Inside the Workshop
On the morning of 2 March 2026, I took my seat in a conference room in Dili. Around me sat colleagues from across the Timorese government — representatives of the central bank, telecommunications regulators, customs officials, people from the Ministry of Commerce and Industry, from Finance, from Agriculture, from the Presidency of the Council of Ministers. In front of us, presenters from the ASEAN Secretariat's Digital Economy Division had flown in from Jakarta to explain, systematically and with considerable patience, the ten chapters of an agreement our country will be asked to sign in approximately eight months.
The agreement is the ASEAN Digital Economy Framework Agreement — DEFA. It is, in the words of the ASEAN Secretariat itself, the world's first legally binding, region-wide digital economy agreement. It covers cross-border electronic transactions, digital trade facilitation, data protection, cybersecurity, digital identity, electronic payments, cross-border e-commerce, emerging technology cooperation, talent mobility, and competition policy. It has approximately 130 substantive paragraphs. As of this workshop, around 116 have been agreed by the other ten ASEAN members. Timor-Leste was not present when those paragraphs were negotiated. We are the eleventh member. We are being asked to sign.
I write this essay not as an official of AIFAESA — the national health and food safety regulatory authority I represent — which, as I will acknowledge openly, has arguably little direct role in a digital economy framework agreement. I write it as a Timorese who sat in that room, listened carefully to what was being said, watched how my colleagues engaged with the material, and came away with a conviction that is both admiring and deeply worried. Admiring, because the workshop was well-organised, the presenters were knowledgeable, and the questions from Timorese participants were often sharp and well-informed. Deeply worried, because the structure of who was in that room, who was not, and what happens next, revealed something that cannot be papered over with diplomatic courtesy.
We are not ready. Not yet. And the most dangerous thing we could do is mistake attendance at a workshop for institutional readiness.
The DEFA information session in Dili was a genuine and generous act of capacity-building by the ASEAN Secretariat. The presenters covered all ten chapters with clarity and did not pretend that Timor-Leste's gaps were small. What the workshop could not do — and was never intended to do — was create the institutional memory, cross-agency coordination, and sustained policy ownership that actually implementing DEFA requires. A two-day session, however excellent, is a beginning. It is not a system.
The Institutional Ironies
Two absences from that conference room deserve to be named, because they are not accidental — they reveal a structural problem, not a scheduling oversight.
The first absence: there was, to my knowledge, no representative of the Direção Nacional de Informação e Comunicação — DNIC — the agency that manages the government's own terrestrial fibre optic backbone connecting 440 public institutions. DNIC is the operational core of Timor-Leste's government digital infrastructure. Any serious implementation of DEFA's commitments on digital trade, e-government services, or national connectivity will pass through the systems DNIC manages. Its absence from a workshop on Timor-Leste's digital economy strategy is not a trivial omission.
The second absence: there was, to my knowledge, no representative of the Internet Service Provider sector — the commercial telecommunications operators who are, in practice, the entities through which any digital economy activity in Timor-Leste actually occurs. The private sector that will bear the burden of DEFA's compliance requirements, and that stands to gain most from its opportunities, was not in the room where the commitments were being explained.
I note this not to criticise the workshop's organisers, who assembled an impressively broad cross-ministerial group within the constraints they faced. I note it because it illustrates, in concrete human terms, the problem this essay is about: Timor-Leste's digital governance is fragmented across institutions that do not have a common table, a common mandate, or a common memory. Each institution sends its representative to the meetings it is invited to attend. When that representative changes, the institutional memory resets. When an institution is not invited, its knowledge — and its compliance obligations — remain unaddressed.
The participants in the March 2026 workshop are individuals representing their respective institutions. There is no guarantee that the same individuals will represent their institutions in the next round of negotiations, in the technical working groups that follow, or when implementation begins. In the absence of a dedicated, institutionally-anchored coordination body, the knowledge and relationships built in this workshop risk evaporating when personnel change — which in Timor-Leste's small public service, happens frequently. This is not a hypothetical concern. It is a pattern that has repeatedly slowed the country's integration into international frameworks.
