Digital forensics and legal communication: network analysis of law enforcement response to viral youth violence cases in Indonesia - Frontiers

ORIGINAL RESEARCH article Front. Hum. Dyn., 17 February 2026 Sec. Digital Impacts Volume 8 - 2026 | https://doi.org/10.3389/fhumd.2026.1709823 Digital forensics and legal communication: network analysis of law enforcement response to viral youth violence cases in Indonesia A N Andi Nadia Aryana M A Muh. Akbar M F Muhammad Farid A F Alem Febri Sonni * Department of Communication Studies, Faculty of Social and Political Sciences, Hasanuddin University, Makassar, Indonesia Abstract The viral spread of youth violence content on social media platforms has created unprecedented challenges for law enforcement agencies in Indonesia, requiring rapid response mechanisms that balance digital evidence integrity with public communication needs. As digital platforms become primary sources of information about criminal incidents, law enforcement agencies must navigate complex tensions between transparency, accountability, and operational security. This study examines how law enforcement agencies communicate and coordinate during viral youth violence cases, analyzing the effectiveness of digital forensics communication networks and their impact on case outcomes. We employed a mixed-methods approach combining Social Network Analysis (SNA) of official communications, content analysis of law enforcement statements, and case study methodology focusing on three landmark cases from 2022-2024. Data sources included official social media accounts, press releases, court documents, and semi-structured interviews with 15 law enforcement officials. Our analysis revealed three distinct communication patterns: (1) Reactive Crisis Communication (72% of initial responses), (2) Proactive Information Management (23%), and (3) Strategic Digital Evidence Protection (5%). Network centrality measures showed that Metropolitan Police social media accounts served as primary information hubs (betweenness centrality = 0.847), while coordination between agencies remained fragmented (network density = 0.23). Law enforcement agencies demonstrated varying levels of digital communication competency, with successful cases characterized by early coordination, transparent evidence-based communication, and strategic social media engagement. The findings suggest the need for standardized digital forensics communication protocols and enhanced inter-agency coordination mechanisms, with particular attention to cultural adaptation in Indonesian contexts. 1 Introduction The rapid digitalization of social interactions has fundamentally transformed how violent incidents involving youth are documented, disseminated, and investigated in Indonesia (Irwanto et al., 2025). Indonesia's digital landscape presents a unique context for this study. With over 170 million social media users as of 2024 (representing 62% of the population) and smartphone penetration reaching 89% among youth aged 15–24, the country has experienced one of the fastest rates of digital adoption globally. This widespread digital connectivity has fundamentally altered how criminal incidents, particularly those involving youth, enter public consciousness and trigger institutional responses. The Indonesian National Police (Polri) data shows a 47% increase in youth violence cases involving digital documentation between 2022 and 2024, with 78% of these cases first gaining public attention through social media platforms before formal police reports were filed. This pattern represents a significant shift from traditional crime-reporting mechanisms and poses unprecedented challenges for law enforcement communication and evidence management. In an era where smartphones are ubiquitous and social media platforms serve as primary news sources for millions of Indonesians, the traditional boundaries between private incidents and public discourse have virtually disappeared. When youth violence videos become viral on social media platforms, law enforcement agencies face the dual challenge of maintaining evidence integrity while managing intense public scrutiny and media attention (Castells, 2015). This phenomenon has created new paradigms in legal communication that require systematic examination and understanding. The transformation of information ecosystems in Indonesia reflects broader global trends toward networked society structures, where power and influence flow through digital communication networks rather than traditional hierarchical institutions. This shift has particularly profound implications for law enforcement agencies, which have historically operated within rigid command structures and controlled information environments. The emergence of viral content as a driving force in public discourse challenges these traditional approaches and demands new forms of institutional adaptation. Recent high-profile cases, such as the Mario Dandy case in 2023, have demonstrated both the potential and pitfalls of law enforcement communication in the digital age (Irwanto et al., 2025). These cases reveal how the speed of information dissemination on social media can either support or undermine criminal investigations, depending on how effectively law enforcement agencies manage their digital communication strategies. The Mario Dandy case, involving assault by a wealthy young perpetrator, became a focal point for broader discussions about social inequality, justice, and institutional accountability, illustrating how individual criminal cases can rapidly escalate into societal discourse about fundamental values and systems. The intersection of digital forensics and legal communication represents a critical yet understudied area in contemporary criminology and communication studies. While previous research has examined social media's role in crime reporting (Patton et al., 2014) and digital evidence collection (Casey, 2010), limited attention has been paid to how law enforcement agencies communicate about ongoing investigations in viral contexts. This gap is particularly significant given the growing importance of public trust and legitimacy in law enforcement effectiveness, especially in democratic societies