Slashdot Mirror
IRS Leaves Taxpayer Data Largely Unprotected
LogError writes "Two weeks ago, Department of Treasury received a D-minus grade in the Federal Computer Security Report Card for 2005, down from a D-plus grade in 2004. The majority of Treasury systems are those belonging to IRS. The government-wide computer-security grade for 2005 was D-plus, while Homeland Security and Defense both received an F. Grades are based on reports submitted to Congress by the agencies; the reports are required under the Federal Information Security Management Act of 2002.8 The scores are meant to reflect whether departments meet federally mandated security standards."
This is why I refuse to pay income taxes!
IRS Leaves Taxpayer Data Largely Unprotected
This story acts as we should be surprised. The government serves the people. The IRS, on the other hand, serves the government. I let you figure out where the disconnect is.
Javascript + Nintendo DSi = DSiCade
Who in their right mind would hack into the IRS sure it would be nice to add a zero to my return but you don't f*** with the IRS.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
Cost of providing security against non-existent WMDs that couldn't reach the US even if they existed ... $100 Billion
... $400 Billion
... $0.0005 Billion (of $500 million)
... Priceless!
Cost of providing security against al-Qaeda attacking US from Iraq, even though they weren't there
Cost of providing security against really obvious IRS forms that let people steal your money and assets easily
Realizing you've been taken to the cleaners due to your own gullibility
-- Tigger warning: This post may contain tiggers! --
Here's a question. What does it cost the IRS if taxpayer data is stolen?
Oh yeah. Squat. Why *should* they care? It's no skin off their back.
If our government wanted to make sure this didn't happen, they'd fine the IRS every time there was a security breach. In fact, they'd fine the IRS just for having bad security. And then things would improve.
'Course, in reality, why would they do that? There's no reason our government would want to hurt the IRS in any way.
Really, what should be happening is the people of America suing the IRS for not guarding our information properly. I wonder how *that* lawsuit would go.
Here's the fundamental issue: If you want someone to behave in a certain way, you have to make it worth their while. Right now the IRS has no incentive for keeping our info safe. Want to change that? Change it at the source.
Breaking Into the Industry - A development log about starting a game studio.
I mean, wouldn't you much rather have a national government that was more like you, instead of some kind of intellectual-elite government scoring all "A"s? Better to have a government that understands people like you than a government that is out of touch with mainstream American values, I say!
(Break out the hookers and blow! Party at Treasury!)
Obliteracy: Words with explosions
This is why I refuse to pay income taxes!
Careful, they got a D- in protecting data, but they have an A doubleplus in 'tracking your ass down and throwing you in jail'. ask Al Capone.
IRS Leaves Taxpayer Data Largely Unprotected
lnk plz.
ok thx
[Fuck Beta]
o0t!
Sounds like we need a Department of Homeland Insecurity...
Stop by my site where I write about ERP systems & more
No shit ?
It's not like many agencies have gone up:
o mputer%20Security%20Report%20Card%20-%202005.pdf
http://reform.house.gov/UploadedFiles/Federal%20C
If you're not seeing your favorite bureau its either too small (FTC) or, like the IRS, under a larger department (Census, ITA, NIST, etc.).
I work for a company that creates electronic filing software for the IRS, and I work with them on a regular basis. While Electronic filing has really only been popular the last few years its history goes back a very long time (in computer years). For example, currently to file a form 1040 electronically, it gets formatted in custom text format, attached to a whole bunch of other forms, gets all sorts of headers and summary information tacked on. It gets gzipped, then pushed through a z-modem connection over a telnet session, inside of an SSL connection. Why? Because it evolved that way. There was a time when electronic filing meant putting magnetic media in the mail. So the file formats go way back and are all fucked up because they are constantly updating the forms in respons to legislation. when they stopped with the magnetic media and started using modems, the whole thing was run like a BBS, so ta-da z-modem. When the bbs system was moved to the internet, it became telnet. Then they said oh shit its on the internet, we need encryption, so they moved that into an SSL connection.
Case in point the whole system is fucked up because its doing things it was never designed to do. So now we introduce Modernized E-File. MEF is basically the IRS rebuilding its entire system from the ground up. File formats are getting moved to XML, the network connections are moving to SOAP, and all sorts of other cool stuff.
Given the amound of stuff thats going on right now I would expect them to be scored poorly because basically the existing system is held together with duct tape while the new system is being built, and the new system probably wasn't considered in the score since its not completly up and running yet.
Slashdot is an anagram for Has Dolts, and I am Dolt number 468543
Hookers and blow?!
Sounds like 1970's W. is back in the house!
We all knew this already. If a chick like Trinity could hack into the IRS... how good could their security be?
Let's be fair here. Isn't a D-minus really an F? Let's not split hairs, people. If I got a C-minus my scholarship would have been dropped. Can't we drop them from the government for not even grading an average C?
Developers: We can use your help.
