Start with the number: 1,270 licensed providers, and revenue going down

By February 2025 Indonesia had roughly 1,270 internet service providers in operation, up from about 600 in 2021 and around 300 before the pandemic, according to figures relayed through the Indonesian internet industry association APJII and summarised by the digital-economy association AEI (https://aei.or.id/artikel/tantangan-dan-peluang-infrastruktur-internet-di-indonesia). More than 800 of them crowd the island of Java. The association's chair has complained publicly that infrastructure in Indonesia "piles up rather than spreads" — poles sagging under redundant cables in cities that are already served, while whole districts wait (https://investortrust.id/business/66138/ketua-apjii-keluhkan-infrastruktur-internet-di-indonesia-bukan-meluas-tapi-menumpuk). Behind the 1,270 in operation stands a queue: more than 500 licence applications waiting their turn. APJII's own membership counter now reads 1,535 (https://apjii.or.id/anggota/infoisp/maluku-utara).

Set that against the second number the industry admits more quietly: total sector revenue is declining. More firms, fighting over the same customers, at falling prices. In a textbook, that combination ends entry. In Indonesia it has accelerated it.

Part of the answer is mechanical. Since the omnibus licensing reform of 2021, becoming an ISP is an administrative exercise run through the national single-submission portal: register the business classification for internet access services, obtain a business number, satisfy a document list, pass an operational-fitness inspection, and the operating licence follows (https://prolegal.id/internet-service-provider-isp-makin-dibutuhkan-ini-cara-urus-izinnya/). The classification is nominally "high risk", but the requirements are paperwork and a modest funding proof, not a capital wall. The pandemic then supplied the motive: three years of remote work and remote schooling taught every neighbourhood in Indonesia what a dedicated line was worth, and taught every local network builder that the recurring subscription — not the one-off installation — was where the money compounded. The licence queue is the visible edge of that lesson.

The resolution of the paradox is that "ISP" in Indonesia is not one business. It is a stack of at least four businesses — submarine and long-haul transport, Jakarta wholesale transit, licensed local access, and unlicensed neighbourhood resale — and the licence that turns a company into an "ISP" is really an admission ticket that lets a local firm keep a margin it was previously handing to someone else. Most of the 1,270 are not building networks in any meaningful sense. They are integrators, cabling contractors and IT-services shops that discovered the connectivity line on their clients' invoices was the one line they were not allowed to bill.

PT Theko Digital Solusindo, a small licensed provider in Ternate, North Maluku, is close to a type specimen. It was incorporated in July 2019, licensed within months, allocated its address space and routing number in May 2020, and has run ever since with the smallest viable footprint the licensed layer permits: 512 IPv4 addresses, three upstream contracts terminating in Jakarta, a single one-gigabit exchange port, and a product card aimed at offices rather than households. Read carefully, the company answers the question the raw licence count poses: why a thousand firms would enter a shrinking-revenue industry, and what they actually expect to earn there.

The identity record checks out from three independent directions

Small Indonesian ISPs are often genuinely hard to pin down — brands change, licences are borrowed, websites outlive the companies behind them. Theko is the opposite case: a company whose paper trail, regulatory trail and routing trail all converge on the same second-floor address.

The corporate record first. PT Theko Digital Solusindo was established by deed number 07 before the notary Leni Indrawati, S.H., M.Kn in Ternate on 24 July 2019, and the Ministry of Law approved the entity two days later under SK AHU-0036416.AH.01.01.TAHUN 2019, per the registry aggregator entry that mirrors the ministry's data (https://iditrix.com/pt-theko-digital-solusindo/462292/). The registered address is Jalan Raya Mangga Dua No. 25, second floor, in South Ternate.

