Inland Revenue rejects PKI technology

The Inland Revenue has postponed plans to use public key infrastructure (PKI) to protect the privacy of online tax returns, because not enough businesses can handle the technology.

Computing has learned that the government service, available to business users from April, will rely instead on a user ID and password system, despite the concerns of business leaders and security experts.

PKI software uses digital certificates to authenticate users and transactions over the internet. The alternative password/ID system cannot be relied on, according to the Confederation of British Industry (CBI).

"Passwords are not secure. The technology for e-certificates and e-signatures does exist, and UK companies are manufacturing and using the technology. We need PKI. With a simple password, integrity is at stake," said CBI head of business Nigel Hickson.

Dennis Keeling, chief executive of the Business and Accounting Software Developers' Association, said that problems with standards and interoperability were holding back PKI in many projects related to the Government Gateway portal.

"The Inland Revenue is anxious to move to digital signatures as soon as software developers and the companies sending the data are happy to move to it. If there was an overwhelming requirement to use it, then the Inland Revenue would be happy to plug into it," he said.

The other services made possible by the Gateway which do use digital certificates include VAT returns from HM Customs & Excise, and applications for agricultural aid from the Ministry of Agriculture, Fisheries and Food.

The Inland Revenue was unavailable for comment.