Document of The World Bank Report No: ICR00003017 IMPLEMENTATION COMPLETION AND RESULTS REPORT (IBRD-75720) ON A LOAN IN THE AMOUNT OF US$ 20 MILLION TO THE ARGENTINE REPUBLIC FOR A SOCIAL AND FISCAL NATIONAL IDENTIFICATION SYSTEM (SINTyS) PROJECT ADAPTABLE PROGRAM LENDING 2 IN SUPPORT OF THE SECOND AND THIRD PHASES OF THE SYSTEM June 19, 2014 Poverty Reduction and Economic Management Argentina, Chile, Paraguay, Uruguay Country Management Unit Latin America and the Caribbean Region CURRENCY EQUIVALENTS (Exchange Rate Effective February 2009, December 2013, and June 18, 2014) Currency Unit = Argentine Peso February 2009 1.00 = US$0.282 US$ 1.00 = 3.55 pesos December 2013 1.00 = US$ 0.153 US$ 1.00 = 6.52 pesos June 18, 2014 1.00=US$0.12 US$ 1.00= 8.13 pesos FISCAL YEAR January 1-December 31 ABBREVIATIONS AND ACRONYMS AFIP National Administration of ICT Information and Public Revenue (Administración Communication Nacional de Ingresos Públicos) Technologies ANSES National Social Security M&E Monitoring and Evaluation Administration (Administración MDP I Municipal Development Nacional de la Seguridad Project I Social) MDP II Municipal Development APL Adaptable Lending Program Project II BCP Business Continuity Plan MTR Midterm Review CAS Country Assistance Strategy ONTI National Office of CNCPS National Council on the Information Technology Coordination of Social Policies (Oficina Nacional de (Consejo Nacional de Tecnologías de Coordinación de Políticas Información) Sociales) PAD Project Appraisal CEU Central Executing Unit Document DNPDP National Directorate of PDO Project Development Protection of Personal Data Objective (Dirección Nacional de PDP I Provincial Development Protección de Datos Project I Personales) PDP II Provincial Development ICR Implementation Completion and Project II Results Report PPF Project Preparation Facility RENAPER National Registry of People SINTyS II Social and Fiscal National (Registro Nacional de las Identification System Project Personas) II SEWS SINTyS Web Service SPFO SINTyS Provincial Field (Servicio Web SINTyS) Office UNOPS United Nations Office for SIGEN General Syndicate of the Project Services Nation (Sindicatura VIAS Window for Automatic General de la Nación) Integration and Monitoring SINTyS Social and Fiscal National (Ventanilla de Integración Identification System Automática y Seguimiento) (Sistema de Identificación VUO Entity Single Window Tributario y Social) (Ventanilla Única de SINTyS I Social and Fiscal National Organismo) Identification System Project I Vice President: Jorge Familiar Country Director: Jesko Hentschel Sector Manager: Arturo Herrera Gutierrez Project Team Leader: Henry Forero ICR Team Leader: Henry Forero ICR Primary Author: Adrienne Hathaway ARGENTINA Social and Fiscal National Identification System (SINTyS) Project Adaptable Lending Program 2 In Support of the Second and Third Phases of the System CONTENTS Data Sheet A. Basic Information B. Key Dates C. Ratings Summary D. Sector and Theme Codes E. Bank Staff F. Results Framework Analysis G. Ratings of Project Performance in ISRs H. Restructuring I. Disbursement Graph 1. Project Context, Development Objectives and Design ............................................... 1 2. Key Factors Affecting Implementation and Outcomes .............................................. 6 3. Assessment of Outcomes .......................................................................................... 11 4. Assessment of Risk to Development Outcome......................................................... 15 5. Assessment of Bank and Borrower Performance ..................................................... 16 6. Lessons Learned ....................................................................................................... 18 7. Comments on Issues Raised by Borrower/Implementing Agencies/Partners .......... 18 Annex 1. Project Costs and Financing .......................................................................... 19 Annex 2. Outputs by Component ................................................................................. 20 Annex 3. Economic and Financial Analysis ................................................................. 40 Annex 4. Bank Lending and Implementation Support/Supervision Processes ............ 42 Annex 5. Beneficiary Survey Results ........................................................................... 44 Annex 6. Stakeholder Workshop Report and Results................................................... 45 Annex 7. Summary of Borrower's ICR and/or Comments on Draft ICR ..................... 46 Annex 8. Comments of Cofinanciers and Other Partners/Stakeholders ....................... 47 Annex 9. List of Supporting Documents ...................................................................... 48 Annex 10. Results Framework as Modified in September 2011 Restructuring…..…..49 MAP A. Basic Information AR SOC&FISC NTL Country: Argentina Project Name: ID SYS II Project ID: P101171 L/C/TF Number(s): IBRD-75720 ICR Date: 06/19/2014 ICR Type: Core ICR GOVERNMENT OF Lending Instrument: APL Borrower: ARGENTINA Original Total US$ 20.00M Disbursed Amount: US$ 19.986M Commitment: Revised Amount: US$ 20.00M Environmental Category: C Implementing Agencies: Consejo Nacional de Coordinacion de Politicas Sociales Cofinanciers and Other External Partners: B. Key Dates Revised / Actual Process Date Process Original Date Date(s) Concept Review: 01/22/2008 Effectiveness: 02/27/2009 02/27/2009 Appraisal: 05/09/2008 Restructuring(s): 09/16/2011 Approval: 07/10/2008 Mid-term Review: 05/31/2011 05/02/2011 Closing: 12/31/2013 12/31/2013 C. Ratings Summary C.1 Performance Rating by ICR Outcomes: Moderately Satisfactory Risk to Development Outcome: Moderate Bank Performance: Moderately Satisfactory Borrower Performance: Satisfactory C.2 Detailed Ratings of Bank and Borrower Performance (by ICR) Bank Ratings Borrower Ratings Quality at Entry: Moderately Satisfactory Government: Satisfactory Implementing Quality of Supervision: Satisfactory Satisfactory Agency/Agencies: Overall Bank Overall Borrower Moderately Satisfactory Satisfactory Performance: Performance: C.3 Quality at Entry and Implementation Performance Indicators Implementation QAG Assessments Indicators Rating Performance (if any) Potential Problem Project Quality at Entry No None at any time (Yes/No): (QEA): Problem Project at any Quality of No None time (Yes/No): Supervision (QSA): DO rating before Moderately Closing/Inactive status: Satisfactory D. Sector and Theme Codes Original Actual Sector Code (as % of total Bank financing) Central government administration 49 49 Public administration- Other social services 49 49 Sub-national government administration 2 2 Theme Code (as % of total Bank financing) Administrative and civil service reform 35 35 Law reform 5 5 Social safety nets 40 40 Tax policy and administration 20 20 E. Bank Staff Positions At ICR At Approval Vice President: Jorge Familiar Pamela Cox Country Director: Jesko Hentschel Pedro Alba Sector Manager: Arturo Herrera Gutierrez James Parks Project Team Leader: Henry Forero Ramirez Miguel Mercado-Diaz ICR Team Leader: Henry Forero Ramirez ICR Primary Author: Adrienne Elizabeth Hathaway F. Results Framework Analysis Project Development Objectives (from Project Appraisal Document) The project's development objective is to identify social and/or fiscal attributes of physical and legal persons in Argentina, through a sustainable information exchange system, aimed at improving the efficiency, effectiveness, and impact of social services and fiscal programs at all levels of government in Argentina. The specific objectives to be pursued under this operation are: 1. to expand and consolidate the network underlying the exchange of social and fiscal information among public agencies at the national, provincial, and municipal levels of government, with provisions to ensure data protection, accessibility, and the quality and accuracy of information; and 2. to consolidate the institutionalization of SINTyS as an independent national entity responsible for coordinating and setting standards governing the exchange of information within Argentina's public sector. Revised Project Development Objectives (as approved by original approving authority) (a) PDO Indicator(s) Original Target Formally Actual Value Values (from Revised Achieved at Indicator Baseline Value approval Target Completion or documents) Values Target Years The number of government agencies and programs using consistent common Indicator 1 : processes to identify entities and assets has increased from 16 to 38. Value quantitative or 16 38 105 Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved; surpassed target. achievement) The percentage of physical persons that can be identified univocally by SINTyS Indicator 2 : has increased from 31 percent to 92 percent Value quantitative or 31 percent 92 percent 92 percent Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) The percentage of the juridical persons univocally [sic] identified has increased Indicator 3 : from 41 percent to 70 percent. Value quantitative or 41 percent 70 percent 60 percent Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) Indicator 4 : The percentage of the population with family relationship data has increased from 9 percent to 32 percent. Value quantitative or 9 percent 32 percent 32 percent Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) Population identified with a level of confidence equal or greater than 75 percent Indicator 5 : has increased from 35.2 to 38.2 million. Value quantitative or 35.2 million 38.2 million 39 million Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) The number of data types for which SINTyS and ONTI have issued information- Indicator 6 : exchange standards has increased from 0 to 50. Value quantitative or 0 50 0 Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Not achieved. However, SINTyS has developed its own information-exchange (incl. % standards for 30 data types. achievement) Indicator 7 : The information exchange network maintains 97 percent availability. Value quantitative or 97 percent 97 percent 97 percent Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) The number of “highly critical” vulnerabilities exploited by penetration test activities in a scenario simulating legitimate SINTyS user from a participating Indicator 8 : government agency as a proportion of services available to agencies has decreased from 2 to 0. No highly critical Value vulnerabilities to quantitative or 2 0 report from second Qualitative) pentest. Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) Amount of incorrect benefits not awarded due to SINTyS in a given year (in US$ Indicator 9 : Million). Value Not calculated quantitative or 0 51 during Qualitative) implementation Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Due to changes during implementation, actual numbers not available (see main (incl. % text) achievement) Indicator 10 : Increase in tax collections due to SINTyS in a given year (in US$ Million). Value Not calculated quantitative or 0 2.6 during Qualitative) implementation Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Due to changes during implementation, actual numbers not available (see main (incl. % text) achievement) (b) Intermediate Outcome Indicator(s) Original Target Actual Value Formally Values (from Achieved at Indicator Baseline Value Revised approval Completion or Target Values documents) Target Years SINTyS advisory body in place, with representation from key agencies at the Indicator 1 : national level (DNPDP, ONTI, RENAPER, AFIP, ANSES), and meets regularly. Value Implicit in CNPS CNPS monthly (quantitative Unspecified indicator monthly meetings or Qualitative) description meetings Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments Achieved. Measurement changed in September 2011 restructuring from SINTyS (incl. % advisory body to CNPS monthly meetings. achievement) Provincial advisory body in place, with representation from provincial Indicator 2 : authorities, and meets regularly. Annual Value Implicit in Annual meetings meetings with (quantitative Unspecified indicator with provincial provincial or Qualitative) description coordinators coordinators Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments Achieved. Measurement changed in September 2011 restructuring; provincial (incl. % advisory body replaced with annual meetings with provincial coordinators. achievement) Users’ forum is in place, with representation of government agencies from all Indicator 3 : levels of government, with various task forces focusing on, among others, data quality, M&E, priority planning, infrastructure, and security, meeting regularly. Value Implicit in (quantitative Unspecified indicator Not applicable. or Qualitative) description Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Dropped in restructuring. SINTyS elaborates data quality standards, M&E, (incl. % infrastructure framework, etc. achievement) The number of provinces that are financing the salary of the SINTyS Provincial Indicator 4 : Coordinator has increased from 4 to 12. Value (quantitative 4 provinces 12 provinces 12 provinces or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Achieved. As of April 2014, 11 provinces had designated coordinators whom (incl. % they were funding (in one provinces the coordinator recently changed, and a new achievement) one has yet to be appointed). An M&E system with a focus on, among others, information exchanges, data Indicator 5 : quality, technological framework, security, and overall performance, is in place. Monthly reports of Value Implicit in advances in key (quantitative Unspecified indicator indicators are or Qualitative) description prepared Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) Indicator 6 : SINTyS’ systems are audited regularly by a qualified external auditor. Audits of administrative Value Implicit in processes were (quantitative Unspecified indicator carried out by AGN or Qualitative) description and SIGEN in 2012. Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) By midterm at least half of the SPFO coordinators are being financed by the Indicator 7 : provinces Value Implicit in 8 by April 2011; (quantitative Unspecified indicator 12 achieved in June or Qualitative) description 2013. Date achieved 06/12/2008 12/31/2013 06/13/2013 Comments Partially achieved by midterm, fully achieved by June 2013. As of April 2014, (incl. % one of the 12 provincially financed provincial coordinators had changed and was achievement) pending designation of a replacement. DNPDP is formally involved in validating access rights to information (access Indicator 8 : profiles) and the use of SWED. The Profiles Value Implicit in document and the (quantitative Unspecified indicator law project were or Qualitative) description elevated to the National Directorate. Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Partially Achieved. Original Indicator prior to restructuring: Replaces: DNPDP is (incl. % formally and routinely involved in (1) determining the access rights to achievement) information of individual agencies and (2) monitoring its compliance A formal mechanism has been proposed to allow individual citizens to verify the Indicator 9 : accuracy of their information, and, in case of errors, correct it. SINTyS will The frequently inform in its asked questions website to page includes Value Implicit in which agency information on the (quantitative Unspecified indicator the citizen organization to or Qualitative) description need to go in which request case of errors rectification of by theme. identifying data. Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments Achieved. SINTyS cannot grant access to individual citizens as it is not the (incl. % owner of the information. achievement) By midterm a formal mechanism is in place that permits DNPDP to audit Indicator 10 : SINTyS' privacy compliance (i.e. the implementation of Roles y Perfiles) The Profiles document and the Value Implicit in law project were (quantitative Unspecified indicator elevated to the or Qualitative) description National Directorate. Date achieved 06/12/2008 06/30/2011 06/01/2012 Comments (incl. % Partially Achieved. Elevated to the National Directorate by June 2012. achievement) By midterm agencies performing data exchanges on a fully decentralized basis formally request the corresponding external control body (AGN and SIGEN at Indicator 11 : the national level and Tribunales de Cuentas at the provincial level) to expand coverage of annual audits to include privacy compliance Value Implicit in (quantitative Unspecified indicator or Qualitative) description Date achieved 06/12/2008 06/30/2011 Comments (incl. % Not recorded during implementation. achievement) By midterm provincial legislation has been requested requiring that i) all data exchanges between provincial agencies be done through the corresponding provincial SINTyS; ii) provincial agencies make their information available to Indicator 12 : SINTyS to be used for other provincial agencies that have a legitimate need to access such information; and iii) provincial agencies be prevented from collecting information from citizens once such information is available through SINTyS from an authentic source. SEWS was designed to prevent Value Implicit in the loading of (quantitative Unspecified indicator information that or Qualitative) description already exists and has been validated. Date achieved 06/12/2008 06/30/2011 09/30/2013 Comments (incl. % achievement) The number of provinces that have established their provincial coordinating units Indicator 13 : has increased from 13 to 24. Value (quantitative 13 24 21 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) The number of provincial agencies that routinely exchange information under Indicator 14 : SINTyS has increased from 63 to 92. Value (quantitative 63 92 98 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) The number of municipalities that routinely exchange information under SINTyS Indicator 15 : has increased from 11 to 126. Value (quantitative 11 126 42 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Partially achieved. 