Lax security risks taxpayer data

The Internal Revenue Service's computer systems have serious security weaknesses that put sensitive personal tax information at risk, according to a General Accounting Office audit released this month.

According to the audit, in which GAO investigated six IRS facilities, the facilities could not account for 397 missing computer tapes, some of which contain sensitive taxpayer information.

The IRS relies on automated information systems to process more than 200 million taxpayer returns and to collect more than $1.6 trillion in taxes annually. The tax agency uses its computer systems to perform many tasks, including processing tax returns, calculating interest and penalties, maintaining taxpayer data and generating refunds.

In 1997, GAO reported the tax agency had serious security weaknesses that jeopardized sensitive information at its facilities. In the latest audit, GAO credits the tax agency for making significant progress. The IRS said it had corrected 75 percent of the problems identified in the 1997 report.

But, GAO said, "serious weaknesses continue to exist'' because the IRS has not fully installed a computer security management program. Among the problems:

* Sensitive taxpayer information could be accessed by hackers because data is not protected before it is transmitted over telephone lines.

* Too many IRS employees have access to sensitive computing areas, and some tapes containing taxpayer information have been lost.

* Employees have the ability to change or delete taxpayer information. Some tapes and disks are not being overwritten before being used again, allowing unauthorized access to taxpayer data, including Social Security numbers.

* A new IRS system aimed at catching employees who illegally "browse'' through taxpayer files works only on one of several computer systems, and it cannot detect which activities are legitimate and which are not.

* Few contingency plans, such as an alternative computer processing site or effective backup electric generators, are in place in case of disaster.

GAO recommends, among other things, that the IRS should limit access to computer facilities, use software to provide optimum security, ensure that all computer programs are authorized, tested and independently reviewed, and ensure that taxpayer information is not used for software testing.

GAO also recommends that the IRS assess risks for all its facilities, networks, major systems and taxpayer information on a regular basis, occasionally evaluate key computing resources and adopt actions to correct weaknesses identified during the computer evaluations.

IRS Commissioner Charles Rossotti said in a written response that he agreed with many of the conclusions and GAO recommendations. He said he was optimistic about correcting the problems at the IRS.

Rossotti said the initial goals for the IRS were to focus on the larger data processing facilities that have serious weaknesses, "which are critical in processing and safeguarding taxpayer data.

"We believe that managing risk and prioritizing corrective actions and resources is the key to making needed and measurable improvements,'' Rossotti said. "Protecting taxpayer information and the systems used to deliver services to taxpayers are key to the success of a customer-focused IRS.''