IRS fails to plug all security gaps, IG says

Agency has made progress in securing laptops, however

The Internal Revenue Service is effectively securing taxpayers’ personal data on its laptop computers, but still has some security gaps, according to a new report from the Treasury Inspector General for Tax Administration. The weaknesses primarily concern the reporting of breaches and storing of backup data

The IRS has implemented successful encryption technologies for data held on laptop computers and other devices, according to the TIGTA IG's report published on Sept. 14. The service also has put into effect a comprehensive training policy for employees and distributed computer locking devices.

However, the audit also found  that improvements are needed in enhanced tracking processes to ensure that all incidents are properly reported and handled, and greater controls on protecting backup data from unauthorized disclosure.

From Oct. 1, 2006, to Sept. 17, 2008, the IRS identified 132 data breaches in which there was a risk of identify theft or other harm and sent notification letters to 17,498 potentially affected taxpayers. However, notification for roughly 4 percent of the incidents was not shared fully among all the required organizations, the auditors wrote.

Also, auditors visited one of the IRS centers charged with handling backup data and found that annual inventory validation was not conducted and lists of personnel that had authorized access to the data were out of date. The IRS indicated these weaknesses were caused by management turnover and a lack of management oversight over backup procedures, the report said.

The IG recommended that the service make sure that all incidents are reported appropriately and that all backup data is protected. IRS officials agreed with both the recommendations and produced a schedule for implementation.

The IRS handles about 220 million tax forms a year containing personal financial and identifying information that could be used for identity theft. Most IRS employees access the data at federal facilities, but some employees are authorized to carry the data on laptop computers for business purposes.

The IG earlier this year criticized the IRS for being slow to implement security settings on its desktop computers and laptops.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.