The regulatory record second. The company's own site states that it provides internet access services under the brand ThekoNet with an operating licence from the Directorate General of Post and Informatics at the communications ministry, number 283/TEL.02.02/2019 — a licence issued the same year the company was formed (https://theko.net.id/, best read today through the May 2026 archive at http://web.archive.org/web/20260510231802/https://theko.net.id/). It is a member of APJII, listed in the association's North Maluku roster under the domain theko.net.id.

The routing record third, and this is the one that cannot be faked cheaply. IDNIC, Indonesia's national internet registry, registered AS139379 to PT Theko Digital Solusindo on 5 May 2020, with the contact name Theis and the email info@theko.id (https://idnic.rdap.apnic.net/autnum/139379). The same day it allocated the block 103.142.200.0/23 — 512 addresses, portable, registered to the same Mangga Dua address (https://idnic.rdap.apnic.net/ip/103.142.200.0). Both halves of that /23 have been announced to the global routing system continuously through early July 2026 (https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS139379). The company keeps a PeeringDB entry under the name "ISP Theko Net", describing itself as a cable/DSL/ISP network with self-reported traffic between 100 Mbps and 1 Gbps, mostly inbound — the signature of an access network that consumes content rather than serves it (https://www.peeringdb.com/net/22338).

Two domains, theko.id and theko.net.id, have carried the same site since 2020 — the shorter one is what the registry contact uses for mail, the longer one is what the association lists and what the network's abuse and operations mailboxes sit on. The archived site's two blog posts are signed by an author account called "theis", matching the registry contact; the footer phone numbers changed at least once between 2020 captures, from one Indonesian mobile number to another. None of this is corporate polish, and that is the point. The three trails — a notary's deed in the law ministry's database, a licence number on the operator's own page, and registry allocations that cost real annual money and were revalidated by IDNIC as recently as June 2024 — are independent of one another and expensive to counterfeit in combination. The deed, the licence, the address block and the brand all agree. Whatever else is uncertain about this company — and plenty is — its identity is not. In a market where establishing who a firm even is can be the hardest part of the exercise, that is worth stating plainly before moving to the harder question of what the identity is worth.

Everything above the island: how the stack is layered

To locate Theko's margin you have to walk the stack from the top. Ternate sits on Indonesia's eastern submarine grid: Telkom's Sulawesi-Maluku-Papua cable system was designed with a branch to the island, and the ceremonial groundbreaking for the Maluku Cable System was held in Ternate itself in 2013 (https://postel.go.id/berita-ground-breaking-maluku-cable-system-serat-optik-sepanjang-6000-km-siap-membentang-menyatukan-kawasan-timur-indonesi-26-2020). The state-subsidised Palapa Ring Tengah adds 3,102 kilometres of fibre — 1,326 on land, 1,787 under water — reaching seventeen regencies including North Maluku (https://inet.detik.com/telecommunication/d-7673734/mengenal-palapa-ring-tengah-yang-membentang-3-102-km-ini-manfaatnya). Physical transport to the island exists, and it is owned by the state and the state's contractors.

The next layer down is Jakarta. Indonesian wholesale bandwidth is priced and traded in a handful of carrier hotels in the capital, and Theko's interconnection life happens there, 2,400 kilometres from its customers. PeeringDB places the company in Cyber Data Center International, the historic Jakarta carrier hotel, with a one-gigabit port at OpenIXP — the open exchange that now counts around 608 connected networks and several terabits of aggregate traffic (https://www.peeringdb.com/ix/375). Routing observations show exactly three transit feeds: AS7713, which is Telkom Indonesia; AS38158, which is Cyberindo Aditama, the network behind the CBN brand; and AS138077, Abhinawa Sumberdaya Asia, the Jakarta wholesale and exchange operator known as idEX (https://stat.ripe.net/data/asn-neighbours/data.json?resource=AS139379). No downstream networks appear behind Theko — nobody runs their own routing under its wing.

