Highly invasive spyware and other rights-threatening surveillance technologies have been used to target human rights defenders, journalists and other members of civil society worldwide, as documented by an ever-growing body of research. This research provides a case study on how one country, Indonesia, is relying on a murky ecosystem of surveillance suppliers, brokers and resellers that obscures the sale and transfer of surveillance technology. The investigation also showcases the continued failure of multiple countries to regulate and provide transparency on the exports of dual-use technologies, such as spyware, and the non dual-use hardware that hosts the spyware or surveillance technology which pose serious human rights risks. Through open-source intelligence, including commercial trade databases and spyware infrastructure mapping, Amnesty International has uncovered numerous spyware imports or deployments between 2017 and 2023 by companies and state agencies in Indonesia. This months-long investigation by Amnesty International’s Security Lab was carried out in collaboration with Haaretz, Inside Story, Tempo, WAV research collective and Woz.