Cybersecurity Regulation Against Ransomware Attacks on National Critical Infrastructure: A Legal Analysis of Indonesia’s Regulatory Preparedness

Abstract

Ransomware attacks on national critical infrastructure have emerged as one of the most destructive cyber threats in the digital era, endangering the continuity of essential public services, including energy, healthcare, finance, and government systems. Indonesia has experienced a significant increase in ransomware incidents in recent years, culminating in a major attack on the Pusat Data Nasional Sementara (PDNS) that disrupted hundreds of government services. This study employs a normative-comparative approach to examine two fundamental issues: (1) the extent to which Indonesia’s existing cybersecurity regulatory framework, particularly Presidential Regulation No. 82 of 2022 concerning the Protection of Vital Information Infrastructure, is effective in addressing ransomware threats; and (2) why strengthening the regulatory framework for national critical infrastructure security has become an urgent priority requiring comprehensive assessment. The findings reveal that the current regulatory framework still contains several critical weaknesses, including fragmented institutional authority, the absence of binding technical cybersecurity standards, and limited coordination in incident response mechanisms. This study recommends the development of a comprehensive sector-specific cybersecurity regulatory framework and the establishment of a national Computer Emergency Response Team (CERT) with clearly defined legal authority.