manajemen risiko sesuai PBI. PBI No.9/15/PBI/2007 14

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 4) Lanj. Proses Manajemen Risiko Terkait TI 2. Langkah-langkah pengendalian dalam pengembangan dan pengadaan TI Penetapan dan penerapan prosedur & metodologi secara konsisten Penerapan manajemen proyek Melakukan testing yang memadai Melakukan dokumentasi dan pemeliharaan Memiliki manajemen perubahan sistem aplikasi sistem dan data yang terjaga kerahasiaan dan integritasnya. PBI No.9/15/PBI/2007 15

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 5) Lanj. Proses Manajemen Risiko Terkait TI 3. Mengidentifikasi dan memantau serta mengendalikan risiko akitivitas operasional TI + jaringan komunikasi data + End User Computing EUC) pengendalian fisik dan lingkungan DC & DRC pengendalian hak akses pengendalian input, proses, dan output penggunaan jaringan komunikasi; desain dan pengoperasian jaringan komunikasi pemantauan kegiatan operasional TI pemantauan EUC PBI No.9/15/PBI/2007 16

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 6) Lanj. Proses Manajemen Risiko Terkait TI 4. Memastikan BCP dan DRP dapat dilaksanakan secara efektif 5. Memastikan pengamanan informasi dilaksanakan secara efektif PBI No.9/15/PBI/2007 Memiliki BCP dan DRP Pengujian minimal 1 kali setahun Mengkinikan BCP dan DRP Informasi yang dikelola terjaga kerahasiaan, integritas, dan ketersediaannya Dilakukan terhadap aspek teknologi, sumber daya manusia dan proses Mencakup pengelolaan aset Bank yang terkait dengan informasi, kebijakan SDM, pengamanan fisik, pengamanan akses, pengamanan operasional, dan aspek penggunaan TI lainnya Manajemen penanganan insiden Dilakukan berdasarkan risk assessment. 17

Pengaturan BI Mengenai Manajemen Risiko TI : Penerapan Manajemen Risiko 7) IV. Sistem Pengendalian dan Audit Intern Melaksanakan SPI secara efektif: Pengawasan oleh manajemen dan adanya budaya pengendalian; Identifikasi dan penilaian risiko; Kegiatan pengendalian dan pemisahan fungsi; Sistem informasi, sistem akuntansi dan sistem komunikasi; Kegiatan pemantauan dan koreksi penyimpangan, yang dilakukan oleh satuan kerja operasional, satuan kerja audit intern maupun pihak lainnya. Pelaksanaan audit secara berkala dan adanya kaji ulang fungsi audit. PBI No.9/15/PBI/2007 18

Pengaturan BI Mengenai Manajemen Risiko TI : Electronic Banking 1) Penyelenggaraan kegiatan elektronik Banking WAJIB memenuhi ketentuan BI. Bank HARUS memberikan edukasi kepada nasabah mengenai produk electronic banking dan pengamanannya secara berkesinambungan. Rencana penerbitan produk elektronik banking HARUS dimuat dalam RBB. Produk electronic banking yang bersifat transaksional WAJIB dilaporkan paling lambat 2 bulan sebelum produk diterbitkan. Laporan rencana penerbitan produk dilengkapi dengan persyaratan tertentu. Realisasi rencana penerbitan dilaporkan PALING LAMBAT 1 bulan setelah implementasi. PBI No.9/15/PBI/2007 19

Akhir Presentasi Terima Kasih 20

Organized Crime on the Internet: Cyber Threats & Proactive Defense

The Rising Impact of Cybercrime * 2013 Norton Report ** National Cyber Security Alliance *** National Center for Missing and Exploited Children

The Rising Impact of Cybercrime Key takeaways: Cybercriminals have sophisticated operations to create and distribute malware Cybercrime is evolving at lightning speed The risk to individuals and companies is growing Cybercriminals have global reach They are using cybercrime to fuel other illegal activities Traditional responses won t suffice proactive, aggressive action is required

Indonesian hacker attacked Singapore Educational Institution Police arrested six alleged hackers 5 Indonesian and 1 Nigerian) accused of accessing corporate e-mail accounts and stealing some Rp 5 billion $440,000) from Indonesian companies

Communications and Information Minister Tifatul Sembiring said earlier that websites of Indonesias state ministries and agencies have received more than 36.6 million cyber attacks from hackers in the last three years.

In the second quarter, Akamai found that attacks originated in 175 countries, with Indonesia accounting for 38 percent of those attacks - up from 21 percent in the first quarter

Total Sample: 282 Counterfeit DVDs & Name-Brand Laptop Computers with Non-Genuine Software Pre-Installed 69% malware infection rate 68% of computers 216) 74% of DVDs 66) 7 in 10 computers infected 5600+ instances of malware 1,898 genuine bypass hacks 3,703 were hostile in nature 1,100 unique malware strains Firewall Rules Changed 97% of computers 15% of DVDs Windows Update disabled 79% of sampled computers 33% of sampled DVDs

A New Era in the Fight Against Cybercrime PROACTIVE DISRUPTION we work with our customers and partners to proactively target online criminals.

Our State-of-the-Art Cybercrime Center is a Global First

Microsoft s Botnet Enforcement Proactive Disruption of Cybercriminal Networks B49- Waldec 2009 B107 Rustock 2009 B79 Kelihos 2010 B71 Zeus 2011 B70 Nitol 2012 B58 Bamital 2012 B54 Citadel 2013 B68 ZeroAccess 2013 Computer Worm email SPAM Cut off 277 Domains from Command and Control C&C) Establish Microsoft s standing in Bot Net cases World largest SPAMbot 30 billion SPAM a day Collaboration With Pfizer & FBI Counterfeit Drugs & Goods 3.8 Billion SPAMs a day Shared code with Waldec First bot net case to name Russian defendant Counterfeit Drugs & Goods 13 Million PCs infected $100 Million Losses Financial Bot - wire fraud, bank fraud, and access device fraud Joined by industry partners FS- ISAC and NACHA as coplaintiffs 500 Strains of Malware on 70,000 subdomains Forensically established evidentiary link between malware infections and counterfeit digital goods like pirated software First botnet case targeting click fraud and search hijacking 7 Million Hi- Jacked Computers Collaboration with Symantec First case in which court allowed direct notification to victims of infected computers 5 Million Infected PCs with Malware in 90 Countries. $500 Million Losses Second global financial botnet take down Botnet Herders 1463 Citadel Botnets First US Law Enforcement public & private disruption action with FBI Second click fraud bot-net operation establishing the link between organized criminal groups 2 Million PCs infected $2.7 Million loss each da First public/private partnership b/w FBI, Europol & Industry

globally 1.4 billion pings from infected PCs a week More than 35 billion messages scanned monthly Daily tracking of 600,000 250 million 700 million computers reporting monthly Run more than 40 billion times since 2005 18+ billion web-page scans per month Millions of consumers defended worldwide Performs billions Millions of computers running Microsoft enterprise antimalware solutions More than 420 million active users

Microsoft Security Landscape Private Cloud APPS Public Cloud On-Premises Online INFORMATION PROTECTION ACCESS CONTROL ANTI- MALWARE POLICY MANAGEMENT RESEARCH & RESPONSE SECURE DEVELOPMENT DEVICES

Microsoft Technology and Resources Private Cloud Public Cloud On-Premises Online INFORMATION PROTECTION ACCESS CONTROL ANTI- MALWARE POLICY MANAGEMENT RESEARCH & RESPONSE SECURE DEVELOPMENT DEVICES

Data Protection in APAC

Protecting our Customers Invest in the latest tools and technologies Undertake pro-active disruption Build strong and secure products and cloud services Ensure banking IT infrastructure is secure and only genuine software is used in banking operations Educate banking customers on safe online banking practices and to use only genuine software due to malware in pirated software Email to banking customers Notice in bank websites & premises

Indonesia Cyber Security Measures Directorate of Information Security, MCIT Republic of Indonesia Jakarta, 24 June 2014

Cyber Crime in Indonesia Indonesia ranked tenth in Symantec s global list as the country accounted for 2.4% of the world s cyber crimes in 2011* Watch the World Get Attacked By Cyber Criminals in Real Time http://map.honeycloud.net/) Chairman of the Indonesia Security Incident Response Team on Internet Infrastructure ID-SIRTII), data show there were about 39m attacks in the past year 2012). Of those, 35% originated from outside the country while 65% came from within* According to news reports in 2010, approximately 86% of Internet users in Indonesia are victims of cyber crimes, a figure that seems high although it is also reported that Indonesia is more prone to cyber crimes than most other countries* Source : *A report from DAKA advisory : Meeting the cyber security challenge in Indonesia : An analysis of threats and responses, 2013

