Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

IRS Freely Gives Out Employee User Name/Password Info

Posted by Zonk on Sun Aug 05, 2007 02:16 PM
from the thanks-uncle-same dept.
Security The Almighty Buck United States
An anonymous reader writes "The Treasury Inspector General for Tax Administration reports that its inspectors were able to get IRS employees to improperly disclose their user names and passwords over 61% of the time. 60,000 of the IRS's 100,000 employees and contractors thus are susceptible to computer hackers, putting personal taxpayer information at risk for unauthorized disclosure, theft and fraud. 'Only eight of the 102 employees contacted either the inspector general's office or IRS security offices to validate the legitimacy of the caller ... The IRS agreed with recommendations from the inspector general that it should take steps to make employees more aware of hacker tactics such as posing as an internal employee and to remind people to report such incidents to security officials.'"
+ -
story

Related Stories

[+] IRS Data Security Still a Concern 54 comments
Lucas123 writes "Computerworld has a story about the possibility and the potential ramifications of an IRS data loss similar to the UK's recent mishap. According to one World Bank executive, it could have already happened, 'and we don't know about it.' While the IRS does offer data encryption to its workers, more than half of its 94,000 employees have permission to take taxpayer information to locations outside the IRS offices. In the 2007 filing season, roughly 128 million individual tax returns were filed. In addition to the basic personal information on those forms, an IRS breach could also jeopardize the banking information of the 46% of filers who requested direct deposit refunds. This is not the first time that IRS security has been called into question, and the Department of Treasury's progress in that arena is dubious. [PDF]"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

IRS Freely Gives Out Employee User Name/Password Info 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Misleading title... (Score:5, Informative)

    by Tokimasa (1011677) <(moc.liamg) (ta) (snewo.j.samoht)> on Sunday August 05 2007, @02:23PM (#20123977) Journal
    No taxpayer information was given out...just the IRS employee's user name and password for the internal IRS system (through which someone could potentially gain access to taxpayer information).
    • > No taxpayer information was given out...just the IRS employee's user name and password for the internal IRS system

      I think you parsed the headline incorrectly, let me help you with that:
      (IRS
      (Freely Gives Out)
      (Taxpayer
      ((User Name/Password)

    • Re: (Score:3, Interesting)

      by Mistlefoot (636417)
      Which means a lot. As someone who works for a company where log-ins are important I see huge issues with this. Any disgruntled employee who knows the password information of someone else can freely do incredible damage. While changes to any account (in our system) are trackable - those tracks lead to the person who logged in and made the changes.

      What's to stop one of those 100,000 employees from doing something to their hated neighbour, mechanic, or whomever; while logged in as someone who gave out their

    • Re: (Score:2, Informative)

      by Urza9814 (883915)
      Ok, so I'm replying to this guy twice, but I just noticed he has a +5 informative rating on this post, which is completely ridiculous.
      I should go post on the 'The Study of Physical Hacks at DefCon' saying the title is misleading because it implies that the hacks are taking place on a computer. Except...no, that would actually make some sense, since that's a common usage of hack. People would actually understand where I'm coming from on that one. The above statement is mind-blowing in the sense that it is co
      • The title is simply worded poorly. It should say "IRS employees unusually susceptible to social engineering schemes". Face it, if they're willing to give out their own username and password, it wouldn't take much more skill for someone to convince them to give up information about people they don't even know if you presented the request in a believable manner.

  • The Human Hack (Score:5, Insightful)

    by EmbeddedJanitor (597831) on Sunday August 05 2007, @02:25PM (#20123999)
    I worked in the physical security industry for a while... designing and installing card-swipe style security systems for buildings etc. What we found with some of our research was that no matter what your physical security set up, the major holes in the operating security system were due to people. Security staff would buzz people through with no card. Tailgaters would get through on someone elses card. People would pass back their card for someone else to get in.

    The greatest security measure of all time was probably the Great Wall of China. That got breached by bribing a gate guard (OK, bribing him with his life...).

    With all the fancy immobilisers etc, many cars still get ripped off because people leave their doors open or their keys in the lock.

    Security in computing etc only changes where the action happens. People still fundamentally operate the same way.

