Norway Tax Auditors Want To Open Source Cash Registers To Combat Fraud

Qedward writes "The Norwegian Ministry of Finance seems to be taking a bit of stick at the moment. It wants all the existing cash registers in the country thrown out and replaced with new ones. Not surprisingly, this massive upgrade is not popular. But it is apparently being pushed through in an attempt to prevent cash registers' figures being massaged downwards in use so as to reduce tax. The Norwegian association of tax auditors said: 'The source code must be opened.' 'Without source code it is not possible to determine whether or "hidden" functionality exists or not. Just knowing that the tax authorities have access to the source code of the application, will reduce the effort to implement hidden functionality in the software.'"

Cracking down on cash...

[Duncan J Murray]

These are the requirements from the article:

Suppliers must be able to prove that the system can integrate with external software that allows changing the online journal.
It shall not be possible to change the entries in retrospect or change preset text on goods and services at registration.
It shall not be possible to record sales without a receipt is printed.
It shall not be possible to drive out more than one copy of the receipt.
It shall not be possible to mark some groups so that they are included in the reports.

I can't remember who told me when I was much younger how to spot the people running cash businesses and not declaring all their tax - they wouldn't be able to get the mortgage for an expensive house, but the inside would be overly luxuriously appointed, and they'd often have a flash car bought outright.

Like the Nevada rules for slot machines

[Animats]

Nevada has rules like that for slot machines. [nv.gov] Only tougher. Stuff like:

Provide a mechanism for keeping a record, in a form approved by the chairman, anytime a control program component is added, removed, or altered on any alterable media. The record must contain a minimum of the last 10 modifications to the media and each record must contain the date and time of the action, identification of the component affected, the reason for the modification and any pertinent authentication information.

Provide, as a minimum, a two-stage mechanism for verifying all program components on demand via a communication port and protocol approved by the chairman. The mechanism must employ a hashing algorithm which produces a messages digest output of a least 128 bits and must be designed to accept a user selected authentication key or seed to be used as part of the mechanism (i.e. HMAC SHA-1). The first stage of this mechanism must allow for verification of all control components. The second stage must allow for the verification of all program components, including graphics and data components in a maximum of 20 minutes. The mechanism for extracting the verification information must be stored on a Conventional ROM Device. [Effective 11/1/2012] All gaming devices must also provide the same two-stage mechanism for verifying all program components on demand via a gaming device user interface where the results are displayed on the gaming device.

That's just one item. There are lots of other logging and audit trail requirements. The Nevada Gaming Commission checks these regularly.

Allready done in Sweden

[Kottie]

Since a few years back all bussines are demanded to have a "black box" connected to the register that tracks all events. Tax authorities can come in any time and download the content to check for any irregularities. It logs everything including how many times and how often the drawer is opened.

Re:Cracking down on cash...

[Anonymous Coward]

Some Euro countries already use registers like this. The ones we sell and manage are basically small Linux boards bolted to various printers with memory card for sales journal files(signed to detect tampering), Eprom for company/store identification and daily sales/tax reports and various communication and peripheral ports.
The register prints one original receipt - marked with small graphical logo. You can print as many copies as you want but they will be marked as such and lack the logo. For tax purposes you can use only the original receipt.

Re:They seem to have missed the point

[pipatron]

There's nothing in the article about FOSS. There's not even anything about "open source", just that the tax agency should have access to the source code.

Similar in Portugal

[danielmatos]

In Portugal, for the last couple of years it is already required for every business to have a "certified" software that enforce some similar rules. Even though the software doesn't need to be open source, every invoice or receipt must include part of an hash key that is automatically generated based on key data (VAT Nr, amount, date, value), an asymmetric key given to each software manufacturer *and* the hash from the previous document. This makes it impossible to change any document after it has been printed out without invalidating every document printed after it. There was a requirement that every software had to be able to export accounting details in a standard format (SAF-T), if requested from the tax authority. Since 1-Jan-2013 every business is now forced to send monthly detailed invoce data to the tax authority.

Crazy taxes

[roman_mir]

Norway and the rest of the countries engaged in taxing people's income only distort the market, forcing people to figure out ways to avoid paying income taxes rather than concentrating on their business, actually improving the economy by doing the best they can.

I build and supply store management, supply chain management systems, POS is just one part of the chain, there are many many different ways that businesses can use to reduce their tax burden. You don't know it, but basically no small retailer would survive in the tax structures that are set up in a way that favour large monopolies and basically destroy small retailers. In business where a few percentage points either make or break your entire model, being able to reduce taxes can be the difference between staying open and shutting down.

Re:Of course, It begs the question...

[Anonymous Coward]

I was an auditor for a state in the USA (posting anon). This is widely known among auditors. The hard part is proving that the place did that.

The state has in the past (at least talk at the legislative level) talked about outlawing software with this feature, but the business burrow makes excuses, like for instance I think I heard these type of "features" are required for discounts, coupon type things, if someone isn't satisfied and get's a free meal, etc.

I think it's a bunch of BS since the software does these things quietly without making an audit trail, but nothing ever happened past the initial talks that I'm aware of.

And even if it did, you could say oh it was a 15% off day or some crap, so you could still hide it unless you could prove it wasn't.

I worked in banking previously, and it was widely known that business's hide money. See small business's want it both ways. They bring their tax info to the Bank for loan or w/e then the bank denies or less then they wanted or unfavorable terms, and some people actually say well I actually make more then this. Our loan officer used to joke about it during training. You can't have it both ways.

There are many things working in Auditing I've learned about. Some is very creative and some is just very simple.

Re:Just releasing the source may not fix it

[aurispector]

You don't need a crooked accountant. Just don't ring up cash sales and you're good to go, then write off the missing merchandise as shrink.

All these tactics are characteristic of being on the wrong side of the Laffer curve. To quote Princess Leia: "The more you tighten your grip, the more star systems slip through your fingers".

Pro Tip - if you have to resort to draconian measure to collect taxes you're probably taxing people too much.

Spending reductions are the first and best measure - tax revenues go UP when rates go down.