Indonesia prepares to migrate to post-quantum cryptography

This story is part of GovInsider's Digital Trust & Cybersecurity Champions 2026 Special Report. 

Indonesia is preparing to migrate to post-quantum cryptography (PQC) to tackle the threats that quantum computers pose to existing encryption systems.  

The transition to PQC will take place nationwide, covering ministries, government agencies, state-owned enterprises (SOEs) and other strategic sectors. The rollout will be phased, with priority given to critical sectors and Critical Information Infrastructure (CII). 

The country’s National Cyber and Crypto Agency (BSSN) is establishing a task force with various stakeholders, including Coordinating Ministry of Politics and Security Affairs, Coordinating Ministry of Economic Affairs, and Telkom Indonesia, to coordinate the migration and develop a roadmap for this transition. 

“The task force will make coordination easier and ensure that data protection continues throughout the migration process,” says BSSN's chief Nugroho Sulistyo Budi.  

Budi was speaking to GovInsider on the sidelines of the ASEAN Ministerial Conference on Cybersecurity (AMCC) at the Sands Expo and Convention Centre in Singapore on October 14.

The meeting was part of Singapore International Cyber Week (SICW) 2026 event.  

He explains that quantum computing could break certain cryptographic algorithms currently used to protect sensitive data, including banking information and economic transactions.  

This creates a risk that data stolen or collected in encrypted form today could be accessed in the future as quantum computing advances and becomes capable of breaking existing protections.  

“Data that is secure today may not remain secure in the future. This is why BSSN is developing and coordinating PQC at an early stage,” he adds. 

Indonesia is racing against time 

As migrating national-scale infrastructure takes time, Budi emphasises that preparations cannot wait until quantum computers are capable of threatening systems.

The task force is an initial step towards bringing together the various parties involved in protecting Indonesia’s electronic systems.  

However, BSSN cannot manage the transition alone because migration requires coordination with organisations that operate critical systems and hold sensitive data.

“That is why each sector needs to understand the technologies it uses, the risks to its systems, and the steps required,” he notes. 

While planning for the future, Indonesia is also concurrently bucking up its defences against artificial intelligence (AI)-powered cyberattacks that are already taking place.“Quantum computing can break encryption, while AI increases the speed and scale of attacks. Both can have cascading effects on public services,” he says.  

AI can also be used to strengthen cyber defences, including helping to identify system vulnerabilities and supporting cyber sensor operations and digital forensics.  

As AI systems can also be manipulated through misleading data or attacks targeting their inputs, Budi says that the risks associated with AI must also be considered. 

Indonesia’s infrastructure scale and geography add to the complexity of these challenges.  

With around 280 million people spread across an archipelago, levels of technological understanding and security awareness vary across the population, he adds. 

Budi also warns that cybersecurity must not be treated as a secondary consideration in digital transformation.

Digitally connected systems need a strong security foundation to prevent services from being disrupted or collapsing during an attack.  

Regional cooperation and cyber diplomacy  

Budi highlights that regional cooperation and cyber diplomacy are essential to address cross-borders threats.

This is important for Indonesia because the infrastructure used to launch attacks may be located outside the country, while perpetrators can conceal their identities and use various techniques to make tracing them more difficult.  

“No country can tackle cyber threats alone. Exchanging threat intelligence, maintaining intergovernmental communication, and coordinating across borders are necessary to verify findings and understand attack patterns."   

He shares Indonesia’s efforts to pursue cooperation with several countries during AMCC 2026. 

BSSN is exploring cooperation with the Cyber Security Agency of Singapore (CSA) on threat intelligence sharing, institutional and personnel capacity building, and the exchange of knowledge about attack techniques and patterns. 

Singapore’s experience in handling advanced persistent threat (APT) attacks attributed to the UNC3886 group could provide lessons for Indonesia.  

In turn, Indonesia can share information about cyber vulnerabilities it identifies. 

Indonesia is also exploring cooperation with Estonia, which experienced large-scale cyberattacks in 2007, focusing on strengthening regulations and institutional capacity. 

With Australia, Indonesia is exploring cooperation to strengthen links between the ASEAN and the Pacific regions. 

Budi stresses that these partnerships must be followed by practical programmes, including joint training, expert exchanges, and technical capacity building.  

“The point is not just to establish agreements, but to ensure that countries can respond to cross-border threats more quickly,” he says. 

Strengthening domestic cyber resilience  

Cybersecurity is not merely a technical issue but also a matter of national sovereignty, says Budi.  

Protecting networks and servers is protecting economic, defence, energy, and citizens' data.  

The government must therefore strengthen its technical capabilities and institutional capacity to detect and respond to threats effectively.

Discussions on the Indonesia's Cybersecurity and Cyber Defence Bill form part of these efforts.  

He emphasises that cybersecurity in this context focuses on protecting systems, networks, applications, devices, and data, rather than spying on the contents of people’s communications, which has often been alleged.  

“We simply want to ensure that security standards are followed, and that public data receives adequate protection,” he highlights.  

The next step is to strengthen national cyber resilience by ensuring that everyone understands their responsibility for security.  

According to BSSN’s monitoring, around 80 per cent of the cyberattacks it observes involve the exploitation of human factors.  

These attacks include scams, social engineering, and the exploiting vulnerabilities within organisations.  

He urges the public to be more alert to suspicious links, identity manipulation, credential theft, and privacy settings on digital services.  

Users should also keep their devices’ security features up to date and pay attention to vulnerability warnings.

“Every citizen must be security-conscious,” Budi says, emphasising the role of the media and other stakeholders in raising cybersecurity awareness.