  • 60% "susceptible to computer hackers" (Score:4, Insightful)

    by multisync (218450) on Sunday August 05 2007, @02:31PM (#20124051) Journal
    Not to mention CEOs [slashdot.org].

  • Holy $h!t!!! (Score:5, Insightful)

    by rolfwind (528248) on Sunday August 05 2007, @02:35PM (#20124079)
    The IRS has 100,000 employees! What a drag on the economomy! Imagine if each one costs $5-10K an average per month in salary, health care, space, pension -- what that all adds up to.

    Ron Paul is right, get rid of that juggernaut.

    • Re:Holy $h!t!!! (Score:4, Insightful)

      by Invidious (106932) on Sunday August 05 2007, @02:55PM (#20124243)
      Average employee costing $5-10K a month? LOL! The largest portion of IRS employees are GS 3-6, making, at the top end of that scale, about $17/hr (and that's if you're in NY or somewhere else that qualifies for the largest locality pay increases.) Tack on witholding (which just goes back to the IRS, at least temporarily, and you can bet your ass they're getting interest on that) and deductions for health care, SSA, TSP investment and such, and the average employee is taking home 2K/month. If they've got health insurance -- and a lot of the employees don't, particularly among the part-timers, temp, and term employees -- that's maybe an extra $300-500 in premiums covered by the gov't.

      • Re: (Score:3, Informative)

        by rolfwind (528248)
        However, future entitlements have to be factored in, pensions which I think you are underestimating, and space. People don't work in the outdoors. They were in buildings that have to built and paid for, with airconditioning and maintenance, and do they use computers? A car?

        I looked up the budget for the IRS in 2008, a little more than $11B. Divided by 100K employees, that is $9167 per employee per month to operate - so I guess I am correct.

        • Re:Holy $h!t!!! (Score:4, Interesting)

          by Fulcrum of Evil (560260) on Sunday August 05 2007, @03:28PM (#20124411)
          And the GNP is $40T. Really, who cares about a cost of collections of .025%?
          • Collections were 2.2T in 2006, not $40T. You can't base cost of collections on GNP, that's just stupid.

          • Re: (Score:3, Insightful)

            by QuantumRiff (120817)
            Hate to hop into this argument, but wouldn't the cost of collections be taken from the $3T they actually collect? So its more like .3%.. Still a small amount, but still several times higher.. GNP is a big number people like to use to make other things seem soo much smaller and insignificant..

      • Re: (Score:3, Insightful)

        by AaronLawrence (600990) *
        Salary/wages are usually less than 50% of the total cost of an employee. The cost of the office rent, power, PCs, desks, support systems, infrastructure, and all the people who maintain those things is at least as much as their salary. So your figure of 2k probably comes out to 5k in total costs.

    • Re: (Score:3, Interesting)

      by jcr (53032)
      The cost of IRS employees is noise. The real drag on the economy is excessive government spending, but even without getting a lid on the congress's profligate ways, there's a better way to collect the money, while doing far less damage. See here. [fairtax.org]

      -jcr

      • Re:Holy $h!t!!! (Score:4, Funny)

        by The One and Only (691315) * <phil@philwelch.net> on Sunday August 05 2007, @05:08PM (#20125163) Homepage
        You misspelled "worse way", "more damage", and "I don't know anything about economics".
        • Oh, you're so clever. Are you a lobbyist or a congressional staffer?

          -jcr

          • No, quite far from it. I'm just a guy who would rather have a 10% smaller paycheck than pay 30% sales tax on everything I buy. And, honestly, unless you're at the point where you're saving or investing most of your income, switching to a national sales tax will only hurt you.
            • I'm just a guy who would rather have a 10% smaller paycheck

              Ah, I see you're in the market for a bridge.

              You're paying far more than 10%.

              -jcr

              • Am I? Maybe, I don't have my tax returns handy so I can't say. But I would be paying even more if it was a sales tax. They were example numbers, anyway--I wouldn't exchange a 20% income tax for a 50% sales tax, either. I didn't really want to spend the time working out a rigorous mathematical relation, and if I did, it would probably obscure my point more than illustrate it.