42 municipalities regularly engage in exchanges; however, (incl. % over the years SINTyS has worked with approximately 90 municipalities. achievement) The benefits from the exchange of fiscal and social information by subnational Indicator 16 : governments have increased from 233 to 473. Value Actual value not (quantitative 233 473 available. or Qualitative) Date achieved 06/18/2008 12/31/2013 09/30/2013 Comments (incl. % achievement) Indicator 17 : The number of national agencies implementing national information Exchange standards Value (quantitative 0 4 8 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Achieved. Revised in restructuring. Original indicator: The number of national (incl. % government agencies that have implemented national information-exchange achievement) standards has increased from 0 to 4. The number of provincial agencies implementing national information Indicator 18 : Exchange standards Value (quantitative 0 6 7 11 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments Achieved. Revised in Restructuring. Original indicator: The number of (incl. % provinces that have adopted national information-exchange standards has achievement) increased from 0 to 6. The percentage of information exchanged through SINTyS that is provided by an Indicator 19 : authentic source has increased from 14 to 23. Value (quantitative 14 23 100 percent 100 percent or Qualitative) Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Achieved based on restructured target. Indicator changed in restructuring. Comments Original indicator: The number of agencies that exchange personal identifying (incl. % data through SINTyS that is provided by an authentic source has increased from achievement) 14 to 23. The number of provinces in which the registries of physical persons (registros Indicator 20 : civiles) have information in electronic form has increased from 13 to 22. Value (quantitative 13 22 17 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) The percentage of overall information from registries of physical persons that is Indicator 21 : available in electronic form has increased from 31 percent to 92 percent. Value (quantitative 31 percent 92 percent 75 percent or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) The number of provinces in which registries of juridical persons (registros de Indicator 22 : personas jurídicas) have information in electronic form has increased from 6 to 18. Value (quantitative 6 18 12 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) The percentage of overall information from juridical persons registries that is Indicator 23 : available in electronic form has increased from 41 percent to 70 percent. Value (quantitative 41 percent 70 percent 55 percent or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Partially achieved. Because of the manner in which information is registered, (incl. % this indicator is not expected to ever exceed 60 percent. achievement) The number of provinces with registries of the student population (legajos de Indicator 24 : alumnos) in electronic form has increased from 8 to 18. Value (quantitative 8 18 Not applicable. or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Dropped in restructuring. The project does not continue to monitor the LUA. achievement) The percentage of overall information from registries of the student population Indicator 25 : that is available in electronic form has increased from 43 percent to 75 percent. Value (quantitative 43 percent 75 percent Not applicable. or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Dropped in restructuring. The project does not continue to monitor the LUA. achievement) The number of provinces where the registries of deeds (registros de propiedad) Indicator 26 : have information in electronic form has increased from 10 to 20. Value (quantitative 10 20 17 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) The percentage of overall information from registries of deeds that is available in Indicator 27 : electronic form has increased from 61 percent to 85 percent. Value (quantitative 61 percent 85 percent 80 percent or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) Percentage on compliance with the minimum and desirable quality standards of Indicator 28 : the databases received from national, provincial and municipal agencies Value (quantitative 50 75 75 or Qualitative) Date achieved 09/16/2011 12/31/2013 09/30/2013 Comments Achieved. Revised in restructuring. Original indicator: Initial assessment of key (incl. % information management weaknesses of individual agencies, including data achievement) quality, has been conducted and a capacity building strategy has been formulated The number of government agencies utilizing Web services for data entry (such Indicator 29 : as prefilling of data fields) has increased from 7 to 40. Value (quantitative 7 40 91 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved; surpassed target. achievement) Percentage of capacity building in Quality of Data in the provincial nodes to Indicator 30 : enhance capacities towards decentralization Value (quantitative 30 percent 70 percent 69 percent or Qualitative) Date achieved 09/16/2011 12/31/2013 09/30/2013 Comments Almost achieved. Indicator changed in restructuring. Original indicator: The (incl. % number of government agencies utilizing data quality intelligence tools has achievement) increased from 0 to 10. An information management framework that includes, among others, Indicator 31 : decentralized data quality management (Stage III) has been approved by the midterm review. Value Implicit in (quantitative Unspecified indicator or Qualitative) description Date achieved 06/12/2008 06/30/2011 Comments (incl. % Not reported during implementation. achievement) The SOA is defined during Year 1 and implemented in stages with 10 percent of Indicator 32 : activities during Year 2, 20 percent in Year 3, and 40 percent in Year 4. Value 50 percent of the Technology model and (quantitative activities in plan Not applicable. infrastructure for Phase II or Qualitative) are implemented Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Dropped in restructuring. The indicator was related to a specific technology. (incl. % Since SINTyS interacts through different technologies such as web services, achievement) there was no need to have this indicator. An M&E system is designed during Year 1 and implemented during Year 2, with Indicator 33 : full monitoring of the exchange beginning during Year 2. Value Monthly M&E Monitoring and 85 percent of (quantitative Does not exist reports to evaluation technological area. or Qualitative) management Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments (incl. % Achieved. achievement) Number of national and provincial nodes connected and in operation. Number of Indicator 34 : institutions on Stage III and number of municipal offices in operation 18 national nodes, 3 6 SPFO nodes are 4 SPFO nodes 24 SPFO nodes for provincial nodes in connected, 7 are in the impact 3 SPFO the process of Value process of being 2 SPFO nodes nodes are Stage III installation. 4 (quantitative connected, of which 1 is are on Stage and 30 organizations in or Qualitative) Stage III. No III and 30 municipalities are Stage III. 30 municipalities are municipalities connected municipalities connected are connected connected Date achieved 06/12/2008 12/31/2013 09/30/2011 09/30/2013 Achieved. Revised in restructuring for cumulative total of 18 nodes over all Comments years. Original: Number of national and provincial nodes connected and in (incl. % operation. #of institutions on Stage III and #of municipal offices connected and achievement) in operation The number of government agencies that perform fully decentralized information Indicator 35 : exchanges has increased from 3 to 5. Value (quantitative 3 5 104 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Achieved; significantly surpassed target. Currently, there are 104 enabled users (incl. % of SINTyS Web Services (SEWS). achievement) Indicator 36 : Guarantee at least 99 percent up time during Years 1 to 4. Value (quantitative 97 97 99 99 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments Achieved. Guarantee the backup infrastructure has at least 99 percent up time. (incl. % Exceeded original PAD target of 97 percent achievement) A secure data center and control center are designed during Year 1 and put into Indicator 37 : operation during Years 2 and 3. Value Centers are (quantitative None Center in operation operational or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) A partner institution and/or provinces that will provide space for SINTyS Indicator 38 : redundancy on a secure data center is(are) identified during Year 1, an agreement is signed during Year 2, and put into operation during Year 3. Value Implement the Monitor and In process of (quantitative None redundant data evaluate implementation. or Qualitative) center Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments (incl. % achievement) Indicator 39 : 2 services the interact with other agencies Value (quantitative 3 2 5 or Qualitative) Date achieved 09/16/2011 12/31/2013 09/30/2013 Comments Partially achieved. 3 services of this type with RENAPER, one with the Registro (incl. % de Aeronaves (ANAC), and another with the National Ministry of Health (SISA). achievement) Original indicator in PAD: 2 services are developed for each of years 1 to 5. If feasible, a pilot is designed during Year 1, implemented during Years 2 and 3, Indicator 40 : and evaluated during Year 4. Assessment has Value been made. It is not (quantitative None Pilot evaluation feasible to perform or Qualitative) a pilot. Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % achievement) Establish an information security architecture and framework by which SINTyS Indicator 41 : can conduct business safely and reliably and implement 60 percent of it in Year 2, 30 percent in Year 3, and 10 percent in Year 4. Sintys operates its own VPN-based network with national reach, and Value Full granular internet (quantitative Unspecified implementation by access at each or Qualitative) year 4. Node, arbitrated by strong security policies and proper perimeter defenses. Date achieved 06/12/2008 12/31/2012 09/30/2013 Comments (incl. % Achieved. achievement) At least 3 audits are conducted every year by an external (private) firm testing Indicator 42 : the robustness of the system and the control environment. Beginning in 2007, SINTyS hired external audits by world-class security professionals. Audits were not Value Implicit in conducted in 2008 (quantitative Unspecified indicator due to financial or Qualitative) description reasons, but were resumed in 2009. Last year 2full- blown pentests and a social engineering audits were conducted Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) At least 1 logical and physical security audit is conducted every year by the Indicator 43 : internal (SIGEN/AGN) auditors. AGN has been auditing SINTyS only on administrative and financial issues SIGEN has audited SINTyS on Value Implicit in information (quantitative Unspecified indicator technology matters, or Qualitative) description including information security aspects. Latest audits were conducted during several auditing practices thru 2007 and 2008. Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Partially achieved. No audits have been conducted since 2008. SINTyS has no (incl. % influence whatsoever on SIGEN's auditing agenda. achievement) SINTyS National Office reports users’ activity to agency heads on a monthly Indicator 44 : basis. Value Implicit in Practice has been in (quantitative Unspecified. indicator place since its or Qualitative) description conception in 2008. Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments Achieved. With the introduction of SEWS, agency directors will have the (incl. % capacity to monitor data consumption patterns both in real time and on a monthly achievement) basis. The number of personnel comprising the core information security team at Indicator 45 : SINTyS Central has increased from 4 to 8. Value (quantitative 4 8 9 7 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments (incl. % Partially achieved. achievement) Number of hours each information security personnel has undergone through in Indicator 46 : order to update/upgrade his skill level has increased from 16 to 40. Value (quantitative 16 40 60 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) Percentage of users that have signed a Security Awareness Statement [ESAS] has Indicator 47 : increased from 0 percent to 100 percent. Value (quantitative 0 100 100 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved achievement) Indicator 48 : Number of hours of such training programs held in a calendar year amount to 8. Value (quantitative 4 8 12 10 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/16/2011 09/30/2013 Comments (incl. % Achieved original PAD target. Partially achieved restructured target achievement) Indicator 49 : By midterm, the BCP plan is being tested twice a year. Value (quantitative 0 2 1 or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved. achievement) Indicator 50 : Approval records for ratifying all activities for executing major changes in the system and at the network level. Value Some informal Formal procedures Formal procedures (quantitative procedures in place in place in place. or Qualitative) Date achieved 09/16/2011 12/31/2013 09/30/2013 Comments (incl. % Achieved. Indicator does not appear in RF of PAD, but in Restructuring Paper. achievement) Events are captured and reported as part of the daily MIS reporting to the process Indicator 51 : owners. All significant events are reviewed for anomalies and all exceptions are investigated further. Value (quantitative 70 percent 100 percent 100 percent or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Achieved. achievement) By midterm, roles and responsibility matrix for incident response team and Indicator 52 : define a set of standard operating procedures for handling computer security incidents. Value (quantitative 50 percent 100 percent 85 percent or Qualitative) Date achieved 06/12/2008 12/31/2013 09/30/2013 Comments (incl. % Partially achieved by closing. achievement) At midterm, a five year plan has been presented for SINTyS' financing, including, among others, sources of financing for human resources, technological Indicator 53 : upgrade, renewal and maintenance at the national, provincial and municipal levels. Value Implicit in (quantitative Unspecified indicator or Qualitative) description Date achieved 06/12/2008 06/30/2011 Comments (incl. % Not reported during implementation. achievement) G. Ratings of Project Performance in ISRs Actual Date ISR No. DO IP Disbursements Archived (US$ millions) 1 12/18/2008 Satisfactory Satisfactory 0.00 2 06/25/2009 Satisfactory Satisfactory 0.79 3 12/02/2009 Satisfactory Satisfactory 2.24 4 12/09/2009 Satisfactory Satisfactory 2.24 5 06/11/2010 Satisfactory Satisfactory 2.92 6 02/06/2011 Satisfactory Satisfactory 7.92 7 06/27/2011 Satisfactory Satisfactory 12.64 8 12/26/2011 Satisfactory Satisfactory 17.27 9 07/02/2012 Satisfactory Highly Satisfactory 18.86 10 12/29/2012 Satisfactory Highly Satisfactory 19.48 11 07/10/2013 Satisfactory Highly Satisfactory 19.95 12 12/31/2013 Moderately Satisfactory Satisfactory 19.95 H. Restructuring (if any) ISR Ratings at Amount Board Restructuring Disbursed at Restructuring Reason for Restructuring & Approved Restructuring Date(s) Key Changes Made PDO Change DO IP in US$ millions This restructuring (i) made changes to some intermediate results indicators and (ii) reallocated loan proceeds to meet the financial requirements of the consolidation stage 09/16/2011 S S 13.69 (continuing investment in IT infrastructure), adjust for changes in prices due to inflation, and move funds from the PPF that were not used prior to project effectiveness. I. Disbursement Profile 1. Project Context, Development Objectives and Design 1.1 Context at Appraisal 1. At the time of design, Argentina was experiencing a sustained period of strong growth, expanding 8.7 percent in 2007 - the sixth straight year of 8-9 percent growth since the crisis. In order to achieve increased social equity, the Kirchner administration had prioritized social safety-net programs, and since 2006, had initiated a massive expansion in the coverage of social security, incorporating an estimated 1.4 million people who had previously not been covered. While together these factors had contributed to a considerable improvement in social indicators such as unemployment and poverty, these issues continued to pose significant challenges. 2. The expansion of social programs had been made possible by the substantial increase in public revenues, especially from taxes.1 However, in spite of improvements in tax administration systems, there remained room for improvement at the national and provincial levels, with some estimates suggesting that tax collections represented only about half of their potential revenue. 3. The government of Argentina was committed to continuing to improve the efficiency, efficacy, targeting, and transparency of social expenditures, and to reducing tax evasion and noncompliance. During the 1990s, such efforts had been hampered by a variety of factors, including the lack of national e-government and information and communication technologies (ICT) strategies, and a common framework for effective interconnection of ICT systems and exchange of data among government agencies. To ameliorate this shortcoming, the Social and Fiscal National Identification System (Sistema de Identificación Nacional Tributario y Social (SINTyS)) was established in 1998 to support the development of an online, real time shared information exchange network which facilitated the systematic exchange of information across national, provincial and municipal public agencies’ databases. 4. The SINTyS Adaptable Lending Program (APL), approved in 1999, was designed to support this development, through the objective “…to improve the efficiency, effectiveness and impact of social services and fiscal programs through institutionalized information exchange.”2 As conceived, the APL was planned to be implemented in three phases covering a total of eight years, supported by US$54 million in Bank lending– a demonstration phase (Phase I), an expansion phase in which additional government agencies were to be incorporated into the system (Phase II), and a consolidation phase focused on the institutionalization of the system (Phase III). 1 Collections from the value added tax and income tax increased from 13.6 percent of GDP in 2003 to 16.3 percent in 2006. 2 Project Appraisal Document on a Proposed Loan in the Amount of US10 Million to the Argentine Republic in Support of the First Phase of a Social and Fiscal National Identification System, March 31, 1999. Report No. 19110 AR. P055461 1 5. By the time of design of SINTyS II, program implementation had progressed somewhat differently than initially planned (See Table 1). Phase I, for which implementation took longer than expected, received Bank support under the Social and Fiscal National Identification System Project (P055461, US$10 million) over the course of six and a half years, and was found to have provided monetary benefits of more than US$130.5 million as a result of reduced tax noncompliance and improved targeting of social programs and social security benefits, as well as a wide range of non-monetary benefits. Due to limited resources under the 2004-2005 Country Assistance Strategy (CAS) envelope (which was fully committed and did not contain separate resources for Phase II), the first part of Phase II received Bank support through the reallocation of US$8 million from the State Modernization Project (P057449, US$30.303 million) in November 20053 (and was estimated to have provided approximately US$62.4 million in benefits during one and a half years of implementation in 2006 and 2007). 6. At the time of SINTyS II’s design, there were approximately 200 government agencies participating in SINTyS. The progressive decentralization and extension of the system to provincial and municipal governments had begun,4 and the establishment of SINTyS as a National Directorate under the National Council on the Coordination of Social Policies (Consejo Nacional de Coordinación de Políticas Sociales, CNCPS) in December 20075 was a major first step towards Phase III-Consolidation, reflecting the administration's commitment to the permanent institutionalization of SINTyS within Argentina's public sector. As a result of the significant progress already made on Phase II as well as developments in line with the objective of Phase III at the time of SINTyS II’s design, the decision was made to combine the remainder Phase II and Phase III within the SINTyS II operation. Table 1. Original APL Design vs. Implementation Original Design As Implemented Phase I: Demonstration US$10 million, 2 years US$10 million, 6.5 years (SINTyS I, P055461) US$8 million, 1.5 years (Reallocation under State Modernization I Phase II: Expansion US$37 million, 4 years (P057449)) US$20 million, 5 years (SINTyS II, P101171) Phase III: Consolidation US$7 million, 2 years 7. As such, the SINTyS II operation was designed to provide further Bank support for completion of the SINTyS APL program, building upon previous advances under the projects mentioned above and focusing on the key pending challenges which needed to be addressed in order to ensure the achievement and sustainability of SINTyS’s full potential. With its extensive experience supporting public sector modernization efforts in 3 Argentina, State Modernization Project, Loan No. 4423-AR, Proposed Third Amendment to the Loan Agreement, November 9, 2005. Amendment letter signed by the Government in May 2006. 4 All 24 provincial jurisdictions had entered into agreements formalizing their incorporation into SINTyS, six provinces had operational SINTyS provincial field offices (SPFOs), and seven provinces were in the process of implementing SPFOs. 5 Decree 78/07 2 Argentina’s subnational sector, the Bank was well-positioned to help the Government expand SINTyS at the provincial and municipal levels. Sectoral knowledge and longstanding relationships forged by the Bank with subnational actors that resulted from two Provincial Development Projects and two Municipal Development Projects 6 were particularly relevant. The Bank’s support towards the development of a national e- government plan, as well as its broad perspective, ability to apply lessons from similar projects worldwide, and its role as a facilitator of inter-institutional coordination were also seen as important. 8. The project was fully consistent with the overall strategic goals outlined in the 2006-2008 CAS (34015-AR, discussed by the Board on May 4, 2006), which focused on three pillars (sustained economic growth with equity, social inclusion and governance), and included public sector strengthening as one of four highlighted areas of work. By helping to provide more accurate information on the social and fiscal status of individuals (through contributing to reducing tax noncompliance and thereby generating additional public revenues that could be redirected to social programs and social security benefits), the operation supported the CAS objectives of enhancing fiscal equity and furthering social inclusion, and was explicitly noted in the CAS under the Improved Governance pillar. 