where police accountability has become a central concern. In the Indonesian context, these challenges are compounded by unique cultural, legal, and technological factors. The country's diverse linguistic landscape, with over 700 local languages alongside the national language, adds complexity to public communication strategies. Furthermore, Indonesia's rapid digital adoption, with over 170 million social media users as of 2024, has created an information environment in which traditional gatekeeping mechanisms have become less effective. The decentralized nature of Indonesian governance, with significant autonomy at regional levels, also affects how law enforcement agencies coordinate communication across jurisdictions. This study addresses three key research questions that emerge from the intersection of digital forensics, legal communication, and viral youth violence in Indonesia: RQ1: How do Indonesian law enforcement agencies structure their communication networks when responding to viral youth violence cases? RQ2: What communication patterns emerge during different phases of investigation and prosecution in viral youth violence cases? RQ3: How do these communication strategies impact both digital evidence integrity and public trust in law enforcement institutions? These questions are designed to capture both structural and processual aspects of law enforcement communication while acknowledging the dual imperatives of technical competency and public accountability. This study makes several novel contributions to both academic scholarship and practical domains. Theoretically, it is the first to integrate Network Society Theory with Crisis Communication Theory in the context of law enforcement digital communication in Southeast Asia, developing a culturally adapted framework that accounts for Indonesian values such as gotong royong (collective responsibility), rukun (social harmony), and bapakisme (paternalistic authority) in digital governance contexts. Methodologically, the study pioneers the application of Social Network Analysis to law enforcement communication networks in viral crisis contexts, moving beyond traditional content analysis to reveal structural patterns of coordination and information flow. The mixed-methods design combining SNA metrics (network density, betweenness centrality, modularity) with qualitative case analysis provides unprecedented insight into how hierarchical institutions adapt to networked communication environments. In practice, the research provides evidence-based recommendations for standardizing digital forensics communication protocols within Indonesian law enforcement, addressing a critical gap: 72% of initial responses remain reactive rather than strategic. The findings directly inform the Indonesian National Police's digital communication guidelines, currently under revision, and contribute to broader discussions about balancing transparency with operational security in democratic policing. Most significantly, the study challenges the prevailing assumption that digital evidence integrity and transparency in public communication are inherently conflicting objectives. Our analysis demonstrates that these can be mutually reinforcing when approached through strategically designed communication protocols, offering a framework applicable beyond Indonesia to other democratic societies navigating similar challenges in digital governance. 2 Literature review and theoretical framework 2.1 Digital communication in law enforcement The emergence of social media as a primary information source has necessitated fundamental changes in law enforcement communication strategies (Denef et al., 2013). Traditional models of police-public communication, characterized by controlled information release through formal channels such as press conferences and official statements, have been disrupted by the immediacy and interconnectedness of digital platforms (Schneider, 2014). This disruption extends beyond mere technological adoption to encompass fundamental changes in power dynamics, information control, and public expectations of institutional transparency. The transformation of digital newsrooms and communication practices, as documented by Sonni et al. (2024), demonstrates how artificial intelligence and digital technologies are reshaping information dissemination across institutions, including law enforcement agencies. Their research reveals that organizations increasingly rely on automated systems and real-time analytics to manage communication flows, creating new opportunities for responsive communication and risks of miscommunication and technical failures. Mergel (2013) Identified three evolutionary stages in police social media adoption: (1) Push strategies for information dissemination, where agencies primarily use platforms to broadcast official messages; (2) Pull strategies for community engagement, involving more interactive approaches that solicit public input and feedback; and (3) Network strategies for collaborative problem-solving, representing sophisticated approaches that leverage social media for genuine partnership with communities. However, these frameworks were developed primarily in Western contexts. They may not fully capture the dynamics of Indonesian digital culture, where collective social responsibility and hierarchical authority structures shape online interactions (Lim, 2017). The challenge becomes more complex when law enforcement agencies must balance transparency with operational security. Digital evidence preservation requires careful communication strategies that neither compromise ongoing investigations nor alienate public support. This tension is particularly acute in viral cases, where public attention creates pressure to release information immediately, often before agencies have sufficient time to analyze evidence or coordinate responses across multiple stakeholders. Contemporary law enforcement communication must also navigate the phenomenon of “information warfare,” where multiple narratives compete for public attention and legitimacy. In viral youth violence cases, these competing narratives often include victim advocacy groups, perpetrator support networks, media interpretations, and various civil society organizations, each with distinct communication strategies and objectives. Law enforcement agencies must position their communications within this complex ecosystem while maintaining professional standards and legal constraints. 