By Karim Anjarwalla & Abdulmalik Sugow
So far in this series we have commented on several aspects of the upcoming general elections in Kenya. One of our articles, which was published on 8 July, focused on the Independent Electoral and Boundaries Commission’s (IEBC) election preparedness. In it, we discussed the IEBC’s supplier of the Kenya Integrated Elections Management System (KIEMS) kits, Smartmatic International Holding B.V (Smartmatic). Following our article, Samira Saba, Smartmatic’s Director of Communications, reached out to us seeking to set the record straight in relation to claims around the credibility of Smartmatic’s systems. In our article, we cited the Philippine Cybercrime Investigation and Coordination Centre’s conclusion that Smartmatic’s system was ‘compromised’. Smartmatic elaborated on this claim, stating that the finding by the Philippine authority related to a now former Smartmatic employee sharing non-sensitive day-to-day operational material with individuals outside the company who then proceeded to unsuccessfully try and extort Smartmatic. In addition to offering this explanation, Samira informed us that with election day approaching, the likelihood of misinformation is only likely to increase and as such, she was ‘at [our] disposal to clarify any doubts [we] may have about’ Smartmatic.
In the interest of transparency and considering recent news reports around Smartmatic, we took up Smartmatic’s invitation to clarify their role in Kenya’s elections. In this article, we interrupt our regular Road to 9/8 series to set out and analyse Smartmatic’s responses.
Scope of inquiry
Our queries to Smartmatic focused on three areas. First, we sought to have Smartmatic shed some light around its ownership structure and its contract with the IEBC. Second, we inquired about Smartmatic’s proposed activities in the elections, specifically focusing on whether they would be handling any voter data, the reliability of the results transmission module of the KIEMS kits, their system’s critical dependencies and fallbacks, and whether they had confirmed the condition of any legacy KIEMS kits from 2017 which the IEBC intends to reuse. Third, we asked them about the recent arrest of Venezuelan nationals affiliated with them, and their relationship with an entity mentioned in a press release by the Directorate of Criminal Investigations (DCI), Seamless Limited. You can find here the specific questions we posed to Smartmatic and their responses.
Who is Smartmatic?
In May 2021, the IEBC published an international tender seeking a service provider to supply, deliver, install, test, commission, support and maintain KIEMS kits for the 2022 elections. Following the tendering process, the IEBC awarded Smartmatic the contract. This decision was challenged at the Public Procurement Administrative Review Board by an interested tenderer, Risk Africa Innovatis, which alleged that the tender documents did not specify preference margins for local suppliers as required in public procurement law and also did not require international tenderers to acquire at least 40% of their supplies from local suppliers as required in the Public Procurement and Disposal Act. While the Public Procurement Administrative Review Board nullified the award and directed the IEBC to tender afresh, this was subsequently overturned by the High Court and Court of Appeal. While the IEBC may seem to have drastically cut costs, it is worth highlighting that it is only acquiring 14,100 KIEMS kits from Smartmatic, less than a third of the amount it acquired in 2017 (we understand from the IEBC that 41,000 kits are still functional).
When Smartmatic approached us, they introduced themselves as the ‘undisputed leader in the elections industry’, having ‘deployed election technologies in 31 countries.’ Founded in Florida in 2000, Smartmatic has gone on to notably provide technology for elections in Belgium and Norway, among other countries. They further cited accolades such as recognitions by the United Nations, European Union, and the Carter Centre. However, with the existence of news reports relating to Smartmatic’s ownership structure and bearing in mind the consequential role they are playing in Kenya’s democracy, we asked Smartmatic to provide us a with further detail on its organisational structure and ultimate beneficial ownership. We also asked if they would be willing to share its contract with the IEBC in the public interest.
