DDoS Attacks against e-Government

117 Pages·2013·0.74 MB·English

by  Arindra Yudha Oktoberry

The Role of The Law in Combating DDoS Attacks against e-Government
A Comparative Analysis of The Substantive and Procedural Cybercrime Law between
A ThesiIsn odf oMnaesstiear aPnrodg rTahme iUn nLaitwe dan Sdt aTteecsh nology
Tilburg University
by
Arindra Yudha Oktoberry
594141

Supervisors:
Prof. Dr. E. J. Koops
M.A.Dizon, LL.M

TILBURG

2013
TABLE OF CONTENTS

Chapter 1: Introduction .............................................................................................................. 5
1.1. Background ..................................................................................................................... 5
1.2. Research Question ........................................................................................................ 14
1.3. Methodology ................................................................................................................. 15
1.4. Thesis Structure ............................................................................................................ 15
Chapter 2: E-Government, Information System, Information Security, and
Cybercrime Attacks ................................................................................................................. 17
2.1. Definition and Classification of E-Government ........................................................... 17
2.2. The Development of E-Government in the US and Indonesia ..................................... 19
2.3. Information System ....................................................................................................... 22
2.4. Information Security ..................................................................................................... 23
2.5. Cybercrime Attacks: Distributed Denial of Service (DDoS) ........................................ 27
Chapter 3: Contemporary Regulatory Framework of Information Security
and Cybercrime in Indonesia…………………………………………………………………34
3.1. The Recent Substantive Cybercrime Law in Indonesia………………………………34
3.1.1. Content-Related Crimes under The Law No. 11………………………………….37
3.1.2. Crimes of Illegal Access…………………………………………………………..38
3.1.3. Crimes of Illegal Interception……………………………………………………..40
Page 1 of 116
3.1.4. Data Interference Delinquency………………………………………………………41
3.1.5. The Offense of System Interference…………………………………………………43
3.1.6. Misuse of Devices…………………………………………………………………....44
3.1.7. Computer-related Forgery...………………………………………………………….45
3.1.8. Computer-related Fraud….…………..………………………………………………46
3.2. Procedural Cybercrime Law in Indonesia……………………………………………….47
3.2.1. Investigation Powers…………………………………………………………………48
3.2.1.1. Digital Search and Seizures……………………………………………………..49
3.2.1.2. Network Search and Remote Search……………………………………………52
3.2.1.3. Interception or Wiretapping Power……………………………………………..52
3.2.1.4. Investigating Telecommunication……………………………………………….54
3.2.1.5. Other Legal Competences………………………………………………………56
3.2.2. Arrest and Detention…………………………………………………………………56
3.2.3. Prosecution, Pre-trial Proceedings, Trial Proceedings, and Judgment………………57
3.3. Incidents of DDoS Attack on www.beacukai.go.id..........................................................58
3.3.1. Tools and Techniques………………………………………………………………...59
3.3.2. Prior to July 2011…………………………………………………………………….64
3.3.3. Subsequent to May 2011……………………………………………………………..66
Chapter 4: The Contemporary Regulative Framework in relation to Information Security
and Cybercrime in the United States…………………………………………………….69
Page 2 of 116
4.1. The Recent Substantive Cybercrime Law in the United States………………………...69
4.1.1. Content-related Crimes under US Code…………………………………………….71
4.1.2. Crimes of Illegal Access…………………………………………………………….73
4.1.3. Crimes of Illegal Interception……………………………………………………….77
4.1.4. Data Interference Delinquency……………………………………………………...78
4.1.5. The Offense of System Interference………………………………………………...79
4.1.6. Misuse of Devices…………………………………………………………………...82
4.1.7. Computer-related Forgery……………………………………………………...……82
4.1.8. Computer-related Fraud……………………………………………………………..83
4.2. Procedural Cybercrime Law in the United States………………………………………84
4.2.1. Investigation Powers………………………………………………………………...86
4.2.1.1. Digital Search and Seizures…………………………………………………….89
4.2.1.2. Network Search and Remote Search…………………………………………...90
4.2.1.3. Interception Or Wiretapping Power……………………………………………90
4.2.1.4. Investigating Telecommunication………………………………………………91
4.2.1.5. Other Legal Competences…………………………………………………...…93
4.2.2. Arrest and Detention………………………………………………………………...96
4.2.3. Prosecution, Pre-trial Proceedings, Trial Proceedings, and Judgment……………...96
4.3. Case of DDoS Attack in the United States……………………………………………...97
Chapter 5: A Comparison of The US and Indonesian Regulatory Framework in terms of
Page 3 of 116
Information Security and Cybercrime…………………………………………………………101
5.1. Similarities in the American and Indonesian regulation of Information Security
and Cybercrime……………………………………………………………………………..101
5.2. Differences in the American and Indonesian Regulation of Information Security
and Cybercrime……………………………………………………………………………..103
5.2.1. Sources of Cybercrime Law….……………………………………………………103