That Jakarta arrangement is not vanity; it is the whole cost logic of a provincial ISP. Domestic Indonesian traffic exchanged at the capital's exchanges is close to free at the margin — the port is a fixed cost, and every gigabit shifted across it avoids metered transit. International traffic is what costs money, and a small operator diversifies it across three suppliers so that no single account manager can hold its service hostage at renewal. The declared traffic profile, "mostly inbound", says what the customers do: they consume — video, cloud software, government portals — and originate little. An eyeball network's bargaining position is weak on peering and wholly dependent on the price of its inbound paths, which is exactly why the portability of the /23 matters. Because the address block belongs to Theko and not to any upstream, the company can walk its addresses from Telkom to CBN to idEX without its customers noticing, and can credibly threaten to. For a buyer this small, that threat is the only negotiating leverage that exists.

Below Theko sits the layer the licence count never captures: Indonesia's RT/RW-net world, the neighbourhood operators who buy a business line from a licensed ISP and resell it across a kampung by wireless or stretched cable. Theko's archived site carries a dedicated reseller page, and community groups for RT/RW-net operators circulate recommendations for suppliers covering Ternate and Sofifi (https://www.facebook.com/groups/RtRwNetIndonesia1/posts/24912254845028909/). The licensed ISP is the legal membrane between Jakarta wholesale and this grey retail layer.

That is the whole stack: state-built transport, Jakarta wholesale, a licensed local membrane, and informal resale. Theko occupies the membrane. Its economics are the economics of that position — it produces almost nothing itself, and it is the only layer of the four that is both legal to operate locally and small enough for a local firm to own.

What the licence actually buys, and what it costs

The licence is the pivot of the whole model, so it pays to be precise about what licence 283/TEL.02.02/2019 confers and what acquiring one demands.

The demands first, because their modesty is the market-shaping fact. Under the current framework an applicant registers the internet-access classification through the single-submission portal, then satisfies a list of about eighteen documentary requirements from the telecoms directorate: a business plan, a technical configuration, proof of address-space and routing-number allocation, service and after-sales arrangements, a shareholder declaration reaching two tiers up the ownership chain, and a bank statement showing funds covering a small fraction of the planned investment (https://prolegal.id/internet-service-provider-isp-makin-dibutuhkan-ini-cara-urus-izinnya/). An operational-fitness inspection follows, and the certificate it produces is the last gate before the licence. Nothing on that list requires owning a metre of fibre. Theko cleared the equivalent process in the pre-reform format within months of incorporation, which is the normal tempo for a firm that already had working infrastructure to inspect.

First, legality. Selling internet access in Indonesia without an operating licence is an offence; an IT-services firm that quietly rebills a Telkom line to its clients is operating outside the law and can be shut off by its own supplier. The licence converts that grey rebilling into a lawful product line. For a firm that already installs networks, manages routers and answers support calls for institutional clients — which is exactly the menu Theko advertises — the licence means the connectivity line on the client's invoice finally belongs to it.

Second, resources. Licensed status plus APJII membership opens IDNIC's door: a portable /23 and a routing number of one's own, which is what separates a provider from a subscriber. With portable space, Theko can hand business customers real public addresses — its product tiers include one, two or five of them — and can switch upstream suppliers without renumbering anyone. That is negotiating power against Jakarta, purchased for annual registry dues.

Third, wholesale standing. A licensed operator with its own routing number is a counterparty that Telkom's carrier division, CBN and idEX will sell transit to at wholesale rates, and that OpenIXP will connect for the cost of a port. The moment the licence and the address block exist, the firm's cost of bandwidth drops from retail-plus to wholesale.

