LIMS and Lawful Interception: Keeping Audit Logs Intact

Searches for LIMS spiked after Indonesia’s police criminal investigation agency, Bareskrim, announced an alleged illegal wiretapping case on 3 November 2026. LIMS, or Lawful Interception Management System, is the software that manages legal interception by law enforcement. This piece explains how it works, the rules in Indonesia, and what it teaches about audit logs.

How lawful interception works

Lawful interception is the monitoring of communications at the request of law enforcement, backed by a legal basis. Under this model, investigators ask a telecom operator to route the communications of a specific number to a monitoring facility run by law enforcement.

One widely cited technical standard is ETSI TS 101 671, published by the European Telecommunications Standards Institute. It splits the handover between operator and agency into three ports. The first (HI1) carries administrative orders, such as activating or ending an interception. The second (HI2) carries intercept related information, including numbers dialled, call times, and location. The third (HI3) carries the content of the communication.

The standard also sets a few important limits. To activate an interception, the agency must provide the target identity and the start and end of the interception. It also states that the agency’s monitoring facility shall have no direct control over the operator’s equipment. Every order passes through the administrative port, where it is recorded.

LIMS sits on the management side. It records registered targets, stores the validity period of each operation, receives results from operators, and controls who may open them. That makes the records inside LIMS the main evidence of whether an interception followed procedure.

The approval process under Perkap 5 of 2010

For the Indonesian National Police, the procedure is set out in National Police Chief Regulation No. 5 of 2010 (Peraturan Kapolri Nomor 5 Tahun 2010 tentang Tata Cara Penyadapan pada Pusat Pemantauan Kepolisian Negara Republik Indonesia, on interception procedures at the police monitoring centre). It sets four layers of checks before a number can be tapped.

First, an investigator submits a written request (Article 9). It must include the police report number, a short description of the offence and the articles alleged, the reason for the interception, and the target phone number. Second, the head of Bareskrim is designated as the official who authorises the start of an operation and assesses whether it is warranted (Article 5). Third, if it is warranted, the head of Bareskrim applies for permission to the Chief Judge of the District Court where the operation will take place (Article 6). Fourth, the monitoring centre links the target with the operator through provisioning, after approval from the head of Bareskrim (Article 13).

The same regulation caps each interception operation at 30 days (Article 11). Results unrelated to evidence must be destroyed by the monitoring centre and documented in an official report (Article 20). The head of Bareskrim acts as supervisor to ensure the operation is transparent and accountable (Article 22).

The higher legal basis is still taking shape. On 24 February 2011, the Constitutional Court ruled in Decision No. 5/PUU-VIII/2010 that interception restricts human rights, so its procedures must be set by statute. That dedicated law does not exist yet. In January 2026, Deputy Minister of Law Edward Omar Sharif Hiariej said interception outside corruption and terrorism cases must wait for a separate law, as quoted by Metro TV from Antara.

The alleged misuse described by Bareskrim

At a press conference on 3 November 2026, Bareskrim chief Commissioner General Asep Safrudin said a number of phone numbers were allegedly entered into LIMS without verification and without a valid law enforcement basis between 2025 and 2026, as reported by TIMES Indonesia. According to Liputan6, intercept files on the LIMS computer were allegedly ordered deleted around October 2026. Police have named suspects, the investigation is ongoing, and the presumption of innocence applies.

From a systems governance view, two points stand out in the official account. Target data could allegedly enter the system without the required verification, and the interception records could allegedly be erased from within the same system. Liputan6 also reports that the case came to light when an officer who knew of the conduct reported it on 30 October 2026. In other words, it surfaced through an insider’s report.

The same pattern can occur in any system that holds sensitive data, from civil service records and regional tax systems to electronic medical records. A privileged account that can change data and also erase the record of doing so makes abuse hard to detect.

Audit logs that insiders cannot erase

An audit log is an automatic record of who did what, when, and from where inside a system. NIST SP 800-92, the US guide to computer security log management, stresses that logs and their archives must be protected against alteration. It also recommends that someone other than the system administrator review a system’s logs, so the administrator’s own actions remain accountable.

