Published on the 06/03/2024 | Written by Heather Wright

The cybersecurity concerns that kept commissioner up at night…

Around 4.7 million attempted cyber intrusions a month are hitting the Australian Taxation Office websites, services and infrastructure, but it’s the industrialisation of identity theft that’s causing big concerns.

Days before departing from his 11 year tenure as Commissioner of Taxation, Chris Jordan told the National Press Club of Australia that he’s often asked what keeps him up at night.

“Our systems were never designed for people to commit fraud at such scale in such a short period, in their own names.”

“My response has always been ‘cyber security’,” he says.

“We hold about 50 petabytes of data. To put that in context, that’s equivalent to one billion tall filing cabinets.”

But it’s identity fraud and identity theft – and the ‘industrialisation’ of that theft through large scale cyber breaches – that Jordan revealed was his big concern.

While he noted that identity theft has been around for ages, harking back to the days of letterbox thefts of utility bills or Medicare cards for the purpose of identity theft, the ability to access vast dark-web databases of stolen credentials has moved identity theft to new levels.

“We came across something recently… there was a situation where 30,000 super funds were created in a very short period of time.”

Information from the dark web, grabbed during big data breaches such as those of Medibank and Optus, was used in that example.

“The curious bit of this was they were using bots – an automated way of filling out the form. So the criminals couldn’t fill out the forms to create the new super funds quick enough, so they devices a bot to do that work for them.”

It is, he says, ‘scary stuff’.

“These are things we really have to keep on top of, keep investing in, keep convincing government that this is something where continuous funding will be required. The criminals are smart. We just have to keep ahead.”

While the TikTok GST fraud had ‘a little’ of the identity fraud element, Jordan says it was a particularly bizarre situation and one he doesn’t expect to see recreated.

The large-scale GST fraud was promoted particularly on social media and saw individuals inventing fake businesses, lodging fraudulent Australian business number applications and then submitting fictitious business activity statements in an attempt to gain false GST refunds. More than $2 billion in fraudulent GST refunds were claimed.

An ATO-led, multi-agency investigation, dubbed Operation Protego, resulted in the identification of 57,000 people for the fraud – something Jordan dubbed ‘unheard of’.

“It really shocked us that the community would have such an appetite to commit fraud and take money from the government in that way.”

A number of people have since been sentenced for their role in the fraud, receiving sentences of up to seven-and-a-half years.

Protego also netted 150 former or current employees or contractors to the ATO. Of those three were current employees at the time they carried out the fraud, with nine being contractors at the time.

While Jordan acknowledged that it was ‘totally unacceptable’ to have even three employees involved – ‘clearly they are terminated and compliance actions have been taken’ – he was quick to note that 60,000 people who had worked for the ATO or a contractor in the last five years were ‘scanned’ for the indicators of the GST fraud.

“Our systems were never designed for people to commit fraud at such scale in such a short period, in their own names,” Jordan says.

“They were real people, with real addresses, real tax file numbers, real bank accounts and it just went off on social media,” he says.

He says he hopes the GST fraud was just a bizarre one-off.

“That was just bizarre, to have people [using] in their own names. And our systems are tighter [now].”

Jordan used his address to highlight the transformation – both digital and otherwise – of the ATO, from a rigid and isolated organisation to one more in touch with the community’s needs and expectations, focusing on ‘helping people get it right, not just catching people who did the wrong thing’.

The ATO website, refreshed several months ago, is one of the largest and most accessed government sites in Australia, he says, with more than 40,000 pages and over 115 million visitors annually.

“The Mandarin reported we updated our website and no one really noticed. This is a good thing! My favourite quote is: ‘Any major government customer-facing website that can flip its entire content management system without significant initial blowback puts similar corporate overhauls in the shade’.”

His time at the helm also saw the establishment of the Tax Avoidance Taskforce which clawed back around $30 billion in additional tax revenue from multinational, large public and private businesses.

“More importantly, we’ve locked in future tax performance, by requiring companies to agree to the tax treatment of their operations.”

Apple, Facebook, Google and Microsoft are among those to feel the wrath of the ATO. All four, along with others, have publicly acknowledged finalising disputes with the ATO in what Jordan calls ‘landmark victories’.

“The size of these successes for the benefit of all Australians are without precedent in the history of the ATO.”

The journey though, is far from over, he says, with the next part of the ATO’s journey including being fully digitalised by 2030.

“This means we’ll offer real-time tax reporting and payment information; where data will flow from taxpayers’ natural systems to ours, without any extra effort or intervention from them.”

Jordan departed his role on February 29, with Rob Heferen becoming the thirteenth Commissioner of Taxation.