Let me be equally frank about my own institution's position. AIFAESA regulates health products, food safety, and medical equipment. Its direct stake in DEFA is real but indirect — the data protection chapter is relevant to patient data; the digital ID chapter matters for health system connectivity; cybersecurity frameworks are critical for any national health information system. But AIFAESA is not a digital economy regulator. I was in that room because DEFA touches everything, and every institution in Timor-Leste's small state must understand what is coming. That, too, is part of the problem. When an agreement is so cross-cutting that even the health products regulator needs to be briefed on it, the country needs a body that can hold all of those threads together. No single ministry can do it. The Ministry of Commerce and Industry is doing its best — and it is doing it largely alone.
The Fragmentation Problem in Full
To understand why a National Digital Economy Council is not a bureaucratic luxury but a strategic necessity, one must first understand the precise nature of Timor-Leste's institutional fragmentation in the digital domain — not as an abstract problem, but as a concrete map of who owns what, and what the gaps are.
The Autoridade Nacional de Comunicações (ANC) is the telecommunications regulator. It licenses operators, allocates spectrum, and oversees compliance with telecommunications law. It does not set digital economy policy. It does not negotiate international agreements. It does not regulate data protection or cybersecurity beyond the narrow telecommunications context.
The Direção Nacional de Informação e Comunicação (DNIC), within the Ministry of Transport and Communications, manages the government's fibre backbone connecting 440 institutions. It does not regulate commercial operators. It does not set e-government policy. It operates infrastructure, and it does it reasonably well within that mandate.
TIC Timor, EP — the public enterprise for e-government ICT services — develops information systems for government institutions and manages the government data centre. It is operational, not regulatory, and its mandate does not extend to private sector digital services or national digital economy strategy.
The Banco Central de Timor-Leste (BCTL) regulates financial services, including mobile wallets and digital payment providers. It has taken meaningful steps towards financial inclusion and participated in the Pacific Regional Regulatory Sandbox. But its mandate is financial, not digital economy-wide. It does not coordinate with ANC on telecoms-fintech intersections in any formal way.
The Ministry of Commerce and Industry (MCI) leads Timor-Leste's engagement with ASEAN economic negotiations, including DEFA. It organised the March 2026 workshop. But MCI does not control telecoms, does not regulate digital payments, does not manage government networks, and does not have authority over the legislative agenda of other ministries. It is the diplomatic face of Timor-Leste's digital economy engagement, coordinating across agencies that have no formal obligation to coordinate back.
And then there is the legislative gap: as of March 2026, Timor-Leste has no personal data protection law. No national cybersecurity strategy. No Computer Emergency Response Team. No national digital identity framework. No National Single Window for trade. No dedicated e-commerce consumer protection regime. These are not peripheral items — every single one is a chapter in the DEFA agreement Timor-Leste is being asked to sign in eight months.
This is not a failure of individuals. The officials I sat with in that workshop are intelligent, committed, and often better-informed about their respective domains than any outsider might expect of a small developing state. The failure is structural: there is no institutional home for the digital economy as a whole. There is no body mandated to look at the full picture, identify the gaps, assign responsibility, track progress, and present Timor-Leste to the world as a coherent digital economy partner.
A country that sends different people to every meeting, with no common brief, no common memory, and no common mandate, does not negotiate. It attends. There is a profound difference. — The author's reflection on the March 2026 DEFA workshop
The Comparison That Should Embarrass Us Into Action
Consider, briefly, how other small ASEAN members have approached digital economy governance. Cambodia established its Digital Economy and Digital Society Policy Framework and created a dedicated ministry — the Ministry of Digital Economy and Digital Technology — with a cross-cutting mandate before engaging in the early rounds of DEFA negotiations. Lao PDR, a country of comparable economic size, has a Ministry of Technology and Communications with a formal digital economy mandate and participates in ASEAN digital working groups with institutional continuity. Brunei, one of ASEAN's smallest members, established a dedicated Digital Economy Council chaired by the Prime Minister himself, ensuring that digital economy commitments carry political weight across all ministries.
Timor-Leste has none of these. It has the Ministry of Commerce leading ASEAN negotiations, the Ministry of Transport holding telecoms policy, the central bank handling fintech, a technical directorate managing government networks, and a public enterprise running e-government services — all operating in their own lanes, without a single inter-institutional mechanism to integrate their work.
