The Australian Taxation Office is looking for a tool that could allow its agents to go undercover on social media and on the dark web to spy on potential tax cheats and cyber criminals selling stolen data.
The ATO called for tenders, encouraging businesses to submit their proposals for an "open source intelligence tool", or OSInt, that would help the tax office quickly and effectively scan the internet and look for information and "persons of interest".
An open source intelligence tool would be a program or product that could scrape social media and the dark web — a job that is currently done by the agency's investigative teams.
In its tender documents the tax office said it was looking to bolster its capabilities when it came to hunting down potential criminals.
“The tool(s) must address the big data challenges facing us through an ability to detect, intercept, and respond to various and evolving threats, using integrated technology to complete advanced targeted digital data collection across multiple platforms such as Facebook, Instagram, Twitter, Telegram, Gab, Reddit, 4chan, 8kun, VK, Discord,” it said.
“Capability to collect information across and extensive list of dark web forums and marketplaces is also required.
“This will provide the ATO … with an essential capability and allow us to be at the forefront of detecting, intercepting, and disrupting serious financial crime which is increasingly being exploited by criminals.”
The ATO said any tool would have to allow its investigators to “fully blend in” with site traffic while performing searches, and the ability to geo-locate “persons of interest”.
University of Western Australia cybersecurity expert Dr David Glance said OSInts were a good way to automate labour intensive work usually done by tax agents.
"This would be in order to get information about individuals or companies that make claims in their taxes but are living a lavish lifestyle — pictures of expensive cars, holidays, houses," he said.
"Individuals working for the ATO could do this manually by creating … fake accounts and going onto each platform and searching for the individual under their name or aliases.
"But this is labour intensive and there is a risk of alerting the individual to too much poking around."
Dr Glance said an OSInt tool could automate the process and then be passed on to intelligence officers.
"This is easier said than done and for this to work properly it would need to be pretty sophisticated," he said.
Why should we care?
Ex-commissioner Chris Jordan told the National Press Club in December last year cyber security at the ATO "kept him up at night".
He said the organisation had repelled almost 18 million cyber attacks in the six months, which was concerning for an agency that had an “equivalent of one billion tall filing cabinets” worth of Australian taxpayers’ data.
Mr Jordan detailed one instance when hackers used stolen data to set up new accounts.
"There was a situation recently where 30,000 new superfunds were created in a very short period of time and using information from the dark web," Mr Jordan said.
"The curious bit of this was they were using bots … it’s an automated way of filling out a form, as the criminals couldn't fill out the forms to create super funds quick enough.
"This is scary stuff, right? These are the things that we really have to keep on top of."
University of Melbourne Academic Centre of Cyber Security Excellence's Dr Toby Murray said the tender indicated the ATO was also taking escalations in cyber attacks in Australia seriously.
"When personal information is stolen it is often published on so-called 'deep' or 'dark' web sites, where it is sold or traded between criminals," he said.
"So criminals using information obtained from the dark web — for example, information that was stolen in a data breach and then published on the dark web — to commit tax fraud is certainly something that the ATO would be worried about."
Dr Murray pointed to the 2022 Medibank data leak, which saw the data of millions of customers posted on the dark web.
Statistics from the Office of the Australian Information Commissioner published last month show there has been a 19 per cent rise in data breaches, from 485 between July and December 2023 to 527 between January and June 2024.
It also found cyber attacks on the Australian government made up 12 per cent of all data breaches.
Scouring the dark web
Experts said the ATO could be interested in a tool that could access the dark web for a number of reasons.
Dr Murray said OSInt technology could help identify cyber threats before they could attack the agency.
"Increasingly government agencies who are investigating fraud and other criminal activity are turning their attention to the dark web to aid their investigations," he said.
"They have realised that the dark web provides a valuable source of intelligence to aid investigations."
Dr Glance said while OSInt could be used for cybersecurity processes, it was also likely the ATO would use the tool to complete surveillance on hidden corners of the internet.
"The ATO [could] be looking for individuals and companies who are active on the dark web — as in they are conducting business of some kind — for example, selling drugs, arms or contraband," he said.
"Government agencies will use intelligence of all kinds in their fight against fraud and criminal activities.
"There are free and open source versions of [OSInt] but the ATO is looking for a turn-key system that suits their needs."
A spokesperson for the Australian Taxation Office said the authority could not provide further information until the successful contractor was awarded.
"As per the statement of requirement released on AusTender, the ATO is seeking this tool to address ‘big data’ challenges through an ability to detect, intercept, and respond to various and evolving threats," they said.
"The ATO introduced OSInt tools in 2023, to better understand active and anticipated threats, enable advanced search and efficiencies in the collection and analysis of publicly available information.
"This has allowed the ATO to take proactive steps to protect Commonwealth revenue and the integrity of the superannuation and taxation systems.
"This allows the ATO to further disrupt serious financial crime."
