Originally published on Forbes.com.
Panic reigns in countless accounting firms across the nation as one of the top providers of tax software, CCH, a subsidiary of Wolters Kluwer, a Dutch company, has gone dark this week. Here is what they have to say about it.
On Monday, May 6, we started seeing technical anomalies in a number of our platforms and applications. We immediately started investigating and discovered the installation of malware. As a precaution, in parallel, we decided to take a broader range of platforms and applications offline.
What’s Up?
Here is how things look out in the trenches with a bowdlerized report from Andrea Carr, who continues to work on tax returns as she waits for her career as a twitter comic to take off.
“schedule maintenance” they are full of **** should say “we’ve been hit with a cyber attack which we didn’t think was possible and we’re in a complete ****storm because we have no idea how long it will take to fix this, and OMG, can someone send lots of caffeine and pizza to HQ”
As I write this on May 9, I don’t know whether they are totally back up again or not, although I did get a report that they came back online yesterday afternoon.
If you are really geeky here is a reddit thread. Going Concern putting various pieces together tentatively concludes that the culprit is MegaCortex ransomware. Ed Zollars has a nice summary of what has gone on through yesterday.
While this was all going my partner and I were unloading our RV and readapting to living in around 2,000 square feet rather than 200 or so after four months in relatively warm weather. Between 199A and now this, I am so glad we decided to retire.
The Good Old Days
Being an old fart, this incident has put me in a reflective mood. I’m trying to imagine how something like this could have happened in 1981. We come into the office and all the file cabinets are gone. All the workpaper folders that had been sitting on our desks are gone. The shelf where we kept copies of the most used IRS forms has disappeared. And the pencils. Where the hell are our pencils?
And then we hear that the same thing has happened to half the accounting firms in the city. And then there is the fear that our clients’ tax returns are now in nefarious hands. That is the big worry.
I remember in 1998 being the partner on the scene when our computer system was crippled by vandalous thieves. It turned out that it was actually guys who worked through the entire office building stealing chips, but I didn’t know that when I was talking to the detectives. When they asked me how much value was involved, I put it at $10 million because I thought it could conceivably destroy our practice if the data on the drives was accessible to the thieves.
The Rise Of Software Returns
I’m sure Robert Flach the Wandering Tax Pro is having another one of his chuckles.
In 45 years of preparing individual income tax returns I have never used flawed and expensive tax preparation software. One of the last of the dinosaurs, I prepare over 250 sets of returns each year manually.
In 1981, we were already using commercial software to prepare individual tax returns. It was a remote service and because of the expense used very selectively. Most returns were done by hand in pencil and then photocopied.
Herb Cohan, our managing partner, told me about how they used to type the returns to get multiple copies using carbon paper. It was a lot harder, but they were able to start earlier – like in November – because you didn’t have all those 1099s to worry about. For dividends and interest, you could put down, you know, “a figure”.
Can’t Work
But now when a Dutch-based company has a problem, nobody can do any work. One whine I read illustrates how this is the epitome of a first world problem
This is SO FRUSTRATING. Can’t they fix this faster! How is CCH going to make up for the fact that I now will have to work this weekend, when I initially get all my work done this week. Also, my firm isn’t going to lower the charge hour budget I need to meet to get a bonus, but I can’t get any charge hours if I can’t work.
One of my sources who is unaffected as his firm uses another product has a calmer and saner response.
I think accountants think we are more important than we really are. I know unexpected interruptions are inconvenient and this issue would make me worried about if it happened almost any other time of the year. But it is early May so unless someone has a significant nonprofit practice and is facing a 5/15 deadline, is it that much of a disruption? If it was me I’d just take the week off and post the out of office message “due to necessary software maintenance our office is closed this week.” Inconvenient? Yes. poor customer service by CCH? Absolutely. But firms saying they are losing revenue at their max billing rate x 8 hours a day per person are exaggerating.
Villains. They just don’t think things through. If they wanted to put a scare into the country and had picked tax accounting as the vulnerable spot, they really should have hit on April 1 or so. Otherwise, nobody outside the industry is going to notice.
Are We Too Reliant On Vulnerable Tech?
On a more serious note, I think we should reflect a little on how vulnerable we have made ourselves from overreliance on technology. When I was a hotel night auditor, the monstrous bookkeeping machine I wrestled with had a hand crank back-up so I could work it without electricity. It never came up, but with a flashlight, I would be able to have the bills ready at checkout time during a power failure.
The military is taking this problem very seriously. Naval officers are now being trained in how to do celestial navigation. It had become passe in the nineties, but fears about the vulnerability of GPS to either hacking or actually shooting down the satellites now makes it a thing. Having a carrier battle group not be able to figure out where it is is much scarier than having a bunch of tax accountants not able to do returns. Even if it means somebody will not make his charge hour bonus.
Update
I received an on-the-record comment from Andrea Carr, whose time zone is five hours behind mine.
It only bothers me a little that CCH was attacked, no system is impenetrable against all adversaries. It bothers me that CCH didn’t have a clear response plan to a cyber attack, as indicated by their terrible communication (and lack thereof) to their customers. Cyber attack contingency plans should be as common as fire drills at this point. What was also perturbing was CCH claiming the attack impacted their communication channels, which while I understand the ability to e-mail customers was unavailable, there’s no reason CCH couldn’t post more updates on the social media sites. Customers are grumpy when a company messes up. Customers get litigious when a company starts lying about their mess ups.
I also heard from Michael Schaffner, who among other things is an amateur historian. I was mainly asking him about the Navy observation I made, but he gave me a lot more, which I reproduced in full here.
In that light, sorry to hear about all the accounting firms, but maybe they can take a hint from the Navy. Learning the more primitive technology not only gives you a backup and makes you more appreciative of the modern approach, but it provides a deeper understanding of how things work and why. Input screens are equivalent to paper forms. Excel is equivalent to graph paper and a calculator. The nature of the work — the essential requirements of the job of an accountant or any other administrative employee — is more a constant than we realize, and it helps to know how those before us got it done.