The Critical Need for Independent Digital Authentication and Third-Party Verification in Indonesia’s E-Commerce Ecosystem

The rapid digitization of Indonesia’s economy, while a catalyst for financial inclusion, has unveiled profound vulnerabilities in the architecture of trust. As digital transactions become the primary medium for everything from retail banking to peer-to-peer lending, the reliance on self-claimed security measures by platform operators has come under intense scrutiny. During the recent "The Forum" discussion held in Jakarta, experts converged on a singular, urgent conclusion: self-verification is no longer sufficient to protect consumers or provide a robust foundation for legal recourse. The path forward necessitates a shift toward mandatory third-party verification through Electronic Certification Providers (PSrE) and Certified Electronic Signatures (TTE), ensuring that the digital identity of users is validated by an independent, cryptographic authority.

The Erosion of Trust: Beyond Self-Claiming Systems

The legal framework governing digital transactions in Indonesia has long been anchored by the Law on Electronic Information and Transactions (UU ITE). However, legal experts argue that the practical application of this law is lagging behind technological reality. Edmon Makarim, former Dean of the Faculty of Law at the University of Indonesia, highlights the inherent risk in the "self-claiming" model currently employed by many digital platforms. In this model, companies determine the identity of their users through proprietary, internal systems—a process that lacks the necessary neutrality to hold weight in a court of law.

"Article 15 of the UU ITE is clear in its intent, yet the enforcement remains problematic when platforms act as both the gatekeeper and the arbiter of identity," Makarim explained. "When two parties meet in a digital space without physical proximity, the verification process must be anchored in immutable, third-party authentication. By relying on asymmetric cryptography managed by a certified PSrE, we move from subjective platform claims to objective, legally binding evidence."

The issue is not merely technical; it is a fundamental challenge to the rule of law. Without independent verification, a digital transaction is essentially a "black box" where the platform’s internal logs are the only record of truth. In the event of a dispute, this asymmetry often leaves consumers defenseless, as they cannot challenge the platform’s internal data with the same level of legal standing.

The Technical Anatomy of Authentication

The complexity of modern cyber threats requires a layered approach to security. Yudho Giri Sucahyo, a prominent information technology expert, emphasizes that trust in cyberspace is not a static state but a dynamic process that must be proven repeatedly. The transition from simple password-based security to multi-factor authentication (MFA) is merely the first step.

"We are seeing an era where simple authentication is failing," Sucahyo noted during the forum. "When a user switches devices, the systems that rely on legacy verification methods often struggle to re-authenticate the user accurately. This creates a window of opportunity for account takeovers—a catastrophic event where a malicious actor assumes the identity of a legitimate user to execute fraudulent financial transactions."

The current security stack, according to experts, should ideally include a combination of biometric scanning, behavioral analytics, and, crucially, TTE Tersertified (Certified Electronic Signatures). The latter is governed by cryptographic standards that link a digital identity to a real-world person through a government-vetted process. Without this, platforms remain vulnerable to "identity spoofing," where sophisticated automated bots or human bad actors circumvent internal security protocols that prioritize convenience over strict identity verification.

The Human Cost: Case Studies in Financial Fraud

The consequences of failing to implement rigorous verification are not merely theoretical; they are causing significant financial and personal distress. Zico L. Djagardo, an advocate and victim of data misuse, provided a harrowing account of how the absence of independent verification allowed a financial platform to compromise his identity.

"My experience with a peer-to-peer (P2P) lending platform was a wake-up call," Djagardo testified. "Through a series of internal lapses and a total lack of third-party validation, my personal data was weaponized to create fictitious financial obligations. When I approached the platform, it became clear that their internal verification was not just weak—it was non-existent. They admitted to bypassing third-party PSrE services to minimize operational costs. This is a business model built on the exploitation of user data."