Against that, the running cost of being licensed is structured as a tax, not a wall. Indonesian telecom operators pay a licence levy of 0.5 percent of gross revenue and a universal-service contribution of 1.25 percent, obligations restated in the ministry's regulation 5 of 2021 (https://jdih.komdigi.go.id/produk_hukum/view/id/768/t/peraturan+menteri+komunikasi+dan+informatika+nomor+5+tahun+2021) and complained about at length by APJII whenever relief is discussed (https://cyberthreat.id/read/6601/APJII-Insentif-BHP-Telekomukasi-dan-USO-Tak-Sesuai-Harapan). One and three-quarters percent of gross, plus association and registry dues, plus periodic service-worthiness evaluations. There is no spectrum auction, no build-out obligation that bites, no minimum capital that matters. The state deliberately made the membrane cheap to join — which is why 500 more applicants are in the queue, and why the association now lobbies, in effect, to pull the ladder up behind its members with a moratorium in saturated areas.

This is the answer to the entry paradox. A licence that costs little to hold, converts existing service relationships into recurring connectivity revenue, and confers wholesale standing is worth acquiring even in a falling-revenue industry — because the revenue it captures was previously someone else's.

A product card built for institutions, not households

What Theko sells with that licence is visible in its archived product pages, and the shape of the offer is itself evidence about who pays.

The core product is dedicated internet access in three tiers: an office package at 1:4 contention with one public address, a corporate package at 1:2 with two, and an enterprise package at true 1:1 with five, all described as unlimited, all bundled with traffic graphs the customer can watch, a lent wireless router, and round-the-clock support (http://web.archive.org/web/20201020143154/https://theko.net.id/internet/). The headline promises a 99 percent service level; the fine print guarantees 95. No prices are published anywhere — every tier ends in "contact us". The archived coverage-area page is empty apart from the footer (http://web.archive.org/web/20201020142733/https://theko.net.id/cakupan-area/). A residential mass-market operator cannot survive a single quarter without a price card and a coverage map. A business that sells by visit, quotation and relationship does not need either.

Around the connectivity core sits an integrator's ring: managed routers, managed LANs, managed mail, IT outsourcing, server colocation resold out of Jakarta with local-exchange connectivity up to a gigabit, cloud hosting, website and application development, network construction, CCTV installation, and a maintenance service. Delivery media are listed as wireless, fibre and VSAT — wireless first, which fits a company whose registered premises are a building floor rather than a headend. Point-to-point radio is the rational access technology for this model: no civil works, no pole rentals owed to the electricity utility, deployable to a hotel rooftop in a day by two technicians, and recoverable when the customer churns. The lent router in every tier is not generosity; it keeps the demarcation point under Theko's management, which is what makes the managed-services attach — and the switching cost — real. The reseller page completes the picture: Theko will wholesale to the layer below it.

The discrepancy between the 99 percent headline and the 95 percent written guarantee deserves a sentence, because it encodes the operating reality rather than sloppiness alone. Ninety-five percent availability allows roughly thirty-six hours of downtime a month. No Jakarta enterprise would sign that; in a market whose transport rides one submarine branch and whose power grid browns out in storms, it is the honest number, and the honest number is what a local firm can afford to put in a contract it intends to honour.

Who pays for this in Ternate? The city holds roughly a quarter of a million people by the statistics bureau's 2024 projection (https://ternatekota.bps.go.id/), or 207,781 by the civil registry's stricter count (https://kabarpublik.id/penduduk-ternate-capai-207-781-jiwa-di-semester-i-2024/2024/08/21/), and it is the commercial anchor of a province whose internet penetration, at 67.47 percent, still trails the national 80.66 percent (https://databoks.katadata.co.id/en/technology-telecommunications/statistics/68a5b6a1d8cbe/internet-penetration-rate-in-38-indonesian-provinces-in-2025). The buyers of 1:1 circuits with static addresses in such a city are banks' branch offices, hotels, campuses, clinics, logistics depots, regional government units and the local outposts of national firms — buyers who need the invoice, the guaranteed floor, the fixed address for their VPN, and above all a technician who can be on site within the hour. Households are not the customer. Households are what the neighbouring giants are for.

The arithmetic of a /23

Public numbers permit a rough profit-and-loss reconstruction, provided the evidence is separated from the inference honestly.

