National Cyber and Crypto Agency

The National Cyber and Crypto Agency (Indonesian: Badan Siber dan Sandi Negara, lit. 'State Cyber and Signal Agency', abbreviated as BSSN), is Indonesia's primary signal intelligence agency, and also has responsibility for cyber intelligence, cyber threat intelligence, cyber defense, and cyber security.

Formed

4 April 1946; 80 years ago (1946-04-04) (as National Crypto Agency)
8 April 2014; 12 years ago (2014-04-08) (as Cyber Information Defense and Security Desk)
19 May 2017; 9 years ago (2017-05-19) (as National Cyber and Crypto Agency)

Preceding agencies

National Crypto Agency
Cyber Information Defense and Security Desk, 7th Deputy (Coordination of Communication, Information, and Apparatuses), Coordinating Ministry for Political, Legal, and Security Affairs
Directorate of Information Security, Ministry of Communication and Information Technology
Indonesia Security Incident Response Team on Internet Infrastructure/Coordination Center, Directorate of Application and Informatics, Ministry of Communication and Information Technology

JurisdictionIndonesia

Agency executives

Lieutenant General TNI (Ret) Nugroho Sulistyo Budi, Chief
Police Inspector General Rachmad Wibowo, Vice Chief

Quick facts Agency overview, Formed ...

National Cyber and Crypto Agency
Agency overview
Badan Siber dan Sandi Negara
Seal of the National Cyber and Crypto Agency
Flag of the National Cyber and Crypto Agency
Formed	4 April 1946; 80 years ago (1946-04-04) (as National Crypto Agency) 8 April 2014; 12 years ago (2014-04-08) (as Cyber Information Defense and Security Desk) 19 May 2017; 9 years ago (2017-05-19) (as National Cyber and Crypto Agency)
Preceding agencies	National Crypto Agency Cyber Information Defense and Security Desk, 7th Deputy (Coordination of Communication, Information, and Apparatuses), Coordinating Ministry for Political, Legal, and Security Affairs Directorate of Information Security, Ministry of Communication and Information Technology Indonesia Security Incident Response Team on Internet Infrastructure/Coordination Center, Directorate of Application and Informatics, Ministry of Communication and Information Technology
Jurisdiction	Indonesia
Agency executives	Lieutenant General TNI (Ret) Nugroho Sulistyo Budi, Chief Police Inspector General Rachmad Wibowo, Vice Chief
Website	www.bssn.go.id

Close

The BSSN was formed from two preceding agencies, the National Crypto Agency (Lembaga Sandi Negara, lit. 'State Signal Agency', abbreviated as Lemsaneg), and the Cyber Information Defense and Security Desk (Desk Ketahanan dan Keamanan Informasi Cyber Nasional, abbreviated as DK2ICN).^[1]

History of the preceding agencies

Lembaga Sandi Negara (Lemsaneg)

Lemsaneg was Indonesia's original primary signal intelligence agency, founded by Lieutenant Colonel (later Major General) Dr. Roebiono Kertopati [id]. Dr Kertopati was a medical doctor assigned to Section B of the Ministry of Defense, Indonesia's intelligence department during the Indonesian National Revolution, and was mainly responsible for strategic intelligence analyses. However, the Minister of Defence at that time, Amir Sjarifuddin, tasked him with building a signal intelligence unit, resulting in Code Service (Dinas Code) being founded on 4 April 1946.

As a medical doctor, Dr Kertopati had no background or formal training in either general intelligence or signal intelligence. However, he completed various crash courses in these pursuits and in 1949, during the Dutch-Indonesian Round Table Conference period, he completed a signal intelligence course with the Dutch Ministry of Foreign Affairs and developed various cryptography methods. These methods proved useful in making the transmission of encrypted messages and government communications secure during both war and peacetime.^[2]

On 2 September 1949, via Ministry of Defense Decree Number (No.) 11/MP/1949, the Code Service was renamed the Crypto Bureau (Djawatan Sandi in the old spelling; Jawatan Sandi in the new spelling), and placed under the Ministry of Defense. On 16 January 1950, via Presidential Decree No. 65/1950, the Crypto Bureau separated from the Ministry of Defense to come directly under the Office of The Prime Minister of Indonesia.^[3]

On 22 February 1972, via Presidential Decree No. 7/1972, the Crypto Bureau was renamed the National Crypto Agency (Lembaga Sandi Negara, abbreviated as Lemsaneg),^[4] with the name continuing to be used until 2017.

