THE Land Transportation Office (LTO) is moving to blacklist German technology firm Dermalog Identification Systems GmbH over alleged contractual violations in its P3.19-billion Land Transportation Management System (LTMS) project, citing the company's failure to deliver a fully functional system despite multiple contract extensions.
According to LTO Executive Director Martin Ontog, the agency has started the blacklisting process after Dermalog allegedly failed to complete the LTMS before its contract expired, despite receiving 13 contract extensions.
Ontog said the LTMS remains unfinished more than 900 days after its original target completion date and still cannot process a single public utility vehicle (PUV) transaction or automatically collect penalties for newly registered vehicles, among other critical functions.
He added that the Commission on Audit (COA) has flagged deficiencies in the LTMS for four consecutive years.
Ontog also disclosed that Dermalog's maintenance contract expired on May 13, leaving the LTMS without software patching, active monitoring, and incident response, exposing the system to potential crashes, slowdowns, and cybersecurity threats.
He said Dermalog has repeatedly refused to turn over the LTMS source code, encryption keys, administrative access, and the complete database of vehicle registrations and driver's licenses despite formal demands from the LTO.
"Because Dermalog continues to withhold source code, encryption keys, and full administrative and database access, including the transfer of LTO's complete database of vehicle registrations and driver's licenses, the LTO is effectively blind in operating, maintaining and, most critically, securing the LTMS. We cannot secure a system we do not control," Ontog said.
The issue was raised during the latest hearing of the House Committee on Transportation, where lawmakers warned that Dermalog's continued control of the system could expose the personal data of around 10 million motorists.
Las Piñas City Rep. Mark Anthony Santos has warned that the company could leak the personal information of about 10 million motorists after he received unsolicited text messages regarding alleged traffic violations.
The Office of the Solicitor General (OSG) earlier asked the Supreme Court to compel Dermalog to surrender the LTMS source code and expedite action on a petition filed by concerned citizens seeking to nullify the LTMS contract.
Assistant Solicitor General James Lee Cundangan said the OSG considers the matter one of national importance because the source code is the "heart" of the system and contains critical information on millions of Filipino motorists.
Pending the Supreme Court's ruling, Ontog said the LTO will continue operating both the LTMS and the Stradcom-developed LTO-IT System to ensure uninterrupted public services despite an earlier Ombudsman directive ordering the agency to stop using the older platform.
He said the continued use of the LTO-IT System is supported by existing legal agreements and government approvals.
"Public service has to come before a directive we cannot comply with as written. The LTO-IT System is not an improvised workaround. It rests on the 1997 and 1998 NEDA approvals of the BOO arrangement, DOJ Opinion No. 7, series of 2018, and the Phaseout Agreement of December 2016 — a legal foundation spanning multiple government agencies, not a unilateral LTO decision," Ontog said.
Ontog also recalled that LTO operations were severely disrupted on June 3 after the LTMS suffered a nationwide outage while the agency was complying with the Ombudsman's directive not to use the backup system, which forced personnel to send motorists home.
The outage was traced to the LTMS running out of storage capacity.
Ontog said five more outages followed, indicating that the failures had become a recurring operational problem rather than isolated incidents.
He also revealed that an internal LTO investigation found firewall logs showing repeated virtual private network (VPN) connection attempts and login activity from a "Dermalog" account on June 2, weeks after the company's maintenance contract had already expired.
The agency has since disabled the account as part of its cybersecurity measures.