The evidence: Theko holds exactly 512 IPv4 addresses (its registry allocation), reports traffic between 100 Mbps and 1 Gbps (its own PeeringDB declaration), maintains one 1G exchange port and three transit relationships (registry and routing observations), and pays 1.75 percent of gross revenue in levies (regulation). Its product tiers assign one to five public addresses per dedicated customer (archived product page). Wholesale IP transit at the world's most competitive hubs floors near $0.05 per Mbps per month at very large commitments, per TeleGeography's 2025 survey (https://resources.telegeography.com/ip-transit-price-erosion-significant-regional-differences-remain); a buyer of Theko's size in Jakarta pays a multiple of the floor, and the dominant cost of serving Ternate is not the transit but the 2,400-kilometre backhaul between the island and the Jakarta port, leased from the same carriers it buys transit from.

The inference, stated as such: after routers, gateways and internal use, a /23 leaves room for perhaps 350 to 450 customer-assigned addresses. At one to five addresses per dedicated customer, the dedicated fleet is bounded somewhere between roughly 80 and 300 accounts, before counting reseller and wireless customers behind shared addresses. Dedicated circuits of tens of Mbps in provincial Indonesian cities are quoted, in market practice, between about Rp1.5 million and Rp4 million per month depending on contention and medium — a range consistent with the fact that Theko's national comparators sell uncontended bandwidth to businesses at many times the residential price per Mbps. Take a deliberately modest midpoint: 100 paying connections averaging Rp2 million. That is Rp2.4 billion a year, about $150,000. The levies claim Rp42 million of it. Three or four hundred megabits of Jakarta transit and the exchange port, even at small-buyer rates, cost single-digit thousands of dollars a year — almost nothing. A support and installation staff of six to ten at Ternate wages absorbs perhaps Rp400-600 million. Everything else that matters is one number: the backhaul contract, which in eastern Indonesia can swallow more than transit, staff and levies combined, and which is set by suppliers who compete with Theko at retail.

The premium embedded in that model is easiest to see per megabit. IndiHome's entry tier prices 30 Mbps at Rp265,000, call it Rp8,800 per Mbps per month. A dedicated 20 Mbps circuit at Rp2 million is Rp100,000 per Mbps — an elevenfold premium over the residential product available, in principle, on the same street. The premium is not for the bits; the bits come off the same cables. It is for the contention guarantee, the static addresses, the invoice a government treasurer can process, and the technician. Every rupiah of it is margin over a wholesale input whose price falls by double digits annually, which is why the model is resilient to transit inflation — there is none — and fragile only to the things that erode the premium itself.

The sensitivity runs like this. In a thin case — sixty accounts at Rp1.5 million — revenue is about Rp1.1 billion and the firm is a livelihood for its founders, no more, with the backhaul contract deciding whether even that survives. In a fat case — two hundred accounts averaging Rp2.5 million plus reseller wholesale — revenue passes Rp6 billion and the constraint stops being demand and becomes the /23 itself: without more address space or carrier-grade address sharing, the dedicated fleet cannot grow, and IDNIC has no more IPv4 to give. A company whose growth ceiling is its address allocation has a strange balance sheet: the scarcest asset it owns is the one the registry gave it for annual dues.

Two conclusions follow from this arithmetic even at its crudest. First, the business clears money at a scale of dozens of institutional customers — which is precisely why 1,270 such firms can exist. Second, the margin does not come from moving bits. Transit is nearly free; backhaul is a pass-through set by others; the levies are small. What the customer's Rp2 million actually buys is the last hundred metres, the lent router, the engineer who answers at midnight, and the accountability of a counterparty with a licence number. The connectivity margin and the services margin are the same margin wearing two names. Theko is less an internet company with a services sideline than a services company whose licence lets it own the recurring line.

The price umbrella is folding from below

That margin has held because, for institutional buyers in a secondary city, there was no substitute for the local firm. The last three years have sent four different attackers under the umbrella.

