Government Organization Portal Development

Government Organization Portal Development

Government portals represent a distinct category with specific requirements. The legislation governing access to information about government agencies, accessibility standards (WCAG 2.1, level AA as minimum), integration with state identification services, and strict personal data protection requirements all apply. This is not a corporate website with a contact form — it demands a higher level of responsibility in implementation.

Legislative Framework

In Belarus: the Law "On Electronic Document and Electronic Digital Signature," requirements from Council of Ministers decrees on state information resources. In Russia: Federal Law 149-FZ "On Information," Federal Law 152-FZ "On Personal Data," and Government decrees on requirements for official government websites.

The list of mandatory sections for Russian government agencies is fixed in Russian Government decree No. 477 from 2010 and its subsequent versions: agency information, regulatory documents, government services, audit results, and anti-corruption materials.

Accessibility: WCAG 2.1 AA is Mandatory

This is not a recommendation but a requirement. GOST R 52872-2019 in Russia directly references WCAG. Verification is conducted both automatically (axe-core, Lighthouse) and manually.

Common issues that emerge during audits:

<!-- Incorrect: search form without label -->
<input type="search" placeholder="Search the site">

<!-- Correct -->
<label for="site-search" class="sr-only">Search the site</label>
<input id="site-search" type="search" placeholder="Search the site"
       role="searchbox" aria-label="Search the site">

<!-- Incorrect: table without headers -->
<table>
  <tr><td>Ivanov I.I.</td><td>Department Head</td><td>+375 17 000-00-00</td></tr>
</table>

<!-- Correct: headers with scope -->
<table>
  <caption>Leadership Contacts</caption>
  <thead>
    <tr>
      <th scope="col">Full Name</th>
      <th scope="col">Position</th>
      <th scope="col">Phone</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>Ivanov Ivan Ivanovich</td>
      <td>Department Head</td>
      <td><a href="tel:+375170000000">+375 17 000-00-00</a></td>
    </tr>
  </tbody>
</table>

All PDF documents hosted on the portal must also be accessible — tagged PDFs with logical structure and alt texts for images within the document. This is separate work if you have a large archive.

Authentication via Government Services

For portals with citizen personal accounts, integration with the national identification system is mandatory. In Belarus — ESIA (unified identification and authentication system) or ID card. In Russia — Gosuslugi (portal.gosuslugi.ru) via SAML 2.0 or OpenID Connect.

Example of ESIA integration via OAuth 2.0 (simplified scheme):

// Laravel: redirect to authorization via ESIA
public function redirectToEsia()
{
    $params = [
        'client_id'     => config('esia.client_id'),
        'response_type' => 'code',
        'scope'         => 'openid fullname email mobile snils',
        'redirect_uri'  => route('esia.callback'),
        'state'         => csrf_token(),
        'timestamp'     => now()->format('Y.m.d H:i:s O'),
        'access_type'   => 'online',
    ];

    // Request signature via PKCS#7 (mandatory for ESIA)
    $params['client_secret'] = $this->signRequest($params);

    return redirect(config('esia.auth_url') . '?' . http_build_query($params));
}

ESIA requires request signatures using a qualified certificate — this is a separate infrastructure that must be obtained from a certification authority.

Personal Data and Storage

Federal Law 152-FZ (Russia) and analogous laws require storing personal data of citizens on servers within the country. This affects hosting choice — only Russian or Belarusian data centers for respective projects.

# Mandatory security headers for government portal
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-{NONCE}'; style-src 'self' 'unsafe-inline'" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

Document Search

Government portals accumulate thousands of regulatory documents. Simple database search is insufficient — full-text search accounting for Russian morphology is required.

Elasticsearch with analysis-morphology plugin or PostgreSQL configured for Russian:

-- PostgreSQL: full-text search with Russian morphology
CREATE INDEX docs_fts_idx ON documents
  USING GIN (to_tsvector('russian', title || ' ' || content));

SELECT id, title,
  ts_rank(to_tsvector('russian', title || ' ' || content), query) AS rank
FROM documents, to_tsquery('russian', 'privatization & housing') query
WHERE to_tsvector('russian', title || ' ' || content) @@ query
ORDER BY rank DESC
LIMIT 20;

For very large archives (>100k documents) — Elasticsearch with configured analyzer:

{
  "settings": {
    "analysis": {
      "analyzer": {
        "russian_analyzer": {
          "type": "custom",
          "tokenizer": "standard",
          "filter": ["lowercase", "russian_stop", "russian_morphology"]
        }
      }
    }
  }
}

Versioning and Archive

Regulatory documents must be retained with revision history. Users must see the current version and have access to previous ones. This is implemented via a revisions table:

CREATE TABLE document_revisions (
  id            BIGSERIAL PRIMARY KEY,
  document_id   BIGINT REFERENCES documents(id),
  content       TEXT NOT NULL,
  revision_note TEXT,
  created_by    BIGINT REFERENCES users(id),
  created_at    TIMESTAMPTZ DEFAULT NOW(),
  effective_from DATE,
  effective_to   DATE
);

Multilingual Support

For organizations working with national minorities or international partners, the portal should support multiple languages. hreflang in head, separate URLs by language (/ru/, /be/, /en/), localStorage to save language preference.

Performance and SLA

Government portals must meet SLA requirements for availability — typically 99.5% or higher. This means:

• Infrastructure-level redundancy (multiple servers behind load balancer)
• Uptime monitoring with alerting
• Incident response procedures

Typical architecture: nginx as reverse proxy and load balancer, two application servers in active-active, PostgreSQL with replica, Redis for session caching.

Timeline

Information portal with document archive and search — 6–10 weeks. With ESIA/Gosuslugi integration and citizen personal accounts — 3–5 months. Full government services platform with application submission, request status tracking, and digital signatures — separate project for 6+ months involving lawyers and information security specialists.