Padu registration should be suspended until the security flaws are ...

(Jan 3): I take no joy in writing this statement. I wanted the Central Database Hub (Padu) to be successfully launched because the intended purpose of this database was for the roll-out of more targeted subsidies, including for the withdrawal of the non-targeted petrol subsidy to be placed by a targeted subsidy mechanism.

Sadly, the Padu database, as it stands, will not be useful in achieving this objective.

Firstly, those who are currently receiving government aid such as Bantuan Tunai Rahmah but are not eligible to because they have other non-taxed income such as rental income from houses and land they own will not fill in the accurate information in Padu (see Figure 1 below).

Figure 1: Income-related information to be filled in via Padu database

Secondly, some users including myself are wondering as to why so many of these columns are not filled, given that Padu is supposed to have consolidated data from a number of ministries and agencies, including the Inland Revenue Board, the Employees Provident Fund, the Social Security Organisation, the National Registration Department and the Implementation Coordination Unit, just to name a few (see Figure 2 below).

Figure 2: Government ministries and agencies which have supplied data to Padu

Minister of Economy Mohd Rafizi Ramil’s reply, via X (formerly known as Twitter), was that this information was not displayed because of security concerns over possible hacking into Padu’s servers. But if some of this information is already available via government ministries and agencies, why does Padu need the user to fill up this information? What if the information supplied is not the same as what is found in Padu’s database? How does Padu verify the other information which is supplied by the user, such as rental income from land or property? With so many additional fields to fill in, many users would choose the option of not filling up these fields, or to fill them up with inaccurate information, so that they remain eligible to receive government subsidies!

Thirdly, there is a major security issue with the registration of Padu whereby if you have the IC number and the postcode associated with the IC address of a user, you can register for the Padu account for that person, without having to go through the electronic know-your-customer (e-KYC) process. I did this with the IC address and postcode of four of my DAP colleagues who are ministers or deputy ministers, namely Hannah Yeoh Tseow Suan, Steven Sim Chee Keong, Liew Chin Tong and Teo Nie Ching (see Figure 3 below).

Figure 3: Registration of Padu accounts for Hannah Yeoh, Steven Sim, Liew Chin Tong and Teo Nie Ching without going through e-KYC verification

I was also able to change some of the details of the academic qualifications and occupation of Yeoh, without having to go through e-KYC verification (see Figure 4 below).

Where does this leave us? I would strongly recommend for the Cabinet to make a collective decision to suspend the registration of Padu users until the security issues can be solved.

The system should be properly stress-tested before it is rolled out again. Users who have registered but have not undergone e-KYC verification should be asked to register again after the security issues have been resolved. The number of fields of information should be decreased.

Once the security features are in place, the information which can be pulled from other agencies and ministries should be pre-filled as much as possible. The user should have a mechanism where he or she can make a report if the information provided is not accurate.

Figure 4: Editing the education qualification, occupation and workplace of Hannah Yeoh

Information technology and cybersecurity experts should be called in to provide value-added inputs, which can be used to improve the design of the Padu system.

I hope that my former colleagues in the Cabinet will not see this as a move to undermine their governing objectives.

In highlighting these flaws in the Padu system, I hope that they can be quickly rectified before the next parliamentary sitting, so that the opposition parties in Perikatan Nasional will not have the opportunity to make this into a point of political debate.

I wish for the Madani government under Prime Minister Datuk Seri Anwar Ibrahim to succeed, and I hope that my actions in revealing the gaps in the Padu registration system will be understood as such.

Dr Ong Kian Ming is a former deputy investment, trade and industry minister.