```

[Senate Hearing 114-322]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 114-322

   INTERNAL REVENUE SERVICE DATA THEFT AFFECTING TAXPAYER INFORMATION

=======================================================================

                                HEARING

                               before the

                          COMMITTEE ON FINANCE
                          UNITED STATES SENATE

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION

                               __________

                              JUNE 2, 2015

                               __________

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     
                                     

            Printed for the use of the Committee on Finance
                                   ______

                         U.S. GOVERNMENT PUBLISHING OFFICE 

20-598-PDF                     WASHINGTON : 2016 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001

                          COMMITTEE ON FINANCE

                     ORRIN G. HATCH, Utah, Chairman

CHUCK GRASSLEY, Iowa                 RON WYDEN, Oregon
MIKE CRAPO, Idaho                    CHARLES E. SCHUMER, New York
PAT ROBERTS, Kansas                  DEBBIE STABENOW, Michigan
MICHAEL B. ENZI, Wyoming             MARIA CANTWELL, Washington
JOHN CORNYN, Texas                   BILL NELSON, Florida
JOHN THUNE, South Dakota             ROBERT MENENDEZ, New Jersey
RICHARD BURR, North Carolina         THOMAS R. CARPER, Delaware
JOHNNY ISAKSON, Georgia              BENJAMIN L. CARDIN, Maryland
ROB PORTMAN, Ohio                    SHERROD BROWN, Ohio
PATRICK J. TOOMEY, Pennsylvania      MICHAEL F. BENNET, Colorado
DANIEL COATS, Indiana                ROBERT P. CASEY, Jr., Pennsylvania
DEAN HELLER, Nevada                  MARK R. WARNER, Virginia
TIM SCOTT, South Carolina

                     Chris Campbell, Staff Director

              Joshua Sheinkman, Democratic Staff Director

                                  (ii)

                            C O N T E N T S

                              ----------                              

                           OPENING STATEMENTS

                                                                   Page
Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman, 
  Committee on Finance...........................................     1
Wyden, Hon. Ron, a U.S. Senator from Oregon......................     3

                               WITNESSES

Koskinen, Hon. John A., Commissioner, Internal Revenue Service, 
  Washington, DC.................................................     5
George, Hon. J. Russell, Treasury Inspector General for Tax 
  Administration, Department of the Treasury, Washington, DC.....     7

               ALPHABETICAL LISTING AND APPENDIX MATERIAL

George, Hon. J. Russell:
    Testimony....................................................     7
    Prepared statement...........................................    37
    Responses to questions from committee members................    42
Hatch, Hon. Orrin G.:
    Opening statement............................................     1
    Prepared statement...........................................    44
Koskinen, Hon. John A.:
    Testimony....................................................     5
    Prepared statement...........................................    46
    Responses to questions from committee members................    49
Roberts, Hon. Pat:
    ``I.R.S. Data Breach May Be Sign of More Personalized 
      Schemes,'' by Patricia Cohen, New York Times, May 28, 2015.    63
Wyden, Hon. Ron:
    Opening statement............................................     3
    Prepared statement...........................................    65

                                 (iii)
 
   INTERNAL REVENUE SERVICE DATA THEFT AFFECTING TAXPAYER INFORMATION

                              ----------                              

                         TUESDAY, JUNE 2, 2015

                                       U.S. Senate,
                                      Committee on Finance,
                                                    Washington, DC.
    The hearing was convened, pursuant to notice, at 10 a.m., 
in room SD-215, Dirksen Senate Office Building, Hon. Orrin G. 
Hatch (chairman of the committee) presiding.
    Present: Senators Grassley, Crapo, Roberts, Enzi, Cornyn, 
Thune, Isakson, Heller, Scott, Wyden, Stabenow, Nelson, Carper, 
Cardin, Bennet, and Casey.
    Also present: Republican Staff: Chris Campbell, Staff 
Director; Kimberly Brandt, Chief Healthcare Investigative 
Counsel; Chris Armstrong, Deputy Chief Oversight Counsel; and 
Justin Coon; Detailee. Democratic Staff: Adam Carasso, Senior 
Tax and Economic Advisor; Dave Berick, Chief Investigator; 
Michael Evans, General Counsel; Daniel Goshorn, Investigative 
Counsel; and 
Joshua Sheinkman, Staff Director.

 OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM 
              UTAH, CHAIRMAN, COMMITTEE ON FINANCE

    The Chairman. The committee will come to order.
    Our hearing today concerns recent revelations that the 
Internal Revenue Service was the target of an organized service 
breach aimed at roughly 200,000 taxpayer accounts. We 
understand that over 100,000 of these breaches were successful, 
with cyber-criminals obtaining confidential taxpayer 
information from the agency's Get Transcript application.
    In dealing with this breach here in the Senate, this 
committee stands alone, having legislative jurisdiction over 
the Internal Revenue Code, oversight jurisdiction over the IRS, 
and wide-ranging abilities to conduct investigations dealing 
with individual taxpayer information.
    While I have raised questions in the past about the way the 
IRS prioritizes its spending, today's hearing is about finding 
out how criminals stole vast amounts of taxpayer information. 
Any questions regarding funding levels for the agency should 
wait until we have a complete understanding about what 
occurred.
    Before we turn to the technological issues, let us focus 
for a moment on the victims. Because of this breach, criminals 
were able to get personal information about roughly 104,000 
taxpayers, potentially including Social Security Numbers, bank 
account numbers, and other sensitive information. These 
taxpayers, and their families, must now begin the long and 
difficult process of repairing their reputations. And they must 
do so with the knowledge that the thieves who stole their data 
will likely try to use it to perpetrate further fraud against 
them.
    Commissioner Koskinen, put simply, your agency has failed 
these taxpayers.
    This hearing is of utmost importance as we work to find out 
what individuals and organizations were behind this breach; 
discover how this breach occurred and what steps the IRS might 
have taken to prevent it; find out what taxpayer information 
was compromised and how this may affect both taxpayers and tax 
administration going forward; and determine what tools and 
resources are necessary to better protect taxpayers, catch 
cyber-criminals, and prevent this type of breach from being 
successful in the future. Most of all, we must pledge to work 
together to make sure that this type of breach does not happen 
again.
    The secure movement of information is the lifeblood of 
international commerce and a necessary predicate for efficient 
government administration. Unfortunately, this information is 
also highly valuable to criminals.
    We see it in the headlines nearly every week: a major 
insurance company, bank, or retailer has its information 
security compromised, and personal information or corporate 
data is stolen. Federal departments, especially defense-related 
agencies, come under attack each and every day.
    The IRS is not, and will never be, exempted from this 
constant threat. In fact, there is reason to believe the IRS 
will be more frequently targeted in the future. After all, the 
IRS stores highly sensitive information on each and every 
American taxpayer, from individual taxpayers to large 
organizations, and from mom-and-pop businesses to multinational 
corporations. The challenge of data security matters a great 
deal to every single taxpayer and will continue to be a central 
challenge to tax administration in the coming years.
    Of course, data security and the protection of taxpayer 
information are of the highest importance in the prevention of 
stolen identity refund fraud. Identity theft, and the resulting 
tax fraud, costs taxpayers billions of dollars every year, and, 
once it occurs, it can take months or years for a taxpayer to 
mitigate the damage.
    It was out of concern over stolen identity refund fraud 
that Ranking Member Wyden and I quietly launched an 
investigation earlier this year, requesting information and 
documents from the country's largest tax return preparers and 
debit card companies.
    We look forward to working with the IRS as we move forward 
with this investigation and consider policy changes. We also 
look forward to hearing the report from your preparer working 
groups, and the committee looks forward to weighing in on those 
matters in the near future.
    So I welcome our witnesses today, IRS Commissioner Koskinen 
and Inspector General George. Commissioner Koskinen, earlier 
this year, when I first welcomed you before the committee as 
chairman, I noted that I hoped it would be the beginning of a 
new chapter in the long, historic relationship between the 
Internal Revenue Service and the Senate Finance Committee. I 
said that because the issues before us are too great for that 
relationship to be anything but open, honest, and productive.
    Today's topic is a great example of why that relationship 
is so important. Cyber-threats will only continue to grow, and 
those types of threats go to the core of our voluntary tax 
system. We must work together to figure out what really has 
happened, what went wrong in allowing the breach to occur, and 
how we can prevent another successful attack from taking place 
in the future.
    Finally, I would like to acknowledge that today's hearing 
occurs during somewhat unusual circumstances. The issue before 
us is the subject of several recently opened investigations, 
including a criminal investigation conducted by TIGTA. I 
caution members of the committee to be sensitive to these 
investigations when asking questions of the witnesses and be 
aware that they may not be able to provide full answers to 
every question in this public forum. In spite of these 
limitations, it is important to discuss this matter today as 
fully and candidly as possible.
