‘Sri Lanka today is unable to provide passports to its citizens—and nobody has been held accountable’
The Public Security Ministry’s bungled ePassports tender has thrown thousands of Sri Lankans into despair. Among them are heavily indebted prospective migrant workers and students with missed university entrance dates.
The issuance of travel documents is now down to a bare minimum and the first stock of empty books—not ePassports but regular machine readable ones—is expected only after October 27, 2024.
From the inception, a heated contest between competing entities meant that this lucrative tender was open to manipulation. The very structure of the procurement was altered midway based on the input of an adviser to Public Security Minister Tiran Alles. It was cancelled and re-advertised before being awarded in April.
But more than a year after expressions of interest (EoI) were first called, the contract for the country’s inaugural ePassport is only partly completed as the tender to buy two-key encryption infrastructure for personal data has not even been floated yet.
Sri Lanka is today unable to provide any passports to its citizens—and nobody has been held accountable.
The origins
The Battaramulla-based Epic Lanka is the long-term supplier of machine readable passports (MRPs) to the Department of Immigration and Emigration (DIE), having sold them for 23 years. The Kollupitiya-headquartered ‘Just In Time’ (JIT) company is the contract holder for Sri Lanka’s eNIC and won the new ePassport deal, outbidding Epic on price.
The Sunday Times did not contact either party but interviewed multiple strong sources who corroborated the facts in this report, including with documentary evidence. They claimed that competition between these two companies, each supported by their own “internal” backers, had compromised the tender process. They stressed the urgency—on the back of a string of other recent questionable deals—for strong, legally enforceable procurement laws and guidelines with punishment for violations.
The latest proposal to introduce ePassports goes back to 2020 when the DIE, then under the Defence Ministry, considered shifting to a book with a durable, tamperproof polycarbonate data page. Chamal Rajapaksa was the State Minister of Defence and a Cabinet paper was accordingly submitted, recommending a technical evaluation committee (TEC) and a procurement committee (PC).
Long queue outside the Department of Immigration and Emigration. Pix by M.A. Pushpa Kumara
The Cabinet memo also explained that the existing personalisation system couldn’t be used for ePassports. Two-key encryption was needed. This allows the Sri Lankan passport’s unique public key infrastructure (PKI) to be lodged with the International Civil Aviation Organisation’s (ICAO) public key directory (PKD) for access by immigration entities worldwide. Along with the University of Moratuwa (UoM), therefore, the relevant specifications were crafted. But the procurement did not come to fruition.
Meanwhile, Epic was providing MRPs to the DIE. According to several sources, including Minister Alles, the company continuously sold passports to the Department after winning the first contract without tenders being called.
“Initially, Epic sold the books and printing solution, printers, consumables and maintenance,” and authoritative source said. “They also later provided the photo-capturing software. Procurement of new passports was routinely delayed so that there was a danger of stocks running out and Epic got new orders by default, to avert a crisis.”
Epic’s partner in the Sri Lankan passport contract is Perum Peruri, which goes as the money-printing public corporation of the Republic of Indonesia.
A fresh attempt
Then ICAO released its 2025 passport standards requiring a new method of encoding biometrics in travel documents. The DIE, now under the Public Security Ministry, received instructions to draw up a bid document for ePassports and to examine whether it could be implemented as a Government-to-Government (G2G) deal.
In June 2023, EoIs were invited from interested, qualified and capable parties “through the respective Governments” for five million ePassports and 500,000 ‘N’ series MRPs. Extended till August that year, the advertisement sought the development and installation of a passport personalisation unit and personalisation of passports; and the design, development and deployment of passport personalisation software with necessary hardware.
It was to be a “build, operate and transfer” whereby a supplier would be paid by the DIE for each personalised passport with polycarbonate data page and embedded chip. There was to be no investment from the Sri Lankan Government. The PKI-PKD infrastructure was included. The basis for this EOI document was the 2020 specs prepared with input from the UoM. It was even publicly announced that Sri Lankans would have ePassports by January 2025.
But despite around nine interested parties picking up the documents, this procurement was cobbled. Even before that, certain bidders were concerned that, while Cabinet had granted approval for a G2G contract, the public advertisement changed this to “through the respective Governments” while the EoI eligibility criteria called for applicants to be “endorsed” by the respective Governments/Foreign Missions of such Governments.
