State Revenue Department Snooping and Audit
The controller of an SME in North Carolina recently got a call from the tax authority in California (Board of Equalization), saying the authority had web evidence the SME was doing business in California and needed to file a use tax return. State revenue departments are becoming more assertive in enforcing use tax, which applies when a taxpayer uses a taxable product or service in a state but did not pay sales tax on it.
The SME was indeed starting a sales office in California, and the controller was impressed at how quickly the California authority discovered that information on the web.
Tax Intelligence Collection
Make no mistake about it; tax authorities are exploiting the web for intelligence. Laura Saunders, "Is 'Friending' in Your Future? Better Pay Your Taxes First," Wall Street Journal, Aug 27, 2009.
But many taxpayers would prefer that tax collectors not come into their web pages to gather information, just as they prefer the collectors stay away from the taxpayers’ land, homes, offices and factories. In the physical world a taxpayer can post a no trespassing sign to keep out tax agents (unless they have a search warrant) and other personae non-gratae. Why can’t a taxpayer post a no trespassing sign on its web page as well?*
No Trespassing Notice
US case law hints that a web site owner can enforce a no trespassing sign. For example:
eBay Inc. v. Bidder's Edge, Inc., 100 F. Supp. 2d 1058 (ND Cal., May 24, 2000): Competitor trespassed as to eBay’s servers when it systematically scrapped data from eBay’s web site in violation of eBay’s published terms.
Creative Computing v. Get Loaded: Web site owner wins judgment (under federal Computer Fraud and Abuse Act) against competitor who used stolen password to access owner’s site without authority.
Here is an example of no trespassing language for a web site:
“Warning. No trespassing. This web site is exclusively for the benefit of ABC Corp., its customers, prospective customers, vendors, prospective vendors, employees and prospective employees. It is not for tax agents, tax collectors, tax authorities or programs or contractors operating on behalf of the same (collectively, “Tax Authorities”). Tax Authorities are forbidden from using, entering or copying information this web site. All Tax Authorities accessing this warning agree to its terms. Violation of this warning constitutes, among other offenses, trespass, breach of contract, and entry of a computer without authority causing damage.”
What do you think, gentle reader?
Update April 2011: Students in my SANS course commented that the no trespassing sign as written above will make a company a target for a tax audit. Therefore, they suggested making the words of the no trespassing sign more generic in its description of who is allowed in and who is not. In reaction to their comments, I have rewritten the no trespassing sign I present in the course.
Update August 2011: HM Revenue & Customs says it will be using web robots to find tax cheats.
Mr. Wright teaches Internet law and investigations at the SANS Institute.
The foregoing is public discussion, not legal advice for any particular situation. If you need legal advice, you should consult a lawyer.
* A no trespassing sign might deter the gathering of OSINT (open source intelligence) by many kinds of adversaries (bill collectors, divorce lawyers), not just tax authorities.
Related Article: Tax auditors demand more data