In Tangerang, men claiming to repair a mobile-phone tower were challenged because they could not show a work letter. They fled. The reported equipment loss was Rp481.6 million. The episode suggests an obvious business: check the technicians before expensive equipment leaves. Yet Indonesian tower companies have been buying digital access systems for years. The opportunity, if there is one, lies in a failure those systems still leave behind. [1][4][5]
The distinction matters because a permission to enter a site is not necessarily permission to remove a particular piece of equipment. That is the question worth investigating: could an outside company reconcile the visit with the authorised job, and prevent enough losses to earn its fee?
A tower has several parties to satisfy
A tower company rents infrastructure that mobile operators can share, reducing the need for each operator to build its own. The operator places equipment at the site to deliver mobile service. Mitratel describes this shared-infrastructure model; its reported portfolio includes many more operator tenancies than towers. [11][10]
The equipment matters as much as the structure. Radio modules help provide the signal; batteries keep the site powered when the normal supply fails. Police accounts describe thefts of both. Maintaining that equipment requires people to enter the compound, so a useful security system must let genuine work proceed as well as keep thieves out. [9][8][6]
Impersonation is one route in. In a 2024 Jakarta case, police said a suspect arrived as though he were a provider technician, carrying provider letterhead. Investigators put the wider losses at about Rp120 billion and a module at around Rp90 million. Those are case-specific police estimates. They do not tell us the annual risk at an average tower. [2]
Legitimate industry knowledge can also be involved. Reporting on an XLSmart investigation in July 2026 described repeated losses of roughly Rp5 billion and suspects employed by a network-installation vendor. A valid-looking visitor is therefore only part of the problem; checking identity alone could leave the damaging action untouched. [3]
The digital lock is already in the market
Mitratel reported 1,292 smart locks installed by the end of 2022, with user authorisation and access histories. Willowmore announced a multi-year Protelindo smart-padlock agreement in December 2021 and, separately, its selection by Mitratel. The latter announcement described remote access allocation and integration with external sensors. [4][5][6]
These records overturn the idea that a newcomer would enter a paper-only market. They do not establish current coverage at every site, or prove how well each installation prevents theft. The choice today may be to extend a system the customer already owns. Willowmore currently markets remote access and audit records; iLOQ offers contractor credentials, access logs and interfaces for connecting locks to other systems. Neither page publishes a price for the proposed Indonesian service. [13][7]
There is a reason to preserve that arrangement: authorised technicians need prompt access. A second approval system would have to justify its added work and any delay to repairs. An operator should first ask its existing supplier to close the same gap.
| Permission | Question it answers | What still needs checking |
|---|---|---|
| Site access | May this person enter here now? | Existing suppliers offer digital authorisation and logs. [4][7] |
| Equipment work | Does the approved job allow this item to be removed? | Whether current contracts and systems already reconcile this, and whether missing checks caused preventable losses. |
Sell responsibility for the exception
Neutral Entry Verification for Shared Sites is the strongest business to investigate first. The proposed customer is an operator with repeated module losses at a reachable group of western-Java sites. Its security or network-management budget would pay a monthly fee for a service connecting the tower owner’s access record with the operator’s current work order—the instruction specifying the approved job.
The company would obtain permission to read those records, check visitor identity, site, time and authorised work, and send mismatches to an agreed operator decision-maker. Suspected removal outside the approved job would trigger the customer’s security procedure, with an existing security partner where physical attendance is needed. It would preserve an incident record. These are proposed operations; no operator or tower company has agreed to provide the access or buy the service.
The reason to buy would be fewer preventable losses without making the operator staff another exception-handling desk. That advantage only exists where its present lock supplier, maintenance contractor and own employees do not already provide the same outcome economically. A team with telecom maintenance experience, software-integration skills and an established security-service partner could attempt it. It would need the operator’s authority and the tower owner’s cooperation, rather than assuming that being neutral earns either.
The initial sale should go through a network or security executive at an operator with documented losses, followed by its IT team, procurement staff and the relevant tower owner. The proposal would compare an additional service with extending the current supplier’s contract and operating it internally. Integration, procurement and a trial consume cash before a monthly contract starts. Existing suppliers could copy the checking procedure; the company’s useful asset would be a working service across an agreed portfolio, not a novel lock.
