The continuous refusal of the foreign administrator of the online platform of the Land Transportation Office (LTO) to turn over source codes and other encryption keys is making it difficult for the agency to secure the driver's license and vehicle registration data of millions of its clients, an official said.

LTO executive director Martin P. Ontog said that despite the expiry of the contract that gave birth to the Land Transportation Management System (LTMS), the agency could only view at its own data and could not administer it.

The LTMS was designed to integrate all LTO services like issuance of driver’s license, registration of motor vehicles, and issuance of transport permits into a single database and digital platform.

Ontog said the helplessness of the LTO was evident during the June 3 nationwide outage of the LTMS when the agency’s IT experts were unable to address the issue since the supplier was still managing the system's firewall.

He said the LTO investigation revealed a login activity tied to a vendor-linked account a day before the nationwide outage and that firewall logs also showed repeated connection attempts through a VPN account geolocated to a telecom connection within Metro Manila.

Ontog said the LTO has since disabled the accounts it identified and its management information division has formally recommended replacing the firewall entirely so that the agency, not the vendor, controls it,.

The nationwide outages, which the LTO said happened six times in seven weeks from June to July this year, raised the issue of data privacy of the agency clients.

It was recalled that this was one of the arguments raised by two petitioners who asked the Supreme Court to end the contract between the government and the LTMS supplier. The High Court is yet to settle the issue.

"If LTMS is compromised, and the personal data of millions of Filipino motorists and licensed drivers is leaked, who is accountable?" Ontog said during a congressional hearing.

He argued that the LTO cannot be held responsible for defending a system it has been denied the means to control, while the vendor holding that control has no active contract obligating it to do so.

"This is a liability gap [the vendor] manufactured through its own withholding. It is not a failure of LTO stewardship,” said Ontog.

Currently, the LTO has no budget line dedicated to LTMS cybersecurity and no active funded contract covering the system's cloud infrastructure and with the present arrangement of the agency having no full control of the online platform, license renewals, vehicle registration continue to be occasionally operational but are not stable.

The agency’s hands are also tied to address the issue after the Ombudsman ordered the LTO to only use the LTMS, and not its backup system through its old system.

Ontog said LTO will not seek any extension or renewal of its relationship with the vendor and will continue pressing for complete, unconditional turnover of system control, including through blacklisting proceedings already in preparation.