Data Security and Tax Administration Insights with Ryan Minnick, COO at FTA: Part 2

Meredith: 00:01:02

Welcome to SALTovation.

The Salvation show is a podcast series featuring the leading voices in SALT where we talk about the issues and strategies to help you make sense of state and local tax.

In the second part of our episode with Ryan Minick, COO at the Federation of Tax Administrators, we continue our conversation about tax technology from an agency perspective at the state level and how states work to get it right.

Meredith: 00:01:28

So we kind of just, I'm sure this just a tiny little subsect of, you know, all, you know, 25 programs and whatnot. And you had kind of brought this up.

ugh, you know, this year, the: 2024

State websites basically know how you give states their sales tax. And you know, everyone had their favorite, everyone had their least favorite portal to use.

So kind of just using that little kind of carve out what is your perception of kind of how states view their filing portals and, you know, what they do to try to improve them or just I know there was one fact that, you know, one of the states on the panel, it was either if they wanted to update their system, it would either cost 90 million or like $90 million to upgrade their state website. So just what is, what does that look like? How do you think states view that?

Do you have any examples just kind of looking at that tiny little portal component in isolation?

Ryan: 00:02:50

Absolutely. So, yeah, technology from the taxpayer perspective versus the agency perspective.

This is, as you saw at Crush, one of my favorite conversations, because I think the scope and scale is so different than people expect when you cross this divide from private to public. So states rely on kind of a multitude of interconnected systems in order to do the work of tax administration.

So you've got inbound flows of data from the digitally filed returns, you've got your public website. Oftentimes your private portal is not in the same platform at all as your public website for a lot of safety and security reasons.

And then connecting it all, and this is a huge oversimplification, but connecting all these pieces is what we refer to as an integrated tax system or an its. So your integrated tax system could be a single vendor. There's a lot of states that use particular vendors to implement this.

So they're commercial software that get customized for the state, that run either locally.

Ryan: 00:03:44

Or in a cloud environment that's secured.

Ryan: 00:03:46

To a certain standard or in some Cases, states have, you know, their integrated tax system. Integrated is a little bit of a misnomer.

They may have a mainframe system that interfaces with a bunch of other kind of child processes that then makes up.

Ryan: 00:03:59

A single view for their agency employees.

Ryan: 00:04:02

But, you know, beyond that is really a number of different systems that pull together. And I suppose, you know, one important point is that we talk about legacy a lot.

hat, you know, it's like that: 1995

Usually it's all running on very modern hardware, sometimes in very modern data centers, but it's the code base itself. For the nerds who are listening, like me, that means that it might be written in COBOL versus something more modern.

But legacy doesn't necessarily mean out of.

Ryan: 00:04:46

Date or not modern.

Ryan: 00:04:48

We use modern and legacy to refer to things like programming languages. But to your. The $90 million, it ranges widely from, from state to state.

So estates to replace that core, that integrated tax system function, that can be an exercise that costs anywhere from tens of millions to more than 100 million. In some cases big states, $200 million to over many, many rollouts and many, many months and years phase out and replace that system.

They're really great projects. I think they should be.

You know, I like the tax practitioner community to be aware of these large price tags because that's something that they can then support if they have any relationships with legislators or with state agencies that help fund and allocate that budget. Because oftentimes those price tags are shared without context and people don't understand why it would cost so much to replace it.

And if you think about it, these integrated tax systems are the single point that 94, 95% of revenue for your state comes through.

And so you really want them to be secure, you really want them to have that high level of performance, and you really want to then have what we were talking about at crush, really great user experiences to interface with them.

And so I know that I was interested in the discussion around taxpayer portals because this is often one of our topics internally about data security more so than usability, because it's that. That perfect scale, right? The most secure system in the world is one you can't get into.

And the least secure system in the world is often the One that's easiest to use and there's everything else falls somewhere in between. And so for states, they're actively making decisions because they want to optimize for.

Ryan: 00:06:30

A number of things.

Ryan: 00:06:31

But for this conversation, two really important things, right? One's voluntary compliance. Voluntary compliance makes the world go round.