The implications for the victims are long-lasting. In Indonesia’s credit-scoring ecosystem, fraudulent transactions linked to a victim’s identity can destroy their credit rating, effectively barring them from mainstream banking services. Djagardo argues that the lack of accountability from platforms has created a "race to the bottom," where cost-cutting measures supersede consumer protection. He calls for the Constitutional Court’s intervention to be codified into hard, technical requirements, positioning the PSrE not just as a service provider, but as a mandatory "referee" that ensures transparency during disputes.

Legislative Shifts and the Revision of PP 71/2019

The Indonesian government has acknowledged the growing urgency of this crisis. Aulia, representing the Directorate of Digital Space Supervision Strategy and Policy at the Ministry of Communication and Digital (Komdigi), confirmed that the state is currently in the process of revising Government Regulation (PP) Number 71 of 2019.

This legislative update is expected to be a watershed moment for the digital economy. The revision aims to formalize the role of digital identities and mandate higher standards for high-risk transactions. "We are drafting these revisions with a clear goal: to establish a national digital identity framework that provides legal certainty for both industry players and the public," Aulia stated.

The anticipated regulations will likely include:

1. Mandatory Third-Party Verification: Requiring all financial service providers to integrate with licensed PSrE services for high-risk identity verification.
2. Standardized TTE Protocols: Establishing a unified technical standard for electronic signatures across all sectors to ensure interoperability and legal validity.
3. Liability Frameworks: Defining the clear legal liability of platforms when they fail to employ standardized verification, effectively ending the era of self-claiming immunity.

Broader Implications: A Maturing Digital Economy

The push for independent verification is symptomatic of a maturing digital economy. In its infancy, the Indonesian digital market focused on rapid adoption and user acquisition. However, as the ecosystem reaches a saturation point, the focus must shift toward resilience and reliability.

The integration of PSrE and TTE into the standard operating procedure for digital platforms will have several downstream effects:

• Increased Compliance Costs: Platforms that previously skimped on security will face higher operational costs, which may consolidate the market, favoring more robust and security-conscious players.
• Enhanced Consumer Confidence: A standardized, secure environment will likely increase the participation of risk-averse demographics in digital finance, ultimately deepening financial inclusion.
• Strengthened Legal Precedents: With clear technical standards, the judiciary will have a more objective framework to resolve digital disputes, reducing the time and cost associated with litigation.

A Timeline of Digital Identity Evolution in Indonesia

The journey toward a secure digital identity in Indonesia has been marked by several key phases:

• 2008: The enactment of the original UU ITE (Law No. 11 of 2008) provided the initial legal recognition for electronic transactions, though it lacked the technical depth required for modern verification.
• 2019: The introduction of PP 71/2019 provided a more comprehensive framework for electronic system providers, yet left significant gaps regarding the mandatory use of third-party verifiers.
• 2022-2023: The rise in P2P lending fraud and data breaches catalyzed public outcry, leading to the formation of the Data Protection Act (UU PDP).
• 2024-Present: The ongoing revision of PP 71/2019 represents the current attempt to harmonize identity, security, and legal accountability into a single, cohesive policy framework.

Conclusion: The Path Forward

The consensus among experts and policymakers is clear: the digital ecosystem in Indonesia has reached a point where trust can no longer be a matter of corporate policy; it must be a matter of technical necessity. The shift toward independent, third-party verification is not merely an IT upgrade—it is a social contract renewal. By embedding PSrE and TTE services into the core of digital transactions, Indonesia is laying the groundwork for a safer, more transparent, and ultimately more prosperous digital future.

As the government moves forward with the revision of PP 71/2019, the involvement of stakeholders—from tech developers and legal scholars to consumer advocacy groups—will be essential. The goal is to move beyond the era of self-claiming and into a new phase of digital maturity, where the validity of a transaction is defined not by the platform’s claim, but by the strength of its verified identity. Only then can Indonesia truly claim that its digital economy is not just growing, but becoming increasingly secure for every citizen.