The Public Utilities Workers' Union (PUWU) of the Trades Union Congress (Ghana) has issued a strong rebuttal to allegations made by Vice President Dr. Mahamudu Bawumia regarding a ransomware attack on the Electricity Company of Ghana (ECG).

In a press release dated May 13, 2024, the union contested the Vice President's assertion that ECG's ICT staff were responsible for sabotaging the company's digital payment system.

According to Dr. Bawumia's address at the 14th Regional Conference of Heads of Anti-Corruption Agencies in Commonwealth Africa, the ICT staff had deliberately introduced ransomware into ECG's systems and demanded a ransom.

He also claimed that ECG's revenue had significantly increased following the digitalization of its payment system.

However, the PUWU has refuted these claims, stating that the Vice President's remarks were inaccurate and misleading.

The union highlighted that the Economic and Organised Crime Office (EOCO) had conducted a forensic audit on the ECG Power App in September 2022, involving third-party IT professionals, which could have compromised the security of ECG's network.

The union also clarified that the first ransomware attack occurred on September 28, 2022, and was reported to the Cyber Security Authority.

"The Union respectfully DISAGREES with the statement of His Excellency the Vice President on his presentation relating to digitalization and sabotaging of the ICT system at ECG.

“In September 2022, EOCO commenced forensic audit on the ECG Power App: They demanded for the payment platform architecture, databases, Application Programming Interface (API) documentation and the power app custom source code, including credentials to the backend prepayment systems.

“EOCO did not use its internal staff but had to use third-party IT professionals for the assignment. Consequently, it was not only ECG IT staff who had access to the ICT infrastructure of ECG.

“Could the sharing of the source code with external parties have compromised ECG network security in relation to the scale of the September 2022 attack?” the statement read.

Subsequently, National Security took control of ECG's ICT system, during which the second and more severe attack happened on November 11, 2022.

The PUWU emphasized that it was the ECG ICT staff who led the recovery efforts, not National Security as suggested by the Vice President.

“In the midst of the takeover, the second and most severe of the ransomware attacks occurred on the 11th November 2022, at the time the National Security personnel had both full physical access and software administrative rights to all ECG systems.

“The National Security arrested and detained some ECG ICT staff for days but were later released.

“We wish to state that it was the ECG ICT staff who used their system recovery strategy and worked tirelessly day and night to restore the systems and even assisted the National Security operatives on how to operate the ECG systems.

“The ECG ICT staff led the recovery effort, with the support of E-crime Bureau, a cyber security firm, invited by the ECG Board,” the statement continued.

PUWU also corrected the Vice President's figures on ECG's revenue, citing the company's 2019 Annual Report and the 2023 SIGA-ECG Performance Contract, which show different figures than those mentioned by Dr. Bawumia.

The union praised the ECG staff for their dedication to digitalization, particularly the ICT professionals who have been instrumental in developing and deploying the ECG Power App since 2016.

“ECG's financial performance is a matter of public record, as indicated in the company's 2019 Annual Report. The average monthly revenue for the period 2017 to 2019 was around GHS532.7 million. In the 2023 signed SIGA- ECG Performance Contract, the average monthly revenue is GHS631.3 million as at early 2022. These documents are available to the public on ECG website.

“We further wish to put on record that the enhancement of aspects of digitalization into ECG work processes by the current Management has improved convenience to our customers and commitment exhibited by staff has been the pivot of any observed improvement especially in the area of revenue mobilization.

“The staff of ECG have no motivation whatsoever to sabotage any process, procedure or system designed to improve the work processes and as such must be commended,” it added.

The PUWU further called for recognition of the staff's contributions to national development and urged stakeholders to refrain from disparaging remarks.

“The accusations of sabotage and resistance to digitalization are not only unfounded but also damaging to the morale and reputation of our hardworking members.

“The ECG ICT department has been at the forefront of digitalizing revenue collection for decades, a fact that seems to have been overlooked,” it stated.

The press release, signed by General Secretary Michael Adumatta Nyantakyi, reaffirmed the commitment of ECG staff to enhancing efficiency and service delivery, despite the challenges they face, including attempts by some stakeholders to push for the privatisation of ECG.

The union said it stands firm in its defence of its members and their unwavering dedication to the company's digitalization journey.

View the full statement here







ID/SARA