Credit Card Dumper and Memory Grabber

Server Location

Phishing and Spam

Mobile Malware Source : Ditkaminfo, 2013

Information Security Incident Reporting on Government agencies in Indonesia March 2013) 160 140 143 120 100 80 60 40 20 0 43 15 16 0 0 6 13 7 0 Source : Ditkaminfo, 2013

5 Five) areas of Cyber Vulnerability in Indonesia Malware According to the threat exposure rate TER) in the Security Threat Report 2013 from Sophos, a security firm, at 23.54%, Indonesia had the highest percentage of PCs that experienced a malware attack in the world over a three month period China was second with 21.26%; Norway and Sweden the lowest with 1.81% and 2.59% respectively)* Cyber fraud, phishing, email and SMS fraud, local SPAM increase last 2 years Phishing and Spam Mobile Threats According to Nielsen, a research firm, almost half of Indonesia s population browses the Internet via mobile phones, which is the highest mobile Internet dependency in Southeast Asia * Data from TNS, a market research company, show that 87% of Indonesians who go online have a social media account * Social Media Between 1 January 2013 until mid-february 2013, 60% of attacks on government domains were web defacements followed by malware attacks at 36%), according to a Government CSIRT Gov- CSIRT) report Hacktivism Source : *A report from DAKA advisory : Meeting the cyber security challenge in Indonesia : An analysis of threats and responses, 2013

9 Critical Infrastructure Law Enforcement Cybersecurity Ecosystem International Security Organization National Security Organization/ Communities Cybersecurity Ecosystem

Cybersecurity Measures Cybersecurity is broader than just Cybercrime 1 Legal Framework Cybercrime legislation is in many country the most complex part of a Cybersecurity legal framework* 5 International Cooperation Cybercrime may even be the dominant part international cooperation in Cybercrime investigations) * INDONESIA Global Cybersecurity Agenda ID-GCA) : Cybercrime needs to be addressed within all pilars 2 Technical and Procedural Measures ICTs is a vital tool that becoming generally linked to organised crime on the Internet Develop culture of Cybersecurity to prevent cybercrime 4 Capacity Building CERT for instance are not solely related to Cybercrime. It can be important tasks for a CERT. But not all work of a CERT will be related to Cybercrime* 3 Organizational Structures Source: *Prof. Dr. Marco Gercke, International Security Measures in Cyberspace, 2012

Cyber Security Legal Framework Agenda 1 Legal Framework Ministerial Circulation Information and Transaction Electronic Act, No.11/ 2008 Telecommunication Act, No. 36/1999 Government Regulation No.82/2012 Electronic System Provider and Electronic Transaction) Other Supporting Law and Regulation

Agenda 2 Technical and Procedural Measures Indonesian National Standard SNI/ISO IEC 27001-2009 Filter Internet : Trust Positive Information Security Index Monitoring by ID-SIRTII/Gov-SCIRT Forensic Laboratory Malware Analyst

Information Security Index 2011 YEAR 2011 250 Technology Asset Management 21 Framework 200 Risk Management Governance 150 100 21 Central Governments have been assessed through KAMI Index 50 1 Source : Ditkaminfo, 2013 21

Information Security Index 2012 350 300 250 YEAR 2012 42 Technology Asset Management Framework Risk Management Governance 200 150 100 42 Central & Local Governments have been assessed through KAMI Index 50 1 Source : Ditkaminfo, 2013 42

Information Security Index 2013 YEAR 2013 62 Technology Asset Management Framework Risk Management Governance 250 200 62 Central & Local Governments have been assessed through KAMI Index 150 100 50 1 Source : Ditkaminfo, 2013 62

Database Blacklist TRUST + Positif http://trustpositif.kominfo.go.id The Blacklist Database from 2010 to 2012 Total Blacklist 838052 Internal Research Complaint Open Proxy 818 4840 32432 International Pornography 799962 0 400,000 800,000 Source : Kominfo, 2013

Agenda 3 Organizational Structures Regulator Directorate Information Security- Kominfo IDSIRTI Indonesia Security Incident Response Team on Internet Infrastructure) Kominfo National Crypto Agency Law Enforcement Police Ministry of Legal Affairs Attorney Justice National Cybersecurity Institution Defense/Military Ministry of Defense TNI Indonesia National Armed Forces) Intelligence BIN National Intelligence Agency) BAIS TNI Indonesian Militarys Strategic Intelligence Agency)

Workshops and Training Public Private Partnership Certification Awareness Education

Member of ASEAN Network Security Action Council Working Group Member of International Telecommunication Union ITU) Bilateral Cooperation in Cyber Security Steering Committee Asia Pacific Computer Emergency Response Team APCERT). Member of FIRST Forum of Incident Response and Security Teams)

Thank You hasyim.gautama@kominfo.go.id ditkaminfo ditkaminfo

Indonesia ICT Consultative Forum IICF) June 24 Marco Ogliengo Managing Director

CONTENT ABOUT ZALORA INDONESIA & KEY CHALLENGES 1

WHO WE ARE ZALORA FILL THE ONLINE FASHION GAP THAT EXISTS IN SEA AND REDEFINING HOW HIGH-STREET FASHION IS ACCESSED IN THIS PART OF THE WORLD We provide affordable high-street fashion that is not readily available to offline shoppers in emerging markets. 2

WHERE WE ARE - THE ZALORA GROUP WHERE WE ARE SINGAPORE HONG KONG MALAYSIA + BRUNEI INDONESIA PHILIPPINES VIETNAM THAILAND AUSTRALIA* NEW ZEALAND* * The Iconic 3

CONTENT ABOUT ZALORA INDONESIA & KEY CHALLENGES 4

ZALORA INDONESIA DOUBLES IN SIZE EVERY 6 MONTHS REVENUE GROWTH CUSTOMER GROWTH Zalora Indonesia Revenue Increase by +1000% since Q2 2012 Our customer base has grown by ~2000% since Q2 2012, reaching millions of consumers 9

INDONESIAN ECOMMERCE: WE RE JUST STARTING Online commerce revenues and growth USD Billion Indonesia e-commerce only ~0.6% of retail UK > 10%) 8

GROWTH IS DRIVEN BY INTERNET PENETRATION Internet penetration Indonesia 7

WHAT IS HOLDING US BACK CONSUMER TRUST Consumers are still not comfortable buying online fraud concerns) In Thailand the government is actively promoting e-commerce through yearly e-commerce days PAYMENTS Low credit card penetration, low bank account penetration 20% vs 60-80% in China/Thailand/Malaysia) Inability to accept debit card online payments Lack of great mobile payment solutions e.g. legally we cannot use phone credit [pulsa] for payments] Zalora circumvents by offering Cash on Delivery, though we re still unable to cover 100% of the territory [and this is not an option to smaller players] INTERNET SPEED Slow 3G internet: 50% of our traffic comes from mobile, but connection is slow and unreliable Low desktop internet penetration: most people buy during office hours fast connections in office). Evening users are mostly mobile. 8

MARCO OGLIENGO marco@zalora.co.id WWW.ZALORA.CO.ID 26

OUT 10

WE REACH ALL OF INDONESIA ~70% of Our Orders Are From Outside of Jakarta We Have Wide and Dispersed Reach Jakarta 30% Tangerang 4% Bandung 4% Surabaya 3% Medan 3% Bekasi 3% Makassar 2% Bogor 2% Denpasar 2% Others 47%

+ INDONESIA: WE RE STILL AT THE BEGINNING Fastest growing internet audience 251M 65.8% Penetration 73M 73% Penetration 36M 38M 23M 44% have purchased in mobile 18M SOUTHEAST ASIA AND THE PACIFIC 218 MILLION INTERNET USERS 32% PENETRATION ON AVERAGE 40% INTERNET TRANSACTIONS IN ID ARE FASHION 33% 667M 67% 12

CHINESE ECOMMERCE TIPPING POINT

INDONESIAN E-COMMERCE TIMELINE 14

INDONESIA BANK ACCOUNT PENETRATION 15

Indonesia ICT Consultative Forum Securing Online Transaction June 2014

WHY EVERYONE? PAYMENT GATEWAY S POINT OF VIEW CONSUMER FRAUD MERCHANT FRAUD RISK INTERNAL FRAUD Internal Fraud can potentially cause the most damage section title.p00.

ONLINE E-COMMERCE) FRAUD What s different with the OFFLINE world? CP vs. CNP Anonymity fraudsters can always hide) More creative ways to steal data Larger scale criminal rings in Eastern EU, Asia, Africa) Some things remain the same: Fraudsters are smart, calculating, persistent section title.p00.

TYPES OF ONLINE FRAUD ACTIVITIES Based on activities, these are categories of online fraud list may be expanded): Identity theft: large purchases; bust-out; many purchases; perfect identities address, phone and credit card data look clean). Social Engineering: asking questions, change information through social interaction hijack orders Convenience ease of use): small purchases for testing, safe/unassuming places Internal fraud: organized criminal rings, sharing info section title.p00.

