ALMATY -- The involvement of a Kremlin-linked company in the implementation of Kazakhstan's digital governance platform is raising concerns over Russia's access to Kazakhs' personal data.
Kazakh Prime Minister Askar Mamin and Sberbank CEO Herman Gref on September 3 signed a memorandum of co-operation on Kazakhstan's digital transformation.
As a part of the memorandum, the Sber group -- a group of companies with close ties to the Kremlin -- is expected to implement the GovTech digital platform for the Electronic government of the Republic of Kazakhstan (egov.kz) website.
Under the deal, Sber will link all government agency databases to the same platform.
The website will contain personal information, including Kazakh citizens' health data, their family members, physical address, and information about their assets and tax payments.
Kazakhstan's information technology (IT) companies will help implement the platform, and prominent Kazakhs will join the commission to monitor the process, according to Minister of Digital Development Bagdat Musin.
The platform's estimated cost is about $500 million (213 billion KZT). Officials did not give a schedule for developing it.
"Some of this amount will be invested in the local IT market. Kazakh companies will receive this money as part of the work to implement a platform approach. Another part of that sum will go to infrastructure solutions. And only the remaining part will go to purchase the solution itself from Sber," Musin said September 14, without specifying the respective amounts.
Sber is organising sessions with specialists who will demonstrate how the platform works and will conduct trainings. Subsequently, only Kazakhs will work on it, Musin said.
Kazakhstan stipulated that it will receive the software as well as continuing technical support, he added.
'Alarming' risks
Kazakhs have misgivings in light of the notoriety of Russian government-backed hackers like the election-disrupting Internet Research Agency (IRA) in St. Petersburg.
In addition, Russian respect for Kazakhstan's boundaries, either physical or digital, is questionable, with members of the Russian parliament periodically questioning whether Kazakhstan is a legitimate country.
Entrusting a foreign company to develop the new e-government platform is alarming in itself, said Yerkegali Mashir, chief executive officer of the Azimut Solutions Group, an IT company in Almaty.
"Undoubtedly, Sber is a big company, but there are questions about its experience in implementing such projects," he said.
"Second, government services will be provided through GovTech, which implies communication with every IT system and all government data, and this is strategically important information," he said. "That's why I am pessimistic about this project's implementation by foreign software developers."
Kazakhstan can independently develop a platform for GovTech -- it just needs to commit time and money, he said.
Since the Kazakh government made the agreement to work with Sber, it is important to ensure the transfer of all of the new platform's source code to Kazakhstan, he said.
"Additionally, the deployment of the system itself should be handled by local specialists."
"After all, it is obvious that the GovTech platform itself is only 30% of the project," he said. "Seventy percent is implementing the systems themselves and state services."
"In order for everything to work as it should and not leak out of Kazakhstan, the question of controlling access to data must be taken very seriously," Mashir warned.
Although Musin says that user data will not be available to Sber, the company most likely will have access to some of the data belonging to government agencies, since the project entails full integration with a big-data platform, said Almaty-based backend developer Askhat Abdikary.
"That's why I am against the participation of a foreign company in a project that is so important for the state and the public," he said.
For example, a programmer writing the code for the project could create a back door and gain access, Abdikary said.
"I am not claiming that Sber will do just that," he said. "It's just that a developer participating in the integration has the opportunity."
Kazakh innovation
Some stakeholders say Kazakhstan should implement the project without the help of Sber.
Kazakhstan has the necessary skilled personnel, said Ablaykhan Adilbek, an Almaty resident and third-year student in the faculty of information technologies of Kazakh-British Technical University.
"For example, our Kaspi.kz, a technology company that floated its shares on the London Stock Exchange and attracted $1 billion from investors, became the most valuable company in Kazakhstan," he said.
"Demand for its shares surpassed giants of the Russian market such as Tinkoff Bank and Sberbank," he said. "This is an innovative domestic success story."
In regard to GovTech, Adilbek said he naturally wants, as an ordinary user, the e-government site to work well.
But from a data security perspective, the government agencies' databases linked to the website have so much sensitive personal information that he opposes having a non-Kazakh company involved.
"Sber is a company that operates at the B2G [business-to-government] level; that is, it has close contacts with the Russian government," he said. "That's why I don't consent to Russians having access to my data and the data of my loved ones."
"We must implement GovTech on our own," he said. "Kazakhstan has intelligent programmers to do this. Even if it won't be as fast as Sber, data security is an area where you should not rush."