A cheap-looking fee can require many prevented thefts
Consider an illustrative fee of Rp250,000 per site each month. Across 1,000 sites that is Rp3 billion a year. Using the 2024 case’s Rp90 million module valuation, the service would need to prevent about 34 single-module losses a year merely to equal its fee. If it prevented half the relevant thefts, the portfolio would need roughly 67 such losses a year before the service began. Insurance recoveries or a lower retained loss make the hurdle higher; documented savings from outages could lower it. None of those portfolio-level figures has been established. [2]
This is why one spectacular ring total cannot establish willingness to pay. The buyer needs the losses on the sites being billed, the part it actually bears, and the share this particular check would prevent. A vendor employee with a genuinely authorised removal could defeat it; forced entry bypasses it altogether.
The company’s costs also need a ceiling. At that assumed fee, a target 50% contribution margin leaves Rp125,000 per site per month for integration allocated over the contract, software, checking staff, partner charges and support. With assumed central overhead of Rp1.2 billion a year, it would need about 800 paying sites at that contribution to cover overhead. This is a budget to test with quotes and staffing requirements, not a cost estimate.
Buying locks is a different expense from running this service. If an operator already owns suitable locks and can obtain the same checks from its staff, outsourcing may lose immediately. In an illustrative equivalent-service comparison, an internal setup costing Rp600 million plus Rp100 million a month would beat a Rp250 million monthly service bill for 1,000 sites after four months. Those internal costs are assumptions, not a quotation; the deciding question is what maintaining the same coverage and response actually costs.
There is room for a small company if enough suitable sites exist. The three large tower groups’ reported mid-2026 portfolios imply roughly 102,000 physical towers. Applying explicit assumptions about western Java, sites still needing this check and contract wins produces about 840–4,200 paying sites. At an assumed Rp150,000–300,000 monthly fee, that is roughly Rp1.5–15.1 billion in annual revenue. The low end would not support the cost structure above; the upper end could support a lean specialist. The share genuinely needing an extra service is the weakest input, not an observed market. [10][14]
Other regions could offer the same work once the company has reusable integrations and operating procedures. Fibre and power cabinets are possible later customers because access-control suppliers already serve those assets, but that is a reason to examine expansion, not revenue to add to this estimate. [7]
Start with the records of losses
Before building another platform, ask one willing operator to compare a recent year’s incident files with the permits, work orders, access logs and insurance recoveries for the same sites. Could the proposed checks have distinguished an unauthorised action before equipment left? How many legitimate visits would they have delayed? Obtain an equivalent quote from the current supplier and the operator’s own costed alternative. This is a proposed test, not work this investigation has commissioned.
If the records show that existing checks already did the job, or that the avoidable retained losses fall below the additional fee and disruption, stop pursuing that portfolio. If a material loss category passes through an unowned handoff, make a priced service offer before commissioning new hardware.
Theft and an established security market are documented. A profitable space between them is still a hypothesis. Telecom security and maintenance managers who can distinguish permitted entry from authorised equipment removal—and attach the actual loss and service costs—could settle it more usefully than another demonstration that a phone can open a gate.
Research Notes
The sources, calculations and evidence records behind this investigation. Numbered citations in the article link here; ↩ returns to the text.
Basis of the investigation
This revisits an earlier unpublished investigation into Indonesian telecom-equipment theft. New verification materially changes its premise: documented digital-lock procurement and deployment replace the earlier broad claim that entry rests on unchecked paper letters. No existing published post is being edited. Public API searches for “tower security”, “Tangerang” and “telecom operator” returned no posts on 2 November 2026; this is a bounded repeat check, not proof that all related coverage is absent. The titles and H2 headings of the five latest published posts were also read.
Sources and limits
1. Fenomena Maling BTS Bikin Internet Lumpuh, Menkomdigi Buka Suara — CNBC Indonesia, 27 October 2026 ↩
Original source. Full article read directly after the research reader returned 403. Supports the Tangerang amount, impersonation and challenge for a missing work letter. It does not establish universal weak verification.
2. 5 Pencuri Modul BTS di Jakpus Ditangkap, Kerugian Rp120 Miliar — detikNews, 14 October 2024 ↩
Original source. Full report read. Police valuation and provider letterhead; the article does not explicitly establish that the letter was forged. Loss total has no site-year denominator and is not annual revenue.
3. Kasus Pencurian Modul BTS Operator Selular, Libatkan Jaringan Internasional — Selular.ID, 14 July 2026 ↩
Original source. Full report read. Police account of repeated XLSmart losses and vendor-employee suspects. Employment does not establish whether any particular removal held a valid work order.
