Indonesia’s Covid tracker app PeduliLindungi: To care for and protect? · Global Voices
Image via EngageMedia
This article by <PERSON> is part of Pandemic of Control, a series of articles that aims to further public discourse on the rise of digital authoritarianism in the Asia-Pacific amid COVID-19. Pandemic of Control is an initiative by EngageMedia, in partnership with CommonEdge. This edited version of the article is republished in Global Voices under a content partnership.
As the COVID-19 pandemic continues in Indonesia, the government’s PeduliLindungi application remains an integral part of daily life. Named by merging the Indonesian words for “care” (peduli) and “protect” (lindungi), the app claims to do just that, tracking and screening COVID-19 statuses, and providing resources and information on COVID-19. It has become commonplace in everyday life as most restaurants, businesses, and all public transportation require users to “check-in” by scanning a QR code via the app.
Its existence has become synonymous with and inseparable from the pandemic itself in Indonesia. But people’s reliance on the information, access, and resources it offers to protect from COVID-19 may come at the expense of data privacy rights.
As of writing, over 50 million people have downloaded the app from the Google Play Store, making it the top medical app in the country. But, as more and more users register and use the app, the severity of concerns regarding the app’s security and extensive tracking have also increased.
In September 2021, Indonesian President <PERSON>’s vaccine certificate was leaked online, just a month after the suspected breach of the Indonesia Electronic Health Alert Card (eHAC) app, which compromised the data of 1.3 million users. The leaks have since spurred public discourse on data security and the amount of personal information collected and stored by PeduliLindungi.
Following the breaches, the Indonesian government has since claimed that the app has secured the data of all users, a response not unlike previous reassurances it has given, after similar breaches in the past. PeduliLindungi thus potentially poses a bigger threat due to its frequent usage, large user base, and the unique type of information stored, all while leaving people with little to no legal recourse to protect their data.
A daily ritual: How PeduliLindungi controls people's freedom of movement
While the app’s usage varies between regions, there is no other government platform that reaches its scale and scope. 803
The app’s main interface has also been integrated into 15 other consumer-oriented apps; there are even plans to turn it into a digital wallet.
To enter any public place in Indonesia, one must first scan the location’s required QR code through PeduliLindungi or an interconnected app, such as Jakarta’s regional app JAKI and the Indonesian startup giant GOJEK. The collected information ­— such as the user’s legal name, ID number, susceptibility to COVID-19, current location, and time spent within the facility — are then logged and stored on PeduliLindungi servers. Those who have not formally registered for PeduliLindungi or the other interconnected apps are allowed to enter public spaces only if they show valid vaccine certificates, which are also hosted by PeduliLindungi and must be accessed through its portals.
When an Indonesian is not formally part of the PeduliLindungi system, there are a number of challenges and hurdles disturbing their daily routines. For example, without a ticket to get vaccinated — whether it from choice or vaccine unavailability — one will not be allowed to freely use and enter bus stops, train stations, airports, markets, hospitals, office buildings, and other public spaces. The unvaccinated have even reported difficulties in getting treatment from medical facilities, which rely on the PeduliLindungi database to access COVID-19 status.
Using the app is now not only necessary, but socially mandatory in order to keep freedom of movement. Such measures were justified to curb the spread of COVID-19, despite questions regarding their ability to do so.
PeduliLindungi users can request for vaccine certificates via the website. As long as you have a full name, ID number, date of birth, and date and type of vaccination, you can access anyone’s vaccine certificates. Screenshot by <PERSON>
How secure is the data?
There are also numerous unanswered questions surrounding the digital security of PeduliLindungi. While no classified information stored online can ever be completely secure, the Indonesian government has yet to take adequate action to ensure the security of its various databases. 607