Security News > 2022 > January > Court papers indicate text messages from HMRC's 60886 number could snoop on Brit taxpayers' locations

Court documents obtained by The Register show that the secret surveillance capability was baked into otherwise mundane bulk SMS sending carried out by MMGRP Ltd. The tax collection agency, which has the power to retrospectively change laws, had been using SMS reminder messages as an enforcement tool.

We asked HMRC for comment, posing a series of questions including how long had it used HLR look-up techniques against taxpayers; did HMRC obtain necessary warrants to carry out HLR lookups and, if so, under what legislation and from which courts; how many times it had used this technique; under what circumstances it was deployed; and is the capability present in a contract with its new supplier.

The since-settled lawsuit over an alleged breach of public procurement laws was filed by the company which operated HMRC's former 60886 SMS sender number and brought the HMRC surveillance powers to light.

Describing the contract outlined in the lawsuit as "Slightly odd", Professor Alan Woodward, the University of Surrey-based compsci expert, told The Register: "I can see how this might be required if HMRC must later prove that a letter was received and read in a specific jurisdiction. Someone they are taking to court might claim they never received it or that it had no effect where they were when they were served with some form of formal notice."

HMRC leaned heavily on the SMS provider for those short-duration extensions, raising the spectre of "Reputational damage to HMRC, to outer [sic] Government Departments who utilise the service and ultimately to [MMG] as a provider" if the company didn't agree.

Ultimately the service was awarded to rival business IMImobile after lots of short-term extensions with MMGRP. MMRGP owns the old HMRC 60886 SMS shortcode, which is why taxpayers are no longer advised to look out for messages from that number.

News URL

https://go.theregister.com/feed/www.theregister.com/2022/01/27/hmrc_ss7_hlr_lookups/