As the Land Transportation Office (LTO) awaits the decision of the Supreme Court on a petition filed by the Office of the Solicitor General to compel Dermalog to turn over the source code some 10 million motorists data leak is feared.

Earlier, the Office of the Solicitor General (OSG) has asked the Supreme Court (SC) to compel Dermalog to turn over the source code to the Land Transportation Office (LTO) and to expedite its resolution of a petition filed by concerned citizens seeking to nullify the Land Transportation Management System (LTMS) contract.

Assistant Solicitor General James Lee Cundangan said the OSG is particularly concerned that a foreign company controls the LTMS source code, which he described as the “heart” of the system containing critical information on millions of Filipino motorists.

Government lawyers in a 10-page motion, also urged the high tribunal to void the P3.19 billion 2018 contract and issue a temporary restraining order and stop the LTO from making further payments to Dermalog.

For its part, the LTO has told lawmakers that it is preparing to blacklist German technology firm Dermalog Identification Systems GmbH over alleged contractual violations in the multi-billion LTMS project, including its persistent failure to deliver a fully functioning system and the turnover of the source code before the contract expired.

LTO Executive Director Atty. Martin Ontog, during the recent House Committee on Transportation (COTr) hearing, said that the LTMS remains incomplete for over 900 days despite 13 contract extensions, leaving the system unable to process even a single public utility vehicle (PUV) transaction or automatically collect penalties on new vehicle registrations, among other limitations. 

He added that the Commission on Audit (COA) has repeatedly flagged the LTMS for numerous deficiencies for four consecutive years.

Ontog also revealed that Dermalog’s maintenance contract expired on 13 May without patching, active monitoring, and incident response, exposing the LTMS to crashes, slowdowns, and security risks. 

He added that Dermalog refused to turn over the LTMS source code despite repeated formal demands from the LTO, preventing the agency from gaining full control of the system.

Ontog said that due to the withholding of the source code, encryption keys, and full administrative and database access, including the transfer of LTO’s complete database of vehicle registrations and driver’s licenses, the LTO is blind in operating, maintaining, and critically securing the LTMS and they cannot secure a system that they don’t have control.

On the other hand, several lawmakers warned that a foreign entity’s continued control of the LTMS source code could pose national security and data security risks.

Las Piñas City Lone District Rep. Mark Anthony Santos feared that Dermalog could potentially leak the personal data of roughly 10 million motorists, citing unsolicited text messages he recently received regarding alleged traffic violations.

Aklan 1st District Rep. Jesus Marquez, meanwhile, questioned whether the LTMS database could be compromised under the current set-up after discovering that his birth information in the system appeared to have been altered.

He said that when he registered he remembered that his birth date was entered correctly but now, it appears 1 January 1920 which a big concern when he tried to change it.

Ontog though assured Marquez that the LTO can correct his birth information when he renews his driver’s license.

However, he also revealed that the LTO may have to rebuild its motorists’ database from scratch if Dermalog never turns over the source code.

Meanwhile, Ontog maintained that the LTO will continue the parallel operation of the LTMS and the Stradcom-developed LTO-IT System while awaiting the SC resolution to ensure uninterrupted public services, despite the Office of the Ombudsman’s earlier order directing the LTO to cease using the Stradcom-developed LTO-IT System.

He argued that the use of the LTO-IT System is not an improvised workaround but is anchored on valid contracts and legal grounds.

“Public service has to come before a directive we cannot comply with as written. The LTO-IT System is not an improvised workaround. It rests on the 1997 and 1998 NEDA approvals of the BOO arrangement, DOJ Opinion No. 7, series of 2018, and the Phaseout Agreement of December 2016 – a legal foundation spanning multiple government agencies, not a unilateral LTO decision,” Ontog said.

Ontog said LTO operations were severely disrupted when the LTMS suffered a nationwide outage on 3 June, forcing personnel to send motorists home after the agency complied with the Ombudsman’s order to refrain from using a back-up system.

The investigation found that the outages occurred after the LTMS’s storage was fully utilized. 

The system subsequently suffered five more outages, which Ontog dismissed as occasional disruptions but have become the system’s operating condition.