After days of intense negotiations with the Indonesian government, Alphabet, Meta and more than 9,000 technology firms—8,900 of which are local—finally complied with Indonesia’s new licensing regulations last month to avoid being banned from operating in one of the world’s largest and most dynamic internet economies. Meanwhile, some companies that failed to meet the deadline (including Steam and PayPal) faced a nasty surprise in late July when they were temporarily blocked from their hundreds of thousands—if not millions—of users in Indonesia.

The regulation, formally known as the Minister of Communication and Informatics Regulation No. 5 of 2020 on Private Electronic System Operators (MR5), requires digital platforms to apply for licences to operate in Indonesia. But to gain such a licence, they must consent to several terms, including agreeing to comply with government requests to access user data and take down online content.

While the regulation was passed in November 2020, digital platforms were initially under no pressing obligation to register. But on 22 June, the Communication and Informatics Ministry announced a hard deadline of 20 July, threatening that internet service providers would block access to unregistered platforms.

Digital transformation is one of the four pillars of Indonesia’s presidency of this year’s G20, and officials are using its momentum to accelerate implementation of a long list of cyber legislation and policies that have been in the pipeline, including a draft bill on data protection, a national cybersecurity strategy and MR5.

At its core, MR5 paves the way for Indonesia to expand its reach in cyberspace by solidifying its power to control citizens’ data and online activities. By implementing this regulation, Indonesia has joined a host of nations—from Germany to India—in imposing a legal framework that forces platforms to accept local jurisdiction over their content and users’ data policies.

Indonesian officials say that the regulation will make taxing foreign tech firms easier. With greater access to transaction data, the government can impose income tax on foreign digital platforms not located in Indonesia, on top of the value-added tax already imposed on digital goods. Indonesia’s internet economy is growing rapidly, and the government sees online transactions as a potential source of revenue. In the first half of 2022 alone, US$166.8 million in value-added and income taxes was collected from digital companies and services in Indonesia.

There are also other economic implications of MR5 that are not explicitly mentioned. For instance, tech firms are likely to be forced to expand their content-moderation capabilities, which would help with state goals of job creation in the tech sector. There are also expectations that foreign tech platforms will set up businesses in Indonesia, which will also help to develop human capital and have spillover benefits for infrastructure development.

While these economic imperatives are fair justifications for MR5, especially considering the government’s focus on post-Covid-19 economic recovery, social and political concerns still leave it potentially risky for individual rights. MR5 has prompted backlash from civil-society organisations, which fear that the new regulation may impinge on civil liberties. Thousands of Indonesians have signed a petition calling for the regulation to be revoked. The registration website was even hacked before being taken down temporarily in late July.

The requirement for platforms to consent to provisions with clear authoritarian undertones has also come under fire. Plenty of coverage was given to Article 9 of the regulation, which allows the government to take down content that may ‘disturb public order’. Such loosely worded provisions are common in Indonesian legislation governing speech in cyberspace and have been misused by authorities to arrest individuals accused of blasphemy and treason.

Most worryingly, MR5 includes a controversial provision allowing the government to demand access to electronic data without needing a court order. This isn’t the first time the government has sought to gain such access; in 2019, a similar provision was included in a government-sponsored cybersecurity bill. While some digital platforms are likely concerned about the impact of this provision on existing privacy laws, the absence of a mechanism for appealing against requests to take down content has made their decision even more difficult.

Responding to fears that the regulation may be used to curb civil liberties, officials tried to reassure the public that it would not be misused and instead would allow the government to respond more quickly to the growth of illegal companies, like unregistered peer-to-peer lenders. The ability to take down content will also empower the government to quickly remove material produced by criminal organisations, separatist movements and terrorist organisations.

However, Indonesia’s internet regulations have been weaponised to target activists in the past. For example, Indonesians have been arrested under the notorious Electronic Transaction and Information Law, which many organisations, politicians and government authorities have used to counter accusations of misconduct. The concern that MR5 may be similarly abused therefore has some validity.

At its core, MR5 is about Indonesia’s attempt to assert state power over its cyberspace. The regulation positions the government to take advantage of a rapidly expanding digital economy—estimated to be worth US$124 billion by 2025. Yet the government must also work to foster public trust in the internet as an avenue for communication and trade. While this partly means ensuring Indonesians can trade safely online, it also means ensuring that authorities don’t misuse their power by either infringing on people’s right to freely express themselves or illegally accessing private user data for malign purposes.