Wiretapping of the President via LIMS: How It Works and Insider Threat Lessons

LIMS (Lawful Interception Management System) is an official system used by law enforcement to intercept communications via cellular operator networks. According to Bareskrim Polri, this system was misused to tap the numbers of President Prabowo Subianto and a number of other parties. This case is important because the loophole is not hacking from the outside, but abuse of access by insiders.

This article summarizes the problem, explains how LIMS works technically, then draws practical lessons for developers, business owners, and casual users. All suspects still have suspect status; There has been no court decision, and the presumption of innocence remains in effect.

What really happened?

On Tuesday, November 3 2026, Kabareskrim Komjen Asep Safrudin announced three police generals as suspects at National Police Headquarters, Jakarta. According to reports by CNN Indonesia, JawaPos, and Fortune Indonesia, the three are former National Police Chief General Listyo Sigit Prabowo (LSP), Inspector General Ahrie Sonta Nasution (ASN), and Inspector General Eko Hadi Santoso (EH/EHS).

The method explained by Bareskrim:

• Throughout 2025 to 2026, a number of telephone numbers were entered into the LIMS server without verification, without an investigator's request letter, and without a related police report.
• The targets include the President, state officials, political figures, journalists and media figures, leaders of mass organizations/NGOs, and entrepreneurs (CNN Indonesia).
• Around October 2026, the suspects allegedly ordered the deletion of intercept logs and files on the LIMS system computer.
• The case was discovered after an officer who knew about the activity made a police report on October 30 2026 (JawaPos).

Dittipidsiber Bareskrim examined 10 witnesses and 3 experts, and confiscated 11 cellphones, 1 iPad and 4 flash disks. The three suspects are being held at the Bareskrim detention center. The National Police said this was an individual action, "not an institutional policy of the National Police".

What articles apply?

Sources differ slightly regarding the details of the article. CNBC Indonesia mentioned Article 258 and Article 332 of the new Criminal Code as well as Article 32 paragraph (1) of the ITE Law. JawaPos mentioned Article 25 and Article 258 of Law Number 1 of 2023 concerning the Criminal Code. Both agreed on a maximum threat of 10 years in prison. Coordinating Minister Yusril Ihza Mahendra emphasized that the case involved unauthorized wiretapping, not treason.

How do LIMS work?

LIMS is software and hardware for managing legal interception. Quoting ETSI, legal interception allows authorities to obtain communications data from telecommunications providers for investigating serious crimes such as terrorism.

The difference with spyware: nothing is installed on the target phone. Tapping occurs in the operator's infrastructure. The flow is something like this:

1. Target input. The officer enters the telephone number (MSISDN), SIM identity (IMSI), or device identity (IMEI) into the console.
2. Interception function in carrier. Internal Interception Function (IIF/LIF) in the operator's network separates the target's communications.
3. Mediation. The data is formatted to a standard format and sent via an IP-based VPN.
4. LEMF. The Law Enforcement Monitoring Facility (monitoring center) receives, decodes, stores and displays the results.

According to Fortune Indonesia, LIMS supports 2G to 5G networks, fixed networks, WLAN and PON, and now there is a cloud-based version (vLIMS). In Indonesia, wiretapping procedures at the National Police Monitoring Center are regulated by Perkap Number 5 of 2010: the request must be in writing and contain the case, purpose, identity of the target and duration.

What data can be retrieved?

Vaccinecom cybersecurity expert, Alfons Tanujaya, reminded that metadata alone is very valuable: who talked to whom, how often, how long, how long and where the meeting took place.

Why is this called an insider threat, not hacking?

Alfons called this case "abuse of state instruments by people with authority". According to him, LIMS is more "attractive" to insiders than commercial spyware because:

• Leaves no trace on the device. The target phone's forensics won't find anything.
• Can be bulk without additional costs. Commercial spyware is expensive and has a limited number of targets.
• No trace of purchase. There are no vendor contracts or command-and-control servers to trace.

