It is true that Malaysians are wont to be cynical, untrusting of government and given to conspiracy theories.
But when inefficiencies like the government's planned procurement of the MySejahtera app come to light, a Malaysian's wildest imaginations cannot compete with the sad truth: The government doesn't even know how to draw up a contract.
That is the jaw-dropping revelation that has come from a parliamentary Public Accounts Committee (PAC) enquiry last week into Covid-19 vaccine procurement. The idea for some sort of Covid-19 contact-tracing app was born at the start of the pandemic in February or March 2020.
Though 11 proposals had been submitted, the mandate was given to KPISoft Malaysia Sdn Bhd (KPISoft) because the company offered to develop the software and manage it for free as a corporate social responsibility (CSR) project for one year. It is unknown what the government thought would happen one year later, but the short of it is that the government took up KPISoft's offer but didn't draw up a legally-binding agreement.
For the past two years, the government has been operating under the impression that it owns the MySejahtera app. But except for a non-disclosure agreement, there is nothing on paper that defines who owns what, who has the ultimate right over what. That works well to the software developer's advantage, but not to the government's. In May 2020, KPISoft changed entities and became Entomo Malaysia Sdn Bhd (Entomo).
In October 2020, Entomo leased the MySejahtera app's software licence and intellectual property rights to MySejahtera Malaysia Sdn Bhd (MySJ) for RM338.6 million for a period of five years and three months until the end of 2025. How could they have done that if the app is owned by the government? The government now finds itself having to buy or make a new deal for what it thought it already owned.
In November last year, the cabinet decided that the MySejahtera system ought to be transferred to MySJ, and based on this decision, the Finance Ministry approved for the Health Ministry to go into direct negotiation with MySJ, provided that the Health Ministry did its due diligence. A PAC check on MySJ's company profile and list of directors revealed the involvement of influential business figures with ties to the ruling party.
It is significant that the PAC chairman summarised the KPISoft deal as a "backdoor way" of getting a contract. A CSR project, bearing no cost to the government, bypasses the normal procurement process, which would have required an open tender, which then would have needed the Finance Ministry's approval.
It is fair enough that beyond the first year, the developer expects to be paid for services rendered, especially as the MySejahtera app's scope is far bigger than what it started out as. But how could the government have been so careless as to not have locked down ownership of it? How hard would it have been to draft a forward-thinking contract? The government claims that user data is safe and in the government's hands; but is that a fact or merely the government's understanding?
Two years on, MySejahtera now has 38 million registered users (residents and visitors) and racks up 30 million check-ins per day. All people in Malaysia are mandated by law to use it. But for want of a contract, the app is now a hostage. Now whose fault is that?