FRAUD PREVENTION TECHNIQUES CUSTOMER DATA Minimum requirement Typical online payment form section title.p00.

FRAUD PREVENTION TECHNIQUES CUSTOMER DATA - IMPORTANCE DATA IS IMPORTANT THE MORE THE BETTER Data analytics Fraud scoring Rules Engine Etc. section title.p00.

FRAUD PREVENTION TECHNIQUES VARIOUS METHODS/SOLUTIONS Various fraud prevention techniques/solutions: Manual review CVV/Security Code 3D-secure BIN check Velocity of change Velocity of use Fraud rules section title.p00.

FRAUD PREVENTION TECHNIQUES FRAUD RULES Fraud Rules Examples of vendors: Retail Decision, Cybersource Analyzes data, combined with velocity checks, and then set outcome. e.g.: automatically set transactions into hot lists deny) or warm lists review) based on data analysis. section title.p00.

FRAUD PREVENTION TECHNIQUES FRAUD RULES Machine Learning Big data analysis Mathematical statistical model) Looking for outliers section title.p00.

INTERNAL FRAUD & DATA BREACHES www.veritrans.co.id 10

TOP MISTAKES IN SECURITY Weak/default passwords Lack of employee education e.g. security vs. compliance) Security deficiencies introduced by third parties Slow self detection section title.p00.

WHY WE FAIL IN MAINTAINING SECURE ENVIRONMENT Lack of awareness by practisioners No incentive to re-engineer process Just secure whatever that is already there Merging different people and process Slow adaption in evolving technology Unnecessary exposure of sensitive data section title.p00.

WHAT WE CAN DO Identify and isolate privileged users Audit end user passwords: ensure that passwords are audited and meet a certain standard Alert and monitoring: small purchases for testing, safe/unassuming places Review CDE access rules: is it really necessary? section title.p00.

BEST PRACTICES Devaluate data whenever possible Improve continuously Stop thinking scope, start thinking risk It is not out of scope if it can be used against you section title.p00.

CLOSING CONCLUSIONS Why do people shop online - Convenience and trust Frictions can lead to higher abandonment rate Fraud will always be present The key is to how to keep it at a manageable level criminals only need to be right once, we need to be right all the time Security = Technology + Process + People section title.p00.

Data protection & competitiveness: assessing the economic costs Presentation for Indonesia ICT Consultative Forum IICF) Tuesday, 24 June 2014, Jakarta, Indonesia Bert Verschelde, Research Associate Erik van der Marel, Senior Economist 1

Data protection & competitiveness: assessing the economic costs The importance of free cross-border data flows The economic impact of data flow restrictions Conclusion & policy implications 2

Data protection & competitiveness: assessing the economic costs The importance of free cross-border data flows The economic impact of data flow restrictions Conclusion & policy implications 3

The importance of free crossborder data flows The Internet has transformed international trade and has created a globally integrated and connected economy in two ways: E-commerce and the digitalisation of products: books, music, movies, taxis, medical equipment etc. are increasingly supplied digitally Servification: global commerce and manufacturing is increasingly dependent on services, in large part thanks to the Internet and ICT 4

The importance of free crossborder data flows Both of these developments are spurring Indonesian economic growth and furthering its integration in the world economy E-commerce Online sales are projected to boom in the next two years Redwing report) 50% of Indonesian consumers not currently buying online plan an online purchase in the next 12 months Google report) Servification Almost half of global services trade is facilitated by ICT UNCTAD, 2009) Typically, data accounts for between 4 and 31% of production input in services. 5

The importance of free crossborder data flows In short, the Internet is of crucial importance to the Indonesian economy and its continued integration in the regional and global economy The Internet has been responsible for 21% of economic growth in developed countries over the past five years New developments such as the Internet of Things and Big Data will further spur productivity and growth 6

Data protection & competitiveness: assessing the economic costs The importance of free cross-border data flows The economic impact of data flow restrictions Conclusion & policy implications 7

The economic impact of data flow restrictions Global proliferation of government initiatives to restrict the free flow of data across borders In light of revelations on online surveillance by foreign intelligence services, regulatory efforts have intensified Given the importance of free cross-border data flows, restricting movement of data severely impacts the economy 8

The economic impact of data flow restrictions When services firms are required to store and process data locally, it does not only affect internet companies Companies in the financial, retail, logistics, manufacturing, communications sectors all use personal data across their supply chains Indonesian businesses rely on access to personal data to efficiently design, produce, sell and deliver goods and services 9

The economic impact of data flow restrictions Data flow restrictions lead to four economic shocks 1. Price increases: When firms are required to store and process data locally, prices of any good or service that uses data will increase. This cost is passed on to consumers of the service or good - manufactures, exporters or end-consumers. 2. Trade barrier: it creates an additional trade barrier against data processing and internet services, or any service to a lesser extent also goods) that depends on the use of data for delivery 10

The economic impact of data flow restrictions Data flow restrictions lead to four economic shocks 3. Competitiveness declines: as Indonesian exporters face higher input costs due to the regulation, they suffer a comparative disadvantage compared to competitors in other countries. This in turn makes the economy less attractive to domestic and foreign investment FDI) 4. R&D efficiency declines: the effectiveness of R&D is affected to the extent that product development relies on customer and market data. R&D is crucial to spur innovation, a key driver of economic growth. 11

The economic impact of data flow restrictions Who is affected? Indonesian producers: their exports become less competitive, due to increased production costs and lower R&D efficiency. Indonesian consumers: price increases lead to welfare loss; lower investment leads to job losses. Foreign service providers: incur higher production costs through required IT capacity expansion and face extra regulatory hurdles to market access. 12

The economic impact of data flow restrictions Our study quantifies the costs of data flow restrictions By analysing of data use intensity across all sectors of the economy Introducing price increases and TFP losses to domestic economy Estimates impact on domestic GDP and trade and investment flows 13

The economic impact of data flow restrictions An economy-wide data flow restriction would impact the Indonesian economy: by decreasing economic growth by -0.7% roughly USD $6.1 billion) by decreasing domestic and foreign investment by -2.3% lowering FDI by roughly USD $510 million) by decreasing exports by -1.7% 14

Data protection & competitiveness: assessing the economic costs The importance of free cross-border data flows The economic impact of data flow restrictions Conclusion & policy implications 15

Conclusion & policy implications The Internet and cross-border data flows are rapidly transforming global trade, while driving economic growth Data flows will be of paramount importance to Indonesia s growth trajectory in next few years Restrictive regulation would heavily impact the Indonesian economy by decreasing productivity, hampering exports and discouraging investment Designing data protection regulation in a way that does not impede cross-border data flows will be crucial to maintain Indonesia s competitiveness in the ASEAN region and the world 16

member of Ooredoo Group Indonesia s ICT Ecosystem Alexander Rusli President Director & CEO Indosat 02 October 2014

Executive Summary member of Ooredoo Group ICT is essential enabler for economy and development, which contribute ~4.7% of total GDP in 2013 and expected to grow, through direct contribution in ICT ecosystem and indirectly via externality to general economy and productivity increase. Presidential decree on Indonesia Broadband Plan, which signed in 15 September 2014, highlight government focus and support to ICT. Lesson learned from national broadband plan implementation in other countries, there are some essential elements: ensuring the availability of suitable and harmonized spectrum, reducing regulatory cost, providing incentive to ICT sector and creating healthy competitive environment. Digital business start to emerge as new growth area which support economic development of the nation. 2

ICT Contribution to Economy and Development member of Ooredoo Group 10% increase in broadband penetration could boost GDP by 1.38% in low and middle income countries. World Bank) 10% higher broadband penetration in a specific year is correlated with 1.5% greater labor productivity growth over the following five years Booz & Company) Smart use of ICTs can reduce GHG emissions by up to 25%. Mobile technology alone could lower GHGs by 2% by 2020. E- commerce could lower energy consumption and GHG emissions by 30% over traditional retail Broadband commission, GSMA, Carnegie Mellon). In Indonesia, the quality of education is highly correlated 0.71) with the availability of internet access Pustekkom, Kemendikdbud). 3

ICT Mobile Industry) Contribution to GDP member of Ooredoo Group 2013) Mobile industry contributed up to 4.7% of total GDP 2013 and expected to grow through direct contribution in mobile ecosystem and indirectly via externality to general economy and productivity increase Source: GSMA, 2014 4

