IRS Data Security Still a Concern

Lucas123 writes "Computerworld has a story about the possibility and the potential ramifications of an IRS data loss similar to the UK's recent mishap. According to one World Bank executive, it could have already happened, 'and we don't know about it.' While the IRS does offer data encryption to its workers, more than half of its 94,000 employees have permission to take taxpayer information to locations outside the IRS offices. In the 2007 filing season, roughly 128 million individual tax returns were filed. In addition to the basic personal information on those forms, an IRS breach could also jeopardize the banking information of the 46% of filers who requested direct deposit refunds. This is not the first time that IRS security has been called into question, and the Department of Treasury's progress in that arena is dubious. [PDF]"

Re:

[account_deleted]

Comment removed based on user account deletion

Re:Ron Paul...

[Harmonious Botch]

Parent presumably means removing the IRS.

Re:

[gambolt]

Or we could just abolish money. That's just as practical and reduces the level of complexity in our society immensely.

A side effect is that all the leftover currency could be given away as free origami paper.

Re:

[darjen]

Or we could just abolish money. That's just as practical

Have you taken your pills yet today? This country could get along just fine without the IRS. Money, I'm not so sure.

Re:

[timeOday]

No, the country could not get along without the IRS - that's the point. Ron Paul's scheme would still require administration and enforcement - i.e. the IRS, even if by another name.

Re:Ron Paul...

[darjen]

If the income tax was also abolished, there wouldn't be a need for administration and inforcement.

Re:Ron Paul...

[vertinox]

Or we could just abolish money. That's just as practical and reduces the level of complexity in our society immensely.

Really? I'm pretty sure you've never looked at a tax form before.

The problem is that the IRS was created to solve a problem (social security) which will be a moot pint in 50 odd years unless something else is done.

Re:

[dbIII]

Get them to take a hard line on taxing the Scientologists again - that should do it.

Why take data out of office?

[rueger]

...more than half of its 94,000 employees have permission to take taxpayer information to locations outside the IRS offices.

It seems to me that most of the data breaches from large corporations and government come from just this - employees taking data files out of the office and losing them. Why of why don't employers simply insist that data stays on the premises? Surely keeping data in a secure physical location is the first step to safeguarding it.

Re:Why take data out of office?

[dbIII]

In my case I had to take things as far as two members of the board to stop an accountant taking the laptop with the only functioning copy of the application that handles most of the financial information on holiday to Bahrain of all places (at the start of the recent Iraq war). People really think these things are their own personal possessions and are convinced that they will not be stolen even if they leave it unattended on a beach in another country.

Traveling laptop your #5 problem ...

[AHumbleOpinion]

In my case I had to take things as far as two members of the board to stop an accountant taking the laptop with the only functioning copy of the application that handles most of the financial information on holiday

I hope your board members recognized the four more important problems as well. Your top five problems:
(1) Management allowed (2), (3), (4), and (5).
(2) The accountant allowed (3) and (5).
(3) You have one and only one system capable of running a critical application.
(4) This critical application is not being run on enterprise grade hardware.
(5) The accountant wanted to take the system on holiday.

If your board only addressed the laptop/holiday add:
(0) Board allowed (1), (2), (3), (4), or (5) as appropriate.

Re:

[N1EY]

I do not believe your story. Who has an AIS or any part of it running on a LAPTOP? Has any Slashdotter besides me seen a real system running on Oracle? Or Great Plains?

Re:

[dbIII]

Small companies (only a couple of hundred people) do such things. It often comes down to the number of licences. The situation was ridiculous in many ways. If you only have one licenced copy of a critical application it should not be on a machine that can be carried out of the building. Many things could be put down to paranoia and other character issues which is why involvement of the board was eventually required and not just the CEO. If you do not trust IT to back up a system and do not do backups y

Re:

[wizardforce]

exactly, I don't think there is a good enough reason to justify anyone taking people's private data on their laptops *at all* and even if they needed to [which I severely doubt] the data should always remain encrypted! there should never ever be a time when the data is readable without the proper secure passphrase/key. not only that, it should be the highest encryption they can find not the ROT 13 equivalent.

Re:

[Artifakt]

I don't doubt that it can be needed. IRS agents have to appear in court sometimes, either tax office courts that are not in their work locations or regular courts. The also have to contact some clients in the field, i.e. going to a business to look at its records. Often, tax law actually says a business must forward certain records automatically, but must retain other records on site for inspection. Plus the IRS is responsible for checking to see if retained copies match transmitted copies if there's doubt

Re:

[jonbryce]

If the IRS want to audit a mega-corp, they have to visit them on site. There is just too much stuff to look at for it to be practical to do it any other way.

Re:

[Kevinv]

Many IRS audits, especially business ones, are conducted on-site at the place of business (or at the accountants office). The data has to leave the IRS in these situations.

The alternative of course is to force the business to bring all their data to the IRS. Not sure anyone really wants that.

The IRS has begun implementing whole disk encryption which is a good step.

