Page 29 - Building digital public infrastructure for cities and communities

PPP proponents highlight their capacity to mobilize technical expertise, align long-term incentives
and transfer execution risk from the public sector (Schomaker, 2020).

Case studies provide tangible insights into DPI-focused PPPs. São Paulo’s telecentres partnership,
supported by civil society and private actors, established 128 community ICT hubs using open-
source platforms to promote digital inclusion (Selaimen, n.d.). However, PPP also carries inherent
risks. Canadian reviews such as those from Ontario and PPP Canada, report average cost overruns
of up to 16 per cent compared to traditional models, with challenges in transparency, accountability
and higher borrowing costs. The United Kingdom’s National Audit Office had initially cast doubt on
the claimed value for money from PPPs, with some Private Finance Initiative (PFI)-funded services
later returned to public administration after cost escalations and performance shortfalls (Teo, 2024).

3.4 Legacy systems

Legacy systems, often decades old, highly specialized and deeply embedded in public institutions,
pose significant challenges for DPI. These systems are characterized by steep maintenance costs,
operational fragility, security vulnerabilities and rigid architectures incompatible with contemporary
technologies (Sasidhar, 2025).

Legacy systems impose substantial financial burdens. For instance, a U.S. Government Accountability
Office report revealed that ten critical federal systems, some dating back 51 years, consumed
approximately USD 337 million annually in maintenance alone (Burney, 2023). Similarly, McKinsey
estimates that consolidating data centres or migrating them to the cloud can yield cost reductions
of up to 50 per cent, while also improving oversight and operational efficiencies (Das et al., 2019).

Ageing technologies restrict government agencies from delivering timely services or adapting to
emerging needs. McKinsey finds that modernization supports more agile, user-centred delivery and
enhances productivity via automation and data accessibility (Das et al., 2019). Additionally, legacy
systems generate considerable security risk. They frequently rely on obsolete languages, such as
Common Business-Oriented Language (COBOL), and unpatched vulnerabilities. U.S. agencies
have acknowledged that systems, including those maintained by the Internal Revenue Service
(IRS), represent serious cybersecurity threats due to outdated codebases and scarce maintenance
expertise from retiring personnel (Burney, 2023; US Government, 2023).

16