A-G discovers security flaws and forgeries in the immigration system

The Immigration Department in Sabah and Sarawak issued a total of 37 and 1,137 falsified security stickers in 2019 and 2017, respectively, the Auditor-General (A-G) revealed in the second series of its 2019 report which was recently published.

Following the delay since March caused by the Covid-19 pandemic restrictions, the report was eventually presented in Parliament.

The A-G said that the forgeries were feasible as a consequence of security vulnerabilities caused by identity theft in the Malaysian Immigration Department’s online system, MyIMMs.

According to the country’s top auditor, both cases are still being investigated, although security measures have been strengthened subsequently.

The report states that the first forgery involving the abuse of MyIMMs IDs occurred on September 12, 2019, at the Foreign Workers Division in Kota Kinabalu, Sabah.

An officer who subsequently denied knowledge of the issue used the serial numbers of the security stickers to manufacture a bogus Employment Pass. The following day, a police report was filed.

The government auditors noticed an update made from the Immigration Department dated January 11, 2021, in which a report was made to the federal headquarters in Putrajaya’s Information Technology and Records Division (BTMR).

It said that at the time of this writing, the investigative report has not been received.

“BTMR has made several updates to the system and ID, including the following: ICT has been strengthened; IDs are limited to one computer; the system will automatically log out after five minutes of inactivity; the ID will expire after three months of inactivity; and only one ID is permitted to log in to a single branch,” the A-G stated in its report.

The next and bigger forgery instances in Sarawak were linked to a similar breach of the MyIMMs System on October 12, 2017, at the Kuching branch’s Foreign Workers Division.

The federal auditors observed that a police report was lodged four days following the breach, citing the presence of printouts of the counterfeit stickers at various Immigration offices across peninsular Malaysia.

The A-G, however, said in his report that the kind of pass that was forged using the serial number of the security sticker was not specified in the police report since the incident was still under investigation.

He said that both the Sabah and Sarawak intrusions in 2019 and 2017 had a significant impact on the integrity and security of data in the MyIMMs System.

According to him, the Immigration Department must strengthen the security controls on the MyIMMs System in order to address the issue of system intrusion, which has a negative impact on JIM’s operations and national security in general. He also added that in developing the National Integrated Immigration System, it is critical to emphasize more strong system security controls.