The original bid conditions were tough, purportedly to attract “good parties.” For instance, they narrowed the prospective applicants down to companies that had experience of printing 10mn passports “to ensure continuous supply.” But this was later slashed to three million “to suit certain interests.” The Sunday Times could not independently verify that the bid was rigged to favour one or the other company—but every source interviewed made this allegation and provided examples, respectively, to substantiate their claims.
Even the “tough” bid conditions were questioned as being aimed at favouring identified parties, highlighting a complete breakdown of confidence in Sri Lanka’s procurement system. Lax or stringent, everything is now seen as suspect.
A completely new requirement
The procurement was turned entirely on its head, however, when Minister Alles enlisted an adviser cum technical expert for it. Formerly of the Department of Government Printing, he reportedly insisted that the DIE did not require a PKI-PKD infrastructure and at the existing machines could be used for passport personalisation. This was verified by multiple sources.
What was initially a comprehensive bid—with empty passports, printing solution, PKI-PKD infrastructure and hardware; with biometric data entered into the chip and encrypted; and with a facility to enable decryption and identification of the passport-holder at the border of another country—was now whittled down to a tender for empty passports with a chip.
“This adviser contended that the Epic printers the DIE had could do the personalisation and he also removed the requirement for a polycarbonate data page, returning to a paper-based solution,” an authoritative source said.
The EoI was cancelled. In November 2023, a new advertisement was published calling for bids for just five million ePassports with a chip embedded in the cover. There was no longer a PKI-PKD infrastructure component which meant that now had to be procured separately—or handed to Epic for personalisation through an upgrade of their existing facility. The bid was extended till January this year. Only four companies came forward. One was disqualified at the preliminary stage, leaving JIT, Epic and Metropolitan.
Epic and Metropolitan were initially ruled out by the TEC but taken back in, an official source said. However, they lost out on the price of their passports. JIT with Thales offered a passport with chip at Euro 4.62 (which Minister Alles calculated to be US$ 5.05); Metropolitan and its foreign partner, the Malaysian IRIS offered US$ 6.28; while Epic and Perum Peruri bid US$ 9.90.
Thales was awarded the contract in April. The tender stands, even amidst the National Procurement Commission having determined—but not acted in any substantive manner beyond asking the Public Security Ministry Secretary for explanation—that several aspects of the process had been wrong.
Even after the contract was awarded, delays were caused when the Minister’s adviser reportedly said Sri Lanka has no legally-instituted “country signing certification authority” (CSCA) for the PKI-PKD infrastructure which still has to be procured. After much to-and-fro (involving even the ICAO and the Civil Aviation Authority of Sri Lanka), it was decided that the Ministry would be made the CSCA through Cabinet approval while the issuer would be the DIE.
But there are outstanding technical requirements to be fulfilled which will further delay the issuance of ePassports to Sri Lankans. For instance, the DIE must be granted a “document signing certificate” to be embedded as a security feature whenever a chip is personalised. There are other steps that require agreements to be reached with non-ICAO member countries. And there is still no solution to personalise ePassports when they do finally arrive.
No passports
The immediate problem, however, is that all these lags left the DIE with no travel documents to issue—ePassports or otherwise. In this classic “manufactured emergency” situation, the Public Security Ministry has ordered up to 750,000 MRPs from JIT/Thales at a slightly reduced price within the same tender that it won to supply ePassports. Competitors of JIT now allege that the company will also be handed the PKI-PKD tender “on a platter.” “That was always the secret deal, as evidenced by the ridiculously low price Thales offered to sell its ePassports for,” one scoffed.
Epic is also vying to stay in the game, and presently has more legal grounds to do so. It has offered to supply 500,000 MRPs under its old contract with the DIE provided the Sri Lankan President speaks directly with his Indonesian counterpart to facilitate quick production. These passports have 64 pages as opposed to the 32-leaf books Thales is providing.
Earlier, Epic also offered to upgrade within a month its existing systems to allow personalisation of the new ePassport for a fee of US$ 10,000. This was not accepted. Official sources say the Public Security Ministry has “misled Cabinet” on several counts. This is a common complaint related to procurement in most sectors.