The pension fund threatens to break off 4 mega-contracts with NCI for delivery of computers

The Pension Fund of the Russian Federation and one of his largest suppliers of "a new wave" - "National Center of Informatization" (NCI) – in February, 2020 appeared on the verge of termination of four large contracts with a total cost nearly 908 million rubles at once. TAdviser understood the reasons of current situation.

Four large purchases with the total starting price of contracts more than 940 million rubles and almost identical objects of purchases were announced by the Pension fund in the same day, on October 28, 2019. Each purchase provided delivery of personal computers (the automated jobs, an automated workplace) for territorial authorities of RPF in two federal districts; thus, with four purchases the need for replacement of an obsolete computer hardware in THAT had to be provided to RPF in all eight federal districts.

Specifications of each of purchases included the automated workplace of two types, the difference between which was insignificant and consisted in characteristics of system units - the amount of RAM and frequency of the central processor; in total on all four purchases it was going to buy more than 13.5 thousand computers (see Tab. 1).

The pension fund does not accept computers which were bought for it by NCI

The following was key technical requirements (mismatch which, as a result, also led all signed contracts to a situation when they with high probability can be terminated):

• The motherboard, basic input-output system and operating system the automated workplace should be compatible to the hardware-software modules of a trusted boot of family HSS of "Sobol" of versions 3 and 4 operated in territorial authorities of RPF, an information security facility NSD HSS "Akkord-AMDZ" modifications 5.5, 5.5e, LE and GX certified according to requirements security of information in the system of certification FSTEC Russia;
• The operating system should be certified in the System of certification of information security tools of FSTEC of Russia on compliance to requirements of the documents "Security Requirements of Information to Operating Systems" (FSTEC of Russia, 2016) and "A profile of protection of operating systems of type "A" of the fourth class of protection. IT.OS.A4.PZ" (FSTEC of Russia, 2017);
• The operating system should be compatible to the software tools operated in territorial authorities of RPF cryptographic data protection and electronic signature, certified according to security requirements information in the system of certification FSB of Russia - ViPNet Client versions 4.x, ViPNet PKI Client versions 1.x, ViPNet CSP version 4.2 and CryptoPro CSP versions 4.0 and 5.0.

At all four auctions which took place 11/8/2019 the situation was similar (it is quoted in the text of the protocol of summing up an electronic auction):

Within ten minutes after the beginning of running an electronic auction the only contract bid was submitted. Based on consideration of the second part of such request the decision on its compliance to the requirements set by documentation on an electronic auction (Part 13 of Article 69 of Law No. 44-FZ) is made.

NCI LLC ("The national center of informatization"), "grand" structure of Rostec state corporation was this only participant submitting applications at all auctions (100% of stocks of NCI belong to "subsidiary" of Rostec - to Avtomatika Concern).

It is interesting what initially expected participants of auctions was more. On two of tenders about 6 participants, came on two – on 5 participants. Who specifically there were these participants, it is unknown – in protocols of consideration of the first parts of the requests available in EIS of state procurements, names of the companies are not specified. The tender committee of RPF left in each tender only 2 participants (one of whom in all cases was the NCI), and the request of the others did not allow the tender documentation because of their mismatch. Directly in day of holding electronic auctions to each auction there was only a NCI, made only according to one price offer and was announced by the winner. Why the second allowed participant and who it was did not take part in electronic auctions, and remained to unknown.

Decrease in the starting price of requests in all auctions was purely symbolical – from 2.5% to 4.5% (see Tab. 1).

After holding auctions and the declaration of results FULL FACE of Russia complaints to each of purchases arrived.

Originally all complaints were directed from the same company - Elsikom LLC (TAdviser wrote about the beginning of this "plaintive" story in November, 2019 - see. "War for the largest IT tenders of the Pension fund began"), but in 1-2 days the number of complainants increased to 2-3 on each purchase. The discrepancies of technical requirements detected by the company applicant to the purchased automated workplaces and real characteristics of the automated workplace which are present at the market were a reason for submission of complaints.

