Civil Servants Caught Faking Attendance: How They Manipulated the System and How to Prevent It
The Brebes Police have uncovered a case of alleged misuse of the electronic attendance system by civil servants (ASN) within the Brebes Regency Government, resulting in the arrest of nine suspects. The case came to light following a report of illegal online attendance on 29-30 April 2026 by the Regional Human Resources Development and Personnel Agency (BKPSDMD). Investigations revealed that coordinate points were manipulated, allowing ASN to clock in even when they were not at the designated location.
Cybersecurity expert Alfons Tanujaya explained three possible methods used to carry out the fake attendance. The first involves using the Mock Location feature on Android devices, where a cheating application registers as a fake location provider, replacing the actual GPS signal. The second method uses a rooted device or a framework to hook directly into the Location Manager API, feeding fake coordinates to the target application without being detected as a mock provider.
The third scenario, which Alfons suspects is the most likely in this case, involves sending requests directly to the attendance backend API. “This is likely what happened and should be a concern because the weakness lies in the attendance server. The app probably sent a request directly to the presensi backend API with a list of coordinates prepared beforehand,” Alfons told CNBC Indonesia. He noted that this is a serious issue, indicating that the server was not properly secured or was left open, allowing reverse engineering of the protocol or API. This suspicion is supported by an official statement that “the server was turned off but attendance records still went through.”
To prevent similar incidents, Alfons suggested several security measures. He recommended validating requests to ensure they come from unmodified devices and rejecting any direct API access without a valid signature. He also advised cross-checking location signals beyond just GPS, such as verifying the WiFi BSSID and cell tower ID, as these cannot be spoofed by mock location apps. Finally, he proposed upgrading to a biometric liveness-based attendance system to ensure the physical presence of the individual, while maintaining strict server-side security to block unauthorized direct API access.