DREAM / The Prime Minister resigns and wakes up under the Parisian bridge!

 Kliko këtu për të tjera
Voxpress:

Electronic certificate for fiscalization of businesses, will the data be safe?

2022-09-01 12:02:50Biznes SHKRUAR NGA REDAKSIA VOX

Electronic certificate for fiscalization of businesses, will the data be safe?

At the last meeting, the government approved a decision according to which "Provision of public key infrastructure (PKI) services" will be granted with a Public-Private Partnership type concession.

The concession is aimed at the production of electronic certificates for fiscalization of businesses, which is currently administered by ANA has raised concerns about data security.

Accountants are concerned that the administration of sensitive data by a private individual would compromise data security at a time when the public system is also suffering from cyber attacks. The National Information Society Agency (AKSHI) was attacked recently, paralyzing the state's online operation, while it is not yet known what data may have fallen into the hands of the hackers. During the last two years, at least three databases with confidential data on citizens have been leaked.

The annual cost of entities to be equipped with the electronic certificate is 4,000 ALL. According to the current procedure, the electronic certificate is generated by the National Agency of the Information Society (AKSHI).

Meanwhile, in the draft budget of 2022, the list of 7 new concessions included the PPP concession "For the provision of PKI public key infrastructure service" worth 208.8 million ALL.

AKSHI is the one that currently develops, administers, maintains the infrastructure of the Public Key (PKI) and manages the electronic certificates. The concession contract is planned for 2022, but there are still no details about its object.

The legal auditor Sokol Toska has previously stated for Monitor that despite the fact that the electronic certificate is produced by the state authorities, the security protocol has been broken, since the electronic key (electronic certificate) must be generated only by the businesses' computer.

He affirmed that if this service, as it is being realized now, will be transferred to another private party with the same principle, the security of the production will deteriorate, since we will have another party that has the public keys. Toska says that the electronic key should remain only with the user and not be shared with third parties.

"To achieve the security protocol the electronic key must be generated only by its user. When the electronic key is generated, two components are generated: private and public. The private key must be known and kept only by the user of the key. In the case of fiscalization, we are dealing with a procedure where AKSHI generates account keys for others and sends it by e-mail. First, we have the NSA that holds the user's private key. Second, we are dealing with an electronic key distribution at very low security levels, such as email.

In addition, to use the invoice platform, uploading the key produced by AKSHI is required. Even in this case, we are dealing with a breach of the security protocol, as the private key is declared to the tax department. The subject's private key is also available from AKSHI and the General Tax Directorate. In other words, this is a similar situation as if the stamp and tax blocks of the business were available to the tax administration. At the end of the month, if the subject receives an invoice issued by the tax administration, the subject cannot prove that this invoice was not issued by him, because it contains the electronic seal of the business. Under no circumstances can the private key be made public, as the entire security process is compromised. So not only can the business be damaged, but at another moment the subjects themselves may dispute the invoices, saying that they were not issued by him, but may have been issued by another party who has his private key", underlines Mr. Tosca.

According to him, this is a security problem that must be solved, since the business itself generated the electronic keys from its computer and via the e-Albania platform sent the public key to ANKSI, which it confirmed and then the procedure followed.

The legal auditor Sokol Toska recommends that it is necessary to change the fee for the electronic certificate device for businesses. "The annual fee of 4,000 lek was imposed years ago when the keys were provided by a USB hard drive. It was the cost of the vines that affected the rate determined. Currently, the production of the key is an electronic product that has no material cost, but the price has remained unchanged. The price should be reduced, the certificate should be refreshed more often and the security protocol of its production should change", adds Mr. Tosca.

In total, according to DPT data for "Monitor", from January 1, 2021 to May 18, 2022, 70% of all active businesses have been taxed. From the total of 118,953 active businesses according to tax data, 83,202 of them were fiscalized until May.


Në përputhje me standarded JTI

Video

SHIKO KANALIN NE YOUTUBE
×