In particular, affirmed as complaints:

For the automated jobs the Windows operating system is provided. However, to Technical requirements to the operating systems installed on system units the automated workplace Type 1 and automated workplace Type 2, operating systems of the Windows family do not correspond, in particular, there is no version of Windows certified in the System of certification of information security tools of FSTEC of Russia on compliance to requirements of the documents "Security Requirements of Information to Operating Systems" (FSTEC of Russia, 2016) and "A profile of protection of operating systems of type "A" of the fourth class of protection. IT.OS.A4.PZ" (FSTEC of Russia, 2017). Thus, the Customer sets the requirements to operating systems contradicting regulating documents to which the Customer refers. Establishment of such requirements leads to the fact that it is impossible to offer the Goods which are completely meeting the requirements that leads to restriction of number of participants of an auction to delivery

FAS issued the instruction about the declaration of competitive procedures for all four purchases suspended, however, in several days withdrew all instructions, having recognized complaints unreasonable.

Public contracts on all four purchases were signed in one day and with the same limit completion date of the contract (see Tab. 2).

The signed contracts allowed NCI to take the place of the new leader among IT suppliers of RPF – taking into account these 4 contracts, the total cost of the contracts signed between RPF and NCI at that time almost reached 1.8 billion rubles.

Though at all 4 contracts on deliveries of an automated workplace completion date expired at the end of 2019, all of them until the end of January, 2020 in EIS of state procurements were in the status "Execution", and, neither documents on the taken place deliveries, nor payment documents in cards of contracts in EIS were.

The explanation for the events between RPF and NCI appeared only 1/27/2020 – this day in cards of all contracts records and documents on requirements about contract cancelation and about payment of a penalty for improper execution of conditions of contracts imposed on RPF to NCI were made. All 4 requirements were almost identical according to contents, only the amounts of accrued fines caused by different costs of contracts differed.

One of reasons for charge of penalties was rather usual for large IT suppliers – non-execution of the requirement of Federal law 44-FZ on obligatory attraction to performance of the contract of subcontractors, collaborators from among the small business entities (SBE), the socially oriented non-profit organizations (SONPO) of 15-20 percent from the contract price. As the penalty for non-execution of this requirement of the law is symbolical (5% of the volume of required attraction, i.e., 0.75-1% of the contract price), many suppliers consciously go for violation, in advance putting these 0.75-1% in the costs.

But because of such violations contracts are never terminated. Another was the main reason for presentation of requirements about contract cancelation absolutely – the supplier did not provide compliance of a delivered goods to the technical requirements of the customer stated in procurement documentation.

According to these requirements recorded in the contract, procedures of delivery provided an opportunity for the contractor to start shipment of goods only after check by the customer of control copies of goods in the order set in the annex to the government contract and signings of the act of readiness of the delivered goods for shipment.

The mentioned check, in turn, provided that (the quote by the text of the government contract) "… within 10 working days from the date of the conclusion of the public contract Supplier represents to the Customer of 3 control copies of the technical means specified in the specification for conducting by the Customer check of compliance of the delivered goods to Technical requirements of auction documentation".

Occurring during these checks further it is simpler to state official language of requirements about contract cancelation. The quote from one of 4 requirements is included below, in all others the essence of occurring is stated similarly:

Control copies of technical means were provided to the Customer on December 12, 2019, on December 23, 2019, on January 13, 2020 that is confirmed by delivery-acceptance certificates of control copies of technical means. During checks 12/13/2019, 12/26/2019 and 1/15/2020 mismatch of the delivered control samples to the requirements set by the contract in this connection the Customer, being guided by point 6 of technical requirements, sent to the Supplier cover letters of 12/19/2019 No. 11-19/27951, of 12/30/2019 No. 11-19/28772 and of 1/17/2020 No. 11-19/578 acts with the list of discrepancies of deliverable technical means to technical requirements and requirements of the public contract of November 28, 2019 No. 20-407-D of delivery of the automated jobs for territorial authorities of RPF in the Central and Northwest federal districts of 12/17/2019, of 12/26/2019 and of 1/15/2020 respectively (further - acts) was revealed. At the time of drawing up this requirement the Supplier did not perform replacement of control copies of technical means by the control copies of technical means conforming to the requirements set by the contract, the goods under the contract did not deliver. The delay period in delivery of goods under the contract is 45 calendar days (from 12/11/2019 till 1/24/2020 inclusive)

At the disposal of TAdviser there is one of the above-mentioned letters which were sent RPF to NCI. Among points of requirements on which mismatch of control samples is revealed there are also absolutely insignificant - for example, mismatch of weight of the PC system unit to the value specified in specifications of the government contract or value of a response time of pixel of the monitor, smaller (i.e., the best), than it is required according to the specification. But discrepancies of the equipment rooms and software tools automated workplaces planned to delivery, requirements regarding data protection became critical.

