HP likely to keep population census project without tender

Details of a population survey leaked onto the Internet, the state comptroller warned in a report issued earlier this year. Despite Comptroller Micha Lindenstrauss' biting criticisms, the Interior Ministry received permission from the Finance Ministry and the census administration to negotiate a three-year extension to the systems maintenance contract exclusively with the present systems operator, HP, without holding a tender process.

The contract is worth about NIS 24 million. HP's present contract expires in November.

Meanwhile, the Finance Ministry published documents showing that it's starting work on a tender to build a new population census system. But the new system, at a cost of about NIS 150 million, won't hit the road for another three years, until which time HP will apparently continue to run the existing one.

The original contract to create and run the existing system was won by a company called Digital back in 1993. Responsibility for the system subsequently passed to Compaq, which acquired Digital in 1998, and then to HP, which bought Compaq in 2002. To this day the system runs on Digital computers, which are most likely not compatible with modern technological requirements.

The state comptroller pointed to the various mergers between the companies as the source of evil vis-a-vis the leak of information to the Internet.

However, the teleprocessing committee at the Finance Ministry, which operates under the auspices of the accountant general, recommended that HP remain in charge of the system for the time being, until the new tender is completed. However, awarding the contract to HP again is contingent on changes in its business model, to prevent further leaks of data.

Under the present business model, HP charges a service fee for each inquiry made from the database. The fee can range from 40 agorot to NIS 1.25, depending on the extent of the information required. Another service enables the ministries to ask for information based on breakdowns. Alternatively, ministries can ask for copies of the census, which they can store on their own computer systems, thus avoiding the need to pay individually for each inquiry.

The upshot has naturally been that the various ministries have downloaded the census data and kept it on their own systems. Hundreds of copies are believed to have been disseminated over time, if not more, which in itself begs security breaches. Hence the leak to Internet.

Also, many of the files that the ministries store are outdated.

Based on the explanations behind allowing the Interior Ministry to negotiate exclusively with HP, that company has made about NIS 100 million in revenues so far from the establishment and operation of the system.

The information that leaked contains all the identity card (teudat zehut) numbers of all Israeli citizens, their marital status, their addresses, their date of birth and their family relations.

The comptroller underscored problems with encryption and password management, among other things.

Following suspicions that its system had been violated, the Interior Ministry complained to the police. The investigation, conducted from May to November 2008, found that 20 bodies receive routine updates, and that the relevant files had been freely passed around the Internet. The police finally wound down the investigation, says Lindenstrauss, claiming that there were simply too many suspects using the database to narrow down the leakers.