He also highlights operators' blind spots: "Operators look at the number and the requester, not the reason or case letter." This means that the operator carries out commands without being able to judge whether they are valid or not. The core issue is in governance: supervisors are in the same chain of command as access holders.

Deleting logs does not necessarily erase traces. Residual evidence could be in operator backup logs, system backups, confiscated devices, and whistleblower testimony. This case itself was discovered because of a report from internal officers.

What impact will this have on businesses and developers?

Almost every digital product has its own "little LIMS": an admin panel that can open customer data, impersonate user features, database export access, or internal APIs without restrictions. The risk pattern is the same: someone with legitimate access uses it for an unauthorized purpose, then deletes all traces.

In Indonesia, this risk also intersects with the Personal Data Protection Law. If customer data is leaked because of an insider, the company will still suffer the consequences, as we discussed in the case of the data leak of 5.7 million Fore Coffee accounts.

Step 1: require two people and one ticket

Sensitive actions (opening personal data, bulk export, changing permissions) should only be executed if there is a different approver and a valid ticket ID. Also limit super-admin access with a validity period (just-in-time access), not permanent.

Step 2: create an immutable audit log silently

The example below creates an append-only audit table in PostgreSQL. Each row stores the hash of the previous row, so silent changes break the chain. Constraint beda_orang rejects actions that are approved by the perpetrator himself. We have tested this code in PostgreSQL 16.

CREATE EXTENSION IF NOT EXISTS pgcrypto;

CREATE TABLE audit_log (
  id         bigserial   PRIMARY KEY,
  at         timestamptz NOT NULL DEFAULT now(),
  actor      text        NOT NULL,  -- yang mengeksekusi
  approver   text        NOT NULL,  -- yang menyetujui
  ticket_id  text        NOT NULL,  -- dasar akses (tiket/perkara)
  action     text        NOT NULL,
  target     text        NOT NULL,
  prev_hash  text,
  hash       text,
  CONSTRAINT beda_orang CHECK (actor <> approver)
);

-- Setiap baris menyimpan hash baris sebelumnya (hash berantai)
CREATE OR REPLACE FUNCTION audit_chain() RETURNS trigger AS $$
DECLARE last_hash text;
BEGIN
  PERFORM pg_advisory_xact_lock(424242);
  SELECT hash INTO last_hash FROM audit_log ORDER BY id DESC LIMIT 1;
  NEW.prev_hash := coalesce(last_hash, 'GENESIS');
  NEW.hash := encode(digest(
      NEW.prev_hash || (NEW.at AT TIME ZONE 'UTC')::text || NEW.actor ||
      NEW.approver || NEW.ticket_id || NEW.action || NEW.target, 'sha256'), 'hex');
  RETURN NEW;
END $$ LANGUAGE plpgsql;

CREATE TRIGGER trg_audit_chain BEFORE INSERT ON audit_log
  FOR EACH ROW EXECUTE FUNCTION audit_chain();

-- Tolak UPDATE, DELETE, dan TRUNCATE
CREATE OR REPLACE FUNCTION audit_block() RETURNS trigger AS $$
BEGIN
  RAISE EXCEPTION 'audit_log bersifat append-only';
END $$ LANGUAGE plpgsql;

CREATE TRIGGER trg_audit_block BEFORE UPDATE OR DELETE ON audit_log
  FOR EACH ROW EXECUTE FUNCTION audit_block();
CREATE TRIGGER trg_audit_trunc BEFORE TRUNCATE ON audit_log
  FOR EACH STATEMENT EXECUTE FUNCTION audit_block();

REVOKE UPDATE, DELETE, TRUNCATE ON audit_log FROM PUBLIC;

To check integrity, run the following query periodically. An empty result means the chain is intact; every id that appears indicates a changed row.

