Slashdot Mirror
Taxpayer Data At IRS Remains Vulnerable
CWmike writes "A new Government Accountability Office report (PDF) finds that taxpayer and other sensitive data continues to remain dangerously underprotected at the IRS. The news comes less than three months after the Treasury Inspector General for Tax Administration reported that there were major security vulnerabilities in two crucial IRS systems. Two big standouts in the latest finding: The IRS still does not always enforce strong password management rules for identifying and authenticating users of its systems, nor does it encrypt certain types of sensitive data, the GAO said."
That reminds me of what happened in Australia with the taxation department a few years ago.
The ATO put everyone's tax details online and used their Tax File Number ( everyone who pays tax has one ).
Some bright spark noticed his TFN in the URL the day they launched their new service and changed the number only to find that it gave him access to someone else's data.
There were accusations of hacking and all, but it conveniently left out the discussion that it was a pretty obvious and blatant flaw.
The minister responsible was never held accountable. That's why these security breaches keep on happening over here.
I'm pretty sure that there's a similar situation in the US.
GrpA
Enjoy science fiction? "Turing Evolved" - AI, Mecha, Androids and rail-gun battles. What more could you want?
So it seems that the system allows for modification of taxpayer data. That's quite a bit different from just having it available.
So what if someone else knows how much you make?
There's more to a person's tax record than how much s/he makes. The tax man knows WAY more than most people would want to be common knowledge.
The most exciting phrase to hear in science, the one that heralds new discoveries, is not 'Eureka!' but 'That's funny...
I hope you're being funny.
If others knew what I make, I would get a pay cut. My pay has been negotiated between myself and management. There would be a brouhaha if others in similar, but less accountable, roles thought I was "paid too much" or some such.*
My pay is not something I would want broadcast. Also, I would not want marketers to know my pay, nor family (aside from my spouse).
-nB
* I say this who has worked their way up from the bottom, where I used to think I was mighty damn important, now I know my absolute value may be low but my relative value is higher. I don't expect others who are in the boat I was in to necessarily understand this, and would rather avoid the conflict.
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Suspend all income taxes for one year. Plenty of time to focus on the security holes and a temporary boost to the economy. Two problems easily solved.
Developers: We can use your help.
Care to post your tax return online and find out?
Give me Classic Slashdot or give me death!
So what if someone else knows how much you make?
Well if they also know where you work and live, there's always a threat of being mugged, burglary, etc. Just a consideration.
I worked at one company where I'm sure I missed out on getting a transfer to a new department where I could have done a lot of good and learned new things because my new manager asked me how much I was getting. I could see from his expression that I'd lost out the moment he learned that I was making more than he was. Not only had I received a merit increase at one point, but our annual raises were a percentage, and even if my percentage was average, it still meant a bigger raise than the other techs got, and the gap just got bigger every year. Now, imagine what would happen if you were looking for a new job and your potential employer was able to learn what you were really getting instead of what you wanted him to think your salary/hourly was.
Good, inexpensive web hosting
What we need is a counterpart to the GAO.
The GAO should be able to exact fines from any agency for waste, insecurity etc etc.
All of this fine money should be funneled into a Government Solutions Office whose task is to spend that money back into the program to fix it.
GAO finds improper encryptions. Fines IRS. GSO hires a security expert to create new policies and purchase needed training.
Just a thought.
The technically don't really exist anyway so why should they give half a damn about all the information they bully out of people through courts so they can continue their highway robbery.
Asshats.
That is all.
I can't wait for someone to....hack into the system, and change the info to reflect that all rich people pay extra 10% and all poor people pay a 10% less, that would be a very nice hack!
Remember a month or so ago when so many people here were saying what a stupid idea it was that Obama wanted to create a CTO position for the government? Isn't this exactly the sort of thing that someone in that position would be involved in sorting out?
This guy's the limit!
It's like when the PWC douchebags come and "audit" you, by first being given root access on all your servers, then glibly pointing out that you're running sendmail or Tomcat of some microscopic version behind the current rev or that /etc/password is world-readable.
I want to delete my account but Slashdot doesn't allow it.
I didn't want to comment until I read the report. Now I have.
The report cites some less-than-optimum security practices. To me, it sounds like lots of nitpicky stuff but I realize that a minor vulnerability can be a major problem if exploited by someone sharp and evil.
That said, doing evil via any of the avenues suggested by the report requires an insider to do bad things. So, if security is a process and has lots of layers, is it reasonable to be vulnerable in one area if that area is rendered unimportant by other security processes and layers? At the IRS, doing bad things that would get you admonished or fired from the private sector will result in a stretch in the federal pen. So, yeah, we have admins who could change tax records. They have no reason to do so. Actually having a record important to me placed in a system over which I had some control would be a freaky low-probability situation. And if an admin did make bad changes, they'd almost certainly be found out (you can't change a tax record without generating automatic correspondence or screwing up an ongoing investigation; there are people who would eventually notice) and they'll go to prison in the aftermath.
Under those conditions, closing off every little permission problem is probably more trouble than it's worth and the price in workplace inefficiency is probably too high.
This report left me uneasy. Paragraph after paragraph, I found myself saying "Yeah, I know the system this report is probably talking about. It's right about that not being set up perfectly by the book. But so what?"
I guess I should go re-read it and study harder. There may be something in there worth getting excited about. But after my first read, my opinion is...probably not.
If others knew what I make, I would get a pay cut. My pay has been negotiated between myself and management. There would be a brouhaha if others in similar, but less accountable, roles thought I was "paid too much" or some such.
Or, it would be incentive for everyone else to negotiate better.
It depends on whether the people around you are more interested in pulling you down, or lifting themselves up.
There is a reason it is just about standard corporate policy world-wide that employees are forbidden from sharing salary information amongst themselves, and it certainly isn't to protect those of us who have better negotiating skills.