The Procurement Blind Spot: What the Chromebook Scandal Reveals About Where Corruption Actually Begins

In June 2026, Indonesia sentenced Nadiem Makarim to ten years in prison.

The conviction sent shockwaves through Southeast Asia's tech and governance communities. Makarim was not a career politician. He was the co-founder of Gojek, one of the region's most successful startups. He had been brought into government precisely because he represented something different: private sector efficiency, digital transformation, and the promise of reform.

The case against him centred on a COVID-era procurement programme that allegedly cost the Indonesian state Rp 2.18 trillion (approximately $125 million USD). Between 2019 and 2022, his Ministry of Education purchased thousands of Google Chromebooks for schools under an education digitisation initiative. Prosecutors argued the specifications were steered towards Google products, the devices were procured at roughly double their appropriate cost, and the programme was designed to benefit vendors with undisclosed financial ties to Makarim himself.

Makarim vows to appeal the case as politically motivated. But that narrative misses the structural lesson entirely.

The Chromebook case is not a story about one man's moral failure or political revenge. It’s a story about institutional design failure. And the most important insight it offers has nothing to do with whether Nadiem Makarim was guilty of corrupt intent or whether the Indonesian government is politically motivated. It has everything to do with where the corruption risk actually lies and where procurement best practices are never designed to look.

Procurement law regulates the tender. Corruption begins before the tender exists.

Here are the structural problems that the Chromebook case exposes with uncomfortable clarity:

Procurement law treats the tender announcement as the boundary of the regulated space

The actual boundary of where corruption risk begins is wherever a need first gets identified and defined. That, almost always, happens earlier, often, off the books, that procurement audits are built to check.

Across jurisdictions, specification manipulation is one of the most common forms of procurement corruption. And one of the hardest to catch because it happens upstream from the process that regulators, compliance officers, and auditors scrutinise.

In the Chromebook case, the specifications were not written through a formal procurement process. According to trial testimony, the technical direction was shaped in a WhatsApp group called "Mas Menteri Core Team” that was created long before the tender process. In other words, the formal procurement process inherited a decision that had already been made.

A specification that narrowed after the fact, with unclear authorship

The initial technical recommendation was a Windows/Chrome hybrid solution. It was later changed to Chrome-only at the technical team level; Makarim claims this happened without his formal knowledge. A specification narrowing from a mixed, flexible solution involving two vendors to a single-vendor-ecosystem solution, especially one where nobody can clearly say who made the final call.

"Who changed this? And why did the vendor list shrink?" are standard hygiene questions for any procurement activity. If they are not, finding the answers later becomes a difficult forensic reconstruction.

Specifications correlated with market concentration, not need

Indonesia Corruption Watch simultaneously flagged that requiring high domestic-content levels alongside a Chrome-only specification would likely favour only a few suppliers. This is a mechanical, checkable signal: you can count how many vendors satisfy a specification before making a purchase. If the number is unusually small compared to the market and effectively excludes other competitors, it should trigger basic compliance checks.

No feasibility testing against deployment conditions

The devices required stable internet access. Indonesia has large rural and frontier regions without internet. The court later cited this as the core reason the programme failed to deliver value. This was not a hidden fact that only emerged in litigation. Connectivity maps and infrastructure data already existed in 2020. A basic “use case" check, done before procurement rather than assumed, would have flagged this as a major issue.

Personal financial proximity to the eventual outcome, undisclosed at the point of decision.

Prosecutors tied the alleged personal-gain theory to Google's prior investment in Gojek's parent company and Makarim's own declared securities holdings. A relationship that existed before the Chromebook decision, and was not walled off from it. Whether or not the causal story holds up on appeal, the structural signal is observable: an undisclosed pre-existing financial relationship between a decision-maker and a business that later becomes the sole eligible vendor is checkable the moment the decision-maker is appointed. Full, line-item asset and interest declarations are common compliance practices for public office and government intelligence.

None of these signals, individually, require knowing in advance that something will go wrong. Each is a structural property—who is in the room, how early vendors entered, whether the specification narrowed and who signed off, whether feasibility was tested against real conditions, whether financial relationships were disclosed before the decision—that is observable in real time by anyone doing basic process hygiene.

The Chromebook case does not need a villain to be instructive. It needs an architect

COVID Emergency Procurement: The Perfect Storm

The Chromebook procurement took place under COVID-era emergency provisions. That context is not incidental, it is structural.

According to UNODC research, many governments bypassed procurement provisions to respond quickly to the pandemic. In many instances, emergency packages were disbursed with irregular levels of compliance, accountability, and due diligence, creating opportunities for new levels of corruption.

Emergency procurement provisions are designed to solve a speed problem. But they end up removing the friction that conflict-of-interest and objective-bidding rules depend on to function.

The formal rules did not fail because they were absent. They failed because the emergency carve-out formally suspended them, and nobody built compensating controls to fill that gap.

This is the real institutional lesson: emergency status was used as a blanket waiver.

Market research, feasibility studies, competitive bidding, and conflict disclosures all got suspended together, as if they were all equally time-consuming. They are not.

When "we had no time" is invoked to justify skipping steps that would not have meaningfully slowed anything down, that mismatch between the stated justification and the actual time cost of the step being skipped is itself a signal worth noticing.

Conflict-of-interest declarations take minutes to check and do not slow anything down. There is no legitimate reason to waive these even in a genuine crisis.

Competitive bidding among a pre-vetted pool can happen in days, not months, if the pool already exists.

Feasibility studies can be condensed into a rapid checklist. Instead of eliminating questions altogether, we can ask simple ones, such as “does this work with existing infrastructure in actual deployment conditions?” to ensure core utility. The Chromebook case illustrates the consequences of completely omitting this step: a product that fails in areas without reliable internet is purchased at scale.

