Neglecting data centres poses a growing threat to government operations and security

The government’s decision to shut down the National Information Technology Center (NITC) has not yet been implemented. Due to an inadequate implementation plan, the decision, which was supposed to take effect in July, has proven ineffective.

In the budget for the fiscal year 2023/24, it was announced that the NITC would be abolished, and all of its functions would be transferred to the Department of Information Technology starting in July. This announcement has confused the operation and management of the government’s data centre.

However, with the NITC having already received its budget allocation for the current fiscal year, the ministry is now actively seeking a compromise decision to scrap it entirely.

An overhaul needed

An official from the ministry has stated that the NITC will not be abolished immediately. Instead, preparations are underway to establish a new organisational structure for its operation and management.

“There is pressure from many sides not to shut down NITC,” says an official of the Ministry of Communication and Information Technology. “Under the banner of NITC, we are now creating an organisational structure to keep its leadership and operational modality under the direct supervision of the government.”

According to the government’s latest idea, the NITC will no longer have an executive director appointed by political parties. The ministry is advocating for the Department of Information Technology to take charge of the operation and management of the NITC. However, there remains a lingering question about whether the department is equipped to handle these responsibilities.

Services such as integrated office management systems, government cloud (G cloud), and e-attendance systems provided by the Department of Information Technology are facing operational issues as different government agencies are not satisfied with the performance of these systems.

Given these circumstances, the government is not in a position to remove more than 60 NITC employees, even if the organisation is slated to be scrapped.

The Ministry of Communication and Information Technology has thus far focused on discussions regarding the operation and management of NITC. According to the spokesperson of the Ministry, Netra Prasad Subedi, they are currently in the process of working out the details for the implementation of the budget announcement concerning NITC. He mentioned that the specific implementation plan has not yet been finalised but will be decided in the near future.

Furthermore, NITC faces deficiencies in maintaining accurate equipment records for service offices, neglects to analyse server capacity in accordance with customer demand, and overlooks quality testing for data centres. Additionally, critical responsibilities such as managing software licenses, assessing hardware lifespan and ensuring backup power sources are also frequently disregarded.

The recent report from the Auditor General underscores major concerns within the centre. These include the absence of crucial information regarding agencies utilising colocation services and the maintenance schedules for fire extinguishers.

Internal and technical audits have been overlooked, and there has been a lack of diligence in performing critical quality tests for data centres that house sensitive government information. Additionally, the centre falls short of implementing internationally recognised security standards for multilateral data security measures.

Ensuring server security is paramount, and it is typically achieved through nationally or internationally recognised assessments such as the ISO 27001 certification. However, the centre has demonstrated limited interest in conducting routine internal and external assessments, despite the widely acknowledged importance of such measures.

Officials of the Ministry expressed their suspicion that NITC will have to be revived by issuing formation orders like the Melamchi Water Development Committee. It was announced in the budget of the current fiscal year that the work of the Melamchi water supply project will be brought under the Department of Water Supply and Sewerage Management. However, after the cancellation of the committee, the rest of Melamchi’s work could not proceed, and the government had to decide to revive it.

The challenges

NITC is currently chaired by the secretary of the Ministry of Communication and Information Technology, while the joint secretaries of various ministries are members of the board of directors. It is customary for the executive director to call a committee meeting and discuss and decide on the problems that arise unexpectedly.

Storage, operation, management, processing and protection of government data, shared computing resources, consulting services, government domain registration, email server, and government network management are currently being done by NITC.

According to the officials of NITC, due to a lack of adequate preparation before announcing the abolition of the organisation operating the sensitive system, the management of the government’s online system and the protection of data have been added to the challenge.

Pradeep Paudel, the executive director of the centre, has been saying that many sensitive services such as passports and national identity cards from the airport are connected and if the bodies that have to work around the clock are kept within the structure of the department, decisions cannot be made quickly.

In addition, there is confusion about how the assets and responsibilities of this body, which is in charge of colocation services, virtualisation, cloud services, web hosting, software development and manpower training, will be transferred under the department.

Even in the IT department, there are not enough manpower and experts to run the data centre. There are also doubts about firm work by the data centre under the department because the Department of Information Technology is not able to fulfil even its departmental responsibilities.

According to officials, even if NITC is scrapped, the data centre will continue to operate under the government. However, the Department of Information Technology, which does all the work, neither has experts who can run the data centre nor is the department fully prepared for it. There is a state of confusion as there is no organisational structure of the department that can manage the employees of NITC.

Spokesperson of the ministry, Subedi, says that NITC will not remain in its current state. “We will quickly conclude how to manage the sensitive data centre,” he says.

---

This story was translated from the original Nepali version and edited for clarity and length.