SOHAIL AMIN VS SECRETARY, REVENUE DIVISION, ISLAMABAD, 2013 PTD-FEDERAL-TAX-OMBUDSMAN-PAKISTAN 2226 (2013)

Income Tax Ordinance (XLIX of 2001)---

----Ss. 198 & 216---Assessment record of taxpayer---Illegal access to such record and theft of confidential data therefrom---Effect---Failure of department to ensure integrity of taxpayer's assessment would tantamount to maladministration and constitute data theft---Principles.

Maintaining confidentiality of all information contained in the assessment record of taxpayers is the responsibility of the concerned office of the Federal Board of Revenue where the manually filed data is store/maintained. Any person who in contravention of the provisions of Section 216 of Income Tax Ordinance, 2001 (the Ordinance) discloses any particulars borne on a taxpayer's assessment record is guilty of an offence under Section 198 of the Ordinance, which is punishable on conviction with fine or/and imprisonment for a term not exceeding six months. The provisions of Section 216 of the Ordinance cast a statutory responsibility on the FBR to ensure the integrity of a taxpayer's assessment record.

When the department fails to ensure the integrity of a taxpayer's assessment record, then this lapse tantamounts to maladministration as defined in section 2(3) of the Establishment of the Office of Federal Tax Ombudsman Ordinance, 2000. The illegal access to taxpayer's assessment record also constitutes data theft under Section 216 of the Income Tax Ordinance, 2001.

Muhammad Munir Qureshi, Advisor Dealing Officer.

Waheed Shahzad Butt for Authorized Representative.

Qadir Nawaz DCIR, Mujahid Naeem Senior ManagerAutomation (DT) PRAL, Zulfiqar Ali, DCIR, Uzair Ahmad, IRAO, Rashid Mehmood, Data Base Admin PRAL, Fakhar Abbas E-support Supervisor PRAL, Muhammad Aftab, Inspector Income Tax and Irfan Ahmad, IRAO Departmental Representatives.

FINDINGS/RECOMMENDATIONS

ABDUR RAUF CHAUDHRY, (FEDERAL TAX OMBUDSMAN).---This is a complaint against alleged theft of confidential data from a taxpayers assessment record.

2.The facts in this case are that a Mr. Muhammad Abu Bakar Khan son of Muhammad Rafiq Khan (CNIC 36501-8633546-3) r/o Chak No.111-7R, Tehsil Chichawatni, District Sahiwal, lodged a complaint on 25th July, 2012 in the Human Rights Cell, set up by the Supreme Court of Pakistan that a retired Patwari by the nameof Muhammad Amin had amassed wealth through illegal gratification that was being used by his son Sohail Amin and daughter in law Javeria Amin to run a thriving fertilizer business that was also involved in tax evasion. In order to make the complaint credible Abu Bakar Khan referred to data and information borne on the assessment record of Sohail Amin, complainant. Sohail Amin has now alleged in his complaint before the FTO that officials of the Regional Tax Office (RTO), Multan and Pakistan Revenue Automation Ltd. (PRAL), custodians of taxpayers assessment record (filed manually as well as electronically), have failed to ensure the secrecy of his assessment record. He stated that he had reasons to believe that access of his confidential assessment record in the absence of official requirement by these officials had a nexus with the complaint filed against him in the Human Rights Cell of the Hon'ble Supreme Court of Pakistan.

3.The Human Rights Cell of the Supreme Court referred the said complaint filed by Mr. Abu Bakar to DCO Vehari for enquiry. The DCO found that the cited person, being fictitious was not available at the given address. Nor were his whereabouts known to anyone. The complaint was eventually dropped. However, getting hold of copies of returns of income and wealth statements from the assessment record of the complainant was proof that access to complainant's assessment record is apparently not possible without insider help.

