Go on, feast your eyes on... HMRC's backend: 4,000 IT staff, its hookup with AWS and more

The British tax man loves the cloud, but anyone who thinks public infrastructure can be run by a skeleton crew should think again: HMRC has no fewer than 4,000 IT staff who deliver around 140 digital services. ... people were really reluctant to do on-call because of the problems we had The government agency is also a big …

[Anonymous Coward]

Using AWS?

Suddenly you get a message

"We notice that you have just filed your Tax Return and that you are due a refund of £123.46. From your recent browsing history may we suggest that you spend that money on ..."

Sorry, HMRC. Putting our Tax records out on AWS is just asking for a hack of mega proportions apart from the inevitable leaks into the Amazon data store which already knows more about us than we can remember.

[Anonymous Coward]

If they are so good

Why can't they knock an in-house web interface to MTD ?

Or is some high-up at HMRC on commissIon from a third party software vendor ?

[alain williams]

Why have HMRC given my tax records to the USA government ?

If all that data is held by Amazon, a USA company subject to USA laws, then how long before the NSA/CIA/... issues them with a National security letter demanding a slurp of all UK tax data.

How can they be so stupid ? Or don't they care ?

All this brouhaha about Huawei and we just give it to the USA!!!

[phuzz]

Re: Why have HMRC given my tax records to the USA government ?

"Amazon, a USA company"

Funny, all the money I pay them seems to go to Amazon Sarl in Luxembourg.

[PDurrant]

Re: Why have HMRC given my tax records to the USA government ?

really !!!! , i'm sure someone would have chosen the correct availability zones , GDPR and all that

eu-central-1 EU (Frankfurt)

eu-west-1 EU (Ireland)

eu-west-2 EU (London)

eu-west-3 EU (Paris)

eu-north-1 EU (Stockholm)

[Anonymous Coward]

Re: Why have HMRC given my tax records to the USA government ?

Don't need to be on US soil for the US law to apply, America, world police remember. The law applies to American companies and all subsidiaries. If they want data held in a British data center they are legally required to give it. But they are also legally required not to due to the local law where the data center is located. They have 2 conflicting laws. They have to fight in both countries, will lose in both countries and then will need to pick the one that will have the least repercussions for them. Which will probably be obay American law.

That is if they even say the data has been requested.

[phuzz]

Re: Why have HMRC given my tax records to the USA government ?

Theoretically local laws apply, for example there's the case of a certain large US based email provider who had a data centre in Ireland, and refused to hand over emails from that data centre to the US government, and went to court for years to deny them.

Mind you, not every company can be as principled as Microsoft ;)

[stiine]

Re: Why have HMRC given my tax records to the USA government ?

I bet that was hard to type.

[Anonymous Coward]

In other words

"because it's easy money for people"

The newly qualified PFY will probably not receive a payment for being "on-call" then. Given my knowledge of how HMRC considers payments to staff.

AC to protect the source.

[Crisp]

Why is HMRC employing a company that doesn't pay its taxes?

Is this another one of those things discussed over lunch with a high up HMRC tax inspector?

[BebopWeBop]

Re: Why is HMRC employing a company that doesn't pay its taxes?

Well he needs somewhere to go when he retires. NOT A —————>

[Anonymous Coward]

4000 IT people? WTF...

Considering the PAYE-RTI crap that was thrown at us a few years ago, and the current Making Tax Difficult debacle which seems to be aimed at fecking over small businesses with their own systems, I have to wonder what those 4000 staff actually do? From the above two projects, I think the PFY is in charge and the rest just sit around having tea breaks.

And loading it all onto Amazon servers? Seriously? It's not like Amazon are known to be a tax friendly company or anything - yet the taxman throws our money at them to ship abroad into offshore bank accounts? Someone's head needs to roll. Even if they had costed it and said "it will cost thrice as much to have this in house as it does to have it on a cloudy server" then it would still be better in house.

[Tom 7]

Re: 4000 IT people? WTF...

That's around 30 people per project. So that's 2 programmers, 10 people to defend them from the 18 MBA when they get back from a long lunch with AWS.

[AJ MacLeod]

Re: PAYE-RTI

I'm not sure it required 4000 people to write it, but I have been consistently impressed with the PAYE-RTI software HMRC provide for small businesses. It's straightforward to use, has been very reliable and most importantly is decently cross-platform, including support for Linux. Tax money well spent for once, IMO.

