The flow of passenger-related information from airlines to border control authorities can be divided into two main streams of data: advance passenger information (API) and the passenger name record (PNR). API data are generated during the check-in process, while PNR data are generated at the time of booking or purchasing a flight ticket.

nalysis of the data enables Customs to identify anomalies such as travel itineraries involving sensitive or illogical routes, passengers travelling with a suspicious amount of luggage for the length of their stay, unusual forms of payment, suspect travel agencies, etc., or a combination of these different elements.

Two systems, two analytical tools

Indonesian Customs implemented the electronic exchange of API between airlines and Customs in 2009 and the electronic exchange of PNR in 2015 (see WCO News June 2015 edition). Although, when building the PNR system, the intention was to bring together API and PNR data under the same platform, this soon proved to be too difficult to achieve.

At the time, the Administration had just successfully completed the implementation of new systems for Customs processing which had required the allocation of substantial resources and manpower. There were therefore budgetary and human resource constraints at play. Moreover, API was being collected by several distributed systems at local Customs offices responsible for overseeing passenger flows, which meant that the Administration first needed to build a centralized API system to accommodate the needs of the various Customs offices. As for the proposed integration of API and PNR data, this required the development of substantial storage and data management capacities. It was essential both that the underlying system was able to keep up with constant data streams and that it was always available. In some enforcement areas, officers can cope with system downtimes. This is not the case, however, when managing risks related to passengers.

Until recently, therefore, officers of the air passenger analysis unit needed to open two separate applications in order to be able to visualize the data, and carrying out the analysis was very time-consuming and energy-intensive. They reported that the excessive amount of data displayed on the screens often led to “analysis paralysis”, which would cause a great deal of confusion and stress. In 2016, during a coordination meeting that took place a few months after the PNR system had been deployed, they agreed on the need for a unified platform.

A project to integrate API and PNR data into a single platform was launched in 2017. Most airlines in Indonesia use the SITA Network to collect API, but some use local API providers. Moreover, different global distribution services (GDS) are used for PNR. Indonesian Customs therefore had to bring several stakeholders on board, including three GDS providers.

One of the challenges was the development of an IT infrastructure able to store and analyse a large amount of data. The annual count of international passengers reached 23 million in 2024, which means that a standard application architecture is inadequate for handling the corresponding volume of data. Some of the application requirements include fast query processing and a high availability of data. Consequently, a two-layer storage system was implemented: the first layer focuses on receiving the data, as well as any redundancies, while the second layer stores cleansed, properly structured data for rapid querying and analysis. This design minimizes the impact of application crashes on the underlying data pipeline.

Various regulations had to be examined to ensure that the integration project was fully compliant with the legal framework. These included:

• regulations on the general protection and confidentiality of passenger data (2014);
• data governance and information security management rules issued by the Ministry of Finance (2019); and
• guidelines on the governance of API/PNR systems developed by Indonesian Customs (2021).

A number of obstacles were encountered during the pilot phase, mainly in connection with data transmission, which was not as smooth as had been expected. While GDS followed international standards for the transmission of PNR data, local API providers did not. This highlighted the importance of continuing to develop a more robust understanding of data transmission, which is a field of knowledge in itself, and to keep an open channel of communication with data providers in the event of any difficulties being encountered.

Integration was completed in 2019, and it was then that training started for passenger analysts at various Customs offices located at major international airports in Indonesia, such as Kualanamu International Airport, Soekarno-Hatta International Airport, Juanda International Airport and Ngurah Rai International Airport.

Metrics to monitor and evaluate the completeness of API and PNR data were established, enabling the system to flag passengers for whom data are incomplete. Parameters can also be added to select passengers based on a specific profile or scenario. Additionally, PNR data are analysed to identify similarities between passengers’ data and highlight potential relationships between them.

A fraud detection tool that leverages machine-learning techniques has been developed to support analysts. The way the tool works is rather complex. To put it simply, it compares data at three different levels in order to identify potential connections and look for similarities to patterns and scenarios drawn from previous cases.

The system is also connected to a facial recognition system that collects data from surveillance cameras deployed at strategic locations within airports. This enables Customs officers to analyse the behaviour of suspects and keep track of their whereabouts.

While Indonesian Customs’ mission is primarily to enforce laws regulating cross-border movements of goods, it also plays a crucial role in enhancing border security, in particular by combating drug-related offences. The integrated analytical system is used not only by passenger analysts but also by units responsible for monitoring narcotics smuggling operations and transnational crimes who support officers of the National Counter-Terrorism Agency and of the National Narcotics Board. All officers involved conduct parallel analyses and share their results through dedicated focus groups.

Most of the seizures that have taken place at the airports have involved drugs. During the development of the analytical system from 2014 to 2019, the number of narcotics cases appeared to plateau. After its full implementation in 2019, the number of positive controls substantially increased. Although the number of seizures declined in 2020 due to the travel restrictions adopted to contain the COVID-19 pandemic, this system has overall made a significant contribution to the fight against drug trafficking by air in Indonesia.

Challenges

Despite these positive results, maintaining and using such a system is not without its challenges. One such challenge involves receiving data in a systematic and consistent way. Although there is an obligation for airline operators to submit their data according to a specific time frame, some smaller ones still do not comply for various reasons (for example, some have no data delivery system or cannot bear the financial costs of the transmission), and some even refuse to share PNR data, citing passenger confidentiality concerns. Moreover, operators frequently change GDS or even API service providers, resulting in ongoing data availability issues years after the system’s launch. Finally, their use of different channels to collect and send API and PNR data often leads to discrepancies in the data they provide.

Another challenge is maintaining a functional data pipeline; sometimes the data received are incomplete, can only be partially parsed or cannot be parsed at all. This leads to disputes between airlines claiming compliance and the receiving end asserting that the data pipeline is functioning correctly.

Such matters are addressed in meetings with airline representatives; one such meeting led to a call to action being issued approximately nine months after the launch of the integrated API/PNR system, requesting airline operators to report any difficulties they encountered, describe them in detail and suggest ways in which the Administration could help.

As data blind spots still occasionally occur, local Customs offices must maintain communication with airport authorities and request to be notified in the event of specific arrivals of persons of interest. Local ground handlers contracted by the respective airlines are also kept in close contact should further information be required.

To bolster border security, relying solely on passenger data from airlines is insufficient, but very few private aircraft, sea and land carriers provide electronic API and/or PNR (or the equivalent of PNR). In the past, data on passengers arriving at land and sea ports of entry were provided electronically to Customs by the immigration service. However, this data flow ceased following a national data breach in 2024.

An internal working group consisting of various members of staff from the Directorate General of Customs and Excise as well as representatives of general aviation, maritime carriers and international bus operators has been established with a view to exploring the possibility of setting up a system to enable the electronic transmission of API and PNR (or the equivalent of PNR).

However, engaging with non-regular modes of transport, such as private jets and cruise ships, poses a specific issue, as these entities typically lack dedicated agents responsible for maintaining communication with the Indonesian Government or tend to engage with the Government only on an ad-hoc basis. This situation complicates the standardization and digitalization of data provision processes, presenting challenges that are not only technical but also political and bureaucratic in nature.

More information
Tri Mulyadi Wibowo
Sandi Putra Pratama