Slashdot Mirror
IRS Leaves Taxpayer Data Largely Unprotected
LogError writes "Two weeks ago, Department of Treasury received a D-minus grade in the Federal Computer Security Report Card for 2005, down from a D-plus grade in 2004. The majority of Treasury systems are those belonging to IRS. The government-wide computer-security grade for 2005 was D-plus, while Homeland Security and Defense both received an F. Grades are based on reports submitted to Congress by the agencies; the reports are required under the Federal Information Security Management Act of 2002.8 The scores are meant to reflect whether departments meet federally mandated security standards."
This is why I refuse to pay income taxes!
IRS Leaves Taxpayer Data Largely Unprotected
This story acts as we should be surprised. The government serves the people. The IRS, on the other hand, serves the government. I let you figure out where the disconnect is.
Javascript + Nintendo DSi = DSiCade
Who in their right mind would hack into the IRS sure it would be nice to add a zero to my return but you don't f*** with the IRS.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
Cost of providing security against non-existent WMDs that couldn't reach the US even if they existed ... $100 Billion
... $400 Billion
... $0.0005 Billion (of $500 million)
... Priceless!
Cost of providing security against al-Qaeda attacking US from Iraq, even though they weren't there
Cost of providing security against really obvious IRS forms that let people steal your money and assets easily
Realizing you've been taken to the cleaners due to your own gullibility
-- Tigger warning: This post may contain tiggers! --
Here's a question. What does it cost the IRS if taxpayer data is stolen?
Oh yeah. Squat. Why *should* they care? It's no skin off their back.
If our government wanted to make sure this didn't happen, they'd fine the IRS every time there was a security breach. In fact, they'd fine the IRS just for having bad security. And then things would improve.
'Course, in reality, why would they do that? There's no reason our government would want to hurt the IRS in any way.
Really, what should be happening is the people of America suing the IRS for not guarding our information properly. I wonder how *that* lawsuit would go.
Here's the fundamental issue: If you want someone to behave in a certain way, you have to make it worth their while. Right now the IRS has no incentive for keeping our info safe. Want to change that? Change it at the source.
Breaking Into the Industry - A development log about starting a game studio.
I mean, wouldn't you much rather have a national government that was more like you, instead of some kind of intellectual-elite government scoring all "A"s? Better to have a government that understands people like you than a government that is out of touch with mainstream American values, I say!
(Break out the hookers and blow! Party at Treasury!)
Obliteracy: Words with explosions
This is why I refuse to pay income taxes!
Careful, they got a D- in protecting data, but they have an A doubleplus in 'tracking your ass down and throwing you in jail'. ask Al Capone.
No shit ?
I work for a company that creates electronic filing software for the IRS, and I work with them on a regular basis. While Electronic filing has really only been popular the last few years its history goes back a very long time (in computer years). For example, currently to file a form 1040 electronically, it gets formatted in custom text format, attached to a whole bunch of other forms, gets all sorts of headers and summary information tacked on. It gets gzipped, then pushed through a z-modem connection over a telnet session, inside of an SSL connection. Why? Because it evolved that way. There was a time when electronic filing meant putting magnetic media in the mail. So the file formats go way back and are all fucked up because they are constantly updating the forms in respons to legislation. when they stopped with the magnetic media and started using modems, the whole thing was run like a BBS, so ta-da z-modem. When the bbs system was moved to the internet, it became telnet. Then they said oh shit its on the internet, we need encryption, so they moved that into an SSL connection.
Case in point the whole system is fucked up because its doing things it was never designed to do. So now we introduce Modernized E-File. MEF is basically the IRS rebuilding its entire system from the ground up. File formats are getting moved to XML, the network connections are moving to SOAP, and all sorts of other cool stuff.
Given the amound of stuff thats going on right now I would expect them to be scored poorly because basically the existing system is held together with duct tape while the new system is being built, and the new system probably wasn't considered in the score since its not completly up and running yet.
Slashdot is an anagram for Has Dolts, and I am Dolt number 468543
We all knew this already. If a chick like Trinity could hack into the IRS... how good could their security be?