The Countdown to November 2026
There is a sense in which pointing out institutional fragmentation is easy. What makes this moment genuinely urgent is the convergence of an external deadline with a domestic unpreparedness that, if not addressed with real urgency, will leave Timor-Leste in one of three bad positions: signing a binding agreement it cannot implement; being asked for special carve-outs and extended timelines that mark it as a partial participant in ASEAN's digital future; or, worst, discovering after signing that critical national interests — in data sovereignty, in digital competition, in consumer protection — were not adequately represented because no institutional mechanism existed to think them through.
The timeline is genuinely compressed. Let us be precise about what must happen between now and November 2026 if Timor-Leste is to sign DEFA as a capable and prepared participant rather than a well-intentioned but unprepared newcomer:
What Is Actually at Stake
It is worth pausing to name, plainly, what Timor-Leste stands to gain and to lose — because the urgency of this argument rests on those stakes being genuinely high, not merely bureaucratically inconvenient.
On the gain side: DEFA, properly implemented, is one of the most significant non-petroleum economic opportunities Timor-Leste has ever encountered. The BCG analysis commissioned for DEFA negotiations estimated value multipliers of up to 6.5 times current digital economy values for lower-middle income ASEAN countries. Timor-Leste's petroleum revenues are declining. The Petroleum Fund's drawdown trajectory is unsustainable. The country needs a successor economic model. A well-implemented digital economy — grounded in DEFA's market access, payment interoperability, and trade facilitation commitments — could be a meaningful part of that model. For coffee farmers in Ermera who could sell to regional markets with digital payment systems. For entrepreneurs in Maliana who could access regional logistics platforms. For health workers in Baucau who could consult specialists in Dili via telemedicine. These are not fantasies. They are the documented outcomes of digital economy development in comparable countries.
On the loss side: if Timor-Leste signs DEFA without the legislative architecture to implement it, the agreement becomes a commitment without enforcement, a right without substance. If the country's digital payments system remains fragmented between non-interoperable wallets, the cross-border payments chapter delivers no benefits. If there is no data protection law, the data flows chapter opens the country's citizens to risks it cannot legally address. If there is no cybersecurity strategy, the cybersecurity cooperation chapter is a signature on a document rather than a functioning protective system. And if there is no coordinating body to steer implementation, each ministry will pursue its own interpretation — and DEFA's potential will be fragmented as surely as the institutions implementing it.
Timor-Leste's challenge is not primarily a digital infrastructure challenge. The submarine cable has landed. Connectivity is improving. The challenge is an institutional governance challenge: the country lacks the coordinating body that can turn the commitment to sign DEFA into a programme of action, and the programme of action into real economic benefits for real Timorese. That body must be created now, with political authority, a clear mandate, a secretariat, and the participation of both public institutions and the private sector. Nothing else will do.
Why a Council, Not a Committee
The distinction matters. Timor-Leste has committees. It has inter-ministerial working groups. It has task forces. What it does not have — and what DEFA demands — is a standing, high-level, politically-anchored body that is permanently responsible for the digital economy as a whole, not as a subset of any single ministry's mandate.
A committee is typically convened to address a specific task and dissolved when that task is complete. An inter-ministerial working group is typically staffed by mid-level officials with no authority to bind their institutions and no direct line to political leadership. A task force is temporary by definition. All of these forms share a common weakness: they are peripheral to the institutions they are meant to coordinate. Their recommendations are advisory. Their authority is derivative.
A Council, as proposed here, is different in three critical ways. First, it must be constituted at political level — chaired by a minister or the President of the Council of Ministers, with members who are senior officials empowered to make commitments on behalf of their institutions. Second, it must have a permanent secretariat — a small, dedicated professional body that carries institutional memory, manages the work programme, and maintains the knowledge base regardless of ministerial reshuffles or personnel changes. Third, it must have a defined mandate that includes both policy coordination and accountability — so that when the Council identifies a legislative gap, there is a mechanism to assign responsibility for closing it and a timeline for reporting back.