4. Mitratel Sustainability Report 2022, printed pages 35–36 ↩
Original source. Relevant report section read, printed pages 35–36. Historical deployment, access authorisation, logs and managed services. The 1,292 count is for end-2022, not current coverage or measured theft prevention.
5. Willowmore for Towercos — Willowmore, 21 December 2021 ↩
Original source. Full short announcement read directly. Historical procurement announcement, not confirmation that every Protelindo site was equipped or that losses ended.
6. Mitratel Selects Willowmore — Willowmore, 29 December 2021 ↩
Original source. Full short announcement read directly. Historical selection, remote permissions and external-sensor integration capability; no prevention outcome or current coverage count.
7. iLOQ for telecom operators — iLOQ, accessed 2 November 2026 ↩
Original source. Full relevant product page read. Vendor claims on credentials, locks, logs and integration; no independently established Indonesian deployment, service outcome or public price.
8. Polri Bongkar Komplotan Pencuri Baterai Tower di 17 Titik, Kerugian Capai Rp432 Juta — IDXChannel via RCTI+, 7 August 2026 ↩
Original source. Full syndicated IDXChannel report read. Police account of 17 locations, cable cutting, battery role and case-level values; no measured response time or control-group comparison.
9. Komplotan Pencuri Spesialis Penguat Sinyal BTS Dibekuk — Medcom, 31 August 2020 ↩
Original source. Full article text read. Historical 2020 evidence of Perisai Nusantara working with police and describing Indosat as an area-security client; not a current national contract or tariff.
10. Peta Aset Menara & Fiber Optik MTEL vs TBIG vs TOWR Semester I/2026 — Bisnis, 25 August 2026 ↩
Original source. Full comparative article read. Mid-2026 portfolio figures; SMN figure is approximate. TBIG total sites include 108 distributed antenna systems, which are excluded from our physical-tower base.
11. Mitratel Dorong Inklusi Digital Nasional melalui Shared Infrastructure di Bali Tech Week 2026 — Mitratel, 22 October 2026 ↩
Original source. Full relevant corporate statement read. Explains shared infrastructure and confirms Mitratel’s 40,563 first-half-2026 towers; company advocacy is not independent performance evidence.
12. Anti Theft System for Batteries at Telecom Sites — ennomotive, undated
Original source. Full short offer read. Vendor claims implementation below EUR500 for a lead-battery anti-theft system. It is not a quote for lithium batteries, digital entry checks or an Indonesian installed service.
13. Products — Willowmore, accessed 2 November 2026 ↩
Original source. Full relevant product page read. Current supplier positioning for remote access, monitoring and audit visibility; no measured prevention rates or public price.
14. Pemerataan Internet Dongkrak Kinerja Mitratel, Penyewa Menara di Luar Jawa Tumbuh — Bisnis, 20 August 2026 ↩
Original source. Full article read. Mitratel’s 59% outside-Java share supports a 41% Java anchor for that company only. Applying it to other owners is explicitly an assumption.
Alternatives and what each leaves unresolved
| Alternative | Offering, buyer and channel | Price and customer outcome | Unresolved opening |
|---|---|---|---|
| Willowmore / Protelindo; Mitratel | Locks and access workflow, supplied through enterprise tower-company relationships. Mitratel also describes managed services. [4][5][6] | Public comparable tariff unavailable. Permissions and access records already offered; no theft-reduction rate established. | Current deployment and whether equipment-removal work orders are reconciled with entry must be checked. |
| iLOQ | Digital locks, phone credentials and integration interfaces for telecom infrastructure, sold through supplier contact. [7] | Price undisclosed on page. Vendor offers remote rights and logs; Indonesian coverage and incremental loss reduction unverified. | Not evidence that local customers lack the capability; an existing supplier could implement the proposed rule. |
| Perisai Nusantara / PT Paraduta Servis Indonesia | Area security for Indosat and investigation cooperation, documented historically in 2020. Contract relationship. [9] | Price and current contract scope unknown. Historical help in uncovering a ring. | Does not establish current prevention, speed or uncovered areas. |
| Battery barriers and alarms | Physical protection and detection; ennomotive markets a lead-battery anti-theft solution. [12][8] | Vendor claims below EUR500 implementation; non-comparable to the proposed service. Malang reporting shows locks damaged and alarm cables cut. | Early warning needs an independent functioning path and an effective response, not just another sensor. |
| Operator’s own staff, current lock supplier, maintenance contractor | Extend current permissions, checks and escalation. This is an alternative inferred from the capabilities above, not a verified universal workflow. | Marginal and setup costs not publicly established. Existing systems may be cheaper and avoid another integration. | Obtain equal-scope costs and evidence of the actual missing work. |
| Local watchers, police, retaining or insuring losses | Observation, investigation, recovery or risk retention. Police action is documented in theft reports; watcher and insurance terms need buyer evidence. [1][2] | No comparable current tariff or net insurance settlement verified. Gross loss is not necessarily the operator’s retained cost. | Determine net avoidable cost rather than assuming all reported loss can fund prevention. |
Evidence ledger
Observed: impersonation, vendor-linked suspects, forced access and cut alarm cables; existing digital access suppliers and historical deployments. Inferred: reconciling access with the specific equipment job could distinguish some unauthorised removals. Unknown: whether a reachable portfolio lacks that check, whether it would have changed the recorded incidents, retained loss frequency, integration permissions, approved budget and equal-scope self-provision cost. Crime despite protection neither proves protection ineffective everywhere nor proves a new service profitable. We withdraw the claim that all module-down alarms are treated only as maintenance faults: the reviewed evidence does not establish it.
