Report says failures stemmed from IRS failing to properly track efforts to eliminate 'identified flaws' in its security systems

This article is more than 6 years old

This article is more than 6 years old

The Internal Revenue Service has failed to properly protect taxpayers' data, leaving individuals at risk of identity fraud, according to an auditor's report.

Russell George, the Treasury inspector general for tax administration, found that the IRS was at risk of “malicious users exploiting accounts with default or blank passwords to steal taxpayer identities and carry out fraud schemes”.

The failures were as a result of the IRS failing to properly track its efforts to eliminate "identified flaws" in its security systems, George said. The IRS had only "partially implemented" 42% of planned corrections to its security, despite claiming it had completed the corrections.

The disclosure raises questions about how the government is placed to protect personal data as the IRS prepares to potentially acquire more of Americans’ information under the Affordable Care Act.

The report, released internally in September but made public on Thursday, examined 19 "planned corrective actions" to the IRS's security systems. George looked at whether these corrections, which the IRS claimed it had completed, had been fully implemented.

George found that eight of the 19 "had not been fully implemented", and should not have been marked as completed.

"All eight PCAs involve systems containing taxpayer data," George said. The IRS had failed to scan servers for "critical and major vulnerabilities", while software updates had not been applied to databases containing taxpayers' information. In some cases user accounts had not been properly locked.

"As a result, the IRS is increasing its exposure to risk for malicious users exploiting accounts with default or blank passwords to steal taxpayer identities and carry out fraud schemes," George said.

"The IRS is also increasing its susceptibility to performance and security weaknesses inherent in older software versions, its exposure of taxpayer data to unauthorized disclosure, and its exposure to disruptions of system operations."

George found that the failings were as a result of “weakened management controls” over the planned improvements to the IRS’s security system. He recommended six improvements including training for employees involved in uploading data and strengthening the management of overseeing improvements.

The IRS did not immediately respond to the Guardian’s request for comment.

Under the Affordable Care Act the IRS determines who qualifies for insurance subsidies and is responsible for collecting taxes and fees. Republicans have previously expressed concern over its ability to handle the extra personal data.

In October the National Organisation for Marriage filed a lawsuit against the federal government and the IRS, claiming that someone in the agency had leaked its tax returns to opponents.

The Human Rights Campaign obtained NOM’s 2008 returns in March 2012. It published the information, including names of donors, on its website. NOM said there was a stamp on the documents which could only have come from the IRS and accused the agency of deliberately giving the information to the Human Rights Campaign.