SELECT id
FROM (
  SELECT id, hash, prev_hash,
         lag(hash) OVER (ORDER BY id) AS prev_expected,
         encode(digest(prev_hash || (at AT TIME ZONE 'UTC')::text || actor ||
                approver || ticket_id || action || target, 'sha256'), 'hex') AS recomputed
  FROM audit_log
) t
WHERE hash <> recomputed
   OR prev_hash <> coalesce(prev_expected, 'GENESIS');

Step 3: keep the checkpoint out of reach of admins

The above trigger can still be turned off by the database superuser, and a very willing person can recalculate the entire chain. Therefore, routinely send the final hash to a WORM (write once, read many) repository managed by another party. Example with Amazon S3 Object Lock (bucket must be created with Object Lock enabled):

TGL=$(date +%F)
psql -At -c "SELECT id, hash FROM audit_log ORDER BY id DESC LIMIT 1" > "checkpoint-$TGL.txt"

aws s3api put-object \
  --bucket audit-worm-contoh \
  --key "checkpoints/checkpoint-$TGL.txt" \
  --body "checkpoint-$TGL.txt" \
  --object-lock-mode COMPLIANCE \
  --object-lock-retain-until-date 2027-11-04T00:00:00Z

In COMPLIANCE mode, objects cannot be deleted or overwritten by anyone, including the root account, until the retention date has passed. If the hash in the database does not match the checkpoint, something has changed the history.

Step 4: independent audit and whistleblower path

Designate a reviewer from outside the team with access, and provide a secure whistleblower channel. The LIMS case shows that a single inside report can be the only way abuse can be uncovered.

What can ordinary users do?

• Use apps with end-to-end encryption for sensitive conversations. The contents of the message are safe from interception at the operator level, although the metadata remains visible.
• Avoid regular SMS and mobile calls for confidential information, including OTP codes that can be replaced with authenticator applications.
• Don't rely on "check for signs that your cellphone is being tapped". Tapping via LIMS does not leave traces on the device, so tips such as battery draining quickly are not relevant for this mode.
• Reduce the metadata footprint if necessary, for example by not using a primary number for all services.

What is the government's next step?

According to CNN Indonesia, the government will evaluate the tapping equipment at the National Police, Prosecutor's Office, KPK and BNN together with BSSN and the Coordinating Ministry for Political and Security Affairs. DPR Commission III asked that the process be professional and transparent. Alfons Tanujaya also pushed for the Tapping Bill to be ratified immediately, with the condition that every input number is recorded permanently, cannot be deleted by the operator, is audited by an independent party, and requires court permission.

For industry players, this is a signal that data access and audit trail regulations will become stricter, in line with other digital policy trends such as Komdigi's 4-hour takedown rule.

FAQs

Are LIMS illegal?

No. LIMS is the official tool for lawful wiretapping in law enforcement. What is being questioned by Bareskrim is its alleged use without verification, without an investigator's request letter, and without any connection to the case.

Can WhatsApp be tapped via LIMS?

The contents of WhatsApp messages are protected by end-to-end encryption, so they cannot be read across the operator's line. However, metadata such as connection time, IP address and tower location can still be recorded.

How do I know if my number is being tapped via LIMS?

It is technically almost impossible from the user's side, because the tapping occurs on the operator's network, not on the phone. The best protection is to use encrypted communications for sensitive matters.

Does deleting logs actually eliminate evidence?

Not necessarily. Traces can be left in operator backup logs, system backups, confiscated devices, and insider testimony. That's why audit logs are best copied to separate, immutable storage.

What are the key lessons for companies?

Secure technology is not enough if governance is weak. Implement segregation of duties, ticket-based access, immutable logs, and independent audits.

Source

• CNN Indonesia: Facts about alleged wiretapping of President Prabowo (4 Nov 2026)
• kumparanTEKNO: Experts say LIMS tapping is not spyware, but an insider threat (4 Nov 2026)
• CNBC Indonesia: President's wiretapping uses LIMS illegally (4 Nov 2026)
• Fortune Indonesia: What is LIMS suspected of tapping Prabowo's phone (4 Nov 2026)
• JawaPos: Tapping mode, target number inputted in LIMS since 2025 (4 Nov 2026)
• VIVA: Get to know how LIMS works (4 Nov 2026)
• AWS: Amazon S3 Object Lock Documentation