    [The prepared statement of Chairman Hatch appears in the 
appendix.]
    The Chairman. With that, I would like to turn to Senator 
Wyden for his opening remarks.

             OPENING STATEMENT OF HON. RON WYDEN, 
                   A U.S. SENATOR FROM OREGON

    Senator Wyden. Thank you very much, Mr. Chairman. Mr. 
Chairman, I look forward to working with you and all our 
colleagues on what is another important and bipartisan concern 
for this committee.
    Three months ago, the Finance Committee met in a hearing on 
the latest ID thefts and other scams plaguing taxpayers, and I 
said then that that wave of attacks sure looks to me like 
organized crime. Today, we meet after 104,000 tax returns have 
been hoovered up by what appears to be a sophisticated 
organized crime syndicate.
    The problem continues to spiral, with hackers targeting 
Federal agencies, State governments including my own, and 
private companies alike, to steal money and data. One report 
from the Department of Homeland Security said Federal agencies' 
computer systems come under attack hundreds of times a day, 
tens of thousands of times a year.
    The investigation of the stolen tax returns is ongoing as 
of this morning. But once again, it seems that the thieves are 
a step ahead of the authorities. They gained access to enormous 
amounts of personal data, which is up for purchase at 
extraordinary cost in the Internet's shadowy corners. These 
rip-off artists used that data to slip past the security 
filters at the IRS and steal taxpayers' most sensitive 
financial information. So it is my view that it is fair to say 
once again that this conduct fits the definition of ``organized 
crime.''
    The thieves who steal taxpayer information could wipe out 
people's life savings and leave them in financial ruin. They 
could falsify tax returns next year or further down the road. 
They could take out huge, fraudulent home or student loans. And 
on a bigger scale, the money stolen in this cyber-crime wave 
could be funneled into yet more criminal activity. It could 
wind up in war zones. There is a possibility it could be used 
to fund acts of terror without being traced.
    Just like when the White House and the Department of 
Defense were targeted in the past, this was an attack on the 
security of Americans. I will be very direct about what is 
needed here. To protect taxpayers from this onslaught of cyber-
crime, the IRS needs a 21st-century IT system.
    Now, this is not just a question of resources, and it is 
certainly not a lack of commitment from the IRS staff. It is 
also a question of expertise. The era of punch cards and paper 
forms ended long ago. Federal agencies like the IRS need to tap 
into the expertise of our leading technology firms, our leading 
web firms--the pros who serve not millions or tens of millions 
but hundreds of millions of users.
    This expertise will allow the IRS to avoid the pitfalls of 
the past and to implement a 21st-century IT system that 
protects taxpayers' privacy, catches the hackers and the 
cheats, and funds our government as efficiently as possible. 
When that system is in place, the Congress has to step up and 
provide the funds necessary to manage those functions 
effectively.
    Legislators would not call for the Department of Defense or 
White House security budgets to be slashed after cyber-attacks, 
but the IRS's security funding has been shrinking for years. No 
company would try to defend against modern cyber-criminals with 
technology that is 20 or 30 years old, but that is what the IRS 
is stuck using in the absence of the expertise and resources to 
serve the American taxpayer.
    The Congress must also make sure that the IRS has the 
information it needs to mount the strongest possible fight 
against the fraudsters. If the IRS had access to the data on W-
2 and 1099 forms from the beginning of tax season, it would be 
much easier to catch fraudulent returns early and save 
taxpayers the nightmare of a stolen refund. Chairman Hatch and 
I have developed a bipartisan proposal to add an extra level of 
security by expanding the program that distributes unique 
passwords for individual taxpayers to use when they file. And 
when the taxpayer does become a victim of fraud, they ought to 
get more help undoing the damage more quickly and restoring 
their credit.
    It ought to be clear to all that beefing up cyber-security 
at the IRS ought to be a top priority and draw on the 
technology expertise that exists in my home State and in States 
across the land. It is my hope that our hearing today will set 
aside once again the politics of these issues and focus on 
bipartisan, fresh ideas of how to best protect our taxpayers.
    Thank you, Mr. Chairman, and I look forward to working with 
you.
    The Chairman. Thank you, Senator.
    [The prepared statement of Senator Wyden appears in the 
appendix.]
    The Chairman. Our first witness today is IRS Commissioner 
John Koskinen. Commissioner Koskinen has been serving as the 
head of the Internal Revenue Service since December 2013. Mr. 
Koskinen's extensive public- and private-sector experience has 
prepared him to confront the many challenges facing the IRS. I 
have a great deal of confidence in Commissioner Koskinen.
    I want to thank you, Commissioner, for being here with us 
today.
    Let me introduce our second witness as well, and then we 
will have you give your statements.
    Our second witness today is Inspector General Russell 
George, the Treasury Inspector General for Tax Administration, 
or TIGTA. Inspector General George has been serving as the head 
of TIGTA since 2004. Mr. George has extensive public-sector 
experience, including working for the House of Representatives' 
Committee on Government Reform and Oversight.
    I have a great deal of respect for you also, Mr. George, 
and I want to thank you, Mr. Inspector General, for being here 
today.
    So if you will, Commissioner Koskinen, we will start with 
you. We hope you can keep your remarks within 5 minutes, 
because I am sure we are going to have a lot of questions.

  STATEMENT OF HON. JOHN A. KOSKINEN, COMMISSIONER, INTERNAL 
                REVENUE SERVICE, WASHINGTON, DC

    Commissioner Koskinen. Chairman Hatch, Ranking Member 
Wyden, and members of the committee, thank you for the 
opportunity to appear before you today to provide information 
on the recent unauthorized attempts to obtain taxpayer data 
through the IRS's Get Transcript online application.
    Securing our systems and protecting taxpayer information 
are top priorities for the IRS. Even with our constrained 
resources as a result of repeated decreased funding over the 
past few years, we continue to devote significant time and 
attention to this challenge. At the same time, it is clear that 
criminals have been able to gather increasing amounts of 
personal data as the result of data breaches at sources outside 
the IRS, which makes protecting taxpayers increasingly 
challenging and difficult.
    The unauthorized attempts to access information using the 
Get Transcript application were made on approximately 200,000 
taxpayer accounts from questionable e-mail domains, and the 
attempts were complex and sophisticated in nature. The attempts 
were made using taxpayers' personal information already 
obtained from sources outside the IRS.
    It should be noted that the third parties who made these 
unauthorized attempts to obtain tax account information did not 
attempt to gain access to the main IRS computer system that 
handles tax filing submissions. The main IRS computer system 
remains secure, as do other online IRS applications such as 
``Where's My Refund?''
    To access Get Transcript, taxpayers must go through a 
multistep authentication process to prove their identity. They 
must first submit personal information, such as their Social 
Security Number, date of birth, tax filing status, and home 
address. The taxpayer then receives an e-mail from the Get 
Transcript system containing a confirmation code that they 
enter to access the application and request a transcript.
    Before the request is processed, the taxpayer must respond 
to several so-called out-of-wallet questions designed to elicit 
information that only the taxpayer would normally know, such as 
the amount of their monthly mortgage or car payment.
    During the middle of May, our cyber-security team noticed 
unusual activity on the Get Transcript application. At the 
time, our team thought this might be a ``denial of service'' 
attack, where hackers try to disrupt a website's normal 
functioning. They ultimately uncovered questionable attempts to 
access the Get Transcript application.
    Of the approximately 100,000 successful attempts to access 
the Get Transcript application, only 13,000 possibly fraudulent 
returns were filed for tax year 2014, for which the IRS issued 
refunds totaling $39 million. We are still determining how many 
of these returns were filed by actual taxpayers and which were 
filed using stolen identities.
    For now, our biggest concern is for the affected taxpayers 
to make sure they are protected against fraud in the future. We 
have marked the accounts of the 200,000 taxpayers whose 
accounts were attacked by outsiders to prevent someone else 
from filing a tax return in their name, both now and in 2016. 
Letters have already gone out to the approximately 100,000 
taxpayers whose tax information was successfully obtained by 
unauthorized third parties. We are offering credit monitoring 
at our expense to this group of taxpayers. We are also giving 
them the opportunity to obtain an Identity Protection Personal 
Identification Number, or IP PIN as it is known. This will 
further safeguard their IRS accounts.
    We are also in the process of writing to the 100,000 
taxpayers whose accounts were not accessed to let them know 
that third parties appear to have gained access from outside 
the IRS to personal information such as their Social Security 
Numbers and other information. We want them to be able to take 
steps to safeguard that data. The Get Transcript application 
has also been taken down while we review options to make it 
more secure without rendering it inaccessible to legitimate 
taxpayers.
