KATHMANDU, Sept 26: The government’s online bidding system has remained shut for nearly a month after an investigation found that contractors allegedly colluded with a hacker to take control of the Public Procurement Monitoring Office’s (PPMO) e-bidding system and secure government contracts.
The Central Investigation Bureau (CIB) of Nepal Police has launched a second-phase investigation after its first-phase probe found that contractors had colluded with a hacker to manipulate the government’s bidding system.
The CIB conducted its first-phase investigation in March and filed a case against 13 people at the Kathmandu District Court in April. The accused include former minister and Kalika Construction Pvt Ltd owner Bikram Pandey. They have been released on bail.
The investigation found that the hacker, identified as government employee Diwakar Deuja, took control of the PPMO’s online bidding system and changed documents and bid proposals in favor of contractors who paid him. Some contractors allegedly obtained details of bids submitted by their competitors through the hacker and then submitted their own bids accordingly.
The PPMO has been unable to improve the government’s bidding system since it was taken over by the hacker. The online bidding system has remained shut since August 27.
The CIB investigation found that the hacker had accessed 313 government tenders. Of these, he was found to have manipulated bids for 27 projects in favor of 16 contractors. The CIB launched the second-phase investigation after suspecting that contractors had also paid the hacker to secure contracts for other projects.
According to a CIB investigation officer, the second-phase probe has so far found that contractors colluded with the hacker to secure contracts for around 25 more government projects. The investigation, however, is still underway.
NTA cancels tender for free Wi-Fi services in tourist and relig...
How did the hacker manipulate bids?
The CIB had arrested Deuja in the first phase of the investigation for allegedly hacking the government’s bidding system and helping contractors secure contracts in exchange for money.
Deuja, who was working at the Dhankuta branch of the Urban Development and Building Construction Project, allegedly hacked and took control of the PPMO’s online bidding system. Through the system, he accessed details of which contractors had submitted bids for different projects and how much they had quoted.
He then allegedly provided the information to contractors who paid him and helped them submit bids in their favor. At the final stage, he allegedly entered documents and bid proposals into the system in a way that enabled the companies that paid him to secure the contracts.
Sanjay Bhatta, a shareholder of Soli Thumka Nirman Sewa Pvt Ltd, reportedly told investigators that he paid Rs 4.5 million to the hacker and secured a contract by increasing his original bid by Rs 20 million based on information about competing bids.
Similarly, the investigation found that hacker Deuja manipulated the bid amount by Rs 60 million in a contract awarded to former minister Pandey’s Kalika Construction on January 23 for the construction of a bridge over the Bakaiya River along the Mahendra Highway.
Kalika Construction had initially quoted Rs 670 million for the bridge project. Deuja allegedly accessed the amounts quoted by competing contractors and provided the information to Kalika.
At the final stage, Deuja allegedly changed the bid and documents submitted by Pandey’s company, enabling Kalika to secure the contract at Rs 605.4 million.
The investigation found that the hacker manipulated bids for 27 projects in this manner, allegedly helping contractors who paid him secure contracts.
Sixteen contractors were found to have gained unauthorized access to the PPMO’s e-bidding system through the hacker. Investigators found that changes made to bids with the hacker’s assistance resulted in differences of up to Rs 80 million in some projects.
The CIB also found that Deuja received commissions from contractors in cryptocurrency.
Among those facing charges in the Kathmandu District Court are Sanjay Bhatta of Soli Thumka Nirman Sewa, Sagar Katwal of Katwal Construction, Jiwankumar of Geetanjali Construction, Bikram Pandey of Kalika Construction, Rishikesh Gauli of Ashish Nirman Sewa, Swadesh Pokharel of Icon Pvt Ltd, Amrit Bohora of Chapur Nirman, Prakash Dhungana of Kalpabriksha Builders Pvt Ltd and Bhaskar Raj Aryal, who allegedly transferred money to Deuja through cryptocurrency.
Deuja is in custody pending trial, while the other accused have been released on bail. Their cases are sub judice.
CIB Spokesperson Senior Superintendent of Police Anupam Shamsher Rana said the bureau was investigating whether other contractors had also paid the hacker to manipulate bids and secure government contracts.
“As the second-phase investigation is ongoing, we cannot disclose further details at present,” he said.
The PPMO has also come under scrutiny for failing to adequately secure its e-bidding system. The online bidding system was suspended after the hacking exposed vulnerabilities and confidential information.
The CIB has recommended that the PPMO restrict unnecessary access to the online bidding system, fix vulnerabilities identified on the website and ensure data confidentiality from the software development stage.