4.Maintaining confidentiality of all information contained in the assessment record of taxpayers is the responsibility of the concerned office of the Federal Board of Revenue where the manually filed data is stored/maintained. Any person who in contravention of the provisions of section 216 of Income Tax Ordinance, 2001 (the Ordinance), discloses any particulars borne on a taxpayer's assessment record is guilty of an offence under section 198 of the Ordinance which is punishable, on conviction with fine or/and imprisonment for a term not exceeding six months. The provisions of section 216 the Ordinance, cast a statutory responsibility on the FBR to ensure the integrity of a taxpayers assessment record. The fact that the person(s) behind the fictitious complaint filed in the Human Rights Cell of the Supreme Court made specific reference to information borne on the assessment record of Mr. Sohail Amin, the complainant before the FTO, shows that the Deptt. (RTO Multan and PRAL) has failed to ensure the confidentiality of the complainant's assessment record.

5.Earlier, when Mr. Sohail Amin became aware of the complaint filed in the Human Rights Cell of the Supreme Court, he approached Mr. Farooq Ahmed Khan, CIR Sahiwal Zone. RTO Multan on 2-1-2013 and filed a complaint against the leakage of information/data from his assessment record maintained in the RTO. There was no response from the CIR, despite two reminders. However, after a lapse of 41 days the matter was transferred by him to Commissioner Inland Revenue, Information Processing/Tax Facilitation Centre (CIR/IP/TFC), RTO Multan. It was evident that the CIR was simply passing the matter referredtohimbySohailAmintoanotherjurisdictionsoastoabsolve himself of any responsibility in the matter. Disillusioned, Sohail Amin; complainant, then approached the FTO and sought his intervention.

6.When confronted the Deptt. (RTO Multan) custodian of complainant's manually filed assessment record raised a preliminary objection that the complaint was premature as no data/record had been stolen/lost from the assessment record. It was also the Deptt. contention that Sohail Amin's wealth statements were not borne on the assessment record. On merits, PRAL (operational custodian of the electronic record of all taxpayers) filed a written statement confirming that the complainant's confidential electronic assessment record had been accessed by both RTO Multan as well as PRAL officials. However, PRAL said that the officials who had so accessed the record were authorized persons. The PRAL official, Mr. Mujahid Naeem, who attended the complaint proceedings explained that it was not possible for any person to access a taxpayer's electronic record from outside designated official premises. Thus only authorized persons could access the electronic record and that too from within the designated office premises. However, he confirmed during the hearing, conducted at the FTO Regional Office, Lahore, that for a short period between May, 2012 and June, 2012 it was possible for anyone in possession of the official password / pin code and user ID to log in and access a taxpayer's data from any location.

7.Both sides have been heard and record examined.

8.The Deptt. objection that the complaint was premature has been examined and found to be misconceived. Much of the information cited in the complaint filed in the Human Rights Cell of the Supreme Court could only have come from the assessment record of Sohail Amin, complainant, and that record was in the custody of Deptt. officials of the FBR including both field officials of RTO Multan as well as PRAL. Prima facie, there has been theft of data from complainant's manually filed assessment record as well as his electronic record. That being so. Sohail Amin has rightly sought the intervention of the FTO as the CIR took no interest in the matter when it was brought to his notice. On merits, the PRAL representative, Mr. Mujahid Naeem, candidly acknowledged that between May, 2012 and June, 2012 there was a period of one month (approximately) when anyone in possession of Sohail Amin's User ID, password and pin code could access his electronic data from anywhere in Pakistan. No log-in data for this period was statedly available with PRAL. However, from June 2012 onwards random access of taxpayers electronic data from anywhere in Pakistan was not possible as controls had been tightened and changes made in the system whereby data access was only available to authorized person from within designated FBR/PRAL office premises. A few select PRAL personnel could still access data from outside the designated office premises but only if they used the samePC/Laptop that theywould use within the designated office premises.