    The problem of criminals using stolen personal information 
to impersonate taxpayers is not a new one. The problem of tax 
refund fraud exploded from 2010 to 2012. Since then, we have 
been making steady progress both in terms of protecting against 
fraudulent refund claims and prosecuting those who engage in 
this crime. Over the past few years, almost 2,000 individuals 
were convicted in connection with refund fraud related to 
identity theft.
    Additionally, as our processing filters have improved, we 
have also been able to stop more suspicious returns at the 
door. This past filing season, our fraud filters stopped almost 
3 million suspicious returns before processing, an increase of 
over 700,000 from the year before. But the criminals continue 
to become more sophisticated and creative. For that reason, as 
the chairman noted, we recently held a sit-down meeting with 
the leaders of the tax software and payroll industries and 
State tax administrators. We all agreed to build on our 
cooperative efforts of the past and find new ways to leverage 
this public-private partnership to help battle identity theft. 
We expect to announce more details shortly.
    Congress plays an important role too, and can help by 
approving the President's 2016 budget request, which provides 
for $101 million specifically devoted to identity theft and 
refund fraud. And as Senator Wyden noted, a key legislative 
request, among others in the budget, is a proposal to 
accelerate information return filing dates generally to January 
31st of the year following the year for which the information 
is being reported. That would assist the IRS in identifying 
fraudulent returns and reduce refund fraud related to identity 
theft.
    Chairman Hatch, Ranking Member Wyden, and members of the 
committee, this concludes my statement, and I would be happy to 
answer your questions.
    [The prepared statement of Commissioner Koskinen appears in 
the appendix.]
    The Chairman. Well, thank you, Mr. Koskinen.
    I will turn to Mr. George.

STATEMENT OF HON. J. RUSSELL GEORGE, TREASURY INSPECTOR GENERAL 
FOR TAX ADMINISTRATION, DEPARTMENT OF THE TREASURY, WASHINGTON, 
                               DC

    Mr. George. Thank you, Chairman Hatch, Ranking Member 
Wyden, members of the committee. Thank you for the opportunity 
to discuss the data breach that occurred at the Internal 
Revenue Service.
    On May 26, 2015, the IRS announced that criminals had used 
taxpayer-specific data acquired from non-IRS sources to gain 
unauthorized access to information on approximately 100,000 tax 
accounts through the IRS's Get Transcript application. Our 
Office of Investigations continues to investigate this 
incident, coordinating with other Federal enforcement agencies.
    According to reports we received from the IRS, which we 
have not yet validated, an individual or individuals succeeded 
in clearing an authentication process that required knowledge 
of prior information about the taxpayer, including Social 
Security Number, dates of birth, tax filing status, street 
addresses, as well as answers to personal identity verification 
questions that typically only the taxpayer would know.
    Security of taxpayer data has been designated by TIGTA as 
the top concern facing the IRS since fiscal year 2011. Due to 
the significant risks in this area, we currently have an audit 
underway to assess the IRS's processes for authenticating 
taxpayers at the time the tax returns are processed and when 
accessing IRS services.
    Information obtained from data breaches in recent years and 
increased availability of personal information on the Internet 
have resulted in a weakening of controls used to authenticate 
individuals accessing personal data. The risk for this type of 
unauthorized access to tax accounts will continue to grow as 
the IRS focuses its efforts on delivering taxpayers' self-
assisted, interactive online tools. More avenues for online 
assistance also mean more opportunities for exploitation by 
hackers and greater risk to the IRS and taxpayers.
    In prior audits, we have identified a number of areas in 
which the IRS could better protect taxpayer data and improve 
its overall security posture. For example, we found that the 
IRS had not always applied high-risk computer security 
upgrades, known as ``patches,'' to help ensure IRS systems were 
protected and operated securely.
    In another audit, we found that the IRS office responsible 
for addressing cyber-attacks was not monitoring a significant 
percentage of IRS servers, which puts the IRS's networks, data, 
and applications at risk.
    The IRS is continuously under attack by those using the tax 
administration system for personal gain in various ways. These 
attacks and the methods used to perpetrate them are constantly 
changing and require constant monitoring by the IRS. Two of the 
most pervasive frauds currently being perpetrated that impact 
tax administration are the phone impersonation scheme and 
identity theft.
    In summary, the IRS faces the daunting task of protecting 
its data and IT environment from the ever-changing and rapidly 
evolving hacker world. This incident that is the subject of the 
hearing provides a stark reminder that even security controls 
that may have been adequate in the past can be overcome by 
hackers, who are anonymous, persistent, and have access to vast 
amounts of personal data and knowledge. The IRS needs to be 
even more vigilant in protecting the confidentiality of 
sensitive taxpayer data. Otherwise, as shown by this incident, 
taxpayers can be exposed to the loss of privacy and to 
financial damages resulting from identity theft or other 
financial crimes.
    We at TIGTA are committed to our mission of ensuring an 
effective and efficient tax administration system and 
preventing, detecting, and deterring waste, fraud, and abuse. 
As such, we plan to provide continuing audit and investigative 
coverage of the IRS's efforts to effectively protect sensitive 
taxpayer data and investigate any instances of attempts to 
corrupt or otherwise interfere with tax administration.
    Chairman Hatch, Ranking Member Wyden, and members of the 
committee, thank you for the opportunity to share my views.
    [The prepared statement of Mr. George appears in the 
appendix.]
    The Chairman. Well, thank you, Mr. George.
    Let me start with you, Inspector General George. In your 
written testimony, you said that TIGTA has designated the 
security of taxpayer data as the top concern facing the IRS in 
every year since 2011, as you stated here today. But in spite 
of your concerns, the IRS has not implemented many of TIGTA's 
audit recommendations about how the IRS can strengthen its IT 
security.
    You noted that as of March 2015, the IRS had not 
implemented 44 of TIGTA's audit recommendations about 
information technology security, 10 of which were more than 3 
years old. Beyond that, the IRS had disagreed with another 10 
recommendations about IT security.
    Mr. Inspector, if the IRS had fully implemented TIGTA's 
past recommendations about IT security, do you believe that the 
recent attacks on the Get Transcript application would have 
been successful?
    Mr. George. I cannot at this stage, Mr. Chairman, give you 
a definitive answer as to whether or not it would have been 
possible. But I can say it would have been much more difficult 
had they implemented all of the recommendations that we made.
    The Chairman. Thank you.
    Mr. Commissioner, in your testimony, you acknowledge that 
the use of stolen identities to perpetrate tax fraud has really 
exploded in recent years. Now, due to the theft of personal 
information from your agency, there are more than 100,000 new 
identities on the international black market, and as many as 
13,000 new fraudulent returns have been filed, at a cost to 
taxpayers of up to $39 million.
    When it comes to identity theft and tax fraud, I do not 
think we can adopt a ``pay and chase'' mentality, or we will 
lose every single time. Stolen identities are a significant 
problem, but also not a problem that your agency can solve on 
its own. What your agency can solve is the ease with which 
criminals then use this stolen information to obtain fraudulent 
tax refunds.
    News reports indicate that the recent IRS identity thieves 
may have been in Russia. Two years ago, TIGTA found large 
numbers of fraudulent refunds issued to Bulgaria, Lithuania, 
and China.
    Now, I am not asking you to speak about the new 
investigation, but can either of you tell the committee about 
what more can be done to stop these thieves from robbing the 
Treasury both at home and abroad? And do you feel like you have 
received the adequate cooperation of the Justice Department and 
others in finding and stopping these perpetrators?
    Commissioner Koskinen. Well, it is, as noted, an 
increasingly complicated challenge everyone faces in the 
financial world. I would just note, as a correction, there are 
not 104,000 new stolen identities. Those identities were stolen 
before the transcripts were accessed. What is available now is, 
for those transcripts out there, more details to go along with 
those stolen identities, and that is part of the problem. As 
there are breaches across the private sector or across the 
economy, all of that data is being collected by organized 
criminals who have a database in what is the so-called dark net 
that exceeds the amount of data that is in the regular web that 
we all use. So it is, as the Inspector General says, an 
increasingly complicated challenge. What worked yesterday, what 
worked a year ago, may not be working anymore today. So you 
continually have to attack that problem.
    We work very closely with the Inspector General and value 
their input, and, in fact, in many cases we ask them to do 
tests, to do reviews and audits of the security and the IT 
systems as we go forward.
    In response to your question, we have looked at that in 
terms of the suggestions made about improvements we could make. 