These are not excessive demands. Comparable councils have been established by countries of similar or smaller size. Brunei's Digital Economy Council, chaired by the Sultan, gave digital economy reform a political weight that nothing else could have provided. Singapore's Smart Nation initiative, though on a different scale, demonstrated that a dedicated coordinating mandate at the highest political level accelerates implementation faster than any amount of technical capacity-building. Even Fiji, a Pacific Island nation closer to Timor-Leste's development context, has established an ICT Steering Committee with cross-sectoral representation that has materially improved its engagement with regional digital frameworks.
The form matters less than the substance: a standing body, with genuine authority, that owns the digital economy agenda and is accountable for delivering results. Call it a Council, a Commission, an Authority — the name is secondary. The power and the permanence are not.
The Anatomy of the Council
Drawing on the specific gaps identified in this essay and in the companion analysis of DEFA's requirements, the following structure is proposed. This is a recommendation, not a prescription — the precise institutional design should emerge from a national consultation process. But the elements below represent the minimum viable configuration for the body to be effective.
Its Mandate and Its Teeth
A council without authority is an expensive meeting. The proposed National Digital Economy Council must have a mandate that is both comprehensive enough to be useful and specific enough to be accountable. Four dimensions of that mandate are essential.
Strategic Direction, Not Just Coordination
The Council must be empowered to set national digital economy strategy — to decide, at a whole-of-government level, what Timor-Leste's digital priorities are, how resources should be allocated across competing institutional needs, and what the sequencing of legislative and regulatory reform should be. This is different from the coordination role that inter-ministerial working groups typically perform. Strategy requires the authority to say "this comes first" and to have that judgment respected by all member institutions. Without that authority, the Council becomes a forum for sharing information rather than a body that drives outcomes.
Legislative Accountability
One of the Council's most critical functions is to own the legislative gap between Timor-Leste's current legal framework and DEFA's requirements. This means: commissioning the gap assessment, assigning drafting responsibility to the appropriate ministry, setting deadlines, tracking progress, and escalating to political leadership when timelines are at risk. The Ministry of Justice cannot close these gaps alone; neither can MCI. The Council is the body that coordinates across both, and across Finance (for budget implications), and across Parliament (for legislative scheduling). Without formal responsibility for this pipeline, no institution currently owns it — and ownership matters.
Private Sector as a Co-Owner, Not a Bystander
DEFA will be implemented not by government alone but by telecommunications operators, payment service providers, e-commerce platforms, and digital service businesses. These entities have operational knowledge that government cannot replicate — they know where the payment interoperability problems actually are, what the real barriers to digital trade facilitation look like from a business perspective, and what connectivity infrastructure is actually available beyond Dili. The Council must include the private sector not as a courtesy, but as a co-author of the national digital economy strategy. This means structured, formal consultation mechanisms — not ad hoc meetings when a specific problem arises — and it means the private sector having a clear channel to raise issues that the Council is obligated to consider.
Accountability to the Public and to Parliament
The people who stand to gain most from DEFA's implementation — or to suffer most from its inadequate implementation — are not in the conference rooms where negotiations happen. They are in Ermera, in Oecusse, in the sucos of Manufahi and Aileu. They are the coffee farmers who might sell to regional markets, the small merchants who might accept digital payments, the women who might access health consultations without a wasted journey. The Council must be accountable to this public through Parliament. An annual report to the National Parliament, open to public scrutiny, would establish a line of accountability that connects the technical work of digital economy governance to the constitutional obligations the state owes its people.
Eight Actions for Eight Months
The following recommendations are sequenced by urgency. The first three must be taken before the end of April 2026 — they are the prerequisites for everything else. The remaining five are the work programme that the Council, once established, must drive through to November and beyond.
-
Immediate — April 2026 Establish the National Digital Economy Council by Government Decree A government decree constituting the Council, defining its membership, mandate, and secretariat is the single most important action Timor-Leste can take for its digital economy future. This does not require new legislation — a Council of Ministers decree is sufficient to establish it. It requires political will. The decree should specify the chairperson, the permanent members, the quorum requirements, the meeting frequency (at minimum quarterly, with monthly secretariat meetings), and the obligation to produce an annual public report.