Desk Ketahanan dan Keamanan Informasi Cyber Nasional (DK2ICN)

DK2ICN was created via CMPLSA Decree No. 24/2014 as a coordinating desk under the 7th Deputy (Coordination of Communication, Information, and Apparatuses) of the Coordinating Ministry for Political, Legal, and Security Affairs (CMPLSA).^[5] It was later renamed in 2016 as the National Cyberspace Desk (Desk Cyberspace Nasional, abbreviated as DCN) under the Coordinating Ministry for Political, Legal, and Security Affairs. As a coordinating desk, DK2ICN's members included representatives from the CMPLSA; the Agency of Assessment and Application of Technology [id] (abbreviated as BPPT); the Indonesian Telematic Society (Masyarakat Telematika Indonesia, abbreviated as Mastel); Association of Indonesia Internet Providers (Asosiasi Penyedia Jasa Internet Indonesia, abbreviated as APJII); Indonesian Internet Domain Name Registry (Pengelola Nama Domain Internet Indonesia, abbreviated as PANDI); and other independents.

The predecessor of DK2ICN had been the National Cyber Security Desk (Desk Keamanan Siber Nasional, abbreviated as DKSN), formed under the National Security Council (Dewan Ketahanan Nasional, abbreviated as Wantannas) in 2013. Along with the decree establishing DK2ICN, a future National Cyber Agency to be under Wantannas (Badan Cyber Nasional, abbreviated as BCN) was also proposed. But until this new agency was formed, DK2ICN was still responsible for cyber defence and cyber intelligence.^[6] However, President Joko Widodo seemed displeased with the BCN proposal, believing that it lacked the important elements of infrastructure and human resources. Instead of forming a new agency, he chose to upgrade Lemsaneg with its pre-existing infrastructure and readily available human resources, subsequently combined Lemsaneg with DK2ICN to form the new agency, BSSN.^[7] ^[8]

The formation of BSSN

Prior to BSSN's formation, state cyber activities had been carried out by all of the Military Intelligence Agency's Cyber Operations Unit; the national police force (Directorate of Cyber Crime of the Criminal Investigation Agency); the State Intelligence Agency (Deputy VI); the Coordinating Ministry for Political, Legal, and Security Affairs (7th Deputy); the Ministry of Defense (Cyber Defense Center); the Ministry of Communication and Information Technology (Directorate of Informatics Application Control, Directorate of Information Security, and ID-SIRTII/CC); the Ministry of Foreign Affairs (Directorate of Diplomatic Security of General Directorate Public Information and Diplomatics); and each ministry's Computer Security Incident Response Team (CSIRT). Each agency had its own interests and functions, but in addition to protecting their own cyber infrastructure they all contributed to more general security matters.^[9]

Presidential Decree No. 53/2017, the constituting document of BSSN, was signed by President Widodo on 19 May 2017. The decree also ordered that the Ministry of Communication and Information Technology's Directorate of Information Security, and ID-SIRTII/CC both be handed to BSSN to provide BSSN with access to state IT infrastructure security and state network protection. However, the decree stipulated that the BSSN become temporarily subordinate to the Coordinating Ministry for Political, Legal, and Security Affairs for coordinating purposes.^[10] On 16 December 2017, Widodo signed Presidential Decree No.133/2017, which took the BSSN out of the Coordinating Ministry for Political, Legal, and Security Affairs so as to be directly under the President.^[11]

Organizational structure

The organizational structure of BSSN was established through Presidential Decree No. 28/2021,^[12] with the structure later expanded by Chief of BSSN Decree No. 4/2023,^[13] 6/2024, and 1/2025. The current structure is as follows.

