Kazakhstan's Ministry of Finance has entrusted the protection of citizens' declarations to white-hat hackers.

Following a wave of discontent among Kazakhstanis regarding the forced "error correction", many have questioned the readiness to submit declarations. Some believe that society is not prepared for the declaration process at all. To clarify this, we decided to inquire with the committee of state revenues from the Ministry of Finance of the Republic of Kazakhstan overseeing this process.

In the department, a correspondent from inbusiness.kz was informed that the citizens' readiness for declaration at the 4th stage can be assessed as high, as the successful completion of the first three stages has created positive experience.

"Psychologically, citizens have become more confident in the process, as they have gone through the previous stages without serious issues. Culturally, the process is perceived as mandatory and important for society, which promotes active participation," – described the preparation for the next stage of declaration in the state agency.

Who will ensure cybersecurity?

The Committee for State Revenues guarantees the confidentiality of data. An integrated database of the committee is used for collecting and processing information about the declared assets of individuals, which combines data from various sources. It is noted that the information systems operate in a closed circuit, without internet access, ensuring the security of taxpayers' information. Access to declarations is limited to a select group of employees who bear personal responsibility, including administrative and criminal.

When asked who and how the protection of the information security of taxpayers' personal data is ensured, the agency clarified that the Ministry of Finance of the Republic of Kazakhstan has contracted with Kazhackstan LLP to provide services for the Operational Center for Information Security (OCIS). Kazhackstan LLP is presented by tax officials as a leading company in the field of cybersecurity in Central Asia and the first OCIS in Kazakhstan.

According to data from the Adata portal, Kazhackstan LLP was registered on May 8, 2012. The company has been in the market for 12 years and seven months and is classified as a small enterprise. Its main activity is software support (OKED: 62012). Over its years of operation, the company has paid taxes amounting to 132 million 105 thousand 860 tenge. Kazhackstan LLP has been consistently paying taxes since 2015. The lowest tax payment was in 2021 – 621 thousand 520 tenge, and considering the wage fund (WF) – 2 million 299 thousand 274 tenge. The total amount of tax payments has reached 2 million 920 thousand 794 tenge.

Judging by the tax charts, the company's situation has improved. The tax amount reached 6 million 848 thousand 375 tenge (an increase of 2295% compared to 2023). Payments for the WF amounted to 40 million 536 thousand 810 tenge (an increase of 216.8% compared to last year). In total, this year the budget received from the company 47 million 385 thousand 185 tenge (an increase of 262.2% compared to the same period last year). This is indeed a significant leap for the firm.

Kazhackstan LLP – a participant in government procurement

However, alongside the positives, the company has its downsides. The reliability of Kazhackstan LLP, according to Adata, is assessed as having a high degree of risk. The company is involved in three civil cases: two concern disputes over property rights or recovery of property from illegal possession, and one is related to disputes over the conclusion, modification, and termination of contracts. Risks also include the use of a mass address – more than 50 companies are registered at a similar address. The enterprise has its legal address in Astana: Esil district, Mangilik El Ave, house 54, apartment 133.

Nevertheless, this does not hinder the company from participating in government procurements, including projects under "Samruk-Kazyna." Kazhackstan LLP received the status of "government procurement participant" on January 29, 2024. The list of signed contracts includes 24 positions, including a government procurement contract with the Ministry of Finance dated March 28, 2024, for the amount of 77 million 500 thousand tenge. Presumably, these funds are intended for ensuring the security of data in the declarations of Kazakhstanis.

Kazhackstan LLP is also listed as a supplier for various state institutions and private companies, including:

• JSC "Kazakhstan Development Bank": BugBounty service, contract — 7.9 million tenge (2024).
• State Enterprise "Committee for Road Transport and Control of the Ministry of Transport": OCIS services (operational center for information security – Note), contract — 9.17 million tenge (2024).
• State Communal Enterprise "Information Technology Center" Zhetysu: connection to OCIS, contract — 4.5 million tenge (2024).
• JSC "Situational and Analytical Center for the Fuel and Energy Complex": technical audit (IS ISUN), contract — 2.8 million tenge (2024).
• JSC "Kcell": information security services, contract — 9.4 million tenge (2024).
• Kazakhstan LLP "MOBILE TELECOM-SERVICE": OCIS services, contract — 75.23 million tenge (2024–2025).
• JSC "Kazpost": information security services, contract — 100 million tenge (2024–2025).
• State Enterprise "Digitalization Management of Astana": OCIS services, contract — 218.25 million tenge.
• JSC "KazMunayGas": information security services, contract — 16 million tenge. And so on.

Thus, when tax authorities refer to Kazhackstan LLP as a serious player in the field of cybersecurity in Kazakhstan and Central Asia, this statement appears justified.

What is known about the owners…

The head of Kazhackstan LLP is Enlik Kanatbekovna Satieva, 28 years old (date of birth: October 29, 1996). She also leads Blue Team LLP, QAZSOC LLP, and is their founder. Additionally, Satieva has registered an individual entrepreneur (IE) KHS HUB with the activity "Restaurant activity and food delivery" (OKED: 56101).

According to available data, E. K. Satieva is likely related by blood or marriage to Olzhas Shagzadovich Satiev (born May 18, 1989, 35 years old), who is the head and founder of several companies, including the well-known association of legal entities "Center for Analysis and Investigation of Cyber Attacks" (CAICA). Unlike Enlik Satieva, Olzhas Satiev actively engages with the public, occasionally giving interviews to the media. He is involved in ethical hacking and was one of the founders of the hacker team TeaM13 during his school years, as well as a co-founder of one of the first hacker forums in Kazakhstan – thehack.kz. He is also a finisher of half-Ironman competitions and a marathon runner.

Automated monitoring

Continuing the topic of declaration, according to the KGD, monitoring is carried out around the clock, allowing for the rapid identification and analysis of information security incidents, as well as the protection of data necessary for the stable operation of state information systems. A total of 1,090 sources have been connected.

"During the operation, 1,189 information security incidents were identified, of which 11 were critical. All incidents were successfully resolved thanks to the coordinated work of the OCIS and the information security management of the committee for state revenues. Additionally, specialists from the public association “CAICA” conducted instrumental vulnerability scanning of all information systems of the committee. The identified vulnerabilities were promptly addressed by developers and administrators, enhancing the security level of the infrastructure," – added the state agency.

Despite the operation of the KGD contact center based on the multi-channel system of the unified contact center 1414 for clarifying issues of universal declaration and the presence of consultation centers in district offices of state revenues, individuals face difficulties with the notarization of accounts receivable and payable. According to paragraph 5 of Article 211 of the Tax Code, obligations and debts must be reflected in the initial declaration, for which no amendments are provided.

"Control over the accuracy of declaration filling will be conducted using the information database. All information from declarations will be uploaded to the system, which automatically verifies the correctness of data based on pre-established criteria and rules. An increase in tax revenues is expected as a result of identified violations, which will provide additional funds for the implementation of social programs," – noted the KGD.

Obligations and fines

According to the Code of Administrative Offenses of the Republic of Kazakhstan, liability for concealing taxable objects is provided: for the first violation within a year – a fine of 200% of the amount of unpaid taxes (clause 1 of Article 275 of the Co