Telkom's IndiHome — now folded into Telkomsel — retails from about Rp265,000 a month for 30 Mbps on its late-2025 price card (https://selular.id/2025/11/harga-terbaru-paket-indihome-internet-only-2025/). The state electricity utility's IconNet passed a million subscribers nationally (https://www.rri.co.id/bisnis/463075/pengguna-iconnet-capai-1-juta-layanan-internet-pln-icon-plus-makin-diminati), sells 35 Mbps for around Rp239,000 through its sales channels (https://iconnet.web.id/harga-paket/), and counts Ternate inside its build map, riding its parent's poles into every street the grid reaches (https://www.plniconplus.co.id/). Telkomsel's EZnet fixed-wireless product advertises 10 Mbps home service in Ternate for Rp200,000 a month (https://eznet.id/wifimurah/wifi-murah-ternate/). Even CBN — one of Theko's three transit suppliers — now claims Ternate as an active area for its retail fibre brand (https://mycbn.id/area/ternate/). And since April 2024 Starlink has held Indonesian operating licences for both its satellite network and internet access service, with the minister insisting its obligations match every other operator's (https://www.liputan6.com/tekno/read/5585359/starlink-dapat-izin-operasional-di-indonesia-menkominfo-kewajiban-sama-dengan-operator-lain); it paused new activations only for capacity and reopened them in mid-2025 (https://www.antaranews.com/berita/4983973/kemkomdigi-sebut-starlink-mulai-buka-layanan-aktivasi-pelanggan-baru). The ministry's own framing of Starlink — best suited to the remote and frontier regions where terrestrial competition is thin — describes eastern Indonesia, not Java. A substitute that needs no pole, no permit from the city and no Jakarta backhaul contract is aimed, by the regulator's own logic, at precisely the geography where firms like Theko live.

The policy wind blows the same direction. The digital ministry has floated a 1.4 GHz licensing plan explicitly designed to deliver 100 Mbps fixed broadband at Rp100,000 to Rp150,000 a month, noting that only 21.31 percent of Indonesian households have fixed broadband at all and the national average speed is a modest 32 Mbps (https://intimedia.id/read/komdigi-prepares-affordable-fixed-broadband-internet-rp-100000-for-100mbps). The government's stated goal, in other words, is to collapse the retail price per megabit by an order of magnitude.

Note what the price points say when read per megabit. Telkomsel's island fixed-wireless offer works out to Rp20,000 per Mbps — more than double IndiHome's fiber rate per megabit, a premium that measures exactly what last-mile construction costs where trenching does not pay. Theko's wireless dedicated tiers live on the same physics and carry the same cost structure, which means the state's fixed-wireless product is the closest thing to a direct attack on its delivery model: same rooftops, same spectrum economics, national brand, subsidised customer acquisition. Meanwhile the demand side is still growing underneath everyone. North Maluku's 67 percent penetration against a national 81 leaves a decade of catch-up demand, and a provincial capital is where that catch-up concentrates first — new bank branches, new logistics rooms, new government service points, each one a candidate for exactly the circuit Theko sells. The squeeze and the growth are simultaneous, which is why the question is never whether the local ISP survives, but at what margin.

None of these attackers kills the dedicated-access niche outright. A bank branch cannot run its VPN over a residential product with carrier-grade NAT and no service floor; a government office needs an invoice from a licensed vendor, not a subscription receipt. But the umbrella narrows in three ways. The marginal customer — the small hotel, the shop with a point-of-sale terminal — trades down to a Rp239,000 IconNet line and accepts the risk. The reseller layer beneath Theko can increasingly buy its raw material from IconNet or Starlink instead. And every ratchet down in the retail price per megabit makes the Rp2-million dedicated invoice harder to defend in the annual budget meeting, forcing the local ISP to justify itself ever more explicitly as a services firm — response time, managed equipment, accountability — rather than as a seller of bandwidth.