Office of the Chief of BSSN
Office of the Vice Chief of BSSN
Main Secretariat
1. Bureau of Planning and Finance
2. Bureau of Organization and Human Resource
3. Bureau of Law Affairs and Public Communication
  - Division of Strategic Support and Central Leadership Administration
    1. Subdivision of Administration of the Office of the Chief of BSSN
    2. Subdivision of Administration of the Office of the Vice Chief of BSSN
    3. Subdivision of Administration of the Office of Main Secretariat of BSSN
    4. Subdivision of Administration of the Office of Deputy I
    5. Subdivision of Administration of the Office of Deputy II
    6. Subdivision of Administration of the Office of Deputy III
    7. Subdivision of Administration of the Office of Deputy IV
4. Bureau of General Affairs
  - Household and State Property Section
    1. Subdivision of Household Affairs and Security
  - Goods/Services Procurement Section
Deputy for Strategy and Policy of Cyber Security and Crypto (Deputy I)
1. Directorate of Cyber Security and Crypto Strategy
2. Directorate of Cyber Security and Crypto Policies on Government Affairs
3. Directorate of Cyber Security and Crypto Policies on Technological Affairs
4. Directorate of Cyber Security and Crypto Policies on Human Resource Affairs
Deputy for Cyber Security and Crypto Operations (Deputy II)
1. Directorate of Cyber Security Operations
2. Directorate of Information Security and Control Operations
3. Directorate of Crypto
Deputy for Government Cyber Security and Crypto and Human Resource Development (Deputy III)
1. Directorate of Central Government Affairs on Cyber Security and Crypto
2. Directorate of Regional Governments Affairs on Cyber Security and Crypto
3. Directorate of Cyber Security and Crypto Human Resource Development
Deputy of Cyber Security and Signal Intelligence in Economy (Deputy IV)
1. Directorate of Cyber Security and Crypto for Finance, Trading, and Tourism Affairs
2. Directorate of Cyber Security and Crypto for Energy and Natural Resources Affairs
3. Directorate of Cyber Security and Crypto for Information Technology, Communication, Media, and Transportation Affairs
4. Directorate of Cyber Security and Crypto for Industrial Affairs
Office of Inspectorate General
Centers^[13]
1. Center of Cyber Technologies and Crypto Technologies Certification
2. Center of Data, Information Technology, and Communication
3. Center of Human Resource Development
Technical Units
1. Electronic Certification Institute, Jakarta
2. Batam Signal Detection Center, Batam
3. Crypto Museum, Yogyakarta
4. Digital Identity Hub Center, Jakarta

Training

During the Indonesian National Revolution, the Dinas Code had held internships for those interested in being signal intelligence operators. During its formation period in the peacetime of the 1950s and 1960s, Djawatan Sandi relied on a special training program called Pendidikan Sandiman dan Juru Sandi (Education of Signal Operators and Signal Experts). In 1969 the program was elevated into Pendidikan Ahli Sandi Gaya Baru (New Style Signal Expert Education), and further upgraded and resourced in 1973 to become a school under the name AKSARA (Akademi Sandi Negara, State Signal Academy). The school was formally established in 1974, gaining approval from the Department of Education and Culture in 1975. AKSARA subsequently became STSN (Sekolah Tinggi Sandi Negara) in 2002, and was formally established as an official state school by Presidential Decree No. 22/2003.^[14]

Since the BSSN was developed from Lemsaneg, it inherited Lemsaneg's primary training facility STSN, which in 2019 became PoltekSSN (State Signal Polytechnics), after the Ministry of Research, Technology, and Higher Education Decree No. 03/M/I/2018 that upgraded STSN to Polytechnics. This was later approved through Ministry of State Apparatuses and Bureaucratic Reform Decree No. B/1007/M.KT.01/2019, and Chief of BSSN Decree No. 12/2019.^[14]

All graduates of AKSARA (and its successors STSN and, later, PoltekSSN), are classified as Level III Signal Operators (Ahli Sandi Tingkat III), the highest qualification level for the most fully trained Indonesian cryptologists, as per the Indonesian cryptology education standard specified in Chief of National Crypto Agency Decree No. 17/2010 (On Levels of Cryptologists).^[15] Aside from PoltekSSN's rigorous training of future BSSN members, BSSN also holds less rigorous training for field and applied operators from other institutions in a program called Diklat Sandiman (Signal Operators Short courses). Training under this scheme is available in both Level I Signal Operators (Basic Signal Operators, Ahli Sandi Tingkat I) and Level II Signal Operators (Advanced Signal Experts, Ahli Sandi Tingkat II), as well as the lesser level Pelatihan Penunjang Ahli Sandi (Supporting Training Program for Signal Operators).^[15]^[16]