China Eximbank provides RMB 359 million government concessional loan for Integrated Government Information System (IGIS) Project

Project narrative

On December 23, 2010, China Eximbank and the Government of Papua New Guinea signed an RMB 359 million $53 million government concessional loan (GCL) agreement for the Integrated Government Information System (IGIS) Project. The borrowing terms of the GCL are unknown. However, it is known that the borrower was to use the proceeds of the GCL to finance a commercial contract between Telikom PNG Ltd — a state-owned telecommunications company in Papua New Guinea (PNG) — and Huawei Technologies Co., Ltd., which was signed on September 7, 2010. The purpose of the project was to develop a broadband infrastructure to link all government departments and agencies at the national and sub-national level and to establish a main data center to enable the operations of all government departments in an integrated cost-effective manner, working harmoniously together in a coordinated fashion for information sharing, archiving and storing data in a centrally secured environment. The 6 components to the project were: (1) Records and Data Management Services (RDMS); (2) Government Email; (3) Civil Registration; (4) IGIS Portal; (5) IGIS Data Center & Disaster Recovery Center; and (6) Project Management Office (PMO). Phase 1 of the project was carried out in 46 sites. 15 of these sites were installed with IGIS equipment. The first phase covered the metropolitan area in the National Capital District (NCD) and six other provinces (Central, Goroka, Wewak, Kimbe and Kokopo). The second phase involved extending coverage to other provinces and linking the districts with the main centers so that all would be integrated to complete the primary backbone. Huawei Technologies Co., Ltd. was the contractor responsible for implementation. The project commenced in June 2011 and officially reached completion on July 11, 2014. However, the data center in Port Moresby was not put into operation until 2018. The IGIS project was the subject of international controversy after an Australian media outlet leaked the findings of a report that was commissioned by the National Cyber Security Centre of PNG and funded by the Australian Department of Foreign Affairs and Trade (DFAT). The report noted the layout of the data center did not match the intended design, opening up major security gaps. "Core switches are not behind firewalls. This means remote access would not be detected by security settings within the appliances," it said. In cataloguing major security flaws, the report, also said the algorithm used for encrypting communications was considered "openly broken" by cyber security experts two years before being installed in Port Moresby. The Huawei firewalls in the data center reportedly reached their "end of life" in 2016, two years before the facility was opened. While the report suggested a deliberate effort by Huawei to deploy lax cyber security, it noted this plan was partially thwarted by the center quickly falling into disrepair, as insufficient money was set aside for maintenance and operations. This resulted in many PNG government departments not moving their data into the center as planned. The lack of an operating budget meant basic functions such as software licenses had expired, while batteries had degraded and were not replaced. To get the data center up and running again, Port Moresby sought financial assistance from the Australian government, a request that resulted in the report being commissioned.