The new Russian track & trace system (Chestny ZNAK) launched in March 2019 is probably the most comprehensive system of control of the movement of goods established by any tax authority in the world.
It all started with some stamps on liquor (EGAIS). Subsequently, there was the introduction of Cash Register Equipment (CRE) and the pilot making RFID chip tagging of fur items mandatory.
Chestny ZNAK is already mandatory for tobacco,
fur, footwear and some medications. Pilots for dairy, wheelchairs, bicycles,
photo cameras, tyres, garment and perfumes are carried out or starting next
month. According to the tax authorities, by 2024, the system will cover all
How does it
product manufactured or imported to Russia, there has to be assigned a unique digital
code and placed on the packaging. With the help of this code Chestny ZNAK
records the transfer of goods, when goods are stored or placed on the shelf and when items are sold via an
online cash register. There is even an end consumer app that allows scanning
the purchased product.
way, Chestny ZNAK makes
it possible to trace the entire journey of the product.
Italy are also planning to introduce online cash registers.
First, tax authorities are probably already collecting a lot more data than they tell us and than we think.
After the hack in Bulgaria 57 databases with 10.7 GB of data were shared in a forum. The hacker claimer that 110 databases with nearly 21 GB were stolen. The data contains names, personal identification numbers, home addresses, financial earnings, debt information, health and pension payments and so on of 5 million Bulgarians (out of 7 million, i.e. just about every working adult) ranging from 2007 to June 2019. The data also contains information imported to the tax authority’s systems from many other government agencies such as customs agency (BECIS system), Department Civil Registration and Administrative Services (GRAO), National Health Insurance Fund (NZOK) and Bulgarian Employment agency (AZ). But most interestingly, officials said that this is only 3% of the data they have!
Second, the authorities don’t seem to have understood the real value / damage potential of this data yet and fail to secure it accordingly.
The hacker seemed to use SQL injection to gain access to the databases through a rarely used VAT refund service for transactions abroad. This VAT refund service was implemented in 2012, but not updated since. Since SQL injection is no rocket science, this leaves the impression of poorly secured and protected data. Since 2002, the Bulgarian government has spent estimated more than $1 billion (about 2 billion BGN) on e-government projects. At the same time, a 2018 annual report on the state of national security already indicated a very low level of cybersecurity insufficient to counter modern challenges, but obviously no adequate action was taken.