So 51,000 employees of the nation's tax agencies that belong to FTA, 330 million Americans, 150 odd individual income tax filers, tens of millions of corporate filers. So that ratio, if you have to talk to every single taxpayer or help all of them, that's an untenable prospect, right?

You would need staff many, many, many multiples of what we have. So voluntary compliance is great.

How do we make it easy and then how do we make it secure so that what you're providing to the state agencies, as a practitioner, as a taxpayer, is received, reconciled payment, deposited and have all that done, ideally timely and in an automated fashion.

And then only have those exceptions be situations where, you know, there's a unique situation that needs to be addressed, or maybe there's a complex, complex text type issue or really free up the resources to deal with the really chewy.

You know, maybe I'm crazy when I say this, but the really fun problems, the ones that don't quite fit tax code and the model that you expect, but everything else should just flow through. And so the pain point, the pinch point for that is how accessible do you make a system?

Ryan: 00:07:50

What do you do for identity requirements?

Ryan: 00:07:52

How do you make sure that these systems are accessed securely, that you can.

Ryan: 00:07:56

Receive data and that you can trust.

Ryan: 00:07:57

The data that you receive, and that you're not inadvertently disclosing data that could then be used criminally or fraudulently, either against the tax agency or against the taxpayer. So that's where a lot of these discussions happen. So, and note that for the last minute or so, I didn't mention technology at all.

This is all policy decision making, risk tolerance, risk gradient analysis. And that's where I think we talk about it a lot at conferences and I was excited to share it with the audience at crush.

But I don't think it's part of, you know, it's not the sexiest headline in the world. You know, tax agency wants to protect your data. Makes it really hard to log in like that. Not really the headline. Usually it's insert agency names.

Website has been down for three days and it's been hit with pummeled with all these requests. So there's a lot going on behind the scenes that I Think, you know, kind of supports empathy more than, more than criticism often.

Meredith: 00:08:51

Well, and that's as you're, you know, after I left that and you know, we do sales tax filings for clients and you know, two factor authentic authentication is, you know, a pain. We appreciate the, the mechanisms behind it and the reasonings for it.

But, you know, when you're trying to file a sales tax return on like the last minute you make a payment, it's, it's an annoyance. But I did start developing that empathy for the Ohio Business Tax Gateway. This is an opinion of Meredith Smith, not of Tax Ops, not of the F.

Of the fda.

Just like how clunky or just unfriendly some of these systems can be because of that and just, you know, taking a step back and it's like they're doing the best they can.

And I'm sure that they're sick of hearing feedback about how people don't like their website, but of all of the list of things that money can be funded towards, like, had a little bit greater empathy for, you know, the Business Tax Gateway. Now I haven't Two factor authentication mandatory. TFA just went live in Ohio around the recording of this. So my empathy might be diminished.

But again, opinion of Meredith, not of anyone else on this episode.

Ryan: 00:10:00

Well, and it is hard that, like I said, all that risk gradient and every agency is going to make their own decisions based on either the risk tolerance that they have in leadership or sometimes the risk tolerance they have in statute. So there's also some things we run into where, you know, a state agency may have a legitimately, you know, they want to do something for, to make.

Ryan: 00:10:21

The business run smoother or to make.

Ryan: 00:10:22

The process run smoother, but there's a statutory requirement that prevents them from doing so.

Ryan: 00:10:26

And then that becomes even more complicated.

Ryan: 00:10:28

Because they have to then work with their executive branch, with their legislative liaisons in the agency. They have to articulate that need to their legislators. The legislators have to decide whether or not the issues important enough to either.

Ryan: 00:10:39

Put in its own bill or attach.

Ryan: 00:10:41

It to a different bill. And so it can be, you know, you can identify one process or procedure issue. It could be, you know, months, if not years to get it resolved.

Not because they don't want to do.

Ryan: 00:10:51

The work or they want to, you.

Ryan: 00:10:52

Know, don't want to make it easier. But sometimes their, their hands are tied by something that was written, you know, before computers existed.

And so, you know, they can't run afoul of it because it's statute, but they're trying to introduce that flexibility and you know, every agency implements a little differently. But yeah, two factor, we hear a lot about two factor Identity Access management is actually one of the really big challenges right now.