Price, cost and loss arithmetic
All proposed prices, cost budgets and prevention percentages below are assumptions or illustrations, not observed spending or forecasts. Currency is IDR unless specified. The case-specific module value is Rp90m from source 2; no national average is inferred.
At Rp250,000/site/month, 1,000 sites produce a fee of Rp3bn/year. Required prevented single-module losses = 3bn / 90m = 33.33, rounded up to 34. At 50% prevention, underlying relevant annual losses must exceed 3bn / (90m × 0.5) = 66.67, about 67 across those 1,000 sites, equivalent to 6.67 losses per 100 site-years, not an observed incidence. For the Rp150,000–300,000 price range, perfect prevention requires 2–4 single-module losses per 100 site-years; at 50% prevention, 4–8. Use net retained loss after insurance, salvage and recovery, plus only evidenced outage savings. Multiple-module incidents change the conversion; the required money saved does not change.
Illustrative verification-service cost envelope: fee Rp250,000, maximum direct cost Rp125,000 and contribution Rp125,000/site/month (50%). Direct cost includes contract-allocated integration and acquisition, checking labour, infrastructure, partner escalation and support. If acquisition and integration together consume an assumed Rp600m for a three-year 1,000-site contract, allocation is Rp16,667/site/month, leaving Rp108,333 for other direct delivery. This is an allowable budget, not a claim that it is sufficient. Assumed Rp1.2bn annual overhead / Rp1.5m annual contribution per site = 800 sites. Churn, debt collection, emergency visits, upfront cash and taxes can worsen the result.
Own-versus-buy: compare equal outputs and coverage, including compatible existing locks, staffing, emergency access, integration and incident handling. Internal cost = F + I × months; outside service = N × p × months. If Np > I, internal breakeven months = F/(Np − I). Illustration only: F=Rp600m, I=Rp100m/month, N=1,000, p=Rp250,000 gives four months. If the customer already operates the checks, F can approach zero and the entrant must show a different incremental outcome. No verified quote establishes which alternative wins.
From towers to conditional supplier revenue
Base: 40,563 Mitratel towers + 25,172 TBIG physical towers + approximately 36,600 SMN towers = approximately 102,335, source 10; Mitratel count cross-checked in source 11. The earlier 102,443-site base included TBIG’s 108 distributed antenna systems. This is a three-group base, not a census of every Indonesian tower and not a count of unique operator buyers.
Geography: use 41% in Java, anchored on Mitratel’s 59% outside Java (source 14), transferred to the other groups as an assumption: about 41,957 towers. Assume half in western Java: about 20,979. Assume 20–50% have material retained losses susceptible to the proposed extra check and lack an adequate equivalent: about 4,196–10,489 eligible sites. Assume a new supplier could win 20–40% of those by year five: about 839–4,196, rounded to 840–4,200. Bill each contracted physical site once in this model, not once per tenant.
Annual price assumption Rp1.8m–3.6m/site. Broad TAM ceiling = 102,335 × annual price = Rp184.2–368.4bn/year; this all-sites ceiling is not demonstrated security demand. SAM = 4,196–10,489 eligible western-Java sites × annual price = about Rp7.55–37.76bn/year. Year-five SOM = 839–4,196 wins × annual price = about Rp1.51–15.10bn/year. Endpoints combine low assumptions with low and high with high; no probability is assigned. These are conditional scenarios, not a confidence interval. The unserved, preventable-loss share could be zero. The lower outcome cannot fund the illustrated company; the upper could, if delivery remains within budget. Adjacent provinces and other access-controlled assets are unsized, overlapping possibilities, not added to TAM. No remote-BTS revenue is added: geographic density and response economics differ.