2.2 Digital forensics and evidence integrity Digital forensics has evolved from a technical discipline focused on data recovery to a comprehensive framework encompassing legal admissibility, chain of custody, and public communication considerations (Carrier and Spafford, 2003). This evolution reflects the increasing importance of digital evidence in criminal proceedings and the growing complexity of digital crime environments. The integrity of digital evidence depends not only on technical preservation methods but also on how information about the evidence is communicated to various stakeholders, including courts, legal professionals, media, and the public. Modern digital forensics faces unprecedented challenges in viral content scenarios. The speed at which information spreads through social media networks can compromise evidence integrity through multiple mechanisms: original content may be altered through platform compression algorithms, redistributed with modified metadata, or contaminated through user-generated modifications such as annotations, cropping, or filtering (Quick and Choo, 2014). These technical challenges require law enforcement agencies to develop rapid protocols for evidence preservation while simultaneously educating the public about their role in maintaining evidence integrity. The concept of “evidence communication” emerges as a critical component of digital forensics, requiring agencies to develop sophisticated strategies for explaining technical constraints to non-technical audiences. This involves translating complex legal and technical concepts into accessible language while maintaining accuracy and avoiding oversimplification. Effective evidence communication must address public curiosity about the progress of investigations while protecting the integrity of ongoing legal proceedings. Law enforcement agencies must also coordinate with social media platforms to preserve evidence before it is deleted or modified. This coordination requires understanding the policies, technical capabilities, and response times of different platforms, adding another layer of complexity to digital forensics operations. The relationship between law enforcement and platform providers often involves legal instruments such as preservation orders and subpoenas, but effective communication can facilitate faster, more comprehensive preservation of evidence. Furthermore, digital forensics in viral cases must consider the phenomenon of “evidence multiplication,” where the duplicate content appears across multiple platforms, accounts, and formats. This multiplication can be advantageous for evidence preservation but creates challenges for establishing a chain of custody and authenticating sources. Communication strategies must help courts and juries understand these complexities while maintaining confidence in the reliability of the evidence. 2.3 Social network analysis in legal contexts Social Network Analysis (SNA) has emerged as a powerful tool for understanding communication patterns in legal and law enforcement contexts (Bright et al., 2021). Previous applications have focused primarily on criminal network mapping (Morselli, 2009) and information flow within judicial systems (Fowler et al., 2007). However, the application of SNA to law enforcement communication networks represents a relatively new area of inquiry with significant potential for understanding organizational effectiveness and public impact. Network theory provides valuable insights into how information flows through organizational structures and across institutional boundaries. In crisis communication contexts, network density measures indicate how well-connected different actors are within the communication system. In contrast, centrality measures identify which actors are critical information hubs or bridges between various groups (Vespignani, 2011). Clustering coefficients indicate the extent to which communication partners are also connected, revealing cohesive subgroups within larger networks. The application of SNA to viral incident response allows researchers to examine how quickly information spreads, which actors serve as central nodes in communication networks, and how effectively different agencies coordinate their messaging. This approach can reveal structural factors that influence communication effectiveness beyond individual agency, such as network position, redundant pathways, and structural holes that may impede information flow. Temporal network analysis adds another dimension by examining how communication networks evolve over time. In crisis contexts, networks often exhibit dynamic properties, with some actors becoming more central during certain phases while others reduce their communication activity. Understanding these temporal patterns can help agencies optimize their communication strategies for different stages of incident response. The integration of SNA with content analysis provides a comprehensive approach to understanding both the structure and substance of law enforcement communication. While network analysis reveals patterns of interaction and information flow, content analysis examines the actual messages being transmitted, their tone, accuracy, and effectiveness in achieving communication objectives. 