So, during checks it was established that the motherboard of production Acer Inc. installed in the automated workplace system unit (model of a payment MIB36L-vMocha 17554-1M), is compatible to a HSS of "Sobol" of versions 4, but is incompatible with a HSS of "Sobol" of versions 3 and a HSS of the information security facility of NSD "Akkord-AMDZ" of modifications 5.5, 5.5e, LE and GX.

It became clear also that the operating system Astra Linux Special Edition of version 1.6 planned to delivery as a part of an automated workplace has FSTEC Russia certificate of conformity No. 2557 and the profile of protection of operating systems of type "A" of the second class of protection conforms to requirements of the documents "Security Requirements of Information to Operating Systems" (FSTEC of Russia, 2016) and ". IT.OS.A2.PZ" (FSTEC of Russia, 2017) – while according to technical requirements of procurement documentation it was required that OS had certification on the fourth class of protection.

Considering that the second class of protection means higher degree of security (actually, in the environment of such OS the documents containing the data carried to the state secret – unlike the fourth class of protection where processing only of confidential information without security classifications), not really clear is allowed can be processed, than formal mismatch according to this requirement did not suit the customer on behalf of RPF. Perhaps, the reason was in one mismatch described below.

When checking it was established that all three ViPNet software products (ViPNet Client of version 4.x, ViPNet PKI Client of version 1.x and ViPNet CSP of version 4.2), the compatibility with which was required for OS as a part of an automated workplace, are not certified under version 1.6 of Astra Linux Special Edition OS installed on control samples. Besides, in version 4.x product ViPNet Client for Astra Linux there was no number of the program components which are available in a similar product for Windows and used in Executive directorate of RPF and THAT by RPF; also other technical issues for ViPNet Client of version 4.x and ViPNet PKI Client of version 1.x were mentioned. In full only version 4.2 product ViPNet CSP met functional requirements, however, as it was already mentioned above, it (as well as at his fellows) had no certificate for Astra Linux Special Edition OS of version 1.6.

Proceeding from the fact that procedures of check of control samples revealed mismatch to technical requirements three times in RPF the decision on termination of all 4 contracts with NCI was made. Based on provisions of Article 450 of the Civil code of the Russian Federation, RPF suggested NCI to terminate all contracts by agreement of the parties, having specified that in case of refusal the NCI from signing of such agreement of RPF will use contract right of termination through court.

At the same time on NCI, in addition to a penalty for not involvement of subcontractors from among SMP/SONO, under each contract also the penalty for improper execution of the contract in the amount of 0.5% of cost of the contract was imposed. The total amounts of penalties shown to NCI from RPF are specified in Tab. 2 – the total amount of penalties under all four contracts was more than 11.3 million rubles.

All 4 requirements about contract cancelation are dated on January 24, 2020. 2 copies of the agreement on contract cancelation, with the signature of the vice chairman of the board of RPF Vadim Akkuzin, RPF under seal were attached to each requirement, i.e. the gravity of intentions of RPF about contract cancelation does not raise any doubts.

The contractor of contracts, according to these requirements, was obliged within 5 working days from the moment of obtaining requirements to pay the shown penalties and to sign agreements on contract cancelation. As all requirements were placed in EIS of state procurements on January 27, 2020, it is possible to consider that until the end of January they were already precisely received in NCI. Thus, during the first business week of February, i.e., from February 3 to February 7, the NCI had to react to requirements of RPF. There are no documentary evidences of the taken place reaction in EIS of state procurements – neither payment documents about payment of penalties, nor the issued agreements on contract cancelation.

According to a source of TAdviser, the meeting between Vadim Akkuzin and the CEO of NCI Konstantin Solodukhin according to the results of which the parties agreed took place on February 19 to carry out one more inspection of control copies. Officially in NCI were limited to the comment that the company continues to perform contracts with RPF.

TAdviser reminds that it is not the first conflict situation which arose at performance of contracts of NCI in RPF. In August, 2019 the NCI signed the contract with RPF with the starting price of 250 million rubles which did not decrease during the tender. Maintenance and repair of computer aids of MITs RPF on technology platform No. 2 was the subject of the contract. And here the NCI nearly had large "puncture" - the customer on behalf of MITs RPF nearly broke off the contract in a month after signing (in more detail in the separate article.

Then the NCI was succeeded to settle quickly the conflict – in 10 days, on September 27, 2019, the solution MITs on a rupture of the contract was cancelled since the NCI eliminated violations.

Informatization

Main article: Information technologies in the Pension Fund of the Russian Federation.