So far in this series we have commented on several aspects of the upcoming general elections in Kenya. One of our articles, which was published on 8 July, focused on the Independent Electoral and Boundaries Commission’s (IEBC) election preparedness. In it, we discussed the IEBC’s supplier of the Kenya Integrated Elections Management System (KIEMS) kits, Smartmatic International Holding B.V (Smartmatic). For the reader’s benefit, KIEMS refers to the integrated elections management system which the IEBC is required by law to deploy in all elections. It comprises biometric voter registration, electronic voter identification and results transmission – a combination of both hardware and software. Following our article, Samira Saba, Smartmatic’s Director of Communications, reached out to us seeking to set the record straight in relation to claims around the credibility of Smartmatic’s systems. In our article, we cited the Philippine Cybercrime Investigation and Coordination Centre’s conclusion that Smartmatic’s system was ‘compromised’. Smartmatic elaborated on this claim, stating that the finding by the Philippine authority related to a now former Smartmatic employee sharing non-sensitive day-to-day operational material with individuals outside the company who then proceeded to unsuccessfully try and extort Smartmatic. In addition to offering this explanation, Samira informed us that with election day approaching, the likelihood of misinformation is only likely to increase and as such, she was ‘at [our] disposal to clarify any doubts [we] may have about’ Smartmatic.
In the interest of transparency and considering recent news reports around Smartmatic, we took up Smartmatic’s invitation to clarify their role in Kenya’s elections. In this article, we interrupt our regular Road to 9/8 series to set out and analyse Smartmatic’s responses.
But let us first set the constitutional context. Article 81 of our Constitution requires our elections to be “transparent” and “administered in an impartial, neutral, efficient, accurate and accountable manner”. Article 86 of the Constitution requires the IEBC to ensure that “whatever voting method is used, the system is simple, accurate, verifiable, secure, accountable and transparent”.
Has the IEBC and its relationship with Smartmatic met these constitutional tests?
Scope of inquiry
Our queries to Smartmatic focused on the following areas. First, we asked Smartmatic to shed some light around its ownership structure and its contract with the IEBC. Second, we inquired about Smartmatic’s proposed activities in the elections, specifically focusing on whether they would be handling any voter data, the reliability of the results transmission module of the KIEMS kits, their system’s critical dependencies and fallbacks, and whether they had confirmed the condition of any legacy KIEMS kits from 2017 which the IEBC intends to reuse. This is particularly relevant as, according to the publicly available tender document, the scope of Smartmatic’s mandate extends to providing the software which will run on all the KIEMS kits in the IEBC’s possession, not just those Smartmatic supplies. Finally, we asked Smartmatic about the recent arrest of Venezuelan nationals affiliated with them, and their relationship with an entity mentioned in a press release by the Directorate of Criminal Investigations (DCI), Seamless Limited. You can find here the specific questions we posed to Smartmatic and their responses.
Who is Smartmatic?
In May 2021, the IEBC published an international tender seeking a service provider to supply, deliver, install, test, commission, support and maintain KIEMS kits for the 2022 elections. Following the tendering process where five entities put in their bids, the IEBC awarded Smartmatic the contract. This decision was challenged at the Public Procurement Administrative Review Board by an interested tenderer, Risk Africa Innovatis, which alleged that the tender documents did not specify preference margins for local suppliers as required in public procurement law and also did not require international tenderers to acquire at least 40% of their supplies from local suppliers as required in the Public Procurement and Disposal Act. While the Public Procurement Administrative Review Board nullified the award and directed the IEBC to tender afresh, this was subsequently overturned by the High Court and Court of Appeal on the basis that Risk Africa Innovatis technically did not have standing as it did not put in a bid. With the legal challenge out of the way, the IEBC proceeded to sign a contract with Smartmatic. We understand from the IEBC, that the value of this contract is approximately KES 3.2 billion. For comparative purposes, the IEBC’s contract with Safran Identity and Security SAS (now IDEMIA) in 2017, costed USD 39.9 million (KES 4.3 billion at the exchange rate prevalent in 2017) and entailed the supply of 45,000 KIEMS kits. While the IEBC may seem to have cut costs, it is worth highlighting that it is only acquiring 14,100 KIEMS kits from Smartmatic, less than a third of the amount it acquired in 2017. We understand from the IEBC that 41,000 kits which it acquired in 2017 are still functional. Whilst such contracts may differentiate between the price of hardware, software and support and maintenance, a back of the envelope approach to pricing based on the number of KIEMS kits supplied would suggest that Smartmatic is materially more expensive than IDEMIA.
