Appointment of MySejahtera developer did not follow procedure, says PAC

The appointment of KPISoft as the developer of the MySejahtera application was not in accordance with the procedures for government procurement, a report by the Public Accounts Committee (PAC) shows.

PAC chairman Wong Kah Woh said the committee had found no minutes or supporting documents other than the non-disclosure agreement between the National Security Council (MKN) and KPISoft, now known as Entomo.

"The CSR concept proposed by KPISoft (Entomo) caused uncertainty about the true direction of the acquisition of MySejahtera," he said in a statement today. 

"The government was confused about the appointment of KPISoft, the CSR concept, and its duration as well as the ownership of the MySejahtera application.

"The CSR concept was apparently used as a mechanism to obtain government projects without undergoing the proper procurement procedures." 

The MySejahtera application was developed following the onset of Covid-19 in Malaysia. It was used, among others, for contact tracing, monitoring the health status of Covid-19 patients, location check-ins, and the storing of vaccination records and certificates.  

A total of two proceedings on the issue were held on April 14 and 21 this year, with eight witnesses called up including Health Minister Khairy Jamaluddin, Finance Minister Tengku Zafrul Aziz, and treasury secretary-general Asri Hamidon.

PAC also found that the ceiling price of RM196 million set for a period of two years for the acquisition of MySejahtera was high and contradicted the concept of CSR. 

The report has revealed contradictions in statements by the government regarding the ownership of the application. 

Khairy previously said that the data in the application was the full and absolute property of the government. 

But Wong said that KPISoft (Entomo) had acknowledged itself as the owner of the application's intellectual property.

"The Cabinet's decision referring to the government taking over the ownership of MySejahtera from the application developer shows that the application was, in principle, still owned by the developer," he said. 

"As of April 2022, the government had yet to register the intellectual property for MySejahtera on MyIPO, which could see the ownership of the application claimed by its developer."

Other issues had also previously arisen regarding the use of the application, including the alleged leak of user data to external parties. 

PAC submitted four recommendations, including for a review of the decision to award the contract for MySejahtera through direct negotiation. 

It also urged the government to take over the entire application through the Malaysian Administrative Modernisation and Management Planning Unit.

"The government needs to take a more prudent approach in all procurement processes. All offers through CSR are welcome. However, the terms of CSR offers should be clearly stated and should not be used as an alternative way for direct negotiations," it said. 

"It should ensure full government ownership of the MySejahtera application, and guarantee the security of users' personal data in the application in addition to ensuring that the data is not misused."