IRS brushes off security bugs in new computers
Two new IRS computer systems that will eventually cost taxpayers almost $2 billion are being put into service despite known security and privacy vulnerabilities, a Treasury watchdog said in a report Thursday.
The office of the Treasury Inspector General for Tax Administration said Internal Revenue Service officials failed to ensure that identified weaknesses had been addressed before activating the systems.
Inspector General J. Russell George said it was “very troublesome” that the IRS “was aware of, and even self-identified, these weaknesses.”
The IRS, in a statement, said security of taxpayer data “is of paramount importance” and that, as noted in the report, the agency had implemented many of the inspector general’s recommendations and taken steps to improve security. It stressed that no taxpayer data had been compromised and numerous security safeguards were in place.
The report focused on the Customer Account Data Engine, which will provide the foundation for managing all taxpayer accounts, and the Account Management Services system, which will provide faster access by employees to taxpayer account data.
Both systems are gradually being put into use. CADE, expected to cost more than $1 billion through 2012 to develop and operate, this year processed about 20% of the 142 billion tax returns filed. The Account Management Services system, or AMS, will cost more than $700 million to develop and maintain through 2024.
The inspector general’s report said the IRS organizations responsible for giving the go-ahead to partial deployment of the systems were aware of security and privacy problems but did not consider them significant.
But, it said, those vulnerabilities increased the risks that unscrupulous people could gain access to vast amounts of taxpayer information with little chance of detection and that systems could not be recovered effectively during an emergency.
It said CADE administrators could access, modify and delete information without being detected, that contractors could make changes to system configurations without approval, and that backup tapes from off-site storage facilities were not adequately tested to ensure that data could be restored without errors or losses.
The report said the CADE system might be vulnerable to malicious code attacks such as computer viruses.
It said auditing controls for the AMS system were not sufficient to detect illegal browsing and changes or theft of taxpayer files.
The report recommended that the committee in charge of approving implementation of new stages of the systems consider all security vulnerabilities before giving that approval and that interim measures be put in place when significant security problems have been identified. It said the IRS agreed with their recommendations.