                The point is, if you take the same tax burden (doesn't matter what size it is) and distribute it among sales taxes, you're going to ge

            • Ah, I see you Americans are barely getting used to the idea of what we Europeans call "Value Added Tax".
              The fun part however (not in the "ha, ha, funny" way however) is that you'll probably get that AND THEN KEEP everything else in place too.
    • I like Paul, too. A rarity among the swine who dominate American politics. In fact, he appeals to me more than do any of the leading Democrats, although I am to the left of all of them.

      Paul's anti-war and anti-IRS positions address our central problem: we cannot sustain our misshapen and violent empire, nor should we try.

      Under the mutant Reagan-Clinton-Bush vision of government, tax revenues are collected primarily for military expansion and subsidizing corporate profits. Meanwhile the essence of any

  • It took this long for this to hit /.? (Score:5, Interesting)

    by Invidious (106932) on Sunday August 05 2007, @02:35PM (#20124083)
    Actually, I work for the IRS, so let me set the record straight. I've seen the original paper, which was published months ago: the users involved didn't give out their passwords, they changed them to one requested by the "tech support" person (and these calls came in to extensions which the public doesn't really have access to, for the most part.) Still highly stupid, but most of the people at the IRS don't know much about computers, and while they've generally got "don't give out your password" down, they didn't seem to equate this to "if you change your password to something someone suggests, that's the same thing."

    Also, this is mostly an internal threat; without access to the IRS intranet, I'd say that 99% of those compromised accounts would be useless to someone outside the IRS.

    But, whatever. This is what happens when you have what amounts to a major data center staffed primarily by people who're just barely computer literate. AFAIK, memos about the problem have gone out to ~everyone and meetings have been held at the lowest levels to inform the staff that doing this is Bad.

    What's really fucked up is that several of the employees that fell for this were at the highest GS levels. I can understand how the problem would be prevalent among the lower-level off-the-street employees, but you'd think that someone who was getting paid $100K+ a year would have a clue about data security.

    • What's really fucked up is that several of the employees that fell for this were at the highest GS levels. I can understand how the problem would be prevalent among the lower-level off-the-street employees, but you'd think that someone who was getting paid $100K+ a year would have a clue about data security.

      Trust a government employee to fail to realize what's really fucked up about the situation.

      What's really fucked up is that the IRS, which asks for, demands and is granted access to a great deal of

      • Stupid? (Score:4, Interesting)

        by Slashdot Parent (995749) on Sunday August 05 2007, @03:08PM (#20124315)
        Well, he did his undergrad at Yale and has a Harvard MBA. He flew fighter jets (F-102s) in the national guard.

        Can you fly a fighter jet? I can't.

        You would have an easy time convincing me that several negative adjectives describe President Bush. However, you will have difficulty convincing me that the man is stupid.

        • Re: (Score:3, Insightful)

          by iminplaya (723125)
          Can you fly a fighter jet? I can't.

          He couldn't either before he was trained to. Could you learn to fly a fighter jet? Probably.

          As far as his school is concerned, that's just rinding daddy's coattails. And his business deals with Enron and the Rangers shows just the kind of education he received. It's too bad he's not stupid. That would be his only saving grace.
          • Um, no. Daddy's coattails help to get in the door, but graduation still requires passing the courses.

            -jcr

            • At certain good MBA programs failing to pass would require killing half the faculty and even that may not do the job. Basically signing up for a class gives you a B and you can only go up from there not down (no matter how much you piss off the professor they just bow their heads because you're paying for it).
              • You know, one rich kid did get away with an honor code violation. He cheated on a Spanish exam, and should have been expelled per the school's honor code. That rich kid was Teddy Kennedy, and the school was U. Va.

                Now, if you want to claim that any other person, including Bush, cheated in school, then the burden of proof is yours.

                -jcr

        • Well, he did his undergrad at Yale and has a Harvard MBA. He flew fighter jets (F-102s) in the national guard.

          That might mean something if you believe his participation
          each of those programs was based only on merit and not family wealth and connections.

        • Re: (Score:2, Informative)

          by localman (111171)
          You think flying a jet makes you "smart"? Sure... smarter than your average bear, but we're talking about the president of the US here. I don't think being a fighter pilot indicates that you have the strategic thinking abilities and grasp of subtlety needed to lead the country.