5.2.2. Material-related Differences……………………………………………………….103
5.2.3. Procedural Law-related Differences……………………………………………….105
5.2.4. Technology-related Differences……………………………………………………106
Chapter 6: Conclusion and Recommendation…………………………………………………108

Page 4 of 116
1. INTRODUCTION
1.1. Background
Technological developments have completely changed our society and world. These changes in society
mean that the technology - especially Information and Communication Technology (ICT) have
transformed our society from an industrial society into an information society.1 While changing the
world, means that in addition to the real world (the physical world), ICT has also formed a virtual world
more commonly known as the cyberworld or cyberspace.2
Accordingly, these changes have not only positive impacts but also negative effects which are
perceivable in daily life. On the one hand, ICT has become a phenomenon that plays a pivotal role in
human life within various fields.3 Businessmen, politicians, private or public employees, professionals,
researchers, teachers, students, and many other people are using ICT as a part of the routine of
domestic and international business as well as in their personal lives. In brief, people now appear to be
subserviently reliant on ICT.

1 AD Elyakov, ‘The Nature of the Modern Information Society’ (2010) 37(1) STIP 60.
2 SW Brenner, ‘Fantasy Crime’, (2008) 11 (1) VJTEL 9. See also SR Sjahdeini, Kejahatan & Tindak Pidana Komputer
[in English: Computer Evil Conduct and Computer Crime] (1st edn, PUG 2009) 8.
3 DS Wall, The Transformation of Crime in the Information Age (PP 2008) 31-34. This statement is also found in SR
Sjahdeini, Kejahatan & Tindak Pidana Komputer [in English: Computer Evil Conduct and Computer Crime] (1st edn,
PUG 2009) 8.
Page 5 of 116
On the other hand, despite the benefit ICT brings about, adverse consequences have occurred as well.
As a matter of fact, ICT has not only facilitated criminals to carry out their illegal activities, but also
created numerous new types of crimes. In addition, crimes committed in the virtual world using the
internet are commonly known as a cybercrime.4 David S Wall classifies the cybercrimes into three
generations, firstly traditional or ordinary or low-end cybercrimes, secondly hybrid or adaptive or
middle-end cybercrimes, and thirdly true or 'sui generis' or high-end cybercrimes.5 To elaborate further,
the true cybercrimes are crimes that may merely be carried out entirely through ICT such as hacking and
botnet spreading. These hybrid cybercrimes are crimes using the network (global span) and are actually
just traditional crimes using globalised opportunities such cracking, phreaking, and trading pornography,
whereas ordinary cyber crimes are mundane crimes but employ the computer to execute wrongful
behavior such as salami fraud.6
Furthermore, Bert J Koops confirms the aforementioned undesirable corollaries of ICT by mentioning 12
features of the internet opportunity structures for cybercrimes to occur, namely, the internet:
has a global reach, leads to deterritorialisation, allows for decentralized and flexible networks,
facilitates anonymity, enables distant interaction with victim, facilitates manipulability of data
and software with minimal cost, allows for automation of criminal processes, can blow up the
scale of a crime from a minor nuisance to major harm, allows for aggregation of a large number
of insubstantial gains, facilitates an information economy where information has become a

