Watchdog jittery about IRS computers

Watchdog says tax collectors haven't done enough to guard against unscrupulous employees, contractors and hackers.

EMAIL  |   PRINT  |   SHARE  |   RSS
google my aol my msn my yahoo! netvibes
Paste this link into your favorite RSS desktop reader
See all RSS FEEDS (close)

How much credit card debt do you currently have?
  • More than $10,000
  • $1,000 - $10,000
  • Less than $1000
  • None

WASHINGTON (CNN) -- As taxpayers rush to file tax returns, independent auditors are warning that the Internal Revenue Service has not done enough to safeguard some of its computer systems, leaving sensitive taxpayer information vulnerable to disgruntled IRS employees, contractors or hackers.

Unscrupulous people could "reconfigure [computer] routers and switches" and "steal taxpayer information in a number of ways, including diverting information to unauthorized systems," according to the Treasury Inspector General for Tax Administration (TIGTA) office, which serves a watchdog function over the IRS.

The IRS says it has addressed the concerns raised in the report.

At issue is the security of routers and switches, devices that determine the proper path for data to travel between computer networks, TIGTA said. Because the IRS sends sensitive taxpayer and government information across its networks, it must have security controls to deter and detect unauthorized users.

The report does not indicate whether any taxpayer information has ever been misdirected or stolen from IRS computers, but said that in more than 84% of the 5.2 million times employees accessed a system to administer and configure routers, they used "accounts" that were not properly authorized.

To ensure security, the IRS had authorized 374 accounts for employees and contractors to use to access routers and switches to perform system administration duties, the TIGTA said. Of those, authorization for 86 had expired at the time of TIGTA's review in 2007, and there was no record that 55 employee and contractor accounts had ever been authorized.

"We are particularly concerned that 27 of the 55 employees and contractors had accessed the routers and switches to change security configurations," wrote Michael R. Phillips, the deputy inspector general who wrote the report.

In addition, nine accounts were still active, even though the employees and contractors had not accessed the system for more than 90 days, the report says. The IRS should have automatically prevented users from accessing routers and switches after 90 days, it says.

The report does not say whether anyone wrongly obtained taxpayer information or if taxpayer information was misused, but says it is continuing to review security to see whether changes made to the computer system were appropriate or warranted.

In a written response accompanying the report, the IRS said it has made some changes and is continuing to improve the control and monitoring of controls and switches. All 369 users now have current and valid authorizations on file, the IRS said.

-- from CNN Producer Mike M. Ahlers  To top of page

They're hiring!These Fortune 100 employers have at least 350 openings each. What are they looking for in a new hire? More
If the Fortune 500 were a country...It would be the world's second-biggest economy. See how big companies' sales stack up against GDP over the past decade. More
Sponsored By:
These 10 food trends could dominate 2015 So long, kale. Here's what's expected to shake up the food industry next year. More
Beyond Russia: Geopolitical hot spots in 2015 Investors beware: These 5 global crises are likely to rattle the stock market and world economy. More
These 20 antique guns could fetch big bucks Morphy Auctions in Pennsylvania is putting nearly 1,000 old guns on the block. Here are just a few. More

Most stock quote data provided by BATS. Market indices are shown in real time, except for the DJIA, which is delayed by two minutes. All times are ET. Disclaimer.

Morningstar: © 2014 Morningstar, Inc. All Rights Reserved.

Factset: FactSet Research Systems Inc. 2014. All rights reserved.

Chicago Mercantile Association: Certain market data is the property of Chicago Mercantile Exchange Inc. and its licensors. All rights reserved.

Dow Jones: The Dow Jones branded indices are proprietary to and are calculated, distributed and marketed by DJI Opco, a subsidiary of S&P Dow Jones Indices LLC and have been licensed for use to S&P Opco, LLC and CNN. Standard & Poor's and S&P are registered trademarks of Standard & Poor’s Financial Services LLC and Dow Jones is a registered trademark of Dow Jones Trademark Holdings LLC. All content of the Dow Jones branded indices © S&P Dow Jones Indices LLC 2014 and/or its affiliates.