9.The report submitted by PRAL identified four persons who had accessed Sohail Amin's electronic data. They are two RTO Multan Officials Mr. Zulfiqar Ali (ACIR) having login ID 35302-2025899-7 and Mr. Uzair Ahmad (Auditor) with login ID 32103-8176313-1. Besides, two PRAL officials Mr. Rashid Mahmood and Mr. Fakhar Abbas also accessed the data. Mr. Mujahid Naeem could not say why these persons accessed Sohail Amin's data. All that he could say was that access was made routinely during the course of their official duties and that the cited officials had proper authorization for accessing taxpayers electronic data/ assessment record. As per the details filed by Mr. Mujahid Naeem of PRAL, Mr. Uzair Ahmed (Inland Revenue Audit Officer) had accessed Mr. Sohail Amin's assessment record on 23rd November 2012 while Mr. Zulfiqar Ali had done so on 11th April 2013. The two PRAL officials Mr. Fakhar Abbas and Mr. Rashid Mehmood had accessed the site on 15-11-2012.

10.The above cited officials were questioned as to the purpose of accessing the complainant's electronic record.

11.Mr. Zulfiqar Ali, DCIR, deposed that he had accessed the site on 11-4-2013 in order to ascertain whether or not Mr. Sohail Amin, complainant, had filed Income Tax Return for Tax Year 2011 through electronic channel. His access of the site confirmed that the return had been e-filed.

12.Mr. Uzair Ahmad, IRAO (Inland Revenue Audit Officer) denied accessing the site himself. However, he said that his password had been used by Mr. Muhamad Aftab, Income Tax Inspector RTO Multan, and Mr. Irfan, IRAO, RTO Multan, to gain access to complainant's electronic record using the official PC (Personal Computer) available to them for office work.

13.Mr. Muhammad Aftab, Income Tax Inspector, confirmed that he did access the complainant's electronic record using Mr. Uzair Ahmad's Password that he said he had himself given to him in order to gain access to the site and carry out 'desk audit' assignments on his behalf. This was confirmed by Mr. Uzair Ahmad who acknowledged that he may have earlier conveyed the wrong impression that Mr. Muhammad Aftab, Inspector, had misused his (i.e. Mr. Uzair Ahmed's) Password to gain access to the complainant's electronic record without proper authorization. It may be mentioned here that when during complaintproceedingsMuhammadAftabwasaskedwhetheranydeskauditreport was prepared after he had accessed the site, he replied in the negative.

14.Mr. Irfan Ahmad, IRAO denied having ever accessed the complainant's site himself. He also did not have any Password assigned to him for the purpose. While it was a fact that the PC available to him for office use was used to access the complainant's site he said that he did not do so and in any case without the required Password he couldnotgainaccesstothesite.HesaidthattheofficePCwasnotinhis exclusive custody and it was not Password protected by him personally.

15.Mr. Rashid Mehmood, Data Base Administrator (PRAL) explained that he accessed the site on 15-11-2012 at the behest of his colleague, Mr. Fakhar Abbas, e-support supervisor, RTO Lahore who requested assistance as he was having problems downloading CPR's (cash payment receipts) submitted online by Mr. Sohail Amin (complainant), Mr. Sohail Amin had earlier filed an Online request that the CPR's be updated.

16.Mr Fakhar Abbas, e-support supervisor PRAL, confirmed that he had accessed the site on 15-11-2012, after he had received an electronic request from Syed Mutahir Hussain, Regional Manager PRAL to update the CPR's submitted by Mr. Sohail Amin, complainant. He acknowledged that he had sought assistance from Mr. Rashid Mehmood as he was relatively new at the job and was having problems downloading the CPR's.

