<![CDATA[This study aims to analyze and reconstruct legal policies in addressing ransomware attacks on national critical infrastructure in Indonesia using normative juridical methods through legislative and conceptual approaches. The results show that the legal provisions contained in Law Number 1 of 2024 concerning the Second Amendment to Law Number 11 of 2008 concerning Electronic Information and Transactions and Law Number 27 of 2022 concerning Personal Data Protection do not specifically regulate ransomware as a separate crime and do not provide comprehensive protection for national critical infrastructure. Furthermore, there are weaknesses in both normative and implementation aspects, including the absence of a legal definition of ransomware, weak cybersecurity standards, institutional fragmentation, and obstacles in digital evidence management and cross-border law enforcement. Therefore, legal policy reconstruction is needed through the establishment of specific norms related to ransomware, the strengthening of regulations for critical infrastructure protection based on a risk approach, the implementation of mandatory cybersecurity standards, as well as institutional integration and the enhancement of law enforcement capacity. This study contributes to the development of a legal policy model that is preventive, repressive, and adaptive to technological developments to ensure national security and Indonesia's digital sovereignty.]]>
Copyrights © 2026
