Did Utah sales tax apply to remote computer-network monitoring that alerted clients about intrusions, software updates, and virus-protection issues?

Plain-English summary

Utah Private Letter Ruling 02-024 said the company's described computer-network monitoring service was not subject to Utah sales or use tax.

The company monitored client log files on servers in Texas, looked for attempted or actual intrusions, checked software and virus-protection versions, and notified clients about detected problems or available updates. It did not provide the software updates itself.

That distinction controlled the answer. Monitoring networks and alerting customers that they needed to obtain software were nontaxable services, but selling or leasing canned computer software was taxable.

The service described

The company planned to serve its first Utah customer. Client devices would send log files through a secure connection to the company's Texas servers.

The company would analyze those files for:

• Hacker intrusion attempts and penetrations.
• Protocol anomalies, signatures, event thresholds, and regular-expression matches.
• Outdated network-software versions.
• Outdated virus-protection software.
• Virus-protection programs that had not run recently.

Notifications would be delivered by telephone, pager, or email. Customers could also use a secure website to view network status and would receive daily email summaries.

Monitoring and alerts were not taxable

The Commission characterized the offering as monitoring client computer networks and alerting clients when and where to purchase software updates or current editions.

It said those monitoring and alert services were not taxable.

Because the request did not indicate that the company would provide any computer software while performing the service, the Commission found no sales or use tax liability for the described service.

Canned software was taxable

The Commission separately warned that any sale or lease of canned computer software to a Utah client was subject to sales and use tax under Utah Admin. Rule R865-19S-92.

That included canned software installed on a client's system to allow the company to monitor the network.

The response also treated charges associated with a canned-software sale, including maintenance, consultation, and training, as taxable under Rule 92.

Software supplied free with the service

The Commission did not give a final answer for software supplied free of charge when a customer bought monitoring services.

It said more information would be needed to determine the company's Utah tax liability. The response identified two possible treatments:

1. The company could be deemed to have sold the software, making sales tax due.
2. The software could be incidental to the nontaxable service, making the company subject to use tax on the software.

Holding

For the facts presented:

• Remote network monitoring and customer alerts were nontaxable services.
• The answer assumed the company did not provide software to clients.
• Selling or leasing canned software was taxable.
• Software needed to enable the monitoring service was taxable if sold or leased to the customer.
• Related canned-software charges were taxable under Rule 92.
• A free-software bundle required additional facts and could create either sales-tax or provider use-tax liability.

What this means for you

Cybersecurity and managed-service providers

Separate monitoring, analysis, and notification services from any software transferred or licensed to the customer. The software component can change the tax result.

Software companies

Calling software free does not settle the tax treatment. The Commission looked to whether it was effectively sold or instead consumed incidentally by the service provider.

Accountants and tax professionals

Review the contract, delivery method, customer software rights, and separately stated charges. This ruling's nontaxable answer depended on no software being provided with the described service.

Common questions

Q: Was the remote network-monitoring service taxable?

A: No, on the stated facts.

Q: Did it matter that the company alerted customers about available software updates?

A: The Commission treated monitoring and alerts as nontaxable because the company did not provide the software.

Q: Was canned software taxable?

A: Yes. The response said any sale or lease of canned software to Utah clients was taxable.

Q: What if monitoring required software installed on the customer's system?

A: The Commission said canned software supplied for that purpose would be taxable if sold or leased.

Q: What if the software was advertised as free with the service?

A: The Commission needed more facts. It could be treated as a taxable sale or as provider-consumed software subject to use tax.

Key source language

• Monitoring service: “Services to monitor network systems and alert clients of the need to purchase software are not taxable services.”
• Stated-facts result: “Under these circumstances, COMPANY has no sales or use tax liability on the services described in the letter.”
• Software: “any sale or lease of canned computer software by COMPANY to its Utah clients is subject to sales and use tax.”
• Free software: “more information is needed before the Commission can determine COMPANY Utah tax liability.”

Citations and references

• Utah Admin. Rule R865-19S-92

Source

• Landing page: Utah Private Letter Rulings
• Official ruling: Utah PLR 02-024
• Fetch note: the exact official URL returned HTTP 404 to a direct request and was then retrieved through Sofya.

Original ruling text

REQUEST LETTER

NAME

ADDRESS

We are a STATE company in the process of signing up our first customer in Utah so I wanted to get a determination on our sales tax status. I contacted TP REP via your website and she instructed me to send this letter to you.

Following is a description of our company and what we do:

Company Name: COMPANY.

Description of Services: COMPANY monitors our customers' networks for three things:

Intrusion attempts and actual penetrations by hackers

Service patches and updates to network software

Updates to virus scan patterns

If we detect a problem in any of the above areas, we alert the customer to that fact, and in some cases, point them to the appropriate websites where they can download updates.

The process we use to accomplish this monitoring is as follows:

�The client's devices send our servers in Texas information in the form of log files (via a direct, secure connection that their devices initiate)

�Our servers analyze those log files for penetration attempts by comparing them to protocol anomalies, signatures, event thresholds, and regular expressions.

�When we find such things, we contact the client so that they can respond appropriately

�We check the log files to determine what versions of software that the client is running (be it Microsoft, Novell, etc.), comparing them against the most recent versions available.

�When we find that there is a more current version, we notify the client of that fact

�Finally we check the log files to determine what versions of virus protection software that the client is running (be it Norton, McAfee, etc.) comparing them against the most recent versions available; we also check when the program was last run.

�When we find that there is a more current version, we notify the client of that fact and when we find that the virus protection program has not run recently, we notify the client of that fact.

�All notifications are by telephone, pager, and/or email.

Clients can use our secure website to log into the system at any time to see the status of their network devices. They also receive a daily email summarizing the traffic on their networks.

Contact: NAME, PHONE, EMAIL

Please let this letter serve as a request for a formal determination letter on this issue. Also, please feel free to contact me with any questions or clarifications. I look forward to your response.

Sincerely,

RESPONSE LETTER

January 14, 2003

NAME

ADDRESS

RE: Private Letter Ruling Taxation of Computer Network Services

Dear NAME,

You have the requested that the Commission determine if services provided by COMPANY are subject to Utah sales and use tax. From your description of the services, it appears that COMPANY monitors its clients� computer networks and alerts the clients when and where to purchase updates or current editions of their computer software.

Services to monitor network systems and alert clients of the need to purchase software are not taxable services. However, any sale of �canned computer software,� as defined in Utah Admin. Rule R865-19S-92 (�Rule 92�) (copy enclosed), is taxable. You do not indicate that COMPANY will provide its clients any computer software while performing the services described. Under these circumstances, COMPANY has no sales or use tax liability on the services described in the letter.

To reiterate, however, as a precaution, any sale or lease of canned computer software by COMPANY to its Utah clients is subject to sales and use tax. This would include canned computer software that the client might install on its computer system to enable COMPANY to monitor its network, should such software be necessary. Also, please be aware that other charges associated with the sale of canned computer software, such as charges for maintenance and consultation, are also taxable under and training, are also taxable under Rule 92.

If COMPANY provides canned computer software �free-of-charge� when a client purchases the monitoring services, more information is needed before the Commission can determine COMPANY Utah tax liability. In this case, either COMPANY will be deemed to have �sold� the software, in which case sales tax is due, or the software will be deemed incidental to the sale of nontaxable services, in which case COMPANY would be subject to a use tax on the software.

Please contact us if you have any additional questions.

For the Commission,

Marc B. Johnson

Commissioner

MBJ/KC

02-024