I know the IRS catches a lot of flack for this that I think I'll help build some empathy for them too. They're not even my member and I'll do it. But IRS largely uses that ID me platform for login.gov.

kind of the linchpin of ID me is that there's one account per, per person, like you have to authenticate you as an individual. That's part of that identity assurance that you know, for people who are super technical.

If you want to know more about this, go look up the NIST guidelines and specifically the 863 series. There's some really good stuff in there about authentication, identity management and how all of that is.

You know, NIST guidelines are kind of non prescriptive think tank guidelines and then they show up everywhere else in government. So they show up in a lot of the IRS publications that govern how you design and access systems.

They show up in things like Fedramp where you have to secure your systems in order for them to be eligible for use by federal and state stakeholders. The identity access provisions that dictate a lot of what ID me does are from, they're derived from that 863 series.

And so even those changes are really hard because people are used to kind of living two lives, your home life and your work life. And when all of a sudden you have to create an authenticated version of.

Ryan: 00:12:35

You.

Ryan: 00:12:37

You Meredith, not work Meredith or home Meredith. That can become a friction point. There's a lot of pushback that both the private sector, different public sector employees are given about.

Hey, why am I providing all this.

Ryan: 00:12:49

Personal information to create an account?

Ryan: 00:12:50

Well, you're providing it so that your identity can be verified, so that you can be led into a higher risk environment, so that you can do what you need to do. And those rollouts are never smooth or well received or seamless for everybody because we've all got our different risk tolerances.

onto that Motorola Razr from: 2008

But we have to also kind of keep things moving along and, and two factor identity management, that risk adjustment, that's a big element.

Speaker E: 00:13:29

So I Guess if a state is entertaining, upgrading systems, I mean, are they typically then reaching out to, you know, your team at FTA to maybe get some input, to maybe do have some of your team do some research for them? And I mean, and how much maybe lead time do you guys have in those situations?

Ryan: 00:13:54

Yeah, we encourage people to reach out to us anytime they're thinking about any of these issues.

So, you know, sometimes, you know, depending on their, how they're handed the project, whether it comes from the legislature, some of the parameters are already set. Generally speaking, our members reach out to us really early in the process.

It may even be before they put together their funding request from their state central IT or from their legislature. So they'll do things like engage with.

Ryan: 00:14:22

Our National Technology Leaders program, which is.

Ryan: 00:14:24

Made up of agencies, CIOs, CISOs, platform directors.

They're going to reach out to their peers that they connect with through our various platforms and they're going to have one on one conversations, you know, to find out, you know, what were some of the constraints that you had, what were some of the requirements that you all foresaw? Because everybody wants to see around the corners as best as possible.

They want to know, you know, are we thinking about, you know, capacity in the right way?

Ryan: 00:14:50

Are we thinking about environment in the right way?

Ryan: 00:14:53

We have, you know, some states have a state central IT unit that operates a data center for the state. So, so sometimes it's do we want to host our data in the data center or do we want to work with a compliant cloud vendor to access.

Ryan: 00:15:10

Additional overhead and compute power?

Ryan: 00:15:12

And the answers are a little different for everybody.

And a lot of it comes down to how you're storing data, how you classify data, things like that, but also what your budget is and what you're trying to do. From a capital standpoint, that has even shifted. This is super inside baseball. But, you know, the funding models are different.

Ryan: 00:15:30

When you're working with a cloud environment.

Ryan: 00:15:32

Versus a hardware environment, you're not buying a computer every, you know, three to five years. You're instead, you know, paying for a computer that exists somewhere else, getting a tremendous amount of benefit for that.

Ryan: 00:15:41

But you have to even budget differently for it.

Ryan: 00:15:43

And so that process takes time.

Yeah, the earliest, the earlier they reach out to us, the better because we can, you know, we can connect them with people who have, you know, similar, you know, either similar employee sizes, similar tax types. A lot of times they even check with their, you know, they may check with their neighbors in the region depending.

Ryan: 00:16:00

On the regionality of Some of the.

Ryan: 00:16:02

Some of the things that they deal with. So yeah, it's. Then it happens on the technology side, but then also I interface with most of those folks.

But we may even during the process of modernization have different functional groups like audit collections, customer experience. They may get together and have a discussion about best practices.

