House speaker criticizes IRS cybersecurity

The Office of the Speaker of the House posted a scathing blog entry criticizing the IRS for not getting all its security controls in order in time for tax season.

"Right now, as you’re sending the IRS just about everything there is to know about you, it remains highly vulnerable to hackers and cyberattacks," Michael Shapiro, communications adviser to House Speaker Paul Ryan, wrote in the March 30 post. "And the agency has no intention of doing anything about it."

In a report released March 28, the Government Accountability Office issued 43 recommendations for the IRS to patch its information security vulnerabilities. GAO found that weaknesses in security controls threaten to compromise taxpayers’ sensitive data. Of the 12 systems GAO reviewed, two lacked critical patches.

The blog post accuses the IRS of “the usual excuses and evasions” in response to the report and calls for the agency to take steps to implement the recommendations and report back to Congress on its progress.

The IRS implemented an automated tool to manage password requirements, but several systems did not force periodic password resets despite an IRS policy mandating new passwords every 90 days for user accounts and every year for service accounts.

In early March, the IRS suspended its Identity Protection Personal Identification Number retrieval tool over concerns that it could be vulnerable to hackers.

In 2015, hackers might have accessed more than 700,000 taxpayer accounts and targeted another 576,000 accounts unsuccessfully, according to an inspector general investigation.