Ex-DFA chief Yasay suspects deflection in passport mess; Locsin denies he is 'misinformed'
MANILA - (2ND UPDATE) Former Foreign Affairs Secretary Perfecto Yasay Jr on Monday said he does not believe a contractor stole the data from his former agency in its passport renewal system.
Yasay, who headed the Department of Foreign Affairs from June 2016 to March 2017, said the current top diplomat, Teodoro Locsin Jr, was "misinformed" in his statement that the contractor "ran away and the DFA couldn't do anything about it because the DFA was wrong," as relayed to him by certain officials.
"The only reason, compelling reason I can see is because they wanted to deflect the real issue of the passport mess, which is awarding, the production of the passport from an end-to-end basis," he told ANC's Headstart, pertaining to the officials who relayed the information to Locsin.
The production and personalization of machine readable electronic passports (MREPs) was subcontracted to French firm Francois-Charles Oberthur Fiduciare in 2006 with the recommendation of the Bangko Sentral ng Pilipinas, Yasay said. The system was put in place in 2009, and data was kept in the BSP facility with back-up in the DFA main office.
Oberthur continued to assist the Philippine government for free until 2014, when under then-Secretary Albert Del Rosario, the DFA issued a purchase order contract in favor of APO Production Unit Inc, he said.
APO, a company under the Presidential Communications Office, then tapped United Graphic Expression Corporation (UGEC) for the production of the new e-passports "without bidding," and they assisted the government in the operation and management of the system for a fee, said Yasay.
This subcontracting to UGEC was “in violation of the law” and was "anomalous" because the contract with APO stipulated that it could not subcontract any part of the process without bidding, he said.
When APO and UGEC entered the picture, Oberthur "withdrew" its assistance, so it is "completely false and malicious" to say the French company ran away with the data, he said.
The data initially kept in the BSP and DFA offices were “moved out” and presumably brought to the APO-UGEC facility in Lipa, Batangas, he added.
Yasay said he was tipped off even before he assumed the DFA post about the issues surrounding the passport issue, and he immediately told President Rodrigo Duterte about it on their first Cabinet meeting.
It was in this meeting that he received marching orders from the chief executive that there should be no more lines when applying for passports. It came to him then that if he cancels the contract with APO, "the greater good will be compromised."
"If I cancel, I will be complicating the entire thing. So I said, under the contract we have with APO, I cannot hold UGEC for any breach or screw-up in the processing of these passports, so I want this amended," he said in the interview.
'POWERFUL MEMBERS OF CONGRESS'
The contract with UGEC "was never sustained," but it still exists because "some powerful members of Congress intervened, powerful members who are also members of the Commission on Appointments, and said there was nothing wrong with the contract," said Yasay.
In a Facebook post, Yasay said President Rodrigo Duterte ordered him and Finance Secretary Carlos Dominguez to discuss with the Bangko Sentral ng Pilipinas the transfer back to the latter "the printing of the MREPs" but the BSP refused.
On February 10, 2017, Chief Presidential Legal Counsel Salvador Panelo found that the assignment of the passport printing services to UGEC was "illegal and demanded that all rights over all the personal data, source code, data center and other information relating to the performance of the E-passport printing services unlawfully subcontracted to UGEC be reconveyed to the DFA or be acknowledged to be exclusively owned and controlled by the DFA," Yasay wrote.
"Upon information and belief, it appears that UGEC which continues the illegal production of the E-passports has not complied."
Locsin earlier this month said the DFA needs to "rebuild" its database for passports issued before 2010 because a "previous outsourced passport maker took all the data when contract terminated."
He said some Filipinos renewing their passports may have to present their birth certificates as an additional requirement after the incident.
PREDECESSORS PANICKING?
In a tweet, Locsin said while he loves Yasay, he does not agree that he was "misinformed" about the passport data mess.
He admitted, however, that he lacks information on "the anomalous DFA-BSP-Oberthur/APO passport contracts," which "demands deep investigation."
"My predecessors seem to be panicking. I don't know why. What do you think?" he said, urging his followers on the microblogging platform to send him their opinions.
He also questioned Yasay's statement that it was impossible for Oberthur to run away with the data.
"Then why is DFA frustrated it cannot access passport data so it won't have to impose birth certificate to reconstitute data lost, stolen or inaccessible," he noted.
"Stories changing. Sign of guilt. DFA told me even APO does not give direct access to DFA of its data bank. Panic time," he wrote.
In a statement, former foreign affairs secretary Albert Del Rosario said he has a "high measure of respect" for Locsin's judgement, so he will refuse to comment on his "early findings concerning the passport challenges."
WAS THERE REALLY A DATA BREACH?
For cybercrime lawyer JJ Disini, it could be that the problem Locsin was conveying in asking passport renewal applicants to also submit their birth certificates is that the data from Oberthur might have been in a particular format that might not be compatible with the system APO and UGEC uses.
"Perhaps, that’s what Sec. Locsin is struggling with: they have this data but it’s in this particular format that can’t use it and they cannot convert it in time and as a stop-gap measure, they need to start from scratch," he told ANC's Headstart in the same interview as Yasay.
"It’s faster for us to get the data from your birth certificate rather than having to convert it from this huge database that’s in a different format," he said.
Yasay said this scenario was "very likely" because "the data is there," and it was "impossible for Oberthur to run away with it."
"It would have been easy for the Bangko Sentral and the DFA to require Oberthur to assist in the transferring of that data to the system of APO-UGEC if Oberthur was going to be paid for it. But nobody wanted to pay Oberthur for it, and that’s probably it," he said.
Under the Data Privacy Act which has been in effect since 2017, the third party contractor has no right to use all of the personal information encoded into its system, which belong to those who hold the passport, he said.
The National Privacy Commission is looking into the issue because if the data of the Filipino people will be affected, "will not only be a violation of the law but might also attract criminal penalties for the contractor," he added.
Comments