The Fix: Integrity-by-Design in Procurement Architecture

The structural fixes are not exotic. They do not require new technology or regulatory innovation. They require extending the paper trail, the disclosure obligations, and the vendor-contact firewalls backward, from "tender announcement" to "the first meeting where someone said we should solve this problem."

A tiered emergency procurement framework

Emergency procurement rules and compliance resilience frameworks should specify which controls flex (timelines, advertisement periods, number of required bids) and which never flex (conflict disclosure, beneficial ownership checks, minimum feasibility sign-off). These rules must be set before the emergency, not improvised during it.

This is the single highest-leverage fix because it converts "we had no time to run a tender and do due diligence" from a true constraint into a solved problem.

Pre-qualified vendor pools built in calm times

A major reason emergency procurement collapses into single-vendor deals is that there is no vetted shortlist ready to go. If governments maintain pre-qualified, competitively vetted vendor pools for likely emergency categories, such as medical supplies, IT and education technology, disaster relief logistics, then "emergency" only needs to compress selection among the pool, not skip competition altogether.

Mandatory post-hoc review with a hard trigger

Emergency procurement should come with an automatic, non-waivable retrospective audit, triggered by the emergency declaration itself, not by a whistleblower or a change in political leadership. In the Chromebook case, accountability arrived years later, entangled with a change in administration, which makes it look political even when it may not be.

A built-in six-to-twelve-month post-emergency audit, done regardless of who is in power, decouples accountability from politics and catches feasibility failures while there is still time to course-correct rather than years later in a courtroom.

Upstream specification controls

Integrity-by-design at the specification stage means requiring documented, sequenced answers to basic questions:

What is the problem, independent of any vendor or product?

What are the constraints of the actual deployment environment? (decided and logged before any vendor conversation)

Who participated in the first needs-definition meetings? (roles and affiliations disclosed, from the earliest scoping conversation, not just from tender announcements).

A record of every version of the specifications (who changed it and why, with mandatory justification if the change narrowed eligible vendors).

This doesn’t require extra time; these conversations are already happening informally for every emergency tender. They just need to happen formally.

This turns "why did the specification change, and who made that call" from a question that requires forensic reconstruction into a question with a clean, pre-recorded, apolitical answer.

The Technocrat Trap: When Private Sector Logic Meets Public Accountability

There is a deeper pattern beneath the Chromebook case that matters beyond Indonesia. Nadiem Makarim came from a startup. Startups optimise for speed, founder authority, and informal trusted-lieutenant networks. That is how Gojek was built. That is how most successful companies are built.

Public governance optimises for the opposite. It is designed to prevent exactly the failure the case centres on. An unaccountable decision that captures public value for private benefit. The entire apparatus exists specifically to slow down and formalise the informal-trusted-network model that startups reward.

The trial record shows a structure that reads like the startup model transplanted wholesale: testimony described a special staffer with no formal procurement authority who was informally known as the "Shadow Minister" due to influence comparable to the minister's own; an outside technical consultant brought in through a personal network rather than a formal advisory appointment; and a specification that appears to have been set, then altered at the technical level, without formal ministerial sign-off being clearly on record.

Whether or not that constitutes corrupt intent is precisely what the court, the dissenting judges, and the pending appeal disagree about. But structurally, it is the informal-network operating model.

In a company, that is just how the founder's inner circle works. In a ministry, each of those features is the exact thing laws exist to prevent. The technocrat trap is not a structural inevitability. It is a failure of contextual intelligence.

The core difference between decision-making in government and the private sector comes down to motive and accountability. The private sector makes choices to maximise profit and outpace competitors. Government makes choices to balance competing public interests and follow strict laws to prevent abuse of state power.

This changes everything, from the pace and process for buy-in to setting internal controls. The responsibility sits squarely with the person who crossed the threshold to understand the organisational context within which they are working!

Speed and Accountability Are Not in Tension

The most persistent myth in emergency procurement is that speed and accountability are in tension. They are not, if the accountability mechanisms are built to be fast too.

Emergency procurement rules should be built on the assumption that someone will eventually ask "why this vendor, why this specification, why this price” and design the process so that question has a clean, pre-recorded, apolitical answer available, rather than relying on a prosecution years later to reconstruct intent from WhatsApp messages and asset disclosures.

The Chromebook case exposes a governance system that was not designed to connect signals. Procurement saw a procurement. IT saw a technology project. Education officials saw pandemic learning needs. Finance saw budget execution. Legal saw emergency powers. Audit planned future reviews.

No one appears to have been explicitly responsible for asking the overarching question: "Do all of these facts, taken together, suggest that this decision deserves heightened scrutiny before we proceed?"

That is precisely the role modern risk and compliance functions are increasingly designed to play.

Traditional compliance asks: "Did we comply?"

Upstream governance asks: "Are we making a decision we can defend?"

That subtle difference changes everything.

In high-reliability industries like aviation, nuclear power, and air traffic control, organisations do not wait until someone crashes a plane before asking whether procedures are deteriorating. They need to monitor for small deviations: unusual communication, missing documentation, unexplained changes, increasing complexity, informal workarounds.

The specification change is a small deviation. The vendor concentration is a small deviation. The undisclosed financial relationship is a small deviation. No single one of them crashes the plane. But someone whose job it is to watch for holes lining up would have seen all pointing in the same direction at the same time.

The Chromebook case does not need more villains. It needs better architecture.

Let’s Stay in Touch. If you're working with integrity, anti-corruption, or simply passionate about building resilient institutions, I'd love to hear from you. Let’s connect!