ASEAN ICT Profile 2013) member of Ooredoo Group Country Global Network Readiness Rank Internet Users %) Fixed BB %) Mobile BB %) Population Mn) National Broadband Plan Singapore 2 73% 26% 103% 5 Intelligent Nation 2015 2005) Malaysia 30 67% 8% 61% 30 National BB Implementation NBI 2010) Brunei Darussalam 45 65% 6% 48% 0.4 National Broadband Blueprint 2008) Indonesia 64 16% 1% 30% Presidential Decree No. 96 2014) 248 Priorities Of MOCIT Year 2010-2014 2010) Thailand 67 29% 7% 50% 68 The National Broadband Policy 2010) Philippines 78 37% 3% 35% 97 Digitally Empowered Nation 2011) Vietnam 84 44% 6% 27% 90 Master Plan of Vietname 2010-2015 and PMDecreee 1755/QD-TTg on the approval of National Strategy on Transforming Vietnam into an advanced ICT country 2010) Cambodia 108 6% 0.2% 19% 15 Cambodia ICT development Strategy 2011-2015 2011) Lao PDR 109 13% 0.1% 10% 7 N/A Timor-Leste 141 1% 0.1% 0.2% 1 N/A Presidential decree on Indonesia Broadband Plan 2014-2019 is signed in 15 September 2014 PP 96/2014), which emphasize government focus and support to ICT Source: The State of Broadband 2013: Universalizing Broadband, A report by the Broadband Commission. Indonesia Secretary of Cabinet. ITU. GSMA. IMF 5

National Broadband Plan: Lesson Learned From Other Countries member of Ooredoo Group Reduce the 2 Regulatory Cost Ensure enough spectrum is available Renew licenses and refarm spectrum Prepare for future demand 3 Incentives & Create Healthy Competitive Environment Source: GSMA 6

Beyond Connectivity: Developing Digital Ecosystem member of Ooredoo Group IWIC Competition Incubator Venture Fund Batch # 1 Indosat Wireless Innovation Contest IWIC) Encourage new idea / innovation with competition of potential startup Funding for ideabox startups Funding for Indosat JVs Early digital ecosystem participation in Indonesia Strategic Partner 5 months program, one batch each year Initial step in search of potential idea / innovation 3 year program, two batches per year 4 startups already in Partners also coaching Dunia Digital teams 4 year investment horizon 7

Developing Digital Platform and Incubating Local Startups via Ideabox & Venture Fund member of Ooredoo Group Local Apps & Contents? Source: Indosat 8

Indosat has created a digital unit with startup culture & environment member of Ooredoo Group Startup culture and environment Experience in launching mobile commerce, finance and advertising businesses Experience in investing in digital startups and joint ventures Dedicated technology and app development team More than 100 resources with annual revenue over US$ 18 M 9

Up to 10 new investments per year through the ideabox startups accelerator member of Ooredoo Group 10

A number of products have been launched in just a few months member of Ooredoo Group 11

Complete ICT Ecosystem to Deliver Best Customer Experience member of Ooredoo Group Mobile Devices Infrastructure Apps Cloud Providers 12

Concluding Remarks member of Ooredoo Group ICT is supporting the country in connecting people, business and government. This sector contributes to GDP directly via ICT ecosystem and indirectly via externality to general economy and productivity increase. Implementing Indonesia Broadband Plan will require collaboration among stakeholders, especially in the following focus areas i.e. ensuring the availability of suitable and harmonized spectrum, reducing regulatory cost, providing incentive to ICT sector and creating healthy competitive environment. Indonesia need to think Beyond Connectivity to enter into digital business, as opportunities and tools to support economic growth. 13

member of Ooredoo Group

invest in The 3rd Executive Meeting of Indonesia ICT Consultative Forum Jakarta, 2 October 2014 INVESTMENT UPDATES ICT SECTORS 2009-2014S1) INDONESIAN INVESTMENT COORDINATING BOARD Nurul Ichwan Deputy Director for Manufacturing Industry Promotion 2014 by Indonesian Investment Coordinating Board. All rights reserved

FDI to the World in ICT sectors USD388billion invested in 2009-2013, ASEAN received 5% of global FDI Rank Source Share 1 United States 32% 2 UK 11% 3 Spain 7% 4 France 5% 5 Japan 4% 6 Mexico 3% 7 Germany 3% 8 Italy 3% 9 Sweden 3% 10 India 3% Others 26% Total 102 countries) 100% Rank Destination Share 1 Brazil 13% 2 United States 6% 3 India 6% 4 Canada 5% 5 UK 4% 6 Spain 4% 7 Nigeria 4% 8 Chile 3% 9 China 3% 10 Australia 3% 61 Bulgaria 0,2% 62 Indonesia 0,2% 63 Greece 0,2% Total 171 countries) 100% 45,000 40,000 35,000 30,000 25,000 20,000 15,000 10,000 5,000 - Rank Company Share 1 Telefonica 6% 2 Vodafone 4% 3 America Movil 3% 4 Telecom Italia 3% 5 Orange France Telecom) 3% 6 Microsoft 2% 7 Level 3 Communications 2% 8 38,139 7,020 Nippon Telegraph & Telephone NTT) The Investment Coordinating Board of the Republic of Indonesia To the world To ASEAN 2% 9 IBM 2% 10 Cisco Systems 1% Others 73% Total 5.368companies) 100% 18,554 2,886 2009 2010 2011 2012 2013 20,715 379 Source: Financial Times, 2014. 2

FDI to ASEAN in ICT sectors USD18billion invested in 2009-2013, Indonesia received 5% of FDI Rank Source Share 1 United States 36% 2 Japan 13% 3 UK 10% 4 South Korea 5% 5 India 4% 6 Singapore 3% 7 Germany 3% 8 Finland 3% 9 Malaysia 3% 10 China 3% Others 17% Total 48 countries) 100% Rank Destination Share 1 Singapore 46% 2 Malaysia 16% 3 Vietnam 14% 4 Thailand 6% 5 Philippines 6% 6 Indonesia 5% 7 Cambodia 4% 8 Myanmar Burma) 3% 9 Laos 1% 10 Brunei 0,3% Total 10 countries) 100% 45,000 40,000 35,000 30,000 25,000 20,000 15,000 10,000 5,000 - Rank Company Share 1 Nippon Telegraph & Telephone NTT) To the world To ASEAN 7% 2 Samsung 4% 3 IBM 3% 4 SEA-ME-WE 5 2% 5 CSF Group 2% 6 Global Switch 2% 7 Equinix 2% 8 Mini-Circuits Tech. 2% 9 Nokia 2% 10 Verizon Communications 2% Others 46% Total 75 companies) 100% 18,554 2,886 20,715 379 2009 2010 2011 2012 2013 The Investment Coordinating Board of the Republic of Indonesia Source: Financial Times, 2014. 3

FDI realization in ICT sectors in Indonesia Singapore in the lead with USD888million 85%) from USD1.04billion of total FDI realized since 2010 4500 4000 3500 3000 2500 2000 1500 1000 500 0 2010 2011 2012 2013 FDI Realization in ICT Sectors in Indonesia by Origin Country Top-10 Countries Based on Capital Expenditure USD million) in 2014S1) Excl. oil, gas, and financial sectors Rank Country 2010 2011 2012 2013 2014S1) 1 Singapore 4.052 2.671 1.740 935 888 2 UK 1 - - 2 122 3 South Korea 8 1 25 26 7 4 Japan 1 1 1 22 4 5 Germany 0-1 1 3 6 Australia 1 3 1-1 7 Netherland 305 675 485 175 1 8 South Africa - - - - 1 9 India - - 1 0 0 10 Hong Kong 466 0 0 1 0 Total Top 10) 4.834 3.351 2.254 1.163 1.027 Total 4.951 3.686 2.416 1.304 1.044 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 4

FDI realization in ICT sectors in Indonesia Dominated by telecommunication provider, Slowing down since 2010 FDI Realization in Indonesia by Subsector Top-10 Subsectors Based on Capital Expenditure USD million) in 2014S1) 6000 5000 4000 3000 2000 1000 0 2010 2011 2012 2013 Plan Realization *) Other telecommunication consists of : telecommunication provider for personal purpose, defense & security, broadcasting, also trade of network capacity without providing additional services Rank Subsector 2010 2011 2012 2013 2014S1) 1 Wired telecommunication - 202 179-874 2 Other telecommunication* 2.972 1.774 799 256 122 3 Big trade based on fee or contract 54 11 23 8 16 4 Web portal - 2 17 24 11 5 Big trade of electronic and telecommunication equipments The Investment Coordinating Board of the Republic of Indonesia 3 4 4 12 8 6 Big trade of computer, hardware and software 0 17 2 7 3 7 Construction of communication systems - - 0 9 3 8 Data processing and hosting activities - - - 1 1 9 Electricity system installation 2-0 1 1 10 Multimedia service 1 0 1 1 1 Total 4.951 3.686 2.416 1.304 1.044 Source: BKPM, 2014. 5

FDI realization in ICT sectors in Indonesia Top-10 Companies The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 6

