Denying Voters' Data Breach, KPU Traces Owners Of 2014 Election DPT Copy

JAKARTA - The General Election Commission (KPU) has denied the leakage of data in the form of a final voter list (DPT) which was sold in hackers forums. The issue of KPU data leakage originated from the Twitter account @underthebreach.

Actor leaks information on 2,300,000 Indonesian citizens. Data includes names, addresses, ID numbers, birth dates, and more. Appears to date back to 2013. Actor claims he will leak 200,000,000 additional citizens information soon. pic.twitter.com/xVWhOGOhtX

- Under the Breach (underthebreach) May 21, 2020

KPU commissioner Viryan Aziz explained, based on data tracing with the KPU technical team, the image displayed on the Twitter account was the 2014 Election DPT. The image clip shows voters domiciled in Yogyakarta.

Even so, Viryan denied that the data obtained by hackers came directly from the KPU server. "DPT data for the 2014 elections can no longer be accessed apart from the internal KPU since 2018," Viryan said in a video conference with journalists, Friday, May 22.

Then, why are millions of DPTs in the ".pdf" format with detailed voter population data scattered around? Viryan replied that during the 2014 Election, several parties were allowed to receive the copy, provided that it was only for election purposes.

This is regulated in Article 34 paragraph (5) of the Election Law Number 8 of 2012. The substance is so that the parties concerned are convinced that they have received authentic documents and that the DPT KPU is the real data.

"In this case, a copy with the '.pdf' format can be given to the political parties participating in the election, Bawaslu, and the government. The three parties accept it," explained Viryan.

However, because the DPT details are confidential data, all parties must sign an agreement that such data cannot be provided by other parties and can only be used as data analysis to obtain accurate voter data for election purposes.

Viryan suspects that there are external parties who indeed spread it to other parties, so that the sale and purchase of DPT appears in hacker forums. Therefore, the KPU will follow up cases through legal channels in coordination with the National Cyber and Crypto Agency (BSSN) and cyber crime at the National Police Headquarters.

"So, the KPU coordinates with related parties to carry out a search by BSSN and the National Police Headquarters. We want to be certain where the person gets it from. But, what is clear, the data is not directly from the Indonesian KPU," explained Viryan.

Previously, the news about millions of KPU voter data that was allegedly leaked in the hacker community forum was first disclosed by the @underthebreach account on Twitter.

This Twitter account is active enough to monitor hacker activity, especially those related to leaks of personal information. He also briefly informed about the sale of 91 million Tokopedia user data on the dark web.

Through his tweet, this account uploaded three screenshots of the KPU folder and sample data published on hacker forums. According to him, 2.3 million identity data were leaked.

"These data include name, address, NIK, date of birth and others. These data are from 2014. Hackers claim they still have 200 million more data," tweeted @underthebreach.

From VOI's search, the hacker said the data was stored in ".pdf" format obtained from the General Election Commission website. According to him, these data will be very useful for those who wish to register an account.

"Very useful for those who need to create multiple phone numbers in IDs (you need ID NIK and NKK for registration), or do some extracting phone numbers from those IDs," wrote the hacker.

This hacker also claims that he still has 200,000,000 other Indonesian citizens' data that will be shared through the forum. "I think Indonesian data seems rare in this forum," he said.

Some of the population data displayed includes full name, family card number, Identity Number (NIK), place and date of birth, home address, and several other personal data. From the sample data he shared, most of the leaked information came from residents in Yogyakarta.

The distributed data sample contains folders of voter data from a number of regions in Yogyakarta, including their registered polling stations. The data is compressed in a 1.78GB file which can be obtained after paying 8 euros on the forum.