In November 2025, Indonesia’s National Police Detachment 88 (Densus 88 AT Polri), together with the National Counter-Terrorism Agency (BNPT), reported the arrest of five adults who administered several radical-terrorist groups on encrypted messaging platforms that included child members. An estimated 110 children, aged 10–18, from various provinces in Indonesia were alleged to be members of these groups.
In today’s online extremism ecosystem, encrypted messaging apps serve not only as communication platforms but also as part of a strategically chosen technological architecture tailored to their specific goals. Messaging platforms are likened to beacons – with functions that can be exploited to attract more sympathisers. Since the implementation of deplatforming and content moderation practices on mainstream platforms, there has been a corresponding shift by radical-extremist groups toward the use of end-to-end encrypted messaging apps to evade detection. Therefore, the presence of children in encrypted messaging groups on WhatsApp and Telegram reflects a broader tactical shift by radical-extremist actors toward targeting minors and leveraging more private digital communication environments.
This Insight will analyse how WhatsApp, as a communications medium, has potentially played a role in extremist grooming among children in Indonesia. It discusses its implications for counter terrorism strategies through digital communication platforms. WhatsApp has been selected for analysis because it has become the leading communication platform in Indonesia; therefore, the potential threat is higher than that of other platforms. The analysis will position children as strategic targets in the current radical-extremism landscape because children do not become radicalised and extreme on their own, but rather as a result of mobilisation, indoctrination, and direction from adult actors through socialisation and control.
The Indonesian Digital Milieu: Why WhatsApp Matters
WhatsApp has played a significant role in Indonesians’ lives, as reported in the Reuters Institute’s Digital News Report 2025 (page 143), which states that 43% of Indonesians obtain news via WhatsApp and that 76% use it for other purposes. Furthermore, according to World Population Review data, Indonesia is the third-largest WhatsApp user in the world, with 112 million users. Therefore, the WhatsApp communication platform has become a crucial social infrastructure and is inseparable from Indonesians’ daily lives.
Figure 1: Top Rank of Social, Messaging, and Video Networks used by Indonesians in 2025. Source: https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2025.
In 2025, a survey by the Indonesian Internet Service Providers Association (APJII) found that Generation Z (aged 12-27 years) and Generation Alpha (aged 1-11 years) accounted for the largest share of internet users in Indonesia, representing 48.73% of total users. This high rate of internet usage could also be a factor that increases the vulnerability of children in Indonesia to exposure to radicalism and terrorism through digital platforms.
The increased use of digital communication platforms, particularly WhatsApp, in children’s communication patterns in Indonesia has been observed since the COVID-19 pandemic, when the government implemented physical distancing policies and schools shifted to online learning. One issue is that not all schools in Indonesia have the resources to provide online learning platforms, so many teachers use WhatsApp to support learning. Teachers will form WhatsApp groups for their respective classes and then facilitate learning by sending videos and assignments. Further, students can submit assignments through the group as photos, documents, or videos. WhatsApp is also the primary choice by teachers due to its ease of installation, user-friendly interface (even for children), and the ability to share text, documents, audio, and video, as well as its group feature, which facilitates teachers grouping students by class.
In addition to its positive features and support as a learning medium for children, several technical features of WhatsApp have been misused for the benefit of violent extremist actors. First, the end-to-end encryption (E2EE) feature prevents service providers from having plaintext access to the content of group messages, and the distribution of group messages via a fan-out server remains encrypted on the user’s device, as explained in the WhatsApp Encryption Technical Whitepaper. The E2EE feature is considered an effort to improve privacy and security, but it has also been exploited for the benefit of radical terrorist groups.
A second notable feature that extremists typically exploit is WhatsApp’s closed-group, invitation-based option. There is also a community feature that makes it easier to organise many groups (up to 100) in a centralised channel by increasing the role of administrators as managers who can make announcements to all members. This structure has been relevant to extremist actors because it facilitates the practice of funnelling: initial targets can be in seemingly public or low-risk spaces, then moved to more closed, ideologically homogenous subgroups as trust increases. Additionally, the Basic Online Safety Expectation Report 2025 (p. 33), in its section on terrorist and violent extremist (TVE) written material, states that WhatsApp does not apply hash-matching tools to channel messages.
Third, the WhatsApp ecosystem is built on relationships based on social trust. Individual participation and engagement in WhatsApp groups are generally based on pre-existing social ties, such as family, friendship, or community ties, leading to higher perceptions of safety than on more open social media platforms. WhatsApp groups can be an effective venue for the formation of values and norms, micro-authority, and cohesion because they facilitate intensive communication and coordination while maintaining member participation in multidirectional communication patterns.
Therefore, the combination of E2EE features, closed-group structures, and trust-based social ties demonstrates that propaganda efforts are not confined to random broadcasts; radical terrorist groups also attempt to engage in relational development (narrowcasting), which emphasises closeness, target selection, and gradual escalation in private digital spaces.
