2013 PLP 2226 (PTD)

8. The Deptt. objection that the complaint was premature has been examined and found to be misconceived. Much of the information cited in the complaint filed in the Human Rights Cell of the Supreme Court could only have come from the assessment record of Sohail Amin, complainant, and that record was in the custody of Deptt. officials of the FBR including both field officials of RTO Multan as well as PRAL. Prima facie, there has been theft of data from complainant's manually filed assessment record as well as his electronic record. That being so. Sohail Amin has rightly sought the intervention of the FTO as the CIR took no interest in the matter when it was brought to his notice. On merits, the PRAL representative, Mr. Mujahid Naeem, candidly acknowledged that between May, 2012 and June, 2012 there was a period of one month (approximately) when anyone in possession of Sohail Amin's User ID, password and pin code could access his electronic data from anywhere in Pakistan. No log-in data for this period was statedly available with PRAL. However, from June 2012 onwards random access of taxpayers electronic data from anywhere in Pakistan was not possible as controls had been tightened and changes made in the system whereby data access was only available to authorized person from within designated FBR/PRAL office premises. A few select PRAL personnel could still access data from outside the designated office premises but only if they used the same PC/Laptop that they would use within the designated office premises.

9. The report submitted by PRAL identified four persons who had accessed Sohail Amin's electronic data. They are two RTO Multan Officials Mr. Zulfiqar Ali (ACIR) having login ID 35302-2025899-7 and Mr. Uzair Ahmad (Auditor) with login ID 32103-8176313-1. Besides, two PRAL officials Mr. Rashid Mahmood and Mr. Fakhar Abbas also accessed the data. Mr. Mujahid Naeem could not say why these persons accessed Sohail Amin's data. All that he could say was that access was made routinely during the course of their official duties and that the cited officials had proper authorization for accessing taxpayers electronic data/ assessment record. As per the details filed by Mr. Mujahid Naeem of PRAL, Mr. Uzair Ahmed (Inland Revenue Audit Officer) had accessed Mr. Sohail Amin's assessment record on 23rd November 2012 while Mr. Zulfiqar Ali had done so on 11th April 2013. The two PRAL officials Mr. Fakhar Abbas and Mr. Rashid Mehmood had accessed the site on 15-11-2012.

10. The above cited officials were questioned as to the purpose of accessing the complainant's electronic record.

11. Mr. Zulfiqar Ali, DCIR, deposed that he had accessed the site on 11-4-2013 in order to ascertain whether or not Mr. Sohail Amin, complainant, had filed Income Tax Return for Tax Year 2011 through electronic channel. His access of the site confirmed that the return had been e-filed.

12. Mr. Uzair Ahmad, IRAO (Inland Revenue Audit Officer) denied accessing the site himself. However, he said that his password had been used by Mr. Muhamad Aftab, Income Tax Inspector RTO Multan, and Mr. Irfan, IRAO, RTO Multan, to gain access to complainant's electronic record using the official PC (Personal Computer) available to them for office work.

13. Mr. Muhammad Aftab, Income Tax Inspector, confirmed that he did access the complainant's electronic record using Mr. Uzair Ahmad's Password that he said he had himself given to him in order to gain access to the site and carry out 'desk audit' assignments on his behalf. This was confirmed by Mr. Uzair Ahmad who acknowledged that he may have earlier conveyed the wrong impression that Mr. Muhammad Aftab, Inspector, had misused his (i.e. Mr. Uzair Ahmed's) Password to gain access to the complainant's electronic record without proper authorization. It may be mentioned here that when during complaint proceedings Muhammad Aftab was asked whether any desk audit report was prepared after he had accessed the site, he replied in the negative.

14. Mr. Irfan Ahmad, IRAO denied having ever accessed the complainant's site himself. He also did not have any Password assigned to him for the purpose. While it was a fact that the PC available to him for office use was used to access the complainant's site he said that he did not do so and in any case without the required Password he could not gain access to the site. He said that the office PC was not in his exclusive custody and it was not Password protected by him personally.

15. Mr. Rashid Mehmood, Data Base Administrator (PRAL) explained that he accessed the site on 15-11-2012 at the behest of his colleague, Mr. Fakhar Abbas, e-support supervisor, RTO Lahore who requested assistance as he was having problems downloading CPR's (cash payment receipts) submitted online by Mr. Sohail Amin (complainant), Mr. Sohail Amin had earlier filed an Online request that the CPR's be updated.

