M. Krishnamoorthy
A media coach, adjunct professor and author
Malaysians are caught in a Catch-22 situation. The question is, Do or don’t register with PADU?
“Don't register with PADU as it is highly security-flawed, easily hacked, and all private info stolen. It is too risky as detailed info such as IC, Selfie, etc. IF stolen and linked with Finger print, National Registration/ Immigration Department, all your assets gone, bank money withdrawn, passports barred and banks accounts frozen within seconds...”
This is viral SMS that is being circulated. It continues: “Padu registration should be suspended until the security flaws are fixed, says Ong Kian Ming, said former deputy investment, trade and industry minister.
In February last year, it was reported that the personal information of millions of MySejahtera users had been exposed after an account authorised for vaccine administration stole data from three million vaccine recipients, revealed a national audit.
The Auditor-General’s 2021 report tabled in Parliament revealed that a “Super Admin” account under the MyVAS system, which is used at vaccination centres to record and issue Covid-19 vaccination certificates, had downloaded the personal information of three million vaccine recipients from the MySejahtera app.
Ong wrote: “I take no joy in writing this statement. I wanted the Central Database Hub (Padu) to be successfully launched because this database's intended purpose was to roll out more targeted subsidies, including the withdrawal of the non-targeted petrol subsidy to be placed by a targeted subsidy mechanism. Sadly, the Padu database, as it stands, will not be useful in achieving this objective.
“Firstly, those currently receiving government aid, such as Bantuan Tunai Rahmah, but are not eligible to because they have other non-taxed income, such as rental income from houses and land they own, will not fill in the accurate information in Padu.
“Secondly, some users, including myself, are wondering why so many of these columns are not filled, given that Padu is supposed to have consolidated data from several ministries and agencies, including the Inland Revenue Board, the Employees Provident Fund, the Social Security Organisation, the National Registration Department and the Implementation Coordination Unit, just to name a few. “
Minister of Economy Mohd Rafizi Ramil’s reply via X (formerly known as Twitter) was that this information was not displayed because of security concerns over possible hacking into Padu’s servers.
“But if some of this information is already available via government ministries and agencies, why does Padu need the user to fill out this information? What if the information supplied is not the same as in Padu’s database? How does Padu verify the other information supplied by the user, such as rental income from land or property? With so many additional fields to fill in, many users would choose the option of not filling up these fields, or to fill them up with inaccurate information, so that they remain eligible to receive government subsidies!,” Ong questioned.
“Thirdly, there is a major security issue with the registration of Padu whereby if you have the IC number and the postcode associated with the IC address of a user, you can register for the Padu account for that person, without having to go through the electronic know-your-customer (e-KYC) process.”
Ong added: “I did this with the IC address and postcode of four of my DAP colleagues who are ministers or deputy ministers, namely Hannah Yeoh Tseow Suan, Steven Sim Chee Keong, Liew Chin Tong and Teo Nie Ching. I was also able to change some of the details of Yeoh's academic qualifications and occupation, without having to go through e-KYC verification.
“Where does this leave us? I would strongly recommend that the Cabinet collectively suspend the registration of Padu users until the security issues can be solved.”
He proposed that the system be properly stress-tested before it is rolled out again. Users who have registered but have not undergone e-KYC verification should be asked to register again after the security issues have been resolved. The number of fields of information should be decreased.
“Once the security features are in place, the information which can be pulled from other agencies and ministries should be pre-filled as much as possible. The user should have a mechanism where he or she can make a report if the information provided is not accurate.
“Information technology and cybersecurity experts should be called in to provide value-added inputs, which can be used to improve the design of the Padu system. I hope that my former colleagues in the Cabinet will not see this as a move to undermine their governing objectives. In highlighting these flaws in the Padu system, I hope they can be quickly rectified before the next parliamentary sitting so that the opposition parties in Perikatan Nasional will not have the opportunity to make this into a point of political debate.
“I wish for the Madani government under Prime Minister Datuk Seri Anwar Ibrahim to succeed, and I hope that my actions in revealing the gaps in the Padu registration system will be understood as such,” Ong concluded his statement.
Freelance Writer M. Krishnamoorthy (www.imkrishna.net) is a media coach, adjunct professor and undercover journalist. He has freelanced with Bernama, NST, The Star, and Malaysiakini. He also freelances as a fixer/coordinator for CNN, BBC, German and Australian Television networks and the New York Times. As an undercover journalist, he has highlighted society's concerns.
M. Krishnamoorthy is a content creator under the Newswav Creator programme, where you get to express yourself, be a citizen journalist, and at the same time monetize your content & reach millions of users on Newswav. Log in to creator.newswav.com and become a Newswav Creator now!
The User Content (as defined on Newswav Terms of Use) above including the views expressed and media (pictures, videos, citations etc) were submitted & posted by the author. Newswav is solely an aggregation platform that hosts the User Content. If you have any questions about the content, copyright or other issues of the work, please contact Newswav.