When Smartmatic approached us, they introduced themselves as the ‘undisputed leader in the elections industry’, having ‘deployed election technologies in 31 countries.’ Founded in Florida in 2000, Smartmatic has gone on to notably provide technology for elections in Belgium and Norway, among other countries. They further cited accolades such as recognitions by the United Nations, European Union, and the Carter Centre. However, with the existence of news reports relating to Smartmatic’s ownership structure and bearing in mind the consequential role they are playing in Kenya’s democracy, we asked Smartmatic to provide us a with further detail on its organisational structure and ultimate beneficial ownership. We also asked if they would be willing to share its contract with the IEBC in the public interest.
We understand from the IEBC that 41,000 kits which it acquired in 2017 are still functional.
In response, Smartmatic did not provide us with its ownership structure, only stating that Smartmatic Corporation is currently incorporated in Delaware, USA. Two of its founders, Antonio Mugica and Roger Piñate run the company. By its own account, 83% of the shares in Smartmatic Corporation (which is the entity incorporated in the USA) are owned by SGO Corporation Limited, a holding company incorporated in the United Kingdom. SGO in turn is owned by the Mugica and Piñate families. The remaining shares in Smartmatic Corporation are held by employees and angel investors. According to the response we received, Smartmatic International Holding B.V.—the company which received the tender from the IEBC— ‘is part of this structure’. Smartmatic also declined to share its contract with the IEBC on the basis that confidentiality requirements prevented them from doing so.
A publicly available search on SGO Corporation reveals that it had, as directors, Lord Malloch Brown, but he resigned on 4th December, 2020, Sir Nigel Knowles but he resigned on 18th May, 2021 and David Giampaolo but he resigned on 9th August, 2017. As far as we can tell SGO Corporation Limited only has two directors, Antonio Mugica and Roger Piñate. From what we can tell, when Sir Nigel Knowles, Lord Malloch Brown and David Giampolo resigned, they were not replaced by other independent directors.
Elections are credible when the processes around them are transparent and capable of easy diligence. The KIEMS kits and the software relating to them are at the very heart of the election process. So Smartmatic are central to our elections. Being absolutely clear as to who Smartmatic is, what their corporate and governance structure is, their precise shareholding and their funding structure should be a matter of public record. The IEBC should have required this and should have shared this information with the public. We consider that even if the IEBC did not, Smartmatic should have volunteered this information in response to our request. Again, through this article, we request them to do so. We consider that it does not behove Smartmatic, whose business model is designed to be at the nerve centre of democratic transitions, to be less than fully transparent about such matters. Being less than fully transparent creates a cloud of mistrust and uncertainty especially when one considers the history of Kenya’s elections particularly since 2002 and the palpable tensions that surround elections. This is all the more the case because Smartmatic, on their website, proclaim that “transparency is at the core of what we do”. Yet the company that ultimately owns Smartmatic only has the founders as directors and does not have any independent directors. One can expect robust corporate governance when independent directors are present and the likelihood of less robust corporate governance when they are absent.
What is Smartmatic’s role in the 2022 Kenyan elections?
In the run up to the forthcoming elections, there have been numerous news reports around the procurement of KIEMS kits and their reliability. For example, it was reported that once Smartmatic was awarded the contract by the IEBC, they had a challenge kicking off as the IEBC’s previous service provider, IDEMIA, allegedly held on to voter data due to a pending KES 800 million payment from the IEBC. A few months after, once the voter register was updated, the IEBC allegedly reported a failure rate of nearly 60% during a dry run of the results transmission system. Bearing the recent developments in mind and considering the importance of these kits, we sought to have Smartmatic clarify whether they would be handling voter data in accordance with the Data Protection Act, 2019 (DPA); whether, in addition to supplying new KIEMS kits, they had confirmed the condition of the remaining 41,000 KIEMS kits which the IEBC had procured in 2017; whether they would be willing to comment on the failure rate recorded during the dry run of the results transmission system; what critical dependencies their systems rely on; and what fallbacks they have in place.
