Canada Revenue Agency Shut Down Tax Filing Secure Web Access

Canada Revenue Agency has shut down all access to its secure web server, effective April 8, 2014.

Secure web services affected by this shut down are CRA online services like, EFILE, NETFILE, My Account, My Business Account and Represent a Client.

CRA website state that, April 8, late afternoon, it came to their attention that the software CRA is using to make internet transmission of our data secure is vulnerable to a bug named “Heartbleed Bug” and it was affecting the secure data transmission software worldwide. As a preventive measure, CRA temporarily shut down public access to their online secure services to safeguard the integrity of the information they hold. 

The issue with this specific version of the software which was released in December 2011, and is affected by the “Heartbleed Bug” is that it is possible for a hacker to see some of the encrypted information. Unfortunately, it is impossible to tell what, if any, information has been compromised. The vulnerability was only discovered recently by security researchers.

According to other sources, a new version of the software is available, and CRA might be working to upgrade their security software. CRA is expecting to open the secure services to the public on Monday, once the software is fixed.

Personally, I doubt that CRA will ever be able to provide a 100%  ironclad security to the  secure web services. The updated software will be compromised soon enough. That is the nature of software and people who want to exploit the software vulnerability.

Only three more weeks left to submit the Canadian Income Tax Return to CRA. Disruption to access to CRA electronic services will have a big impact on individual taxpayers. All the secure web services access must be reset with new access code. If you have on line secure access to CRA web site, you might not be able to get access to that even after the CRA secure web services has been restored.

The good news is, Honourable Minister of National Revenue has confirmed that individual taxpayers will not be penalized for CRA service interruption.

Now, that’s a message we all need to contemplate on.

CRA is moving all their service to online. In Province of BC, there is not a single CRA window is open for client service in any of the CRA office. Online services were disrupted in 2013 too. If taxpayers can’t file their taxes, their refunds will be delayed. Payroll Tax, GST remittance dates are time sensitive. Access to My Account and My Business Account is necessary for each account holder.

So, can we penalize CRA for not giving us secure access to the web services, or exposing our secure information to hackers?