1.2 Original Project Development Objectives (PDO) and Key Indicators (as approved) 9. The project's development objective was to identify social and/or fiscal attributes of physical and legal persons in Argentina, through a sustainable information exchange system, aimed at improving the efficiency, effectiveness, and impact of social services and fiscal programs at all levels of government in Argentina. 10. The specific objectives to be pursued under this operation were7: 1. to expand and consolidate the network underlying the exchange of social and fiscal information among public agencies at the national, provincial, and municipal levels of government, with provisions to ensure data protection, accessibility, and the quality and accuracy of information; and 2. to consolidate the institutionalization of SINTyS as an independent national entity responsible for coordinating and setting standards governing the exchange of information within Argentina's public sector. 1.3 Revised PDO (as approved by original approving authority) and Key Indicators, and reasons/justification 6 PDP I (P006005): $200 million, PDP-II (P006018): $225 million and MDP-I (P005963): $120 million, and MDP-II (P006060): $210 million 7 As per the Project Appraisal Document (PAD). Only the overall development objective noted in Paragraph 9 appears in the Loan Agreement dated January 13, 2009. 3 11. Neither the PDO nor the PDO indicators were revised during implementation. Main Beneficiaries 12. As described in the PAD, the direct beneficiaries of the Project were to be the program managers and government officials in charge of social programs and social security benefits and tax, health, judicial, and pension administration at federal and provincial levels who would be able to improve the management and effectiveness of their respective programs through better targeting and/or the reduction of fraud and leakages. The general public was to be an indirect beneficiary, as a result of facing a fairer tax burden (because of reduced tax evasion) as well as potential increases in social and other public programs, which could have a positive -albeit indirect- impact in terms of poverty alleviation. 1.5 Original Components (as approved)8 13. Component 1-Institutional and Legal Framework (US$1.56 million, of which 58.97 percent was to be financed by the Bank loan): This component was to support the further development and implementation of the institutional and legal framework required to ensure SINTyS' permanent institutionalization within Argentina's public sector, as well as the continuing expansion of SINTyS to additional agencies. Specifically, the focus was to be on the definition of SINTyS' institutional imprint (organizational structure, financial mechanisms, and coordination among participating agencies, monitoring and evaluation (M&E) and control mechanisms), the development mechanisms to ensure transparency and full compliance with Argentina’s legal framework and constitutional guarantees regarding the privacy and confidentiality of personal information, and subnational expansion. 14. Component 2-Information Management and Data Quality Framework (US$6.75 million, of which 31.41 percent was to be financed by the Bank loan): This component was to focus on further strengthening SINTyS’ information management, with a particular emphasis on enhancing the quality of the data being exchanged under the system through the development of data standards, support to the digitalization of information from key sources of social and fiscal data, enhancement of the quality of data at entry, and development of SINTyS’ information management and quality enhancement framework . 15. Component 3-Technological Framework for the Information Exchange (US$12.69 million, of which 87.71 percent was to be financed by the Bank loan): This component was to support the project’s overall information technology, telecommunication, and software development needs, with specific support to the management, development, implementation, maintenance, and continuous reengineering of technology and infrastructure; the definition of protocols and standards for data 8 See Annex 2 for more detailed component descriptions. 4 exchange; and evaluation and adaptation of modern telecommunication models to guarantee the highest reliability of the information exchange. 16. Component 4-Information Security (US$6.31 million, of which 85.1 percent was to be financed by the Bank loan): This component was to support the further development and implementation of a robust information security architecture and framework to ensure that SINTyS could run operations safely and reliably, and ensure that constitutional guarantees for the privacy and confidentiality of individual information exchanged under SINTyS were preserved and protected. The component was to finance the development and implementation of tools and methodologies, as well as the purchase of equipment for data security to protect the ICT system from unauthorized intrusion, and also foster awareness on the importance of security within the user communities within participating agencies. 17. Component 5-Project Management (US$ 0.67 million, of which 59.7 percent was to be financed by the Bank loan): This component aimed to provide the administrative, financial and budget management, accounting, audit, procurement and other services support needed for project implementation according to the rules specified in the Project Operation Manual and the Bank’s procedures. 1.6 Revised Components 18. Components were not revised during implementation. 1.7 Other significant changes 19. On September 16, 2011, a Level 2 restructuring was approved. This restructuring (i) made changes to a number of intermediate results indicators (See Annex 10 for the table of changes from the restructuring paper) and (ii) reallocated loan proceeds to meet the financial requirements of the consolidation stage (continuing investment in information technology (IT) infrastructure), adjust for changes in prices due to inflation, and move funds from the Project Preparation Facility (PPF) that were not used prior to project effectiveness. Table 2. Reallocation of Loan Proceeds by Expenditure Category Category Original September 2011 Restructuring (1) Goods 11,329,700 12,905,181 (2) Works 200,000 0 (3) Consultant Services (a) Firm 1,190,000 74,492 (b) Individual Consultants 3,772,000 3,980,446 (4) Non-Consultant Services, Training, and 1,969,000 2,159,506 Operating Costs (5) Refund of the Project Preparation Advance 1,489,300 830,375 (6) Front-End Fee 50,000 50,000 TOTAL 20,000,000 20,000,000 5 2. Key Factors Affecting Implementation and Outcomes 2.1 Project Preparation, Design and Quality at Entry 20. The quality at entry is viewed to be Moderately Satisfactory. 21. Project design was a logical continuation of the work undertaken in SINTyS I and the corresponding component of State Modernization I, and drew upon international experience in similar efforts9. 22. As previously mentioned, with progress already made on Phases II and III, SINTyS II combined the remaining Phase II and III activities under one operation. SINTyS II’s full implementation within the expected five year timeline and the successful institutionalization of SINTyS within the government structure support the positive evaluation of the feasibility of combining remaining activities within one operation. However, this feature also may have reduced the imperative to fully meet all of the intermediate results indicators designed for “passage” from the expansion to the consolidation phase under the original APL design (as implied by Annex 10 of the PAD10) (targeted for a midterm completion date, but not all fully achieved by then), given that such was not required for the origination of a separate loan or continuing disbursement. 23. The operation’s components (Institutional and Legal Framework; Information Management and Data Quality Framework; Technological Framework for Information Exchange; Information Security; and Project Management) reflected the program’s increasing emphasis on institutionalization following the successful demonstration of SINTyS’ impact in past operations11, and represented the key areas in which additional work was needed to ensure the agency’s mainstreaming into Argentina’s public sector (strengthening the institutional framework to define users’ responsibilities and prerogatives; ensuring the privacy, confidentiality and legitimate use of data; and generating confidence in the appropriate management of the information exchanges). This focus reflected an understanding of the challenges encountered in the past (e.g. 9 During Project preparation, visits to Estonia and Belgium were undertaken, with the goal of learning from their experience in information exchanges. 10 The preconditions for moving from Phase II to Phase III, as appearing in the SINTyS I PAD appear as the main headings in Annex 10 of the SINTyS II PAD. The specific achievements associated with these preconditions are defined through the comments on the state of these preconditions in Annex 10 of the PAD and the Results Framework. 11 The SINTyS I operation contained components in Improving Social Services; Improving Fiscal Efficiency; Institutional Framework, Infrastructure and Common Services; Management of the System; and Project Administration, and the corresponding component of State Modernization I included subcomponents on Improvement of Social Services; Improving Fiscal Efficiency; Technological Framework and Infrastructure; Organizational, Institutional, and Legal Framework; and Security Framework. 6 agencies’ reticence to share their information, the institutional complexities implied by Argentina’s federal structure, and inconsistent data quality). 24. Project design contemplated a thorough assessment of possible project risks and a corresponding set of risk mitigation measures, some of which were linked to monitoring indicators thereby facilitating oversight during implementation. In retrospect, in monitoring of indicators, it seems that some of the designed mitigation measures could have benefited from a deeper assessment of their feasibility (e.g. annual security audits by external control bodies when SINTyS cannot influence the General Syndicate of the Nation’s (Sindicatura General de la Nación, SIGEN) auditing agenda). However, given that the associated possible risks identified did not impact project implementation, the mitigation measures applied appear to have been sufficient. 25. In January 2008, a PPF for US$1,489,300 was approved to finance activities including the definition of the components, diagnostic studies, and evaluations of the needs of the participating government agencies. The corresponding loan was subsequently approved by the Board on July 10, 2008 and became effective on February 27, 2009 following receipt of the legal opinion of the Treasury Attorney ( Procurador del Tesoro) confirming the validity and enforceability of the Loan Agreement (the only effectiveness condition). 26. Implementation arrangements built upon those associated with previous support to the agency, with additional responsibilities being transferred to SINTyS (the agency) under SINTyS II. The CNCPS continued to be responsible for project implementation and in charge of the Central Executing Unit (CEU), which benefited from the continuity of staff associated with the previous projects. Following the past use of the United Nations Office for Project Services (UNOPS) as the procurement agent and funds administrator, it was decided to limit the use of UNOPS in SINTyS II to only the first two International Competitive Bidding processes. These changes were a positive reflection of the institutionalization that had occurred since the inception of the original APL program. Although the CEU’s lack of direct past experience in Bank procurement processes (identified at design as one of the risks) did contribute to some initial challenges in implementation, these issues were overcome through intensive, proactive, and regular coordination between the CEU and the Bank (discussed below). 27. While design drew upon the lessons learned from past operations, it seems that it may have been overly ambitious in its assessment of some aspects of the environment for new inter-institutional coordination arrangements amongst stakeholders. For example, the meetings anticipated at design related to the SINTyS and provincial advisory bodies and the users’ forum were not held in the first two years of project implementation, resulting in the modification of the related intermediate results indicators (change of measurement in the case of the first two to already existing mechanisms and elimination in the case of the third) in the September 2011 restructuring. Similarly, the target set for regular municipal participation in data exchanges also was overly ambitious, and was not able to 7 be met over the implementation period, in part as a result of an overestimation of municipal capacity and motivation12 to participate. However, as commented upon further in Section 3, these factors do not appear to have hampered the successful expansion and institutionalization of the system, and demand for SINTyS’ services remains high. 2.2 Implementation 28. Overall, project implementation proceeded quite smoothly. The Project was implemented as planned over the course of five years, aided by the strong motivation, flexibility, and skill set of the SINTyS team, substantial political support from the Government, and strong support from the Bank team, which included experts in the areas of information security and data quality. 29. Learning from the experiences of the first provincial nodes and complications related to the renovation and access to SINTyS spaces, and taking advantage of recent technological advances, SINTyS adjusted its provincial strategy in 2009 to allow for a solution that was more cost-effective while guaranteeing the physical security of equipment, thereby facilitating expansion into less affluent provinces. The successful expansion to additional provinces was also aided by central SINTyS’ understanding of the need to tailor their presentation of SINTyS’ services to each province’s specific needs and commitment to re-presenting the SINTyS model to local authorities following changes in political leadership. 30. While SINTyS II involved fewer acquisitions processes than SINTyS I, the processes carried out were more sophisticated, and the newness of some of the technology deployed implied additional time be devoted for the Government’s corresponding technical reviews. Following some initial delays and complications in procurement processes, including delays in UNOPS procedures, however, these challenges were overcome through intensive coordination between the CEU and the Bank task team. This good relationship, combined with permanent dialogue between technical and procurement experts both within SINTyS and the Bank, facilitated the successful execution of large and complex processes (such as those related to a data safe room) without delay. 31. By the time of the midterm review (MTR) in May 2011, significant progress had been made in all of the components – with, for example, national decrees having been emitted to designate the individuals holding key positions within SINTyS13, a detailed data quality operations manual having been developed, the new data center being operational, and information security controls having been applied in central SINTyS’ new offices. Following the review of project indicators during the MTR, the Project was restructured in September 201l to reallocate funds between expenditure categories and modify some of the intermediate results indicators in order “to properly reflect project 12 Under the Constitution, municipalities are autonomous. 13 Decrees 486/10, 487/10 y 488/10 designated the individuals holding the positions of National Director of SINTyS, Director of Integration of Information Technology, and Director of Technology for Information Exchange. 8 progress as well as SINTyS challenges in face of the consolidation phase.”14 Some of these changes (such as the dropping of indicators related to student registries once the information could be obtained through the Universal Child Allowance (Asignación Universal por Hijo, AUH), as well as the one related to the service-oriented architecture model which was outdated following the creation of web services) are indicative of changes to implementation that could not have been anticipated at design and were beyond SINTyS’ control. Some others, however (e.g. those previously mentioned related to the convening of external groups (CNCPS advisory body, provincial advisory body, users’ forum)) seem to reflect a shift in perspective since design. 32. As discussed further below, the Project is believed to have resulted in significant savings. However, during implementation, the verified impact of SINTyS II was not measured in the form anticipated at design, due to the growing technical challenges associated with doing so given the increasing number of information exchanges and SINTyS’ desire not to be viewed as auditing independent agencies’ use of information. Supervision missions as early as November 2009 underscored the importance of impact information, and discussions with the Bank team on the development of a new tool to measure SINTyS’ financial impact continued throughout the remainder of implementation. By closing, SINTyS had developed a tool via which average potential efficiency gains from removing identified irregular claimants in a particular period could be estimated. While allowing for the collection of information illustrative of project efficiency and within the spirit of the project development objective, such information is not directly comparable with the two impact-related PDO indicators, thereby preventing measurement of these indicators. 33. In spite of SINTyS’ proactive approach during project implementation, it is important to note that some aspects - which could perhaps have been better anticipated in design - lay beyond its control, and also demonstrate how signing and revisiting agreements is a continual activity within an agency such as SINTyS. The activity related to the digitalization of the civil registries (included within Component 2) is temporarily on hold for reasons beyond the scope of SINTyS (registries are autonomous and it is required to enter into separate agreements with each entity in order to use their information). Similarly, while SINTyS has developed information exchange standards for thirty data types, formalization of these standards with the National Office of Information Technology (Oficina Nacional de Tecnologías de Información, ONTI) is pending. 2.3 Monitoring and Evaluation (M&E) Design, Implementation and Utilization 34. The Project’s M&E Framework included an extensive set of indicators, which are to be commended for their ambitious scope, designed to both continue monitoring of some of the key indicators used in the SINTyS I project15 and incorporate mechanisms 14 Restructuring paper 15 The indicators from the first operation that continued to be monitored in SINTyS II included: (1) Number of agencies using consistent common processes to identify entities and assets; (2) Percentage of 9 through which progress on the SINTyS II operation’s particular focus on expansion and consolidation could be captured. However, given that in order to properly reflect progress as well as some of the challenges in the face of the consolidation phase, some were later modified during the restructuring without having previously recorded any progress prior to this point, the extent to which some indicators’ original formulations were practical is unclear. Those associated with the verified impact were not measured during implementation for the reasons discussed above. While at design the continuation of the verified fiscal impact indicators may have seemed logical from the perspective of the overarching APL program and such indicators were maintained during project supervision because of their recognized importance, it took longer than expected to reach agreement on the measurement methodology, and ultimately they were not measured as planned at design for the reasons discussed above. 35. While the Project’s extensive set of intermediate indicators was surely intended to provide detailed monitoring information on project implementation, in practice, the large number of indicators seems to have caused some challenges. The baselines of some intermediate indicators were not clearly specified in the PAD, and some of the original indicators (some of those with a midterm target date) were not included in the tables prepared at the Project’s restructuring. 