          I've worked with a number of Harvard folks, MBAs and more. Yeah, they're smart, but they can be stupid in many situations, like anyone. I doubt any one of them would be a particularly smart president. And neither is Bush. He's b

        • Can you fly a fighter jet? I can't.

          I probably can. This means that I could probably get in one, take off, fly in a big circle and possibly land without killing myself (landing's the hard part). If I was rated on a medium sized prop plane, I'd upgrade that to 'definitely'. Still doesn't tell you if I'm at all smart.

          • Monkeys can be trained to pilot space vehicles too.

            No monkey ever piloted a space vehicle. They were put aboard capsules that followed a programmed flight profile.

            -jcr

      • There's a huge difference between stupid and inarticulate.

        Bush is one, but certainly not the other.
          • He's not a genius by any stretch, but he's smarter than the average politician (which doesn't sound like much, but...)

            You are assuming his aims and goals of the Presidency are the same as what you think they are. If he was seriously trying to make America "better" and so on and so on, then yes the evidence is that he's an idiot. My suspicion is that he's not an idiot, it's just that his goals weren't to be the best President the nation had ever seen and to make America "great", and hence if you think they a

  • they should be sacked... (Score:3, Interesting)

    by advocate_one (662832) on Sunday August 05 2007, @02:58PM (#20124261)
    then the rest might just start taking things seriously...

  • People need to grow some balls (Score:5, Insightful)

    by HalAtWork (926717) on Sunday August 05 2007, @03:19PM (#20124367)
    People need to grow some balls when it comes to these situations. They're afraid of offending the person on the other end, they think they're suggesting that they're liars or frauds. Really, it's just a precaution for your own ass (you'll get fired) and your business (their normal operations can't be disrupted by random people).

    Then again, administrators, executives, etc need to be more patient and understanding when what they say is challenged. They can't get an attitude or it will cause people to react by defending their character; i.e. if a less confident individual is accused of incompetence, audacity, or whatever for challenging another, then they will be more likely to feel that it is audacious or incompetent to verify a workplace activity.

    Using social engineering to get people to give up their passwords? People were already socially engineered to be susceptible, and afraid. Places of businesses need to have employees treat each other with respect and make it clear to the employees that they have a right to challenge the legitimacy of any workplace situation.

    • Some balls ... a little story (Score:4, Interesting)

      by pbhj (607776) on Monday August 06 2007, @05:54AM (#20128497) Homepage Journal
      I part-own a ceramic cafe. A sales person visited to encourage us to switch to accepting Amex (IIRC). After all the blah-blah I said "sounds fine", he says give us your bank details (on the form for Amex).

      So, I wanted to get some verification of his ID. He shows me a photo card, OK. Can I ring your boss? He didn't have a number I could call (eg on the Amex literature) only some number on his business card (I spoke to the guy on the other end, but all this shows is he knows someone with a phone!). Even if I could have had that number on the literature how would that verify him, me thinks, easily faked.

      It turns out he was genuine (or an Amex insider!) - I eventually managed to chase him through the Amex phone system. But without some means to check his ID the transaction never happened.

      The thing is this. Clearly no-one else ever bothered to ask for (proper) identification - there was no system in place. And this for a major financial institution that relies on proper ID.

  • There are bigger risks for the IRS (Score:5, Interesting)

    by Alain Williams (2972) on Sunday August 05 2007, @03:24PM (#20124387) Homepage
    Yes: people should know better; training should be better. However with 100,000 employees there will be many who can be 'bought', they may have finance problems (drugs, gambling, divorce, ...). For a bit of cash you could get the info that you want without having to get access to internal systems and know any passwords.

  • Social Engineering (Score:5, Insightful)

    by nurb432 (527695) on Sunday August 05 2007, @03:27PM (#20124403) Homepage Journal
    Is always the most effective way into a 'system'.
      • A lot depends on what user you manage to con.

        Some do have high enough rights to cause damage, but i agree most dont.
  • That kind of bad training doesn't happen overnight. Where is the US Cybersecurity chief [wikipedia.org], who should be making sure that government agencies use proper security practices? Do we even have one, after every other one since Bush created the department has resigned in disgust?

    And is the current one as fired as is the clueless one in _Live Free or Die Hard [imdb.com]_?

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.