Other routes and their decisive tests
Clustered Rapid Response Fleet remains a distinct, secondary strategy for repeated forced-entry battery theft. An established security operator would sell readiness and documented response to an operator’s regional security manager, using trained personnel and agreed escalation rather than assuming ride-hailing drivers can confront thieves. The documented Malang cable cuts support the problem, but do not prove an alert arrives while interruption is still possible. Tower access cooperation and a security partner would need contracts; neither is assumed.
Illustrative response budget: 200 clustered sites × Rp500,000/month = Rp100m monthly fees. A 25% contribution target caps all cluster delivery, readiness, vehicles, dispatch and integration at Rp75m/month, leaving Rp25m before central overhead and sales. Assumed initial sales/setup Rp150m would consume six months of that contribution. At Rp16m per battery, Rp1.2bn annual fees require 75 avoided battery losses per cluster per year before other benefits—gross case valuation, not retained-loss evidence. Compare an equivalent owned response roster: assumed Rp200m setup and Rp70m/month running cost versus Rp100m outside fees gives 6.7 months to own-it breakeven, if outcomes are equal. All costs are test budgets. Coverage on demand cannot be assumed to eliminate standby wages.
First replay historical alarm, outage and incident timestamps against normal travel times and the existing response contract. If usable alerts arrive after removal, do not stage a response pilot to test an impossible interception. If a window exists, use safe scheduled drills with trained staff and operator permission; compare the existing service’s arrival distribution, false dispatch burden and cost. It weakens the business if arrivals cannot beat that window or the necessary retained loss reduction cannot fund an equal-scope quote. A short trial with no theft is not prevention evidence.
Tamper-Alert Retrofit Service is the repaired name for the proposed early-warning hardware route. Sell installed sensors and optional monitored maintenance to the operator; detect interference through a protected alert path before equipment disappears. Do not call it prediction or promise that circuit cutting always comes first. Integration with existing access suppliers is competition as well as a potential distribution route, given source 6’s sensor-integration offer.
Illustrative hardware economics: Rp2.5m installed selling price, assumed Rp1.5m equipment and Rp0.5m installation/testing cost leaves Rp0.5m contribution (20%), before sales and central costs. Optional Rp100,000/site/month monitoring with assumed Rp50,000 direct cost leaves Rp50,000. A 500-site customer would contribute Rp250m initially and Rp300m/year on support if all subscribed; these are unit scenarios, not market demand. Assumed Rp100m sales/integration cost would consume 40% of that initial contribution. The buyer owns the equipment outright; it must also price buying equivalent sensors and integrating them internally. An assumed Rp2m DIY hardware purchase leaves only Rp0.5m for internal installation before matching the installed offer; recurring internal monitoring must be compared with the optional fee. No price or superior outcome is established.
Its decisive test is a bench comparison against the customer’s existing door/tamper alarm: scheduled cable cuts, power failure, disconnected network and authorised maintenance, with separate timing and false-alarm records. Then check a priced installed offer and equal-scope internal bill. It fails as a differentiated business if there is no useful lead time or the existing supplier can deliver the same outcome at lower total cost. The hardware remains worth testing only where cut alarm paths caused the loss; it is not a replacement thesis for module theft.
Routes considered and what would change the finding
Live-ticket gate credentials are an implementation of the featured verification strategy. Escorting every technician adds labour and still needs proof of the authorised task. Dynamic patrol and pooled dispatch variants belong with the response fleet. Community keepers are a possible partner, not disproved by the possibility of collusion; no documented cost or availability supports a separate keeper-network company here. Sirens without an effective response do not establish prevention.
Investigate verification first because the retrospective permissions-and-loss check is cheaper than building either a new response roster or sensor fleet. It also has the clearest connection to the documented high-value module losses. It has the largest potential under this investigation’s evidence, but only conditionally: no comparative sales data establish a ranking by actual revenue. Security managers could identify preventable retained losses; tower access managers could establish present coverage; current suppliers and IT teams could supply equal-scope costs. No contacts, tests, purchases or partnerships were commissioned by this article.
Leave a Reply