An additional step would be to ensure the data leaving on the laptop is only appropriate data for the case(s) the auditor is leaving for and not

Re:

[rueger]

An additional step would be to ensure the data leaving on the laptop is only appropriate data for the case(s) the auditor is leaving for and not old cases lying around that they forgot to delete.

Exactly. What I was thinking of are those stories of X million customer records being lost when some idiot loses a laptop or DVD. What possible reason could there be for carrying that much data off-site? (Backups excepted obviously)

Re:

[N1EY]

I had thought we made the Green Move some time ago. We are allowing employees to work from home in order to reduce transportation costs and the damage to the environment. The productivity gains and improvement in employee morale would also be important to the IRS. So we can't allow them to telecommute? You didn't think the other thing. The guy comes out with his laptop in order to review YOUR RECORDS on site. Sheesh, I guess no one else here has been audited by them!

Maybe a white hat will break into IRS ...

[AHumbleOpinion]

Maybe a white hat will break into the IRS and encrypt all the files for them. Hope he doesn't lose the key before he anonymously mails it to them. :-)

Re:

[AHumbleOpinion]

Because we don't allow people, who don't follow certain rules and don't have a basic understanding of what a car can or can't do drive. Why don't we apply that rule to a piece of technology that surpasses the sophistication of a car by a hundred years of technological advancement ?

Because computers don't kill. Well consumer stuff, at least not yet.

Re:

[ScrewMaster]

Because computers don't kill. Well consumer stuff, at least not yet.

Precisely. And even if poorly-operated personal computers resulted in the deaths of their operators and innocent bystanders as often as motor vehicles do, it wouldn't matter. The GP doesn't realize that certification means squat. Having a piece of paper that says you know or understand something often has surprisingly little relevance to what you actually know or understand, it just means that you could convince someone in authority, at

Direct deposit

[whois_drek]

an IRS breach could also jeopardize the banking information of the 46% of filers who requested direct deposit refunds

How could this happen? If I remember my last tax form correctly, I just put my account number and bank routing number on it. Getting this information doesn't allow an attacker to withdraw any money. Perhaps it gets them one step closer, but it's a small step.

Re:

[moreati]

As I understand the situation. Name, address and bank details alone cannot be used to withdraw money or take out bank loans. However they provide useful leverage when fraudulently making consumer purchases with in store credit or fabricating/stealing an identity.

A phishing attempt that included one's name, address, bank & tax details would be very convincing indeed.

Alex

Re:

[Anonymous Coward]

Name, address and bank details alone cannot be used to withdraw money

Many merchants who accept paper checks turn them into "electronic checks" which debit your checking account directly at the next clearing session (usually 10pm to 5am). The account number and the amount are the only two required pieces of information, but who receives the money is well known. This is the mechanism used by automated payment for utility bills, subscriptions, etc.

Re:

[TykeClone]

As I understand the situation. Name, address and bank details alone cannot be used to withdraw money

You understand incorrectly. A name, routing number, and account number would give a criminal enough information to send through fraudulent transactions to that account.

Re:

[moreati]

Wow, financial identity is even more screwed than I thought. Thanks for the clue. Do you know if this applies just to the US, or to the UK also?

Re:Direct deposit

[TykeClone]

The United States has a system called the Automated Clearing House (ACH) network that is used to move deposits and payments electronically between banks. If you have any ACH items hit your account, Regulation E kicks in giving you as a consumer certain rights about how soon you must report bad or fraudulent items before you are out of luck (60 days from the statement that the item appeared upon).

An ACH transaction != financial identity. If I have that information about you and have access to the payment system, I can fraudulently send out ACH items and hope to collect enough to make it worthwhile before I'm shut down. This information, however, does not allow me to open a loan or credit account in your name. It sucks, but it's not identity theft.

I'm sure that the UK does also have some sort of an electronic transaction system, but I've got no idea about what it is and how it works. You guys have a different style of banking than we do in the US. We have a few major, major players, but also a very large number of small "community banks" and credit unions. The ACH network in the United States was set up as a clearinghouse to basically send transactions to a large number of different banks. If I understand things correctly, the UK doesn't have the smaller financial institutions like we do, so the electronic transaction systems may work differently there (to say nothing of the regulations defining how they work!).

Re:

[jonbryce]

You can set up a fraudulent direct debit with just the account number and sort code. I had someone do that to me once - 86p to Carphone Warehouse. It did get refunded immediately when I complained.

Re:Direct deposit

[Clomer]

I used to work for a check printing company, and I can tell you that the most common type of check fraud is where someone orders checks with someone else's routing and account information. If you have a person's income tax statement complete with name, address, and bank account information, then you have all you need to order fraudulent checks. Heck, you could even have your name printed on them, but have the fraudulent account number info on the checks. You'd be surprised how easy it would be to cash such a check.

Not that I would recommend it: we, at the check company, were taught certain red flags, things to watch for that may indicate a fraudulent order (and a good CSR won't let it on that they suspect you), and I won't go into those details here. And the penalties are pretty stiff if you are caught.