36. The central SINTyS office was responsible for monitoring overall project implementation, including continuing development at the national level, implementation of remaining provincial field offices, and special activities related to specific registries (civil, juridical, deeds and students). Provincial SPFOs were responsible for monitoring subnational expansion. 37. Indicator measurements and progress was monitored and discussed with the CEU and the Bank team during missions, with reports regularly provided to the Bank. The practice of monitoring activities appears to have been well institutionalized within SINTyS. At closing, SINTyS had its own M&E system in place, and was preparing monthly reports for management to monitor advances in key management indicators. 2.4 Safeguard and Fiduciary Compliance 38. Throughout project implementation, Financial Management (FM) performance was satisfactory, with audits received on time, and considered acceptable by the Bank. 39. As mentioned above, some initial procurement challenges were encountered (including delays in UNOPS procedures, which subsequently resulted in a change in the procurement agent from UNOPS to the CEU). However, following the initiation of close and frequent interactions between the CEU, the Bank procurement specialist, and the task team including preparation of annual procurement plans, early detection of complex procurement processes, and prompt reviews of No Objection requests, implementation the population univocally identified; (3) Percentage of the population with family relationship data; (4) Amount of incorrect benefits not awarded, due to SINTyS, and (5) Increase in tax benefits due to SINTyS. 10 proceeded smoothly and project procurement ratings were at least moderately satisfactory16 throughout implementation. 40. With respect to safeguard, no safeguard policies were triggered by the Project at design, an appropriate decision, as no such issues arose during implementation. 2.5 Post-completion Operation/Next Phase 41. As of project closure, SINTyS appears to have become a well-institutionalized agency. The activities undertaken have resulted in significant utilization of its services (between January 2008 and September 2013, more than 13,000 data exchanges took place17, and as of September 2013, 98 provincial agencies and 42 municipalities were regularly exchanging information through the system (increasing from baselines of 63 and 11, respectively), with information meeting the desired quality standards. From the point of view of demand, it seems that SINTyS is well-positioned to continue to facilitate such exchanges in the future, delivering a service valued by many agencies within the Argentine public sector. 42. From the perspective of internal sustainability, SINTyS also seems to be well- positioned to sustain the advances to date. All of SINTyS’ personnel costs, as well as those associated with the updating and operation of its technological platform have been incorporated into the budget of the CNCPS, and twelve provinces were financing the salaries of their provincial coordinators in September 2013. Recognizing the significant work carried out to date in internal processes, central SINTyS has also expressed its intent to thoroughly document such progress, facilitating the creation of institutional memory of the agency’s evolution. 43. While the Bank does not currently have immediate plans for a follow-up project, the topics addressed in SINTyS II remain of high relevance. There are positive signals that future Bank engagement in Argentina would include a focus on strengthening capacities of subnationals for public service delivery, and the availability of accurate and timely fiscal and social information made possible through the data exchanges facilitated by SINTyS would likely form an important input to such efforts. 3. Assessment of Outcomes 3.1 Relevance of Objectives, Design and Implementation 44. The objectives pursued under the SINTyS II Project remain highly relevant and of critical importance. Improving the efficiency, effectiveness, and impact of social services and fiscal programs at all levels of government continue to be shared priorities of the 16 Through ISR#3 (December 2, 2009), Project procurement was assessed to be satisfactory; subsequent assessments through the remainder of implementation were moderately satisfactory. 17 In the first months of 2008 approximately 60 exchanges took place per month. By 2013, the number of monthly exchanges had more than doubled. 11 Government of Argentina and the Bank, and as mentioned above, there are positive signals that future Bank engagement in Argentina will reflect this commitment. By facilitating the exchange of information on fiscal and social benefits between agencies at multiple levels of government, SINTyS has contributed to the strengthening of such agencies’ institutional capacity to effectively use their information and in doing so, likely to have helped improve the efficiency and effectiveness of agencies’ associated social and fiscal programs. 3.2 Achievement of Project Development Objectives 45. Overall, the Project could be said to have satisfactorily met its development objective. Project activities have contributed to the improved identification of social and/or fiscal attributes of physical and legal persons in Argentina, as evidenced by the full achievement of PDO # 2 (92 percent of physical persons unequivocally identified by SINTyS), #4 (32 percent of the population identified with family relationship data), and #5 (38.2 million people identified with more than 75 percent confidence), and the partial achievement of PDO #3 (60 percent of juridical persons unequivocally identified) (See Table 3 below). The significant over-achievement of the target set for PDO #1 (number of agencies using consistent common processes), as well as the achievement of the PDO indicators measuring high network availability (PDO#7) and the reduction of highly critical vulnerabilities exploited by pentests (PDO#8) are critical to the creation of the enabling environment required for the sustainability of the information exchanges being facilitated by SINTyS. Table 3. PDO Indicators, Achievement Summary Indicator PDO 1. The number of government agencies and programs using Achieved. consistent common processes to identify entities and assets has increased from 16 to 38. PDO 2. The percentage of physical persons that can be identified Achieved. univocally (sic) by SINTyS has increased from 31 percent to 92 percent. PDO 3. The percentage of the juridical persons univocally (sic) Partially achieved. At 60 identified has increased from 41 percent to 70 percent. percent, above Year 4 target. PDO 4. The population identified with family relationship data has Achieved. increased from 9 percent to 32 percent. PDO 5. Population identified with a level of confidence greater than Achieved. 75 percent has increased from 35.2 to 38.2 million. PDO 6. The number of data types for which SINTyS and ONTI have Not achieved. issued information-exchange standards has increased from 0 to 50. PDO 7. The information exchange network maintains 97 percent Achieved. availability. PDO 8. The number of highly critical vulnerabilities exploited by Achieved. penetration test activities in a scenario simulating a legitimate SINTyS user from a participating government agency as a proportion of services available to agencies has decreased from 2 to 0. PDO 9. Amount of incorrect benefits not awarded due to SINTyS in Indicator not measured during a given year (in US$ million) implementation. PDO 10. Increase in tax collections due to SINTyS in a given year Indicator not measured during implementation. 12 46. However as reflected in Table 3, three PDO targets set forth in the results framework were not achieved as planned, leading to an evaluation of moderately satisfactory performance against the metrics set forth in the Results Framework. SINTyS has developed information exchange standards for 30 data types, but as formalization of these by ONTI is still pending, the indicator is not considered to have been achieved. As previously mentioned, the indicators related to verified fiscal gains (PDO#9 and #10) were not measured as designed during implementation, and are thus considered to be unmet. However, the Counterpart has developed a tool to estimate SINTyS’ potential economic impact (see Annex 3 for details on the calculations carried out, and Section 3.3 for a summary of results), the results of which are suggestive of the potential for significant savings from the identification of incorrect benefits, contributing to the increased efficiency, effectiveness and impact of social services and fiscal programs. 47. It is important to reiterate the Project’s substantial results, in line with both the spirit of the overall development objective and the two specific objectives discussed in the PAD (expansion and consolidation of the network, ensuring data protection, accessibility, and quality; and consolidation of the institutionalization of SINTyS). Intermediate indicators demonstrate such progress, with at least 22 of 49 intermediate results indicators have been fully achieved and 21 others having demonstrated progress towards achieving their corresponding targets, and the SINTyS network has continued to expand and consolidate over program implementation. The development of tools including SEWS (Servicio Web SINTyS, SINTyS Web Services) and VIAS (Ventanilla de Integración Automática y Seguimiento, Window for Automatic Integration and Monitoring) (among others) has allowed entities to improve the quality of their data and facilitated the attainment of high-quality information in real time, with more and more government agencies now utilizing web services (use increased from 7 to 91), and 8 national and 11 provincial agencies now use national information exchange standards. Provincial support for such exchanges is evident, with twelve provinces financing the salaries of their provincial coordinators in September 2013 (from a baseline of 4) and conversations during supervision missions with provincial agencies in Formosa and San Juan expressing their satisfaction with SINTyS’ services. 48. Overall, substantial Program results were also achieved vis-à-vis the original APL’s objective of improving the efficiency, effectiveness, and impact of social services and fiscal programs through institutionalized information exchanges – evident in both the results of the SINTyS II loan described above, as well as the advances achieved under SINTyS I and the corresponding component of the State Modernization loan.18 18 The SINTyS I project was found (Report No. 36160-AR) to have successfully demonstrated the benefits of comprehensive information exchange and won the participation of a sufficiently substantial number of entities to establish consensus for widespread buy-in to the concepts and benefits, leading to national and provincial agencies actively seeking SINTyS’ support to monitor their social spending and rationalize their beneficiaries. Benefits of U.S. $130.5 million were estimated. Under the corresponding component of the State Modernization Project (ICR No. 0000778), activities were found to have contributed to improving the completeness, accuracy and reliability of agency data through cross-validation, which in served to enhance 13 3.3 Efficiency 49. The activities undertaken have contributed to the increasing efficiency of SINTyS’ services, with developments such as the VIAS tool having significantly reduced the time required for data exchanges. 19 Similarly, the establishment of user profiles within the system has allowed for important savings in time, eliminating the delays previously encountered if the person responsible for physical verification was not present. 50. Based upon the Counterpart’s calculations of potential economic benefit s, and looking only at the number of deceased individuals identified among the social benefits registries in 2013 (using the average value of benefits within each registry and assuming that such individuals were dropped from the registries one month after identification), potential savings of more than US$160 million were estimated – implying that savings could be seven times the size of the US$20 million loan associated with SINTyS II in just 2013. These savings, combined with the on-time implementation of SINTyS II, suggests that Project efficiency was high. Overall program efficiency is also quite high – while total implementation was approximately five years longer than anticipated, the program had a US$192.9 million fiscal impact between 1999 and 2007 (in addition to the potential impact from SINTyS II), and was implemented using US$38 million in Bank funds instead of the planned US$54 million. 3.4 Justification of Overall Outcome Rating Rating: Moderately Satisfactory 51. Given the Project’s and the APL’s high relevance, substantial progress on project and program objectives and the efficiency implied by the counterpart’s calculations on the Project’s potential economic impact in 2013 alone, the overall Project outcome could be considered to be satisfactory, as could the outcome of the APL program as a whole, taking into account the savings reported under the SINTyS I and the corresponding component of State Modernization I projects. While the outcome of the APL program is therefore considered to be satisfactory, given the necessity of measuring the SINTyS II’s project achievement against the formal Results Framework, and progress against the corresponding PDO indicators – the overall Project outcome rating is viewed to be moderately satisfactory. 3.5 Overarching Themes, Other Outcomes and Impacts (a) Poverty Impacts, Gender Aspects, and Social Development the targeting of social programs and reduce tax non- compliance (resulting in estimated benefits of over US$60 million from reduced tax non-compliance and enhanced targeting of social programs). 19 Before SINTyS, exchanging such information could take between five and six months. Over the years, with SINTyS, the average number of days continued to decline, dropping from 38 days in the period between creation and 2003 to 7 days in 2012, and now with VIAS one can have the information within 1 to 2 days 14 52. While the project did not directly impact poverty, gender or social development, the estimated potential impact of removing irregular claimants as beneficiaries of social programs implies that the government will be able to direct social benefits to those in greatest need, thereby indirectly contributing to poverty reduction and social development policies. (b) Institutional Change/Strengthening 53. As the Project focused upon the expansion and consolidation of sustainable information exchanges, the SINTyS II project has contributed significantly to the institutional strengthening of the national and provincial SINTyS offices. The technical assistance provided by central SINTyS to the provincial offices has helped to strengthen these offices’ capacities, and institutionalize their roles. At the central level, important practices – including the setting of annual goals, the creation of monitoring dashboards to monitor exchanges, and the development of a strong security environment – have been institutionalized, and are expected to be sustained well beyond the scope of this particular loan. Furthermore, and perhaps most importantly, the continuing adherence of additional agencies to the networks speaks to a growing culture of information sharing within the public sector – an impact that while supported by the SINTyS II project, points to an institutional change extending much further within the Argentinian public sector. (c) Other Unintended Outcomes and Impacts (positive or negative) 54. No unintended outcomes or impacts were identified. 3.6 Summary of Findings of Beneficiary Survey and/or Stakeholder Workshops 55. Neither a beneficiary survey nor a stakeholder workshop was carried out. 4. Assessment of Risk to Development Outcome Rating: Moderate 56. It is clear that over the course of implementation, the institutionalization of SINTyS as an agency has been achieved, and that it is no longer a “ project.” As previously mentioned, SINTyS has succeeded in generating significant demand from other agencies for its services, a place for itself within the institutional framework of multiple levels of government (recognition as a National Directorate, receipt of funding through the federal budget, provincial funding of provincial coordinators, etc.), and has also started to share its experience with other developing countries. Important management practices (regular monitoring of management indicators and creation of monitoring dashboards, establishment of annual goals, capacity building efforts focused on explaining the reasons behind policies - instead of simply focusing on the enforcement of the policies themselves) have been internalized, and all indications to date suggest that they will be maintained in the future. 57. However, several issues remain to be addressed and could pose a challenge in the medium to longer term. Covering the entirety of the state (with so many systems, and 15 being so physically large) will continue to be a challenge moving ahead, and it may be that expansion processes reaches a point where its advancement is limited by the diversity of the actors involved. Given the rise in cloud technology, it also remains to be seen how SINTyS will evolve. While such technology has the potential of permitting the expansion to areas previously unreachable due to the challenges associated with their maintenance of their individual servers, given the political importance associated with local control of the data safe rooms, the extent to which this technology is able to be taken advantage of in such contexts remains to be seen. 5. Assessment of Bank and Borrower Performance 5.1 Bank Performance (a) Bank Performance in Ensuring Quality at Entry Rating: Moderately Satisfactory 58. In designing the SINTyS II operation, the Bank team drew upon past experiences with SINTyS and related projects, incorporating lessons learned from these experiences. Given the progress at the time of design, the decision to combine Phases II and III under the same APL seems to have been justified, and based upon the progress made during implementation, have reflected an accurate assessment of what could be accomplished over the Project’s five year implementation period. 59. Nevertheless, it seems that some of the issues encountered during implementation could have been diminished by further consideration of contextual realities and possible implementation challenges during the design phase. The fact that discussions regarding the need to adopt a new methodology to measure Project impact arose less than a year after Project effectiveness suggests that design could have benefitted from a greater analysis of the considerations surrounding its measurement. Additionally, design could have merited from a greater consideration of the necessity and practicality of including so many intermediate results indicators; in implementation, the large number of intermediate indicators (53) proved to be somewhat cumbersome. (b) Quality of Supervision Rating: Satisfactory 60. The Bank team played a very proactive role in Project implementation. Supervision missions were carried out one to two times every year, and in between missions, video conferences were arranged in order to facilitate a fluid dialogue with the SINTyS team. During the period in which many procurement processes were being undertaken, missions included detailed meetings with procurement staff and a permanent dialogue between technical and procurement experts within the Bank and SINTyS was maintained, helping to facilitate the timely completion of the Project’s highly technical activities. From an early stage of implementation, Project supervision included active discussions on the impact measurement methodology (which took longer than anticipated to agree upon), and progress was followed up on both during missions and in between video conferences, helping to support the development of the methodology developed to 16 measure the Project’s potential impact. While surely complicated by the large number of intermediate indicators established at design, a more detailed review of the modified results framework would have helped to further facilitate the assessment process. The intensive supervision should also be credited for supporting the Project’s full implementation without requiring an extension, as well as the almost full disbursement of loan resources. (c) Justification of Rating for Overall Bank Performance Rating: Moderately Satisfactory 61. Considering the overall strength of project design and supervision, but in light of the challenges encountered due to Project design, overall Bank performance is considered to be moderately satisfactory. 