Did human identity verification make an SSL digital-certificate service primarily human effort and exclude it from Washington digital automated services tax?

Plain-English summary

The Washington Department of Revenue held on reconsideration that an SSL digital-certificate service remained a taxable digital automated service (DAS) and did not qualify for the human-effort exclusion.

Employees spent roughly 30 to 60 minutes researching and verifying a customer's identity when a certificate was issued or renewed. After issuance, however, authentication and certificate-status functions operated without further personal involvement by the seller.

The exclusion required human labor to exceed 50% based on the average of time and direct-cost factors. The taxpayer claimed that human-related costs were 79% in one year and 77% on average, but included all salaries plus broad or unexplained expenses such as travel, recruitment, relocation, outside services, contractor services, and cost sharing. Removing just three unclear categories dropped the example-year figure from 79% to 44%, before removing other indirect costs.

The evidence therefore did not show that the overall service primarily involved seller human effort.

Result: reconsideration petition denied; assessment sustained.

What this means for you

Cybersecurity and certificate providers

Analyze the entire customer service, not only the human onboarding step. Ongoing automated delivery can dominate the DAS classification.

Finance teams

For a human-effort exclusion, isolate direct labor costs from general overhead, travel, recruitment, facilities, vague contractor expenses, and other indirect costs.

Tax professionals

Washington's test averaged a time factor and a direct-cost factor. Both need transactionally relevant support.

Common questions

Q: Was the identity-verification step human?

A: Yes. Employees researched each customer before issuance and renewal, but that did not establish that the whole service was primarily human.

Q: What happened after a certificate was issued?

A: Certificate authentication, status, and revocation-list functions operated through automated systems without additional seller human involvement.

Q: Why did the cost study fail?

A: It included broad indirect and unexplained expenses rather than only direct costs of performing the human part for customers.

Citations and references

• RCW 82.04.192(3) (digital automated services and human-effort exclusion)
• RCW 82.04.050(8)(b) (retail sale of digital automated services)
• WAC 458-20-15503(303)(a) (time-and-cost test for human effort)

Source

• Landing page: Washington Tax Decisions ZIP files
• Original PDF: 36WTD394.pdf
• Source archive: Volume 36 ZIP (member 36WTD394.pdf)

Original ruling text

Det. No. 16-0141R, 36 WTD 394 (July 31, 2017)

394

Cite as Det. No. 16-0141R, 36 WTD 394 (2017)

BEFORE THE ADMINISTRATIVE REVIEW AND HEARINGS DIVISION
DEPARTMENT OF REVENUE
STATE OF WASHINGTON
In the Matter of the Petition for Reconsideration )
of
)
)
)
...
)
)

DETERMINATION
No. 16-0141R
Registration No. . . .

RCW 82.04.192: B&O TAX – RETAIL SALES TAX – DIGITAL
CERTIFICATES - HUMAN EFFORT EXCLUSION FROM DIGITAL
AUTOMATED SERVICES (DAS). Does the income derived from providing digital certificates qualify for the exclusion from DAS as a service that “primarily involves the application of human effort by the seller?” Headnotes are provided as a convenience for the reader and are not in any way a part of the decision or in any way to be used in construing or interpreting this Determination. Lewis, T.R.O. – Taxpayer requests reconsideration of Det. No. 16-0141. Taxpayer requests correction of an assessment of retailing [B&O tax] and retail sales tax on income received from providing customers digital certificates, maintaining that its service is excluded from the definition of DAS as a service that “primarily involves the application of human effort by the seller.” We affirm the assessment.1 ISSUE: Under the provisions of RCW 82.04.192(3)(b), does Taxpayer’s service of providing digital certificates qualify for the exclusion from the definition of DAS as a “service that primarily involves the application of human effort by the seller?” FINDINGS OF FACT Taxpayer, a privately owned, foreign corporation, derives income from providing digital certificates to businesses hosting commercial websites and providing identity-based security solutions for both public and private organizations. Taxpayer’s customers are located throughout the United States, including in Washington. The digital certificates sold by Taxpayer are used for two purposes: 1) to verify the identities of parties connecting on the internet; and 2) to ensure secure safe communications using encryption.

1

Identifying details regarding the taxpayer and the assessment have been redacted pursuant to RCW 82.32.410.