Smartmatic, in a broad response to our queries, directed us to a press statement issued by the IEBC on 26 July, stating that the IEBC is the only entity at liberty to speak authoritatively about the election process. We are unclear as to why Smartmatic believe they are not at liberty to speak about matters in the public domain. They also refrained from commenting on the technical points regarding the reliability of the KIEMS kits, the failure rate, and their use of fallbacks. We consider that this is another missed opportunity by Smartmatic. In relation to their handling of voter data, Smartmatic stated that it ‘does not own or copy any personal data about voters in Kenya.’ They further went ahead to indicate that they are not in charge of processing results as the results are manually counted in each polling centre and tally reports are physically transported to tallying centres. By its account, Smartmatic does not play a role in any of these functions. Their KIEMS kits will only be used to transmit statutory tallying forms that are manually completed by the IEBC’s officers, not to tally any results. These tallying forms will be published by the IEBC on a public site and an official tally will be done manually in the tally centres.
It was reported that once Smartmatic was awarded the contract by the IEBC, they had a challenge kicking off as the IEBC’s previous service provider, IDEMIA, allegedly held on to voter data due to a pending KES 800 million payment from the IEBC.
Smartmatic’s account of the election process is broadly accurate, but major questions remain unanswered. In accordance with the Elections Act and its subsidiary legislation, the voting process begins when a voter is biometrically registered through a KIEMS kit prior to the elections. On election day, a voter is identified using the KIEMS kit’s electronic voter identification system. After being identified, they vote and are marked, through the KIEMS kit, as having voted. Tallying commences immediately voting ends and the presiding officer is required to complete the statutory Form 34A with the final result of the vote. While the tallying process is entirely manual, the eventual tally must be keyed into the KIEMS kit’s results transmission system and a scan or photo of the Form 34A uploaded. The same process is replicated cumulatively at the constituency and national levels with the Forms 34B and 34C respectively. All ballot papers and physical copies of the forms are delivered to the national tallying centre for verification before a declaration is made.
While Smartmatic’s claim that it neither owns nor copies any voter data may be technically accurate, it does not substantively respond to our query relating to compliance with the Data Protection Act, 2019. In the tender for the supply of KIEMS kits, the IEBC specified that the successful bidder would be required to undertake voter data migration from the previous system to the new one. Further, KIEMS contains three modules: biometric voter registration, electronic voter identification and results transmission. Two of these modules directly involve the handling of voter data such as national identification numbers. Based on our understanding of the tender, the supplier of KIEMS kits is also required to provide the software which the kits will operate on and on election day, is also required to provide technical support in relation to both hardware and software. With this in mind, it seems unavoidable that Smartmatic will handle voter data. Its compliance with the DPA therefore remains an open question. In fact, the impasse with IDEMIA over voter data seems to confirm it. We must then think about its compliance with the obligation to register with the Data Commissioner, the provisions on cross border transfers of personal data, and, where it temporarily stores data, the requirement to maintain a server or a copy in Kenya. We point out that the IEBC has also contracted other service providers for among other things, maintenance services for its data centre, the supply, delivery and installation of network monitoring tools, the supply of the KIEMS network, and the supply of security information and event management, so Smartmatic is not solely responsible for the data life cycle.
On the reliability of the results transmission system, Smartmatic also did not respond. In the tender calling for bids for the supply of KIEMS kits, the IEBC specified that the successful entity (now Smartmatic) would be required to provide software support for all KIEMS kits, and as established, the KIEMS includes a results transmission module. Smartmatic did not respond to our request for comment on the failure rate recorded during the IEBC’s dry run. Further, they also did not confirm whether they verified the condition of the legacy systems owned by the IEBC. This leaves a host of open questions: since we presume the Smartmatic’s software will run on both the KIEMS kits they have supplied to the IEBC and on the legacy systems, how do we allocate responsibility for their proper functioning as between Smartmatic and the IEBC? How will we know whether the failure of an KIEMS kit to operate is attributable to IEBC or Smartmatic or whether the kit that failed was supplied by Smartmatic or was a legacy unit? Is Smartmatic’s limited responses consistent with their public proclamation that “transparency is at the core of what we do”.
Who are they working with?
