The revelation by the Public Accounts Committee (PAC) that the MySejahtera app was developed without a contract between the government and the private company who created it, and that it had been approved for sale through direct negotiations to another company is damning, further highlighting the lack of transparency in Malaysia’s business-political nexus.
The Center to Combat Corruption and Cronyism (C4 Center) calls upon the government to provide satisfactory clarifications for these issues immediately, as well as investigations into the clandestine processes that resulted in the app’s acquisition.
MySejahtera was developed by KPISoft Sdn Bhd – now Entomo Sdn Bhd – at the start of the Covid pandemic in March 2020.
The app is a cornerstone of the government’s management of the pandemic, with contact tracing and vaccination appointment-making as its primary functions and contains the personal data of over 38 million registered users including full names, identity card numbers, phone numbers, location history, vaccination status, and Covid infection status.
The MySejahtera app is not without its share of controversies; complaints regarding its performance and unreliability are common, and questions over its security have been raised, especially in October 2021, when an exploit allowed people to send out emails or one-time passwords (OTPs) on behalf of the application.
A cabinet meeting had decided in November 2021 to appoint MySJ Sdn Bhd to take over the operations of MySejahtera from KPISoft, who had apparently developed the app without receiving any payment as part of its corporate social responsibility initiatives.
The acquisition of a government-mandated public service with access to personal data of citizens by a private entity is in itself concerning, but more so that this appointment was not made through an open tender process, hence the selection criteria remain opaque and shielded from scrutiny.
However, documents obtained on MySJ’s management and ownership further reveal a system fraught with questionable appointments; two of KPISoft’s founders, Anuar Rozhan and Raveenderan Ramamoothie, are directors in MySJ, with the latter also being a shareholder through another company as well.
While the details on the acquisition of MySejahtera are yet to be made clear, this undertaking could potentially lead to the self-enrichment of the individuals who initially decided that the development of the app would be a not-for-profit undertaking.
Further muddying the waters are the appointments of MySJ’s other directors who have ties to big business, including Eco World Development Group Bhd executive chairman Liew Kee Sin and executive director and chief financial officer Heah Kok Boon, Sapura Energy Bhd founder and former chief executive officer Shahril Shamsuddin, and Sime Darby Plantation Bhd non-executive chairman Megat Najmuddin Megat Khas. Megat also happens to be the chairman of Bersatu’s disciplinary board.
It is alarming that a handful of individuals tied to private corporations have seemingly now been handed control over what is essentially a public healthcare service without the knowledge of the public it is meant to serve, and more so alarming that one of the individuals profiteering off this development is a political figure. This inevitably raises the question as to whether Megat has used his influence as a prominent figure to secure his position as director within MySJ Sdn Bhd.
Health Minister Khairy Jamaluddin has since addressed some of these concerns, stating on 27 March that the app was not being sold to any private entities and that it remains under the sole ownership of the government, with the Ministry of Health being the main stakeholder and ensuring the secrecy of personal data.
He further clarified on 28 March that the government was not involved in any negotiations between Entomo Malaysia (formerly KPISoft Sdn Bhd) and MySJ Sdn Bhd for the latter’s acquisition of app’s intellectual property and software license to be sold for RM338.6m, stating that the agreed amount would be “much lower”.
What was notably left out of Khairy’s explanation was the extent to which MySJ Sdn Bhd would exert control over the operations of and personal data obtained by the MySejahtera app, and the process by which MySJ was selected to procure the application despite the presence of a political figure on the board of directors.
Khairy’s assurance that the app remains under the control of the Ministry of Health is contradictory to the fact that its operations will be taken over by a private entity.
C4 Center once again reiterates the demand for an explanation of the concerns raised above, as well as an assurance that future proceedings with regard to procurement live up to the standards of transparency and accountability as expected of a public institution.
C4 Center therefore calls upon:
- Parliament to convene a special parliamentary session for Health Minister Khairy to provide a full and satisfactory explanation and for MPs to debate what actionable next steps can be taken to provide redress to this issue
- The Malaysian Anti-Corruption Commission to investigate and uncover any possible corruption and breach of law that led to this decision by cabinet ministers
Ultimately, the issues that must be resolved are:
- Why has the government decided to privatise a mandated public health service?
- What were the selection criteria for the procurement of MySejahtera, and why was it not made public through an open tender?
- Why was MySJ Sdn Bhd selected despite a known political figure sitting on the board of directors that should have immediately raised conflict-of-interest concerns?
- How is the Ministry of Health going to ensure that the personal data of millions of Malaysians will be protected?
The Covid pandemic has irreversibly changed the lives of all Malaysians and laid bare the weaknesses of the healthcare system – the lives of people must not be gambled for the sake of individual self-interest. – C4 Center