Jakarta FDI realization in ICT sectors in Indonesia Since 2010, 99.6% of total FDI are located in Java FDI Realization per location Economic corridor rank based on investment realization USD million) 2014S1) 2010 2011 2012 2013 S1 2014 Rank Economic Corridor 2010 2011 2012 2013 2014S1) 1 Java 4.909 3.684 2.415 1.299 1.042 2 Bali & NT 1 2 1 0 1 3 Kalimantan 41 0 - - 0 4 Sumatera - - 0 3 0 5 Sulawesi - - 0 3-6 Papua & Maluku - - - - - Total 4.951 3.686 2.416 1.304 1.044 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 7

DDI realization in ICT sectors in Indonesia Dominated by telecommunication provider, Slowing down since 2011 8000 7000 6000 5000 4000 3000 2000 1000 0 2010 2011 2012 2013 DDI Realization in Indonesia by Subsector Top-10 Subsectors Based on Capital Expenditure IDR billion) in 2014S1) *) Other telecommunication consists of : telecommunication provider for personal purpose, defense & security, broadcasting, also trade of network capacity without providing additional services Rank Subsector 2010 2011 2012 2013 2014S1) 1 Other telecommunication* 2.878 7.389 5.726 3.913 3.722 2 Wireless telecommunication 71-824 268 102 3 Big trade based on fee or contract 2-0 0 0 4 Construction of irrigation, communication and waste systems The Investment Coordinating Board of the Republic of Indonesia - - - 1-5 Electricity system installation - - 0 - - 6 Big trade of electronic and telecommunication equipments - 5 - - - 7 Data processing and hosting activities - - - - - 8 Computer industry and/or cmputer assembly industry 0 - - - - 9 Computer equipments industry - - 3 - - 10 Wireless telecommunication equipments industry Plan Realization - - - 166 - Total 2.951 7.394 6.553 4.347 3.824 Source: BKPM, 2014. 8

DDI realization in ICT sectors in Indonesia Top-10 Companies The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 9

Jakarta DDI realization in ICT sectors in Indonesia Since 2010, almost 100% of total DDI are located in Java DDI Realization per location Economic corridor rank based on investment realization IDR billion) 2014S1) 2010 2011 2012 2013 S1 2014 Rank Economic Corridor 2010 2011 2012 2013 2014S1) 1 Java 2.950,9 7.394,3 6.553,1 4.346,7 3.824,1 2 Kalimantan - - 0,1 0,1-3 Sumatera - - - 0,5 - Total 2.950,9 7.394,3 6.553,2 4.347,3 3.824,1 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 10

McKinsey: Indonesia by 2030, additionalusd1.3 trillion market opportunity from growing middle class Indonesia today Indonesia in 2030 Source: McKinsey Global Institute, September 2012. The Investment Coordinating Board of the Republic of Indonesia 11

Abundant opportunity from growing consuming class 71 % Population in cities, producing 86% of GDP in 2030 90 million Consumer Additional consumers by 2030 7.7 % p.a. USD1.1 trillion spend growth in urban areas Market opportunity in consumer services by 2030 Estimated annual revenue in 2030 USD billion, 2010-11 price) Urban Households Expenditure in 2011 and 2030 USD billion, 2010 price) The Investment Coordinating Board of the Republic of Indonesia 12

Population million) Below Global Consuming Class Global Consuming Class Consuming class in Indonesia in 2030 Middle Class Growth in ASEAN 2012-2020 Source: AC Nielsen, 2013. 2010 2020 2030 in 5-6% 2030 in 7% 135 million GDP scenario GDP scenario Middle class growth GDP per capita USD) 195 45 2,428 2000 2001 2002 180 85 2003 2004 2005 145 135 2006 2007 2008 2009 110 170 2010 4,666 2011* 174 % in Indonesia 2012-2020 High middle class growth & consumer confidence index 120 Nielsen Consumer Confidence Index Source: AC Nielsen, 2013. Source: IMF, Bappenas, UNPP, McKinsey Indonesia The Investment Coordinating Board of the Republic of Indonesia 13

Driven by young and dynamic population China 1.3 billion India 1.2 billion US 310 million Indonesia 248 million Fourth largest population in the world Dependency ratio keeps falling until 2025 90 80 70 60 50 Brazil India Russia China Indonesia 40 30 1980 1990 2000 2010 2020 2030 2040 2050 Source: IMF, Bappenas, UNPP, McKinsey The Investment Coordinating Board of the Republic of Indonesia 14

60% 50% Rise of the Middle Class 47% 53% 56% 40% 30% 29% 30% 29% 33% 20% 10% TV, Refrigerator and Car/Motorcycle Ownership 0% Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun 2008 2009 2010 2011 2012 2013 Source: Roy Morgan Single Source Indonesia June 2013 National) Base: Indonesian Population 14+ n= 29,087 The Investment Coordinating Board of the Republic of Indonesia 15

100% Car and Motorcycle Ownership by Households 90% 80% 70% 60% 58% Car 61% Motorcycle 62% 71% 76% 81% 82% 50% 40% 30% 20% 10% 0% 9% 7% 4% 3% 4% 4% Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun 2008 2009 2010 2011 2012 2013 10% Source: Roy Morgan Single Source Indonesia June 2013 National) Base: Indonesian Population 14+ n= 29,087 The Investment Coordinating Board of the Republic of Indonesia 16

Ownership of Mobile Phone and Smart Phone 90% 84% 85% 80% 76% 70% 68% 60% 50% 51% 40% 30% 32% 41% 27% 20% Have a Mobile Phone 24% 10% Have a Smart Phone 14% 0% Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun Sep Dec Mar Jun 2008 2009 2010 2011 2012 2013 Source: Roy Morgan Single Source Indonesia June 2013 National) Base: Indonesian Population 14+ n= 29,087 The Investment Coordinating Board of the Republic of Indonesia 17

The most promising country for overseas business Japan Bank for International Cooperation Survey 2013) Rank 2005 2006 2007 2008 2009 2010 2011 2012 2013 1 China China China China China China China China Indonesia 2 India India India India India India India India India 3 Thailand Vietnam Vietnam Vietnam Vietnam Vietnam Thailand Indonesia Thailand 4 Vietnam Thailand Thailand Russia Thailand Thailand Vietnam Thailand China 5 US US Russia Thailand Russia Brazil Indonesia & Brazil Vietnam 6 Russia Russia US Brazil Brazil Indonesia - Brazil Brazil Vietnam 7 Korea Brazil Brazil US US Russia Russia Mexico Mexico 8 Indonesia Korea Indonesia Indonesia Indonesia US US Rusia Myanmar 9 Brazil Indonesia Korea Korea Korea Korea Malaysia US Rusia 10 Taiwan Taiwan Taiwan Taiwan Malaysia Malaysia & Taiwan Taiwan Myanmar US Positive Factors 1. Future growth potential of local market 2. Inexpensive source of labor 3. Current size of local market 4. Supply base for assembler 5. Industrial cluster development Issues of Concern 1. Rising labor costs 2. Underdeveloped infrastructures 3. Execution of legal system unclear frequent changes) 4. Intents competition with other companies 5. Difficult to secure management-level staff 6. Labor problems The Investment Coordinating Board of the Republic of Indonesia Source: JBIC, November 2013 18

The most preferred destination in Asean region for future expansion AmCham Singapore and US Chamber of Commerce) Strengths 1. Tax structure 2. Stable government and political system 3. Personal security 4. Housing costs 5. Availability of low cost labor Challenges 1. Infrastructure 2. Corruption 3. Laws and regulations 4. New business incentives offered by government 5. Availablility of trained personnels The Investment Coordinating Board of the Republic of Indonesia Source: JBIC, November 2013 19

Open opportunities for foreign direct investment Negative Investment List Presidential Regulation No.39 /2014) Investment Law Law No.25 /2007) OPEN OPEN with conditions Such conditions include: Partnership with local partner, Capital ownership, Location and Special permits. Mandate equal treatment for foreign and domestic investors Freedom to repatriate capital. All business sectors/fields are open to investment activities, except those that are declared to be closed or open with conditions. CLOSED Any investment activities producing goods/services that is: Prohibited by Indonesian law, Dangerous, Polluting, Strategic for national security and/or heritage. The Investment Coordinating Board of the Republic of Indonesia 20

Skilled workforce Challenges The gross enrolment ratio for tertiary education was 23% in 2010. In a 2006, half of the workforce had just a primary education or less. Overall, the country spends about 1.3% of its GDP on education. Total R&D spending is less than 0.5% of GDP. High-tech exports as a percentage of totals are about 11%. [Oxford Business Group, 2013] 20 % 12 years Share of state budget dedicated to education since 2004. Compulsory schooling since 2013. Top-5 Number of higher education graduates in 2020, covering 6% of world s total. OECD, 2012) Partnership between vocational schools and companies operating in Indonesia to produce graduates with specific skills. There are 850,000 vocational school graduates a year. Establishment of university of professions, dedicated for the needs of various professions, by and for the professions. Tax incentive for companies who conduct R&D programs. 80.0 70.0 60.0 50.0 40.0 30.0 20.0 10.0 0.0 35,000 30,000 25,000 20,000 15,000 10,000 5,000 - Enrollment Ratio Comparison between the number of students and people at the school age) 50.9% 10.8% Education Facilities 13,000 1,900 High school University High school University 67.9% 18.5% 28,600 3,800 The Investment Coordinating Board of the Republic of Indonesia 21

