At 2 a.m., a ministry security officer became aware of the alert. He started calling his colleagues. The disbelief of what was happening made it more difficult to accept that the risk of the computer attack had materialized and was coming on a large scale. The object of the attack was not a single server, it was not the systems of the tax administration, it was not even the management capacity of the ministry. It was the country itself that was being attacked.

For the tax administration, between the direct consequences of the attack and the need to analyze other intrusions or interventions, the transactional systems were suspended. This meant that it was not possible, for example, to register taxpayers, receive and process tax declarations or receive payments. Also, that the systems could not be used to make payments, including payments to suppliers. The children’s daily lunch in public schools was just one of the services that could have been disrupted, but one that helps us understand the enormous threat.

However, the daily lunch of children in schools, and the other services and functions of the State did not stop. The tax administration established that the 1000 biggest taxpayers had to pay their taxes even without the operational transactional systems, using for this the D-110 form, which was not used since when the tax returns were made manually. It was thus sought to ensure the collection of the lion’s share of revenue, and in order for it to work, the determined support of the large taxpayers, the banks and, of course, the administration officials were required. The measure worked. It was an extraordinary response with an extraordinary result. A different approach to cooperative compliance, which is good to share…. and it is the reason for this post.

A couple of years earlier, a court ruling had forced the tax administration to publish certain data on large taxpayers. Regardless of what the reader thinks –if tax secrecy and the responsibility to protect taxpayer information prevail, or the public interest in knowing the details of the contribution of large taxpayers, or the monitoring of the actions of the administration including the elements that determined the selection of taxpayers-, a change was established that would probably affect the relationship between the administration and that group of taxpayers. A challenge or an opportunity depending on how you look at it. For the tax administration, it was clearly an opportunity, with a cooperative and service approach, allowing relations with large taxpayers to improve from this stage of dialogue, which proved to be decisive for what would come next.

The weekend following the publication of the decree enabling the D-110 form was, as can be easily imagined, hectic. The taxpayers were contacted individually, they were instructed on the form, they interacted with the banks where they would be received at the bank window, something that had not happen for many years, something that the new cashiers had never seen and would find anachronistic and rare. Auditors and accountants’ guilds were contacted. The administration officials with the historical memory about the manual processes and procedures, plus those from the IT area with memories of the old applications, joined the operation, training the new ones. Electronic sheets were created, accounts were enabled, backups were restored, hundreds of calls and thousands of messages were collectively exchanged. Forms were delivered and received, and payments were made and received from these taxpayers. Control will come later.

The experience reminds us of the need to write with clear and neat writing in everything related to security, data governance and data management processes. You do not just have to have a backup policy; you need to execute it and test it. It is necessary to have a business continuity plan which, as we had already confirmed in the last two years, must go beyond information systems and include processes and the role of people. But, fundamentally, it is good to assimilate the idea that seeing the administration and the taxpayers as two opposing parties in a permanent confrontation is a limited and limiting vision.

What we have experienced, and very briefly described, in these lines may help us, as the Commissioner of the Tax Administration of Costa Rica told us in San José, to cement the importance of developing and consolidating a culture of services that begins with knowing the taxpayers and establishing a differentiated platform of relationship with the different taxpayers. Today, after most of the storm, we can comment on the story with a smile, similar to that of an administration official, responsible for the taxpayer registry, who told us the joy they felt in their area when they returned to see the screens of the operating information systems and on their machines.

This is one more example of citizen model action that comes to us from Costa Rica. Pura vida!

Greetings and good luck.

1,004 total views, 1 views today