Abstract :

The decentralized architecture of cross-border cybercrime, where perpetrators, victims, data infrastructure, and digital evidence concurrently span multiple territories, routinely undermines traditional territoriality principles in criminal law. While Indonesia has expanded its domestic statutory reach through the Electronic Information and Transactions (ITE) Law, the New Penal Code (KUHP), the Criminal Procedure Code (KUHAP), the Mutual Legal Assistance (MLA) Law, and the Personal Data Protection (PDP) Law, asserting prescriptive jurisdiction does not automatically confer enforcement authority abroad. Unauthorized extraterritorial investigative actions directly violate foreign state sovereignty. This article evaluates the systemic friction between Indonesia’s expansive prescriptive frameworks and the strict territorial limitations governing cross-border evidence gathering and coercive maneuvers. Utilizing a normative-doctrinal method paired with a comparative statutory analysis, this study evaluates contemporary domestic laws against international legal instruments and foreign legal developments. To resolve jurisdictional conflicts, this article constructs a novel Digital Jurisdictional Nexus Test based on five distinct connecting factors: the locus of conduct, victimhood and localized harm, operational data infrastructure, national economic interest, and proximity to the data custodian or service provider. This framework clearly demarcates the legislative capacity to criminalize conduct from the procedural authority to seize electronic evidence globally. Consequently, the study introduces an operational Five-Stage Cross-Border Digital Investigation Protocol navigating nexus verification, sovereignty and comity assessments, evidentiary taxonomy, international cooperation channel selection, and judicial oversight. Finally, this paper evaluates the strategic implications of Indonesia’s September 2026 signature of the United Nations Convention against Cybercrime, mapping out its potential to modernize mutual legal assistance frameworks ahead of its formal ratification and entry into force.

---

Keywords :

cybercrime jurisdiction, digital evidence, extraterritorial enforcement, Indonesia criminal law, UN cybercrime convention.

---

References :

