Automated Biometric Information System (ABIS) update; IEC Commissioner Vacancy & salary increase; with Deputy Minister

Meeting report

Deputy Minister's opening remarks
Deputy Minister Njabulo Nzuza indicated that the Minister could not attend this meeting because he was in the Justice, Crime Prevention and Security (JCPS) meeting. He introduced Director General Mr Tommy Makhode and Deputy Directors General, Mr Thulani Mavuso, Mr Modiri Matthews, and Mr Thomas Sigama.

The Deputy Minister noted the purpose of the meeting was to present the progress on the ABIS project which has been one of the thorny issues for DHA. The DHA has consistently come to the Portfolio Committee to report both the challenges and the steps being taken to deal with them. This is a program that was run by the State Information Technology Agency (SITA) in terms of procurement and the DHA inherited a service provider by the name of Enterprise Outsourcing Holdings (EOH). They then had many issues with the project mainly marred by corruption and these issues have been presented to the Committee.

It was agreed upon that this project should be saved and that value derived for the money put into it because DHA will heavily rely on this particular system being implemented in the future. DHA was pleased to be presenting progress in how far they have gone in the completion of the first phase, how far they are with phase two, how they are dealing with contractual issues, and how they are deriving value for money in the project. It is exciting to be reporting to the Committee with this tone. He called on Mr Mavuso to take the Committee through the specifics of the project.

ABIS Progress presentation
Mr Thulani Mavuso, DDG: Institutional Planning & Support & Acting DDG: Information Services, said that the ABIS project commenced in December 2017 after the appointment of EOH Mthombo, with MorphoCards (later acquired by IDEMIA) as the technology partner in the project. In March 2020 after multiple delays of the project, EOH Mthombo wrote to DHA and noted their intention to exit the contract and recommended it to be ceded to the technology partner IDEMIA. After consulting with the Portfolio Committee and the National Treasury on the expenditure already incurred it was agreed that the contract would be ceded to IDEMIA on 1 April 2021 to avoid having fruitless and wasteful expenditure. April 2021 was defined as a transition period from EOH Mthombo to IDEMIA and IDEMIA commenced with the project on 1 May 2021.

The project consists of three phases. On completion of phase one, ABIS should be fully functional and the migration of the HANIS biometric data will be 100% complete and in a usable format. Fingerprints, facial recognition, and latent search functionality should be fully operational and in production as well. Phase two entails the Enhancement of ABIS functionality by implementing Iris, Palmprint, and Infants Footprint biometrics. And finally, phase three involves the addition of any other biometric modalities as required by DHA such as DNA, and system maintenance and support.

According to the contract, phase one was supposed to be completed by 30 November 2021, however, IDEMIA requested multiple extensions. By 20 June 2022, the fourth extension date, it was clear that some parts of phase one were ready and others that were not. There was therefore an agreement to separate phase one into two smaller components. Phase 1A would consist of fingerprints and photos while phase 1B would consist of the facial recognition and latent search. Phase 1A went live on 22 November 2022. Latent searches and facial recognition functionalities (Phase1B) were ready to be released into production on 18 March 2023, however, due to the ABIS Database Indexing, the functionalities were not released and ABIS was downgraded to a secondary biometric system and HANIS was made the primary. IDEMIA addressed the technical issues of switching to ABIS as a primary biometric system with facial recognition and SAPS latent searches. DHA/SARS MoA was coming to an end on 30 June 2023 and DHA prioritized the Live Capture Lavarock Release phase 4 (system upgrade) on 23 June and ABIS testing was deferred to commence on 17 July 2023. ABIS was still under testing with Lavarock Release phase 4 (interfaces), and the estimated date to switch over to ABIS as the primary database was 8 September 2023.

ABIS Phase 2 commenced in May 2023, estimated to conclude in April 2024 and DHA requested IDEMIA to add resources on Phase 2 to bring completion to March 2024 in line with the APP target for 2023/24. In May 2023 DHA reported to the Committee that it had levied penalties on the Phase 1 delays and that IDEMIA made a settlement proposal that was not acceptable to DHA. IDEMIA was advised to reconsider its proposal and revert to DHA with an improved settlement offer and to date no revised proposal has been received and DHA is still withholding an invoice of R8m until the penalties dispute has been settled. The switch over to ABIS took place on 08 September 2023.

Discussion
Mr A Roos (DA) said that the Committee and DHA agreed that they would save this project, and this was based on a statement in Parliament on 5 March 2019 when Parliament was told that HANIS was obsolete. When Minister Gigaba launched this project, he stated that one of the major challenges faced was the imminent collapse of the 20-year-old biometrics database. He asked for clarity on which functionalities have been activated and gone live and when exactly the whole system will go live. He asked if ABIS is currently able to perform facial recognition and latent searches as detailed in the tender. He asked if all the data has been migrated to ABIS in its totality in a readily usable form with no duplication of data.