2.4 Indonesian context and cultural considerations Indonesia's unique legal and cultural context significantly influences how law enforcement agencies approach digital communication. The implementation of the Electronic Information and Transactions Law (UU ITE) has established frameworks for handling digital evidence, but its practical application remains inconsistent across jurisdictions. This inconsistency reflects broader challenges in Indonesia's federal system, where regional autonomy creates variations in the implementation of national policies and standards. Recent research on digital communication patterns in Indonesian contexts, including studies on encoding-decoding processes in online spaces (Yushar et al., 2021), reveals how cultural factors influence information interpretation and response in digital environments. Their analysis of YouTube comment spaces during the COVID-19 pandemic demonstrated that Indonesian netizens employ complex interpretive frameworks that blend traditional cultural values with contemporary digital communication norms. Cultural factors, including concepts of social harmony (rukun) and collective responsibility (gotong royong), influence how law enforcement agencies approach public communication about sensitive cases (Bourchier, 2019). The principle of rukun emphasizes maintaining social equilibrium and avoiding open conflict, which can create tension with transparency requirements that might expose controversial or divisive information. Meanwhile, the principles of gotong royong suggest that effective communication should mobilize collective action toward shared objectives, implying that law enforcement communication should not merely inform but also inspire community cooperation. The Indonesian cultural value of maintaining face (tidak kehilangan muka) creates additional pressure for agencies to project competence and authority, potentially conflicting with transparency requirements that might reveal limitations or uncertainties. This cultural dynamic can lead to overly confident public statements that may require later revision as investigations proceed, potentially undermining long-term credibility. The hierarchical nature of Indonesian institutions also affects communication patterns, with information typically flowing through formal channels before reaching the public. This hierarchy, rooted in traditional Javanese court culture and reinforced by military traditions in Indonesian governance, can create delays in crisis response but may also ensure message consistency across different agency levels. Understanding these hierarchical dynamics is crucial for analyzing communication effectiveness, as rapid response requirements may conflict with established approval processes. Indonesia's linguistic diversity adds another layer of complexity to law enforcement communication. While Bahasa Indonesia serves as the national language, many citizens are more comfortable communicating in regional languages, and social media discourse often involves code-switching between multiple languages. Law enforcement agencies must navigate this linguistic complexity while maintaining message clarity and legal precision. The country's Islamic majority also influences communication norms, particularly regarding concepts of justice, authority, and social responsibility. Islamic principles of consultation (syura) and community welfare (maslaha) provide cultural frameworks that can either support or constrain different communication approaches, depending on how agencies frame their messages and engage with religious discourse. 2.5 Theoretical integration: network society and crisis communication This study integrates two primary theoretical frameworks to understand law enforcement digital communication in Indonesian contexts. Castells (2009) Network Society Theory provides the foundational understanding of how contemporary organizations operate within networked information structures. The theory posits that effectiveness depends not only on institutional authority but also on the ability to manage information flows across diverse network nodes, recognizing that power in networked societies flows through communication channels rather than traditional hierarchical command structures. In the Indonesian context, Network Society Theory must account for the persistence of hierarchical cultural values alongside emerging networked communication patterns. This creates hybrid organizational forms where traditional authority structures coexist with networked information flows, potentially creating tensions between formal and informal communication channels. Law enforcement agencies must navigate these tensions while maintaining both hierarchical accountability and network responsiveness. Crisis Communication Theory, particularly Coombs (2007) Situational Crisis Communication Theory (SCCT), offers a framework for understanding how organizations should communicate during crisis events based on crisis type and organizational responsibility. SCCT categorizes crises by managerial responsibility and provides strategic recommendations for communication approaches. We adapt this theory to examine how law enforcement agencies select communication strategies when responding to viral youth violence cases, recognizing that law enforcement crisis communication is subject to unique constraints related to legal proceedings and evidence integrity. The adaptation of SCCT to law enforcement contexts requires consideration of multiple audiences with different information needs and rights. Unlike commercial organizations that primarily focus on customer and stakeholder communication, law enforcement agencies must simultaneously address victims, perpetrators, legal professionals, media, political authorities, and the public, each with distinct expectations and legal protections. The integration of these theories suggests that effective law enforcement communication in viral contexts requires both structural network management capabilities and strategic crisis communication competencies. Agencies must simultaneously maintain their position within formal institutional networks while developing the flexibility to respond rapidly to evolving digital communication environments. This dual requirement creates challenges for hierarchical organizations that may lack the flexibility needed for effective network communication. Furthermore, the theoretical integration highlights the importance of cultural adaptation in communication strategies. While Network Society Theory provides universal insights about information flows and power dynamics, Crisis Communication Theory emphasizes the importance of contextual factors in strategy selection. In Indonesian contexts, this contextualization must account for cultural values, linguistic diversity, legal frameworks, and political structures that shape communication effectiveness. The synthesis of these theoretical perspectives leads to a conceptual framework that views law enforcement digital communication as a process of managing multiple network relationships while adapting crisis communication strategies to cultural and legal constraints. This framework emphasizes the dynamic nature of communication networks and the importance of strategic flexibility in response to changing conditions and stakeholder expectations. 