[Doctor Syntax]

"I'd like to say that none of our server images are older than seven days"

Never mind, you'll probably get them right eventually.

[Anonymous Coward]

Contractors

I hope none of those IT staff are Contractors after all the crap with IR35. I also hope none of them are offshore with all the data leakage that happens, in addition to the copy the US Government already has.

[Androgynous Cupboard]

Re: Contractors

I''m sure many of them are. Dutifully paying their tax under IR35, and charging the corresponding 25% premium.

[colinb]

pathetic

Try using the employers PRSI pages.

- List of months and amounts shown

- click 1999 era radio button on month you need to pay

- Submit

- New form displayed black with none of the relevant information, you key it all in manually.

Class

Their motto seems to be "its not our problem, its yours"

[s. pam]

And the Smart PFY.....

Will do their apprenticeship and piss off to pastures anew and far greener.

[macjules]

4000 IT staff?

How many of them know how to restart a computer?

[TDog]

I'd like to say that none of our server images are older than seven days,

Why? The rules don't change that frequently. Is this a tacit admission that they keep getting it wrong or simply change for changes sake? I'm not sure I understand this; I am bloody well sure that they don't.

[mmd93ee]

Re: I'd like to say that none of our server images are older than seven days,

It saves having to manage each servers patch level explicitly, if I can be assured that the last time I ran ‘apt-get’ was no longer than 7 days ago then I can be fairly confident I am running current levels of OS software... dependency libraries in the software require more digging into the release process but as a statement it points to having a reasonable level of confidence in having up to date operating systems.

[stiine]

Re: I'd like to say that none of our server images are older than seven days,

No, it might mean that they crash every 7 days because someone coded a week beginning with day 0 and someone else coded a week ending on day 7.

[Roland6]

Re: I'd like to say that none of our server images are older than seven days,

> if I can be assured that the last time I ran ‘apt-get’ was no longer than 7 days ago then I can be fairly confident I am running current levels of OS software...

Surely, apt-get only rebuilds a server if something has changed? Which given MS, mostly only releases patches once a month and others at a lower frequency, would seem to indicate either HMRC think a weekly rebuild provides some form of security protection or the servers are full of faults.

Additionally, if you have the systems in place to completely reprovision/refresh your IT infrastructure every 7 days, you've probably also got in place the infrastructure to automatically manage versioning...

[TDog]

Re: I'd like to say that none of our server images are older than seven days,

I still don't really understand it. As I see it there are 2 obvious possibilities with regard to the server:

1 - This is mission critical; and yet you are allowing it to run unfixed (on average) for 3 1/2 days.

2 - It is not mission critical, but you still use an arbitrary date system for "OK" which apparently could be met by simply rebooting the server.

And, not to make too fine a point of it, if you spin up another version of the same thing, then it is the same thing. (Unless you claim it isn't to meet your bullshit targets).

[Anonymous Coward]

Reduction in resilience

"All the workloads are spread across three AWS availability zones in the UK – which means three different data centres in London."

Given when IT was in house, HMRC had about a dozen datacentres distributed around the country, it would seem that HMRC through cloud in the form of AWS have increased the risks of service outage.

[Riddler]

AWS appear to work on US dates

HMRC sent out self assessment late bills for those tax payers who completed them on the 2nd January 2019.

This was reported as not happening initially and eventually blamed on manual error by HMRC.

The date 02/01/19 equates to 1st February 2019 when the server region date is left to the default US region.

If this type of error is never correctly diagnosed and reported on, then what will happen when something bigger occurs?

[Luke 11]

Taxing

Let me get this right. Amazon, who on a whole seem to pay next to nothing in tax and are constantly criticised for their culture and the way it apparently treats the workers has been awarded a not insignificant contract by HMRC?

It sounds like HMRC probably pau more than Amazon pays in tax! But that detail won't be released as it's like considered sensitive commercial information.

[Anonymous Coward]

Misunderstanding microservices at scale

"It operates on a 'typical microservices architecture' with 850 microservices in production, all of them stateless..."

Ah, so it operates on the typical misunderstanding about microservices and data then, rather than the actual microservices pattern that has each service owning its own database.