He asked if there are concerns about  the integrity of the data, and if there are, for what period will HANIS and ABIS have to run concurrently before potential data integrity challenges will be deemed to be over.

When the project was launched, one of the major factors was that banks would be able to verify client identity quickly. Is ABIS an improvement on the existing performance derived from HANIS? Does ABIS support the integration of various interface applications for live capture, NPR, integrated justice system, national immigration identification system, online verification, and commercial online verification?

The project has been delayed for four years and ten months. How much money has been spent on the maintenance and improvements of HANIS after the original ABIS go-live date, which was November 2018? DHA reported a total spend of R280.87 million, and R113 million was spent on hardware, bearing in mind that the Committee has been informed that the hardware has a limited useful lifespan of five years. What percentage of that is hardware that has now already reached the end of its useful life and has that hardware been replaced or refreshed at some stage?

There was an original contract value of R409 million. The supply of ABIS would cost about R300 million and then maintenance, R110 million. About R129 million of the original value remains to be spent. What is going to happen to that R129 million, and what has been paid out to EOH so far?

He expected to hear more about fraud and corruption considering the shocking nature in which this project was awarded. On 25 August 2020, the Deputy Minister told the Committee that DHA is paying for this irregular contract with regular expenditure and that they faced hardship trying to resolve the issue and as such, no stone will be left unturned in dealing with the corrupt people. The SAB&T report of the 15 February 2021 recommended disciplinary action to be taken against numerous SITA and Home Affairs members and criminal action to be taken against members from EOH and SITA. He asked the Deputy Minister how many prosecutions had been instituted, how many convictions there had been, and how much had been recovered. About R37 million was supposed to be paid by EOH to DHA, has that amount been paid? He asked if it was possible to get an idea of the banks and other service providers that are using this service. To what extent is the data protected and encrypted end-to-end? How many transactions is each client doing per annum and how is this affecting the live civics system if at all?

Ms A Khanyile (DA) said that she had been largely covered by Mr Roos. She then asked how DHA is training and facilitating staff and other users such as banks on how to use the biometric system effectively and efficiently. Is there a provision within ABIS to have more offline functionality at frontline offices in the event of power downtime? The last question was how the ABIS project team ensured that the biometric data migration from the HANIS legal system was accurate, complete, and secure.

Ms M Molekwa (ANC) appreciated the presentation and hoped that a settlement between DHA and IDEMIA will be reached.

Mr K Pillay (ANC) appreciated the report and noted the progress that has been made. He asked when DHA envisages resolving the dispute about the penalty or outstanding payment and why they continued with IDEMIA in phase two knowing that they were not able to perform adequately and there were so many delays. On the data transfer to ABIS, did they lose any data and is the system strong enough to withstand fraud and corruption? He asked if ABIS was a faster system.

Mr B Bongo (ANC) said that the DHA was not clear how the project has yielded the fruits that were intended. He asked how far DHA had gone with the punitive measures to be taken against the EOH. The Committee advised that the matter be divided into two parts. The first part would be to explain all the challenges that were brought by the EOH and the second part was how to save the project. It is not clear if the project has been saved because the report from IDEMIA does not indicate any clear progress. It is also not clear how the project has moved on to phase two when phase one is incomplete. He asked for the costs involved and how they could be mitigated.

Ms M Modise (ANC) said that her colleagues have already dealt with most issues. She emphasised the question of security because everyone in the meeting is aware of the fraudulent activity that normally takes place in the system. The presentation did not address this sufficiently. She noted the 16% spending on the budget. Why has DHA not spent more? Is this not contributing to the delays?

DHA responses
Mr Mavuso replied that when ABIS was launched, the Committee was made to believe that HANIS was dead. He reminded the Committee that when HANIS started to have problems it was run by a company called Marpless. This company had two subcontractors, NEC and Bytes. NEC was responsible for hardware and Bytes was responsible for the software of HANIS. There were a lot of environmental challenges with HANIS at the time. In 2015, DHA requested Marpless give a proposal on how HANIS could be upgraded to make it more stable because there was no intention to acquire ABIS at the time.

Marpless came up with a proposal of R700 million and consequently, DHA decided that it would not be able to fund the project. The market could not fund a R700 million project without having even checked the market for other options. DHA went to SITA to appoint the SCIR to develop the specifications for a system that would be able to replace HANIS so it could go to the market. That is when the specifications for ABIS were developed. ABIS was then taken to the market to test the market, in accordance with public finance laws. The final three names that came up in the bid, through the procurement process, were EOH with a R409 million proposal, Accenture with about R500 million and NEC which was around R600 million. That was when the decision was taken to implement ABIS because of the issues with HANIS.

