How could Madhabi Puri & Dhaval Buch’s tax returns have leaked? BT probes

Fifteen days, five press conferences and allegations ranging from conflict of interest to corruption – it has been a bleak period for Madhabi Puri Buch, the chairperson of the Securities and Exchange Board of India and her husband Dhaval Buch. The opposition Congress party is not letting up on the pressure on the couple, levelling new allegations against them every few days.

Stung by the allegations, the couple issued a detailed rejoinder that sought to counter all the claims. “Shockingly, our income tax returns clearly have been obtained by adopting fraudulent means and illegally. This is a clear breach of not only our right to privacy (which is a fundamental right) but also a violation of the Income Tax Act,” they said in a joint statement on Friday, the 13th of September.

In doing so, they have turned a fresh spotlight on the Income Tax Department and unlocked fresh fears for the well-heeled and high and mighty across the country – about the possibility of their confidential and private income tax records being accessed through illegal means and for malicious ends.

So, how could the tax returns of the Buch couple been leaked, and that too of several years?

A Porous System

Business Today spoke with a chartered accountant (CA) with 46 years of experience in bookkeeping and accounting. “The system is as porous as a sieve,” he alleged, requesting anonymity. “Income tax officers have access to all records and returns. Digitisation of records has made the retrieval of records even easier,” he said, adding, “it literally takes seconds to pull up details of a company or any individual filing in India.”

This sweeping access to IT records is available to all officers of and above the rank of Income Tax Officer. “The access is needed for what they do,” the CA emphasised. “Records of various individuals and companies have to be pulled up during normal scrutiny or any inspection. There is no other way”, he added.

Tax Return Preparers or CA’s, in contrast, have no access to the returns of anyone except their own clients.

Is the System being Misused?

India moved to electronic-filing of income tax returns during assessment year in 2006-07, when the Central Board of Direct Taxes introduced this facility. Online filing of returns was made mandatory for companies from 2007-08, and from 2013 for individuals reporting over Rs 10 lakh in taxable income. At present, e-filing of returns is available to all assesses.

Even before e-filing created a revolution of sorts in taxation, a few hundred rupees in the right hands could be thrown around to illegally access income tax records, sources told Business Today, adding that nefarious elements would indulge in such practices for all manner of reasons – ranging from corporate espionage to marital disputes. So much so, that the Central Information Commission in 2017 asked for a probe of leakage of confidential tax data filed by taxpayers.

In fact, the issue had hit headlines in 2014 when the Finance Ministry also flagged illegal access in some online income tax accounts. Termed as “multifunctional authentication”, the leaks were attributed to login credentials being obtained by third parties, who then reset the passwords and accessed the accounts.

In today’s digital era, the possibility of cyber criminals illegally obtaining data has only grown. Acknowledging this concern, the Income Tax department has a detailed advisory on its website for those who suspect that their e-filing account may have been compromised or accessed in an unauthorized manner.

COMPLAINT PROCEDURE

• Criminal complaint / FIR to be filed on https://cybercrime.gov.in/
• Complete details of complainant including PAN, Aadhaar, brief of incident
• Date and time of suspected account misuse or last log-in details
• Details of how misuse came to your attention
• Other information related to account misuse
• Complaint to IT department to be accompanied with FIR details

So, under normal course, while your IT records will remain secreted away, little can be done to prevent an intentioned leak. Some checks and balances have been put in place including a tracking mechanism which can identify which official has accessed a particular record at what time. What could also help is a ‘double verification’ system to minimise arbitrary record retrievals.