Virtually all of the reports we have had recently have 
appropriately looked at our security with regard to our basic 
database. Those reports and those recommendations did not deal 
with the e-authentication process for this website. The problem 
with the e-authentication process for the website is, what was 
a perfectly good security mechanism that was used by private-
sector financial institutions and others, as the Inspector 
General says, is being overtaken by events.
    The Chairman. In too many cases, foreign criminals are 
reaching into the Federal Treasury from abroad. Now, do you get 
adequate cooperation from foreign governments?
    Commissioner Koskinen. Well, we get very good cooperation 
from the Justice Department. As I noted, with our Criminal 
Investigation Division, and working with TIGTA, we have thrown 
almost 2,000 people in jail. Our resources there--we have 300 
fewer criminal investigators than we had 4 or 5 years ago.
    It is a problem when you find, as we do, that an increasing 
number of the attacks are coming from criminal syndicates in 
Eastern Europe and Asia. Extradition, finding, tracking those 
people down, is much more difficult, and, as a general matter, 
we do not get a lot of cooperation.
    The Chairman. Okay. Senator Wyden?
    Senator Wyden. Thank you very much.
    Commissioner, at a hearing in March, I pointed out that 
with the increased sophistication of those involved in taxpayer 
ID theft, it looked to me like the work of organized crime. I 
understand that you have since stated that most of taxpayer ID 
theft involves organized crime. You also said that the recent 
taxpayer ID theft involved bulk attempts to access taxpayer 
records.
    Now, I know the investigation of this latest ID theft is 
ongoing, but from what I have seen thus far, it sure looks to 
me like this attack was undertaken by an organized crime 
syndicate that already had access to enormous amounts of data 
on U.S. taxpayers. Would you agree?
    Commissioner Koskinen. I would. As I said, there is an 
unimaginable amount of personal data in the hands of criminals 
as a result of data breaches across the economy, not only here 
but criminal syndicates around the world, in Eastern Europe and 
in Asia. And the battle is becoming increasingly more 
difficult, not just for us but for everyone in the private 
sector. In many ways, this event is a shot across the bow to 
remind people of the nature of the battle we are fighting and 
the sophistication of the enemy.
    Senator Wyden. And would you then say, given that you said 
you agreed with my description of the threat, that your 
challenge is making sure you are in a position to have a game 
plan so you can stay ahead of these increasingly sophisticated 
threats to our taxpayers?
    Commissioner Koskinen. Right. Whether we are ever going to 
be able to stay ahead or not is the challenge. Our goal right 
now is to try to make sure that we are at least even with them 
in understanding what is going on and being able to protect 
taxpayer data and taxpayers from these ongoing attacks.
    Senator Wyden. Let us talk for a few minutes then about the 
game plan that you would have to have. As I say, I think the 
sophistication of these organized crime syndicates is such 
that, whenever you close this door, they look for the next one, 
and that is why I talked about how we are going to try to take 
them on.
    It seems to me it comes down to having the people who have 
the skills and experience to combat the threats, the critical 
pay authority to be able to hire them, and sufficient funding 
to upgrade the IRS computer security systems.
    Are those generally the elements of the kind of strategy 
that you want to have?
    Commissioner Koskinen. Those cover most of the significant 
points, particularly what we call the streamlined critical pay. 
It is a small number of people whom we are authorized to hire, 
but it allows--our present head of Information Technology is on 
streamlined critical pay. That program worked for about 14 
years, but it was not extended 2 years ago. I was just talking 
to our IT head. We had two very senior, sophisticated IT people 
we could not hire because they did not want to go through the 
normal government process.
    So it is critical to us. It is a total authorization of 40. 
We had 29 when I started; we are down to 16 as that program 
runs off. A key member of our cyber-security unit is on 
critical pay. Our Online Services Program Director was hired 
through streamlined critical pay authority. So that authority 
is critical for the small number of people we need who are 
going to be world-class experts at dealing, not only with 
technology, but with security.
    Senator Wyden. What does this committee need to do--because 
you have heard Chairman Hatch and I indicate we want to work 
with you on a bipartisan basis to address this. What does this 
committee need to do to assist you in executing this game plan 
to make sure, for example, you have an adequate number of 
people in cyber and these kinds of issues?
    Commissioner Koskinen. Well, I appreciate the chairman's 
note that we need to work on this together. This is not an 
issue that has a political overtone to it. This is a challenge 
that faces every American, faces every company in this country.
    As I noted, if we could get W-2s and information returns 
earlier, it would allow us to be more effective in protecting 
against identity theft. To the extent that we could get 
authority to, in fact, adjust the way Social Security Numbers 
are produced on W-2s, it would help us ensure that those W-2s 
are not fraudulent.
    There are other legislative supporting issues, including 
streamlined critical pay, that would be very helpful. And, 
obviously, I think the chairman is right. We have not made a 
point in this presentation that budget is an issue, but we are 
running an antiquated system with some applications that are 50 
years old. In some cases, as the IG noted, we have not even 
been able to provide patches for all of the upgrades. Some of 
our systems do not have patches because they are no longer 
supported by the providers.
    So we obviously do need jointly to figure out what it takes 
to make sure that this system is able to protect people.
    Senator Wyden. Commissioner, thank you. It just is clear to 
me that if you have IT from the Dark Ages, you are not going to 
be able to stay on top of these kinds of problems. So I am 
committed to working with you, and I also mentioned in my 
opening statement there are some very good people in the 
technology sector, people who run major tech firms, whom I 
think would also be available to work with you all. So we are 
committed to making sure that you understand there is a 
bipartisan effort to help you put that game plan in place.
    Thank you, Mr. Chairman.
    The Chairman. Thank you.
    Senator Grassley?
    Senator Grassley. First of all, Mr. Koskinen, I thank you 
for coming for this conversation, and the reason for that is 
that the theft of personal private tax information of over 
100,000 taxpayers is deeply concerning, because our whole tax 
system is based on the proposition of voluntary compliance and 
privacy and all that.
    So I am asking about a letter I sent to you asking a number 
of questions related to the data breach, and I do not expect 
those answers now, but I want to find out when I am going to 
get answers to my letters. This would include requests for 
documents that should shed light on whether the IRS carefully 
considered security risks prior to instituting the Get 
Transcript online service. My letter asks that you provide a 
response by June 4th, and it was sent last week.
    Some examples of what we are concerned about are whether or 
not you had a risk assessment plan, an implementation plan, and 
mitigation plans. Those are some of the documents I am asking 
for.
    Do you have any idea where my request stands in the 
process? And do you expect to be able to fully respond to my 
letter by June 4th? And if not, when do you expect that I would 
be able to get a response?
    Commissioner Koskinen. That is a good question. As you 
know, and as I committed to the chairman at my confirmation 
hearing, we treat letters from the Hill very seriously. They 
are a high priority. Sometimes we get a request to give a 
response within a week to a lot of data that is difficult for 
us, but our goal is to, in fact, not delay this any longer than 
necessary.
    The amount of information you want probably makes it 
unlikely we will get it by the end of this week, but certainly 
by next week we expect to be able to provide you that data. The 
chairman has a pending request to us, a very thoughtful 
request, about our entire IT program, which is in the process 
of coming back to him. It has taken longer than we would like, 
but it is going to be 40 or 50 pages long, with very, I think, 
instructive detail--I found it interesting to read--about the 
priorities we have, the challenges that we have faced over 
time, and how we have responded to those.
    But we will point out to you that we take risk seriously. 
When this Get Transcript was put up, when any new application 
is put up, we look at the security risks. Whenever we have a 
new program, we work with the Inspector General to see that it 
is being set up appropriately, that there are appropriate 
protections.
    And so, it is an important question, one that, as we move 
along--not only do we have risk mitigation plans when we start, 
we monitor as we go forward each year what are the schemes, 
what is going on with identity theft, where are the attacks 
coming from. We are pinged, as it were--not necessarily 
attacked but just people checking to see where we are and what 
they might be able to find--over a billion times a year. So we 
have security going on every day.
    The Chairman. If I can interrupt, we have a vote on. 
Senator Grassley will finish his questions, and then next is 
Senator Carper. And I will try to get back by then. If not, 
after Senator Carper is Senator Enzi.
    Senator Grassley. Okay.
    The Chairman. So, in that order.
    Senator Grassley. Yes. Well, I think I heard you say that 
you will fully respond. It may not be by June 4th but next 
week. Thank you.
    Mr. George, IGs are very important offices as far as I am 
concerned. Did your office evaluate the security measures put 
in place by the Get Transcript service either before or after 
it went online? And if so, what were your office's findings? 
Did the IRS fully comply with any recommendations you may have 
made?
    Mr. George. Mr. Grassley, we did take a look at an earlier 
iteration of the Get Transcript program and at that time made 
some recommendations that we believe were implemented. We have 
not taken a look at a subsequent version of it until now. But 
obviously we will be looking at that.
