IRS hacks, college data, IoT warnings and more

Senate panel seeks fixes for IRS identity hacks

The Senate Finance Committee is planning to mark up legislation that would require the IRS to do more to prevent the use of IRS systems to perpetrate identity theft and fraud. The proposed law comes in the wake of revelations that hackers potentially accessed the tax-return documents for as many as 330,000 taxpayers via the IRS "Get Transcript" tool.

The bill would give any taxpayer the right to request a six-digit code to access his or her tax data; that service is currently only available to individuals whose information has been stolen. It also would require the IRS to study the feasibility of creating a "do not e-file" list under which IRS systems would block tax returns from individuals who elect to file paper returns.

At the same time, the bill seeks to expand e-filing by giving paid preparers who submit as few as 20 returns per year direct electronic access to IRS filing systems -- down from the current minimum of 250. The bill would also require the IRS to create a secure Internet platform for small-business operators to file employment eligibility forms, such as W-2s and 1099s, online.

The IRS would get a little help on the IT end of things: The bill would reinstitute "streamlined critical pay" enhancements for top tech personnel at the IRS through 2020 to address tax system improvements and overall cybersecurity.

If enacted, the legislation is expected to cost $286 million over 10 years. The Finance Committee is set to mark up the legislation on Sept. 16.

New government tool gives students access to college data

The Education Department has released a new tool called College Scorecard that allows applicants to compare colleges based on costs, graduates' post-college earnings and other factors.

Although the tool isn't technically a scorecard because no rankings have been assigned to the 7,000 colleges, users can access 18 years' worth of government data that has been consolidated into a single interface for the first time.

The data is accessible via the web and an open application programming interface. According to a blog post by Lisa Gelobter, Education's chief digital service officer, some developers are already using the data to create their own applications.

The 18F team and the U.S. Digital Service collaborated on College Scorecard.

FBI warns on risks from Internet of Things

It might be amazing to program an air conditioner via a remote smartphone app or listen to an infant wail via an IP-enabled monitor, but those devices offer new attack vectors for hackers, the FBI warned in a recent alert.

The technology behind the Internet of Things promises a new world of convenience to consumers, but that ease of use creates vulnerabilities. In particular, the Universal Plug and Play protocol that allows connected devices to access networks without authentication provides opportunities for hackers to take over devices, execute their own commands, spy on users or steal information.

Data theft could compromise information from health monitoring devices or home security and climate control systems. Hackers could also potentially turn devices off or use their computing power to launch spam attacks. Many devices come with universal default passwords that criminals can use to gain access.

The FBI is recommending that users disable the Universal Plug and Play protocol, update passwords on devices and only connect devices via secure networks.

Feds fighting insider threats but how?

Three-quarters of federal managers say they're more focused on stomping out insider threats now than a year ago, but they're divided on how to do it.

Those were the findings of a survey of 150 federal IT managers released Sept. 14 by MeriTalk and Symantec.

Forty-five percent of respondents said they had been the target of an insider threat in the past year, and 29 percent lost data as a result. Despite calls for file use-tracking tools, many survey respondents lacked awareness: 45 percent couldn't tell if a document had been shared inappropriately and one-third couldn't tell what data had been lost.

More than half of the respondents said employees commonly disregard protocols, and 40 percent said employees access files they shouldn't once a week or more.

Unlike other studies indicating federal leaders might not even be aware of many insider threat situations, MeriTalk's survey indicates that leaders were familiar with the problem, but there wasn't a consensus on the best response. Forty percent of respondents said end-user education was the key to curtailing insider threats, another 40 percent said better technology was the answer, and 20 percent called for more controls or guidance.

PSC questions OMB cyber acquisition guidance

The Professional Services Council told U.S. CIO Tony Scott and Office of Federal Procurement Policy Administrator Anne Rung that it had significant concerns about the Office of Management and Budget's guidance on cybersecurity acquisition.

OMB's guidance, "Improving Cybersecurity Protections in Federal Acquisitions," was posted on the CIO Council's website for public comment in August.

In a letter to Scott and Rung, PSC President and CEO Stan Soloway wrote that the document fails to provide meaningful guidance to the federal agencies and contractors in the five areas it is meant to address (security controls, cyber incident reporting, information system security assessments, information security continuous monitoring and business due diligence). Soloway also said the guidance lacks common definitions for federal acquisition and fails to outline government/contractor training or outreach to industry.

He added that the guidance is too late because many agencies have already taken regulatory and contractual steps to address many of the five components, "thus undercutting any hope for uniform, governmentwide guidance resulting from this document in its current form."

FAA taps two for drone integration

The Federal Aviation Administration has named Marke "Hoot" Gibson and Earl Lawrence to two executive-level positions to lead the agency's integration of unmanned aircraft systems into U.S. airspace.

Both will assume their new positions later this month, the agency said.

Gibson will become senior adviser on UAS integration, a position established to focus on outreach and education, interagency initiatives and an enterprise-level approach to managing UAS integration efforts. He will report to FAA Deputy Administrator Michael Whitaker.

Gibson had served as executive director of the NextGen Institute, which provides professional services to the UAS Joint Program Development Office.

Lawrence will become director of the FAA's UAS Integration Office. During almost five years as director of the FAA's Small Airplane Directorate, he was responsible for 17 aircraft certification and manufacturing district offices in 21 states. Before joining the agency in 2010, he was vice president for industry and regulatory affairs at the Experimental Aircraft Association.

NSF funnels $40 million into 'smart cities'

The National Science Foundation announced $40 million in awards on Sept. 14 aimed at cultivating "increasingly smart and connected communities" in support of the White House's inaugural Smart Cities Week.

The money includes $12 million toward gigabit network connectivity, $10 million toward cyber-physical systems (or Internet of Things) research and $4 million for academic and industry research partnerships.