National Fuel Pass and fiction of Sri Lanka’s digitalisation

A motorist shows off the QR Code on his mobile to an employee of a fuel station in Colombo – Pic by Sameera Wijesinghe

The same Government that cannot manage basic legal, and regulatory compliance for a fuel rationing app, manage its rollout, or staff a single public official or MP to respond to significant questions, and widespread concerns, is also going ahead with plans to issue electronic national identity cards by year’s end

“Sri Lanka›s digitalisation drive is often defined by flashy headlines, high-profile conferences, and foreign trips. Yet, when delivery fails, the officials & ministers vanish, leaving a guy on X to provide tech support for the entire nation.”

When an account on Twitter/X called Sajith Cooray tweeted the above, he was referring to cybersecurity expert Asela Waidyalankara, who spent all of Sunday fielding complaints, explaining system failures, and responding to frustrated users of the National Fuel Pass (NFP).  Waidyalankara was acting in his personal capacity. No one from the Ministry of Power and Energy was present anywhere online. No one from the President’s office was responding to questions, and concerns. No one from the development team behind the NFP platform and the QR-code app was answering questions. Incredibly, and to my mind, in what was an unprecedented development, the entire public-facing crisis response for a platform processing the personal data of Sri Lanka’s entire fuel-consuming population was, on social media, and for over 48 hours, a single private citizen posting to Twitter/X. This is the true state of digitalisation in Sri Lanka today. I want to reflect on what this means. 

It could not have come as a surprise to the Government that global fuel supply chains would be affected. For over a week, there were mounting calls to reintroduce the QR code based fuel rationing system. When the system finally went live at on Sunday morning, it was clear the platform was not ready. The website threw numerous errors, and even refused to load. New vehicle registrations did not work. Newly issued NIC numbers weren’t recognised. OTPs arrived after the two-minute verification window had expired. Second-hand vehicle owners discovered their vehicles were still registered to previous owners whose data had never been purged from the database. 

The 1919 helpline did not work, and most probably because they were inundated with calls and hadn’t planned for surge demand over the weekend. No trilingual FAQs had been prepared. No registration portal link was included in any of the official announcements. Citizens were told to register early in the morning for a system that remained dysfunctional throughout the day, and well into Monday.

Is this Government so incompetent, one user asked on Twitter/X, that it would ask people to start using a system overnight without even validating it, after it had lain dormant for four years? The question answers itself. 

Late Sunday, I studied over 4,000 comments across five Facebook posts by Ada Derana, Newsfirst, Newswire, and the Government Information Department. What they revealed, in both Sinhala and English, was not just frustration at technical failure. It was something closer to a collective, grudging realisation that no one in Government had anticipated basic concerns, challenges, and questions like: Can I use my old QR code? What about 48cc motorcycles without number plates? How do I find my chassis number? Where do I even register? No one from the Government actively engaged with millions of frustrated citizens. This communications vacuum extended well beyond Facebook. 

On Sunday, while officials and ministers were nowhere to be found, Indians planning visits to Sri Lanka tweeted at Sri Lanka’s High Commissioner in Delhi, Mahishini Colonné asking whether they should be worried about fuel rationing. Colonné was left to improvise reassurances: “The queues are largely due to people topping up before the QR-based fuel quota system comes into effect tomorrow. Once operational, queues should ease. Tourist travel within Sri Lanka will not be affected. Only on Monday afternoon did Deputy Minister of Tourism Ruwan Ranasinghe announce that a special QR code system would be introduced for the tourism sector “by this evening”. 

The tourism sector, a fragile, recovering lifeline for the economy, was an afterthought in the NFP rollout. Foreign missions in Sri Lanka, and our own diplomatic outposts weren’t debriefed on how it would impact tourism. Our hapless diplomatic representatives had to rely on their own wits to adroitly manage a glaring gap in official communications, before, and even after the NFP’s launch. 

Tsunami of technical failures and PDPA conundrum

The tsunami of technical failures were damning, but what I find more concerning is what sits beneath them. The NFP platform collects NIC numbers, phone numbers, addresses, vehicle registration details, and chassis numbers. It processes this data for millions of citizens. Sri Lanka’s Personal Data Protection Act (PDPA), enacted in 2022 and amended in 2025, exists precisely to govern how the state handles information of this nature. 

