Invoices documenting arms deliveries to the Polish armed forces are being fed into the national e-invoicing platform KSeF, with the finance ministry insisting the system has never been breached. Germany and France have written clear carve-outs for classified procurement, while Poland has not — and critics warn that a stack of ordinary invoices can expose more than any single document ever could.
The Ministry of National Defence and the Armament Agency have confirmed to WNP.PL that domestic suppliers send their invoices to the agency through KSeF. Both bodies say the content and the level of detail on those documents comply with tax regulations and with the act on the protection of classified information.
A single invoice carries little weight on its own. Item names, quantities, unit prices and delivery values are ordinary tax data. Read together across dozens of months, they can be used to reconstruct the tempo of deliveries, shifts in pricing, the real scale of successive batches and the shape of the supply chain behind them.
The mosaic effect around a PLN 8 billion contract
The Armament Agency’s order for Piorun MANPADS from Mesko is public knowledge, and the framework agreement is worth more than PLN 8 billion. The contract alone says nothing about how many units actually shipped in a given month. Invoices do — and once the documents of Mesko’s subcontractors are added, the picture extends to component demand and to newly appearing suppliers.
– The name of the goods, the quantity and the unit price did not appear on invoices because of KSeF. The VAT act has always required them. What KSeF changed is that this data sits in one place, in a structured form, easy to analyse – said Piotr Juszczyk, chief tax adviser at inFakt.
Juszczyk first pointed to the gap in a 26 September WNP.PL text headlined „KSeF zdradza wrażliwe dane zbrojeniówki, wojska i służb? Tysiące faktur tworzą efekt mozaiki”. The legislator gave the finance minister the power to exclude specific invoices from KSeF by regulation. No such exclusion exists today for supplies covered by classified information protection or for the defence industry.
The ministry counters that the scope of invoice data was already being reported to tax authorities before KSeF arrived, through JPK_VAT filed together with the VAT return. That is accurate, though a central, structured repository of invoices allows far more systematic work than periodic reporting files do.
Access rules and organisational drift
– All invoices sent to KSeF are subject to special protection rules, with the highest security and encryption standards applied. A separate security question concerns safeguarding access to invoices and granting the right permissions on the part of system users – the finance ministry said.
– It is crucial to properly plan and enforce the right security procedures by taxpayers themselves – the ministry stated.
Juszczyk sees permission management as the most practical weak point. Companies hand out access quickly, under deadline pressure, often wider than needed, and nobody reviews it later, he argues. An employee leaves, the accounting office changes, and a token stays active.
– Loss of control over access to invoices rarely comes from an attack. Far more often it comes from organisational mess: nobody at the company knows who currently has access and to what extent – Juszczyk said.
Col. Piotr Potejko, a former long-serving director of the classified information protection department at the Internal Security Agency (ABW), argues the problem reaches beyond military procurement. Police, special services and other state institutions face comparable exposure, since KSeF creates a fresh channel in which information can be pooled and combined — including details about equipment, suppliers, purchase volumes and the way given formations operate. He points to earlier cases in which analysis of openly available tender documents from the services allowed conclusions about their operational activity.
Berlin and Paris wrote exemptions; Warsaw did not
– Security issues of the system are fully addressed and treated as a priority. We apply appropriate procedures, mechanisms and internal controls that ensure a high level of protection – the finance ministry said.
– Due to the sensitive nature of these issues, detailed information on the solutions applied, including possible audits or technical documentation, is confidential and not subject to public disclosure – the ministry stated.
Tomasz Janas, president of PKF Advisory and advisory managing director at PKF Polska, says a security declaration alone does not close the case.
– Central collection of invoices for arms deliveries creates a risk that must be taken seriously. Bringing many documents together can allow the supplier network, the scale of purchases and the rhythm of deliveries to be reconstructed – Janas said.
– Invoices in KSeF are not public and the system has access control and encryption mechanisms, but without an independent assessment of those safeguards, granted permissions and access monitoring, one cannot conclude that the protection is sufficient for transactions — particularly those important for state security – Janas said.
Germany’s e-invoicing rules exclude invoice data protected as classified information. France applies a similar principle: orders covered by secrecy, requiring special security measures, or where the imperative of defence or national security speaks for it are exempt from the e-invoicing obligation. Poland has no equivalent carve-out for defence purchases.
Military procurement will be discussed at the „Przemysł dla obronności” conference in Katowice on 14 October, with registration open.
Źródło: WNP.PL, Fot. commons.wikimedia / U.S. Army Reserve / Staff Sgt. Emilie Lenglain