From Propaganda to Grooming: How Extremist Recruitment of Children Operates
In encrypted messaging environments, recruitment often unfolds through relational grooming practices. In this case, the groomer – an adult WhatsApp administrator – will implement a strategy that involves gaining access by exploiting the child’s needs for group affiliation and the target’s psychosocial condition to facilitate the formation of relational bonds. Furthermore, after the child joins the digital communication group, the perpetrator will build closeness through seemingly natural conversations, using symbols, emoticons, humour, memes, emotional support, praise, personal attention, and appreciation to foster bonding or enter the affective grooming stage. In the context of extremism and terrorism, this stage is a process of socialisation within the ingroup that strengthens the internalisation of group norms, especially when the recruiter positions themselves as a mentor figure.
Figure 2. Administrators of the group use emoticons and casual language to build closeness with child members and control information flow (Source: Densus 88 AT Polri & BNPT Task Force).
The next stage, after controlling the flow of information, ensures that the information consumed by group members is curated to build the desired perceptions and interpretations. For example, this includes excerpts from lectures, narratives of suffering, narratives of heroism, and audiovisual content that align with the ideology of the extremist-terrorist group. At this stage, group members are instilled with a belief in the group’s truth, thereby delegitimising sources outside the group and ideologically isolating the target, in this case, children.
Furthermore, within these groups, efforts are made to normalise violence. Initially, violence is perceived as a standard action, and then it becomes an action with moral justification or is considered an expression of positive values and heroism, with subtle and contextual content. Finally, there is a phase that supports efforts to form an intent to act, where this escalation will appear when the relationship and group identity are strong enough to carry out primary actions, such as taking action or carrying out supporting activities, such as providing logistics, helping to spread understanding, and other activities that are considered part of proving one’s loyalty to the group.
All stages of grooming carried out by violent extremists inevitably involve the crucial role of adult actors as administrators, whose goal is to build relationships through social interactions with these children.
Actions Taken by WhatsApp to Counter Extremist Exploitation
In terms of policy, WhatsApp has implemented measures to prevent violence and exploitation through its Terms of Service and Messaging Guidelines. WhatsApp has acceptable use provisions that prohibit users from engaging in illegal acts or encouraging inappropriate behaviours, including promoting violence, crime, and child exploitation. Violations of these policies will result in user or group deactivation. WhatsApp Business Messaging Policy explicitly prohibits individuals or organisations from engaging in terrorist activities and from facilitating or organising criminal activities.
WhatsApp’s product design has also implemented mitigation measures to prevent the mass dissemination of information. In 2018, WhatsApp limited forwarding to a maximum of five chats at a time; in 2020, it introduced additional restrictions so that messages categorised as “frequently forwarded” could be forwarded to only one chat at a time.
Regrettably, we have not yet found any official documents or statements from the Indonesian National Police (POLRI) confirming its collaboration with WhatsApp to address the aforementioned cases. The Ministry of Communication and Digital Affairs of the Republic of Indonesia facilitates communication between the POLRI and WhatsApp.
Conclusion and Recommendations
The case identified by Indonesian authorities in November of extremist recruitment of youth via WhatsApp represents a concerning security threat. Violent extremist actors and networks no longer rely solely on broadcast propaganda but also seek to build relationships and foster social interaction behind closed doors. The encrypted nature of E2EE services also offers significant potential for exploitation by extremist and terrorist groups, as it can reduce the effectiveness of early detection efforts by both platform security systems and law enforcement. Therefore, developing preventative measures is necessary, based not only on product design but also on governance and collaboration.
One way to do this is by developing a safety design framework specifically for the kids’ mode. This includes, for example, implementing more protective default settings, strengthening parental controls, requiring parental approval when children seek to join certain communication groups, and improving the reporting user experience to make it user-friendly for both children and accompanying adults. Furthermore, WhatsApp needs to improve its transparency reporting, specifically by addressing child risks and vulnerabilities on its platform, including aggregate metrics on accounts or groups targeting children, response times, and actions taken.
In terms of product service design, consideration can be given to strengthening behavioural indicators as a risk-based intervention rather than a content-based one. This way, patterns of unnatural additions of children and adolescents to their membership, and the creation of multiple groups on similar topics by the same account, can serve as warning indicators for further action.
Cross-sectoral collaboration and cooperation need to be strengthened by involving educators and child protection agencies as referral channels for children or parents with concerns and by providing them with the necessary risk literacy. Formal collaborations with law enforcement agencies are also necessary to conduct investigations quickly and support child protection.
–
Orisa Shinta Haryani is an analyst with the Foreign Terrorist Fighters Task Force of the Indonesian National Counter-terrorism Agency. She is also affiliated with the new research and social intervention institute, Rangkul Citrapasada Indonesia. Her areas of interest include radicalism and terrorism, crime prevention, policy, and policing.
Didik Novi Rahmanto holds a doctorate in criminology from the University of Indonesia and currently serves as Head of the North Sumatra Regional Task Force of Densus 88 AT Polri. He also teaches at the Police Science College (STIK-PTIK), the School of Strategic and Global Studies (SKSG) at the University of Indonesia, and the State Intelligence College (STIN). His research focuses on terrorism, foreign terrorist fighters, intelligence, transnational crime, and cybercrime.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.