PAC Report: MySejahtera Developed Without Contract, App’s Ownership Unclear With New Company

After receiving MOF approval for direct negotiations with MySJ Sdn Bhd – with different directors and shareholders from KPISoft – MOH is now considering whether to buy the entire MySejahtera system or MySJ’s software services.

KUALA LUMPUR, March 26 – Although the government claims to own MySejahtera, Parliament’s Public Accounts Committee (PAC) reveals that the Covid-19 app was actually developed without a contract with the company that created it.

A Cabinet meeting on November 26 last year approved, in principle, direct negotiations to appoint a new company, MySJ Sdn Bhd, that had received the MySejahtera “system” developed by KPISoft Malaysia Sdn Bhd, Finance Ministry government procurement division deputy secretary Rosni Mohd Yusoff told a meeting last March 8 between the PAC and senior officials from the Ministry of Finance (MOF), the Ministry of Health (MOH), and the Ministry of Science, Technology and Innovation (MOSTI).

This is subject to due diligence procedures by MOH to verify that the new company is a “valid” party that had developed the MySejahtera system, according to MOH deputy secretary-general (management) Harjeet Singh Hardev Singh.

Based on the Cabinet’s decision, MOF then gave approval to MOH to conduct negotiations with MySJ, said Rosni, according to a Hansard of the March 8 PAC meeting published in the PAC’s latest Covid-19 Vaccine Procurement report that was tabled in Parliament Thursday.

“All this time, when the development of the system was being administered by the National Cyber Security Agency (NACSA) or the National Security Council (NSC), there was no proper contract with the company. So, there is no contract,” MOF’s Rosni told the PAC.

“So, when we bring to the Cabinet to fix it in terms of the procurement process and the like, when it goes to the Finance Ministry and when the Health Ministry agrees to take over the MySejahtera application, this means that it’s as if the Health Ministry has to start the initial process all over again, meaning in terms of costs, in terms of the status of the company from KPISoft Sdn Bhd that has changed to MySJ Sdn Bhd.

“This means we need to check from that angle and we need to renegotiate the development costs for this MySejahtera app.”

Harjeet said the Health Ministry’s negotiations with MySJ haven’t begun yet as it had only just received approval from MOF for direct negotiations.

The meeting transcript showed that both MOF’s Rosni and MOH’s Harjeet were uncertain about the status of MySJ – with Harjeet initially believing that MySJ was just a new name for KPISoft.

When Harjeet said MOH needed MySJ to show proof that it was the same company as KPISoft and that it had developed the MySejahtera system, with just a name change, PAC chairman Wong Kah Woh questioned why this would take four months since such checks would only take 10 minutes.

During the meeting itself, Wong got his staff to do a search on the Companies Commission of Malaysia (SSM), revealing that KPISoft Malaysia Sdn Bhd’s name was changed in May 2020 to Entomo Malaysia Sdn Bhd. Entomo Malaysia’s directors are Rekha Mani and Yogaraj Thuraisingam.

MySJ Sdn Bhd, on the other hand, was incorporated in September 2020. Its board of directors include Eco World Development Group Bhd (EcoWorld Malaysia) executive chairman Liew Kee Sin and executive director and chief financial officer Heah Kok Boon as directors of the company, alongside Sapura Energy Bhd founder and former chief executive officer Shahril Shamsuddin.

Also on MySJ’s board of directors is Bersatu disciplinary board chairman Megat Najmuddin Megat Khas, who currently also serves as non-executive chairman of Sime Darby Plantation Bhd and recently listed Farm Fresh Bhd. Raveenderen Ramamoothie and Anuar Rozhan are directors on MySJ’s board as well.

“The shareholders are also not the same as KPISoft Sdn Bhd,” said Wong.

“It looks like these two companies are not just different entities, but completely different ownership. They are not from the same people. So what I can conclude, or at least I can guess here is that KPISoft Sdn Bhd has sold all rights and interests in the MySejahtera application to a company named MySJ Sdn Bhd.”

Who Owns The Data?

Government officials at the PAC meeting did not confirm what exactly was transferred from KPISoft to MySJ, when or how this occurred, or if anything was even transferred in the first place.

It was further unveiled, in the PAC report, that the government’s corporate social responsibility (CSR) deal with KPISoft would only last for a year from March 27, 2020, until March 31, 2021. The government had decided to pay for MySejahtera services from April 1, 2021, when the agreement lapsed.