1. Arnell, P., & Faturoti, B. (2023). The prosecution of cybercrime—Why transnational and extraterritorial jurisdiction should be resisted. International Review of Law, Computers & Technology, 37(1), 29–51. https://doi.org/10.1080/13600869.2022.2061888
2. Cane, P., & Kritzer, H. M. (Eds.). (2010). The Oxford handbook of empirical legal research. Oxford University Press.
3. Council of Europe. (2001). Convention on cybercrime (European Treaty Series No. 185). Council of Europe.
4. Council of Europe. (2021). Second additional protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224). Council of Europe.
5. Council of Europe. (2025). 2025 Council of Europe/Eurojust joint workshop on the Second Additional Protocol to the Convention on Cybercrime. Council of Europe. https://www.coe.int/en/web/cybercrime/-/2025-council-of-europe/eurojust-joint-workshop-on-the-second-additional-protocol-to-the-convention-on-cybercrime
6. Council of Europe. (2026). Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence. Council of Europe. https://www.coe.int/en/web/cybercrime/second-additional-protocol
7. Eberle, E. J. (2011). The methodology of comparative law. Roger Williams University Law Review, 16(1), 51–71.
8. (2025). E-evidence: Cross-border access to electronic evidence. In Annual report 2025. European Union Agency for Criminal Justice Cooperation.
9. (2026). SIRIUS electronic evidence situation report 2025. European Union Agency for Criminal Justice Cooperation.
10. European Commission. (2026, September 29). E-evidence. European Commission.
11. European Parliament & Council of the European Union. (2023). Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings. Official Journal of the European Union, L 191, 118–180.
12. European Union. (2025). Council Decision (EU) 2025/2307 of 13 October 2025 on the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime. Official Journal of the European Union.
13. Government of (2000). Undang-Undang Republik Indonesia Nomor 24 Tahun 2000 tentang Perjanjian Internasional. https://peraturan.bpk.go.id/Details/44991/uu-no-24-tahun-2000
14. Hemmings, J., Srinivasan, S., & Swire, P. (2020). Defining the scope of “possession, custody, or control” for privacy issues and the CLOUD Act. Journal of National Security Law & Policy, 10, 631–660.
15. Hutchinson, (2018). Doctrinal research: Researching the jury. In D. Watkins & M. Burton (Eds.), Research methods in law (2nd ed., pp. 8–39). Routledge.
16. Hutchinson, , & Duncan, N. (2012). Defining and describing doctrinal legal research. Deakin Law Review, 17(1), 83–119.
17. Kuczyńska, H. (2024). The EU e-evidence package from the Polish perspective: High time for a systemic change. Studia Iuridica Lublinensia, 33(5), 125–153. https://doi.org/10.17951/sil.2024.33.5.125-153
18. Kusuma, B. (2025). Jurisdictional challenges in prosecuting transnational cyber offenders in Indonesia. Indonesian Journal of Digital Crime and Criminal Justice, 1(2), 309–346. https://doi.org/10.68080/jdccj.v1i2.29
19. Legrand, P. (1997). The impossibility of “legal transplants.” Maastricht Journal of European and Comparative Law, 4(2), 111–124.
20. Liat, E., & Wahyuningtyas, S. Y. (2025). Personal data protection in cloud computing businesses in Indonesia: Cross-border data transfers and access by public authorities. Refleksi Hukum: Jurnal Ilmu Hukum, 9(2), 195–214. https://doi.org/10.24246/jrh.2025.v9.i2.p195-214
21. MacNeil, (2026). Extraterritoriality in transnational criminal law: The sovereignty paradox. AJIL Unbound, 120, 225–230. https://doi.org/10.1017/aju.2026.10082
22. Ministry of Home Affairs Singapore. (2017, January 9). Computer Misuse and Cybersecurity (Amendment) Bill. https://www.mha.gov.sg/media-room/newsroom/computer-misuse-and-cybersecurity-amendment-bill/
23. Rahman, , & Mulyania, C. K. (2025). Minimising unnecessary restrictions on cross-border data flows? Indonesia’s position and challenges post personal data protection act enactment. International Review of Law, Computers & Technology, 39(2), 281–300. https://doi.org/10.1080/13600869.2024.2359901
24. O’Sullivan, B. (2025). Legal and national security reform: Reconstructing data privacy regulations in the era of Indonesia’s digital sovereignty. Vifada Assumption Journal of Law, 3(1). https://doi.org/10.70184/9c2pfk27
25. Putra, G. R. A. (2026). Kedudukan bukti digital dalam sistem peradilan pidana Indonesia: Rekonsepsi pengaturan dan penguatan chain of custody di era cyber-enabled crime. BULETIN ADALAH, 8(7). https://doi.org/10.15408/adalah.v8i7.51879
26. Republic of (2006). Law No. 1 of 2006 concerning mutual legal assistance in criminal matters.
27. Republic of (2008). Law No. 11 of 2008 concerning electronic information and transactions.
28. Republic of (2022). Law No. 27 of 2022 concerning personal data protection.
29. Republic of (2023). Law No. 1 of 2023 concerning the Criminal Code.
30. Republic of (2024). Law No. 1 of 2024 concerning the second amendment to Law No. 11 of 2008 concerning electronic information and transactions.
31. Republic of (2025). Law No. 20 of 2025 concerning the Criminal Procedure Code.
32. Republic of (2026). Law No. 1 of 2026 concerning criminal adjustment.
33. Ryngaert, (2015). Jurisdiction in international law (2nd ed.). Oxford University Press.
34. Ryngaert, (2022). Extraterritorial enforcement jurisdiction in cyberspace: Normative shifts. German Law Journal, 23, 757–780. https://doi.org/10.1017/glj.2022.48
35. Sachoulidou, (2024). Cross-border access to electronic evidence in criminal matters: The new EU legislation and the consolidation of a paradigm shift in the area of “judicial” cooperation. New Journal of European Criminal Law, 15(3), 256–
36. https://doi.org/10.1177/20322844241258649
37. Shurson, (2025). Investigative jurisdiction: The evolving limits of extraterritoriality in transnational digital investigations.
38. International & Comparative Law Quarterly, 74, 675–705. https://doi.org/10.1017/S0020589325100985
39. (1993). Computer Misuse Act 1993 (Cap. 50A). Singapore Statutes Online. https://sso.agc.gov.sg/Act/CMA1993
40. Svantesson, J. B., & Osula, A.-M. (2025). Unresolved jurisdictional issues in law enforcement access to data. In V. Franssen & S. Tosza (Eds.), The Cambridge handbook of digital evidence in criminal investigations (pp. 43–67). Cambridge University Press. https://doi.org/10.1017/9781009049771.004
41. Tobing, A. N. L., & Fitria, A. (2025). Jurisdiction and locus delicti of transnational cybercrime: A normative study of international law and Indonesian telematics law. Interdisciplinary Social Studies, 5(1), 27–36. https://doi.org/10.55324/iss.v5i1.951
42. United Nations. (1969). Vienna Convention on the Law of Treaties. United Nations Treaty Collection. https://treaties.un.org/pages/ViewDetailsIII.aspx?chapter=23&lang=en&mtdsg_no=XXIII-1&src=TREATY
43. United Nations. (2024). United Nations Convention against Cybercrime: Strengthening international cooperation for combating certain crimes committed by means of information and communications technology systems and for the sharing of evidence in electronic form of serious crimes. United Nations.
44. United Nations General Assembly. (2024). United Nations Convention against Cybercrime: Strengthening international cooperation for combating certain crimes committed by means of information and communications technology systems and for the sharing of evidence in electronic form of serious crimes (A/RES/79/243). United Nations.
45. United Nations Office on Drugs and Crime. (2020). Report on the meeting of the Expert Group to Conduct a Comprehensive Study on Cybercrime. United https://www.unodc.org/documents/Cybercrime/IEG_Cyber_website/UNODC_CCPCJ_EG.4_2020_2/UNODC_CCPCJ_EG. 4_2020_2_E.pdf
46. United Nations Office on Drugs and Crime. (2024). Electronic evidence: Cross-border access to electronic evidence. United
47. United Nations Office on Drugs and Crime. (2025a). International cooperation against cybercrime and electronic evidence [Working paper]. United Nations.
48. United Nations Office on Drugs and Crime. (2025b). The nexus between cybercrime and corruption. United Nations Office on Drugs and Crime.
49. United (2026). United Nations Convention against Cybercrime: Status of treaties—Indonesia. United Nations Treaty Collection. https://treaties.un.org/Pages/ViewDetails.aspx?chapter=18&mtdsg_no=XVIII-16&src=TREATY
50. United States (2026). 18 U.S.C. § 2703: Required disclosure of customer communications or records. Office of the Law Revision Counsel, U.S. House of Representatives.
51. United States (2018). Clarifying Lawful Overseas Use of Data Act (CLOUD Act), Pub. L. 115-141, div. V, 132 Stat. 1213.
52. Urbas, (2008). An overview of cybercrime legislation and cases in Singapore (Working Paper Series No. 001). Asian Law Institute, National University of Singapore. https://law1a.nus.edu.sg/asli/publications/wps001.html
53. Van Hoecke, (Ed.). (2011). Methodology of legal research: Which method for what kind of discipline? Hart Publishing.
54. Varbanova, G. (2025). Electronic evidence as an independent legal phenomenon: Theoretical framework and European practice. Journal of Digital Technologies and Law, 3(3), 497–511. https://doi.org/10.21202/jdtl.2025.20