In response, Smartmatic did not provide us with its ownership structure, only stating that Smartmatic Corporation is currently incorporated in Delaware, USA. Two of its founders, Antonia Mugica and Roger Piñate continue to run the company. By its own account, 83% of the shares in Smartmatic Corporation (which is the entity incorporated in the USA) are owned by SGO Corporation Limited, a holding company incorporated in the United Kingdom. SGO in turn is owned by the Mugica and Piñate families. The remaining shares in Smartmatic Corporation are held by employees and angel investors. According to the response we received, Smartmatic International Holding B.V.—the company which received the tender from the IEBC— ‘is part of this structure’. Smartmatic also declined to share its contract with the IEBC on the basis that confidentiality requirements prevented them from doing so.
From our own independent research, we can confirm that Smartmatic Corporation is a subsidiary of Smartmatic International Corporation which in turn is a subsidiary of Smartmatic International holding B.V which is incorporated in the Netherlands. We were unable to confirm the claims as to the specific position of SGO within Smartmatic’s structure in relation to other entities.
Elections are credible when the processes around them are transparent and capable of easy diligence. The KIEMS kits and the software relating to them are at the very heart of the election process. So Smartmatic are central to our elections. Being absolutely clear as to who Smartmatic is, what their corporate and governance structure is, their precise shareholding and their funding structure should be a matter of public record. The IEBC should have required this and should have shared this information with the public. We consider that even if they did not, Smartmatic should have volunteered this information in response to our request. Again, we request them to do so. We consider that it does not behove Smartmatic, whose business model is designed to be at the nerve centre of democratic transitions, to be less than fully transparent about such matters. Being less than full transparent creates a cloud of mistrust and uncertainty especially when one considers the history of Kenya’s elections particularly since 2002 and the palpable tensions that surround elections.
What is their role in the 2022 Kenyan elections?
In the run up to the forthcoming elections, there have been numerous news reports around the procurement of KIEMS kits and their reliability. For example, it was reported that once Smartmatic was awarded the contract by the IEBC, they had a challenge kicking off as the IEBC’s previous service provider, IDEMIA, allegedly held on to voter data due to a pending KES 800 million payment from the IEBC. A few months after, once the voter register was updated, the IEBC allegedly reported a failure rate of nearly 60% during a dry run of the results transmission system. Bearing these developments in mind, we sought to have Smartmatic clarify whether they would be handling voter data in accordance with the Data Protection Act, 2019 (DPA); whether, in addition to supplying new KIEMS kits, they had confirmed the condition of the remaining 41,000 KIEMS kits which the IEBC had procured in 2017; whether they would be willing to comment on the failure rate recorded during the dry run of the results transmission system; what critical dependencies their systems rely on; and what fallbacks they have in place.
Smartmatic, in a broad response to our queries, directed us to a press statement issued by the IEBC on 26 July, stating that they are not at liberty to publicly speak about the election process. We are unclear as to why Smartmatic believe they are not at liberty to speak about matters in the public domain. They refrained from commenting on the technical points regarding the reliability of the KIEMS kits, the failure rate, and their use of fallbacks. We consider that this is another missed opportunity by Smartmatic. However, in relation to their handling of voter data, Smartmatic stated that it ‘does not own or copy any personal data about voters in Kenya.’ They further went ahead to indicate that they are not in charge of processing results as the results are manually counted in each polling centre and tally reports are physically transported to tallying centres. By its account, Smartmatic does not play a role in any of these functions. Their KIEMS kits will only be used to transmit statutory tallying forms that are manually completed by the IEBC’s officers, not to tally any results. These tallying forms will be published by the IEBC on a public site and an official tally will be done manually in the tally centres.
