Development of a Sensitive-Data Monitoring System for Witness and Victim Protection: Role-Based Security Integration and Usability Evaluation

Abstract

Data on applications, case reviews, and protection services for witnesses and victims at the Medan Representative Office of the Witness and Victim Protection Agency (LPSK) had previously been managed through a legacy application built without a modern framework, which constrained data-handling efficiency, feature coverage, and the security controls required for information tied directly to personal safety. Existing literature widely discusses public-service monitoring in general terms but rarely demonstrates concrete, tested technical safeguards for highly sensitive data such as the identities of protected individuals. This study develops a web-based monitoring platform on the Laravel framework that consolidates the application, review, service, and financial workflows into a single system, protected by layered security consisting of Role-Based Access Control (RBAC), role-based data masking, Bcrypt password hashing, CSRF protection, rate limiting, UUID-based routing, and audit trails. A Research and Development (R&D) approach following the 4D model (Define, Design, Develop, Disseminate) was used. Black-box functional testing across 35 scenarios and security testing across 10 scenarios each achieved a 100% success rate, while a User Acceptance Test with 5 respondents at LPSK Medan produced a mean System Usability Scale (SUS) score of 93.6 (Grade A, Excellent). The principal contribution of this work is the integrated combination of RBAC, role-based data masking, and audit trails, implemented and empirically validated within a highly sensitive government information system. System scalability was not verified through load testing, and the security evaluation did not include independent penetration testing, both of which remain limitations and directions for future work.