IRS Pushing Forward With Risky Systems

If a company was implementing a new customer tracking system which had security controls already identified as "not sufficient to ensure that illegal browsing, changes or theft of [customer] files would be detected" there would be some backlash. If that company was in the health care industry their would be HIPAA violations resulting in fines. If that company accepts credit card transactions they would be out of compliance with PCI Data Security Standard requirements and face penalties. If that company was publicly traded, their would be Sarbanes-Oxley violations potentially resulting in jail time for executive management.

Apparently though, if that 'company' isn't really a company, but is instead a government agency, there are no fines, penalties, or jail time. Just $2 billion tax payer dollars flowing to whatever company was contracted to develop the half-baked system, and perhaps a cabinet level promotion for the head of the agency. That is the situation the IRS finds themselves in.

I noted a little over a month ago that the IRS network was found to have almost 2,000 rogue web servers, over 500 of which were found to have Critical security vulnerabilities. Now the Treasury Inspector General for Tax Administration has expressed concerns with a new IRS system that has issues the IRS is "aware of, and even self-identified."

The IRS wants taxpayers to know that their $2 billion is money well spent. They "stressed that no taxpayer data has been harmed", stopping short of saying "yet". By all means, lets spend $2 billion to put a system online with known security issues based on the premise that it hasn't been compromised yet and just hope that good luck streak continues. Although the Treasury IG believes that the "vulnerabilities increased the risks that unscrupulous people could gain access to vast amounts of taxpayer information with little chance of detection and that systems could not be recovered effectively during an emergency", lets put it online, load it with sensitive taxpayer data, and hope for the best. Seems lke another example of our National Insecurity.