Smartmatic’s account of the election process is broadly accurate, but major questions remain unanswered. In accordance with the Elections Act and its subsidiary legislation, the voting process begins when a voter is biometrically registered through a KIEMS kit prior to the elections. On election day, when a voter visits a polling station, they are identified using the KIEMS kit’s electronic voter identification system. After being identified, a voter is issued with stamped ballot papers which he/she then proceeds to mark accordingly and place in the correct ballot boxes. When one has cast their vote, this fact is recorded through the KIEMS kit. Tallying commences immediately voting ends and the presiding officer is required to complete the statutory Form 34A with the polling station’s tally which is also countersigned by each candidate’s agent. While the tallying process is entirely manual, the eventual tally must be keyed into the KIEMS kit’s results transmission system and a scan or photo of the Form 34A uploaded. The original Form 34A and ballot boxes are then transported to the Constituency Tallying Centre where all the results from each polling station within a constituency are tallied and recorded on the statutory Form 34B. Scans or photos of the Form 34B are also required to be transmitted through the KIEMS kit’s results transmission system. The ballot boxes, Forms 34A and 34B are all then transported to the National Tallying Centre where the Presidential Returning Officer is tasked with first verifying the electronically collated results in the Forms 34B against the results in the Forms 34A. Once this is in order, the Presidential Returning Officer must verify the results against the physically delivered forms. If the tallies match, the results are recorded in the statutory Form 34C, which is then the basis for declaring a winner for the presidential election.
While Smartmatic’s claim that it neither owns nor copies any voter data may be technically accurate, it does not entirely respond to our query relating to compliance with the Data Protection Act, 2019. In the tender for the supply of KIEMS kits, the IEBC specified that the successful bidder would be required to undertake voter data migration from the previous system to the new one. Further, KIEMS contains three modules: biometric voter registration, electronic voter identification and results transmission. Two of these modules directly involve the handling of voter data such as national identification numbers. Based on our understanding of the tender, the supplier of KIEMS kits is also required to provide the software which the kits will operate on and on election day, is also required to provide technical support in relation to both hardware and software. With this in mind, it seems unavoidable that Smartmatic will handle voter data. Its compliance with the DPA therefore remains an open question. In fact, the impasse with IDEMIA over voter data seems to confirm it. We must then think about its compliance with the obligation to register with the Data Commissioner, the provisions on cross border transfers of personal data, and, where it temporarily stores data, the requirement to maintain a server or a copy in Kenya. We point out that the IEBC has also contracted other service providers for among other things, maintenance services for its data centre, the supply, delivery and installation of network monitoring tools, the supply of the KIEMS network, and the supply of security information and event management, so Smartmatic is not solely responsible for the data life cycle.
On the reliability of the results transmission system, Smartmatic also did not respond. In the tender calling for bids for the supply of KIEMS kits, the IEBC specified that the successful entity (now Smartmatic) would be required to provide software support for all KIEMS kits, and as established, the KIEMS includes a results transmission module. Smartmatic did not respond to our request for comment on the failure rate recorded during the IEBC’s dry run. Further, they also did not confirm whether they verified the condition of the legacy systems owned by the IEBC. This leaves a host of open questions: since we presume the Smartmatic’s software will run on both the KIEMS kits they have supplied to the IEBC and on the legacy systems, how do we allocate responsibility for their proper functioning as between Smartmatic and the IEBC? How will we know whether the failure of an KIEMS kit to operate is attributable to IEBC or Smartmatic or whether the kit that failed was supplied by Smartmatic or was a legacy unit?
Who are they working with?
In late July, three Venezuelan nationals entering Kenya were arrested while in possession of election materials. The DCI confirmed the arrest of Joel Gustavo Rodriguez, Carmago Castellanos Jose Gregorio and Salvador Javier Suarez. According to the DCI, the trio attempted to enter Kenya while in possession of stickers used to label election elections equipment. It was apparently not immediately clear to the authorities that these individuals were employees of Smartmatic or agents of the IEBC. In the DCI’s press release, it was alleged that the individuals came to Kenya at the invitation of Abdullahi Abdi Mohamed, an individual associated with Seamless Limited. The IEBC responded to these events by issuing a press release confirming that the individuals were employees of Smartmatic and that the materials in their possession were non-strategic in nature. The IEBC went further to indicate that Smartmatic had a local partner in Kenya as required by the tender but did not specify who the partner was. We asked Smartmatic to confirm whether the three individuals were their employees. We also asked them to confirm whether they had procured the services of Seamless Limited, and if so, to shed some light on Seamless Limited’s specific role in the elections and its capacity to carry out this role.
