Question NW697 to the Minister of Justice and Correctional Services

Reply:

The Department of Justice and Constitutional Development (DoJ&CD) has engaged the Council for Scientific and Industrial Research (CSIR) to undertake a forensic investigation into the failures experienced by the DoJ&CD in respect of MojaPay system. The CSIR advised that they have the requisite skills to assist the Department, however, it was recommended that the Department of Correctional Services (DCS) be engaged for the participation by the DoJ&CD in the Memorandum of Understanding (MoU) which was signed between the CSIR and DCS.

1.1 A review of the DCS-CSIR MOU, in particular Service Programme 4, yielded that the Department could not utilise the said MOU because the deliverables/services did not make provision for a Forensic Investigation as was required by the Department as it only made provision for a service where the following high level deliverables are required:

(a) Current State Assessment;

(b) Future State; and

(c) GAP Analysis and Roadmap.

1.2 In light of the above, the DoJ&CD embarked on an exercise to determine the root cause, through the Major Incident Process of the Department, which was duly undertaken and completed.

1.3 It was determined that the root cause was Data Corruption as a result of the Database Administrator (DBA) of the Service Provider, having chosen an incorrect option in the Client Copy Process which should have been from the Quality Assurance (QA) Server to the Production Server (human error) instead of choosing from the Production Server to the QA Server. This led to the crash of the Production Server.

1.4 The solution could not be restored as per the prescribed Disaster Recovery timelines, primarily due to incomplete backups (system error on backups) which led to delays in getting the system functional. To reduce the restoration timelines, a process to copy the data on the servers to external hard drives had to be undertaken to restore the data.

1.5 The Department has implemented interventions from key lessons learnt to mitigate against possible future failures and recovery timelines such as:

• Performing regular (scheduled) backup restore tests;
• Optimizing the backup processes; and
• Enabling active-active failover capabilities for MojaPay (from Primary Datacentre to the Secondary Datacentre).

END