Despite the lofty position of ASA Philippines being considered the gold standard in the micro-financing industry because of Bangladeshi small business lending advocate Kamrul Tarafder, trouble had started to rock its foundation.
In March 2023, disputes started over a conflict-of-interest allegation against Kamrul.
Several individuals on the ASA board began to show hostility, and sometime in December 2022, Kamrul disclosed to Richard Dee, the son of then chairperson Howard Dee, that Simon, Kamrul’s son, had invested in a separate microfinance institution.
Kamrul said the disclosure was made in the spirit of good faith and good governance.
He related that the revelation did not sit well with the Assisi/Aquino group, and Kamrul was accused of violating the conflict-of-interest regulation of the ASA Foundation as the group was seen as a potential competitor to the planned foundation.
Several board discussions ensued with Kamrul eventually asking Simon to withdraw all his interests from the microfinance venture and a commitment that his family will not engage in any future investments in another microfinance institution.
Despite the action, Kamrul was asked to sign a non-disclosure agreement (NDA) and a non-competition agreement that imposed restrictions on his freedom to teach and share his knowledge about microfinancing to individuals outside the foundation.
Kamrul, thus, declined to sign the documents.
In August 2023, Ambassador Howard Dee stepped down as chairperson and former ambassador to the US Jose Cuisia Jr. was appointed the new chairperson.
Despite the conflict-of-interest having been resolved, Kamrul alleged that the board led by Cuisia limited his authority as president and CEO and instituted several changes in the board.
His authority was taken from him and given to other trustees and other board committees.
The corporate secretary was replaced by Atty. Ronald Policarpio of Romulo Mabanta Law.
A new treasurer was likewise appointed. New committees were established, including the Information Technology Committee where Eric Gotuaco was appointed chairperson.
Kamrul said the board started communicating directly with the management staff.
Where it used to invite external stakeholders to attend board meetings, the board started to limit the attendees and stopped inviting external stakeholders.
Even after benefiting from the Information Technology (IT) System introduced and provided by Simon’s corporation, Jyosna, to the ASA Foundation, the board led by Richard Dee and Eric Gotuaco started to question the contract raising again concerns of conflict of interest.
The issue of conflict of interest against Kamrul resurfaced with Cuisia asking for proof that Kamrul’s family had divested their interest from their supposed microfinance venture.
PDEA steps in
On 18 October 2023, two individuals representing themselves as Philippine Drug Enforcement Agency (PDEA) agents visited the condominium building of Kamrul and Simon asking questions about them, the cars they used, the time they usually left and arrived home, and other movements.
Thereafter, on 21 October 2023, Simon’s IT firm, Jyosna, fell victim to a cyber attack with a ransom demand. The cyber attack was focused solely on the software licensed by one of its many clients, the ASA Foundation.
Jyosna at the time had just completed uploading the superior version of the ATMOS software platform meant to cater to the pressing regulatory requirements of the ASA Foundation.
While the technical implementation of the changes was successful, certain individuals inside ASA, led by Eric Gotuaco and Richard Dee were against the same as they were creating their program/software intended to replace Jyosna’s software.
Gotuaco and Dee were incumbent trustees of ASA but not directly connected to ASA’s IT governance or operations.
Incidentally, on 3 November 2023, ASA’s Board resolved to create an IT Committee and Gotuaco became its chairman.
Subsequently, Jyosna began receiving disparaging comments clearly intended to discredit its software and solution.
It is worth noting that while these ASA individuals showed their discontent towards ASA, their IT Operations Head felt otherwise and was confident about Jyosna’s capability.
Several days later, Jyosna detected an anomalous unauthorized entry into its network.
Countermeasures were immediately implemented to remediate and prevent further hacking while the investigation found evidence of exfiltration of information from about 35 ASA clients only out of several million.
Relative to the hacking incident, Jyosna received messages from the threat actors who identified themselves as the Medusa Group through a message left in one of the hacked user accounts and through email communication from the sender, medusa.ru@protonmail.com.
The email was sent to Jyosna and top executives of ASA Foundation including Gotuaco, with the exception of Kamrul who was the incumbent president and CEO of ASA Foundation then.
Kamrul indicated that it was curious to note that Mr. Gotuaco received the email communication from Medusa through his email, which was nowhere visible in the entire IT system of both Jyosna and ASA Foundation.
(To be continued)