Smartmatic confirmed that all three Venezuelan nationals were employees of Smartmatic, employed through one of its subsidiaries in Panama. All three have permanently resided in Panama for approximately 10 years and have worked on elections in several countries. In relation to the stickers in their possession, Smartmatic informed us that they were merely logistical in nature and not electoral material. They further indicated that the stickers ‘were printed according to the guidelines in the gazette notice published on July 1, 2022’ by the IEBC. Regarding its affiliation with Seamless Limited, Smartmatic declined to comment on the basis of having signed a non-disclosure agreement. Their exact quote was “As per NDA signed, we don’t comment on partners.”
The response provided by Smartmatic in relation to the stickers, while technically accurate, raises a few questions. For one, it is not clear why Smartmatic’s employees were carrying the stickers in their personal luggage. Further, it is also not clear on what basis Smartmatic was printing and supplying the IEBC with such stickers, yet it was not within the scope of the tender for the supply of KIEMS kits, and the IEBC is required to tender offers from the public for all supplies. For illustrative purposes, the IEBC has tendered for the supply of non-strategic election materials such as reflective jackets. The gazette notice which Smartmatic referenced only contains the official list of polling stations. It does not contain any guidelines for Smartmatic to adhere to.
In relation to Seamless Limited, the tender published by the IEBC required Smartmatic to provide proof of technical support staff with a local registered office in Kenya. This can either be directly or through a local partner. Aside from simply stating that Smartmatic needs local representation, IEBC’s tender document did not elaborate on the substantive quality of this representation and how Smartmatic ought to have procured the services of a local partner. In a press statement, the IEBC indicated that Smartmatic complied with this requirement and procured a local partner in Kenya. The IEBC did not name the local partner. News reporting alludes to this local partner being Seamless Limited. However, Smartmatic declined to confirm or deny this. We reached out to Seamless Limited for comment but are yet to receive a response as at the date of this publication. Based on information that is publicly available on its website, Seamless Limited provides enterprise IT systems, collaborative tools, and IT security solutions. Seamless began as a partnership in 2010 but was later incorporated as a private company in 2014. The key individual—Abdullahi Abdi Mohamed—has seemingly gone under the radar, deleting his LinkedIn profile. Again, both the IEBC and Smartmatic are failing to be as transparent as we consider they should be in the context of a democratic election process. We not consider that relying on an NDA (non disclosure agreement) are good grounds for refusing to even confirm the identity of the local partner that Smartmatic has chosen to work with. Smartmatic could have chosen to simply deny any connection with the entity known as Seamless Limited. They have not done so. So, we have no option but to assume that Seamless Limited is Smartmatic’s local partner. If so, then who is Seamless? What qualifies them to also be at the heart of our democratic process? What is their precise role in the forthcoming elections? How do we hold them accountable for this role? We have no answers to any of these questions.
Conclusion
We have previously commented on the IEBC and described it as an institution, institutionally designed to fail. Nothing has happened since we published that article to make us think otherwise. Section 81 of our Constitution requires our elections to be “transparent” and “administered in an impartial, neutral, efficient, accurate and accountable manner”. Section 86 of the Constitution requires the IEBC to ensure that “whatever voting method is used, the system is simple, accurate, verifiable, secure, accountable and transparent”. As Kenyans vote in what is likely to be one of the more consequential elections in the country’s history, they deserved to have clarity around who their elections management body trusts to administer key processes. Full clarity from the IEBC and Smartmatic on the ownership, corporate structure, funding and governance structure of Smartmatic were necessary for these constitutional thresholds to be met. It should have been easy and simple to do. It has not been done. The role of Seamless Limited remains more than opaque, with Smartmatic referring to and NDA and the IEBC referring to a local partner but not naming that local partner. Kenyans can draw their own conclusions about this obfuscation. IEBC and Smartmatic should both be able to confirm who the “local partner” is and what their precise role is. Why the subterfuge? What possible useful purpose does it serve in a democratic nation? Many questions, not too many answers and only 5 days to go. It all seems so sadly familiar.
Add comment