Rosni told the PAC that MOF has approved RM9.317 million for third-party payments for use of the Google Maps API and SMS costs related to the MySejahtera app.

Harjeet said the only payments that the government has made for MySejahtera were for SMS costs and use of the Google Maps API, besides other miscellaneous items, not for development of the system.

Dr Mahesh Appannan, senior principal assistant director of MOH’s disease control division, told the PAC that KPISoft is “still a vendor designated to develop all MySejahtera modules.”

“It still is, but all governance that will look at the development of MySejahtera is from various agencies, including Mampu, NSC, MOSTI, and also MOH.”

He also said MOH “has been the owner of all data” from “day one”, while NACSA controls cyber security over the MySejahtera app.

“They look at all our data acquisition, our data extraction to access and what not with the permission of our Director of Disease Control.”

When PAC member Azizah Mohd Dun asked who was currently managing MySejahtera, Dr Mahesh replied: “We only use the platform provided by the said company. All of the data management, module management, and the like are under the Ministry of Health together with the technical committee comprising various agencies.”

The MySejahtera app receives about 30 million check-ins at premises daily and sends out up to 300,000 casual contact notifications per day on average, according to Dr Mahesh. All check-in data is archived after 30 days and destroyed after 60 days.

MySejahtera has 38 million registered users to date, said Harjeet, including travellers. The app has more than 10 modules that need to be improved from time to time, he added.

MOH Mulls Buying Entire MySejahtera System Or Services

Harjeet told the PAC that MOH is deliberating between purchasing the entire MySejahtera system to “take full control” or to buy software services from MySJ, echoed by Dr Mahesh who said the procurement could be a “buy over process” or for software service modules.

“This is one of the methods that we’re looking at during negotiations on which will make economic sense and also in terms of implementation in the future,” Harjeet said.

The MOH official added that negotiations need to look at the best model for procuring the system, pointing out that if the ministry were to purchase the entire MySejahtera system, then it must figure out who will operate and maintain the system.

Dr Mahesh explained that MOH first got the idea in March 2020 for digital methods to manage the Covid-19 pandemic. At that time, MOH received about 11 proposals from various companies on digital solutions.

Then, on March 20, 2020, a sub-committee was set up by MOH together with other agencies that saw the formation of a Digitalisation Covid-19 Committee chaired by the NSC, where all related proposals were brought in for discussion with other agencies.

“Besides all of MOH’s needs, we also took into account how fast we could deploy a system that we could use as soon as possible. Following that, we selected the vendor, KPISoft Sdn Bhd. So, we went through a rigorous process of choosing the actual vendor to develop our application currently,” Dr Mahesh told Wong.

The Problem

PAC chairman Wong, who is also Ipoh Timur MP, told the meeting that the problem was that KPISoft received the MySejahtera project for a year-long CSR effort that ended in April 2021.

Because it was a CSR effort, the government did not have to pay KPISoft during that one year and the company got the project that bypassed the normal procurement process, where a contract of more than RM200,000 or RM400,000 would have to be done via open tender, unless approved by the finance minister.

“So now here, the problem is that when this contract was first given to KPISoft Sdn Bhd. Now suddenly another company comes in to take over the whole application; is it appropriate and necessary for the Cabinet to solely appoint MySJ Sdn Bhd through direct negotiation?” Wong questioned.

“So, that is a very big question. When we are talking about, we are going to pay— I mean pay for the apps for MySejahtera for a certain period of time, this could represent a huge contract.”

Wong acknowledged that MOH told the meeting it would conduct due diligence, but stated the PAC’s stand against the appointment of a new company via direct negotiation, saying that if MOH wanted to give the contract to companies other than KPISoft, then MOH should follow set procurement procedures – whether direct negotiation with approval from the finance minister, or based on skill or contract value via open tender or quotations.

“Please bear in mind the procurement procedure needs to be straightly [sic] adhered to and of course, KPISoft Sdn Bhd, from day one if they are a doing it as a CSR, they shouldn’t be charging and if they are charging also and if we allow them to charge also, they shouldn’t be selling the MySejahtera system to another company.

“And now the government is telling us, look we are getting another company to manage, we are going to go by direct negotiation and so on. Of course, everyone in the business, they want to make money, yes, but what kind of process that we need to go through, that is something very, very important in the eyes of PAC.”