The law requires any entity collecting personal data to tell citizens why it is being collected, on what legal authority, who will see it, how long it will be kept, and what rights citizens have over their own information. And yet, the NFP’s privacy policy meets none of these requirements. I flagged this publicly on Sunday morning. The law says consent to process personal data must be freely given, specific, and informed. One cannot manufacture consent through a click-through on an app citizens have no practical choice but to use. But the NFP’s policy says “by using the system, you agree.” That is not how the law works. The PDPA requires every ministry processing personal data to appoint a Data Protection Officer: someone citizens can contact with questions or complaints about how their information is being handled. The NFP policy makes no mention of one. Citizens have the right, under the Act, to ask what data the Government holds on them, to request its deletion, and to appeal to the Data Protection Authority if refused. The privacy policy mentions none of these rights.

Incredibly, a “revised” privacy policy published on Monday afternoon was as non-compliant with the PDPA as the version it replaced. What the Ministry of Power and Energy appears to have done is republish the same policy, without any substantive revision or attempt at meaningful compliance. 

This alone tells citizens precisely how much weight the Government assigns to their data protection rights: none.

This Government has no strategic or crisis communications. It isn’t bothered about data governance. There is absolutely no accountability architecture – a key demand, and pillar of the “system change” narrative. No one is online when things go wrong, no one responds to legitimate grievances, and no one is apparently in charge of a major platform rollout

e-NIC program

This pattern is familiar, and it should alarm anyone paying attention to where Sri Lanka’s digitalisation program is headed. The same Government that cannot manage basic legal, and regulatory compliance for a fuel rationing app, manage its rollout, or staff a single public official or MP to respond to significant questions, and widespread concerns, is also going ahead with plans to issue electronic national identity cards by year’s end. The e-NIC program will process biometric data, assign permanent digital identities, and underpin critical national infrastructure that will affect every citizen. Each of those elements raises data protection questions of an order of magnitude more complex than anything the National Fuel Pass confronts. Operational exigency – to get a system launched or live, deal with the legalities later – clearly trumps everything. Technical rollouts, hastily executed, take precedence over the legal, regulatory, and rights-respecting frameworks meant to govern them, and protect citizens. The technocrats heading digitalisation are also completely silent, and unaccountable. 

What the NFP debacle on Sunday exposed is not just a terrible critical national infrastructure launch. It exposed an institutional vacuum that’s growing at pace, and becoming more obvious. This Government has no strategic or crisis communications. It isn’t bothered about data governance. There is absolutely no accountability architecture – a key demand, and pillar of the “system change” narrative. No one is online when things go wrong, no one responds to legitimate grievances, and no one is apparently in charge of a major platform rollout. If it wasn’t for Waidyalankara on Twitter/X, there was not a single person in Sri Lanka attentive towards the failures of the NFP launch, which beggars belief. 

The thousands of comments I studied on Sunday evening weren’t merely complaints about glitches and expired OTPs. They were citizens sensing, without the technical or legal vocabulary to articulate it, that something is profoundly wrong with how the state handles their personal, and private data. They spoke of “errors” and “old owners’ details appearing on my account” without realising these are symptoms of a system built without the safeguards their own parliament enacted to protect them.

If the institutional competence to get a fuel pass privacy notice right does not exist today, the institutional competence to govern a national digital identity ecosystem does not exist either. Sajith Cooray’s observation on Twitter/X lands as hard as it does because it captures something the NFP debacle has made viscerally, embarrassingly clear: Sri Lanka’s digitalisation ambitions are a performance. The spectacle around AI conferences, glossy World Bank, and UNDP events, and diplomatic announcements with the Indian High Commission are all performative, and promissory. The promise, pageantry, and performance of ‘system change’ crumbles at first contact with competence. When digitalisation breaks down, when vital regulations, and laws are broken, when citizens complain in their thousands, the stage completely empties. Quite literally, only a single person on Twitter/X, doing the Government’s job for free, is all that remains.

This should give us all pause. It should give the Government pause. I suspect it won’t.

(The author has a PhD in Social Media and Politics from the University of Otago and is Sri Lanka›s first TED Fellow. He counts over 20 years’ experience in peace building, civic media, and digital security. He is also the founder, and former editor of Groundviews, Sri Lanka›s first, and award-winning citizen journalism website)