5.2 Borrower Performance (a) Government Performance Rating: Satisfactory 62. During project preparation and implementation, the Government played a critical role in supporting the expansion and institutionalization of SINTyS, and many of those involved with the Project cited the strong level of Government support as one of the key factors contributing to the Project’s success. Indeed, the Project’s success in overcoming the challenges and concerns associated with inter-institutional sharing of data across levels of government would not have been possible without the Government’s demonstrated commitment to the agency and its work. In spite of its overarching satisfactory performance, some of the activities that would have required the involvement of multiple agencies (emitting of shared data standards, verification of fiscal benefits of data exchange, creation of new advisory bodies) encountered some challenges which could have been diminished through additional Government oversight. (b) Implementing Agency or Agencies Performance Rating: Satisfactory 63. SINTyS was very committed to the Project objectives of expanding and consolidating the data exchange network, as well as the institutionalization of the agency as an independent national entity. Its flexibility and proactivity in adjusting to technological advances and the realities encountered during provincial expansion played an important role in supporting the continuing development of the data exchange system. The agency’s sustained effort to develop an impact assessment tool in spite of the challenges faced with defining the methodology under this phase of the Project (and the realities that made calculating the impact as planned at design technically complicated and outside of the agency’s mandate), demonstrate its commitment to the Project and all Project objectives. Highly technical projects such as these can often encounter significant delays in implementation, and SINTyS’ dedication to moving forward on implementation, including the realization of complex procurement processes, was critical to both overcoming the initial difficulties and the achievement of an on-time completion of the SINTyS II Project in alignment with the Project’s development objectives. 17 (c) Justification of Rating for Overall Borrower Performance Rating: Satisfactory 64. Considering the important role that Government support played in the project’s successful completion and its continuing support to SINTyS as an agency – critical to the agency’s institutionalization process –, and SINTyS’ successful achievement of the Project’s development objective, overall borrower performance is considered to be satisfactory. 6. Lessons Learned 65. Early institutionalization of SINTyS helped to ensure the sustainability of project activities. The establishment of SINTyS as a National Directorate at the time of loan design served as the foundation for later advances, signaling the Government’s commitment to the agency’s institutionalization. 66. Given the constant evolution in technology, it is critical that technology- intensive projects be attentive to changes and how advances can impact their business model. Because of SINTyS’ awareness of such changes as well as its flexibility to adjust its strategy, the agency was able to leverage technological advances to expand its subnational coverage. 67. While the complexity of projects that are intensive in the procurement of ICT products and services can often result in delays, strong coordination between the SINTyS and the Bank team can help ensure the timely completion of planned activities. In the case of SINTyS II, a hands-on approach, combining regular meetings between the counterpart, the task team leader and procurement staff, was critical to overcoming procurement challenges and facilitating the successful completion of the project within the expected timeline. 68. While project design should include sufficient indicators to monitor progress on key aspects of implementation, too many results indicators can complicate monitoring efforts. The large number of intermediate indicators in the SINTyS II results framework complicated Project restructuring, contributing to challenges in the evaluation of some Project outcomes. 7. Comments on Issues Raised by Borrower/Implementing Agencies/Partners (a) Borrower/implementing agencies 69. Given the Project’s achievement of the general development objective and almost all indicators, as well as its timely development, implementation and execution, the Government views the Overall Outcome to be satisfactory. (b) Cofinanciers N/A (c) Other partners and stakeholders N/A 18 Annex 1. Project Costs and Financing (a) Project Cost by Component (in US$ Million equivalent) Actual/Latest Appraisal Estimate Percentage of Components Estimate (US$ millions) Appraisal (US$ millions)20 Component 1 1.56 1.09 69.9 Component 2 6.75 1.10 16.3 Component 3 12.69 11.94 94.1 Component 4 6.31 4.86 77.0 Component 5 0.67 0.94 140.3 Total Baseline Cost 27.98 19.93 71.2 Physical Contingencies 0.00 0.00 Price Contingencies 0.00 0.00 71.2 Total Project Costs 27.98 19.93 Front-end fee 0.05 0.05 Total Financing Required 28.03 19.98 71.3 (b) Financing Appraisal Actual/Latest Percentage Type of Source of Funds Estimate Estimate of Cofinancing (US$ millions) (US$ millions) Appraisal Borrower 8.03 0.0021 . International Bank for Reconstruction 20.00 19.98 99.9 and Development 20 Only includes loan proceeds; local support to SINTyS was provided and managed by the General Treasury of the Nation and these funds were not monetary transfers into the Project’s operational account . 21 See prior footnote. 19 Annex 2. Outputs by Component Component 1-Institutional and Legal Framework: This component provided support to SINTyS authorities to further develop and implement the institutional and legal framework required to ensure SINTyS' permanent institutionalization within Argentina's public sector at the national, provincial, and municipal levels. Specifically, the focus was to be on the definition of SINTyS' institutional imprint, including its organizational structure, financial mechanisms, and coordination among participating agencies, as well as its monitoring and evaluation (M&E) and control mechanisms. In addition, this component was to focus on developing mechanisms to ensure transparency and full compliance with Argentina's legal framework and constitutional guarantees regarding privacy and confidentiality of personal information. This component also aimed to support the further expansion of SINTyS, not only by incorporating additional government agencies at the national level but also by continuing its decentralization at the subnational level (provincial and municipal). Subcomponent 1.1-Institutional Framework: This subcomponent was to provide support to SINTyS authorities to further develop its institutional framework, paying particular attention to the development of an institutional imprint and governance structure reflecting SINTyS' collaborative nature, with multiple users at the three levels of government. The activities in this subcomponent were to be grouped into two main categories: SINTyS’s institutional imprint (covering SINTyS’ organization structure, financing mechanisms, coordination with other government agencies, advisory bodies, and institutional arrangements) and monitoring and control (monitoring and evaluation and management tools, and internal and external control mechanisms). Subcomponent 1.2-Legal Framework: This subcomponent was to provide support for the further strengthening and implementation of an effective legal framework and complementary operational mechanisms to protect the privacy of data exchanged under SINTyS, ensuring that only those with an authentic right have access to the information and do not misuse it. The activities to be financed included design of SINTyS' privacy protection framework, definition of access to information rights of individual agencies, definition of compliance and enforcement frameworks, and drafting additional legislation to guide the information exchange and promoting its adoption at the national and provincial levels as well as to control the use, dissemination and disclosure of information. Subcomponent 1.3-Expansion at the Subnational Level: This subcomponent was to continue to support SINTyS' ongoing expansion at the provincial and municipal levels, furnishing them with the necessary knowledge and technical assistance. Activities within this subcomponent were to include coordination across jurisdictions -national vis-a-vis provincial governments; provincial vis-à-vis provincial and municipal governments- as 20 well as legal agreements to support them, and ICT equipment. In addition, this subcomponent was to support training and dissemination activities. Outputs:  Interconnected the provinces of Córdoba, Río Negro, Tucumán, San Juan, Formosa, La Rioja, Catamarca, Santa Cruz, Corrientes, Misiones, Entre Ríos and Chubut. Generated institutional conditions for the interconnection of Chaco, Santiago del Esterno, Tierra del Fuego and Neuquén.  Over the period of the loan, 10,771 information exchanges took place (13,653 over the entire life of the system).  Since the creation of SINTyS, a total of 380 agreements have been reached with various jurisdictions, organizations, and national, provincial and municipal entities. 151 of these agreements correspond to the period of SINTyS II.  211 regulations referring to SINTyS were approved. These regulations can be classified according to the jurisdiction in which they were emitted (national, provincial, municipal) and their thematic area (organizational structure, procedures, and those approving agreements).  44,254 judicial requests were responded to.  SINTyS’ website was designed on three occasions, with the goal of converting the site into a tool for diffusion, consultation, and communication with the organizations using SINTyS. As such, content was generated each time missions and meetings took place, or agreements were signed to communicate and share with the SINTyS community.  Annual workshops were held with the coordinators and consultants in the Provincial Coordination Units. Within these workshops, advances in technology and services were presented and consultants were trained in the regulations associated with SINTyS’ functioning and the Law of Protection of Personal Information. Training was also carried out in the standards of the ISO 9001 regulation of Quality Management, among others. These gatherings were also used to exchange experiences and strategies between provincial consultants, helping to spread knowledge of good practices amongst provinces.  At least two video conferences were carried out each year with each of the 13 provincial coordination units which have video conference equipment provided by SINTyS, allowing for the number of provincial missions to be reduced without a loss to fluid contact. (The video conference system was implemented in mid- 2011, implying 65 video conferences (13 provinces*2 video conferences*2.5 years).  Diffusion and training events on information exchanges were organized with entities in the provinces of Tucumán, Mendoza, San Juan, Misiones, La Rioja, Corrientes, Jujuy, Catamarca, Entre Ríos, Río Negro, Forma, Tierra del Fuego, Salta and Córdoba.  User and Administrator Manuals for SINTyS services were created for VUO (Ventanilla Única de Organismo, Entity Single Window), Web Services, SEWS, VIAS and CPM (Consulta Puntual Minima, Basic Consultations) in their different versions, according to technological modifications. 21  In coordination with the other components and the National Directorate, Executive Summaries for the World Bank, Annual Reports for the Ministry of Social Development, and summaries of activities for the Ministry of Economy were prepared. Subcomponent 1.1 - Institutional Framework Level of Baseline Target Revised Target Actual Value achievement SINTyS advisory body in place, with representation from key agencies at the national level (DNPDP, ONTI, CNPS monthly CNPS monthly RENAPER, AFIP, ANSES), and meets regularly. Unspecified Implicit in indicator description meetings meetings Achieved Annual meetings Provincial advisory body in place, with representation from with provincial Annual meetings with provincial authorities, and meets regularly. Unspecified Implicit in indicator description coordinators provincial coordinators Achieved Users’ forum is in place, with representation of government agencies from all levels of government, with various task forces focusing on, among others, data quality, M&E, priority planning, infrastructure, and security, meeting regularly. Unspecified Implicit in indicator description Dropped The number of provinces that are financing the salary of the SINTyS Provincial Coordinator has increased from 4 to 12. 4 provinces 12 provinces 12 provinces Achieved An M&E system with a focus on, among others, information Monthly reports of exchanges, data quality, technological framework, security, advances in key and overall performance, is in place. Unspecified Implicit in indicator description indicators are prepared Achieved Audits of administrative processes were carried SINTyS’ systems are audited regularly by a qualified out by AGN and Partially external auditor. Unspecified Implicit in indicator description SIGEN in 2012. achieved Partially achieved by midterm, By midterm at least half of the SPFO coordinators are being 8 by April 2011; 12 fully achieved financed by the provinces Unspecified Implicit in indicator description achieved in June 2013. in June 2013. 22 Subcomponent 1.2 - Legal Framework Revised Baseline Target Target Actual Value Level of achievement Partially Achieved. Original Indicator prior to restructuring: Replaces: DNPDP is formally and routinely The Profiles involved in (1) document and the determining the access law project were rights to information DNPDP is formally involved in validating Implicit in elevated to the of individual agencies access rights to information (access profiles) indicator National and (2) monitoring its and the use of SWED. Unspecified description Directorate. compliance The frequently SINTyS will asked questions inform in its page includes website to information on the which agency organization to Achieved. SINTyS A formal mechanism has been proposed to the citizen need which which cannot grant access to allow individual citizens to verify the accuracy Implicit in to go in case of request individual citizens as it of their information, and, in case of errors, indicator errors by rectification of is not the owner of the correct it. Unspecified description theme. identifying data. information. By midterm a formal mechanism is in place Elevated to that permits DNPDP to audit SINTyS' privacy Implicit in National compliance (i.e. the implementation of Roles y indicator Directorate by June Perfiles) Unspecified description 2012. Partially Achieved. By midterm agencies performing data exchanges on a fully decentralizeed basis formally request the corresponding external control body (AGN and SIGEN at the natlional level and Tribunales de Cuentas at the Implicit in provincial level) to expand coverage of annual indicator audits to include privacy compliance Unspecified description By midterm provincial legislation has been requested requiring that i) all data exchanges between provincial agencies be done through the corresponding provincial SINTyS; ii)provincial agencies make their information available to SINTyS to be used for other provincial agencies that have a legitimate need SEWS was to access such information; and iii) provincial designed to prevent agencies be prevented from collecting the loading of information from citizens once such Implicit in information that information is available through SINTyS from indicator already exists and an authentic source. Unspecified description has been validated. 23 Subcomponent 1.3 - Expansion at the Subnational Level Revised Baseline Target Target Actual Value Level of achievement The number of provinces that have established their provincial coordinating units has increased from 13 to 24. 13 24 21 Partially achieved. The number of provincial agencies that routinely exchange information under SINTyS has increased from 63 to 92. 63 92 98 Achieved Partially achieved. Work with 42 regularly; however, over the years they The number of municipalities that routinely have worked with exchange information under SINTyS has approximately 90 increased from 11 to 126. 11 126 42 municipalities. The benefits from the exchange of fiscal and social information by subnational governments Actual value not have increased from 233 to 473. 233 473 available. Not achieved Component 2-Information Management and Data Quality Framework: This component was to focus on further strengthening SINTyS' information management, with a particular emphasis on enhancing the quality of the data being exchanged under the system. The specific objective of this component was to enhance SINTyS' information management practices. Particular attention was to be given to enhancing the quality of the data being exchanged under SINTyS so that it correctly represented the real-world constructs to which it referred. Specifically, this component was to focus on ensuring that data being exchanged under SINTyS is representative of the functions, responsibilities and privileges of the government agency that provides it (i.e. that the information is provided from an authentic source). Subcomponent 2.1-Development of Data Standards: Activities under this subcomponent were to support efforts to develop and implement common data standards and formats, so that they could be adopted by the different government agencies that exchange information through SINTyS. SINTyS, in association with ONTI, was spearheading an effort to develop a set of data norms and standards to be applied throughout Argentina's public sector. Both agencies were developing standards for the 30 most commonly used data types (such as name and address) to homogenize criteria among government agencies at the national level thereby facilitating the exchange of information. Subcomponent2.2-Increasing Data from Authentic Sources: Early on in the implementation process, SINTyS identified the need to support the digitalization of information in those entities responsible for generating key social and fiscal data. This subcomponent was to continue to support these efforts, with activities focusing on civil registries, registries of juridical persons, the registry of students, and registries of deeds. 24 Subcomponent 2.3-Information Management and Data Quality at the Agency Level: This subcomponent was to support the efforts of government agencies participating in SINTyS to enhance the quality at entry of data. The focus of these activities was to be on adopting Web services and other applications aimed at reducing the number of errors in data entry; adopting data quality management tools by participating government agencies; and increasing awareness as to the importance of data quality and disseminating best practices in data quality management among participating government agencies. Subcomponent 2.4-Developing SINTyS' Information Management and Quality Enhancement Framework: Since its inception, SINTyS' national office had placed great emphasis on the enhancement of data quality and has gradually developed robust mechanisms to ensure the same. This subcomponent was to continue to support these efforts by developing a business intelligence unit within SINTyS' national office and a data-quality advisory body with representation from participating government agencies. Outputs:  Creation of an index of people with 40.05 million people uniquely identified.  Creation of a new data model for the integration of data sent to SINTyS, associating files by thematic area.  Creation of a new model of exchange with crosses against entire thematic areas.  This new data model allowed for the development of the tool VUO and the first versions of web services. Over time, these became the systems now known as SEWS and Judicial Processes (Oficios Judiciales)  Receipt of information online, using Web Services, allowing for daily updates of information with entities such as RENAPER and the National Administration of Civil Aviation.  