The sharpest structural fact is that every one of Theko's significant competitors is also its supplier or its landlord. Telkom sells it transit and competes for its customers through IndiHome, EZnet and Telkomsel. CBN sells it transit in Jakarta and markets retail fibre in Ternate. The electricity utility whose poles any island fibre build must rent now owns the fastest-growing retail ISP in the country. The middleman's classic nightmare — vertical suppliers reaching past the middle layer to the end customer — is not a scenario here. It is the observable present.

Signals from the edge of the record

The official record stops in about 2020, so the most current information about Theko is unofficial, and it points in two directions at once.

The digital storefront has decayed. On 3 July 2026 the company's website answered with a server error to ordinary requests, and raw retrieval showed injected, obfuscated code of the kind that follows a compromised WordPress installation — the front door serving an intruder's script rather than a sales page. The site behind it, visible in the May 2026 archive, still carries a 2020 copyright, a careers page filled with template filler text, an empty coverage page and two blog posts from July 2020. The company's own diagnostic page for its routing, hosted inside its address block at https://noc-tools.theko.net.id/lg/, refused connections the same day. Taken alone, that reads like a company going dark.

The network record says otherwise. Both prefixes have been announced without interruption into July 2026, seen by the global route collectors with all three upstreams attached. Someone renewed the peering-exchange record as recently as August 2024, and the registry data was revalidated in June 2024. Transit contracts in Indonesia are paid monthly; routes do not stay in the global table for years on unpaid invoices. The most economical reading of the two signals together is a business that has stopped selling through the web because it never needed to — its customers arrive by relationship and its renewals happen face to face — while neglecting everything customers do not see. That is consistent with the empty coverage page and the unpublished prices: the web presence was scaffolding for legitimacy, not a sales channel, and nobody noticed when the scaffolding rusted.

The neighbourhood layer supplies a faint demand signal: operators in Indonesia's RT/RW-net communities still ask for and recommend upstream suppliers covering Ternate and Sofifi, which suggests the wholesale-to-reseller line of business has a live market. What is absent is equally informative. No visible complaint threads, no outage chatter naming ThekoNet, no employee reviews, no procurement award notices surfaced in searches of the province's electronic tender portals. For a consumer ISP, silence would be implausible; for a firm with dozens of institutional accounts, it is roughly what the base rate predicts — complaints about a dedicated circuit go to an account manager's phone, not to a review page.

The compromised storefront needs the same discipline in the other direction. A hacked marketing site says nothing direct about the separateness or health of the customer-facing network; the two commonly run on different machines, and here the web server answers from hosting infrastructure while the routing gear demonstrably keeps working. What it does say is that nobody with authority looked at the company's public face for long enough to notice an intruder living in it — a statement about attention and staffing, not about packets. The distinction matters because the product this firm sells to institutions is, precisely, attention. What would settle the direction: a refreshed site or a licence-status change in the ministry's public operator data, movement in the traffic level declared at the exchange, or the company's name appearing in a regional government contract award.

Dependency runs in one direction only

The risk ledger of this business is short and asymmetric, and the licensing stack explains all of it.

Upstream, everything Theko sells is assembled from inputs priced by three Jakarta counterparties, two of which compete with it at retail, across a physical path it does not control. The September 2025 break in the SMPCS submarine system — a single fault off Ambon that cut access across towns in Maluku and Papua for days until a repair ship arrived (https://bedahnusantara.com/gangguan-kabel-laut-smpcs-putuskan-akses-internet-di-papua-dan-maluku-telkom-percepat-pemulihan/09/10/) — is the standing reminder that an eastern ISP's service level is hostage to cable systems it merely rents. The Palapa Ring's state-owned capacity is the partial hedge, and the reason the guarantee in Theko's fine print reads 95 percent rather than 99.

