WASHINGTON -- One more tax-season dread: A week before the filing deadline, Treasury watchdogs said Monday that poor controls over IRS computers could allow a disgruntled employee, agency contractor or outside hacker to steal taxpayers' confidential information.
Indeed, a hacker might even "gain full control of the IRS network," said a report Monday from the office of the Treasury Inspector General for Tax Administration.
Investigators did not cite any specific cases of wrongdoing within the IRS, which processes some 137 million tax returns. But they suggested a lack of review means someone could get sensitive information and no one would ever know.
The report comes amid increasing scrutiny of the IRS and the problems posed both by security concerns within the system and identity theft threats from outside:
- The independent IRS Oversight Board, in a report issued last month, outlined some $32 million in spending it said was needed to enhance the tax agency's security. "Disrupting IRS returns processing and stealing sensitive information could wreak havoc on the economy and financial markets," it said.
- Separately, IRS Commissioner Douglas Shulman will testify before Congress on Thursday about scams in which people are fooled into revealing their Social Security numbers and other confidential information by e-mails and phone calls purported to be coming from the IRS. The tax agency said last month that taxpayers this year had already forwarded to the agency 33,000 'phishing' scam e-mails reflecting more than 1,500 different schemes.
Inside the IRS, Monday's inspector general report dealt specifically with the thousands of routers and data switches that connect networks and direct computer traffic among the tax agency's offices. It suggested that "an unscrupulous person could divert data traffic through a third-party system on its way to the intended destination."
A review found that the IRS had authorized 374 accounts for employees and contractors that could be used to perform system administration duties. But of those, 141 either had expired authorizations or had never been properly authorized.
There was particular concern that 27 of the 55 employees and contractor who apparently had not been authorized had accessed routers and switches to change security configurations.
In addition, system administrations circumvented authentication controls by setting up 34 unauthorized accounts that appeared to be shared-use accounts, the report found. During the fiscal 2007, some 4.4 million of the 5.2 million accesses to the control system were made by these 34 user accounts.
The IG's office also faulted the IRS for not adequately reviewing the "audit trail" logs that could help identify questionable activity.
"As a result, malicious persons could exploit vulnerabilities in the routers and switches to gain unauthorized access to sensitive information and disrupt computer operations with little chance of detection," the report said.
The IRS, in response, agreed to most of the report's recommendations for tightening controls. It said it would lock employee use accounts after 45 days of inactivity and remove those accounts after 90 days without use. It also said it would ensure that no unauthorized or unnecessary shared accounts exist in the control system.
The report follows a study by the congressional Government Accountability Office in January prodding the tax agency to fix dozens of information security weaknesses that left taxpayer records vulnerable to tampering or disclosure.