Various methodologies for the receipt and sending of files were developed (First, CD, then mail, then Secure File Transfer Protocol (SFTP), SWED (Servicios Web de Envío y Descarga), and finally VUO.  VIAS also allows for the standardization of information to be later integrated into the system, the downloading of the results of exchanges, and access to the Results Dashboard.  The Results Dashboard passed through two stages. In the first local version, the user carried out the process on their machine as a result of the information that it had received through the exchange. In the second online version, all entities can have access on the basis of having a VIAS password and having requested an exchange.  A Data Quality Manual, detailing the steps that should be followed for the integration of a file sent to SINTyS, was designed.  A methodology to evaluate, create and implement access to information profiles was developed. 25 Subcomponent 2.1 - Development of Data Standards Revised Baseline Target Target Actual Value Level of achievement Achieved. Revised in restructuring. Original indicator: The number of national government agencies that have implemented national The number of national agencies information-exchange implementing national information Exchange standards has increased standards 0 4 8 from 0 to 4. Achieved. Revised in Restructuring. Original indicator: The number of provinces that have adopted The number of provincial agencies national information- implementing national information Exchange exchange standards has standards 0 6 7 11 increased from 0 to 6. 26 Subcomponent 2.2 - Increasing Data from Authentic Sources Revised Baseline Target Target Actual Value Level of achievement Indicator changed in restructuring. Original indicator: The number of agencies that exchange personal identifying data through SINTyS that is provided by an authentic source has The percentage of information exchanged increased from 14 to through SINTyS that is provided by an authentic 23. Achieved based on source has increased from 14 to 23. 14 23 100 percent 100 percent restructured target. The number of provinces in which the registries of physical persons (registros civiles) have information in electronic form has increased from 13 to 22. 13 22 17 Partially achieved The percentage of overall information from registries of physical persons that is available in electronic form has increased from 31 percent to 92 percent. 31 percent 92 percent 75 percent Partially achieved The number of provinces in which registries of juridical persons (registros de personas jurídicas) have information in electronic form has increased from 6 to 18. 6 18 12 Partially achieved Partially achieved. Because of the manner in which information is The percentage of overall information from registered, this juridical persons registries that is available in indicator is not electronic form has increased from 41 percent expected to ever to 70 percent. 41 percent 70 percent 55 percent exceed 60 percent. Dropped in restructuring. The The number of provinces with registries of the project does not student population (legajos de alumnos) in continue to monitor electronic form has increased from 8 to 18. 8 18 the LUA. Dropped in The percentage of overall information from restructuring. The registries of the student population that is project does not available in electronic form has increased from continue to monitor 43 percent to 75 percent. 43 percent 75 percent the LUA. The number of provinces where the registries of deeds (registros de propiedad) have information in electronic form has increased from 10 to 20. 10 20 17 Partially achieved The percentage of overall information from registries of deeds that is available in electronic form has increased from 61 percent to 85 percent. 61 percent 85 percent 80 percent Partially achieved 27 Subcomponent 2.3 - Information Management and Data Quality at the Agency Level Revised Baseline Target Target Actual Value Level of achievement Revised in restructuring. Achieved. Original indicator: Initial assessment of key information management weaknesses of individual agencies, including data quality, Percentage on compliance with the minimum has been conducted and and desirable quality standards of the databases a capacity building received from national, provincial and strategy has been municipal agencies 50 75 75 formulated The number of government agencies utilizing Web services for data entry (such as prefilling of data fields) has increased from 7 to 40. 7 40 91 Achieved Almost achieved. Indicator changed in restructuring. Original indicator: The number of government agencies utilizing data Percentage of capacity building in Quality of quality intelligence Data in the provincial nodes to enhance tools has increased capacities towards decentralization 30 percent 70 percent 69 percent from 0 to 10. Subcomponent 2.4 - Developing SINTyS' Information Management and Data Quality Framework Revised Baseline Target Target Actual Value Level of achievement An information management framework that includes, among others, decentralized data Implicit in quality management (Stage III) has been indicator Not reported during approved by the midterm review. Unspecified description implementation. Component 3-Technological Framework for the Information Exchange: SINTyS is heavily dependent on a technologically advanced ICT architecture and robust infrastructure for its information exchange system, which aims at providing methodologies and tools for the development of a government-to-government (G2G) platform for real-time, online exchanges of qualitative information, a prime production factor for government bodies, among its participating institutions at the federal, provincial, and municipal levels. This component supported the project's overall information technology, telecommunication, and software development needs, with specific support to the management, development, implementation, maintenance, and continuous re-engineering of the technology and infrastructure; the definition of protocols and standards for data exchange; and evaluation and adaptation of modern telecommunication models to guarantee the highest reliability of the information exchange. 28 The objective of this component was to support the expansion and institutionalization of information exchange that would: (1) eliminate barriers to information exchange among participating institutions by continuing the implementation and financing of nodes at the national and provincial levels; and (2) assist municipalities participating in the system with technical assistance and targeted financing for software and hardware. This objective not only aimed at physically expanding the network with hardware and software but also supported the harmonization of the information flow for the social and fiscal sectors with ICT tools and methodologies aimed at improving real time online data exchange. In particular, this operation was to support the transition to a Service-oriented Architecture (SOA) that would improve the system's flexibility while providing a model for an interoperability platform to underlay current e-government efforts in the country. Subcomponent 3.1-Consolidation of the Enabling Environment for the Information Exchange System: The system's infrastructure requires that a comprehensive ICT enabling environment, including policy and regulatory frameworks specific to ICT, be defined to support the technology implemented as well as its continuous reengineering. This subcomponent was to support the strengthening of the consultative bodies with stakeholders for the improvement of ICT policies, necessary to regulate the information exchange system. Specifically, this subcomponent was to strengthen the current infrastructure to transition to an SOA architecture that included improvements in the telecommunication network and adoption of an interoperability framework', and established the needs and methodologies for international certification for IT, telecommunication, and processes used in and for the system; in collaboration with the security component, define and implement all required security, risk, and business continuity plans; and, with the quality component, implement all necessary technological processes needed to maintain the confidentiality, integrity, and quality of data exchanged in the network; develop an M&E framework for the system to monitor activities associated with the exchange of social and fiscal information and to measure the impact of service resulting from the exchange of information in participant agencies; and provide technical assistance to actual and potential participants to adopt and comply with the ICT policies and standards of the system. Subcomponent 3.2-Expansion and Consolidation of the System: At design, SINTyS' exchange network includes five national nodes and six provincial nodes. Under the proposed operation, the network was to be expanded to 10 national nodes, the remaining provincial nodes, and a selected number of municipalities. This subcomponent was to finance consultant services, hardware and software necessary to expand and consolidate the infrastructure to all participants, and was to include the development and implement a secure data center for SINTyS and explore the possibility for full redundancy in a stakeholders' secure data center, national and/or provincial, to eliminate the costs for a secure redundant data center as well as the development and implementation of a control center to effectively monitor and evaluate the network and its nodes at every point at all times, and an intranet. 29 Subcomponent 3.3-Service Delivery: The main focus of the information exchange was to provide services to authorized users using the current Ventanilla Única de Organismo (VUO) web services and any other technology that became feasible during the operation, with the following activities: development of web services tailored to users' needs, resulting from the mapping of processes and information flow related to the social and fiscal sectors that would include digital certificates and digital signatures over a public key infrastructure; and exploration of the possibility to design a pilot project for a Web service that would allow citizens to view their own data through the national e- government portal. Outputs:  Through Multiprotocol Label Switching, SINTyS implemented a private communications network with multiple security and service protocols. This allowed for the interconnection of the nodes in 19 provinces, guaranteeing the quality of the data transfer and reduced communication costs.  Within this framework, SINTyS implemented a secure internet protocol (IP) telephone network through an open source system. This channeled thousands of long distance calls through a secure connection and generated significant cost savings over the last five years for the provincial and national governments.  Using the same technology, an advanced video conference system was implemented in all of the Provincial Coordination Units, allowing for an increase in communications and savings via reduced transport costs.  All of the communications equipment implemented in the local area network has stringent administration, monitoring and security standards.  Using databases generated and administered by SINTyS with information on each of the components necessary for data exchanges, a monitoring system was created.  24 Blade servers were installed, and a super cluster of virtual machines created. About 250 servers in connected provinces, the national SINTyS, and interconnected entities have been virtualized.  Data storage with stringent data security and availability measures has been implemented, and policies for safeguarding information strengthened.  Complementary open source system for email services, printing, storage, monitoring of preventative and corrective maintenance, document management, administration models, and tracking of goods and technicians were implemented.  Nineteen nodes within the provincial sphere and two in specific entities were computerized, with architecture in accordance with their physical availability and the needs of the SINTyS network. In each, servers for local services, communications equipment, work stations, printers, scanners, and video conference systems were provided.  Implemented a backup and recovery manager for its Oracle-based database and implemented a redundancy in the databases, allowing for synchronizing a physical standby database with the production database, protecting data and allowing for high availability.  A maximum security area was constructed for computing equipment. This space guarantees the safeguarding of the technological environment against 30 environmental threats, vandalism, and unauthorized access. The design follows international guidelines for protection and security.  On-line services were developed. In 2013,VIAS was implemented, allowing for entities to exchange information in a secure manner, with the exchange automatically carrying out the controls necessary to guarantee the consistency and standardization of data.  SEWS was also developed, allowing for entities to automatically interact with the SINTyS network through their own systems, validating online the data of physical or juridical people, and allowing for access to information based on entities’ competencies. Punctual consultations are also facilitated through other services.  A variety of applications were developed, including ones for punctual consultations of processes, administration of users by entities, SINTyS’ internal administration of users, a system for management of consultants, impact, indicators, administration of the information of all SINTyS users, updating RENAPER data daily, as well as one for SINTyS general administration.  In coordination with the National Technological University to meet ONTI standards on Information Technology Infrastructure Library (ITIL) and ISO 9000, 95 percent of technicians were trained.  A variety of processes were surveyed and corrected (listed below) within the framework of talks to become a certifying authority. 31 Process/Document System for Management of Quality Diagram of SINTyS Processes SINTyS Organizational Chart Definition of Profiles by Position Satisfaction Survey Annual Training Plan Revision Act by Directorate Attendance Spreadsheet for Trainings Program for Audits and Revisions of the System for Management of Quality Audit Plan Internal Audit Report Meeting Minutes Project Plan Risk Plan List of Requirements Project Deliverables Project Blueprint Master List of Quality Documents List of Forms and Quality Registries Objectives and Indicators List of Approved Providers Quality Manuals Document Control Registry Control Internal Audits Non-compliance and Corrective Actions Preventative Actions and Opportunities for Improvement Purchases and Contracts Human Resource Management Massive Data Exchanges Integration of Databases Design of Crosses of Databases Execution of Crosses of Databases Policy of Quality 32 Management of Judicial Processes Planning of IT projects Risk Management Communication Management Project Management Ticket Management Configuration Management Change Management Requirement Management Access Management Management of Levels of Service Key Public Infrastructure (PKI) Policy for Certifying Physical People Roles and Functions Plan for Service Continuity Guidelines for the Administration of Cryptographic Devices Termination Plan Manual of Certification Procedures Guidelines for the Registry Authority Privacy Policy Agreement with Subscribers Third Party User Terms and Conditions Definition and Criteria for Risk Evaluation Technological Platform Security Plan Design and Development Testing Maintenance Design and Development Specification of Software Requirements Specification of Software Technical Requirements Registry of Incidents Projects Use Cases Security Audit Report 33 Subcomponent 3.1 Consolidation of the Enabling Environment for the Information Exchange Revised Baseline Target Target Actual Value Level of achievement Dropped in restructuring. The indicator was related to a specific technology. Since SINTyS interacts through different The SOA is defined during Year 1 and 50 percent of technologies such as implemented in stages with 10 percent of Technology model the activities web services, there was activities during Year 2, 20 percent in Year 3, and infrastructure in plan are no need to have this and 40 percent in Year 4. for Phase II implemented indicator. An M&E system is designed during Year 1 and implemented during Year 2, with full Monthly M&E monitoring of the exchange beginning during Monitoring reports to 85 percent of Year 2. Does not exist and evaluation management technological area. Achieved Subcomponent 3.2 - Expansion and Consolidation of the Exchange Revised Baseline Target Target Actual Value Level of achievement Achieved. Revised in restructuring for cumulative total of 18 nodes over all years. 6 SPFO nodes are 24 SPFO 18 national nodes, Original: Number of connected, 7 are nodes for 3 provincial nodes national and provincial in the process of impact 3 4 SPFO nodes, inthe process of nodes connected and in being connected, SPFO nodes 2 SPFO nodes installation. 4 operation. #of Number of national and provincial nodes of which 1 is are Stage III are on Stage III organizations in institutions on Stage III connected and in operation. Number of Stage III. No and 30 and 30 Stage III. 30 and #of municipal institutions on Stage III and number of municipalities are municipalities municipalities municipalities offices connected and municipal offices in operation connected are connected are connected connected in operation The number of government agencies that perform fully decentralized information exchanges has increased from 3 to 5. 3 5 104 Achieved. Achieved. Guarantee the backup infrastructure has at least 99 percent up time. Exceeded Guarantee at least 99 percent up time during original PAD target of Years 1 to 4. 97 97 99 99 97 percent A secure data center and control center are designed during Year 1 and put into operation Centers are during Years 2 and 3. None operational Center in operation Achieved A partner institution and/or provinces that will provide space for SINTyS redundancy on a secure data center is(are) identified during Implement the Year 1, an agreement is signed during Year 2, Monitor and redundant data In process of and put into operation during Year 3. None evaluate center implementation. Partially achieved 34 Subcomponent 3.3 - Service Delivery Revised Baseline Target Target Actual Value Level of achievement Partially achieved. 