There's a lot of states that are modernizing things like call center software and so they allocate how that gets done as well as possible because they want to have that high availability for taxpayers to call in. They want to reduce the amount of times that you're transferred when you call them with a question.

They want to put in, in some cases potentially assistive technologies that are going to help those call center agents pull up data faster so that they don't have to put you on hold.

I mean everything at every step of every process, what I found in nine years being here, every agency is looking at how do we do it faster, how do we do it better, how do we do it more securely and how do we ultimately at some stage.

Ryan: 00:17:03

Automate it so that we can free.

Ryan: 00:17:05

Up our limited resource which is human time for the really high value. Complicated chewy stuff.

Meredith: 00:17:12

Yeah.

I have to keep reminding myself to come back because as you're talking about technology and Stacy and I sit in Colorado and we are still fumbling through, you know, Colorado set system and kind of our own technological woes when it comes to something that is kind of really taking up a lot of capacity from like our clients perspective and like what to do with our Colorado locals of like how could this have gone differently?

How hopefully you know, not expecting you to spill any tea but like that Colorado locals are or one of them or all of them or CML or whatever has utilized your organization in some capacity. But cause high level being snarky, it's like yeah, they didn't talk to anyone. It's a disaster.

Ryan: 00:18:02

It's a good question. We do get outreach from municipalities and small localities.

I think a lot of the challenges, not only getting the word out, they have to know we exist. Like I said, most in my opinion.

Ryan: 00:18:12

Most important organization you've never heard of.

Ryan: 00:18:14

And that's there's a reason for it. We're infrastructure.

Ryan: 00:18:17

Right.

Ryan: 00:18:17

We're here to connect very specific stakeholders and we have in the last few years really shifted our kind of publicity practices. So we've got much like what we're talking on now. We've got a FTA podcast, it's called FTA Tax breaks Shameless plug. So look forward to that.

You Know, we, and there we actually talk about stuff sometimes it doesn't even relate to tax specifically. We talk about big trending things that.

Ryan: 00:18:43

Are going to impact tax and government.

Ryan: 00:18:44

So, you know, whether it's emerging transparency and AI, whether it's something like complex customer experience issues, things like that. So we do things like that to make the FTA brand a little more visible to folks who may not normally discover us. We, you know, really.

Myself, our executive director, Sram Benardi, as I mentioned, Brian, our general counsel, Scott Pattison, who's our new director of research and Tax policy.

You know, we're frequent speakers at various industry and academic events all over the country in order to kind of not only add our national perspective, but, you know, give people an opportunity to get to know some of the FTA team and understand kind of what our role is.

And when we, yeah, when we get outreach from agencies like that, sometimes, you know, in some of these locations, they're agencies of a handful of people and because of state statute, they're now a handful of people that have to administer something that their state's agency does with hundreds of people or dozens of people.

And so they're trying to find their footing and understand sometimes, you know, we can be that helpful connection to their state to, you know, help them, you know, better, better liaise. I mean, this is true of federal to state and then state to locality. Every agency has a different way that.

Ryan: 00:20:01

They run that liaising.

Ryan: 00:20:02

And so those liaison offices tend to be your one point of contact.

And so sometimes, you know, we can be even helpful with the liaison offices on how they kind of structure their internal relationships with, with their, their organization or their agency. I mean, we're, we're all about how do you connect the right information to the right place in the right time.

And you know, sometimes municipalities have like a customer service person that they talk to and that customer service person then has to follow up with somebody to follow up with somebody. Not intentionally complicated, but kind of accidentally complicated.

And so, you know, we, we try to be as helpful as possible to, to those, even those that aren't strict members of fta. But yeah, it can be really complex.

I mean, post, you know, not being a sales tax expert, I'll preface by saying that post Wayfair, from a technology perspective, things got very complex. I mean, you're looking at a huge volume of registrations, you're looking at a huge volume of returns.

Then you had all of the things happening with different marketplaces and them facilitating returns on behalf of other taxpayers. So Purely from a data non policy perspective, it was an avalanche of change that states and agencies had to deal with.

And I can say that from my seat. I think the practitioner community was super patient with that. And I think the states tried to be as helpful as possible during that transition.

