A renewed tender is underway for a new Automated Fingerprint Identification System (AFIS). Among the potential bidders is the Russian company Papillon, which narrowly missed securing this job in Bosnia and Herzegovina back in 2022.
According to an investigation conducted by the Fokus.ba news portal, Bosnia and Herzegovina may soon become one of the few countries in the world to effectively hand over the management of its databases—crucial for police agencies and investigations—to Russia!
Sources indicate that a procurement process is currently underway for the acquisition of an automated fingerprint and palm print identification system (AFIS). This software is intended to modernize the existing outdated system, ensure more efficient data exchange among Bosnian police agencies as well as with those in Europe and worldwide, and significantly enhance police work in combating crime and corruption.
Papillon, IDEMIA, Thales…
This is a renewed tender funded through IPA funds in the amount of 10 million euros provided by the European Union. The EU has entrusted the tender implementation to the Austrian organization ICMPD, which also has an office in Sarajevo. According to information obtained by Fokus, major companies competing to provide the AFIS software include British-based Thales, French IDEMIA, and Russian Papillon.
It was precisely this Russian AFIS manufacturer, Papillon, that was on the verge of winning the contract to install the system in Bosnia and Herzegovina through a tender that was annulled in 2022. On that occasion, among the various global AFIS producers that submitted bids, the top-ranked bidder representing Russian Papillon was the company MRG Export-Import from Banja Luka.
However, the Ministry of Security of BiH, then headed by Selmo Cikotić, requested that the EU Delegation in BiH cancel the tender—which was ultimately done.
Following the collection of information regarding the new tender and the realistic possibility that the Russians could once again win the contract, Fokus reached out to the relevant institutions in BiH. The Ministry of Security of BiH, which is once again the project’s implementing body, told us that the designated working group—led by Assistant Minister of Security Mladen Mrkaja and tasked with conducting the tender—is still not fully acquainted with ICMPD’s procurement rules under which the new AFIS will be acquired.
The Ministry of Security of BiH has stated that its proposal in the given procurement procedure will be to require references or installations of the offered AFIS solution in EU countries, in order to ensure the compatibility and compliance of the proposed system with EU regulations and standards. “To ensure successful implementation of the project and procurement of the new AFIS, ICMPD has engaged an international AFIS expert who is assisting the AFIS working group in drafting the technical specification,” the state ministry told us.
The Role of Mladen Mrkaja
In addition to Mrkaja, who heads the Information and Communication Sector of the Ministry of Security of BiH, the aforementioned working group also includes representatives from the Ministries of Interior of both Republika Srpska (RS) and the Federation of BiH (FBiH). As confirmed by the Ministry, Mrkaja has also been appointed to the Project Steering Committee—an important detail, considering that the same individual serves in both bodies closely linked to the AFIS procurement process.
But why was the Russian company Papillon—represented by the aforementioned firm MRG Export-Import from Banja Luka—ranked as the top bidder in the 2022 tender? According to unofficial information, this was largely due to strong lobbying from the RS Ministry of Interior, as well as the fact that representatives from the Federal Ministry of Interior, who were part of the working group at the time, raised no objections.
BiH Is Already on Papillon’s Map!
Interestingly, Papillon, headquartered in Moscow, has already listed Bosnia and Herzegovina on its official website as one of the countries where its AFIS system has been installed! If we disregard this “error”—given that they have not yet secured the contract in BiH—it is evident that among the other listed countries using their AFIS system, aside from Poland, none are EU member states.
Countries listed as having Papillon’s AFIS installations, apart from Russia, include Azerbaijan, Albania, Bangladesh, Belarus, Vietnam, Georgia, Zambia, India, Kazakhstan, Cuba, Latvia, Mongolia, Nigeria, Serbia, Tajikistan, Turkmenistan, Turkey, Ukraine, Uzbekistan, and South Korea. They also mention Abkhazia, which they consider a country, despite its unrecognized status.
In Serbia—which has been using a Moscow-manufactured AFIS for over two decades—is located the “parent company” of MRG Export-Import Banja Luka: MRG Export-Import Belgrade. MRG Belgrade was founded in 1992, while MRG Banja Luka was established in 1999. Both were founded by Milun Grbović, who has since passed away. According to official registry data, the responsible person for both the Banja Luka and Belgrade branches is Tijana Grbović-Kropfl.
The business description of the Banja Luka-based firm includes activities such as the import and sale of security paper for banknotes and personal documents, as well as cooperation with the Russian company Papillon. Fokus sent official inquiries with several questions to both MRG Export-Import Banja Luka and Papillon, but by the time this article was completed, no responses had been received. If and when responses are provided, they will be published subsequently.
Expert Opinion
Denis Hadžović, Director of the Center for Security Studies (CSS), told Fokus that today's geopolitical landscape is marked by major upheavals, which further complicates the situation and raises questions about which manufacturer to rely on when procuring a new AFIS system.
