LTO eyes ban on digital platform operator

The Land Transportation Office (LTO) in the Philippines is preparing to blacklist Dermalog Identification Systems GmbH, the German contractor responsible for the P3.2-billion Land Transportation Management System (LTMS). The agency cites alleged contractual violations, stating the platform is still incomplete even after the agreement expired in May. LTO Executive Director Martin Ontog identified Dermalog, a German technology firm awarded the contract in 2018, noting that the LTMS has remained unfinished for over 900 days despite 13 contract extensions.

Ontog highlighted significant system limitations, including the inability to process public utility vehicle transactions and automatically collect penalties for new vehicle registrations. The Commission on Audit has also repeatedly flagged the LTMS for numerous deficiencies since 2023. Furthermore, Dermalog's maintenance contract expired without essential updates like patching, active monitoring, and incident response, leaving the LTMS vulnerable to frequent breakdowns and security risks.

A major point of contention is Dermalog's refusal to transfer the source code, encryption keys, and full administrative and database access to the LTO. Ontog explained that this withholding prevents the LTO from effectively operating, maintaining, and securing the LTMS, stating, "We cannot secure a system we do not control." Legislators have voiced concerns about potential data privacy and national security risks, fearing that a foreign entity's control over the LTMS source code could lead to the leakage of personal data from millions of motorists.

The Office of the Solicitor General has intervened, asking the Supreme Court to compel Dermalog to hand over the source code and to expedite a petition seeking to nullify the LTMS contract. This legal action comes amid fears that personal data, including birth information, could be compromised or altered within the system.

“

Because Dermalog continues to withhold the source code, encryption keys, and full administrative and database access, including the transfer of LTO’s complete database of vehicle registrations and driver’s licenses, the LTO is effectively blind in operating, maintaining, and most critically securing the LTMS. We cannot secure a system we do not control.