3 services of this type with RENAPER, one with the Registro de Aeronaves (ANAC), and another with the National Ministry of 2 services the interact with other agencies 3 2 5 Health (SISA). Assessment has If feasible, a pilot is designed during Year 1, been made. It is implemented during Years 2 and 3, and Pilot not feasible to evaluated during Year 4. None evaluation perform apilot. Component 4-Information Security: For a system with SINTyS’ unique characteristics to function adequately, it is imperative that an optimal level of information security be embedded in day-to-day operations of this system, thereby ensuring the confidentiality, integrity, and availability of information for all stakeholders involved. While the development of SINTyS' security framework was included as part of the infrastructure component under the first SINTyS operation, it was later designed as a self-standing component under Phase II in order provide greater objectivity in the detection of potential vulnerabilities by separating security and operational roles, and to avoid any potential instances of conflict of interest between the two; and to increase responsibilities in the area of security, including the development of security plans, to be implemented not only at the SINTyS' national office but in SPFOs as well, that were overloading the capacities of staff responsible to carry out IT operations. The specific objective of this component was to support the further development and implementation of a robust information security architecture and framework to ensure that SINTyS can run operations safely and reliably. This component was to ensure that constitutional guarantees for the privacy and confidentiality of individual information exchanged under SINTyS was preserved and protected. This component was to finance the development and implementation of tools and methodologies, as well as the purchase of equipment for data security to protect the ICT system from unauthorized intrusion, ensuring the physical security of the installations and monitoring user access to information. It was also to be aimed at building relationships and spreading knowledge among participating agencies, to foster awareness as to the importance of security within the user community. Subcomponent 4.1-Strengthening of the Security Enabling Environment: This subcomponent was to focus on the establishment of an organizational structure for long- term sustainability of the legal, logical, and physical security aspects that are related to SINTyS, its exchange, and its participants. This subcomponent was to focus on defining measures that would include the establishment of formal coordination mechanisms with stakeholders, pertaining to the regulatory environment and compliance benchmarks in Argentina with regards to the privacy of personal information that SINTyS could 35 potentially face while dealing with public records and exchange proprietary information. The main activities that were to be financed under this subcomponent were: enhancement of the existing information security practice, within the SINTyS organization model, by defining a separate unit for information security and formally establishing its relationship with the other functional units; augmenting staff for the existing information security unit to meet the future demands; development of a support model for the security network that would allow central SINTyS to efficiently and effectively provide assistance; and formulation of a process to integrate embedded security controls while providing assistance in secured software development within SINTyS. Subcomponent 4.2-Operational Strengthening and Support to Security Aspects: The development of a risk-based information security management plan, infrastructure, and support, to secure SINTyS and its nodes in participating institutions, was the focus of this subcomponent. It was to include the following activities: security architecture and framework and a risk-based approach, looking at operational risks, technology risks, and regulatory risks. Outputs:  Creation of the area for computer audits. Multiple controls for the early detection of anomalies in use were designed, as were controls to safeguard SINTyS’ computer assets.  Since 2008, SINTyS has been aligning itself with international standards such as ISO 27001, and hopes to be certified in such in the short term.  Internal and external training of security and auditing analysts  Implementation of multifactor authentication mechanisms  Periodic external perimeter audits and social engineering tests  Elaboration and implementation of policies, standards, and procedures that support security  Collaboration with the area developing applications, including training in secure development  Deployment of a network of sensors of a system for detection and prevention of intrusion  Fine-tuning of the Network Operations Center  Security testing of new or updated applications  Campaigns and training to raise the awareness of internal and external users of protection of SINTyS’ computer assets.  Carried out an analysis of the business impact of computing assets and a risk analysis  Elaboration of a contingency plan.  Perimeter firewalls  System for detection of intrusions  Physical access controls and cameras  9 policies (e.g. acceptable use, security, access control, etc.), 15 procedures (e.g. backup of security equipment, documentation control, retirement of equipment, 36 etc.), 2 standards (contracting of consultants and physical security in dependencies of SINTyS) and other documents. Subcomponent 4.1 - Strengthening the Security Enabling Environment Revised Baseline Target Target Actual Value Level of achievement Sintys operates its own VPN-based network with national reach, and granular internet access at each Establish an information security architecture Node, arbitrated by and framework by which SINTyS can conduct strong security business safely and reliably and implement 60 Full policies and proper percent of it in Year 2, 30 percent in Year 3, implementatio perimeter and 10 percent in Year 4. Unspecified n by year 4. defenses. Achieved Beginning in 2007, SINTyS hired external audits by world-class security professionals. Audits were not conducted in 2008 due to financial reasons, but were resumed in 2009. Last year 2full- blown pentests and At least 3 audits are conducted every year by an Implicit in a social external (private) firm testing the robustness indicator engineering audits of the system and the control environment. Unspecified description were conducted Partially achieved AGN has been auditing SINTyS only on administrative and financial issues SIGEN has audited SINTyS on information technology matters, including information Partially achieved. No security aspects. audits have been Latest audits were conducted since 2008. conducted during SINTyS has no At least 1 logical and physical security audit is Implicit in several auditing influence whatsoever conducted every year by the internal indicator practices thru 2007 on SIGEN's auditing (SIGEN/AGN) auditors. Unspecified description and 2008. agenda. Achieved. With the introduction of SEWS, agency directors will have the capacity to Practice has been monitor data Implicit in in place since its consumption patterns SINTyS National Office reports users’ activity indicator conception in both in real time and to agency heads on a monthly basis. Unspecified. description 2008. on a monthly basis. 37 Subcomponent 4.2 - Operational Strengthening and Support of Security Aspects Revised Baseline Target Target Actual Value Level of achievement The number of personnel comprising the core information security team at SINTyS Central has increased from 4 to 8. 4 8 9 7 Partially achieved Number of hours each information security personnel has undergone through in order to update/upgrade his skill level has increased from 16 to 40. 16 40 60 Achieved Percentage of users that have signed a Security Awareness Statement [ESAS] has increased from 0 percent to 100 percent. 0 100 100 Achieved Achieved original PAD target. Partially Number of hours of such training programs achieved restructured held in a calendar year amount to 8. 4 8 12 10 target By midterm, the BCP plan is being tested twice a year. 0 2 1 Partially achieved Indicator does not Approval records for ratifying all activities for Some informal Formal appear in RF of PAD, executing major changes in the system and at procedures in procedures in Formal procedures but in Restructuring the network level. place place in place. Paper. Achieved. Events are captured and reported as part of the daily MIS reporting to the process owners. All significant events are reviewed for anomalies and all exceptions are investigated further. 70 percent 100 percent 100 percent Achieved By midterm, roles and responsibility matrix for incident response team and define a set of standard operating procedures for handling Partially achieved by computer security incidents. 50 percent 100 percent 85 percent closing Component 5-Project Management: This component aimed to provide the administrative, financial and budget management, accounting, audit, procurement (goods, services and consultant services) and other services support needed for project implementation according to the rules specified in the Project Operation Manual and the Bank's procedures. This component was to provide assistance to oversee project implementation and to manage the on-going SINTyS program, ensuring that the benefits from the exchange of fiscal and social information continued to be derived. Activities included under this component were to include: strengthening the borrower's capacity to monitor and supervise the overall implementation of the Project; provision of technical assistance to participating government agencies in respect of SINTyS operations; strengthening the capacity of participating provinces to implement SINTyS within their municipalities; strengthening the capacity of participating municipalities to implement SINTyS at the municipal level; and dissemination activities aimed at raising awareness among government agencies at all levels of government of the main benefits that can be derived from the routine exchange of information and the role of SINTyS in facilitating such exchange. 38 Revised Baseline Target Target Actual Value Level of achievement At midterm, a five year plan has been presented for SINTyS' financing, including, among others, sources of financing for human resources, technological upgrade, renewal and Implicit in maintenance at the national, provincial and indicator Not reported during municipal levels. Unspecified description implementation. 39 Annex 3. Economic and Financial Analysis Since Phase I of the SINTyS program, demonstrating the agency’s fiscal impact has been considered important for both generating interest in participating within the system as well as serving as an indication of the corresponding investments’ efficiency. The demonstration effect was considered to be particularly important in the first phase, where the achievement of demonstrable results that would help to support the subsequent expansion and institutionalization of the system was considered to be critical. Within this context (and with a limited number of institutions participating), following a data exchange, SINTyS followed up with organizations to request information on the benefits obtained from the exchange and after the next exchange, verified whether the incompatibilities identified in the previous exchange had been corrected, thereby allowing for the calculation of a verified impact. In this way, SINTyS I and reallocation under State Modernization I were found to have provided monetary benefits of more than US$190 million.22 However, as noted in the main text, during implementation of SINTyS II, the agency did not calculate the verified fiscal impact of SINTyS on incorrect benefits not awarded and increased tax collections due to both the agency’s desire to not be seen as auditing the use of information obtained through the exchanges as well as the technical complications associated with calculating the verified impact given the significant increase in the number of data exchanges. Instead, the potential economic impact was calculated as follows. Using information on beneficiaries included in massive data exchanges between February 2013 and January 2014 from databases containing information on the values of benefits, incompatibilities were identified (with each person only counting once in the event of multiple incompatibilities). Following the calculation of the average value of benefits in each month, the potential impact of removing incompatibilities was calculated. This information for 2013 was then used to further estimate the potential impacts in 2009- 2012. To do so, the value of potential savings was discounted by the Government inflation rate. The potential economic impact per exchange in each year was then calculated, and the amount multiplied by the number of exchanges carried out. Values were converted to dollars using the average exchange rate for each year. SINTyS carried out calculations under different scenarios, including one with only those identified as deceased, and another including incompatibilities in social programs. Based on the most conservative estimates (only deceased individuals who were identified and assumed to have been dropped from beneficiary databases one month after their 22 Under SINTyS I, from 2004 onwards, agencies verified monetary impacts. For the period 1999-2003, SINTyS estimated the actual impact by multiplying the potential impact per period by the average verification rate of the respective provinces. 40 identification23, and only considering 2013 so as to minimize the number of assumptions made), an impact of approximately US$160.5 million is calculated. 23 After one month, SINTyS assumes that the individuals identified as deceased have been removed from benefits programs. While information is not available on how long it took for such individuals to be identified prior to SINTyS, it was assumed that agencies would not engage in such crosses with the National Registry of People (Registro Nacional de las Personas, RENAPER) as frequently, and that identification would take more than a month. 41 Annex 4. Bank Lending and Implementation Support/Supervision Processes (a) Task Team members Responsibility/ Names Title Unit Specialty Lending Keisgner De Jesus Alfaro Senior Procurement Specialist LCSPT Karla Soledad Lopez Flores Operations Assistant CTGBD Pablo Cavallaro Consultant Francis Earwaker Consultant Ramiro Lopez Ghio Consultant LCSPS Andres Mac Gaul Senior Procurement Specialist LCSPT Lisandro Menendez Paratore Consultant Miguel Mercado-Diaz Senior Operations Officer LCSFM TTL Juan Navas-Sabater Sector Leader ECSSD Reynaldo F. Pastor Chief Counsel LEGLE Alejandro Roger Solanot Sr Financial Management Specia LCSFM Shrimant Tripathy Senior Information Security Of ITSIS Giorgio Valentini Representative LCCJM Christopher Walsh Senipr Communications Officer TWIWP Maria Cecilia Zanetta Consultant LCSHE Joaquin Zentner Consultant SASSD Supervision/ICR Keisgner De Jesus Alfaro Senior Procurement Specialist LCSPT Daniel Jorge Arguindegui Procurement Specialist LCSPT Fernando Barraza Consultant CLAIC Ana Bellver-Vazquez-Dodero Senior Public Sector Specialist SASGP TTL Ezequiel Cambiasso Consultant Daniel Chalupowicz Financial Management Specialist LCSFM Daniela Veronica Felcman Public Sector Specialist LCSPS Henry Forero Ramirez Senior Public Sector Specialist LCSPS TTL Aranzazu Guillan Montero Consultant Adrienne Elizabeth Hathaway Junior Professional Associate LCSPS Magali Junowicz Consultant AFTP1 Daria Lavrentieva Senior Operations Officer WBCKO Sebastian Lew Consultant LCSPS Ramiro Lopez-Ghio Consultant Carmen Machicado Operations Officer SEGM2 Andres Mac Gaul Senior Procurement Specialist LCSPT Miguel Mercado-Diaz Senior Operations Officer LCSFM TTL Zafer Mustafaoglu Lead Economist and Sector Leader LCSPR Harold Schuch Consultant Alejandro Roger Solanot Sr Financial Management Specia LCSFM Shrimant Tripathy Senior Information Security Of ITSIS Giorgio Valentini Representative LCCJM Maria Cecilia Zanetta Consultant LCSHE 42 (b) Staff Time and Cost Staff Time and Cost (Bank Budget Only) Stage of Project Cycle US$ Thousands (including No. of staff weeks travel and consultant costs) Lending FY07 5.28 58.17 FY08 15.49 249.54 FY09 0.35 1.60 Total: 21.12 309.31 Supervision/ICR FY09 11.14 71.65 FY10 18.64 110.17 FY11 12.23 88.73 FY12 12.28 102.31 FY13 11.06 63.44 FY14 FY 11.31 51.54 Total: 76.66 487.84 43 Annex 5. Beneficiary Survey Results N/A 44 Annex 6. Stakeholder Workshop Report and Results N/A 45 Annex 7. Summary of Borrower's ICR and/or Comments on Draft ICR As noted in Section 7, given the Project’s achievement of the general development objective and almost all indicators, as well as its timely development, implementation and execution, the Government views the Overall Outcome to be satisfactory. 46 Annex 8. Comments of Cofinanciers and Other Partners/Stakeholders N/A 47 Annex 9. List of Supporting Documents Country Assistance Strategy for the Argentine Republic, 2006-2008. Report No. 34015- AR. Discussed by the Board on May 4, 2006. Implementation Completion Report on an Adaptable Program Loan (APL I) in the Amount of US$10 million to the Argentine Republic for a Social and Fiscal National Identification System Program. June 30, 2006. Report No. 36160-AR Implementation Completion and Results report on a Loan in the Amount of US$30.30 Million to the Argentine Republic for the State Modernization Project. June 30, 2008. Report No. ICR0000778 Project Appraisal Document on a Proposed Loan in the Amount of US10 Million to the Argentine Republic in Support of the First Phase of a Social and Fiscal National Identification System, March 31, 1999. Report No. 19110 AR Second Social and Fiscal National Identification System Project (SINTyS II). Adaptable Program Loan. Implementation Status Reports, 2008-2013. Second Social and Fiscal National Identification System Project (SINTyS II). Adaptable Program Loan. Loan Agreement. January 13, 2009. Loan No. 7572-AR Second Social and Fiscal National Identification System Project (SINTyS II). Adaptable Program Loan. Project Appraisal Document. June 12, 2008. Report No. 44150-AR Restructuring Paper on a Proposed Project Restructuring on a Proposed Project Restructuring in Support of the Second and Third Phases of the System. September 7, 2011. Report No. 64565. v1 48 Annex 10. Results Framework as Presented in September 2011 Restructuring Project Development Objective: The project's development objective is to identify social and/or fiscal attributes of physical and legal persons in Argentina, through a sustainable information exchange system, aimed at improving the efficiency, effectiveness, and impact of social services and fiscal programs at all levels of government in Argentina. The specific objectives to be pursued under this operation are: (i) to expand and consolidate the network underlying the exchange of social and fiscal information among public agencies at the national, provincial, and municipal levels of government, with provisions to ensure data protection, accessibility, and the quality and accuracy of information; and (ii) to consolidate the institutionalization of SINTyS as an independent national entity responsible for coordinating and setting standards governing the exchange of information within Argentina's public sector. Project Outcome Indicators Core D=Dropped Baseline (Actual at the Cumulative Target Values* C=Continue time of restructuring d YR 1 YR2 YR 3 YR4 YR5 N= New R=Revised UoM Value 2011 2012 2013 The number of government agencies Continued and programs using consistent 24 common processes to identify 16 28 38 entities and assets has increased from 16 to 38. The percentage of physical persons Continued that can be identified univocally by 31 45 60 92 SINTyS has increased from 31 percent to 92 percent The percentage of the juridical Continued persons univocally identified has 41 50 55 70 increased from 41 percent to 70 percent. The percentage of the population Continued with family relationship data has 9 17 32 increased from 9 percent to 32 14 percent. Population identified with a level of Continued confidence equal or greater than 75 35,2 million 36,5 37.2 38.2 percent has increased from 35.2 to 38.2 million. The number of data types for which Continued SINTyS and ONTI have issued 0 0 30 50 information-exchange standards has increased from 0 to 30. The information exchange network Continued 97 97 97 97 maintains 97 percent availability. 