3 Methods 3.1 Research design This study employed a convergent mixed-methods design, combining quantitative network analysis with qualitative case study methodology. To ensure methodological transparency and replicability, Table 1 explicitly maps each analytical method to the specific research questions it addresses, the data sources employed, and the analytical techniques applied. Table 1 Research Question Method Data Sources Analytical Techniques RQ1: network structure Social network analysis (SNA) Official social media accounts (Instagram, Twitter/X, Facebook), inter-agency communications Network density, betweenness centrality, closeness centrality, modularity (Gephi 0.9.7, R igraph) RQ2: communication patterns Content analysis + temporal network analysis Press releases, social media posts, court documents, case timeline data Deductive/inductive coding, sentiment analysis, temporal network evolution tracking RQ3: impact on evidence and trust Case study method + semi-structured interviews 15 key informant interviews, case outcomes, public response data Reflexive thematic analysis (Braun and Clarke, 2019), cross-case comparison, correlation analysis Methodological approach linked to research questions. 3.2 Case selection and data collection Three landmark viral youth violence cases from 2022 to 2024 were selected based on the following criteria: (1) achieved viral status with over 1 million social media interactions, (2) involved law enforcement investigation and prosecution, (3) generated substantial media coverage across multiple platforms, and (4) demonstrated distinct communication approaches that could provide comparative insights. The cases include the Mario Dandy assault case (2023), involving allegations of assault by a wealthy young perpetrator; the Malang school bullying case (2022), characterized by institutional coordination challenges; and the Jakarta cyberbullying suicide case (2024), representing complex digital evidence scenarios. These cases were selected through systematic screening of viral incidents reported in major Indonesian media outlets and social media monitoring platforms. The selection process involved content analysis of media coverage and social media metrics to ensure that selected cases met the viral threshold and represented different types of communication challenges. Each case generated distinct patterns of public response and law enforcement communication, providing variation necessary for comparative analysis. Data collection encompassed multiple sources to ensure comprehensive coverage of communication activities. Official social media accounts of law enforcement agencies were monitored during each case period, collecting posts, interactions, and public responses from Instagram, Twitter/X, and Facebook platforms. The monitoring period began when cases first achieved viral status and continued through legal resolution or public interest decline, ranging from 3 to 8 months per case. Official documentation included press releases from Polri headquarters and regional commands, court documents and charging decisions (where publicly available), parliamentary hearings related to digital policy, and policy statements from the Ministry of Communication and Information. This documentation provided insight into formal communication strategies and institutional decision-making processes. Semi-structured interviews were conducted with 15 key informants, including 5 law enforcement officials at various ranks, from detective to commissioner level; 3 digital forensics specialists with experience in viral cases; 3 legal practitioners specializing in digital crimes; 2 communication specialists from law enforcement agencies; and two academic experts in criminology and digital law. Interviews followed a standardized protocol but allowed follow-up questions tailored to participants' expertise and case involvement. 3.3 Data analysis 3.3.1 Detailed coding framework Content analysis employed both deductive and inductive coding approaches. The deductive coding scheme was derived from Coombs (2007) Situational Crisis Communication Theory, adapted for law enforcement contexts. Four primary categories guided the initial coding: Information Provision: Subcodes included factual incident details, investigation status updates, explanations of legal processes, timeline information, and evidence-related communications. Inter-coder reliability (Cohen's κ) = 0.87. Emotion Management: Subcodes captured empathy expressions toward victims, public reassurance messaging, acknowledgment of anger/frustration, and calls for calm. Inter-coder reliability (Cohen's κ) = 0.82. Instructing Behavior: Subcodes identified evidence preservation requests, witness appeal communications, public cooperation solicitation, and warnings against vigilantism. Inter-coder reliability (Cohen's κ) = 0.91. Reputation Management: Subcodes tracked institutional competence assertions, transparency demonstrations, accountability statements, and responsiveness to criticism. Inter-coder reliability (Cohen's κ) = 0.79. Inductive coding identified five emergent themes specific to digital forensics and Indonesian cultural contexts: (1) Evidence Education (explaining digital forensics concepts to public audiences), (2) Cultural Sensitivity (adapting messaging to Indonesian values of rukun and gotong royong), (3) Platform Coordination (describing cooperation with social media companies), (4) Hierarchy Navigation (managing vertical communication within police structures), and (5) Media Relationship Management (strategic engagement with traditional and digital media). Two independent coders achieved an overall inter-coder reliability of 0.84 (Cohen's κ) across all categories. 