“There is a growing trend of using new electronic systems to gain access to data that is not strictly within the scope of the system itself. Given that we rely on the EU and have numerous agreements with it, it would be natural to also rely on technology used in European countries. This would ensure both compatibility and protection against interference from third parties,” said Hadžović, alluding to the widely recognized interference by Russia in security systems worldwide.
According to a report by Buzzfeed (https://www.buzzfeednews.com/article/chrishamby/fbi-software-contains-russian-made-code-that-could-open-a), a U.S. digital media company, the Russian company Papillon boasts in its own publications about its close cooperation with various Russian ministries and with the Federal Security Service (FSB)—the successor to the Soviet-era KGB—which has been involved in multiple cyberattacks against U.S. targets.
What Buzzfeed Revealed
In 2017, Buzzfeed revealed that fingerprint analysis software used by the FBI and over 18,000 other U.S. law enforcement agencies contained code created by the aforementioned Russian firm with close ties to the Kremlin. This raised serious concerns that Russian hackers could gain access to sensitive biometric data on millions of Americans through backdoors—or even compromise broader national security and law enforcement systems.
The large French company Safran, which also manufactures AFIS systems, had reportedly concealed from the FBI the fact that it had purchased Russian code licensed from Papillon.
According to a European Commission document titled “EU Support for Establishing AFIS”, the existing AFIS in Bosnia and Herzegovina was originally owned by a company called Pritrak, which was part of the American firm Motorola. Since then, ownership of the BiH system has shifted to the aforementioned Safran, in which the French government holds an 11.6% stake.
The European Commission document highlights that the system has been plagued by technical issues and malfunctions for years. It also points to the alarming fact that there has been no proper backup for the existing system for several years.
A System from Another Era
Remarkably, when it comes to the current AFIS installed in BiH police agencies, the Ministry of Security confirmed to Fokus a seemingly unbelievable fact: the system is 21 years old and practically unusable.
“The existing AFIS in BiH was established through an EU donation via the EU CARDS program in 2004. The Memorandum on AFIS implementation in BiH was signed not only by the Ministry of Security but also by all competent police institutions in the country (SIPA, Border Police, RS Ministry of Interior, FBiH Police Administration, Brčko District Police, and cantonal Ministries of Interior). Since 2020, the system has operated without a maintenance contract, and all components are long past their end-of-support lifecycle, making them impossible to procure,” the Ministry stated.
What the Auditors Found
This troubling information is certainly good news for criminals, as it severely hampers police agencies’ ability to efficiently and effectively counter criminal activity in BiH. And that’s not the only concern.
“After the maintenance contract expired, AFIS has ceased functioning on multiple occasions but was brought back online through extraordinary efforts by IT sector employees. Since manufacturer support expired long ago and the cost of a new AFIS is estimated in the millions of euros, the Ministry of Security—as the system’s owner—has repeatedly requested the EU to support the procurement of a new AFIS,” the Ministry told us.
State auditors have for years warned about the obsolescence of the AFIS system in their reports on the Ministry of Security’s work. Since 2020, they have repeatedly noted that the existing system is operating without maintenance.
“In the reporting period, a large number of user complaints were registered regarding the functioning of the current AFIS system, which calls into question its operational reliability,” states the audit report for 2022. The 2023 report emphasizes that the system is currently not operating at full capacity.
ICMPD’s Position on the Tender
Fokus also contacted the Austrian organization ICMPD, which is managing the tender. While they did not disclose which companies submitted bids, they did respond to other questions.
“The project has just completed its initial phase. ICMPD cannot provide detailed information on the selection or employment of experts or potential vendors, as doing so would violate established ICMPD procedures. However, please note that ICMPD rigorously applies optimal levels of transparency and fairness in these matters and is an organization with a positive pillar assessment. This means it has been formally evaluated and recognized by the European Commission as meeting the highest standards of financial management, accountability, and internal control under Article 154(4) of the EU Financial Regulation and Article 29(1) of the EDF Financial Regulation,” ICMPD stated.
ICMPD and Other Projects
ICMPD has long collaborated with the Ministry of Security of BiH, including on an EU-funded project to enhance the biometric identification system for foreigners.
As Fokus previously reported, the BiH Prosecutor’s Office and the European Anti-Fraud Office (OLAF) launched investigations into irregularities during the implementation of that project, while ICMPD’s Director Michael Spindelegger initiated an internal investigation into the organization’s Sarajevo office, which led to the suspension of several employees.
While no response was received from the RS Ministry of Interior regarding the extent to which the outdated AFIS hampers their work, the Federal Ministry of Interior acknowledged that the current system is outdated, but still “functional within the technological limits of the time it was acquired.”
“This system was donated during the time of visa liberalization for BiH, and nearly 20 years have passed since then. You can imagine how far technology has come in that time, while we are still, colloquially speaking, ‘walking’ through this system. It certainly burdens the work of our police structures.
Additionally, we have signed international agreements and cooperation with INTERPOL, EUROPOL, EUROJUST, and FRONTEX. All of them expect signatory countries, including BiH, to have adequate systems in place,” said BiH security expert Denis Hadžović.