17.The complaint to the Human Rights Cell in the Supreme Court having been lodged on 25-7-2012 the access of complainant's electronic record on subsequent dates by Deptt. officials suggests that on the basis of log-in information provided by PRAL the Deptt. officials could not be held responsible for leakage of any information to Mr. Abu Bakr who filed a complaint to the Human Rights Cell of the Supreme Court. However it is to be noted that as per deposition made by Mr. Mujahid Naeem, senior Manager Automation (PRAL) during May-June 2012 it was possible for anyone in possession of official password/user ID to log-in and access a taxpayers data from any location. Given the tendency of Deptt. officials to divulge their password to other officials tasked with carrying out assignments that they themselves were required to perform, as in the case of Mr. Uzair Ahmad who divulged his password to Mr. Muhammad Aftab Deptt. Inspector, as discussed above, the possibility of illegal access of complainant's electronic record cannot be ruled out in this window of opportunity. Similarly, the possibility of leakage of information from the manually filed hard copies of the assessment record also cannot be ruled out.

18.According to theparawisecommentsonthecomplaintdated22-4-2013 submitted by the Chief Commissioner IR RTO Multan, no wealth statement as on 30-6-2011 was filed by the complainant. However, PRAL, vide letter dated 23-5-2013, confirm that wealth statement as on 30-6-2011 was filed by the complainant electronically on 29-12-2011. Furthermore, the Chief Commissioner has stated that in the annexures with the tax evasion complaint filed in the Human Rights Cell of the Supreme Court, only Balance Sheet of Pak-Arab Fertilizer Co. and Intiqal record of different properties was incorporated. However, in the complaint by Abu Bakr a list of six attachments is cited, including Income Tax Returns for Tax Years 2009, 2010 and 2011 and Wealth Statement as on 30-6-2011 as well as details of payments to Pak-Arab Fertilizer Co. and evidence of Intiqal record of different properties. The Deptt. thus admits to availability of two attachments with the Abu Bakr complaint Viz Pak-Arab Fertilizer Payment details and Intiqal of properties. This discrepancy is not explained by the Deptt. and indicates that the information annexed with the Abu Bakr complaint was obtained illegally from the Departmental assessment record, electronic as well as manual.

19.The ambient circumstances suggest that documents including returns of income and wealth statements were illegally obtained by accessing the complainant's manually filed record as well as the electronic assessment record. The complainant has pointed out that in the complaint filed before the Human Rights Cell of the Supreme Court of Pakistan Mr. Abu Bakar had statedly annexed Mr. Sohail Amin's tax returns for 2009, 2010 and 2011 and wealth statements. This shows Sohail Amin's confidential assessment record, manual as well as electronic, was illegally accessed as this information was not available anywhere else.

Findings:

20.The leakage of sensitive information from the complainant's assessment record is evident from the fact that in the complaint filed before the Human Rights Cell of the Hon'ble Supreme Court direct reference has been made to information borne on the complainant's income tax returns and wealth statements. This shows that the Deptt. has not been able to ensure the integrity of complainant's assessment record and this lapse is tantamount to maladministration as defined in section 2(3) of the FTO Ordinance. The illegal access to complainant's assessment record also constitutes data theft under section 216 of the Income Tax Ordinance, 2001.

Recommendations:

21.FBR to---

(i)conduct enquiry to determine how and why complainant's assessment record came to be accessed by a number of FBR officials when they were not charged with conducting any enquiry involving him in any manner nor were they involved in the assessment of his income for any Tax Period:

(ii)devise a fool proof SOP in consultation with the National Response Centre for Cyber Crimes (NR3C) wing of FIA to protect the confidential data of taxpayers.

(iii)counsel and caution (sic) Mr. Farooq Ahmed Khan, CIR Sahiwal Zone, RTO Multan who failed to respond to the complainant's repeated requests that cognizance be taken of the illegal access of information from his assessment record;

(iv)enforce strict confidentiality of passwords assigned to field officers for purposes of accessing taxpayer's electronic record; and

(v)report compliance within 30 days.

22.A copy of the above Findings/Recommendations along with copy of complaint filed by Mr. Abu Bakar Khan in the Human Rights Cell of the Hon'ble Supreme Court of Pakistan be forwarded to the National Response Centre for Cyber Crimes (NR3C) wing of FIA for initiating criminal investigation into the matter, as per law.

SAK/139/FTOOrder accordingly.