    Senator Grassley. Okay. Mr. Koskinen, reportedly the 
attacks began in mid-February, but the IRS failed to notice 
suspicious activity until mid-May. Why was the IRS not able to 
detect the malicious activity when it initially began?
    Commissioner Koskinen. Last filing season, there were 23 
million successful downloads on the Get Transcript application, 
so it is a huge volume. We now know when it started by going 
back through our logs. We log every transaction. They were 
shrouded under the huge volume of requests going out 
legitimately.
    When the filing season ended, I think what happened was 
that the volume dropped--not ``I think.'' I know it dropped, 
and then it suddenly started up again. But, by that time, the 
volume of legitimate requests had dropped, and the activity 
became visible to us. I am not sure that people expected it to 
be visible, but anyway, that was when we found it. It was in 
mid-May when we noticed it. As I say, first we thought it was a 
denial of service attack, because things were backing up in a 
way that was unexpected. Within a couple days, our security 
people went through and figured out it was not that; it was, in 
fact, unauthorized attempts to access the data. And as soon as 
they found that out, within a day or two they sat down with us. 
We advised the Hill, and as I say, I am delighted that we have 
been able to notify the 104,000 taxpayers already.
    Senator Grassley. My time is up. Thank you.
    Senator Carper. Thanks, Mr. Chairman. Gentlemen, welcome. 
It is great to see you both. We appreciate your presence today. 
We appreciate very much your service to our country.
    I want to start off by going back to Commissioner Koskinen 
talking about what the IRS is doing in reaching out to those 
citizens, those taxpayers whose information has been or may 
have been compromised to try to help them in a time of 
uncertainty and probably a time of considerable concern and 
worry.
    A lot of us use the Golden Rule to kind of guide us in our 
lives: treat other people the way we would want to be treated. 
Tell me how the IRS is, if you will, using the Golden Rule to 
reach out to the people whose information may have been put at 
risk, or has been put at risk.
    Commissioner Koskinen. The investigation is still going on 
by ourselves, by the Inspector General, but one of our concerns 
was, as soon as we knew that there had been inappropriate 
access and data had been released, our first concern was 
taxpayers. We regret that this attack took place. We understand 
that it is a traumatic event for taxpayers. We work with 
taxpayers as victims of identity fraud every filing season, 
virtually every day.
    So our goal was, even while we were trying to get to the 
bottom of it, once we were able to identify the taxpayers whose 
information had gone out, our goal was to get that notice to 
them as quickly as we could. We secured their accounts--we 
secured the accounts of the other 100,000 even though no data 
went out--so that there would not be false refunds available to 
be filed against their Social Security Numbers.
    As I say, we have completed the mailings to the 104,000. We 
are offering them, at our expense, credit protection. We are 
also offering them the option to authenticate themselves and 
get an Identity Protection PIN, or an IP PIN, to give them even 
further security as they go forward.
    So we have done everything we think we can do, and most 
importantly, we have done it as quickly as we could, because we 
think it is important for them to have that information.
    Senator Carper. Thank you. Just very briefly, did you say 
the letters have been sent or are being sent?
    Commissioner Koskinen. The letters are all in the mail.
    Senator Carper. And when would you expect----
    Commissioner Koskinen. The letters for the 104,000. We are 
now processing the letters to the 100,000 where no data 
escaped, but we think they need to be notified that we have 
evidence that criminals have access to their personal 
information.
    Senator Carper. Do those letters include phone numbers that 
people can call to have further conversation and gain some 
further assurances?
    Commissioner Koskinen. There are numbers to call, although, 
as you know, the ability to get us on the phone is not as good 
as we would like it to be, so we have posted information on our 
website. We are suggesting they go to the website first if they 
have questions. And we have already had some people showing up 
at our Taxpayer Assistance Centers, and we are providing them 
assistance as well.
    Senator Carper. All right. Sometimes people ask me why I 
have had some success in my life. I always say, ``I have always 
surrounded myself with people smarter than me.'' My wife has 
often said, ``It is not hard to find them.'' But I want to talk 
about--I want to go back to the issue of streamlined critical 
pay.
    I would like for us to think--and I will ask you to answer 
for the record. If we were to restore this program, which I 
think ended in 2013----
    Commissioner Koskinen. Yes.
    Senator Carper. If we were to fully restore and fund this 
program, what would be the cost of that on an annual basis? 
Compare that for us with the cost of this breach. What is this 
costing the Treasury as we attempt to respond to it, at least 
to date? You do not have to do that right now, but if you have 
it off the top of your head, that would be fine. I would love 
to know what kind of return we would get on the investment if 
we were to restore this program.
    Commissioner Koskinen. The Inspector General did a review 
of the program that he published last December, and, as a 
general matter, it appeared that the cost to the Government was 
$400,000 or $500,000 a year, because, you know, the pay 
increase differential is relatively modest. We only had about 
30 people who had taken advantage of it. And some of them get 
paid less than senior SESers. So for the $400,000 or $500,000, 
we think you get a great return. As I say, the 13 million 
returns that went through with refunds out of the 104,000 have 
refunds totaling $39 million. Now, some of those will turn out 
to be real taxpayers, but obviously the return on the 
investment is significant.
    As I said, the head of our IT program, who is wonderful, is 
a streamlined critical pay guy. We lost the three people who 
were great data analytics people, including an expert on 
authentication.
    Senator Carper. Thank you. Inspector General, can you give 
me a number, 10 to 1, 50 to 1?
    Mr. George. I do not know that we have a number.
    Senator Carper. I am going to ask you to just respond to 
that for the record, if you would.
    Mr. George. We will, to the extent that we can, but I would 
say that we did find that the program was operated 
successfully, and it was justified.
    [The information appears in the appendix on p. 44.]
    Senator Carper. Okay. Thank you.
    Outside help--you are not in this by yourself. You have 
other Federal agencies that have responsibilities to be of 
assistance to you at the IRS, and one of those is the 
Department of Homeland Security. I would just ask you for the 
record what help have they provided, and is there more that 
they and other agencies should be doing?
    Commissioner Koskinen. We have regular communications with 
Homeland Security. I have met with the Secretary of Homeland 
Security, actually at your suggestion. They provide us 
technical expertise. We alerted them immediately, even when we 
thought it was just a denial of service attack, that this was 
an issue they needed to know about. We alerted the Inspector 
General.
    Homeland Security has been very supportive, and what they 
provide is updated information about what they are seeing 
across the spectrum. So there is a good working relationship 
across the Government of agencies under attack trying to see 
what are the patterns, what is going on, and what can we learn 
from each other.
    Senator Carper. All right. Thank you both very much.
    Senator Enzi?
    Senator Enzi. Thank you, and thank you, Mr. Commissioner 
and Mr. Inspector General, for being here. I read your 
testimony. I thought of some other possibilities for the data 
breach, and I was reminded of them when I filed my taxes. I had 
overpaid, and I do not have electronic transfer to the bank, 
because I am not going to share that information with the IRS 
or anybody else. So I received my tax refund in an envelope, of 
course, a paper check, and what surprised me was, in the 
envelope there was also a flier from the Consumer Financial 
Protection Bureau.
    Now, the Consumer Financial Protection Bureau has the power 
to examine and impose reporting requirements and all kinds of 
regulations on financial institutions and on personal 
information. They are collecting everything. People are worried 
about the National Security Administration. They ought to worry 
about the Consumer Financial Protection Bureau. They are 
getting all of our data all of the time, and that is one of the 
possibilities for a security breach.
    I do not believe the authority extends to the IRS to 
solicit Americans' stories about their money through the 
Consumer Financial Protection Bureau. Additionally, since the 
Consumer Financial Protection Bureau is funded by a transfer of 
non-appropriated funds from the Federal Reserve System's 
combined earnings before it ever gets to the general fund, I 
question whether it is appropriate to use taxpayer dollars to 
advertise the Consumer Financial Protection Bureau as the IRS 
did by including this mailing with the tax refunds.
    And, lastly, because the CFPB is supposed to be an 
independent organization, I do not believe the Treasury 
Department should be soliciting information on behalf of the 
entity. So I would appreciate answers to the following 
questions. Some of these will be more detailed than the time 
that we have for them, but I would like to know what authority 
the Treasury Department relied on to include that information 
in the IRS tax refunds. What agency paid to print and mail 
those fliers? Have you respected all the boundaries concerning 
confidential taxpayer information? Could hackers be getting 
data from the Consumer Financial Protection Bureau that is used 
with the IRS from data that maybe the IRS is sharing with that 
department?