Det. No. 16-0141R, 36 WTD 394 (July 31, 2017)

395

A standard [secure sockets layer] (SSL) certificate includes information pertaining to the holder of the certificate and the issuing certificate authority (e.g., Taxpayer) such as the legal name of the holder, a unique serial number, the validity period of the certificate, and Taxpayer’s digital signature of authenticity. In order for Taxpayer to create and issue an SSL certificate, Taxpayer must verify the identity of each customer. This verification process takes place at both the initiation of a new service and upon the renewal of an existing subscription. For security purposes this process is not automated. Taxpayer’s employees research and investigate each request, a process that on average can take anywhere from thirty minutes to an hour, vetting and collecting information to verify the identity of each customer. Taxpayer incurs a direct cost to perform this service, and it is necessary that this verification process take place in order to safeguard the public’s trust for SSL certificates, as well as to ensure the legitimacy of Taxpayer’s digital signature. When Taxpayer updates the status of an SSL certificate, it conveys that change to third-party servers (e.g., Certificate Revocation Lists and Online Certificate Status Protocol) that contain master aggregate SSL certificate lists. These third-party servers report a valid or revoked status when a browser independently assesses the authenticity of a certificate during the “handshake” process described above. In sum, human effort is required to initially verify the identity of each customer; however, once the identification is made and the certificate is issued no additional personal human involvement is necessary by Taxpayer to assure the validity of Taxpayer’s customers to Taxpayer’s customers’ customers. The Department’s Taxpayer Account Administrative Division reviewed selected records provided by Taxpayer for the period January 1, 2010, through December 2013. On March 17, 2015, the Department issued a $ . . . assessment. The tax deficiency arose from the Department’s conclusion that income from the sale of digital certificates is DAS, which are subject to the retailing B&O tax and retail sales tax classifications. Taxpayer disagreed with the assessment. On April 14, 2015, Taxpayer filed a timely petition for correction of assessment. The petition maintained that Taxpayer’s business activity qualifies for the exclusion from the definition of digital automated services for “any service that primarily involves the application of human effort by the seller.” RCW 82.04.192(3)(b)(i) and WAC 45820-15503(303)(a). Following an in-person hearing on April 13, 2016, the Department issued Det. No. 16-0141, which sustained the assessment. The determination explained that the assessment was sustained because: During the in-person hearing held on February 10, 2015, the review officer made a request for documentation to support the claims made that the requirements of the “human effort” DAS exclusion were satisfied. That request was followed up by two subsequent emails to Taxpayer’s representative requesting the promised documentation.2 No documentation has been provided. Taxpayer has not met its burden of proving that it is eligible for the human effort exclusion from DAS referenced in RCW 82.04.192(3)(b) and Rule 15503(303)(a). Accordingly, the assessment is sustained. 2

Emails were sent on March 8, 2016, and on March 21, 2016.

Det. No. 16-0141R, 36 WTD 394 (July 31, 2017)

396

On May 12, 2016, Taxpayer filed a petition requesting reconsideration of Det. No. 16-0141. Taxpayer reiterated that it qualified for the human effort exclusion. Taxpayer’s petition explained that an [E]xcel workbook, entitled “…Trial Balances,” has been provided to the Department by Taxpayer to substantiate the costs associated with human and automated effort: Cost The cost factor also weighs in favor of the costs of human effort being substantially more than the costs of the automated processes. In the ETA discussed above3, the direct costs of human effort include costs for salary, benefits, and unspecified “other direct human costs”. [Taxpayer] employs a large number of developers, engineers, and other support staff who are essential to issuing, renewing, and revoking SSL certificates. [Taxpayer] incurs direct costs from the salaries and benefits provided to these employees. Conversely, direct automated costs associated with providing these services, such as amount paid for assets used directly in this process, are significantly less. The [E]xcel workbook documents [Taxpayer’s] costs and the associated G/L expense accounts. The workbook includes six tabs: a Profit & Loss statement for each of the tax years at issue, an Expense Balances tab, and an Expense Split tab. The Expense Split tab lists the G/L expense accounts. The accounts are organized into either “Human Efforts” or “Other.” The Expense Balances tab includes G/L amounts (with the associated account code and name) for each tax year at issue. The G/L balances are shown as total (under “G/L Balance”). The balances are then allocated to human effort (“Human Efforts”) and other expenses deemed to be automated services (“Other”). The total balance for each year ties to the sum of “total cost of revenues” and “total operating expenses” in the P&L statement tab for the respective year. For example, cells D11 through D196 on the Expense Balance tab contain the G/L expense amounts for 2013. Cell D7 on the Expense Balances tab contains the total expense balance for all G/L accounts for 2013: $ . . . . This amount ties to the sum of cells B15 and B29 on the P&L 2013 tab: $ . . . and $ . . . . Each G/L expense amount is then allocated to human effort (cells F11 through F196) or other (cells H11 through H196). For 2013, the total expense associated with human effort is $ . . . , and the total expense associated with nonhuman effort is $ . . . . Applying guidance of the above ETA, the cost percentage is determined by the amount of direct human effort costs divided by [Taxpayer’s] total costs. For 2013, [Taxpayer’s] costs percentage is $ . . . / . . . , or 79%. This percentage is calculated in cell F8 on the Expense Balances tab. On average over all years at issue, [Taxpayer] spent 77% on salary, benefits, and other direct human efforts costs related to its employees performing certificate services. Thus, it is clear that the cost factor weighs in favor of finding that these services were performed using primarily human effort during the audit period. Excise Tax Advisory (“ETA”) 3189.2014, while specifically addressing the taxation of alarm monitoring is instructive in calculating the primarily human effort exception to the taxation of digitally automated services. 3

