Internet Shutdowns in Indonesia: Documented Events and Technical Methods

Indonesia has experienced multiple documented internet shutdowns and throttling events over the past decade, typically coordinated during elections, civil unrest, and standardized testing periods. Unlike the sustained near-total blackouts seen in countries such as Myanmar or Sudan, Indonesian shutdowns have been more selective in scope—targeting specific regions, platforms, or application categories rather than nationwide disconnections. Understanding the technical methods and regulatory context behind these events requires careful distinction between documented incidents and publicly available technical details.

The legal framework enabling internet control in Indonesia rests primarily on Law No. 11 of 2008 on Information and Electronic Transactions (ITE Law) and the 2016 amendments, which provide broad grounds for content removal and access restriction. The Ministry of Communication and Information Technology (MOCIT) and the Directorate General of Post and Telecommunications (DGPT) oversee implementation. Internet Service Providers (ISPs) receive removal requests and blocking orders through formal government channels, and compliance is generally swift. Unlike China's formal Golden Shield architecture or Russia's SORM system, Indonesia's blocking infrastructure operates through distributed ISP-level filtering without published technical specifications.

Documented shutdowns include the 2019 post-election unrest, when social media platforms including Facebook, Instagram, WhatsApp, and Telegram experienced service degradation and partial blocking across Java and other regions. According to reports from Access Now and KeepItOn coalition documentation, the 2019 incident lasted approximately 24 hours and was justified as a response to calls for violence and misinformation. More recently, throttling of social media platforms and messaging services occurred during the 2024 election period, though the scope and technical implementation remain less formally documented in public sources.

Regional and platform-specific blocking has become more common than nationwide shutdowns. In 2016, internet access to online exam portals was deliberately throttled during the National Examination (UN), affecting millions of students. The blocking targeted specific IP ranges and domain names associated with exam systems rather than entire ISP connections. In 2022, authorities blocked access to certain gambling and illicit marketplace domains using DNS filtering and IP blacklisting—techniques that operate at lower technical complexity than deep packet inspection but require ISP coordination.

The blocking techniques employed by Indonesian ISPs appear to rely primarily on DNS response manipulation (where DNS queries for blocked domains receive false or null responses) and IP-level filtering at the ISP gateway. Evidence from OONI (Open Observatory of Network Interference) measurements during documented throttling events suggests that blocking is implemented at multiple layers: DNS servers operated by major ISPs return NXDOMAIN responses for targeted domains, while simultaneous IP-layer filtering prevents direct connections to known server addresses. These are comparatively crude techniques that do not require real-time deep packet inspection (DPI) or Server Name Indication (SNI) inspection—technologies that would demand greater ISP investment and technical sophistication.

Throttling, distinct from outright blocking, has been observed during examination periods and election-related tensions. Throttling reduces bandwidth available to specific protocols or services rather than blocking them entirely. This approach allows authorities to claim that services remain accessible while rendering them functionally unavailable. OONI's data from Indonesian vantage points has documented periods of degraded Tor connectivity and reduced speeds to certain messaging applications, consistent with application-level rate limiting rather than protocol-level blocking.

The documented impact of these incidents is significant. Access Now's Shutdown Tracker recorded multiple events affecting millions of users. The 2019 social media restrictions prevented real-time communication during active civil unrest, limiting citizens' ability to organize, document events, or access independent information. For the 2024 election period, no comprehensive third-party audit of blocking scope has been published, leaving exact impact figures uncertain—though user reports and news coverage indicated disruptions to services like TikTok and Instagram in key regions.

For users seeking to circumvent DNS and IP-level blocking, several transport protocols operate effectively under these conditions. OpenVPN and WireGuard, when configured to use non-standard ports and encryption, typically bypass ISP-level DNS and IP filtering because they establish encrypted tunnels that ISPs cannot selectively identify without DPI. REALITY (a protocol configuration in the Xray client) and obfuscation-focused transports like obfs4 are similarly effective against ISP filtering that lacks DPI capability. Shadowsocks and V2Ray/Xray remain functional where ISP infrastructure does not perform protocol-level analysis. Tor pluggable transports such as Snowflake, which disguises Tor traffic as ordinary HTTPS connections, can be effective where SNI inspection is not deployed. Encrypted DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) bypass ISP DNS poisoning but require that the user's ISP does not block traffic to known DoH/DoT resolver IP addresses.

Indonesia's shutdowns represent a middle ground between no infrastructure-level filtering and the invasive, continuous DPI-based systems deployed in some authoritarian jurisdictions. The reliance on DNS and IP-level techniques suggests that large-scale capital investment in sophisticated monitoring infrastructure has not yet occurred—though technological capability and political will for such expansion clearly exist. Understanding this technical baseline matters for anyone assessing Indonesia's actual internet surveillance and censorship capacity versus its potential.