In practice, organizations can add several layers of protection:

1. Forward logs to a separate system in real time. Logs are copied immediately to a log server run by a different team. Deleting them at the source leaves the copy untouched.
2. Store logs on immutable media. Many storage services offer write once, read many (WORM) or object lock modes, so log files cannot be overwritten until their retention period ends.
3. Chain records with hashes. Each entry stores a digital fingerprint of the previous one. If a line is changed or removed, the chain breaks and the change becomes visible.
4. Alert when logs go quiet. An unusual gap or a drop in log volume often signals that someone has disabled or deleted records.
5. Require two-person approval for sensitive actions. Adding a target, changing access rights, or deleting data needs a second, recorded approval.

These layers support one another. A separate copy preserves the content, a hash chain proves it is authentic, and automated alerts make sure someone notices quickly when something changes.

What this means for agencies and organizations

Most agencies never run an interception system, but nearly all of them hold sensitive data about citizens or customers. A local tax office, a hospital with electronic medical records, and a bank with customer data all face a similar risk: privileged accounts whose actions nobody reviews.

Practical steps to start with:

• Map privileged accounts. List who can add records, change access rights, or delete entries, then cut that list to the people who truly need it.
• Separate system administration from log administration. Application administrators should not be able to delete logs on the log server.
• Set log retention periods. Match them to audit needs and the rules that apply to your sector, then lock retention at the storage layer.
• Test regularly. In a test environment, try to delete or alter a log line and confirm that alerts fire and the copy on the separate server stays intact.
• Provide an internal reporting channel. The case announced by Bareskrim shows how much depends on insiders speaking up. A safe reporting channel complements technical controls.

If your organization is reworking how it manages access rights and logs, Merakit’s cybersecurity services team can help review the architecture. For public agencies, this can be part of strengthening digital government solutions. If your data has leaked before, our guide on recycled data leaks is also relevant.

Frequently asked questions

What does LIMS stand for?

LIMS stands for Lawful Interception Management System, the software used to manage legal interception. It records targets, sets the validity period of each operation, receives results from telecom operators, and controls who can access them.

Do Indonesian police need court permission to intercept?

Under Perkap 5 of 2010, the head of Bareskrim applies to the Chief Judge of the District Court for interception permission after finding an investigator’s request warranted. In very urgent cases, the operation must be reported to the head of Bareskrim within 24 hours. A dedicated law covering interception as a whole does not exist yet.

How can you tell if an audit log has been altered?

The common approach is to compare logs at the source with the copy on a separate server, verify the hash chain between entries, and watch for gaps or drops in log volume. Any mismatch means the records need a closer look.

Conclusion

Lawful interception is designed with several layers of approval, from a written request to a court permit. Those layers only matter if every step is recorded and the record cannot be erased by the same people who act on it. The same lesson applies to any organization that stores sensitive data. We are happy to help if you want to check how well the audit logs in your systems hold up today.

Sources

• Penyadapan Presiden Prabowo Diduga Tanpa Prosedur, Bukti Sadapan Dihapus (TIMES Indonesia, 3 November 2026)
• Kronologi Dugaan Penyadapan Presiden Prabowo (Liputan6, 3 November 2026)
• Prabowo informed of illegal wiretapping, minister says (ANTARA, 4 November 2026)
• National Police Chief Regulation No. 5 of 2010 on Interception Procedures at the Police Monitoring Centre (Pasal.id)
• Constitutional Court Decision No. 5/PUU-VIII/2010 (Constitutional Court, 24 February 2011, via Pasal.id)
• ETSI TS 101 671 V3.14.1: Handover Interface for the Lawful Interception of Telecommunications Traffic (ETSI, March 2016)
• NIST SP 800-92: Guide to Computer Security Log Management (NIST, September 2006)
• Wamenkum: Penyadapan di Luar Kasus Korupsi dan Terorisme Tunggu UU (Metro TV, 6 January 2026)