    Mr. Commissioner, could you--some of those I will put in 
more detail for written answers, but my best chance of getting 
an answer is right now. So how did that happen to wind up in my 
statement?
    Commissioner Koskinen. I am delighted to respond. First, I 
should make a correction to the record. I just talked about 13 
million returns. It is 13,000 returns had a false refund, 
potentially false refund. There may have been real taxpayers in 
my previous question.
    With regard to this, we often provide taxpayers with 
information that may be of interest or support to them, 
particularly in financial matters. We do not share--under our 
protection of taxpayer data--information with other Federal 
agencies unless there is a specific statutory authorization for 
that, and to my knowledge, there is not one with the Consumer 
Financial Protection Bureau.
    I will be happy to get you further details as to who paid 
for the flier, why it was put in there. Generally, if we 
provide information to taxpayers, it is for their assistance, 
for their information, in ways that may be helpful to them. We 
are not asking for them to provide us additional information in 
those filings, but we will get you more detailed information, 
and I will get you that answer, again, if you will provide the 
detail of that question. Do not wait for the record. If you 
will just send me a note, I will get you the answer back 
quickly.
    Senator Enzi. Okay. I will be asking you some questions 
about that, because I know there is even a cost to putting 
something in an envelope.
    A different question. Some unlicensed tax return preparers 
maybe are preying on uninformed taxpayers, and I did not 
exactly see that in the testimony, but I know that is one of 
the possibilities for places where people may be getting the 
information. To what degree is the IRS working to eliminate 
these fraudulent taxpayer return people?
    Commissioner Koskinen. We monitor tax preparers. We have 
actually had criminal prosecutions against a number that have 
taken advantage of their clients. We are concerned about, not 
only criminal tax preparers, but uninformed tax preparers, and, 
as you know, we requested legislation that would allow us to 
require minimum qualifications for a tax preparer. If you go 
into particularly low-income or immigrant communities, you will 
see people advertising, ``Come with us. We will get you a big 
refund.'' They do not say, ``Whether you are entitled to it or 
not,'' but that is basically what they are up to.
    And so, to the extent we can, we have a voluntary program 
that provides continuing education for tax preparers who want 
to sign up, but we do monitor fraudulent returns, and, if there 
is a pattern that they come from an individual preparer or 
group of preparers, we refer those cases for prosecution.
    Senator Enzi. Thank you. I appreciate you being here.
    The Chairman. Well, I think I might as well ask a couple 
questions. But first we will go to the senior Senator from 
Kansas.
    Senator Roberts. Well, thank you, Mr. Chairman.
    Gentlemen, thank you for coming. Thank you for endeavoring 
to get to the bottom of this and come up with some answers.
    I must tell you, just the other day, when coming back to 
Washington on an airplane from Kansas, somebody leaned over and 
said, ``What is this business with the IRS?'' And I responded 
with regards to what I thought was his concern with regards to 
the ongoing targeting of conservative groups applying for 
exempt status. He says, ``No, no, no, no, no. There has been an 
attack.'' I said, ``Oh, well, we have a breach. We have a 
cyber-attack.'' He said, ``Well, what was that all about?'' And 
I said, ``Well, we do not know yet, but we are going to have a 
hearing, and I know we can try to get to the bottom of it. But 
what we do know is that this is a foreign hacker, probably from 
Russia, probably Russian mafia.'' There was a long pause, and 
he looked at me, and he said, ``I do not really have anything 
more to say.'' So this whole thing just rendered him 
speechless, and I think a lot of people are in the same boat. 
And it is a paradox of enormous irony.
    My staff tells me that just prior to this breach, privacy 
experts went in to brief them weeks ago, just weeks ago, on how 
safe data was contained in the Get Transcript system and how it 
was safe, and that is a ``was'' now, not an ``is.''
    I do not think this is a new threat. I know it is not to 
both of you. The agency, the Inspector General, the GAO, and 
the committees with oversight have been concerned about these 
threats for years. GAO reported this March that the data under 
the control of the IRS is ``unnecessarily vulnerable to 
inappropriate and undetected use.''
    I agree with Senator Wyden. There is a war going on. On one 
side we have the government, taxpayers, and business, and on 
the other, hackers and criminals, organized syndicates, some 
lone wolves, perhaps even national governments. Right now, it 
looks like we are losing this war, so we certainly need to use 
this latest breach to consider how we can regroup and win the 
fight.
    My concern is whether the IRS has the tools and mind-set to 
achieve better security and whether it is even capable of 
safeguarding this core function. I am very concerned that, in a 
rush to push out programs like Get Transcript--albeit this was 
pushed out some time ago--we have let access and purported cost 
savings overtake the absolute need to safeguard taxpayer 
information.
    So to the Honorable John Koskinen, thank you for coming, 
sir. To what extent do you partner with the private sector on 
data security? Do you need any additional flexibility or 
authority to work with outside experts to make sure you have 
access to the tools and the technology to address the privacy 
and also the data security issues?
    Commissioner Koskinen. We have an ongoing partnership with 
various elements of the private sector. We have a great working 
relationship with financial institutions that work with us on 
stopping improper refund payments. As I noted, we pulled 
together 3 months ago what we call a ``Security Summit,'' where 
I asked the CEOs of the major tax preparers, tax software 
providers, and State tax administrators to sit down with us, 
and I told them when we started: ``The purpose of this meeting 
is not for me to tell you what we are going to do or what you 
ought to do. The purpose of this meeting is to start a 
partnership where we work together to figure out how the three 
of us--the private sector, States, and the Internal Revenue 
Service--can work together in the battle.
    Senator Roberts. Is that ongoing?
    Commissioner Koskinen. And that is ongoing. We expect 
probably next week to give a public discussion of what we are 
going to do for the next filing season. But I told them it is 
not just for the next filing season. We need to begin to take a 
look at, on a longer-term basis, what are the things we need to 
do.
    One of the issues we may need to discuss, although we think 
we have the authority, is the private sector noted that they 
need a level playing field, so if we come up jointly with 
requirements as to sharing of data or the implementation or 
what we are going to require from taxpayers, we are the only 
ones who can require that across the board so that one person 
is not getting an advantage. And we will do that if necessary, 
and, if we need legislation, we will be back. But thus far, it 
has been a wonderful working relationship.
    Senator Roberts. I appreciate that. My time is running out. 
I just have one more question for Mr. George. I understand the 
IRS has shut down the Get Transcript program for the time 
being, and this hack has been stopped. But in looking at this 
program moving forward, how should we close the door to future 
attacks? How will you know that we have even succeeded in 
shutting the door?
    Mr. George. Great question, Senator. I do not have a 
definitive answer at this time. As the IRS is attempting to 
make the experience between the taxpayer and the IRS more user-
friendly, they are giving people opportunities to access 
information in ways that heretofore did not exist. It is a true 
challenge for the IRS to strike a balance between ease of 
access and security.
    Now, the private sector, as has been pointed out, has 
experienced these types of problems. They have adapted, 
acquired different systems that would allow people to further 
authenticate who they are. There is a cost associated with 
doing that, and whether or not the IRS is in a position right 
now, resource-wise, to do that, I would defer to the 
Commissioner.
    But, sir, if I may, Mr. Chairman, one thing I do want to 
clarify is, we are still again at the outset of this 
investigation, but there have been reports that this data 
breach originated solely from Russia, and I want to make it 
clear that is not the case. It is beyond Russia. So I just 
wanted to get that on the record.
    The Chairman. When you say ``beyond Russia,'' what do you 
mean?
    Mr. George. That there are other domains--the domains are 
located in nations other than Russia, in addition to Russia.
    Commissioner Koskinen. I would just note that our 
experience with the criminal syndicates we are dealing with is 
that they are not limited by national boundaries. They are, in 
fact, operating globally. They are located and headquartered 
oftentimes in one country or another, but they are not 
constrained by geographic locations. And so our experience is, 
analyzing the data of the Inspector General, this is coming 
from several different, perhaps organized--clearly, it was an 
organized attack--but our experience in looking at syndicates 
around the world is that they cooperate when it is in their 
interests, and they cross national boundaries very easily.
    Senator Roberts. Mr. Chairman, it occurs to me that perhaps 
we could have something called a ``National Security Agency'' 
or something that could monitor this kind of data and then see 
how the phone calls come in. Something like that might----
    The Chairman. Sounds like a good idea.
    Senator Roberts. Yeah, it sounds like a good idea to me.
    Could I simply ask that a New York Times article which 
contains a statement by Nina Olson, who leads the Taxpayer 
Advocate Service, an independent office at the IRS, be inserted 
in the record at this point? I apologize to my colleagues for 
going over time.
    The Chairman. Without objection.
    [The article appears in the appendix on p. 63.]
