Indonesia Asks 20% of the Internet to Sign on the Dotted Line

This week, the Indonesian government announced it had issued warnings to 25 companies to register under its electronic system operator rules — a regulatory framework that, on paper, exists to bring foreign digital services into compliance with local law enforcement. In practice, the rules would allow the government to access user data, enforce content takedowns, and require companies to maintain a local corporate presence. ^[1]

The list of named companies includes Cloudflare, a US-based internet infrastructure firm whose services underpin roughly 20% of the web; Duolingo, the language-learning app best known for its green owl; and the Wikimedia Foundation, the nonprofit that operates Wikipedia. ^[2]

To understand the scale of what is being asked of Cloudflare specifically, it helps to remember what happened last week. A Cloudflare outage took ChatGPT, Spotify, and X — the website formerly known as Twitter — offline for users around the world. ^[3] Whatever Indonesia decides to do with Cloudflare, then, is functionally a decision about what to do with a non-trivial slice of the internet.

The government, of course, frames it differently. Officials have cited Cloudflare’s role in supporting online gambling websites, claiming that 76% of such sites run on its systems. ^[4] The figure is the government’s; the sourcing, to my knowledge, is not public.

And — in fairness to the government on this narrow point — Cloudflare has historically been in trouble with multiple governments over allegations that it is too passive on cybercrime. ^[5] The company sits at a layer of the internet that is, by design, content-agnostic. That is the point of a content delivery network. It is also, relatedly, why content-agnostic infrastructure is a useful place for bad actors to park themselves.

So the government is not entirely wrong about the architecture. It is, however, reaching for the wrong lever. The rules it wants these companies to comply with have been criticized for opening the door to surveillance, restricting freedom of expression, and what can fairly be called government overreach. ^[6] Compliance, in this framing, means handing over user data on demand, accepting takedown orders without judicial review, and maintaining a local office that the government can, in theory, lean on.

That is the policy the government is asking Cloudflare — the company that, again, runs the pipes for roughly one in five websites — to sign up for. Make of that what you will.

Two other names on the list deserve a mention. The first is Duolingo, whose inclusion in a list of companies the government is threatening with action over, among other things, allegedly facilitating online gambling is — and I want to be careful with my phrasing here — at least colorful. ^[2] The owl, to the best of my knowledge, has not been charged with anything.

The second is the Wikimedia Foundation, the organization behind Wikipedia. ^[2] Wikipedia is the free encyclopedia that anyone can edit, and that Indonesia — like much of the world — leans on heavily for cheap reference material. It is the kind of target that tends to make international press releases write themselves. It is also, like Cloudflare, content-agnostic by design: it does not host online gambling, it does not run a content delivery network, and it does not, to my knowledge, maintain a mascot with a criminal record. Its offense, presumably, is the same as everyone else’s: not being registered under a regulatory regime the government has, in part, written for itself.

None of this is new. Indonesia has, for some time, taken a nuclear approach to internet governance. ^[7] The pattern is consistent. The pattern is also, in a sense, the point. Nuclear approaches to internet policy are not, historically, the ones that age well. They are the ones that get walked back, quietly enforced unevenly, or replaced by the next nuclear approach. The companies on this list will, in all likelihood, comply, negotiate, or quietly leave. The internet, meanwhile, will continue to not care about national borders — a fact that has been true for roughly thirty years and is unlikely to change on the strength of a warning letter in Jakarta.

Indonesia has every right to regulate digital services operating within its borders. So does every other country. The question is not whether the government can do this. It is whether what it is doing is what it says it is doing, and whether the rules it is enforcing will, in the long run, do what the government claims they will. The answers, in my opinion, are not obviously yes.

The Duolingo owl, for the record, remains at large.