What IRS data have "lawmakers" which are supposed to be people we elect to make decisions for us deemed important to homeland security? My income and work/education related expenditures aren't something I think of when I think of defending the homeland.
In 2004, the Department of Commerce got an F.
In 2005, the Department of Commerce got a D+.
Clearly, they must have improved slightly. Why didn't anyone highlight these improvements to show the DOJ, NRC and Treasury that, even if you're completely retarded, you can still make some improvement?
[o]_O
Did any department pass?
In other news, the department of agriculture passed with flying colors. Though they haven't figured it how to plug in their 486 yet, so it's not entirely a fair fight.
Zing!
It's pretty funny the department that gets the most funding gets a F grade. What a joke!
Meanwhile NASA only gets a drop in the bucket.
I refuse to do my taxes via e-file. The having to use a third party program also doesn't help.
Will departments use low scores to justify increased budgets for security related projects? According to the article, the scores were reported by the departments themselves. Surely it will be easier for the IT supervisor of a "D-" departments to hire more security specialists than it will be for the IT supervisor of a "B+" department.
So they get a D-.
Big deal!
They are a very sucessfull agency. They have been providing the 'bread' for the U.S. Government for years.
Mrs. Thompson of McCall Junior High School in Winchester,
Massachusetts gave me a D- in English during my eighth grade.
Do I let it bother me?
No!
I am just as happy as I could be.
In fact, I knew someone who was a streight A student.
His achievment? The methadone clinic.
As Dr. Norman Paul, or Lexington Massachusetts; my
childhood phychiatrist; told me, don't let the little
things bother you. You can only be your true self to be
happy.
I see the IRS as quite happy right now.
Luv
Cleara
Cleara
The problem is obviously the report cards. They got a D+ on a report card, which resulted in getting a D- on the next one. If they didn't give report cards, we wouldn't have to read news stories like this, which make us feel so bad. Instead we'd just read news about getting robbed after their ID was stolen from the IRS, making them unable to pay their taxes, and going to jail in place of the IDnappers.
Or maybe the problem is the media, for reporting these stories which tell IDnappers where to look to steal IDs. Instead we should just learn about it privately, when the bank closes our empty account, or the IRS sends goons to arrest us when we're too broke to pay our taxes.
OK, maybe the problem is the IRS. Without the IRS, we wouldn't have our IDs exposed to theft. And who wants to pay taxes? Instead, we could just let the country grow over with weeds and druglord gangs.
All right - the problem is my posts. Too long, too sarcastic, too scary. No, it's your fault for reading them.
--
make install -not war
You are all fired. It is obvious that bringing in random people that don't even know what they are going can get at least a D-. Heck, sometimes I don't even show up for class and don't bother studying for the test and I can pull a D+.
We need to get rid of the IRS altogether and replace it with the FairTax.
The FairTax would replace the complex and difficult to understand federal income tax with a fair and simple national sales tax.
Under the FairTax, Americans will take home 100% of their paychecks, allowing them to save more money for education and retirement, as well as make investments that will stimulate our economy. Not only will American workers take home their whole paychecks, each registered household will receive a monthly "prebate" check to refund taxes paid on necessities. This combination of sales tax and monthly prebate makes the FairTax the only tax proposal that completely "untaxes" the poor.
The FairTax is revenue neutral. While the American worker has everything to gain under this new system of taxation, the government will lose nothing in federal funding.
The current system of taxation is beyond repair. Compliance is difficult and expensive, often prohibitively so for aspiring small businesses.
Free your ecomony and enact the FairTax
Personally, I think Japan has the better system of publish list of top 100 tax payer, how much they earn and how much they pay in tax, etc.
The privacy of tax return had allowed too many tax loopholes and evasions to go un-notices. If tax returns are public, the transparancy and public outrage would ensure loopholes are plug and tax system remains fair.
In the U.S. the finanacial accounting and tax accounting had been allowed to drifted away from each other. If public investors are allowed to see the tax returns of their holdings, they can get much better sense of a corpration's performance. A lot of recent corporate scandals would had been discovered sooner or prevented all together.
Has it occured to anyone that perhaps DHS and the DoD get failing grades because they take different, more effective approaches to security than what's handed down by a beauracracy?
tasks(723) drafts(105) languages(484) examples(29106)
Randy: That word's kind of getting old. It's not really funny anymore.
Man: Yeah, they're gonna have to come up with a new swear word now.
Mr. Garrison: Well, they can't use "fag." Because you can't say "fag" unless you're a homosexual.
Randy: Really? So we can't say (bleep)?
Mr. Garrison: No. See, you got beeped.
Man: You mean you have to be a (bleep) to say (bleep)?
Mr. Garrison: That's right.
Jimbo: Hell, that's not fair! I should be able to say "fag."
Randy: Hey, you didn't get beeped.
Jimbo: Uh, oh.
Mr. Garrison: Well well well! Guess we learned something new about you, Jimbo, you freakin' fag! You wanna make out or something?
