By Sonny Zulhuda

I have an honour to deliver on cyberlaw and cybwr crimes as part of legal curriculum development at IAIN Padangsidimpuan, North Sumatera, Indonesia.

The event is aimed at sharing with the lecturers from the Faculty of Syariah and Law so as to integrate the cyberlaw issues into the curriculum. This is to answer the challenges of the Industrial Revolution 4.0.

The Rector Prof Dr Ibrahim Siregar opened the forum with an impressive message for all the participants.

In his speech, Prof Ibrahim encourages all the staff to pursue higher studies including achieving the professorship.

Kudos for IAIN PADANGSIDIMPUAN!

July 18, 2019
Categories: Uncategorized . . Author: Sonny Zulhuda . Comments: Leave a comment

Oleh: Sonny Zulhuda

Bicara tentang masalah sistem IT (tepatnya sistem informasi) KPU bisa dimulai dengan membedahnya dengan menggunakan pisau bedah “CIA” – Yaitu aspek kerahasiaan, keutuhan dan ketersediaan sistem tersebut.

Aspek-aspek inilah yang mendasari kriteria keandalan sistem elektronik sebagaimana tertuang dalam pasal 16 Undang-undang No. 11/2008 (UU-ITE) dan juga telah menjadi dasar konseptual pemidanaan cybercrime dibawah Budapest Convention 2001.

Pertama, tentang KERAHASIAAN sistem (“Confidentiality”). Intinya adalah bahwa sebuah sistem informasi yang aman wajib menjaga kerahasiaan sistem informasi dan membatasi akses hanya kepada yang betul-betul berwenang.

Pertanyaan yang bisa disodorkan adalah seperti berikut:
1. Siapa saja yang bisa mengakses sistem IT KPU?
2. Siapa yang berwenang memiliki kode akses (password, PIN, etc) terhadap sistem tersebut?
3. Apakah pengelolaan sistem IT KPU dapat diakses dan dimanipulasi oleh orang yang tidak berwenang?

Kedua, tentang faktor keutuhan (integritas) sistem informasi. Pesan utamanya adalah bahwa sistem informasi termasuk segala data dan proses yang terkait tidak boleh diragukan validitasnya, kebenaran dan keutuhannya. Segala halbyang dapat mereduksi integirtas sebuah sistem harus dienyahkan.

Hal-hal yang dapat ditelisik termasuk:
1. Apakah data yang masuk sudah dipastikan akurasi, keutuhan dan kebenaran faktualnya? Contoh, apakah DPT sudah akurat? Apakah penghitungan suara tepat?
2. Apakah keandalan sistem tersebut sudah diuji kekedapannya terhadap peretasan?
3. Apakah ada sistem pengujian terhadap keabsahan data yang akan, sedang dan telah diproses?

Ketiga, perihal ketersediaan dan dapat diaksesnya sistem informasi (“Availability”). Intinya adalah bahwa sebuah sistem yang andal adalah yang dapat berfungsi sesuai tujuan dan linimasa yang telah digariskan. Sistem tersebut mesti andal dan bertahan dan mereduksi resiko kegamangan informasi.

Untuk itu bisa diselidiki antara lain:
1. Apakah sistem IT KPU kita selalu online dan dapat diakses dengan baik oleh pengguna (masyarakat)?
2. Apakah pengelola mengantisipasi resiko-resiko serangan terhadap sistem tersebut?
3. Apakah sistem informasi KPU memiliki prosedur pengamanan dan recovery yang tepat menghadapi krisis data seperti downtime, insiden peretasan, bencana dsb?

Sebagai pondasi penting ketiga faktor ini adalah isu pengaturan yang baik (“Good governance”) yang memprasyaratkan kepemimpinan teladan, transparan, jujur dan adil.

Sekian, sekadar urun sharing.
Artikel ditulis di <sonnyzulhuda.com>

May 26, 2019
Categories: Uncategorized . . Author: Sonny Zulhuda . Comments: Leave a comment

By: Sonny Zulhuda

Data is an asset in today’s interconnected world. With the changing digital lifestyle and emerging digital workplace, managing personal data becomes a key trust factor for organisations.

The digitalisation of process and records, mobile workplace concept, synchronisation of gadgets and data, as well as emergence of smart contract have all contributed to this change.

Internally, managing data serves as a critical assets management. Externally, it becomes a shield of legal compliance as well as a key competitive value in a more increasingly regulated environment.

In many parts of the world, Personal Data Protection (PDP) is made as a critical trade issue, including a potential trade barrier in the event of trans-border data transfer.

The EU General Data Protection Regulations (GDPR) is setting a new global PDP benchmmark. Meanwhile in this part of the world, Malaysia, Singapore and the Philippines are already enforcing their respective PDP laws. Soon Indonesia and Thailand are following the suit with the drafting and enacting of the laws.

The requirement of PDP law raises a new set of data due diligence for organisations. Privacy Impact Assessment (PIA) and data breach notification (DBN) are among those legal regime that requires careful due diligence under the PDP law.

In short, all life cycles of data management have now to be embedded in a comprehensive, cross-sectoral governance within the virtually every data-reliant organisation.

The data management policies need to be comprehensive and up-to-date. Public communication has to be real-time. For that purpose, not only do we require a specially designated high-level data protection officer (DPO), but also a regular transparency report on our data affairs.

Gone are the days that data protection is only seen as technical and trivial issues. PDP is now a boardroom issue, looking out to both reputational and legal risks and opportunities.

April 7, 2019
Categories: Uncategorized . . Author: Sonny Zulhuda . Comments: Leave a comment

The following passages are copied from the report in the Jakarta Post online <https://www.thejakartapost.com/life/2019/01/21/10yearschallenge-could-simplify-data-collection-expert-says.html> which quoted my comments about the recent social media trend #10yearschallenge. It is partially reproduced here for the purpose of wider reach. Please click on the above link to the original source for the complete report.

=========================================================

The #10yearschallenge has recently swept across social media, with users posting pictures of themselves in 2009 and 2019. Sonny Zulhuda, a lecturer in cyber law at the International Islamic University Malaysia and advisor at Malaysia’s Department of Personal Data Protection, said the hashtag could be a shortcut used for data collection.

Speaking to Antara news agency in Kuala Lumpur on Monday, Sonny said netizens mostly participated in the challenge for entertainment and nostalgia purposes. However, he also said users might not realize the photos could be used for other purposes that could help social media companies or third parties in their lines of work. These include improving databases of users’ faces based on age, time period, race, gender and environment.

“With such an indicative label as #10yearschallenge, data filtering and interpretation would be so much easier. It’s almost like giving a shortcut for data collection. For some people, this is hardly a new issue as the data has been stored on social media and the internet. What’s considered new is how users have made it easier for companies in regards to data curating and packaging.”

Sonny shared that big data curators could freely verify the data in their database packaging, something that is considered a difficult and important process. “This is because the verification has been done by the data owners themselves. In terms of security, it won’t be a problem should the face transformations be stored securely so they are not misused,” he added.

He also said that facial recognition technology had positive effects, such as helping to solve cases of missing people. However, he said that the same technology could be used by private investigators to spy on other people, or by parties that might use data for commercial and marketing purposes. According to Sonny, the worst possibility is if parties misuse the availability of face data for identity forgery.

“Our faces, biographical data, communications, movements and the combination of all those things are considered assets in this digital era. Let’s always be aware,” he said. (wng)

January 22, 2019
Categories: Uncategorized . . Author: Sonny Zulhuda . Comments: Leave a comment