Muhoro: Ex-NYS boss password not stolen

Directorate of Criminal Investigations director Ndegwa Muhoro (centre) appears before the National Assembly’s Public Accounts Committee. PHOTO | JEFF ANGOTE 

By LYNET IGADWAH and EDWIN MUTAI

In Summary

• A forensic analysis of Adan Harake’s computer at the NYS headquarters has established that his password had not been stolen, leaving him at the centre of the Sh791 million scandal.
• Mr Harake’s machine was among the three that operated on an obsolete system (Windows XP) without anti-virus software.
• Mr Harake has maintained that his IFMIS password was stolen and his account used to approve payments amounting to millions of shillings without his knowledge.

Former National Youth Service (NYS) deputy director Adan Harake’s password, which was used to approve fraudulent payments out of the government’s digital financial management system, was not hacked as earlier claimed, Parliament was told on Wednesday.

Directorate of Criminal Investigations (DCI) director Ndegwa Muhoro told the National Assembly’s Public Accounts Committee (PAC) that a forensic analysis of Mr Harake’s computer at the NYS headquarters had established that his password had not been stolen, leaving him at the centre of the Sh791 million scandal.

“If the password was stolen, it could only happen at the user’s level and not through hacking of the IFMIS system,” Mr Muhoro told the PAC, which is probing massive looting of the agency’s funds in 2014 and 2015, adding that the strength of the Integrated Financial Management Information System (IFMIS) is such that it can only be compromised if the account holder shares their password.

Mr Muhoro further left Director of Public Prosecutions (DPP) Keriako Tobiko in a tight corner following his revelation that the Directorate of Criminal Investigations had recommended that Mr Harake be charged with the theft of the Sh791 million, but no action has so far been taken.

Top anti-banking fraud officers told MPs that a forensic analysis on six NYS computers had established that Mr Harake’s machine was among the three that operated on an obsolete system (Windows XP) without anti-virus software.

“The machine had no anti-virus, meaning it was at risk of attack. However, we did not find any malicious software threat that could have been used to hack the password,” said Simon Kipruto, head of the cybercrime unit at the DCI.

The cybercrime team, however, recovered from Mr Harake’s machine several payments with transaction numbers he had approved between May 21 and 22, 2015.

“From his browser history, we were able to tell that it is Mr Harake who approved the payments. It was an afterthought to say that the password was stolen since the IFMIS system is solidly secure,” Mr Kipruto said.

Mr Harake has maintained that his IFMIS password was stolen and his account used to approve payments amounting to millions of shillings without his knowledge.

READ: NYS Sh791m theft started two days after budget allocation, witness testifies

The DCI officers told the House committee that the IFMIS system relies on the internet and that a password can be used to access it from a remote location provided the machine in use is configured to the system.

The committee heard that theft of the Sh3.5 billion allocated to the youth development programme started barely two days after the money was allocated to the Ministry of Devolution and Planning.

Mr Harake’s appointment to the NYS also came under scrutiny after it was established that it was done before the position was actually created by the Public Service Commission (PSC).

On Tuesday, PSC secretary Alice Otwala said the commission had declined to approve the creation of the position of senior deputy director- general of NYS, but sacked Devolution and Planning principal secretary Peter Mangiti went ahead to create it.

“Despite the commission writing to the PS on numerous occasions declining creation of such a position, he went ahead and created the same with impunity. He unilaterally established a non-existent position that was and has never been recognised in the public service,” Ms Otwala told the PAC.

She said that as far as PSC is concerned, Mr Harake served as a deputy secretary at the NYS and not senior deputy director- general.

“Despite his new position, he remained in the salary scale of a deputy secretary. Mr Harake had no basis to run around with that new title,” she said.

Ms Otwala was asked to explain why the commission had abdicated its responsibilities by allowing a PS to appoint persons to offices that are not recognised in the public service.

Ms Otwala said the PSC had delegated its powers to various ministries and departments. In the case of NYS, the powers were delegated to former Devolution and Planning secretary Anne Waiguru and the then NYS director-general, Nelson Githinji.

Ms Otwala was at pains to explain why Mr Harake was still earning his full salary and all other perks attached to his position despite having been interdicted on grounds of fraud.

Upon interdiction, Mr Harake was supposed to be on half pay and  Ms Otwala blamed the NYS human resources department for failing to put the officer on half pay, pending conclusion of his case. The MPs directed Ms Otwala to report the action taken on the payments.

ligwadah@ke.nationmedia.com; emutai@ke.nationmedia.com