4 DS Wall, The Transformation of Crime in the Information Age (PP 2008) 10-11. This definition is also found in
Widodo, Sistem Pemidanaan Dalam Cyber Crime [in English: Criminalisation System in Cybercrime] (1st edn, LM
2009) 24.
5 DS Wall, The Transformation of Crime in the Information Age (PP 2008) 45-50.
6 ibid.
Page 6 of 116
valuable asset, has structural limitations to capable guardianship that can serve as a social or
technical obstacle to commit crime, and has rapid innovation cycles.7
The overall features of the internet provide the widest possible occasions for the prevalence and
development of cybercrime from the past to the present. In contrast, these features make it more
difficult for law enforcement officials to combat cybercrime.
As previously mentioned, the development of ICT facilitates a variety of arenas either in the private or
public sector. In the private sector, trade and businesses that make use of internet facilities are
identified as e-commerce or e-business, while the public administration or government sector are
referred to as e-government. Until recently, the practice of both e-commerce and e-government in the
information society has been increasingly commonplace. In fact, in 2001, Federal Computer Week and
the Pew Internet & American Life Project reported that the US government transaction was reaching an
aggregate of 3.6 million dollars through the Internet (e-government).8 The phenomenon of the rise of
the employment of ICT in public administration/government has not only happened in the U.S. alone,
but has also been implemented in many other countries in the five continents of Europe, Australia, Asia,
America, and even in Africa.

7 BJ Koops, ‘The Internet and its Opportunities for Cybercrime’ (2011) Tilburg Law School Legal Studies Research
Paper Series 9/2011, 739-740 <http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1738223> accessed 12
December 2012.
8 JEJ Prins, E-Government and Its Implications for Administrative Law (TMCAP 2002) 3. This was the sales turnover
of government bonds and securities from The US Treasury Department in 2000.
Page 7 of 116
In Indonesia, the use of e-government began in 1995 when Internet Service Providers began to be
allowed to operate.9 Directorate General of Customs and Excise (DJBC) is a unit of the agency under the
Ministry of Finance of the Republic of Indonesia, which has the main tasks and functions as a trade
facilitator, tax collector, and a law enforcer in the field of customs and excise. The agency at once felt
the need to harness ICT that since 1995 it has started to become one of the forerunners and leaders in
the application of e-government to carry out its duties and functions. It was characterized by the
registration of a domain name www.beacukai.go.id as an official establishment. At first it was merely a
contact service which referred to the possibility of contacting the DJBC. This was put in place so that
people could go on to ask questions of civil servants about the application of certain rules and programs,
or to make a complaint regarding its services. After some time, the website has grown so that today it
has both functions either as a public service media (external) or as an organization management media
(internal).10
According to Homburg, there are five types of services of e-government in practice; encompass
information services, contact services, transaction services, participation services, and data transfer
services.11 In connection with this classification, www.beacukai.go.id site has hitherto already been
providing, firstly, information service that is the disclosure of the DJBC information. For instance the
possibility of downloading brochures, policy reports, regulations and other official documents, and
searching in currency conversion databases for tax-related purposes or looking at benchmark

9 DT Hill and K Sen, The Internet in Indonesia’s New Democracy (Routledge 2005) 56.
10 <http://www.beacukai.go.id/index.ikc?page=about> accessed 1 January 2013.
11 V Homburg, Understanding E-Government-Information Systems in Public Administration (Routledge 2008) 93.
More elaboration on the types of services is provided in Chapter 2, See (n 40).
Page 8 of 116
information about customs and excise revenues.12 Secondly, it provides a contact service as described in
the preceding paragraph. Thirdly, it also provides a transaction service which refers to the electronic
intake and further handling of certain requests such as the rendering of customs registration, and
intermediary license.13
As a comparison, another example of e-government that provides a participation and data transfer
service is www.insw.go.id.14 Here, such website enables citizens, businesses, or other governmental
agencies to participate in forums for getting involved in the formulation and evaluation of policy
programs pertaining to the national single window, and enables data transfer of intergovernmental
institutions.
As mentioned in the third paragraph, in addition to the positive impact of ICT applications, it turns out
the negative impact of ICT in the implementation of e-government in Indonesia has also taken place. In
the application of e-government in Indonesia there have been thousands of cyber attacks carried out
against government websites, such as the Police Headquarters, Lemhanas, TNI, Pertamina, KPU, Ministry

12 http://www.beacukai.go.id/index.ikc?page=about, (n 10).
13 ibid.
14 INSW stands for Indonesian National Single Window which refers to Indonesian national system that allows for a
single submission of data and information, single and synchronous processing of data and information, and a single
decision making for customs clearance and cargo release. NSW System Implementation in Indonesia through the
operation of Portal Indonesia National Single Window (INSW), which can be accessed via the main page
(homepage) of the site (official website) Indonesia NSW which has a domain name or website address (web-
address) at http://www.insw.go.id.
Page 9 of 116