3.3.2 Interview protocol and procedures Semi-structured interviews followed a standardized protocol designed to capture both organizational perspectives and individual experiences. The 60-90 min interviews were conducted in Bahasa Indonesia between July and September 2024, audio-recorded with participant consent, and professionally transcribed. Interview data were analyzed using reflexive thematic analysis (Braun and Clarke, 2019): Section A - Organizational Context (10-15 min): Questions explored the participant's role, experience with viral cases, organizational communication protocols, and decision-making authority. Sample question: “Describe your agency's standard procedures when a youth violence incident gains viral attention on social media.” Section B - Specific Case Experience (20-30 min): Questions elicited detailed accounts of communication decisions during specific cases, coordination challenges, and strategic considerations. Sample question: “Walk me through your communication decisions in the first 24 h after [specific case] went viral.” Section C - Challenges and Constraints (15-20 min): Questions identified technical, legal, cultural, and resource challenges. Sample question: “What are the most difficult tensions you face between transparency requirements and evidence protection needs?” Section D - Recommendations and Future Directions (10-15 min): Questions solicited practitioner perspectives on improving protocols and training. Sample question: “If you could redesign your agency's digital communication protocols, what would you change?” Participant recruitment used purposive sampling targeting individuals with direct involvement in viral case communication. Initial contacts were made through official channels with Polri headquarters and regional commands. Snowball sampling identified specialized experts (digital forensics, legal practitioners). All participants received information sheets detailing the study purpose, voluntary participation, confidentiality protections, and the right to withdraw. Verbal informed consent was audio-recorded before each interview. 3.3.3 Ethical considerations The studies involving humans were approved by the Ethics Committee of the Faculty of Social and Political Sciences, Universitas Hasanuddin (Protocol #2024-087, approved August 5, 2024). The studies were conducted in accordance with local legislation and institutional requirements. The Ethics Committee waived the requirement of written informed consent for participation because: (1) the study involved analysis of publicly available social media data from official institutional accounts with no collection of personal identifying information, and (2) interview participants provided documented verbal informed consent that was audio-recorded, deemed appropriate for this minimal-risk professional interview study. The social media data was accessed and analyzed in accordance with the platforms' terms of use and all relevant institutional/national regulations. All analyzed content was publicly available through official verified accounts. Data storage and analysis procedures followed university data protection protocols, anonymising personal identifiers and securing sensitive materials. No personal identifying information of case victims or suspects was included in the analysis, and pseudonyms were used for all case references where individual identification might be possible. This research deliberately focused on high-profile viral cases (>1 million social media interactions) to analyze law enforcement communication under maximum public scrutiny, providing observable networks essential for Social Network Analysis. We analyzed public-facing communications on Instagram, Twitter/X, and Facebook platforms where law enforcement maintained active official accounts during 2022-2024. All cases occurred in metropolitan Java contexts (Jakarta, Malang). While this scope enabled systematic analysis of communication patterns and network structures, findings may not generalize to routine cases, platforms with different affordances (TikTok, WhatsApp), or diverse Indonesian regional contexts. Our correlational design identifies associations between communication strategies and outcomes but cannot establish causation; alternative explanations (case complexity, resource availability, institutional capacity) may account for observed patterns. Future research should examine communication across case types, platforms, and contexts using stronger causal designs. 4 Results 4.1 Network structure and communication patterns The analysis revealed distinct network structures across the three cases, with significant variations in communication centralization and inter-agency coordination. As shown in Table 2, network density ranged from 0.18 (Jakarta cyberbullying case) to 0.31 (Malang bullying case), indicating substantial differences in overall connectivity between agencies. The Mario Dandy case demonstrated the highest betweenness centrality (0.847), suggesting that Metro Police Jakarta's social media account was the primary information hub, while the fragmented structure (density = 0.23) indicated limited coordination between agencies. Table 2 Metric Case A (mario dandy) Case B (malang bullying) Case C (Jakarta cyberbullying) Network density 0.23 0.31 0.18 Average clustering 0.67 0.71 0.52 Betweenness centrality (Max) 0.847 0.632 0.923 Number of components 3 2 4 Average path length 3.2 2.8 4.1 Modularity 0.45 0.38 0.51 Network structure characteristics by case. Average clustering coefficients ranged from 0.52 to 0.71, with higher values indicating stronger local connectivity within agency clusters. The number of disconnected components ranged from 2 to 4, indicating varying levels of network fragmentation. Average path lengths between nodes ranged from 2.8 to 4.1, affecting the speed at which information could flow through the networks. Figure 1 illustrates the communication network structure for Case A, showing the central role of @polri_metro with strong connections to mainstream media accounts but limited direct engagement with community stakeholders. The visualization reveals how information flows through hierarchical structures, with apparent clustering around institutional nodes and sparse connections between different