Det. No. 16-0141R, 36 WTD 394 (July 31, 2017)

397

ANALYSIS:
DAS means any service transferred electronically that uses one or more software applications. RCW 82.04.192(3)(a). Under the provisions of RCW 82.04.050(8)(b) the term “sale at retail” or “retail sale” includes the sale of DAS to consumers: A retail sale of digital goods, digital codes, or digital automated services under this subsection (8) includes any services provided by the seller exclusively in connection with the digital goods, digital codes, or digital automated services, whether or not a separate charge is made for such services. Taxpayer does not dispute that it provides authentication and resolution services to its customers electronically through the means of software applications, which meets the definition of DAS in RCW 82.04.192(3)(a). Taxpayer’s basis for relief is that its activity qualifies for the exclusion from the definition of DAS because it primarily involves the application of human effort. Under the provisions of RCW 82.04.192(3)(b) DAS does not include: “(i) Any service that primarily involves the application of human effort by the seller, and the human effort originated after the customer requested the service.” WAC 458-20-15503 (“Rule 15503”), explains the proof taxpayers need to provide to qualify for the human effort exclusion: (303) Exclusions from the definition of digital automated service are: (a) Services that require primarily human effort by the seller and the human effort originated after the customer requested the service. In this context, "primarily" means greater than fifty percent of the effort to perform the service involved human labor. To determine whether the fifty percent or greater threshold is satisfied, the average of the time and cost factors is considered. The time factor is determined by dividing the time spent to perform the human effort portion for customers by the total time spent performing the service. The cost factor is determined by dividing the direct costs incurred to perform the human effort portion for customers by the total direct costs incurred to perform the service. Direct costs of the human effort component include salaries, employee benefits and similar direct costs. Direct costs of the automated component include the cost of software, computers, hosting services and other similar direct costs. If the average of the time and cost factors is greater than fifty percent then the service requires primarily human effort and is not a digital automated service in which case the service will generally be subject to service and other activities B&O tax. Taxpayer maintains that an analysis based on cost supports granting of the “human effort” exclusion, because the costs of human effort are significantly more than the costs of the automated processes. Both case law and Department precedent require that we narrowly construe the human effort exclusion contained in RCW 82.04.192(3)(b) and Rule 15503(303) (a). The burden rests with a taxpayer to prove they are eligible for an exclusion from taxation. On reconsideration,

Det. No. 16-0141R, 36 WTD 394 (July 31, 2017)

398

Taxpayer provided the Department with copies of its General Ledger Balances for 2010 through 2013. Using 2013 as an example, which Taxpayer did in its Reconsideration petition, we agree and understand that Taxpayer’s total expenses for FY 2013 were $ . . . . We disagree with Taxpayer’s figure calculation that $ . . . is the “direct costs incurred to perform the human effort portion for customers.” Thus, the analysis focuses on the direct costs to perform the human effort portion for the customer.
...
In calculating direct costs, Taxpayer included a wide variety of expenses. The expenses which Taxpayer maintained were direct costs included: all salaries, termination allowance, stand by pay, company bonus, commission, vacation pay, employee benefits car allowance, office rent, business meals entertainment, employee entertainment, external professional training, external technical training, agencies for recruitment, recruitment other, existing employee relocation, new employee relocation, trade/professional dues, cellular phones, other communication costs, hotel lodging, laundry, dry cleaning, parking, passport fees, taxi/train/tolls, airfare, travel and living, conferences, taxis and limousines, business meals, entertainment, employee entertainment, external professional training, external technical training, agencies for recruitment, recruitment other, existing employees relocation, new employees relocation, trade professional dues, employee activities, outside services, home office upgrade, home office electrical equipment upgrade, home office supplies, home office telephones, contractor services, professional services, and cost share. Taxpayer’s calculation includes many costs that don’t appear to be related to human effort. For instance, Taxpayer’s calculation includes all salaries, bonuses, and commissions ($ . . . ). Taxpayer’s calculation also includes general costs such as hotels and travel, business meals, recruitment and relocation expenses, and undetailed expense such as outside services ($ . . .), contractor services ($ . . . ), and cost share ($ . . . ). If we subtract the expense assigned to outside services, contractor services, and cost share because it is unclear exactly what they relate to, the percentage of costs drop from 79% to 44%. We would expect the actual calculation to result in even a lower percentage because Taxpayer has included many indirect expenses such as employee relocation expense, home office expense, recruitment, entertainment, etc. Here, the upfront authentication process involves human effort whereas after authentication, the services are automated. The overall digital certificate service is not primarily performed by human effort. Our review of Taxpayer’s business expenses does not support a conclusion that Taxpayer’s business activity qualifies for the “human effort” DAS exclusion. Accordingly, the assessment is sustained. DECISION AND DISPOSITION: Taxpayer's petition is denied. Dated this 2nd day of November 2016.