Challenges and progress in infrastructure Challenges The geographical realities: a vast archipelago. Internet penetration in Indonesia stands about 22%, while the Asian average is 27.5% [Internet World Stats, 2012]. In the WEF s Networked Readiness Index 2012, Indonesia was ranked 53 rd. Many gaps still exist in terms of basic services, and infrastructure falls short when it comes to coverage and quality. Infrastructure Budget 2005-2013 IDR trillion) IDR190 trillion Progress The fiscal budget allocated for infrastructure has been increased eight folds since 2005 to IDR229.5 trillion in 2014. Indonesia is focused on getting greater connectivity through MP3EI: Malaysia-to-Indonesia high bandwidth optical fiber submarine system, a new Australia-Indonesia-Singapore cable has been announced [Deloitte, 2012 and IDG Connect, 2012]. The Palapa Ring, a fiber-optic back-bone covering all the main region of the archipelago, scheduled to be finished in 2014 [OBG, 2013]. The Ministry of ICT also started to deploy mobile internet service centers [OBG, 2013]. The Investment Coordinating Board of the Republic of Indonesia Source: National Planning Agency, 22 2014.

Labor issues Wage is no longer a single life support Wage = Productivity National Social Security Program Law No.4/2011) Health Insurance BPJS Kesehatan) Universal health care Minimum wage is also based on productivity, besides the criteria of decent living KHL) and economic growth Presidential Instruction No.9/2013). Wage increase < KHL is directed to fulfill the criteria of decent living with clear plan and timeline. Wage increase KHL is designed to be in line with productivity and approved by employer and employees. Improving certainty and transparency Workforce Insurance BPJS Tenaga Kerja) Pension, old-age savings, death benefits and worker accidents Applied in January 2014 Applied in July 2015 BKPM recommands that wage increase refers to multiyear formula although the increase may be implemented annually. BKPM urges measurement mechanisms to monitor and evaluate wage policies. The Investment Coordinating Board of the Republic of Indonesia 23

Closed for Investment Presidential Regulation No.39 /2014) Information and Communication Technology Fields Closed to Investment Business Fields Management and Operation of Radio Frequency Spectrum Monitoring Stations and Satellite Orbit Remarks The Investment Coordinating Board of the Republic of Indonesia 24

Open for Conditions to Investment Presidential Regulation No.39 /2014) Business Fields KBLI) Conditions Remarks Institute for Community Broadcasting LPK) radio and television 60102, 60202) Cable installation for home and buildings 43212) Telecommunication kiosk 61914) Internet cafe 61924) Telecommunication network operation : Fixed network operation 61100) Motion network operation 61200, 61300) Information and Communication Technology Fields Open with Conditions to Investment Reserved for micro, small, medium enterprises and cooperatives 65% maximum of foreign capital ownership Telecommunication service operation : Content service ringtone, premium SMS, etc) 61911) Call center and other value added service 61919) Internet service provider 61921) Data communication system service 61922) Public internet based telephony service 61923) Network Access Point NAP) service and other multimedia service 61929) 49% maximum of foreign capital ownership The Investment Coordinating Board of the Republic of Indonesia 25

Open for Conditions to Investment Presidential Regulation No.39 /2014) Business Fields KBLI) Conditions Remarks Integrated telecommunication network and service operation 61100, 61200, 61300, 61921, 61922, 61923, 61929) Establishment of Telecommunication Devices Testing Institution 71202) Public Broadcasting : Radio 60101) Television 60201) Information and Communication Technology Fields Open with Conditions to Investment Construction service provider and operator for telecommunication tower 42217) Publication of newspapers, magazines and bulletins press) 58130) 65% maximum of foreign capital ownership 95% maximum of foreign capital ownership Special permit : only monopoly for Radio Republik Indonesia RRI), Televisi Republik Indonesia TVRI) and other local public broadcasting 100% local capital The Investment Coordinating Board of the Republic of Indonesia 26

Open for Conditions to Investment Presidential Regulation No.39 /2014) Business Fields KBLI) Conditions Remarks Broadcasting Agency : - Private Broadcasting Agency LPS) 60102) - Subscription-based Broadcasting Agency LPB) 60202) Postal operations 53101, 53102, 53103) Information and Communication Technology Fields Open with Conditions to Investment 100% local capital and special permit : - Only for expansion, 20% maximum of foreign capital ownership - Comply with broadcasting regulations Special permit and foreign capital : - 49% maximum of foreign capital ownership - Comply with postal operations regulations The Investment Coordinating Board of the Republic of Indonesia 27

TAX HOLIDAY IMPORT DUTY FACILITY MoF Regulation No.130/PMK.011/2011) MoF Regulation No.176/PMK.011/2009) Investment Incentives 5-10 years Tax relief facility, starting from the commencement of commercial production. 50 % for a further 2 years Reduction of income tax after the expiration of the tax holiday and can be extended by MoF. Pioneer industry 1. Basic metal industries; 2. Oil refinery industries and/or basic organic chemicals; 3. Machinery industries; 4. Industries of renewable resources; 5. Communication devices industries. IDR1 trillion Minimum investment plan. Machines, goods, materials for production 2 years import duty exemption or 4 years for companies using locallyproduced machines min.30%). Industries Which produces goods and/or services, including: 1. Tourism and culture 2. Public transportation 3. Public health services 4. Mining 5. Construction 6. Telecommunication 7. Port The Investment Coordinating Board of the Republic of Indonesia 28

Improvement of Ease of Doing Business No. Indicator Procedure number) 2013 Improvement Time days) Cost % of income per capita) Procedure number) Time days) Cost % of income per capita) 1 Starting a business 10 48 20.5 5 5 16.6 2 Getting electricity 6 101 370.6 4 15 311.5 3 Paying taxes & premium insurance 52 259 hours/year 4 Enforcing contract 40 498 5 Resolving insolvency - 4.5 years 6 Registering property 6 22 7 Dealing with construction permit 32.2 % of profit) 139.4 % of claim) 18 % of estate) 10.9 % of property value) 7 136 hours/year 24 175-1.75 years - 12 32.2 % of profit) 1.28* % of claim) 5.08 % of estate) 10.9 % of property value) 13 158 87.2 5 22 36.2 The Investment Coordinating Board of the Republic of Indonesia 29

We provide one-stop shop PTSP) licensing provision and our services for investors include INDONESIA INVESTMENT COORDINATING BOARD Establishing an Investor Relation Unit at BKPM for information, facilitation and inqueries handling from existing and potential investors. Rolling-out the Electronic Information Services and Investment Licensing SPIPISE) in 105 regions throughout Indonesia. Helping contain various obstacles and giving consultation. Facilitating foreign workers permit. Providing online investment tracking system. PLAY Providing online application process for the principal license. Other steps needed would be moved online later in 2014.

Thank You Indonesia Investment Promotion Centre IIPC) Badan Koordinasi Penanaman Modal BKPM) Indonesia Investment Coordinating Board Jln. Jend. Gatot Subroto No. 44 Jakarta 12190 - Indonesia t. +62 21 525 2008 f. +62 21 525 4945 e. info@bkpm.go.id www.bkpm.go.id

Sustainable Investment Growth DDI FDI 23.4 27.9 34.8 24.6 42.2 28.6 42.2 billion USD total investment realization in 2013 IDR398.6 trillion), 2.1% above the 2013 target, IDR390.3 trillion. 27.3 % increase from 2012 IDR313.2 trillion) 15.0 10.8 4.2 16.6 19.5 6.8 8.4 10.2 13.6 FDI 2013 22.4 % increase from 2012 67.8 % share of total investment realization 2009 2010 2011 2012 2013 Investment Realization in Indonesia Based on Capital Expenditure USD Billion) Excl. oil, gas, and financial sectors Assumption: Q1-Q2 rate USD 1 = IDR 9,300 Q3-Q4 rate USD 1 = IDR 9,600 DDI 2013 39.0 % increase from 2012 32.2 % share of total investment realization The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014 32

Investment Realization Progress Semester I 2014 Semester I 2014 y-o-y DDI 20.2% FDI 13.5% Total 15.6% Investment Realization in Indonesia Based on Capex IDR Trillion) Excluding Oil & Gas and Financial sectors Exchange rate USD1 = IDR10,500 Based on State Budget of 2014 DDI : Domestic Direct Investment FDI : Foreign Direct Investment *)Revised investment target 2014, BKPM Strategic Plan 2010-2014 **) Towards the 2014 target The Investment Coordinating Board of the Republic of Indonesia 33