In late July, three Venezuelan nationals entering Kenya were arrested while in possession of election materials. The DCI confirmed the arrest of Joel Gustavo Rodriguez, Carmago Castellanos Jose Gregorio and Salvador Javier Suarez. According to the DCI, the trio attempted to enter Kenya while in possession of stickers used to label election elections equipment. It was apparently not immediately clear to the authorities that these individuals were employees of Smartmatic or agents of the IEBC. In the DCI’s press release, it was alleged that the individuals came to Kenya at the invitation of Abdullahi Abdi Mohamed, an individual associated with Seamless Limited. Little is known about Abdullahi Abdi Mohamed and his LinkedIn profile has been deleted. The IEBC responded to these events by issuing a press release confirming that the individuals were employees of Smartmatic and that the materials in their possession were non-strategic in nature. The IEBC went further to indicate that Smartmatic had a local partner in Kenya as required by the tender but did not specify who the partner was. We asked Smartmatic to confirm whether the three individuals were their employees. We also asked them to confirm whether they had procured the services of Seamless Limited, and if so, to shed some light on Seamless Limited’s specific role in the elections and its capacity to carry out this role.
Smartmatic confirmed that all three Venezuelan nationals were employees of Smartmatic, employed through one of its subsidiaries in Panama. All three have permanently resided in Panama for approximately 10 years and have worked on elections in several countries. In relation to the stickers in their possession, Smartmatic informed us that they were merely logistical in nature and not electoral material. They further indicated that the stickers ‘were printed according to the guidelines in the gazette notice published on July 1, 2022’ by the IEBC. Regarding its affiliation with Seamless Limited, Smartmatic declined to comment on the basis of having signed a non-disclosure agreement. Their exact quote was “As per NDA signed, we don’t comment on partners.”
The response provided by Smartmatic in relation to the stickers, while technically accurate, raises many questions. For one, it is not clear why Smartmatic’s employees were carrying the stickers in their personal luggage. Further, it is also not clear on what basis Smartmatic was printing and supplying the IEBC with such stickers, yet it was not within the scope of the tender for the supply of KIEMS kits, and the IEBC is required to tender offers from the public for all supplies. For illustrative purposes, the IEBC has tendered for the supply of non-strategic election materials such as reflective jackets. The gazette notice which Smartmatic referenced only contains the official list of polling stations. It does not contain any guidelines for Smartmatic to adhere to.
In relation to Seamless Limited, the tender published by the IEBC required Smartmatic to provide proof of technical support staff with a local registered office in Kenya. In a press statement, the IEBC indicated that Smartmatic complied with this requirement and procured a local partner in Kenya. The IEBC did not name the local partner. News reporting alludes to this local partner being Seamless Limited. However, Smartmatic declined to confirm or deny this. We reached out to Seamless Limited for comment but are yet to receive a response as at the date of this publication. As far as we can tell, its website is generic in nature and does not refer to its role in the elections. The phone number quoted does not connect. Its offices are based, it appears, in a co-working space.
Again, both the IEBC and Smartmatic are failing to be as transparent as we consider they should be in the context of a democratic election process. We do not consider that relying on a non-disclosure agreement (NDA) is a good ground for refusing to even confirm the identity of the local partner that Smartmatic has chosen to work with, more so considering that Seamless did not consider itself bound by this NDA and confirmed its relationship with Smartmatic in a statement to the press. Smartmatic could have chosen to simply deny any connection with the entity known as Seamless Limited. They have not done so. So, we have no option but to assume that Seamless Limited is Smartmatic’s local partner, especially since news reports suggest that Abdullahi Mohamed has confirmed the existence of a relationship between Seamless Limited and Smartmatic. If so, then who is Seamless? What qualifies them to also be at the heart of our democratic process? What is their precise role in the forthcoming elections? How do we hold them accountable for this role? We have no answers to any of these questions.
Conclusion
As Kenyans vote they deserve full adherence to the Constitution by the IEBC. A clear picture from the IEBC and Smartmatic on the ownership, corporate structure, funding, and governance structure of Smartmatic were necessary for these constitutional thresholds to be met. It should have been easy and simple to do. It has not been done. The role of Seamless Limited remains more than opaque, with Smartmatic referring to an NDA and the IEBC referring to a local partner but not naming that local partner. Kenyans can draw their own conclusions about this obfuscation. IEBC and Smartmatic should both be able to confirm who the “local partner” is and what their precise role is. Many questions, not too many answers and only days to the election. It all seems so sadly familiar.
–
This article was published in collaboration with Africa Uncensored.