Let's be fair here. Isn't a D-minus really an F? Let's not split hairs, people. If I got a C-minus my scholarship would have been dropped. Can't we drop them from the government for not even grading an average C?
Developers: We can use your help.
In 2004, the Department of Commerce got an F.
In 2005, the Department of Commerce got a D+.
Clearly, they must have improved slightly. Why didn't anyone highlight these improvements to show the DOJ, NRC and Treasury that, even if you're completely retarded, you can still make some improvement?
[o]_O
Did any department pass?
In other news, the department of agriculture passed with flying colors. Though they haven't figured it how to plug in their 486 yet, so it's not entirely a fair fight.
Zing!
It's pretty funny the department that gets the most funding gets a F grade. What a joke!
Meanwhile NASA only gets a drop in the bucket.
We need to get rid of the IRS altogether and replace it with the FairTax.
The FairTax would replace the complex and difficult to understand federal income tax with a fair and simple national sales tax.
Under the FairTax, Americans will take home 100% of their paychecks, allowing them to save more money for education and retirement, as well as make investments that will stimulate our economy. Not only will American workers take home their whole paychecks, each registered household will receive a monthly "prebate" check to refund taxes paid on necessities. This combination of sales tax and monthly prebate makes the FairTax the only tax proposal that completely "untaxes" the poor.
The FairTax is revenue neutral. While the American worker has everything to gain under this new system of taxation, the government will lose nothing in federal funding.
The current system of taxation is beyond repair. Compliance is difficult and expensive, often prohibitively so for aspiring small businesses.
Free your ecomony and enact the FairTax
Personally, I think Japan has the better system of publish list of top 100 tax payer, how much they earn and how much they pay in tax, etc.
The privacy of tax return had allowed too many tax loopholes and evasions to go un-notices. If tax returns are public, the transparancy and public outrage would ensure loopholes are plug and tax system remains fair.
In the U.S. the finanacial accounting and tax accounting had been allowed to drifted away from each other. If public investors are allowed to see the tax returns of their holdings, they can get much better sense of a corpration's performance. A lot of recent corporate scandals would had been discovered sooner or prevented all together.
Has it occured to anyone that perhaps DHS and the DoD get failing grades because they take different, more effective approaches to security than what's handed down by a beauracracy?
tasks(723) drafts(105) languages(484) examples(29106)
For those interested, the entire report card is available here.
Everything was going fine until I filled out the address of my employer from my W2. On the W2, it was listed as "Comptroller's Office, SoAndSo Corp.". So I typed that in, verbatim, to the website. Surprise of surprises, I got back an ASP debugging page saying that an SQL syntax error had occurred and 's' was an invalid command.
For those of you that don't know, this just screams SQL Injection vulnerability. I went back to the login page and tried logging in with "abc'abc". Not only did I get an SQL syntax error on this page as well, but the debugging information showed the IP address, user name, and password of the MSSQL server used to store all of the tax information. *sigh*
This was at about 10:00 pm, so my immediate attempts to contact the company failed. I also contacted the IRS, and eventually got a case assignment after about three different calls to various help desks. I called the company again in the morning and carefully explained the dangers of A) not turning off ASP debugging information on production systems and B) creating SQL statements by concatinating user input. The IRS did eventually call back, and I was able to connect them up with the company spokesman. I'm sure they had an interesting talk.
Moral of this story... there really isn't one. The IRS had linked to these people directly, and in that way endorsed them, but no one, from the IRS or the company, ever thought of placing a single quote into any one of their text fields. Also, this site was verified by TRUST-e, but apparently they're only worried about SSL. Oh, and after all that, the site still isn't fixed. They've turned off ASP debugging. But that's it. I can still log in with "username'--" and an invalid password. Anyone know where I should go next? Who to talk to?
...it would be nice to add a zero to my return...
I decided to help you out there. Here you go.
Instead of getting a return of $237.13, you will now receive $237.130.
Have a nice day!
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
It's good to know that when other government agencies are starting to become increasingly paranoid, there is one that values keeping their records available to the public.
The Social Security Administration scored an "A". As I recall they were also one of the first federal agencies to complete their work on the Y2K project. Score another one for monolithic bureacracies over fragmented bureaucracies :)
Soylent Green is peoplicious!