PLANS by Ministry of Transport and Infrastructural Development officials to engage a Nigerian firm to be linked to a Zinara vehicle database for purposes of computerising third party insurance cover notes could pose a serious security threat to Zimbabwean motorists by giving the company access to private information.
Fears abound if the deal to engage the controversial firm, Courtville Investment, sails through, the company could create a parallel vehicle registration database that might pose security risks for ordinary motorists and public officials.
Courtville Investment’s servers are reportedly housed by another private company, RACKSPACE, in the United States of America and Europe.
The database, a replica of the Central Vehicle Registry’s, would have ownership details of motorists such as name, residential address, national identification number, make and model of vehicle, registration and chassis number and value of the vehicle.
If that database is tampered with, a motorist would be exposed to serious security risk such as theft and kidnapping.
According to impeccable sources in Government, Courtville Investment intends to modify its Nigerian system and adapt it to Zimbabwe. Courtville officials were reportedly in the country last week to negotiate the deal.
It is alleged the Nigerian company was not subjected to rigorous security vetting and clearance for an organisation seeking access to such confidential personal data. It reportedly has a dirty history from its operations in Sierra Leone.
Although Transport and Infrastructural Development Minister Dr Joram Gumbo, through an official from his office, on Tuesday said he was not aware of any such deal, our Harare Bureau is in possession of a letter he wrote to Courtville Investment on August 22, 2016 on the matter.
Part of the letter reads: “I can confirm that I am available to meet with yourselves as per your request on Thursday 25 August 2016 at 1000 hours”.
A Ministry source close to the deal said: “The proposed system operates on a web-based platform and uses cloud-based technology to store data.
“The Courtville Investment system will request the registration number of a vehicle from insurance companies and check it from the Zinara database. If it exists, they will copy it and create a database where vehicle owners can purchase insurance.
“This database will be stored in their cloud-based servers, which reside with RACKSPACE, hosted in Europe and the United States of America.
Once the vehicle has purchased insurance in the system, the Courtville system will send the data to the Zinara system and adjust the vehicle record to say it is insured.
Another source said: “There are a number of dangers posed by this kind of arrangement – first being that data would be held in a cloud server.
Cloud computing is a subscription-based service where you can obtain networked storage space and computer resources.
“Secondly, classified personal data will be consolidated into one database managed and controlled by a third party who happens to be a foreign company. Protection of privacy of individual information will be compromised and reliability of cloud services in Africa and the poor connectivity in Zimbabwe are another cause for serious concern. What happens to Zinara’s revenue collection should the system fail or collapse?
“The vehicle database of any country is part and parcel of strategic assets of the country. It is imperative that this critical data is kept in the hands of Government which must have full control.”
Digital Society of Zimbabwe coordinator Mr Chris Musonza said it would be interesting to see how the Nigerian company wins the contract.
“It is something dangerous. Are we saying there are no locals who can develop such a system, including CVR itself?” he said.
“Under our Constitution, people have a right to privacy and the Data Protection Bill, which is being crafted, also seeks to guarantee personal privacy. It would be interesting to see how that is applied beyond Zimbabwe’s juristic parameters.”
Another IT expert who refused to be named said: “Whether Nigerian or local, no company should have access to database of ownership. From ownership details one can target an individual for either hijack, robbery or assassination. So the security threat is not limited to Government but to all Zimbabweans.
Furthermore, this company was not vetted and there are reports that in Sierra Leone, it gave a false address and when checks were made by the authorities, it was discovered that its physical address was just an open space.”
Information at hand shows that in Sierra Leone where Courtville once operated, the company compromised the internal security of the country as information from vehicle owners, drivers and insurance companies was processed in Nigeria.
In less than six months after signing the contract, Courtville Investment proved its incompetence to deliver, thereby causing embarrassment to the Government and inconvenience to customers of the Sierra Leone Road Transport Authority where long queues became the order of the day.
Efforts to get a comment from Zinara director of operations and human resources Mr Precious Murove were fruitless as his phone went unanswered. Courtville Investment did not respond to emailed questions on whether they were engaged in talks with the Ministry of Transport over a vehicle insurance database.