Slashdot Mirror
IRS Security Faults Leave Taxpayer Data At Risk
coondoggie writes "In this tax season, when billions of dollars and tons of personal information is relayed to and from the government, it's more than disconcerting to hear that the Internal Revenue Service is still struggling to keep private information secure. A report out Friday from watchdogs at the Government Accountability Office says about 69% of the tax agency's previously noted security flaws remain unfixed and continue to jeopardize the confidentiality, integrity, and availability of the IRS's systems (PDF). The problems put the IRS at increased risk of unauthorized disclosure, modification, or destruction of financial and taxpayer information, the GAO concluded."
Shameful that any company would fail at these basic tasks. It would take any competent admin very little time to compose policies that would effectively handle most of these. the others would require procedural changes but why would they continue to let the issue go if they know it's an audit exposure? (no pun intended)
From TFA:
For example, the GAO stated that the IRS continues to:
* use passwords that are not complex,
* ineffectively remove application accounts in a timely manner for separated employees,
* allow personnel excessive file and directory permissions,
* allow the unencrypted transmission of user and administrator login information,
* install security patches in an untimely manner
The IRS is concerned about not disclosing private data.
Private industry (including those companies you have not choice in using) has been selling as much of your information as possible for years. While of course encountering security breeches of their own.
The bottom line is that private companies have already sold all of this data, so relax.
Im not a fan of the IRS, but let's be real: 1. There are almost no government agencies or civilian organizations that don't have fairly terrible security...2. These checkbox requirements dont really tell a story. 2. These checkbox requirements dont tell a story of the actual level of security. You'd have to take a look at the whole architecture to figure out whether, for example, those UNIX passwords actually were important or not.
That's why I don't pay tax.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
A long while back, someone came in on Slashdot and claimed to have consulted/worked with the IRS, and described a security culture and tolerance for hair-trigger detection measures that would make any security fascist drool. So these problems would most likely be on a purely bureaucratic level, then?
Emotions! In your brain!
It's good to know that those who deal with SOX compliance and don't come into compliance are slapped hard with penalties, yet the same rules don't apply to the branch of the FEDERAL GOVERNMENT that deals with more sensitive data than any SOX umbrella'd company.
I am Bennett Haselton! I am Bennett Haselton!
First they get coverage because they send 2 agents after a person who did not pay 4 cents.
I think someone at the IRS is under the impression that they're so badass they don't need security.
My other car is a 1984 Nark Avenger.
Let's just publish all the known weaknesses of the IRS computer network system & its mismanagement for the whole world to see so all the bad guys can get in & do more damage faster & easier.
This man's name is Joseph STACK.
His name is Joseph STACK.
His name is Joseph STACK.
His name is Joseph STACK.
It's like encrypting your eMail using spam as symbol markers. Who'd think just sending acct information in Plane site wouldn't throw off salvagers? It's like disguising a Whale-meat Processing ship as Whale Research vessel, and then creating your own opposition as a bunch of hippies to capture the hearts of the world so their court arguments would be all LSD-tainted of any legal merit but to push the primary goal for recognizing animals as persons and citizens.
The only identity theft I've ever suffered is through the IRS. Supposedly four years ago someone else filed with my SSN. I haven't got my tax refund since. They won't talk to me about what is going on. I've done everything they've asked including filing a police report and verifying my identity with the social security office. If you call the customer support number they aren't able to help because my account is being handled by a secret agency within the IRS that not even they can talk to. They've twice sent me [different] dead phone numbers that are supposedly my point of contact for finding out what is going on. They've gone so far as to send me a bill and to threaten what will happen to me if they find out I'm doing something bad. Last year they finally sent me a letter confirming they recognize that I am me. They sent me a couple hundred dollar check (they owe me thousands) and said there might be more after further review. I've never heard from them again. This year my tax refund got flagged and lost in limbo again.
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
A tax is a seizure on land or a wage garnishment, handled through the First Judiciary Act as a District Court of the United States. Think about it; when you file a legal form, you create a contract that binds you to admit you owe a tax. Move back to your venue with a miscelaneous case file to record your court of competant jurisdiction by an administrator/trustee deployed under UNITED STATES DISTRICT COURT. If I.R.S. is moving on behalf of a creditor then that DC will call that claim to be validated beginning with Title 26 Section 83(a).
All I ever throw in my Miscelaneous docket are Refusals for Cause. I don't need to commit taxable activity, so I refuse to do them because I want to continue in my unlimited liability, and sue anyone that converts my rights to a privilege from someone not interested since the onset.
First then get coverage because they send 2 agents after a person who did not pay 4 cents.
I'm sure glad that FOX news is reporting a "fair and balanced" story rather than just quoting the guy being audited. I mean, people accused of fraud would never outright lie or conveniently ignore facts!
(The IRS wouldn't comment citing "privacy" you say? I see. So I guess the alternative of not printing the story because it couldn't in any way be confirmed wasn't an option?)
It’s the law of reactive efficiency.
They will only change something, if they lost something before, that was big enough to seriously get them at risk of losing their job.
Otherwise, what would be the point? (From their p.o.v.)
Seriously.
I mean you got a job. And your job is to obey rules. So you switch to passive mode.
You get good money. So you get the most profit from it, if you do the least possible amount of work in return.
It’s how nature works, and there is nothing weird about it.
The problem is that:
1. They are not actively involved in their organization. (Including the risk.)
2. And they can‘t feel any danger. We only feel the danger. But we can’t pass it on and threaten to punish them.
I bet you money that if you get them to fear for their jobs, or achieve to threaten those who already are responsible, they WILL change something. (Don’t forget to state exactly what you expect to get! ^^)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
I would think that the IRS would use an IBM mainframe for such a massive data warehouse such as taxes. Why should there even be "security patches" in the report. You mean to tell me they are using WINDOWS?!?! GMAFB.
Just try to break into an IBM mainframe not connected to the Internet at all (or just accessible via IP on the IRS's network or VPN protected by SecurID) running CICS or CA/TOP SECRET or pick your favorite mainframe security system. I don't get it. The US can run $some_obscene_number into the red but not get real, decent security for the bloodsuckers^H^H^H^H^H^H IRS?
Miser
Maybe this is part of 0bama's transparency of gov't(people) ??? I think it might be...
FragHARD or don't frag at all
At times like this, I wish we'd use something else
Support the FairTax