16. Mr Fakhar Abbas, e-support supervisor PRAL, confirmed that he had accessed the site on 15-11-2012, after he had received an electronic request from Syed Mutahir Hussain, Regional Manager PRAL to update the CPR's submitted by Mr. Sohail Amin, complainant. He acknowledged that he had sought assistance from Mr. Rashid Mehmood as he was relatively new at the job and was having problems downloading the CPR's.

17. The complaint to the Human Rights Cell in the Supreme Court having been lodged on 25-7-2012 the access of complainant's electronic record on subsequent dates by Deptt. officials suggests that on the basis of log-in information provided by PRAL the Deptt. officials could not be held responsible for leakage of any information to Mr. Abu Bakr who filed a complaint to the Human Rights Cell of the Supreme Court. However it is to be noted that as per deposition made by Mr. Mujahid Naeem, senior Manager Automation (PRAL) during May-June 2012 it was possible for anyone in possession of official password/user ID to log-in and access a taxpayers data from any location. Given the tendency of Deptt. officials to divulge their password to other officials tasked with carrying out assignments that they themselves were required to perform, as in the case of Mr. Uzair Ahmad who divulged his password to Mr. Muhammad Aftab Deptt. Inspector, as discussed above, the possibility of illegal access of complainant's electronic record cannot be ruled out in this window of opportunity. Similarly, the possibility of leakage of information from the manually filed hard copies of the assessment record also cannot be ruled out.

18. According to the parawise comments on the complaint dated 22-4-2013 submitted by the Chief Commissioner IR RTO Multan, no wealth statement as on 30-6-2011 was filed by the complainant. However, PRAL, vide letter dated 23-5-2013, confirm that wealth statement as on 30-6-2011 was filed by the complainant electronically on 29-12-2011. Furthermore, the Chief Commissioner has stated that in the annexures with the tax evasion complaint filed in the Human Rights Cell of the Supreme Court, only Balance Sheet of Pak-Arab Fertilizer Co. and Intiqal record of different properties was incorporated. However, in the complaint by Abu Bakr a list of six attachments is cited, including Income Tax Returns for Tax Years 2009, 2010 and 2011 and Wealth Statement as on 30-6-2011 as well as details of payments to Pak-Arab Fertilizer Co. and evidence of Intiqal record of different properties. The Deptt. thus admits to availability of two attachments with the Abu Bakr complaint Viz Pak-Arab Fertilizer Payment details and Intiqal of properties. This discrepancy is not explained by the Deptt. and indicates that the information annexed with the Abu Bakr complaint was obtained illegally from the Departmental assessment record, electronic as well as manual.

19. The ambient circumstances suggest that documents including returns of income and wealth statements were illegally obtained by accessing the complainant's manually filed record as well as the electronic assessment record. The complainant has pointed out that in the complaint filed before the Human Rights Cell of the Supreme Court of Pakistan Mr. Abu Bakar had statedly annexed Mr. Sohail Amin's tax returns for 2009, 2010 and 2011 and wealth statements. This shows Sohail Amin's confidential assessment record, manual as well as electronic, was illegally accessed as this information was not available anywhere else. Findings:

20. The leakage of sensitive information from the complainant's assessment record is evident from the fact that in the complaint filed before the Human Rights Cell of the Hon'ble Supreme Court direct reference has been made to information borne on the complainant's income tax returns and wealth statements. This shows that the Deptt. has not been able to ensure the integrity of complainant's assessment record and this lapse is tantamount to maladministration as defined in section 2(3) of the FTO Ordinance. The illegal access to complainant's assessment record also constitutes data theft under section 216 of the Income Tax Ordinance, 2001. Recommendations:

21. FBR to

(i) conduct enquiry to determine how and why complainant's assessment record came to be accessed by a number of FBR officials when they were not charged with conducting any enquiry involving him in any manner nor were they involved in the assessment of his income for any Tax Period: (ii) devise a fool proof SOP in consultation with the National Response Centre for Cyber Crimes (NR3C) wing of FIA to protect the confidential data of taxpayers. (iii) counsel and caution (sic) Mr. Farooq Ahmed Khan, CIR Sahiwal Zone, RTO Multan who failed to respond to the complainant's repeated requests that cognizance be taken of the illegal access of information from his assessment record; (iv) enforce strict confidentiality of passwords assigned to field officers for purposes of accessing taxpayer's electronic record; and (v) report compliance within 30 days.

22. A copy of the above Findings/Recommendations along with copy of complaint filed by Mr. Abu Bakar Khan in the Human Rights Cell of the Hon'ble Supreme Court of Pakistan be forwarded to the National Response Centre for Cyber Crimes (NR3C) wing of FIA for initiating criminal investigation into the matter, as per law. SAK/139/FTO Order accordingly.