Yesterday was initially the last day to file the Beneficial Information Report (BOIR) if you have interest in an American company. The BOIR required business owners to provide personal information to the government that includes their full names, date of birth, home address and the identification number on their driver’s license, passport or any other traceable document like a state-issued identification card.
By August, according to the US Department of the Treasury, “millions” of BOIR reports had been filed with the government. The treasure trove of personal information is ripe for the picking by computer hackers working for criminal organizations or are state sponsored.
The BOIR reports are collected by the US Department of Treasury.
Last week, the US Treasury reported that “a state-sponsored Chinese hacking operation was able to” access the department’s computers, calling the computer intrusion, “a major incident.” The department did not disclose what data was compromised, saying that it would provide Congress a report in 30 days.
It is not known if the computer intrusion by alleged Chinese operatives include access to the personal information of “millions” of American business owners but the intrusion, nonetheless, exposes the problem of the government collecting too much personal information about Americans.
The latest Chinese hack follows previous ones targeting the White House and two telecommunications firms, AT&T and Verizon.
The alleged Chinese hackers are likely after the personal information of Americans. In one intrusion, a database of phone numbers that have law enforcement wire taps on them, as well as information about American leaders appear to have been collected by the intruders.
The information collected by the computer intruders provides the details necessary to target Americans, making them vulnerable to cybercrime. If it is true that the Chinese government is connected to the computer intrusions, it is likely that they are building databases of Americans for espionage purposes.
The On Again Off Again BOIR Requirement
The BOIR reporting requirement was enacted by Congress in 2021. The law required American businesses to report ownership information to the government starting on January 1, 2024. Business owners had one year to comply with the requirement, which was December 31.
The Corporate Transparency Act (HR 6395-1217) was intended to “protect vital” US national security, and “to counter money laundering.” According to the Act, Congress felt that more than 2 million American companies were being formed each year across the country without providing enough personal information about their owners.
Owners failing to file the required report by December 31 faced potential fines of up to $591 per day. However, after “millions” of reports containing personal information, a court delayed the deadline until January 15 to review a challenge to the constitutionality of the requirement. After the injunction was lifted, an appeals court placed an indefinite hold on allowing the government to fine those who fail to comply.
Because the appeals court placed the hold on the fines, it is likely that the court may ultimately find that the law is unenforceable by the time the case makes its way through the judicial system.
Meanwhile, the government continues to collect the personal information on American business owners.
For many American business owners who have filed their reports with personal information and those who have yet to file remain in limbo as to what will happen to their personal information that hackers are working to attain or have already gotten.
It is not only the computer hackers that Americans should be worried about.
Companies Offering To File BOIR Reports
As the deadline to file the report loomed, a cottage industry offering to file the reports developed. Anyone one can offer to file the report for any company as lawyers are not required to perform the service according to the U.S. Treasury.
LegalZoom, for example, offers to file a report for a fee of $149. There are, however, several other companies that offer to file the report as well, including law firms and accounting firms.
But there are also companies who collect the personal information about the owners who provide no information about who is behind the company and what they do with the information.
For example, Beneficial Ownership Report, who registered their domain name usa-boi-filing.com on December 13. The late registration of the domain name with less than 20 days before the deadline raises questions about the intent of the website.
The website does not provide a telephone number. However, a review of the site’s privacy policy suggests that a California company named Simple Tags may be connected to the site collecting personal information for the BOIR report filings. The Simple Tags website offers online California vehicle licensing services as a third-party. However, the license information it posted on its site expired in November.
Both companies are opaque about their ownership leaving users, especially the ones providing personal information to file the BOIR reports not knowing who has access to their personal information or what security measures are in place to protect that sensitive data.
This is in addition to paying a fee for a requirement that does not require a fee to be paid.
Was This Necessary?
Congress argues that it is necessary to collect the personal information for national interests needs and to protect Americans from money laundering. Plaintiffs in the Texas Top Cop Shop, Inc., et al. v. Garland, et al lawsuit (4:24CV478, Eastern District of Texas, Sherman Division) argue that the law “likely exceeded Congress’s authority,” according to an Amicus Brief in support of the plaintiffs filed by the Buckeye Institute on December 26, after an appeals court lifted the stay on collecting the private information.
The institute “works to restrain government overreach,” according to its Amicus Brief.
On December 26, the United Court of Appeals for the Fifth Circuit ordered that the government not enforce the deadline for the filing of the BOIR or applying fines until the constitutional challenge to the law is settled.
It is not known how the court will ultimately rule on this issue. Nonetheless, for the individuals who have provided their personal details to third-parties or to the government the question remains whether their details are in the hands of the Chinese or other bad actors.
Should the courts ultimately rule that the law is unconstitutional, then the question becomes – was its necessary for “millions” to provide the government, and possibly bad actors with personal identifying information that can be used against them?
