E-filing security.

• Author: Laffie, Lesli S.
• Position: IRS electronic filing system vulnerability

The General Accounting Office (GAO) recently released a Report to the Chairman of the Senate Committee on Governmental Affairs, entitled Information Security--IRS Electronic Filing Systems. The report examines the computer controls of the IRS's electronic filing (e-filing) systems and electronically transmitted taxpayer data that ensure information security.

According to the GAO, during last year's filing season, IRS computer controls were inadequate.

During the 2000 filing season, the GAO demonstrated that hackers could have gained access to the IRS's e-filing systems, as well as the electronically transmitted tax return data held by those systems. Such access would allow an individual accessing the data to view and modify the taxpayer data.

The GAO identified the following five major shortcomings in the IRS's e-filing systems:

* Computers that supported the e-filing program were not effectively restricted to external users.

* The operating system that ran the e-filing systems was not securely configured.

* Sufficient password management and user account practice implementation were lacking.

* Access to computer files and directories that contained tax return information and e-filing system data was not adequately restricted.

* The IRS had not yet begun to protect tax return data with file encryption.

Technical recommendations included improvement of specific access controls dealing with the e-filing systems and networks. The GAO also suggested that the IRS complete certification and accreditation of its e-filing systems, assess security risks and routinely monitor effectiveness of access controls dealing with such risks, improve data reliability and integrity controls and notify taxpayers of privacy risks associated with e-filing.

On notification of the problems with...