    The Chairman. Now, before I go to Senator Isakson, have you 
pinpointed any country or countries from which this came?
    Mr. George. Yes, but, again, we have to be careful because 
of the active investigation, Mr. Chairman. But as the 
Commissioner pointed out, you could be in Florida and you can 
use, you know, a router or a server in a different country on 
the other side of the world. I mean, eventually we are able to 
track them down, but at this stage, with the report that it was 
solely Russia, that is not accurate.
    The Chairman. That was just a speculation, as far as I was 
concerned. But you are not in a position to name any country or 
countries?
    Mr. George. At this stage, I would prefer not to publicly, 
but privately we would certainly share that information with 
you, Mr. Chairman.
    The Chairman. Fine. Senator Isakson?
    Senator Isakson. Thank you, Mr. Chairman. I would be happy 
to defer if you are in a hurry.
    You know, I think it is ironic. Senator Roberts made an 
interesting observation, but for the last 6 days, the United 
States Senate has been debating the merit of whether or not 41 
members of the NSA should have access to two phone numbers, the 
date of a call, and the duration of the call, without any 
personally identifying information whatsoever. We are getting 
ready to take that authority away from them, yet we have the 
Commissioner of IRS talking about 104,000 Americans who had 
their identities stolen. And when I file my tax return on April 
15th, they know how much money I make, how much my wife makes, 
what church I go to, whom I give the money to, whether or not I 
had a casualty loss, where I buy stocks, where I buy bonds, 
where my money is deposited, and how much I owe on my house.
    So I just want to put things in perspective, that this is 
an important hearing, but that information is a lot more 
private, a lot more personally identifying, and a lot more 
dangerous for the average American citizen than whatever the 
NSA ever does, and they are looking out for our physical 
safety. I just had to make that statement.
    Secondly, it is ironic----
    The Chairman. You summed that up very well.
    Senator Isakson. Thank you. Experian just e-mailed me to 
tell me my credit card has just changed and I need to check 
with them on the potential of identity theft having taken 
place, and that just came in at 10:24 on my BlackBerry. I had 
mine stolen about 3 years ago, and I want to commend the 
Department, the Internal Revenue Service, for providing 
taxpayers whose identities have been breached with the right 
type of Experian or Equifax protection to see to it their 
identity is protected, just like mine is being protected 
because of the loss that I had.
    I guess my question is on the IP numbers. Georgia is one of 
the States--there are three: the District of Columbia, Georgia, 
and I have forgotten the name of the other State where----
    Commissioner Koskinen. Florida.
    Senator Isakson [continuing]. Florida, where the IRS gave 
taxpayers the option to apply for an IP number, which is a 
self-identifying number for a tax return. Is that correct?
    Commissioner Koskinen. That is correct.
    Senator Isakson. And there are a million and a half of 
those IP numbers now issued. Is that right?
    Commissioner Koskinen. A million and a half are issued to 
those who have been victims of identity theft. We have had the 
pilot program where we had a few thousand. We are trying to get 
more people--we are running it as a pilot to see what the costs 
would be and the burden would be. We have had a relatively 
modest take-up on that, but we are encouraging taxpayers to 
take advantage of it.
    Senator Isakson. Have you found it to be a foolproof system 
yet, or is that why you are doing a test?
    Commissioner Koskinen. We are doing the test primarily to 
see what the burden on taxpayers is and what the cost to the 
IRS is. It is foolproof to the extent that you do not lose it. 
What happens with Social Security Numbers is they are, you 
know, out in the world. They are used for children's 
identification in school. On everybody's Medicare card is a 
Social Security Number. The IP PIN has no other use, so our 
experience thus far is we can authenticate to make sure that 
the taxpayer who gets the IP PIN is the legitimate taxpayer. If 
they keep it secure, there is no way anybody gets access to 
that number, and their returns, therefore, are safe.
    Senator Isakson. It would seem to me that if the trial that 
you are doing in Georgia and Florida and the District works and 
does seem to be foolproof, you would give every American 
taxpayer the ability to apply for one of those. I mean, you 
would not want to make them take one for fear of some sinister 
government plot somewhere, but you would certainly give them 
all the opportunity to get one.
    Commissioner Koskinen. Right. Our challenge, what we are 
looking at with the PIN is, if people lose it, we have a lot of 
people then--if we get, for instance, 50 million people with IP 
PINs and half of them lose them, we are going to end up with a 
tremendous amount of background noise just trying to make sure 
we get them the right PINs and replacement PINs. So that is one 
of the things we are looking at: how does it work when you have 
people who otherwise have not been victims sign up? But it is 
ultimately a way to go.
    When we get down to the bottom of it, our analysis over 4 
or 5 years is, authentication is going to turn out to be the 
key, whether it is authenticating you to get an IP PIN which 
allows you to get in--and that is what we are working on with 
the private sector and the States. We need to, together among 
all of us, have a way of sharing information about who is 
actually the customer. Are you who you say you are? When you 
call us, you know you are you, but then you wonder why we have 
to authenticate you to make sure you are not somebody 
impersonating you.
    So it is a multifaceted approach we are taking, trying a 
lot of different things to figure out, again, as the chairman 
said, how we get even or get ahead of the game. Ultimately, we 
will never put them out of business. The goal is to make it so 
difficult and expensive that it is not worth their while.
    Senator Isakson. Mr. George, I want to ask you a question. 
It would probably be unfair of me to ask Mr. Koskinen this 
question, although he is welcome to comment if he likes. But I 
have been thinking, as I listened to both of your testimonies, 
that the best way to protect taxpayer identity and limit fraud 
is to change the way in which we do our taxation.
    There is a Georgian by the name of Neal Boortz who wrote a 
book called ``The Fair Tax,'' which advocates going to a retail 
sales tax and eliminating the inheritance tax, the payroll tax, 
and the income tax. If you paid at the retail purchase a tax to 
the Federal Government to supplant those three taxes, would it 
not be a seamless protection against identity theft?
    Mr. George. I cannot give you a definitive answer on that 
one, Senator. Suffice it to say the more information, the 
earlier the IRS gets it, and an easier way of doing taxes would 
assist the system overall, the taxpayers and what have you. But 
the various proposals, such as the ones that you mentioned, I 
am not certain whether they would have a direct impact on 
identity theft.
    Senator Isakson. I am not necessarily selling the proposal, 
but what I am saying is, if I paid my tax to the Federal 
Government on a retail purchase and it was collected by the 
retailer, who does that for the States anyway, it would 
eliminate any of this self-identifying information, and the tax 
would end up being collected, which would be a protection 
against some of the identity theft.
    Mr. Koskinen?
    Commissioner Koskinen. I think that is right. If we did not 
deal with taxpayers individually, we would not have individual 
information.
    The issue globally would still exist, as with your credit 
card, and that is: are criminals accessing enough personal 
information to access your bank accounts, your credit cards, 
your mortgage accounts? But from the standpoint of the IRS, if 
we were dealing with a system where we collected funds, the 
government collected funds, with a value-added tax or a fair 
tax or something that did not require individuals to register 
with us, almost by definition we would not have the risk of 
individual identity theft, because we would not have 
individuals identified.
    Senator Isakson. Mr. Chairman, my time is up, but I want to 
thank Mr. Koskinen for taking the time to invite me to the 
Chamblee headquarters of IRS in Georgia and giving me a tour. I 
appreciate the connectivity that you have there. I appreciate 
what you are trying to do.
    The Chairman. Thank you, Senator.
    Senator Scott, we will call on you.
    Commissioner Koskinen. I might just note that the irony of 
that visit, which our employees genuinely appreciated, was the 
Senator and I spent an hour on a briefing on identity theft.
    The Chairman. Good. Senator Scott?
    Senator Scott. Thank you, Mr. Chairman. Commissioner, Mr. 
George, thank you for being here this morning.
    Commissioner, can you tell me how many South Carolinians 
have been affected or had information stolen by the breach?
    Commissioner Koskinen. I cannot tell you that. As I said 
earlier, we have sent letters to the 104,000 whose data was 
accessed, so anybody in South Carolina should be getting a 
letter in the next few days. We can go back through and get you 
that information.
    Senator Scott. That would be great.
    Commissioner Koskinen. We have not segregated it by State 
at this point.
    Senator Scott. Thank you very much.
    Whenever I go throughout South Carolina, my constituents 
are incredibly concerned about the IRS. They really feel like 
your agency is the agency that truly has the power of 
intimidation. So when we hear about breaches, 104,000 folks 
violated by this breach, my citizens are incredibly excited and 
passionate and concerned about the activities at the IRS, and 
it did not simply start with the breach. It started when we had 
the conversation last time about groups being targeted because 
of their religious beliefs or their political doctrine. It 
flows into the Lois Lerner e-mails and the inability to figure 
out if you have or if you do not have the e-mails. It continues 
on down the road as they call during tax season and they are 
unable to get someone to answer the phone, so they have these 
courtesy hang-ups.