On HANIS still running to this day, in 2018 DHA received correspondence from Marpless and the company that was now maintaining this on a month-to-month basis, that they are leaving South Africa, so they are no longer prepared to sign the extension with DHA for HANIS annual support. DHA decided to ask the subcontractors if they could complete ABIS. They asked the subcontractors to continue maintenance for two more years while completing ABIS. They both agreed. The two subcontractors decided that NEC was going to lead and Bytes would be the subcontractor. That is how DHA got into the HANIS support and maintenance contract.

However , NEC gave a proposal that was very different from the initial proposal with Marpless. They said that they could do some tech refresh that will stabilise HANIS. Its team did that after an agreement was reached with DHA within the budget allocated for support and maintenance in 2019. That is why HANIS is still working to this day. They also came up with a proposal to upgrade HANIS to be at the same level of functionality as ABIS. Unfortunately, DHA was under contractual obligation at the time that the proposal was raised.

In terms of functionalities, the functionalities that have been activated currently are facial recognition, fingerprints and latent search. On Saturday when there was a test on facial recognition, there was only one case where the facial recognition was rejected. It turned out that it was somebody who was a naturalised citizen who was applying for a passport. That matter has been looked into so that it does not reject naturalised citizens.

On the data transfer, Mr Mavuso said that the HANIS data had been transferred but 71000 records were found in another HANIS subsystem. They are currently being requested and analyzed before they can be transferred.

On the hardware reaching the end of its life, Mr Mavuso said that IDEMIA bought extended warranties for the equipment to remain. Also, the budget for the project has not been exhausted. (Input could not be captured in full due to technical difficulties).

Director General Makhode spoke to the penalties for contracted parties unable to deliver on time, as provided in the master service agreement (MSA). Those penalties were imposed. DHA is waiting for IDEMIA to respond with an offer to resolve this. DHA will come back to the Committee on whether any data has been lost.

There were six DHA officials that were reported by SAB&T who needed to be taken through a disciplinary process. That process started some time ago. It is chaired by a senior counsel appointed by the State Attorney’s Office which has said that all matters should be finalised by 21 September.

Deputy Minister Nzuza said that DHA is currently running on ABIS as the primary platform and they are now observing the system’s stability, which means that the system is working. DHA is very strong when it comes to fighting corruption. That is why SAP&T was commissioned and DHA has presented the report to the Committee. Subsequently, DHA registered a case with the Hawks to investigate any potential criminal activity and the case number can be disclosed upon request. Having a senior counsel is also a direct indication of how seriously DHA takes these cases.

On saving the project, it was not only because HANIS was obsolete. DHA had already committed and spent resources on the project in the form of hardware and so on. As a result, ignoring it would have caused a major setback. It is also considered the shortest route towards deriving benefits. One of the key things that DHA has learned from this is that there is a general deficiency when it comes to state procurement when dealing with IT and this is being handled. These deficiencies make it hard to keep up with rapid advances in technology due to procurement processes being very slow as governed by the PFMA and the law.

On the second phase, DHA did explore the option of getting out of the contract, which was part of the MSA. They received a legal opinion that they do not have enough reason to exit the contract, but they are still monitoring the situation closely. Lastly, in terms of value for money, DHA has not paid for services that they have not received from the service provider.

Mr Mavuso spoke about how many transactions banks are doing per annum. There are two types of transactions. First, there is commercial verification where the bank has an API that is directly linked to HANIS. They do in the region of about three million verifications per month. Then there is a non-bio which is directly creating information from HANIS and NPR. These are bulk verifications that are received from banks. They get about [number inaudible] of those in a month. Multiplied by 12 that gives a number just over 100 million. Commercial verification is the fingerprint system you usually find in banks.

On the question of giving training to the banks, DHA does not give training [input could not be captured in full due to technical difficulties]. 

Further questions
Ms T Legwase (ANC) asked who will be responsible for the long-term functioning of ABIS.

Mr Roos asked if SAPS is now able to interrogate the database and use it to identify perpetrators. If not, when will it be complete? SAPS must have access to this data to be able to verify fingerprints. He asked again if the integrity of the data transferred from HANIS to ABIS had been confirmed. He was concerned that the disciplinary committees (DCs) are still ongoing because the SAB&T report was given on 15 February 2021. He asked what other service providers are accessing the data other than banks and if the data is secure end-to-end. Finally, he asked when phase three would be completed if phase two will only be complete in March 2024.

DHA response
Mr Mavuso replied that the integrity of the data had been verified. SAPS does not yet have access to latent search but the functionality was tested successfully over the weekend. SAPS will be able to utilize it soon. When the project started, phase three was not scoped or costed. It was about support and maintenance, and other innovations such as DNA which is a very important biometric for a country to have. But obviously there are ethical issues around DNA collection. A lot of research has been done to ensure that all international protocols on DNA collection are adhered to.