FDI Realization 2009-2014S1) 47% of FDI flows to secondary sectors in 2014S1) and 55% in 2013 6,000 5,000 4,000 3,000 Component of FDI Realization Based on Group of Sectors 3,813 483 Primary Secondary Tertiary 6,520 9,844 3,337 3,034 7,802 6,790 FDI Realization in Indonesia by Sector Top-10 Sectors Based on Capital Expenditure USD million) in 2014S1) Excl. oil, gas, and financial sectors 6,862 6,286 3,636 11,770 15,859 6,711 4,883 5,933 6,472 3,940 Rank Sector 2009 2010 2011 2012 2013 2014S1) 1 Mining 333 2,201 3,619 4,255 4,816 2,740 2 Food Industry 534 1,026 1,105 1,783 2,118 2,065 3 Transport, Storage, and Telecom. 4,152 5,072 3,799 2,808 1,450 1,650 4 Plantation and Crops 143 751 1,222 1,602 1,605 1,142 5 Transport Equipment Industry 583 394 770 1,840 3,732 1,028 6 Chemical and Pharmacy Industry 1,183 793 1,467 2,770 3,142 979 7 2,000 1,000 Steel, Machinery and Electronics Industry 0 2009 2010 2011 2012 2013 655 590 1,773 2,453 3,327 859 8 Paper and Printing Industry 68 46 258 1,307 1,169 536 9 Non-Ferrous Mineral Industry 20 28 137 146 874 523 10 Electricity, Gas, and Water 349 1,429 1,865 1,515 2,222 430 Total 10,816 16,215 19,475 24,565 28,616 14,288 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 34

Jakarta FDI Realization 2009-2014S1) 54% of FDI are located in Java in 2014S1) and 61% in 2013 7% 3% 5% 12% 11% 14% 15% 12% 10% 10% 13% 20% 87% 71% 63% 56% 61% 54% 2009 2010 2011 2012 2013 2014S1) FDI Realization per location Economic corridor rank based on investment realization USD million) 2014S1) Excluding oil, gas and financial sectors Rank Economic Corridor 2009 2010 2011 2012 2013 2014S1) 1 Java 9,371 11,499 12,325 13,660 17,325 7,707 2 Kalimantan 284 2,011 1,919 3,209 2,773 2,793 3 Sumatera 777 747 2,077 3,729 3,395 2,058 4 Papua and Maluku 9 596 1,487 1,333 2,735 795 5 Bali and NT 234 503 953 1,127 889 553 6 Sulawesi 142 859 715 1,507 1,498 381 Total 10,816 16,215 19,475 24,565 28,616 14,288 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 35

The US s investment doubled between 2012 and 2013 In 2013, the US was the 3 rd biggest investor; It ranked 4 th in the 1 st half of 2014 6000 5000 4000 3000 2000 1000 0 2010 2011 2012 2013 FDI Realization in Indonesia by Origin Country Top-10 Countries Based on Capital Expenditure USD million) in 2014S1) Excl. oil, gas, and financial sectors Rank Country 2010 2011 2012 2013 2014S1) 1 Singapore 5.565 5.123 4.856 4.671 3.394 2 Japan 713 1.516 2.457 4.713 1.542 3 Malaysia 472 618 530 711 717 4 United States 931 1.488 1.238 2.436 663 5 South Korea 329 1.219 1.950 2.205 655 6 UK 276 419 934 1.076 646 7 Netherlands 608 1.354 967 928 605 8 Australia 214 90 744 226 450 9 Mauritius 23 73 1.059 780 431 10 British Virgin Islands 1.616 517 856 786 368 Total Top-10 Countries) 10.747 12.417 15.590 18.532 9.470 Total 97Countries) 16.215 19.475 24.565 28.616 14.288 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 36

>90% of the US s FDI in Indonesia flowed to primary sectors, Mining is still dominating FDI Realization in Indonesia by Sector Top-10 Sectors Based on Capital Expenditure USD million) in 2014S1) Excl. oil, gas, and financial sectors 3,000 2,500 2,000 1,500 1,000 500-2010 2011 2012 2013 Component of FDI Realization Based on Group of Sectors 2010 2011 2012 2013 S1 2014 primary secondary tertiary Rank Sector 2010 2011 2012 2013 2014S1) 1 Mining 766,9 1.336,5 1.138,1 2.233,8 616,0 2 Food Industry 19,5 17,2 2,1 55,7 21,5 3 Rubber and Plastic Industry - 3,3 0,1 1,7 6,6 4 Electricity, Water, and Gas 0,3 0,3-0,3 4,8 5 Other Services 3,0 1,5 14,4 3,8 3,9 6 Basic Chemical Industry 3,7 10,4 9,4 20,9 3,8 7 Transportation Industry - 3,5 48,8 81,6 3,7 8 Trade and Repair 132,2 106,7 2,8 5,0 2,3 9 Basic Metal, Machinery and Electronics 1,2 1,7 4,0-0,2 10 Transport, Storage and Communication - 0,2-0,1 0,2 Others 4,2 6,5 18,6 32,9 0,2 Total All sectors) 930,9 1.487,8 1.238,3 2.435,8 663,1 The Investment Coordinating Board of the Republic of Indonesia Source: BKPM, 2014. 37

USA s Investment to the world 2009-2013 An 18% increase in 2012-2013 56% 12% 10% 7% 7% 8% Coal, Oil and Natural Gas Communications Software & IT services Automotive OEM Alternative/Renewable energy Investment Realization Based on Capital Expenditure USD Million) Excl. financial sectors Rank Destination % 1 China 14.2% 2 Canada 6.8% 3 UK 6.7% 4 India 6.1% 5 Brazil 5.9% 6 Mexico 5.7% 7 Australia 2.8% 8 Singapore 2.3% 9 Germany 2.3% 10 Ireland 1.8% 29 Argentina 0.9% 30 Indonesia 0.9% 31 Taiwan 0.9% Total 163 countries) 100.0% The Investment Coordinating Board of the Republic of Indonesia 150,128 124,001 132,830 13,956 14,822 To the world To ASEAN 89,989 105,757 7,082 5,486 5,095 2009 2010 2011 2012 2013 Rank Company % 1 ExxonMobil 4.8% 2 Chevron Corporation 3.4% 3 General Motors GM) 3.2% 4 General Electric GE) 2.9% 5 Ford 2.7% 6 Coca-Cola 1.7% 7 First Solar 1.7% 8 Starwood Hotels & Resorts 1.4% 9 Microsoft 1.3% 10 Level 3 Communications 1.2% Others 75.6% Total 4,946 companies) 100.0% Source: Financial Times, 2014 38

USA s Investment to ASEAN 2009-2013 ASEAN received 7.7% of total FDI 150,128 124,001 132,830 To the world 89,989 105,757 55% 18% 8% 7% 6% 6% Coal, Oil and Natural Gas Electronic Components Chemicals Communications Metals Others Investment Realization Based on Capital Expenditure USD Million) Excl. financial sectors Rank Destination % 1 Singapore 30.7% 2 Vietnam 18.3% 3 Malaysia 16.3% 4 Indonesia 11.8% 5 Philippines 11.7% 6 Thailand 8.9% 7 Cambodia 1.4% 8 Myanmar 0.5% 9 Brunei 0.3% 10 Laos 0.1% Total 10 countries) 100.0% To ASEAN 13,956 14,822 7,082 5,486 5,095 2009 2010 2011 2012 2013 Rank Company % 1 IBM 1.1% 2 Convergys 1.4% 3 Cargill 0.5% 4 Coca-Cola 3.8% 5 PepsiCo 0.9% 6 Procter & Gamble P&G) 1.6% 7 Crown Holdings 3.0% 8 General Electric GE) 0.4% 9 Arkansas Best Corporation 1.2% 10 Omnicom Group 0.2% Others 86.0% Total 712companies) 100.0% The Investment Coordinating Board of the Republic of Indonesia Source: Financial Times, 2014 39

Products Compliance International Markets David SIOW Regional Manager, APJC September 2014 CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 1

Market Surveillance Regime in the EU EU has implemented a Market Surveillance regime Products may be checked AFTER they have been placed on the market but NOT before Manufacturer is fully responsible ALL is regulated by EU Directives CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2

EU Directives EU Directives Adopted by 28 EU member states + 4 EFTA countries >95% of business in Europe Most important Directives for Cisco: R&TTE Directive 1999/5/EC) EMC Directive 2004/108/EC) LVD Directive 2014/35/EU) RoHS Directive 2011/65/EC) WEEE Directive 2002/96/EC) MDD Directive 93/42/EEC) CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 3