Sometimes, I'm sure depending on where you're located, that either went really well or didn't. But I know things like trying to.

Ryan: 00:21:29

Provide long runways and changes to different.

Ryan: 00:21:31

Digital formats and making things more efficient can start to get us there. I know that there's still a lot of changes yet to be made, not only from my time listening at Crush, but also listening at our conferences.

Everybody wants to, like I said, it's that if you want to be compliant.

Ryan: 00:21:46

You want to pay the tax that.

Ryan: 00:21:48

You owe, the best feedback possible that you can offer either FTA or your respective state's tax agency, is how can we make it easier for you to do it?

And if there's a part of the process that you perceive needs to be simplified, then what we can do is look at, is it complicated because of statute, is it complicated because of operations.

Ryan: 00:22:10

Or is it just complicated for no reason?

Ryan: 00:22:12

And we can fix it. And that's where I know we talked about feedback a few minutes ago.

Ryan: 00:22:18

Provide it all the time. Everybody's feedback hungry.

Ryan: 00:22:20

I think obviously the fine line between feedback and criticism is really tough to navigate, especially when you're frustrated.

But if there's something that you can see that can be better, even if we can't fix it due to a circumstance that you're not aware of on the outside of the government agency, it's so appreciated. I know that Jay Waldo, the CIO in Texas who was on the panel with Mia Crush, echoed that sentiment.

He's like, yeah, we love getting feedback because, you know, we want to know, you know, we made the website responsive. Does that work for you? You know, the analytics show us that.

Ryan: 00:22:50

A lot of you are using iPhones and iPads.

Ryan: 00:22:52

But, you know, we want to make sure that you're getting what you need.

Meredith: 00:22:55

Yeah, well. And one of the examples, I won't call out the states, but they're like, you know what, we know our websites, we're going to change platforms.

We know our website's not ready for primetime, but we're going to do it anyway. We'll figure it out. You know, and it, I think, came back to bite them. And it's. It's been a kind of an uphill battle since then.

And then another state was kind of, maybe timeline was similar and looking to make that switch. And they're like, I'm gonna step back a little bit and let you all figure that out. And we're not gonna go if we're not ready, we're gonna delay.

I think they delayed it maybe a year or 18 months or something like that. So, yeah, it's. It's all perspective.

And there's so many things that happen behind the scenes, so many parties that, you know, all we can do is complain about what we can see, but we have no idea what's, you know, what it takes to put something on a screen.

Ryan: 00:23:45

Yeah, no, it definitely can be. It can be super challenging.

And, you know, and in cases like that where you have, you know, different methodologies, just like in tax, in the tech world, there's a million different methodologies you can follow for a product rollout. You know, in my private sector days versus my time at fta, I've seen.

Ryan: 00:24:03

A variety of them both work and.

Ryan: 00:24:04

Not work for a lot of different reasons. And it is nice that at least the agencies are connected enough through us that when somebody tries something, it doesn't work out super well.

We don't end up Groundhog Day style seeing it too many places. Very rarely do you see the same error or the same kind of issue in multiple states at the same time.

Some of them will have an error, and then the other states that are similar will learn from it. You know, kind of the. The visual effect that I, you know, I think you all can see from.

Ryan: 00:24:37

Time to time of the work that.

Ryan: 00:24:38

We'Re doing behind the scenes, because they will. They'll show up to a sharing call, and, you know, they're. They're happy to say, hey, we tried this.

Ryan: 00:24:44

It didn't work.

Ryan: 00:24:45

And so here's our advice to anybody else who's thinking about it, and they take that advice to heart. The relationships are super close among people who serve in those roles.

Meredith: 00:24:53

One, I love that you say that as we kind of begin to wrap, because that's kind of been a common theme for, you know, those listeners who get. Continue to stick with us over all the episodes. It's like when it comes to state tax, it's really those relationships that matter.

And I think it maybe it provides like, a modicum of comfort that, like, the states even have relationships with each other and they have this opportunity to share or, you know, make things known of what worked for them. Because us as practitioners, you know, we can't know everything everywhere.

So we rely on our friends and our colleagues and, you know, all over the country to help us get our work done.