Why should I pay for this data
http://usgovinfo.about.com/b/a/217091.htm
when I get get it for free, then?
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
I thought they worked around all the security issues by just writing all their data on 800 bpi 1/2" tape. Seriously, the only people who have those things anymore are the IRS and the FAA.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
That's if it's mandatory. If it's optional, then they don't need to meet the standards and all is well with the world. But if it IS optional, then the Government should state so and not claim that they're mandatory. Optional is a choice, no matter what CYA the lawyers want to put onto it.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
For those interested, the entire report card is available here.
Everything was going fine until I filled out the address of my employer from my W2. On the W2, it was listed as "Comptroller's Office, SoAndSo Corp.". So I typed that in, verbatim, to the website. Surprise of surprises, I got back an ASP debugging page saying that an SQL syntax error had occurred and 's' was an invalid command.
For those of you that don't know, this just screams SQL Injection vulnerability. I went back to the login page and tried logging in with "abc'abc". Not only did I get an SQL syntax error on this page as well, but the debugging information showed the IP address, user name, and password of the MSSQL server used to store all of the tax information. *sigh*
This was at about 10:00 pm, so my immediate attempts to contact the company failed. I also contacted the IRS, and eventually got a case assignment after about three different calls to various help desks. I called the company again in the morning and carefully explained the dangers of A) not turning off ASP debugging information on production systems and B) creating SQL statements by concatinating user input. The IRS did eventually call back, and I was able to connect them up with the company spokesman. I'm sure they had an interesting talk.
Moral of this story... there really isn't one. The IRS had linked to these people directly, and in that way endorsed them, but no one, from the IRS or the company, ever thought of placing a single quote into any one of their text fields. Also, this site was verified by TRUST-e, but apparently they're only worried about SSL. Oh, and after all that, the site still isn't fixed. They've turned off ASP debugging. But that's it. I can still log in with "username'--" and an invalid password. Anyone know where I should go next? Who to talk to?
LOL, and now with the article being slashdotted...they probably will notice thousands of port scans on their network after checking logs =)
Where you start spreading the myth about governments serving its people. Ain't been that way for quite some time now.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Take your average company. Now take a manager's PC and a tech's PC. Which one is more likely to be secured? And the owner of which takes home more money?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
And please correct me if I got anything wrong here. The agencies themselves send in reports. Not some "mystery shopper" guy checking their security, but they hand their reports in themselves.
And they STILL fail?
Scary to think that they're even too dumb to cheat.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
...it would be nice to add a zero to my return...
I decided to help you out there. Here you go.
Instead of getting a return of $237.13, you will now receive $237.130.
Have a nice day!
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
There were four stories today on Slashdot about U.S. government corruption, and one about the government functioning as it should:
This one: IRS Leaves Taxpayer Data Largely Unprotected. If the IRS is denied the computer equipment it needs, there is more money for the government corrupters to steal.
Former BSA VP Confirmed as Tech Undersecretary. Another unqualified person is appointed to influence U.S. technology.
FCC Opens Flood Gates for Junk Faxes. "Under the new rules, a junk faxer could visit your website and call that an existing business relationship."
AT&T Forwarding All Internet Traffic to NSA?. The U.S. government conducts more surveillance world-wide and domestically than any agency, ever, in the history of the world.
Today's news from Slashdot about the U.S. government is not all negative:
FTC Levies Fine Against Big-league Spammers.
--
Violence does not promote democracy. It promotes more violence.
It's good to know that when other government agencies are starting to become increasingly paranoid, there is one that values keeping their records available to the public.
The Social Security Administration scored an "A". As I recall they were also one of the first federal agencies to complete their work on the Y2K project. Score another one for monolithic bureacracies over fragmented bureaucracies :)
Soylent Green is peoplicious!
that a paper filing stays on paper once it gets to the IRS?
The US free market: two halves of a government-granted duopoly are free to set the market price.
Break out the hookers and blow! Party at Treasury!
Fuck that! Party over at the DEA Headquarters! You can have your blow and hookers, I'll take the fine, sweet, Mississippi-grown Government G-17 Cheeba and hotbox the House and Senate. Maybe then we can get IP law changed, the troops 10,000 miles away from things that goes "Allah Akbar--BOOM!!!!", Bush impeached for that Scooter Libby stunt, and DUKE NUKEM GODDAMN FUCKING FOREVER ALREADY!!!!!!!!!
"No beer until you finish your tequila!" -Leela's Dad
Information wants to be free.
You don't have to file. However, if you don't file then (pursuant to Code Section 6020(b)) the IRS will prepare and file a return for you and the only way not to be obligated to pay whatever they decide you owe is to file a return yourself.
= 122901,00.html
But as long as you're willing to pay whatever the IRS decides you owe you don't have to file your own return.
http://www.irs.gov/businesses/small/article/0,,id
For the record, the next thing I did was to shut it down, reboot from the setup DVD, and perform a wipe-and-reload on the hard drive.
http://alternatives.rzero.com/