organizational types. Figure 1 Methodological workflow diagram. These structural differences had significant implications for communication effectiveness. Cases with higher network density and lower path lengths demonstrated more coordinated messaging and faster information dissemination. The Malang bullying case, with the highest density (0.31) and lowest path length (2.8), showed the most effective inter-agency coordination. Conversely, despite having the highest individual betweenness centrality (0.923), the Jakarta cyberbullying case suffered from overall network fragmentation with four disconnected components, leading to inconsistent messaging and delayed response coordination. The network visualization in Figure 2 reveals the typical hub-and-spoke structure of Indonesian law enforcement communication, where information flows primarily through central institutional nodes rather than through distributed networks. This structure, while enabling rapid dissemination from authoritative sources, can create bottlenecks when central nodes become overwhelmed or adopt restrictive communication policies during crises. Figure 2 Network visualization - mario dandy case communication network. 4.2 Temporal communication patterns Three distinct phases emerged in law enforcement communication across all cases. The initial response phase (0-72 h) was characterized by reactive communication in 72% of agencies, focusing on incident confirmation and warnings about evidence preservation. Limited coordination between agencies was evident, with high social media engagement but limited information. The investigation management phase (3 days - 2 weeks) showed a shift toward proactive information management in 45% of communications. This phase emphasized legal process education and expectation management, with increased inter-agency coordination visible in synchronized messaging. Strategic evidence protection communications emerged during this phase, representing only a small fraction of total communications. The legal resolution phase (2 weeks+) focused on outcome communication and legal education, demonstrating the highest levels of inter-agency coordination. Emphasis shifted to broader policy implications and prevention messaging, with agencies using the cases as opportunities to educate the public about legal processes and digital citizenship. As illustrated in Figure 3, the temporal patterns show distinct communication characteristics across the three phases. The initial response phase demonstrates high volume but low coordination, with agencies responding independently to public pressure. The investigation management phase shows reduced volume but increased coordination scores, indicating more strategic messaging. The legal resolution phase shows renewed activity and the highest coordination levels, suggesting that agencies had developed more effective collaborative approaches by this stage. Figure 3 Temporal analysis of communication phases. The transition between phases varied significantly across cases. Successful cases, measured by public satisfaction and case outcomes, demonstrated faster movement from reactive to proactive communication, typically within 24-48 h of initial viral spread. The temporal analysis reveals that agencies capable of rapid adaptation to strategic communication approaches achieved better overall outcomes, supporting the importance of prepared protocols and organizational flexibility. 4.3 Communication strategy categories Content analysis revealed four primary communication strategies employed by law enforcement agencies. Reactive Crisis Communication, characterizing 72% of initial responses, featured rapid acknowledgment of incident awareness, standard procedural language about ongoing investigations, warnings against evidence tampering, and limited specific information about investigation progress. Proactive Information Management, representing 23% of responses, demonstrated more sophisticated approaches, including prepared template responses for different incident types, coordinated multi-platform messaging, educational content about legal processes, and strategic timing of information releases. Strategic Digital Evidence Protection, observed in only 5% of responses, represented the most advanced approach. This strategy included technical guidance about evidence preservation, coordination with platform providers for content preservation, public education about digital evidence integrity, and a transparent explanation of investigation constraints. Community Engagement and Prevention, comprising 12% of responses, incorporated broader social dialogue by discussing underlying social issues, prevention-focused messaging, collaboration with community organizations, and long-term relationship building beyond specific cases. 4.4 Factors influencing communication effectiveness Statistical analysis identified several factors significantly associated with communication effectiveness, measured by public engagement quality, media accuracy, and case outcome satisfaction. As detailed in Table 3, early inter-agency coordination showed the strongest correlation with effectiveness (r = 0.73, p < 0.001), followed by proactive communication strategy (r = 0.68, p < 0.001) and digital forensics expertise (r = 0.61, p < 0.01). Table 3 Factor Correlation with effectiveness Significance Early inter-agency coordination r = 0.73 p < 0.001 Proactive communication strategy r = 0.68 p < 0.001 Digital forensics expertise r = 0.61 p < 0.01 Community engagement level r = 0.54 p < 0.01 Media relationship quality r = 0.49 p < 0.05 Technical communication clarity r = 0.44 p < 0.05 Factors associated with communication effectiveness. The correlation patterns shown in Table 3 reveal several vital insights about communication effectiveness. The strongest predictor, early inter-agency coordination (r = 0.73), underscores the critical importance of the network connectivity patterns observed in our structural analysis. This finding suggests that agencies capable of quickly establishing collaborative communication frameworks achieve significantly better outcomes than those operating in isolation. The second strongest factor, proactive communication strategy (r = 0.68), validates the temporal phase analysis, showing that agencies rushing from reactive to strategic approaches demonstrate superior performance. Digital forensics expertise (r = 0.61) emerges as a crucial technical competency, indicating that agencies with personnel capable of explaining complex technical concepts to public audiences achieve better communication outcomes. Notably, community engagement level shows a moderate but significant correlation (r = 0.54), supporting the cultural adaptation hypothesis that Indonesian communication effectiveness depends partly on activating gotong royong principles. While showing weaker correlations, media relationship quality and technical communication clarity remain statistically significant factors that contribute to overall effectiveness. Interview analysis revealed five primary challenges faced by law enforcement agencies: technical complexity in explaining digital evidence concepts to the public, legal constraints on information sharing, resource limitations in dedicated social media crisis response, cultural expectations for rapid justice that conflict with proper investigative procedures, and platform coordination difficulties across different social media environments. 5 Discussion 5.1 Network structure and information flow The network analysis reveals that Indonesian law enforcement communication operates in a partially fragmented structure, with high centralization around key accounts but limited horizontal coordination between agencies. This pattern reflects broader characteristics of Indonesian institutional organization, where hierarchical authority structures can impede lateral communication (Aspinall and Mietzner, 2019). The high betweenness centrality scores for Metro Police Jakarta's accounts in high-profile cases suggest that geographic and institutional proximity to power centers significantly influences communication network position. However, this centralization creates vulnerabilities, as information bottlenecks can emerge when central nodes become overwhelmed or adopt restrictive communication policies. The emergence of strategic digital evidence protection communication in only 5% of responses indicates a significant gap in current practice. Given the critical importance of evidence integrity in legal proceedings, this represents a substantial opportunity to improve law enforcement digital communication protocols. The disconnect between digital evidence requirements and public communication practices suggests that current approaches often treat these as separate rather than integrated concerns. 5.2 Temporal dynamics and cultural adaptation The three-phase temporal pattern demonstrates that law enforcement agencies adapt their communication strategies over time, but often reactively rather than proactively. The predominance of reactive communication in Phase 1 (72%) suggests that most agencies lack prepared protocols for viral incident response, reflecting broader challenges in organizational adaptation to digital communication environments. This finding is particularly significant given the speed at which viral content spreads, often requiring response decisions within hours rather than the days or weeks typically available for traditional crisis communication planning. The temporal analysis reveals important learning curves within individual agencies and law enforcement systems more broadly. Agencies that performed well in later phases of longer cases often demonstrated improved performance in subsequent instances, suggesting organizational learning effects. However, this learning appeared largely informal and agency-specific rather than systematized across the law enforcement network. Cultural factors significantly influence communication patterns and effectiveness throughout all temporal phases. The concept of bapakisme (paternalistic authority) appears to influence public expectations of law enforcement communication, with citizens expecting authoritative, definitive statements rather than the procedural uncertainty that characterizes ongoing investigations. This cultural expectation can pressure agencies to provide more information than is appropriate for active investigations, potentially compromising evidence integrity or legal proceedings. The Indonesian cultural value of saving face pressures law enforcement agencies to avoid admitting limitations or uncertainties in public communications. This pressure is particularly intense during the initial response phase, when agencies may lack complete information but face immediate demands for public statements. The analysis reveals that agencies often provide minimal information rather than acknowledge uncertainty, which can fuel speculation and alternative narratives that may be more damaging than honest acknowledgment of limitations. However, the study also reveals positive cultural adaptations. The finding that community engagement correlates positively with communication effectiveness (r = 0.54) supports the importance of gotong royong principles in Indonesian digital contexts. Law enforcement agencies that successfully activated community support and participation achieved better outcomes than those relying solely on institutional authority, suggesting that effective communication requires cultural sensitivity and adaptation. The temporal patterns also reveal critical gender and generational dimensions in communication effectiveness. Younger officers with greater social media experience often demonstrated better tactical communication skills, while senior officers provided strategic oversight and institutional credibility. The most effective agencies appeared to combine these strengths through collaborative communication teams rather than relying on either group exclusively. Religious and ethnic considerations also influenced communication strategies, particularly in cases involving perpetrators or victims from different religious or ethnic backgrounds. Agencies operating in diverse communities often demonstrated greater sensitivity to these factors, while those in more homogeneous areas sometimes struggled with cultural adaptation when cases gained national attention. 5.3 Study limitations and scope This st