As the euro teeters on the brink of collapse, and the global economy faces unprecedented severe weather warnings, recovering unpaid tax is a higher priority than ever for countries feeling the financial pain.
Here in the UK, the government has earmarked additional funding to ensure that no stone is left unturned in its determination to stamp out tax evasion and avoidance. Recent estimates from HMRC (Sept 2011) suggest that the Tax Gap – that is, the difference between tax collected compared with that owed – could be around £35 billion: a serious figure at the best of times, let alone in a period of severe financial austerity.
The USA is also closing the net on the billions of dollars that the IRS believes to be held in offshore accounts, as shown in recent talks between the US and Switzerland over a possible tax treaty.
One of the most valuable assets sought by the tax authorities, however, is data. International agreements are increasingly focused on disclosure of information as a means of recovering past unpaid taxes, encouraging future compliance and deterring would-be evaders from hiding their money in the first place on the basis “be sure your sins will find you out.”
Resistance has been strong – the recent deals agreed between the UK and Switzerland, as well as between Germany and Switzerland, enable individuals to retain anonymity, but at the cost of a large one-off payment to cover past tax liabilities and a high annual withholding tax to settle on-going tax due. Clients who opt out of this withholding will, generally, have their details revealed to HMRC.
This has raised more than a few hackles within the European Commission, which regards such deals as going against its rules on data disclosure
However, in a bid to get the information they need, the authorities are increasingly targeting individual banks directly, rather than relying on blanket international agreements. The USA in particular is bringing criminal charges against banks which assist US citizens with tax evasion levying large fines and requiring the banks to reveal details of their clients.
Now that major banks have agreed to hand over client details, we are likely to see an acceleration in information sharing. The Swiss/UK Agreement imposes obligations on institutions to ensure their clients are tax compliant and in some circumstances enables information to be passed to the authorities.
Tax amnesties have also proved a valuable tool for tax authorities in the past, with measures such as Lichtenstein Disclosure Facility (LDF) encouraging non-compliant individuals to confess their sins – and pay back taxes and interest, but with reduced penalties.
Many countries are introducing legislation with extraterritorial effect which seeks to impose reporting requirements on individuals and institutions so the authorities can make sure that account holders are paying the tax they owe – on pain of severe financial penalties for non-compliance. The most high profile example is the USA’s Foreign Account Tax Compliance Act (FATCA).
Other countries like Israel and France are imposing onerous reporting requirements on individuals with offshore funds, and the UK is also issuing tax returns to offshore trustees.
The effect of these measures is that people who fail to pay the taxes they owe are increasingly left with nowhere to hide. Even if the governments of tax havens are prepared to protect individuals, the banks themselves may be unable to escape investigation – or prevent information being stolen and leaked by an employee, as has happened recently.
Tension between the authorities and tax evaders is an age-old feud, but the storm currently brewing in the global financial markets is set to intensify the situation, with the stakes much higher on both sides.
You know how the Internet works, right? Of course you do: you’re a TechCrunch reader, a power user. You know what that “HTTP” means in your address bar (if you’re not using Chrome.) You know that behind the scenes, the Domain Name System translates your requests for domain names like techcrunch.com to numeric addresses like 76.74.254.121, and secure connections are encrypted by SSL. You know that web servers send HTML, the lingua franca of the Web, over the wires (or the air) to your computer, and that web developers write JavaScript to control what your browser does with it.
…Unless you’re actually a techie. In which case you probably already know that the above description — let’s call it the Classic Web — is increasingly completely false.
What follows is a little technical, but bear with me, I have a larger point. (Also, even if you’re not a techie yourself, you need to have some understanding of what today’s tech does, and how it does it, in order to make intelligent decisions.)
Why doesn’t Chrome show the iconic “http://” before web addresses any more? Because it, like Amazon’s Silk and soon Firefox, doesn’t necessarily use HTTP any more. Instead, where possible they use Google’s far-faster replacement, SPDY, which also lets servers push data to browsers, instead of having to wait for requests.
That Domain Name System? It’s increasingly actually DNSSEC, an extension which guards against the massive security holes in the original system.
And your so-called secure connections? Well, SSL was actually replaced by TLS some time ago, which fixed some security holes, but not the biggest: browsers automatically accept security certificates for any site from literally hundreds of different authorities, any of which can be, and often are, compromised. Yes, this is insane. The EFF’s Sovereign Keys initiative might eventually solve the problem; in the interim, Chrome is more secure than other browsers, because it lets site owners specify which certificates are OK.
(Do I sound like I’m telling you to use Chrome? Not exactly. I mostly use Firefox, because Chrome doesn’t support any equivalent of Firefox’s security- and sanity-enhancing NoScript plugin, and probably never will.)
As for JavaScript — sure, all browsers run it, but almost no developer writes pure JavaScript any more. Instead we use library frameworks like jQuery, which has more or less conquered the world, or use higher-level languages like CoffeeScript (which I dislike, for these among other reasons) or even Google’s contentious new language Dart, which both compiles to and is ultimately intended to replace JavaScript. Unfortunately, almost no one outside of Google seems to like it.
In Google’s defense, their new server-side language Go is widely admired — even though, ironically, it signally fails the “The name of your language makes it impossible to find on Google” test — and their Native Client tech is powerful and interesting. Alas, I can’t see any other browser supporting it anytime soon.
But at the end of the day, your browser is still mostly getting and rendering HTML, right? Don’t be so sure. For one thing, “vanilla” HTML is a smaller and smaller part of the average web page. For another, it’s increasingly HTML5, whatever that means.
What’s more, there’s an interesting trend towards web servers that serve no HTML at all. Battlefield 3′s “Battlelog” web site is pure JSON between client and server. My former co-worker Michael Dykman (whose co-workers generally, without provocation, suffixed his name with “the greatest programmer who ever lived”) has developed a pure XML/XSLT web framework, Gossamer: as its introductory rant says, “wouldn’t it be nice if we could handle page requests from web browsers with the same simple elegance the web service model provides?“
The Classic Web is beginning to look like a kludge. Mostly because it was. Slowly, fitfully, three-steps-forward-two-steps-back, the tech community is finally refining it into something more secure, streamlined, and powerful. The last time something like this happened was when AJAX support hit modern browsers. Non-techies don’t realize it, but it was that innovation which ushered in Flickr, Google Maps, and the whole Web 2.0 boom. I expect HTML5 — greatly aided by the little-known back-end iterations I’ve tried to itemize above — to have a similar effect on the web and everything we do there.
Including, maybe, the much-foretold, long-forestalled decline and fall of the Empires of Apps. But more on that in next week’s column…
Points clarified by commenters below: OK, so there’s no real evidence that the removal of HTTP from Chrome’s address bar is actually related to its use of SPDY. “No HTML at all” up above is too extreme: “no dynamically generated HTML” would be better, as the very first pageload still has to be HTML.
Points clarified by me: People can and do argue at some length about the semantic distinction between ‘pure’ and ‘vanilla’ JavaScript, but I maintain — with considerable confidence — that JS written with jQuery is qualitatively different in content and approach than ‘pure/vanilla’ JS. Last I checked, Chrome’s NotScript wasn’t a substitute for Firefox’s NoScript, as it worked by merely masking rather than stripping out JS on a site-by-site basis: alas, I can’t find a detailed technical analysis that compares the inner workings of the current versions.
Image credit: QbiT, Flickr.
All mainly recognised superior states are on this list. Territories that are not intrinsic, such as dependent territories, are listed one by one internet dąbrowa górnicza (in italics) or esteemed as included.