“Registration of a sole proprietorship without a person’s consent”: experts sound the alarm over the security of Diia
16 December 15:58
The story of a Ukrainian woman’s alleged forced registration as a sole proprietor through the Diia app without her consent is gaining traction in Ukraine, resulting in a significant tax debt accumulated over several months. This case sparked a public debate about the security of digital public services, including the Diia app, and the limits of responsibility between the state and the user.
The city “registered” a woman as a sole proprietor without her knowledge
The Cherkasy District Administrative Court is considering a case in which a woman claims that she was registered as a sole proprietor through Diia without submitting any applications, and that the tax authorities then charged her debts.
The plaintiff demands that the entry in the Unified State Register, which registered her as a sole proprietor on March 14, 2023, be declared illegal. According to her, she did not use the service to register her business and did not give any consent.
The woman learned about her “entrepreneurial status” only after receiving court documents in the case of tax debt collection. Prior to that, as stated in the materials, she had not received any notifications from the tax office or other government agencies. As a result, she was charged more than UAH 38 thousand in single tax and another UAH 7200 in military duty.
It is noted that before the above court ruling was issued, the plaintiff had not received any decisions from the Main State Tax Service in Cherkasy region or other documents from which information about the registration of the sole proprietorship could be obtained.
The court decided to consider the case in a simplified manner without summoning the parties. The Ministry of Digital Transformation and SE Diia are obliged to file a response within 15 days, provide all documents related to the registration of the sole proprietorship, and explain who exactly and on what grounds took the relevant actions.
The ruling also states that if the defendants do not provide reasonable explanations, this may be regarded as a de facto recognition of the claim.
The case may be indicative of the risks of digital public services and mechanisms to protect citizens from false or unauthorized registrations.
Problems of digitalization
Cybersecurity expert Konstantin Korsun wrote publicly about the situation, calling it an example of a systemic digitalization problem.
According to Korsun, this is a case where a person learned about the registration of a sole proprietorship after the fact, after the tax liabilities had already been incurred. He adds that the victim was forced to go to court to challenge the consequences of actions he or she did not commit:
“The program registers a business on behalf of a person and drives them into debt. It’s not fiction or Black Mirror anymore, it’s reality.”
Korsun also draws attention to previous incidents of data leaks, including those attributed to hackers and criminal groups. According to him, in case of abuse, an average citizen is often left alone with the system.
The post also touches on the topic of personal data leaks and fraud. Korsun argues that if a complete set of personal information is obtained, attackers can use digital services for financial transactions on behalf of other people.
According to him, victims often spend years trying to prove their innocence, facing bureaucratic and legal barriers.
Coercion to digital services and lack of alternatives
The expert also criticizes the lack of alternative ways to obtain certain public services.
“There are several public services that cannot be obtained other than through Diia. This is actually coercion that requires a smartphone, the Internet, and digital skills that no one has systematically taught people,” Korsun writes.
In his opinion, combined with the scaling of digital solutions in sensitive areas, this creates additional risks to citizens’ rights.
The problem is not in the system, but in the data – economist’s opinion
At the same time , economist Andriy Novak in a commentary
“For any registration to take place, whether paper or electronic, it is necessary to have a complete package of personal data. If someone has all this data, they can register,” explains Novak.
According to him, if the data is incomplete, no system, including Diia, will miss the transaction:
“Whether in paper or electronic form, these are technical issues. And if there is some data missing, a system like Diia simply won’t miss it, and the registration will not take place. That is, if you have all the data necessary for registration, then, of course, you can commit such a criminal act.”
The economist emphasizes that user cyber hygiene remains a key security factor.
“The problem here is not in the system itself, but in the availability of personal data per person. Therefore, everyone just needs to be careful here. There are warnings to be careful with your e-mail, not to open data there to anyone,” Novak said.
Who is at risk and how to protect yourself
Experts agree on one thing: it is impossible to completely eliminate the risks. According to Korsun, it is difficult to predict who might become the next victim today, because we are talking about massive digital systems.
“Ordinary criminals also hack into Diia and take out huge loans from banks for the victims, and unfortunate people spend years going to authorities, banks, and cyberpolice, but cannot prove anything to anyone… There are already many examples, although most of them are hidden. Will this necessarily happen to everyone? It is unlikely. But here is the question: are you sure that you will be lucky? Because it is absolutely impossible to predict who will be the next victim: everyone is at risk, without exception,” he said.
Economic expert Novak added that there are a lot of such scams now, even entire companies that are extracting this data for the hundredth time through some fictitious promotions, offers that we will give you goods 10 times cheaper, and, relatively speaking, we need your data to send you your goods 10 times cheaper, and so on.
“And the person, without hesitation, provides all their data. And then the criminals use this data, including to register individual entrepreneurs, to conduct some financial transactions through this individual entrepreneur and then disappear. That is, everyone should be very careful about whom they provide their personal data to,” Novak emphasized.
At the same time, Korsun draws attention to the inequality in the protection of rights, when in some cases cases are resolved quickly, while in others people cannot prove their innocence for years.
Read us on Telegram: important topics – without censorship