The devil is in the e-file

[Anonymous Coward]

The biggest risk is not the IRS itself, but rather the e-file cabal of the IRS plus the companies that process and reformat your data for submission to the IRS. For instance, the TurboTax privacy statement [intuit.com] and full text [intuit.com] both promise certain steps, but there are gaping holes. Intuit keeps a copy of an e-filed return for at least three years, yet does not promise that the storage is encrypted. Data transmission from you to Intuit is encrypted (via 128-bit SSL), but some returns sent from Intuit to various agencies are NOT encrypted during transmission. Intuit claims that other companies providing services to Intuit may not use your data, but that does not prevent a breach if some employee does not follow the rules.

And of course any subpoena, court order, or National Security Letter presented to Intuit has full access to all your data, including aggregation (database "join" on SSN, phone, address, etc.) with various data brokers who market their services aggressively to Department of Homeland Security, etc. With the IRS itself you have some protection; with the e-file cabal you nave none.

What happens?

[madsheep]

Forget the U.K.: What happens here if the IRS loses our data?

Hmm, I don't know, not a whole lot? Just using the number of publicly reported data breaches and privacy information losses, I would just work on the assumption someone has this data already. It's not like there aren't dozens of websites where someone can pay $15 and get all this same information anyway. What's the best you can really hope for? That they give you a free year of credit monitoring? Maybe they'll fire someone or penalize them? Who knows.. I just say work under the assumption someone has this data already. What are you doing right now to protect yourself?

Banking Data? - Already on Checks

[kwpulliam]

How exactly will 46% of filers banking information be comprimised? -

From TFA "That translates to a lot of personal and banking details maintained by the IRS." - Those banking details are the same ones you hand out every time you write a check.

The information included on the return for direct deposit is 'exactly' the same information printed on the front of a check in human readable format.

If ANY of those households paid with a check to any retail establishment (where the clerk probably makes less than $10.00 an hour) then they have already released this information themselves.

I understand data security and the problems of taking confidential data out of the workplace, but the banking details portion of this story needs to be taken with several grains of salt.

Just because you have a banks routing number and a checking account number, this does not mean you can turn that into cash at an ATM.

Re:

[value_added]

Just because you have a banks routing number and a checking account number, this does not mean you can turn that into cash at an ATM

Agreed that such concerns can be over-dramatised or exaggerated, but the current state of affairs is such that the advancement or implementation of new technologies is often a few steps ahead of someone sitting down to analyse all the possible issues, and even more steps ahead of public awareness. That can be too slow a time line, especially when you factor in the time require

Ask any 5 IRS employees...

[innerweb]

A question and you are likely to get 10 different answers that may or may not be correct.

How the IRS is allowed to operate the way it does is beyond me. How the tax laws are allowed to remain so confusing and frustrating is beyond me. But, obviously it is not cost effective to those that matter to fix it.

If the tax laws were cleaned up, then maybe IRS employees might be able to handle many more individuals per specialist. If the tax laws were cleaned up, then maybe the IRS would be able to do all of its work at work. Just maybe.

InnerWeb

Scare Reporting

[Grech]

Full Disclosure: I work for the IRS, and have a business need to take OUO or SBU data outside of the campus where I work from time to time.

Glossary:

• OUO: [O]fficial [U]se [O]nly.- This is a class of information
• SBU: [S]ensitive [B]ut [U]nclassified This is the category into which all identifiable taxpayer data falls, and falls under the protection of IRC 6103 (with consequences defined in IRC 1203)

The article here is pure scaremongering, though it does at least touch on some of the procedures the Service used to secure taxpayer data. The article makes the following points.

1. The IRS has lots of sensitive data
2. If individual people tasked with protecting sensitive information do stupid things, it will defeat any security measure.

When a laptop is issued, it gets whole disk encryption that can't be turned off by the user. Similarly, when the IRS issues other portable devices, they get the same. The rule, of course, is that you don''t hook up anything the IRS doesn't own to anything it does, so personal thumb drives and home networks should not be an issue, and we make the point every time we issue hardware. Similarly, the article talks about unencrypted drives on Campus machinery, but if someone has penetrated the physical security of the Campus and actually swipes one of these hard drives, things have already gone horribly wrong.

If the IRS lost a great whacking load of SBU data, of course it would be a disaster, this is nothing new, and is obvious. The article makes it seem like it's inevitable or in immediate danger of happening, and this just isn't true.

Re:

[Grampaw Willie]

The article here is pure scaremongering

you don't expect us to believe that do you?

IRS far more frightening than IRS data leaks

[MSTCrow5429]

I'm more terrified of the IRS, not that it will lose data on me. The IRS ruins peoples lives for fun, and the employees are sociopathic or amoral.

Re:

[jav1231]

I don't know that I agree that they do it for fun and are sociopathic but there no doubt their tactics are scary. I think Mike Huckaby said, "People are more afraid of the IRS than being mugged!"

Re:

[MSTCrow5429]

"People are more afraid of the IRS than being mugged!"

What's the difference? At least you can shoot the "bad" mugger.

Yeah, well ...

[ScrewMaster]

IRS Data Security Still a Concern

The IRS' data store is always a concern, whether they lose track of it or not.