Kenya MPs Raise Alarm Over eCitizen Platform Contract Transparency and Security Risks

A cloud of uncertainty hangs over the management of Kenya's eCitizen digital payment platform, with members of parliament raising serious concerns about the transparency and potential risks associated with the consultancy agreement between the government and a consortium of developers. 

The legislators are warning of potential financial irregularities and significant data security vulnerabilities. The eCitizen platform, a critical component of the government's revenue collection, has been under increasing scrutiny, prompting the Auditor-General to initiate a special audit to assess its credibility. The audit's preliminary findings have revealed alarming discrepancies between balances recorded within the system, revenue statements, and ledger entries. 

Specifically, the Auditor-General's report for the 2023/2024 financial year indicates that while the eCitizen system processed Ksh44.8 billion in revenue, inconsistencies in the data raise questions about the platform's overall accuracy and reliability. The ongoing audit aims to provide a comprehensive assessment of the eCitizen system, focusing on key areas such as data accuracy and security, IT governance, physical security measures, and the adequacy of internal controls. However, the audit remains incomplete, leaving critical questions unanswered and fueling further concerns among legislators. 

The Administration and Internal Affairs Committee of the National Assembly has expressed deep scepticism regarding the negotiation and signing of the eCitizen contract. Members of the committee have voiced concerns about the role of Immigration and Citizen Services Principal Secretary Bellio Kipsang, accusing him of withholding critical information pertaining to the agreement. The contract, which governs the processing of hundreds of millions of shillings in daily payments for government services, was signed by a junior government official, raising further questions about oversight. 

Notably absent from the contract's signature page are the signatures of the Attorney-General and key Cabinet Secretaries from the National Treasury and the Interior Ministry, a fact that has drawn sharp criticism from legislators. One anonymous committee member describes the situation as "scary," highlighting the inherent risks associated with a contract handling such significant sums of public funds without proper high-level government oversight. Kisumu West MP Rozzah Buyu echoes these concerns, criticising Dr. Kipsang for submitting relevant documents mere moments before committee meetings. 

She emphasises the importance of transparency, stating that legislators are tasked with overseeing government actions on behalf of the Kenyan people, who have a right to know where their money is going. The three-year contract, which spans from 2023 to 2026, has been criticised for its failure to clearly specify effective and due dates, a glaring omission that legislators fear could be exploited to the government's detriment. Moreover, the contract contains a termination clause that allows either party – the government or the consortium of developers – to unilaterally terminate the agreement.

This provision has raised concerns that, in the event of termination, the consortium could potentially remove proprietary infrastructure and resources, including software that is integral to the system's functionality. Such a scenario could cripple the eCitizen platform and disrupt essential government services. The eCitizen platform is managed by Electronic Services Solutions (ECS) LLP, a consortium comprised of Webmasters Kenya, Pesaflow Limited, and Olive Tree Media Limited. 

As per the agreement, the consortium is responsible for providing all contracted services and managing payments generated through the platform. The eCitizen contract bears the signatures of Stanley Kamanguya, CEO of the ICT Authority, as well as two other government officials: Thomas Odhiambo, Acting Director at the ICT Authority, and Isaac Ochieng, Director-General of eCitizen. 

On the supplier side, the agreement was signed by James Ayogo, CEO of Webmasters Kenya Limited, and witnessed by Evid Araka, Director at Pesaflow Limited, and James Kabiru, Director of Olive Tree Media Limited. The conspicuous absence of signatures from senior government officials, such as the Attorney-General and the Cabinet Secretaries of the National Treasury and the Interior Ministry, raises serious questions about the contract's validity and enforceability. 

Each member of the consortium plays a distinct role in the operation of the eCitizen system. Webmasters Kenya Limited is responsible for service maintenance, customer care, and related functions. Pesaflow Limited handles payment integration and ensures compliance with the National Payment System Act of 2011, facilitating smooth electronic transactions. Olive Tree Media Limited manages bulk messaging, security support for notification services, and revenue mobilisation. 

While the agreement outlines these roles, MPS have questioned the adequacy of safeguards in place to protect public funds and data processed through the platform, demanding greater transparency and accountability. The controversy surrounding the eCitizen consultancy agreement has brought into sharp focus broader governance concerns within Kenya's digital infrastructure.

As the Auditor-General’s special audit continues, MPs have called for greater accountability and comprehensive reforms to ensure the platform operates reliably and securely. The findings of the audit are expected to shed light on the system's credibility and provide valuable insights into strengthening Kenya's digital payment infrastructure.