-
Immediate — April 2026 Constitute the DEFA Negotiating Committee as a Sub-Body of the Council The Council's first formal act should be to constitute Timor-Leste's DEFA Negotiating Committee as a structured sub-body with a dedicated secretariat, technical experts drawn from member institutions, and legal counsel. This Committee must have the authority to develop national positions on each DEFA chapter, to attend ASEAN technical working group meetings, and to report back to the Council on progress. Its existence as a permanent sub-body — rather than an ad hoc delegation — ensures institutional continuity across negotiating rounds.
-
Immediate — May 2026 Commission and Complete a National DEFA Legislative Gap Assessment The Council's secretariat, working with the Ministry of Justice and the relevant line ministries, should produce within sixty days a comprehensive assessment of the legislative and regulatory changes required for DEFA compliance. This assessment should map each DEFA chapter to its domestic legal implications, identify which changes require Parliamentary legislation (long lead times) versus ministerial regulation (shorter timelines), and produce a sequenced action plan with owners, milestones, and escalation triggers. This assessment is the foundation of everything that follows.
-
Priority — June 2026 Draft and Submit a Personal Data Protection Bill to Parliament Among all the legislative gaps, data protection is the most time-critical and the most consequential. Without it, Timor-Leste cannot credibly commit to DEFA's Chapter 8; cannot attract digital investment that requires data governance assurance; and cannot legally protect its citizens' personal information in the digital systems it is building. The bill should establish a Data Protection Authority housed within or reporting to the Council, adopt the ASEAN Data Management Framework principles, and provide a legal basis for cross-border data transfers. Parliamentary committees should be briefed early to build the understanding needed for informed deliberation.
-
Priority — June 2026 Establish a National Cybersecurity Function Under ANC Timor-Leste needs a Computer Emergency Response Team and a national cybersecurity strategy before DEFA signing. ANC is the natural home for this function given its existing telecommunications regulatory mandate. The Council should direct ANC to develop a national cybersecurity strategy document, establish a CERT with initial staffing, and engage ASEAN's CERT cooperation mechanisms. This can be done within the existing ANC mandate via ministerial direction — it does not require new legislation, though enabling legislation should follow.
-
Short-term — July 2026 Direct BCTL to Mandate Mobile Payment Interoperability The Council should formally task BCTL with a specific, time-bound mandate: to develop and publish a national mobile payment interoperability standard and a timeline for MOSAN and T-Pay compliance. The fragmentation between these two platforms is not a market problem that will resolve itself — it is a regulatory gap. BCTL has the authority to close it. The Council provides the political backing for BCTL to act, and the accountability framework to ensure it does so on a timeline compatible with DEFA's electronic payments chapter.
-
Short-term — August 2026 Initiate a National Digital Identity Programme A national digital identity framework is simultaneously a DEFA requirement, a prerequisite for digital health record systems, a foundation for e-government services, and a precondition for financial inclusion for the unbanked. The Council should establish a Digital Identity Working Group that includes DNIC, TIC Timor, the Civil Registry, and BCTL, with ADB technical assistance, to develop a phased national digital ID roadmap. The first phase — a digital civil registry capable of generating authenticated digital identities — should be achievable within the DEFA implementation timeline.
-
Structural — Ongoing Formalise Private Sector and Civil Society Consultation as a Permanent Council Function The telecommunications operators who were not in the room on 2–3 March 2026 must be brought into the national digital economy conversation permanently. The Council should establish a structured private sector advisory mechanism — meeting at least semi-annually, with formal written input to Council deliberations, and a published record of how that input was considered. The same applies to civil society voices representing digital consumers, women's economic participation in digital markets, and rural communities whose connectivity and access needs are systematically different from urban ones.
Answering the Objections
Any proposal for a new institutional body in a small, resource-constrained state will face objections. They deserve serious answers, not dismissal.
"We don't have the capacity to staff a new secretariat."
This objection is real but inverted. Timor-Leste does not have the capacity to manage DEFA implementation without a secretariat either — the difference is that without a secretariat, the work gets done badly and invisibly, spread across ministries as an unfunded mandate on already-stretched officials. The Council's secretariat does not need to be large. Three to five dedicated professionals — a director, legal counsel, a technical specialist, an administrative officer — can anchor the function. External technical assistance from ADB, the EU PADIT-TL programme, and ASEAN dialogue partners can supplement domestic capacity at modest cost. This is one of the most fundable institutional investments Timor-Leste could propose to development partners, precisely because DEFA compliance is a concrete, measurable objective.
