The decision sends KRA investigators back to the drawing board since Google Inc, which is the custodian of the gmail account used to hack the taxman’s system, is domiciled in the United States.
The judgment underlines the difficulty that governments all over the world are facing in their dealings with US digital conglomerates like Google and Facebook
The email address [email protected] was used to access the KRA's computer system and performed a task of an authorised officer.
The Kenya Revenue Authority (KRA) has lost its bid to compel Internet giant Google to disclose the identity of a hacker who breached its computer system, leading to loss of crucial information.
High Court judge Pauline Nyamweya yesterday declared the order that the KRA obtained from a magistrate’s court in January as irrational, noting that Google Kenya is a separate legal entity from Google Inc, the firm that the taxman had listed as the respondent in the case.
The decision sends KRA investigators back to the drawing board since Google Inc, which is the custodian of the gmail account used to hack the taxman’s system, is domiciled in the United States.
“It is thus evident that while the respondent in the said application was Google Inc., the orders sought against the respondent were instead issued against the applicant (Google Kenya). To this extent the order issued on January 9, 2018 cannot be explained by the facts and law,” Justice Nyamweya said, as she directed the KRA to pay the legal cost Google Kenya had incurred.
The judgment underlines the difficulty that governments all over the world are facing in their dealings with US digital conglomerates like Google and Facebook – including the computation of their tax obligations.
A 28-year-old man, Alex Mutungi Mutuku, and 11 others were in March last year arraigned in court for hacking and causing the KRA a loss of Sh3.9 billion but it was not clear whether the case is connected with the documents sought.
In Mr Mutuku’s case, prosecutors claimed that the hackers had used high tech equipment and software to steal from the KRA and that the police had managed to track the syndicate after it allegedly siphoned about Sh4 billion.
Mr Mutuku was charged alongside Calvin Otieno Ogalo, Albert Komen Kipkechem, David Ndung’u Wambugu, Lucy Katilo Wamwandu, Edward Kiprop Langat, Kenneth Opege Riaga, Omar Ibrahim, James Mwaniki Gakung’u, Gilbert Kiptala Kipkechem and Joseph Kirai Mwangi. They denied the charges.
The hacking is said to have happened between March 2015 and March 2017.
The Assets Recovery Agency (ARA) obtained court orders freezing the accounts of individuals charged with stealing the Sh3.9 billion from the KRA.
The taxman has not indicated in court documents whether the case is linked to the hacking at the centre of its feud with Google.
The dispute arose when investigating officer Mohammed Jillo attached to the Directorate of Criminal Investigations unit sought a warrant to investigate Google Kenya. The magistrate’s court granted the request on January 9.
Mr Jillo alleged that the email address [email protected] was used to access the KRA's computer system and performed a task of an authorised officer, hence infringing on the information security of the agency.
He told the magistrate's court that the KRA’s information security was at stake because of the unauthorised access to its systems while seeking the warrant to investigate the said gmail account.
Everything was going well for investigators until Google Kenya informed them that it acts as a separate legal entity that merely handles marketing and sales and could therefore not accept service of court orders on behalf of Google Inc.
The investigation wanted to check information and documents relating to the gmail account used to hack the system in order to get the face behind the hacking.
Justice Nyamweya in her ruling noted that the magistrate acted within the law to issue the orders compelling production of the documents but noted that it was defective since once Google Kenya has proved that it is separate entity from Google Inc.
Case documents before the magistrate's court show that the investigating officer had named parties in the case as KRA DCI unit Vs Google Inc/Google Kenya.
Google Kenya moved to the High Court to challenge the order, arguing that the investigating officers needed to specify who between Google Inc and Google Kenya was the target of their probe.
The KRA, for its part, asked the court to dismiss the suit, arguing that High Court is not the appropriate forum for Google to challenge the orders of the magistrate’s court that allowed the taxman to demand access to details of the Gmail account.
PAYE Tax Calculator
Note: The results are not exact but very close to the actual.
