Imagine checking your phone and instead of finding a list of unread WhatsApp messages from families and colleagues, you find a harrowing notification saying, “You’ve registered your number on another phone”.

After scrambling on social media to announce the hacking, you gain control of the text messaging application, but only to find that whoever hacked your account has broadcast a message inciting people to take part in nationwide riots a day before May Day.

You realize there is something sinister about the whole incident and seek advice from human rights organizations who tell you to switch off your phone and find a safe house. But the police get to you first. They arrest you on incitement charges, along with a foreign national, just before you step into a vehicle owned by a local foreign embassy.

That is not the plot of a dystopian novel. That, according to media reports, is the real-life story of Ravio Patra, an independent researcher who is known to be critical of the government, including the way it is handling the COVID-19 pandemic.

Ravio was arrested on Wednesday and released on Friday. According to the National Police, he was detained along with a Dutch national identified as RS, before entering a vehicle with a Dutch diplomatic plate number.

The police are now investigating him for allegedly broadcasting a “provocative” message that “incites hate and violence”.

“We are now waiting for the results [of the investigation] on whether his [WhatsApp account] had been hacked or not,” said National Police spokesperson Brig. Gen. Argo Yuwono.

His arrest will likely go down in history as one of the worst blunders made by the National Police in their war against fake news and online hate speech, the ailments of the digital world that activists say are used by the powers that be as a pretext to undercut civil rights.

Read also: Government critic faces incitement charges after WhatsApp hacked

The infamous Electronic Information and Transactions (ITE) Law has already turned Indonesia’s cyberspace into a jungle, in which those with power could use a set of ambiguous articles in the law to turn casual remarks or involuntary actions on social media into a felony that is punishable by jail time.

There is already a long list of online defamation cases in which regular social media users are jailed based on flimsy legal arguments and scanty evidence. Former Jakarta governor Basuki “Ahok” Tjahaja Purnama and rock star Ahmad Dhani are among the more well-known figures to have fallen victim to the draconian law, which has disproportionately targeted those who are politically and economically weak.

But Ravio’s case is different in a way that it exposes a significantly more dangerous aspect of Indonesia's cyberspace: that your privacy does not mean anything and could easily be compromised by powerful people with ill intentions. The closest case to Ravio’s is that of Rizieq Shihab and Firza Husein, who were charged with pornography after their personal chats were uploaded on social media by an unidentified party.

With the police repeatedly showing their poor judgment — whether intentionally or unintentionally — in handling politically-charged cybercrime cases, we can safely assume that every Indonesian with internet access is subject to questionable prosecution.

We do not know who hacked Ravio’s WhatsApp account, but whoever did it has the capability of bypassing the strong security measures used by Ravio, including the two-step verification and a fingerprint. This has raised speculations that the perpetrators have accesses or resources that only state institutions have.

Ravio himself claimed that during the hacking attempt, he was contacted by two local numbers and two international numbers from Malaysia and the United States. A tracing of the local numbers showed that they are allegedly owned by two police officers, according to human rights activists.

The motive for the hacking is still a mystery. It is unlikely that whoever is responsible is doing it for financial reasons, as they have not asked for money either from Ravio or his contacts. The broadcast message itself seems to have been composed to reinforce the fears of a possible riot during the COVID-19 pandemic, which has led to mass layoffs.

The message calls on people to join “nationwide riots” on April 30, when workers across the country are expected to rally against the controversial omnibus bill on job creation despite the pandemic.

The police initially played a part in stoking such fears by announcing that an obscure group called Anarcho Syndicalist was planning to incite looting across Java, only days after the government imposed a partial lockdown on the capital. Critics doubt the claim, saying the group was too small and disjointed to instigate mass riots.

Suspicions aside, the police must focus on investigating Ravio’s hacking claim before laying any charges against him. If his claim is proven right, the police must hunt down the perpetrators to ascertain their real motive. This will vindicate the police and assure the public that such actions will not go unpunished.

The curious case of Ravio Patra should not be taken lightly. With a draconian cyberlaw and the absence of legislation on privacy, failing to resolve it will only make Indonesia’s cyberspace look more and more like a dystopian nightmare.