"Creating a Council risks bureaucratic duplication."
The risk runs in the opposite direction. The current structure — multiple agencies with overlapping digital mandates and no coordination mechanism — is the source of duplication, inconsistency, and wasted effort. A Council does not replace any existing institution; it provides the table at which they all sit and agree. If anything, a Council reduces duplication by preventing each agency from pursuing digital economy initiatives in isolation, without knowledge of what adjacent agencies are doing.
"November 2026 is too soon — DEFA implementation is a long-term project."
True, and critically important. DEFA implementation will span years. But the decision about what kind of country Timor-Leste will be when implementation begins is made now, in the negotiating positions it takes, in the legislative groundwork it lays, and in the institutional capacity it builds. A country that signs DEFA with nothing in place will spend its implementation years catching up. A country that has its institutional house in order when the ink is dry will spend those years building. The Council is an investment in the second path.
"This is a government matter — the private sector should not be at the table."
This objection fundamentally misunderstands what DEFA is. DEFA is not a treaty between governments about government activities. It is a framework for the regulation of private-sector digital economic activity — how businesses make payments, how platforms handle data, how consumers are protected online, how digital services cross borders. If the entities who actually conduct digital economic activity are not part of the national conversation about the rules governing that activity, those rules will be poorly designed, poorly understood, and poorly complied with. The private sector's presence at the Council table is not a favour to business. It is a precondition for effective governance.
Conclusion: The Cost of Waiting
I began this essay in a conference room in Dili. I end it with the same image — but seen differently. Around that table sat some of the most capable and committed public servants in one of the world's youngest nations. They asked good questions. They engaged seriously with complex material. They understood, I believe, the stakes.
What they could not do, individually, was what no individual can do: hold the full picture together, assign responsibility across the institutions represented in the room and those absent from it, ensure that the knowledge gained in those two days does not dissolve when they return to offices where the daily urgencies of their primary mandates crowd out the long-term imperatives of digital economy reform. That requires a structure. A home. An institutional identity for Timor-Leste's digital future that is not dependent on the continued presence of any particular individual.
The irony I noted at the start — that I, representing a health products regulatory agency, was in a workshop about digital economy governance — is not actually an irony at all. It is an illustration of the cross-cutting nature of the digital economy: it touches health data, pharmaceutical supply chains, telemedicine regulation, laboratory result transmission, patient identity. It touches the DNIC's networks, the BCTL's payments infrastructure, the ANC's spectrum policy, the Ministry of Commerce's trade commitments, the Ministry of Justice's legislative agenda. It touches, ultimately, the constitutional promise — anchored in Section 57 of Timor-Leste's constitution and running through every essay in this series — that every Timorese, whether in Bidau Tokobaru or in the aldeias of Vatuvou, has the right to the conditions of a dignified life.
The digital economy is not a technical luxury. It is increasingly the infrastructure through which economic rights, health rights, and educational rights are delivered. A country that cannot govern its digital economy coherently cannot deliver on those rights equitably. The National Digital Economy Council is, at its foundation, a constitutional necessity — not merely a policy convenience.
The Argument in Summary
Timor-Leste has eight months before it is expected to sign the most consequential digital economy agreement in ASEAN's history. It has significant legislative gaps, fragmented institutional governance, and no coordinating body with the authority and mandate to address either. Individual institutions are doing their best — and their best is genuinely commendable. But individual institutions cannot substitute for a whole-of-government, whole-of-economy strategy anchored in a Council with political authority, a permanent secretariat, private sector participation, and public accountability.
The cost of creating this Council is modest: a decree, a small secretariat, and the political will to chair it seriously. The cost of not creating it is measured in: a DEFA signature without implementation capacity; legislative gaps that persist for years; a digital economy that delivers its benefits to Dili and its risks to everyone else; and the continued absence of Timor-Leste as a coherent voice in the regional digital architecture that is being built with or without us.
Eight months is not much time. But it is enough — if we start today.