Cross-Border Cybercrime and Criminal Jurisdiction: Rethinking Indonesia’s Extraterritorial Enforcement Framework

The decentralized architecture of cross-border cybercrime, where perpetrators, victims, data infrastructure, and digital evidence concurrently span multiple territories, routinely undermines traditional territoriality principles in criminal law. While Indonesia has expanded its domestic statutory reach through the Electronic Information and Transactions (ITE) Law, the New Penal Code (KUHP), the Criminal Procedure Code (KUHAP), the Mutual Legal Assistance (MLA) Law, and the Personal Data Protection (PDP) Law, asserting prescriptive jurisdiction does not automatically confer enforcement authority abroad. Unauthorized extraterritorial investigative actions directly violate foreign state sovereignty. This article evaluates the systemic friction between Indonesia’s expansive prescriptive frameworks and the strict territorial limitations governing cross-border evidence gathering and coercive maneuvers. Utilizing a normative-doctrinal method paired with a comparative statutory analysis, this study evaluates contemporary domestic laws against international legal instruments and foreign legal developments. To resolve jurisdictional conflicts, this article constructs a novel Digital Jurisdictional Nexus Test based on five distinct connecting factors: the locus of conduct, victimhood and localized harm, operational data infrastructure, national economic interest, and proximity to the data custodian or service provider. This framework clearly demarcates the legislative capacity to criminalize conduct from the procedural authority to seize electronic evidence globally. Consequently, the study introduces an operational Five-Stage Cross-Border Digital Investigation Protocol navigating nexus verification, sovereignty and comity assessments, evidentiary taxonomy, international cooperation channel selection, and judicial oversight. Finally, this paper evaluates the strategic implications of Indonesia’s September 2026 signature of the United Nations Convention against Cybercrime, mapping out its potential to modernize mutual legal assistance frameworks ahead of its formal ratification and entry into force.