Inside multimillion-shilling agreements, the private companies behind eCitizen

Immigration and Citizen Services Principal Secretary Belio Kipsang has come out to explain the contractual agreements behind eCitizen, the government’s online portal for all state services.

Appearing before the National Assembly Administration and Internal Security Committee at Parliament buildings in Nairobi on Tuesday, Kipsang told MPs that the Immigration Department has contracted a developers' consortium dubbed ECS (Electronic Services Solutions) LLC to maintain the platform.

The consortium comprises three firms: Webmasters Kenya Limited, Pesaflow Limited and Olive Tree Media Limited.

Webmasters provides customer care and related services, while Pesaflow handles all payments.

Olive Tree Media is, meanwhile, in charge of bulk messaging and security support for notification services as well as revenue mobilisation.

The government first introduced eCitizen in 2014. Since then, it has expanded to be the main gateway for over 5,000 county and national government services by agencies like the National Transport and Safety Authority, Kenya Revenue Authority, and the National Registration Bureau.

However, Kipsang said the current contract between his state department and the consortium took effect on May 25, 2023 and runs for three years.

Per the agreement between the ICT Authority and the consortium, which Citizen Digital saw, ECS has charged the government Ksh.50 million for the ‘standardisation’ of the eCitizen system.

Additionally, its 'support and maintenance' costs are billed annually between Ksh.300 million and Ksh.1.08 billion, depending on the number of services on the platform.

The government also pays a 'payment gateway tariff' billed between Ksh.10 and Ksh.20 per transaction, as well as service onboarding charges.

These can go up to Ksh.1 million for ‘basic’ services, depending on the number; more services are cheaper, with over 3,000 services attracting a Ksh.400,000 tariff.

‘Intermediate’ services, meanwhile, attract tariffs of between Ksh.3 million (0-50 services) and Ksh.1 million (above 3,000 services), while for ‘complex’ ones, the government pays between Ksh.5 million and Ksh.2 million for the same brackets, respectively.

The consortium also charges ‘custom services’ separately, with the government paying a daily fee of Ksh.52,500 for a senior project manager or senior software developer.

A software tester, researcher and system analyst is paid Ksh.27,000 daily.

Kipsang said eCitizen is continuously monitored through the Security Operation Centre (SOC) at Nyayo House, Nairobi, “providing real-time monitoring, intrusion detection, data integrity verification, and regular penetration testing.”

“Our risk management policy proactively identifies and assesses potential events or vulnerabilities, including cyber-attacks, system failures, and operational risks, through regular risk assessments,” the PS said.

Kipsang added that the Directorate of eCitizen Services is responsible for the portal’s management and that all requisite payments are transmitted directly to the National Treasury.

“We conduct Data Protection Impact Assessments (DPIAs) in conjunction with the Office of the Data Protection Commissioner (ODPC) to identify privacy risks and ensure our data processing practices meet the highest protection standards,” he told MPs.

The platform in June 2023 suffered a major cyberattack, which affected services for over a week, but then-ICT Cabinet Secretary Eliud Owalo said no data was lost to the hackers.