Mr Makhode requested that the question about the security and integrity of the data be dealt with offline because it is a security question about the systems of the country. If the question were to be answered on a public platform it would have huge implications for DHA.

The Chairperson acknowledged the progress in the report and on the concerns raised by the Committee. He thanked the DG and Deputy Minister for the report to update the Committee.

IEC Commissioner vacancy recommendation
The Chairperson noted that the term of one of the IEC commissioners lapsed in April 2023. The Speaker advised the Chief Justice to proceed with inviting candidates or members of society who are interested in serving as IEC commissioner. The Chief Justice dealt with the matter. The advert was released, interviews were carried out, and the process was guided by Section 6 of the Electoral Commission Act. The Committee was able to observe these candidates being interviewed. The background of each candidate shortlisted or recommended by the Chief Justice has been circulated. The Chief Justice has sent a letter to the Speaker on the process that was undertaken. 

The Chairperson commended the shortlisted candidates and said that all of them demonstrated good interaction with the panel.

The Committee Secretary, Mr Eddie Mathonsi, noted that a draft Committee Report has already circulated which is only missing the name of the candidate that will be recommended by the Committee. 

Ms Legwase said the ANC would like to recommend the candidate, Ms Janet Love, to serve as a Commissioner of the Independent Electoral Commission following the process that was undertaken by the Chief Justice in terms of Section 6 of the Electoral Commission Act 51 of 1966. She appreciated the work done by the Chief Justice. Ms Janet Love had strong academic qualifications that include a bachelor's degree in political science and industrial psychology, a master's degree in public financial management from the University of London, and several postgraduate diplomas from the University of Witwatersrand. Commissioner Love brings a wealth of experience in the Public Service and as a IEC Commissioner. She will provide continuity in the work of the Electoral Commission. 

Mr T Mogale (EFF) said that he had expected the questions posed to the candidates to be a bit more challenging considering South Africa is approaching a highly contested election next year. He would have loved to hear the views of the candidates on some of the things that could potentially emerge as challenges to this upcoming election. An important question would have been if they are going to contribute towards a high level of participation, especially by the youth. For this reason, the EFF will abstain from forwarding any name.

Mr Roos appreciated the Chief Justice for having done a good job. The DA was happy to support the nomination of Ms Love as IEC Commissioner as she is the most experienced and capable candidate for the role. She served as IEC Commissioner since 2016 and as Vice Chairperson of the IEC since 2018 and has always made solid contributions in her role.

Ms Molekwa, Mr Pillay, Mr Bongo, and Ms Legwase also recommended Ms Love as IEC commissioner for the same reasons.

The Chairperson noted that the Committee has considered recommending to the House, Ms Janet Love to serve as Commissioner.

He asked Mr Mathonsi to read out the draft report for adoption so that the Committee could then submit it to the National Assembly.

Mr Mathonsi read out the Committee Report on the filling of a vacancy in the Electoral Commission of South Africa, dated 12 September (see document).

Mr Bongo moved its adoption and Mr Roos seconded it.

IEC Commissioner salary determination
Mr Adam Salmon, Committee Content Advisor,  read the draft Committee Report on remuneration of IEC Commissioners, dated 12 September 2023  (see document). 

The Chairperson said that the Committee received the letter from the President referred by the Speaker on the salary determination of Chapter Nine institution office bearers. They need to consider the letter and refer it to the National Assembly for approval. He invited Members to comment on the proposed salary determinations.  

Ms Modise said that the Committee has no say in the salary determination of office bearers and requested that the Committee notes and recommends that the report be forwarded to the National Assembly for approval.

Mr Mogale said that the EFF are not going to support it.

Mr Pillay agreed with Ms Modise that the Committee cannot change the salary determination, but he supports it. Ms Molekwa, Mr Bongo and Ms Legwase also supported it. 

Committee business
The Committee adopted the 13 June minutes after noting the insertion that the Minister and Mr M Hendricks (Al Jama-ah) will report to the Committee after  Al Jama-ah senior counsel and the Minister's legal team have met to consolidate the regulations and ways to address the Member's concern.

The Chairperson requested that DHA indicate when Cabinet is going to approve the consequential amendments to the Electoral Amendment Bill in its next meeting so that Committee has a sense of where the matter is. 

Mr Mogale said that he had written a letter on behalf of the EFF to DHA two weeks ago requesting certain information and has not received any response.

The Chairperson said that he received that letter and has since sent it to DHA and should be expecting correspondence in the next meeting. He received confirmation from the Deputy Minister that the letter had been noted. 

The meeting was adjourned.