Private firms revealed as operators of Government’s eCitizen platform

The government’s eCitizen platform, which offers online access to public services, is currently being managed by a consortium of three private firms under a contract that began in May 2023, Immigration and Citizen Services Principal Secretary Belio Kipsang has said.

Appearing before the National Assembly Administration and Internal Security Committee on Tuesday, Kipsang revealed that the consortium, registered as Electronic Services Solutions (ECS) LLC, is made up of Webmasters Kenya Limited, Pesaflow Limited, and Olive Tree Media Limited.

Each company has a specific role in supporting the platform’s operations.

Webmasters Kenya is responsible for customer care and related services, Pesaflow manages all payment processes, and Olive Tree Media handles bulk messaging, notification security, and revenue mobilisation.

Kipsang informed lawmakers that although eCitizen has existed since 2014, the agreement with the current consortium came into effect on May 25, 2023, and will remain active for three years.

The arrangement is managed through the ICT Authority.

"The deal is managed through the ICT Authority," Kipsang said.

He explained that the government paid Sh50 million to standardise the eCitizen platform, with the annual maintenance cost ranging between Sh300 million and Sh1.08 billion, depending on the number of services integrated into the system.

The PS also revealed that every transaction made through eCitizen attracts a fee of between Sh10 and Sh20.

Onboarding new services comes with separate charges that vary based on their complexity.

"Basic services can attract up to Sh1 million, while intermediate and complex services cost between Sh3 million and Sh5 million, respectively, with discounts applied as more services are added," he said.

Kipsang noted that the consortium also charges for custom services.

Daily fees for senior personnel, such as project managers and software developers, are set at Sh52,500, while other roles like system analysts, researchers, and software testers are paid Sh27,000 per day.

The PS assured members of the committee that the eCitizen platform is being actively monitored through a Security Operations Centre located at Nyayo House.

He said the system offers real-time surveillance to detect intrusions, verify data integrity, and conduct regular tests to identify any weaknesses.

"eCitizen is continuously monitored, providing real-time tracking, intrusion detection, data integrity verification and regular penetration testing," he said.

Kipsang added that the government has adopted a proactive approach to risk management, with regular assessments carried out to identify and address potential threats such as cyber-attacks and technical failures.

"Our risk management policy proactively identifies and assesses potential events or vulnerabilities, including cyber-attacks, system failures and operational risks, through regular risk assessments," Kipsang said.

He further said that Data Protection Impact Assessments (DPIAs) are carried out in partnership with the Office of the Data Protection Commissioner to ensure that the platform adheres to the required data protection standards.

"We conduct Data Protection Impact Assessments (DPIAs) in conjunction with the Office of the Data Protection Commissioner (ODPC) to ensure our data processing practices meet the highest protection standards," he said.

In June 2023, eCitizen experienced a major cyberattack that disrupted its services for over a week.

However, the then ICT Cabinet Secretary Eliud Owalo assured the public that no personal data was compromised.

At the same time, the Business Registration Service (BRS) has announced that it is shifting to a more advanced version of its system under the eCitizen platform.

The upgraded system, known as BRS Version 2, is being rolled out in phases and is accessible at brsv2.ecitizen.go.ke.

According to a public notice, the new platform offers a wide range of business registration services, including the registration of various types of companies and changes to company particulars.

Users can also obtain certified copies and perform document perusal services.

The services already accessible through the upgraded system include registration and updates for Business Names (BN), Limited Liability Partnerships (LLP), Limited Partnerships (LP), Companies Limited by Guarantee (CLG), Private and Public Limited Companies (PVT & PLC), and Foreign Companies (FC).

In addition, users can carry out functions such as appointing or removing auditors, secretaries and authorised persons, restoring entities that were struck off, and amending company articles.

The upgrade is intended to simplify business registration procedures and improve service delivery through enhanced automation.

This move comes after the Business Registration Service experienced a serious data breach in early February this year.

The cyberattack reportedly took place on the night of January 31 and exposed sensitive company information to the public.