And that it's great that organizations such as yourselves, you know, provide that opportunity and that resource to build those, you know, relationships. And as you said, states are sovereign nations.

They can do what they want, but they do still have that sense of community in those relationships to figure it out. And so while they can do what they want, they're not alone and they have that context and that, that availability to them.

Ryan: 00:25:52

Yep, absolutely.

And it is, I think, you know, because of those relationships and because of the overall, you know, the passion of people who, I mean, people don't get into tax administration for the money.

Ryan: 00:26:03

Right.

Ryan: 00:26:03

I mean, these are, you know, you're, you're in a public servant role.

Ryan: 00:26:06

You're there because you believe in the.

Ryan: 00:26:07

Mission and making sure that hospitals and fire trucks and critical public services are funded.

And, you know, you're, you're part of that community of helping kind of bring the critical ingredient, you know, in my opinion, for government, you know, money in order to do whatever happens downstream. You know, they're really dedicated to that, to that mission.

And so as a result, even when you find a kind of a sovereignty differentiation among states, oftentimes they'll look at best practices from each other and they'll.

Ryan: 00:26:34

Try to do things in a consistent.

Ryan: 00:26:36

Manner as long as they can accommodate.

Ryan: 00:26:38

It with their own specific requirements.

Ryan: 00:26:40

So, you know, you kind of don't run into that classic sovereignty problem of we're all going to do it differently just because we can. And that's not at all the attitude of the states. They want to.

They recognize that there's a lot of taxpayers that have obligations in multiple jurisdictions. And while they can't all ever get to that perfect synced up one button place, they can try to make it as consistent as possible.

They can share behind the scenes to best practices. Here's what worked well, here's how we're making sure.

And then above all, it's the number one priority that I talk about on stage, in podcasts, at conferences.

Ryan: 00:27:15

Our number one priority is data security.

Ryan: 00:27:18

Trust is hard to earn and easy to lose.

And no one, hopefully listening to this, at least no one I've met in the last year, no one thinks anything of clicking submit on a tax return and that data going to an agency because they trust that it's going to be secured, that it's not going to be stolen and used against them by a criminal. That is a high, high trust.

Because there's other places where we, you know, submit our information that we do think about it, you know, there's, you know, there's different websites, different vendors, third parties that, you know, you may think twice before you click submit. People don't do that with tax agencies.

And so as a result, we are laser focused both at FTA and the agencies, our members, they want to deliver this like next generation, great, excellent experience for taxpayers. The priority is securing that data. That, that is the most critical data set in government.

It's income, its identity, it's all of these different business situations. And in the case of complex returns, business activity, indifference.

They want that to be locked down, secure, and only use for the purpose of tax administration for what they received it for. And that I think people keep that in mind. Sometimes other things that you encounter will make a lot more sense when it's.

Ryan: 00:28:33

Hard to do and you'll be like.

Ryan: 00:28:34

You know what, maybe this is hard to do because somebody somewhere decided that they wanted to prioritize protecting me over making this one particular step easy. I can't promise it's the case all the time, but it often is when we, when we hear feedback and we look at how to improve processes.

Meredith: 00:28:49

Well, Ryan, I think that's the perfect spot to end. Thank you so much for all the work that you are doing that, you know, the FTA is doing. You know, you and your 10.

I can't believe there's only, you know, you have a. You're a team of 11. That, that of all of the numbers that you've thrown out there, that's a number that's really kind of sticking.

Speaker E: 00:29:13

It's an impressive number for the amount of work that you guys have to do. Yes.

Meredith: 00:29:18

So thank you so much and thank you for, you know, spending your time with us. We really appreciate it.

Ryan: 00:29:22

Awesome. Thank you for having me. Look forward to seeing you in Chicago and Tacoma next year.

Meredith: 00:29:27

I know it's. It's out there, Stace. It's gotta be real.

Speaker E: 00:29:30

Exactly.

Meredith: 00:29:32

All right, that's another episode of Saltivation.

Meredith: 00:29:34

Till next time.

Meredith: 00:29:36

This podcast is for educational purposes only and is not intended, nor should it be relied upon as legal, tax, accounting or investment advice. You should consult with a competent professional to discuss specifics of your situation and the applicability of the information presented.