49 The number of “highly critical” Continued Highly vulnerabilities exploited by critical penetration test activities in a vulnera- scenario simulating a legitimate bilities by 0 2 1 0 SINTyS user from a participating service government agency as a proportion of services available to agencies has decreased from 2 to 0. Amount of incorrect benefits not Continued awarded due to SINTyS in a given 0 43,8 45 51 year (in US$ Million). Increase in tax collections due to Continued SINTyS in a given year (in US$ 0 2,1 2.3 2.6 Million). Intermediate Results Component 1: SINTyS’ Institutional and Legal Framework Subcomponent 1: Institutional Framework Intermediate Result (Subcomponent 1.1): SINTyS’ institutional framework, including its institutional imprint, governance structure, and inter -jurisdictional arrangements, are conducive to its medium- and long-term sustainability. Revised Intermediate Result (Subcomponent 1.1): Unchanged SINTyS advisory body in place, Revised CNPS CNPS monthly CNPS monthly CNPS with representation from key (no change monthly meetings meetings monthly agencies at the national level in indicator. meetings meetings (DNPDP, ONTI, RENAPER, AFIP, Change in ANSES), and meets regularly. measureme nt as the SINTyS adbvisory body was replaced by the CNPS monthly meetings) Provincial advisory body in place, Revised Annual Annual meetings Annual Annual with representation from provincial (no change meetings with with provincial meetings with meetings authorities, and meets regularly. in indicator. provincial coordinators provincial with Change in coordinators coordinators provincial measureme coordinators nt as the 50 Provincial advisory body was replaced by the annual meetings with provincial coordinator s) Users’ forum is in place, with Dropped Used regularly Used regularly as Used regularly Used representation of government SINTyS as per progress per progress as per progress regularly as agencies from all levels of elaborates report. report. report. per progress government, with various task data quality report. forces focusing on, among others, standards, data quality, M&E, priority M&E, planning, infrastructure, and infrastructu security, meeting regularly. re framework, etc. The number of provinces that are Continued financing the salary of the SINTyS 4 6 8 12 Provincial Coordinator has increased from 4 to 12. Continued Monthly M&E Monthly M&E Monthly M&E Monthly An M&E system with a focus on, progress report progress report progress report M&E among others, information with key with key with key progress exchanges, data quality, indicators. indicators. indicators. report with technological framework, security, key and overall performance, is in place. indicators. SIGEN and SINTyS’ systems are audited AGN regularly by a qualified external auditor. Continued Subcomponent 2: Legal Framework Intermediate Result (Subcomponent 1.2): SINTyS’ legal framework and corresponding operational mechanisms are consistent with Argentina’s legal framework, with regard to the protection of personal information, effectively safeguarding citizens’ privacy and confidentiality. Revised Intermediate Result (Subcomponent 1.2): Unchanged 51 DNPDP is formally involved in Revised Conversations Access profiles Access profiles Access validating access rights to with DNPDP and use of and use of profiles and information (access profiles) and the services (and any services (and use of use of SWED. [Replaces: DNPDP modification to any services (and is formally and routinely involved in these) are modification to any (1) determining the access rights to formally these) are modification information of individual agencies validated with formally to these) are and (2) monitoring its compliance.] DNPDP validated with formally DNPDP validated with DNPDP A formal mechanism has been Revised SINTyS will SINTyS will SINTyS will established that allows individual inform in its inform in its inform in its citizens to verify the accuracy of SINTyS website to which website to website to their personal information and, in cannot agency the citizen which agency which case of errors, correct it. grant access need to go in case the citizen need agency the to of errors by to go in case of citizen need individual theme. errors by theme. to go in case citizens as of errors by it is not the theme. owner of the information .24 However, SINTyS will inform in its website to which 24 The pretended mechanism would certainly be useful for citizens, particularly for those who need to rectify errors, even when it exceeds SINTyS's institutional mandate. However, there exist some constraints that would turn its practical implementation unfeasible. Some of these constraints are: (i) In order to allow citizens to access their personal data in compliance with national laws ('habeas data'), a mechanism for robust authentication has to be devised, implemented and maintained, capacity that largely exceeds SINTyS's current possibilities. In order to develop that capacity, SINTyS should grow considerably to allow for the required granularity country wide; (ii) By giving direct access to citizens, SINTyS's operational model would change from G-to-G (government to government) into G-to-C (government to citizen), what would in turn increase the associated information security risks by a manifold. 52 agency the citizen need to go in case of errors by theme. Subcomponent 3: Expansion at the Subnational Level Intermediate Result (Subcomponent 1.3): SINTyS is effectively decentralized at the subnational level, with provinces playing a key role in facilitating the exchange of information among provincial agencies and their municipalities. Revised Intermediate Result (Subcomponent 1.3): Unchanged The number of provinces that have Continued established their provincial 13 21 24 24 coordinating units has increased from 13 to 24. The number of provincial agencies Continued that routinely exchange information 63 79 85 92 under SINTyS has increased from 63 to 92. The number of municipalities that Continued routinely exchange information 11 66 88 126 under SINTyS has increased from 11 to 126. The benefits from the exchange of Continued fiscal and social information by 233 319 367 473 subnational governments have increased from 233 to 473. Component 2: Information Management and Data Quality Framework Subcomponent 1: Development of Data Standards Intermediate Result (Subcomponent 2.1): The information being exchanged through SINTyS conforms to the standards established jointly by SINTyS and ONTI. Revised Intermediate Result (Subcomponent 2.1): Unchanged The number of national agencies Revised implementing national information Exchange standards (Replaces: The number of national government 2 3 3 4 agencies that have implemented national information-exchange standards has increased from 0 to 53 4.) The number of provincial agencies Revised implementing national information Exchange standards (Replaces: The number of provinces that have 4 5 6 7 adopted national information- exchange standards has increased from 0 to 6.) Subcomponent 2: Increasing Data from Authentic Sources Intermediate Result (Subcomponent 2.2): Data being exchanged through SINTyS is originated by an authentic source. Revised Intermediate Result (Subcomponent 2.2): Unchanged The percentage of information Continued exchanged through SINTyS that is 100% 100% 100% 100% provided by an authentic source has increased from 14 to 23. The number of provinces in which Continued the registries of physical persons (registros civiles) have information 13 17 19 22 in electronic form has increased from 13 to 22. The percentage of overall Continued information from registries of 75 physical persons that is available in 31 60 92 electronic form has increased from 31 percent to 92 percent. The number of provinces in which Continued registries of juridical persons 12 (registros de personas jurídicas) 6 10 18 have information in electronic form has increased from 6 to 18. The percentage of overall Continued information from juridical persons registries that is available in 41 50 55 70 electronic form has increased from 41 percent to 70 percent. 54 Dropped The Project does not continue The number of provinces with to monitor registries of the student population the LUA (legajos de alumnos) in electronic as it was form has increased from 8 to 18. aimed at getting data for persons under 18 years old. Dropped The Project does not The percentage of overall continue information from registries of the to monitor student population that is available the LUA in electronic form has increased as it was from 43 percent to 75 percent. aimed at getting data for persons under 18 years old. The number of provinces where the Continued registries of deeds (registros de 16 propiedad) have information in 10 14 20 electronic form has increased from 10 to 20. The percentage of overall Continued information from registries of deeds that is available in electronic form 61 70 85 75 has increased from 61 percent to 85 percent. Subcomponent 3: Information Management and Data Quality at the Agency Level 55 Intermediate Result (Subcomponent 2.3): Participating government agencies at all levels of government are aware of the importance of strengthening their own information management processes and ensuring good data quality. They are effectively implementing quality control and monitoring mechanisms when originating the data and updating it routinely. Revised Intermediate Result (Subcomponent 2.3): Unchanged Percentage on compliance with the Revised minimum and desirable quality standards of the databases received from national, provincial and municipal agencies (Replaces: Initial assessment of key information 50 55 65 75 management weaknesses of individual agencies, including data quality, has been conducted and a capacity building strategy has been formulated) The number of government agencies Continued utilizing Web services for data entry 7 17 27 40 (such as prefilling of data fields) has increased from 7 to 40. Percentage of capacity building in Revised Quality of Data in the provincial nodes to enhance capacities towards decentralization (Replaces: The 30 40 50 70 number of government agencies utilizing data quality intelligence tools has increased from 0 to 10.) Subcomponent 4: Developing SINTyS’ Information Management and Data Quality Framework Intermediate Result (Subcomponent 2.4): The information that is exchanged through SINTyS is of high quality. Revised Intermediate Result (Subcomponent 2.4): Unchanged An information management Continued framework that includes, among others, decentralized data quality management (Stage III) has been approved by the midterm review. Component 3: Technological Framework for the Information Exchange 56 Subcomponent 1: Consolidation of the Enabling Environment for the Information Exchange Intermediate Result (Subcomponent 3.1): The SOA architecture is defined and implemented in stages. An M&E framework for the exchange is implemented. Revised Intermediate Result (Subcomponent 3.1): The SOA architecture is defined and implemented in stages. An M&E framework for the exchange is implemented. The SOA is defined during Year 1 Dropped and implemented in stages with 10 percent of activities during Year 2, This 20 percent in Year 3, and 40 percent indicator in Year 4. was related to a specific technolog y. Since SINTyS now interacts through different technologi es, such as web services, there is no need for having an indicator like this An M&E system is designed during Continued Monthly M&E Monthly M&E Monthly Monthly Year 1 and implemented during reports to reports to M&E reports M&E Year 2, with full monitoring of the management management to reports to exchange beginning during Year 2. management manageme nt Subcomponent 2: Expansion and Consolidation of the Exchange Intermediate Result (Subcomponent 3.2): The system is expanded to all provinces and selected national agencies, support special projects with infrastructure needs, provide maintenance and reengineering to the infrastructure and telecommunication network. The critical systems are in a secure data center with full redundancy and control center. Revised Intermediate Result (Subcomponent 3.2): Unchanged 57 Number of national and provincial Revised 6 SPFO nodes 4 SPFO nodes connected and in operation. are connected, 7 4 SPFO nodes 4 SPFO nodes nodes Number of institutions on Stage III are in the process and number of municipal offices in of being operation. (Replaces: Number of connected, of 2 SPFOnode national and provincial nodes which 1 is in 2 SPFO node are on 2 SPFO node are on are on Stage connected and in operation. Number Stage III. Stage III and 30 Stage III and 30 III and 30 of institutions on Stage III and municipalities are municipalities are municipalitie number of municipal offices No municipalities connected. connected s are connected and in operational.) are connected. connected The number of government agencies Continued 3 3 4 5 that perform fully decentralized information exchanges has increased from 3 to 5. Guarantee at least 99 percent up Continued 99 99 99 99 time during Years 1 to 4. A secure data center and control Continued 60 percent of the 40 percent of the center are designed during Year 1 activities are activities are Centers are None and put into operation during Years implemented for implemented for both operational 2 and 3. both centers. centers. A partner institution and/or Continued provinces that will provide space for SINTyS redundancy on a secure Implement the data center is(are) identified during None Sign agreement(s). . redundand data center Year 1, an agreement is signed during Year 2, and put into operation during Year 3. Subcomponent 3:Service Delivery Intermediate Result (Subcomponent 3.3): Web-services tailored to users’ needs are available to participant institutions A pilot for an institutional data owner to provide the view to citizens of own data is assessed. Revised Intermediate Result (Subcomponent 3.3): Unchanged 2 services the interact with other Continued 3 2 2 2 agencies If feasible, a pilot is designed during Continued Assessment has Year 1, implemented during Years 2 None been made. It is not and 3, and evaluated during Year 4. feasible to perform 58 a pilot.25 Component 4: Information Security Subcomponent 1: Strengthening of the Security Enabling Environment Intermediate Result (Subcomponent 4.1): Security plans related to security management, infrastructure, and risk management are implemented. Internal and external audits of SINTyS information security practice are carried out on a quarterly basis. Revised Intermediate Result (Subcomponent 4.1): Unchanged Continued Sintys operates its own VPN-based network with national reach, and granular internet access at each Node, arbitrated Establish an information security by strong security policies and proper perimeter defenses. A architecture and framework by bidding process to acquire a meshed MPLS service which SINTyS can conduct business architecture is pending approval at ONTI. The only public safely and reliably and implement services offered by SINTyS are a static-content institutional 60 percent of it in Year 2, 30 percent web site and e-mail with PGP support. Services to Agencies in Year 3, and 10 percent in Year 4. are delivered with a combination of multi-factor authentication features that include static IP validation, X.509 certificates, and user/agency credentials. Continued Beginning in 2007, SINTyS started to hire external audits by world-class security professionals. Although audits were not At least 3 audits are conducted every conducted in 2008 due to financial reasons, they were year by an external (private) firm resumed in 2009. Last year two full-blown pentests and a testing the robustness of the system social engineering audit were conducted. Currently, there is and the control environment. an on-going bidding process for the present year edition of the audits. At least 1 logical and physical Continued AGN has been auditing SINTyS but only on administrative security audit is conducted every and financial issues. On the other hand SIGEN has audited year by the internal (SIGEN/AGN) SINTyS on information technology matters, including auditors. information security aspects. Latest audits were conducted 25 The pretended mechanism would certainly be useful for citizens, particularly for those who need to rectify errors, even when it exceeds SINTyS's institutional mandate. However, there exist some constraints that would turn its practical implementation unfeasible. Some of these constraints are: (i) In order to allow citizens to access their personal data in compliance with national laws ('habeas data'), a mechanism for robust authentication has to be devised, implemented and maintained, capacity that largely exceeds SINTyS's current possibilities. In order to develop that capacity, SINTyS should grow considerably to allow for the required granularity country wide; (ii) By giving direct access to citizens, SINTyS's operational model would change from G-to-G (government to government) into G-to-C (government to citizen), what would in turn increase the associated information security risks by a manifold.. 59 during several auditing practices thru 2007 and 2008. No audits have been conducted ever since. It's important to remark that SINTyS has no influence whatsoever on SIGEN's auditing agenda. Continued This practice has been in place since its conception back in SINTyS National Office reports 2008. All agency heads from both VUO and Web Services, users’ activity to agency heads on a receive a monthly usage report to leverage internal controls monthly basis. within the agency under their supervision Subcomponent 2: Operational Strengthening and Support of Security Aspects Intermediate Result (Subcomponent 4.2): The information security practice within SINTyS is performed by specialists with the appropriate level of skill sets and the greatest degree of commitment to the project. The personnel forming the core group of the information security practice within SINTyS are well-trained in their respective areas and are required to upgrade their skill sets to meet the changing needs of the environment. Training programs are conducted periodically to maintain basic information security awareness among the internal user community at SINTyS Central and the provinces. Every SINTyS personnel has to undergo the training program and endorse a Security Awareness Statement (ESAS). A formal Business Continuity Plan (BCP) has to be established to ensure that SINTyS’ day-to-day operations are not affected in the event of natural or a constructed crisis situation. The BCP has to be tested and rehearsed by simulating crisis scenarios and role-playing multiple times during a calendar year. Results of the simulated tests have to be shared with Management and included into the BCP for future reference. Security events at all five layers of system composition (application, desktop, network, server, database) have to be monitored and correlated to proactively detect any potential anomalies and raise an alert for further attention. Formation of a computer security incident response team (CSIRT) within SINTyS that clearly defined roles and responsibilities and a set of standard operating procedures (SOP) that have to be taken in the wake of a computer related emergency situation. Security framework works in an independent environment from SINTyS Revised Intermediate Result (Subcomponent 4.2): Unchanged The number of personnel Continued comprising the core information 4 8 9 security team at SINTyS Central has increased from 4 to 8. Number of hours each information Continued security personnel has undergone through in order to update/upgrade 16 32 40 his skill level has increased from 16 to 40. Percentage of users that have signed Continued a Security Awareness Statement 0% 50% 80% [ESAS] has increased from 0 percent to 100 percent. Number of hours of such training Continued programs held in a calendar year 4 8 12 amount to 8. 60 By midterm, the BCP plan is being Continued 0 2 2 tested twice a year. Approval records for ratifying all Continued Some informal activities for executing major procedures in Formal procedures in place changes in the system and at the place network level. Events are captured and reported as Continued part of the daily MIS reporting to the process owners. All significant 70% 100% 100% events are reviewed for anomalies and all exceptions are investigated further. By midterm, roles and responsibility Continued matrix for incident response team and define a set of standard 50% 100% 100% operating procedures for handling computer security incidents. Component 5: Project Management Intermediate Result (Component 5): Financial sustainability is ensured Revised Intermediate Result (Subcomponent 5): Unchanged At mid-term a five-year plan Continued has been presented for SINTyS’ financing, including, among others, sources of financing for human resources, technological upgrade, renewal and maintenance at the national, provincial and municipal levels. 61 IBRD 33362R 70°W BOLIVIA To Tarija 60°W 50°W U J UY J UJ Pil co To Calama ma yo PA RA GUAY San Salvador De Jujuy To S A L TA Salta FORMOSA San Pedro s C H ILE To Cascavel Salad y ua CHACO á Formosa rag e Paran TUCUMÁN o Pa To San Miguel De Tucumán Copiapó d SANTIAGO Resistencia Posadas NE S BRAZIL CATAMARCA Santiago Del Estero Corrientes I SIO M y ua DEL ESTERO ug n Ur Catamarca CORRIENTES To La Rioja Santa Rosa A To La Serena LA S A N TA To Laguna Mar Chiquita FE Santa Maria 30°S RIOJA ná SAN Cordoba ra To Pa JUAN San Juan Santa Fe Paraná Artigas 30°S Cerro OBA CO R D OBA To Aconcagua ENTRE Desa Tacuarembó PACIFIC (6960 m) RÍOS guadero Mendoza Rosario OCEAN To Valparaíso San Luis To URUGUAY Montevideo s M EN D OZA OZA SAN a LUIS BUENOS AIRES La Plata p To m Talca 0 100 200 300 400 500 Kilometers BUENOS Salado P a Santa Rosa Colo AIRES rado LA 0 100 200 300 Miles PA M PA Mar del Plata To Los Ángeles NEUQUEN Bahía Blanca Neuquén Ne gr o RIO N NE GR O EGR A n d 40°S To Viedma Puerto Montt 40°S C CHUBUT e s hu ARGENTINA AT LA NT IC bu t Rawson O CEA N a o hic C n i To Coihaique Comodoro Rivadavia t a g o Deseado C H ILE S A N TA CRUZ Ch A R GE N TI NA i ca a FALKLAND ISLANDS (ISLAS MALVINAS) P A DISPUTE CONCERNING SOVEREIGNTY OVER THE ISLANDS EXISTS BETWEEN ARGENTINA WHICH CLAIMS 50°S 50°S THIS SOVEREIGNTY AND THE U.K. WHICH ADMINISTERS SELECTED CITIES AND TOWNS THE ISLANDS. Río Gallegos PROVINCE CAPITALS Stanley NATIONAL CAPITAL RIVERS TIERRA MAIN ROADS DEL FUEGO This map was produced by the Map Design Unit of The World Bank. RAILROADS The boundaries, colors, denominations and any other information Ushuaia shown on this map do not imply, on the part of The World Bank Group, any judgment on the legal status of any territory, or any PROVINCE BOUNDARIES endorsement or acceptance of such boundaries. INTERNATIONAL BOUNDARIES 80°W 70°W 60°W 50°W AUGUST 2008