Placing on the market - EU Member states shall not prohibit, restrict or impede the placing on the market and putting into service in their territory of apparatus bearing the CE marking Products bearing CE mark cannot be stopped at customs, means they can freely travel into the EU and within the EU CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 4

Market Surveillance - EU Market Surveillance and Market Enforcement is responsibility of member states Market Surveillance Authorities do random compliance checks AFTER products are already placed on the market This is opposite to a Type Approval Regime where product compliance is verified BEFORE entering the market CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 5

FCC Approval Schemes - USA Declaration of Conformity DoC) : Generally used for Class B devices such as computer peripherals, Analog FXO/modem, DSL, ISDN, T1, specific compontents such as mother boards and power supplies as well as for some radio receivers. Product must be tested in an Accredited Lab Verification : Generally used for Class A type devices non-radio) and some Class B devices non-computer peripheral) Certification: Used for Radio based products. Test reports sent to TCB for reviews, and issues of FCC grant. Telecom proudcts are done under a SDoC and not reviewed by either the FCC or TCB Test reports from any accredited test labs based on ISO 17025. CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 6

Import Customs - Enforcement As part of the importing process, the importer completes a FCC 740 Form declaring the proudct is either approved for importation and sale in the US, coming in for engineering purpose, repair, or will be sold or exported. The FCC Enforcement Bureau as well as the Authorization lab investigate reports of non compliant products being imported, as well as reported cases of interference. CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 7

IDA Approval Schemes - Singapore Enhanced Simplified Equipment Registration: Mainly Customer Premises Equipment CPE) such as Analog FXO >2 ports), ISDN, WiFi, SRD/Low Power. SDoC process Simplified Equipment Registration: Equipment such as ADSL, Cable modem, 2G/3G/LTE. Test reports from an Accredited Lab or Manufacturer Lab or certificates, includes SDoC. General Equipment Registration: Equipment such as Cellular Base station, Analogue land mobile, Wireless Broadband Access Equipment. High potential for causing interference and new technologies. Test reports from an Accredited Lab or Manufacturer Lab, includes SDoC.. CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 8

Market Surveillance - Singapore For post market surveillance, IDA may require the supplier to submit the test results or evidence of equipment certification as proof of conformity with the applicable IDA Technical Specifications. CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 9

CQ JH 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential 10

Mobile Phone Taxes: Implications for Encouraging Investment 2 October 2014 Jakarta, Indonesia Indonesia ICT Consultative Forum 3 rd Executive Committee Meeting Chris Zull, Spectrum Director Asia Pacific Restricted - Confidential Information GSM Association 2014 All GSMA meetings are conducted in full compliance with the GSMA s anti-trust compliance policy GSMA 2014

INTRODUCTION TO THE GSMA About the GSMA The GSMA represents the interests of mobile operators worldwide. Spanning more than 220 countries, the GSMA unites nearly 800 of the world s mobile operators with 250 companies in the broader mobile ecosystem, including handset and device makers, software companies, equipment providers and Internet companies, as well as organisations in industry sectors such as financial services, healthcare, media, transport and utilities. The GSMA also produces industry-leading events such as Mobile World Congress and Mobile Asia Expo. Mobile taxation GSMA leads the global conversation on mobile taxation as part of our Digital Inclusion programme Over the last decade, we ve produced numerous studies that describe and measure the mobile taxation barrier GSMA s Digital Inclusion programme aims to expand connectivity by reducing the barriers to mobile Internet adoption GSMA 2014

A NUMBER OF CONSUMER TAXES APPLY TO MOBILE OWNERSHIP Value Added Tax VAT ) or General Sales Tax GST ): these are consumer taxes incurred when purchasing every component of owning and using a mobile phone. These taxes are ad valorem and are often expressed as a proportion of the value of the good or service Customs duty and excise taxes on imported goods. In mobile telephony, users in developing countries typically pay import taxes on handsets and other mobile devices. These can either be expressed as a proportion of the handset value or as a fixed sum or both. These also typically apply to imports of SIM cards, which are paid for by MNOs and sold as part of the initial connection service Special taxes on handsets, which in certain countries are still treated as luxury items and often attract high custom duty rates and other special contributions Special communication taxes on mobile usage: a number of countries still impose specific taxes on consumers for using mobile services Other telecoms specific taxes, such as SIM activation taxes or other taxes on connection, e.g. in Bangladesh and Turkey, and monthly contributions for post-pay customers Other special taxes, for example a tax on mobile operators gross revenues GSMA 2014

TAX CONSTITUTES A SIGNIFICANT PROPORTION OF MOBILE OWNERSHIP COSTS Total Cost of Mobile Ownership TCMO) includes handset costs, connection costs, and call, SMS and broadband usage costs. Each of the cost components identified above includes the actual component price as well as taxes paid by consumers. A 2011 study in 111 countries showed that the proportion of TCMO account for by tax had increased to an average of 18.11% and was higher than this in many developing countries. Deloitte/GSMA 2011, Global Mobile Tax Review ) Handset costs act as a barrier to the benefits of mobile usage and taxes constituted 23% of this cost on average. In eleven countries tax constituted over 40% of the handset cost. TCMO Handset Connection Mobile Broadband Calls SMS Handset Cost Tax Connection Cost Tax Broadband Usage Price Tax Call Usage Price Tax SMS Usage Price Tax VAT $) VAT $) VAT $) VAT $) VAT $) Customs Duty Telecoms Specific Tax Telecoms Specific Tax Telecoms Specific Tax Telecoms Specific Tax Telecoms Specific Tax Total Taxes VAT $), Customs Duty, Telecoms Specific Tax Service cost without tax Total Taxes as a proportion of service costs GSMA 2014

HANDSET/SMARTPHONE COSTS REPRESENT THE HIGHEST BARRIER TO MOBILE TELEPHONY AND MOBILE BROADBAND In the majority of developing countries, fixed access telephony is not as extensive due to underdeveloped networks. Therefore, mobile telephony represents the universal method of access to telephony and broadband To access mobile telephony, owning a mobile handset is a necessary requirement Equally, smartphones are required to access mobile broadband However, acquiring a handset represents a significant one-off cost for consumers This may negatively affect the poorest sectors of the population People on low incomes and those living in rural areas may not be able to afford handsets GSMA 2014

INCREASING TAXES ON HANDSETS RAISES BARRIERS TO MOBILE TELEPHONY AND MOBILE BROADBAND Handset prices and in the last months smartphones prices have dropped significantly, making it more affordable for the largest sectors of the population to become connected Indonesia currently has 317 million mobile connections, 29.3% of which are mobile broadband. With the right regulations in place, we expect mobile broadband to account for 70.3% of a total of 436 million connections GSMA Intelligence, Indonesia data Q2 2014) However, this positive price reduction effect could be lost due to the introduction of a 20% luxury tax on mobile devices in Indonesia By increasing taxation on handset ownership, there is a risk that many consumers may be priced out of mobile broadband at a time when lower smartphone prices may expand mobile broadband penetration. The local handset industry has indicated that smartphone sales could fall by as much as 50% due to the tax Those on lower incomes and living in rural areas are likely to be most negatively affected by this tax increase, with negative implications on the digital-rural divide and on inequality 20% luxury tax on mobile devices Increase in the cost of device acquisition. The higher price represents a barrier to access to mobile services. Low income consumers are especially hurt. Service adoption slows. Access to high-end LTE handsets is limited, slowing uptake of mobile broadband GSMA 2014

LOWERING HANDSET TAXATION HAS BEEN PROVED TO INCREASE MOBILE PENETRATION AND MOBILE BROADBAND ADOPTION Handset sales and mobile penetration before and after the handset VAT removal The Kenyan government recognised that handset price represented a barrier to the development of the sector In August 2009, the 16% VAT on mobile phone handsets was removed Handset purchases have increased by more than 200% since the removal of VAT Mobile connection penetration has increased from 50% to 70% of the population in Kenya since the beginning of 2009 Source: GSMA Intelligence GSMA 2014

EVIDENCE SHOWS THAT AIRTIME TAXES ALSO HAMPER USAGE AND MOBILE OPERATORS INVESTMENT In 2009, as part of its response to the economic crisis, the Croatian government imposed a 6% tax on mobile gross revenues related to voice and text messages. This increased the consumer taxation as a proportion of total cost of mobile ownership to 28% - the highest taxation levels in the region. In the year immediately following the introduction of the tax, Croatia suffered the first ever fall in voice and text message volumes. Falling revenues and reduced demand led to a reduction in investment in network expansion and other capex items. Mobile operator capital investment in Croatia, HRK millions Total minutes of mobile usage in Croatia, millions Source: GSMA/Deloitte 2012), Mobile telephony and taxation in Croatia Source: GSMA/Deloitte 2012), Mobile telephony and taxation in Croatia GSMA 2014