Regulatory risk cuts both ways. The levies are light, but the ministry's affordable-broadband program is an explicit attempt to reprice the industry's retail layer, and the association's proposed moratorium on new licences in saturated areas would, if it ever reached North Maluku, freeze the competitive map with the incumbents inside. A small operator's licence is renewable, evaluated, and revocable for unpaid levies or failed evaluations; the ministry publishes lists of delinquent operators, and appearing on one is the cheapest way for a small ISP to die. Concentration completes the ledger: one city, one address block, a registry contact that is one person's name, and — on the evidence of the routing table — no second site, no IPv6, and no path to serve a customer anywhere the three Jakarta contracts do not reach.

There is one hard asset hiding in that thin balance sheet. Portable IPv4 space trades on sanctioned transfer markets across the Asia-Pacific region, and 512 clean, never-blacklisted addresses represent real liquidation value — plausibly in the low tens of thousands of dollars, an inference from published transfer price ranges rather than any listing. For a firm of this size, the registry allocation acquired for annual dues in 2020 may now be worth more than its radios. That is not a business plan; it is a floor under the downside, and one more reason the licensed layer's population keeps growing. Even a failed small ISP exits holding something scarce.

What the company has going against all of that is the one asset the stack cannot commoditise: it is the licensed local firm, on the island, with the engineers. The giants above it can underprice its bandwidth but cannot answer its customers' phones by lunchtime. The layer below it can undercut its retail but cannot sign an enterprise contract. As long as the institutional buyers of Ternate need a lawful counterparty with a truck, the membrane holds.

What would change the judgement

The reading above — a services firm whose licence lets it own the connectivity line, solvent at small scale, squeezed slowly from below, dependent entirely on suppliers who are also rivals — rests on public records that thin out after 2020. A handful of facts would move it materially.

The most important unproven fact is the revenue split between connectivity and services. If recurring circuit revenue dominates, Theko is an access provider whose margin erodes with every ratchet of the retail price floor, and the valuation logic is a melting-ice question about how long institutional inertia lasts. If installation, managed services and project work dominate, the licence is a moat around a consulting business, the retail price war is nearly irrelevant, and the company is better understood as Ternate's IT department than as a carrier. Every other question is downstream of this one.

Subscriber and traffic numbers would sharpen the arithmetic: a declared traffic level moving toward the top of its self-reported range, or a second exchange port, would indicate the reseller trade is growing; movement the other way would say the umbrella is failing faster than assumed. A licence-status change in the ministry's operator data, in either direction — renewal, expansion to a network-provider class, or appearance on a delinquency list — would be decisive. The company's name in a provincial tender award would confirm the institutional-customer thesis directly. Evidence that CBN's retail claim in Ternate has become an operating network, rather than a sales page, would mark the arrival of the squeeze at its sharpest possible form: a supplier billing Theko for transit while soliciting its customers. A refreshed website, an IPv6 allocation, or a repaired front door would each say something small but real about whether anyone is investing in the firm's next decade. And any group affiliation surfacing in the corporate registry — a parent, a sibling ISP, a shared shareholder with another eastern operator — would reopen the identity file this analysis currently treats as closed.

Evidence register

The company's own footprint is best read through its registries and archives. The IDNIC records for its routing number (https://idnic.rdap.apnic.net/autnum/139379) and address block (https://idnic.rdap.apnic.net/ip/103.142.200.0) establish the legal holder, the Ternate address and the May 2020 allocation dates; the live announcements are visible in the route collectors (https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS139379) along with the three upstream relationships (https://stat.ripe.net/data/asn-neighbours/data.json?resource=AS139379). The self-described network profile, exchange port and Jakarta facility are in PeeringDB (https://www.peeringdb.com/net/22338), and the exchange's scale is documented on its own record (https://www.peeringdb.com/ix/375). The corporate deed and ministry approval appear in the registry mirror (https://iditrix.com/pt-theko-digital-solusindo/462292/).