Wong also stressed on the PAC’s recommendation in its previous Covid-19 vaccine procurement report tabled in Parliament last December that the government take over operations of MySejahtera without additional costs, since the app has already become part of the national health care system.

He questioned whether MOH was ready to take over MySejahtera now that KPISoft is no longer in the picture.

“Why should we just allow the company just sell the apps to another company and to ensure the other company get the business and get the contract. That shouldn’t happen lah. To me, I’ve said in Parliament if you want to get a government contract don’t go through the backdoor way.”

The Covid-19 vaccination certificate on the MySejahtera app is recognised by other nations, including Singapore, allowing people to travel overseas quarantine-free as more countries reopen.

Presumably, MySejahtera has more than 27 million digital Covid-19 vaccine certificates, based on CovidNow’s statistic of 27.4 million people in the country who has received at least one Covid-19 vaccine dose. More than 23 million adults aged 18 and above have been inoculated with at least one dose.

Besides Covid-19 vaccination certificates and appointments for coronavirus inoculation, MySejahtera – which contains users’ personal details like name, IC number, and phone number or email address – is used for contact tracing, reporting positive test results, self-health assessments for Covid-19, and to display one’s Covid-19 risk status.

Public premises generally only permit entry to fully vaccinated people and those with low risk for Covid-19, as indicated on MySejahtera.

Health Minister Khairy Jamaluddin reportedly said earlier this month that MOH was considering using MySejahtera for Malaysians to sign up as organ donors.

MOH’s disease control division told a forum organised by the Galen Centre for Health and Social Policy last October that the ministry was considering expanding the use of MySejahtera beyond Covid-19 to monitor non-communicable diseases (NCDs), including cancer.

MySJ Directors And Shareholders

SSM records obtained by CodeBlue show that MySJ, which was incorporated on September 23, 2020, is backed by several prominent local corporate figures.

Besides Liew and Heah from property developer EcoWorld; Shahril, former CEO of oil and gas company Sapura Energy; and Megat, chairman of palm oil producer Sime Darby Plantation, MySJ’s two other directors are Raveenderen and Anuar – who, according to an NSC statement in July 2020 – were shareholders and founders of KPISoft then.

MySJ’s share capital is RM35,528,732.

Its biggest shareholder is Revolusi Asia Sdn Bhd, with 28.93 million shares. Revolusi Asia was incorporated on September 17, 2020, just six days before MySJ was incorporated, with Shahril, Raveenderen, and Naveen Pralhad Deshpande named as directors.

Raveenderen has the largest number of shares in Revolusi Asia at 26.6 million shares. Anuar, though not listed as a company director, owns 4.2 million shares in Revolusi Asia. Naveen owns 4.2 million shares.

MySJ’s second largest shareholder is Hasrat Budi Sdn Bhd, with 3.57 million shares. Hasrat Budi was incorporated seven months ago on August 23 last year, with EcoWorld Malaysia’s Liew and Heah named as directors. Property developer EcoWorld Malaysia is the sole shareholder of Hasrat Budi.

P2 Asset Management Sdn Bhd is MySJ’s third largest shareholder, with about 2.5 million shares. Checks on SSM show that the company was incorporated on November 3, 2020, with Johor Bahru-based Yap Zi Jing listed as a company director, along with 29-year-old Johnathan Jaya-Sudhir and 26-year-old Gregory Jaya-Sudhir, who are also based in the southern state.

Ganesan Shanmugam owns the remaining 528,632 shares in MySJ.

KPISoft Malaysia Sdn Bhd, which was incorporated on June 21, 2005, changed its name to Entomo Malaysia Sdn Bhd on May 20, 2020.

Entomo Malaysia’s directors are Rekha and Yogaraj; Anuar and Raveenderen are not listed on the board of Entomo Malaysia. The company’s sole shareholder is Entomo Pte Ltd.

According to Entomo Malaysia’s website, which describes the company as formerly KPISoft, Entomo offers solutions to improve business and organisational performance. Raveenderen is founder and group CEO of Entomo.

Both MySJ and KPISoft Malaysia share the same registered address at Wisma Adiss Udarama Complex in Kuala Lumpur and the same business address at Q Sentral in the capital city.

This is the first part of CodeBlue’s investigative series on MySejahtera:

You may also like