    It is consistent, as I talk to my constituents, that their 
concerns continue to grow, and this breach will only add more 
fuel to the fire for people who are absolutely petrified by the 
IRS. And now having their information exposed to criminal 
elements, criminal cartels, is even more disconcerting.
    I would love to hear what it is exactly that you are doing 
in order to secure the IT at the IRS. And then, Mr. George, I 
have a question for you about the 19 recommendations that were 
made and only 8 were implemented.
    Commissioner Koskinen. What we are doing is, for years now, 
security has been a high priority for us. We understand, 
particularly with identity theft, which is based on information 
stolen elsewhere and then used to file a false return, that 
that is a difficult and traumatic situation for taxpayers. So 
one of our highest priorities is making sure that, if that 
happens to a taxpayer, they get a prompt response from us.
    As I have noted, we work closely with the Inspector General 
and GAO. We value their recommendations. In some cases, we have 
actually asked them to take a look at our systems and to make 
sure they are not breached. As I said, we get pinged, not 
necessarily attacked, over a billion times a year. So we are 
aware--no one at the IRS is under any illusions that we are not 
at risk--and so we spend as much time and effort and resources 
as we can focused on that. Anytime we make a change in a 
system, anytime we make a change in a new application, we look 
at the security aspects of it.
    As the Inspector General said, we are balancing off trying 
to provide better taxpayer service. As you noted, with the 
resource constraints, we did not answer the phones at anything 
like the rate we would like to have. We had 23 million 
transcripts successfully downloaded last year. Those were 
requests, otherwise, taxpayers would have had to make either on 
the phone or in person.
    So to the extent that we can provide better service to 
taxpayers, that is a high priority for us. But ultimately I 
take your point--we take it very seriously--that taxpayers have 
to feel they are going to get treated fairly, no matter who 
they are, no matter what organization they belong to, no matter 
who they voted for. And we have done everything we can. We have 
implemented all the Inspector General's recommendations in 
those regards, and I think it is important for taxpayers to 
know that we take their concerns seriously. They are ultimately 
our customers. We work for taxpayers. We do not work for 
anybody else.
    Senator Scott. Thank you, sir. I will say that, from a 
resourcing standpoint, it appears that during the Obama 
administration about $5 billion has been dedicated to the IRS 
for IT. Under the Bush administration, the number was somewhere 
around $5.3 billion. So in the last decade or so, over $10 
billion for IT, and it just does not seem like the type of 
security that we would anticipate and expect is there.
    And I am running out of time, Mr. George, so, of the 19 
recommendations that were made previously for corrective 
action, it appears that only 8 of those 19 were implemented, 
and perhaps some were closed before they were fully 
implemented. Can you shed a little light on that for me?
    Mr. George. I will in the amount of time that we have left, 
and I would ask for permission to supplement my response in 
writing.
    Senator Scott. Thank you very much.
    Mr. George. We have made a number of recommendations, 
actually a total of 44 recommendations, as of March of this 
year. Eighteen of those have been recommendations from security 
audits that have yet to be implemented.
    Ten of those recommendations come from five security audits 
that were completed during fiscal year 2008 to 2012, so they 
are very dated. And there are a couple of examples of some of 
the oldest recommendations that we made that we think might 
have had some bearing on the IRS's ability, if not to stop, 
again----
    Senator Scott. Can you name just one?
    Mr. George. Certainly. The IRS should require system 
administrators and their managers to correct user account 
deficiencies identified during the audit. Managers need to 
periodically review and validate access to systems, limiting it 
to people who only have a need for that information.
    Senator Scott. Mr. George, that does not sound like a 
resource issue. That sounds like a management issue.
    Mr. George. I agree, sir. I agree there.
    Senator Scott. Okay.
    Mr. George. I agree. And if I may add just one factoid, 
sir, that I just think is important to point out. The 104,000 
figure is used a lot. We have to keep in mind those are the 
records, the transcripts that were accessed. A lot more people 
could be affected by that, because spouses and dependents of 
the taxpayer, their information is contained within those 
reports. So at this stage, again, I cannot give you a 
definitive number, and I do not believe the Commissioner is in 
a position to do so either. But it is more than 104,000 people 
certainly.
    Senator Scott. Thank you, sir.
    Mr. Chairman, thank you for the time.
    The Chairman. Senator Casey, we will turn to you.
    Senator Casey. Mr. Chairman, thank you very much, and 
thanks for this hearing. Commissioner and Mr. Inspector 
General, thank you for your appearance here and your service. 
We appreciate it.
    I want to start with the issue through the lens of 
Pennsylvania. We have had a number of reports--and I have heard 
directly from law enforcement in Pennsylvania--about identity 
theft, and not just the broad-based or the significant 
challenge it presents generally, but specifically because the 
response to it often involves many different agencies, for 
example, in addition to the IRS, the Department of Justice, the 
Social Security Administration, and State and local law 
enforcement.
    So I would ask you first, Commissioner, about what we refer 
to as interagency and interstate coordination. Tell me about 
that in terms of what you have been able to do since you have 
been Commissioner.
    Commissioner Koskinen. When all of this, as I said, 
exploded in 2010 to 2012, it overwhelmed law enforcement, 
overwhelmed everybody. Since then, we have established very 
successful partnerships actually with State and local law 
enforcement across the country, particularly in States like 
Georgia and Florida where all of this seems to have started.
    So they, together with our working relationship with the 
Department of Justice and U.S. Attorneys--we have a very active 
Criminal Investigation Division, but we do not prosecute 
people, we do not bring charges. So we have to work, again, in 
partnership with U.S. Attorneys across the country, and that 
has been a very successful and effective partnership. As I 
said, we have thrown almost 2,000 people in jail over the last 
few years who have been convicted and sentenced to long 
sentences as a result of those partnerships.
    Senator Casey. One of the realities of this for a State 
like ours--and I am sure this is true in other States as well--
is local prosecutors, meaning District Attorneys, for example, 
at the county level, are among the law enforcement officials 
who have to confront the problem. So, Commissioner, I would ask 
for your commitment to work with our folks, both local 
officials and State officials, as well as taxpayers, on a 
coordinated approach to solve the problem.
    Commissioner Koskinen. We are delighted to do that. We have 
no illusion we can do this by ourselves. We need as much help 
as we can get, and we have a great working partnership with the 
investigative arm of the Inspector General as well.
    Senator Casey. I appreciate that. Thank you for that 
commitment.
    I want to turn to the question of resources. I know that 
often we in the Congress will point to a problem, and that is 
part of our job in terms of oversight and in terms of making 
sure taxpayers have their concerns responded to. But as we 
point fingers, we also ought to be constructive in terms of 
providing support. And sometimes that happens, and sometimes it 
does not.
    But I noted in your testimony, Commissioner, on page 5--and 
I guess I am asking a question and answering it by reading 
this, but on the question of resources, you say, and I quote, 
``Congress can help by approving the President's fiscal year 
2016 budget request, which includes $101 million specifically 
devoted to identity theft and refund fraud, plus $188 million 
for critical information technology infrastructure.'' So $101 
million plus $188 million.
    Can you tell us what those dollars would be used for?
    Commissioner Koskinen. Yes. What they would do is, on the 
one hand, in terms of identity theft, they would improve our 
ability to more quickly upgrade our filter process. We have 
been building that for some time. We would go faster with that. 
It would allow us to, in fact, respond more specifically to 
individual taxpayers and their concerns. Most importantly, it 
would allow us to upgrade our basic IT infrastructure. As I 
noted earlier, we are running antiquated systems, some of which 
are no longer supported by the software companies.
    And I would stress this particular problem was not a 
question of resources. My concern about it is, it is really a 
shot across the bow. The overall, ongoing challenge of dealing 
with sophisticated criminals around the world is the security 
of the entire system, and that is where the weaknesses in our 
antiquated system come to bear. So whatever resources we can 
have to continue to improve the overall system will be helpful.
    Senator Casey. And I hope if there is anything additional, 
either by way of authority or resources you need when it comes 
to dealing with the international dimensions to this, which I 
am sure are challenging, I hope you indicate that to us.
    Thanks very much, Mr. Chairman.
    The Chairman. Thank you, Senator.
    Senator Heller, you are next.
    Senator Heller. Mr. Chairman, thank you. Thanks for holding 
this hearing. I also want to thank our witnesses for being here 
also.
    Commissioner, I want to thank you for the call we had 
yesterday. It was very, very helpful, and hopefully we can move 
forward on some ideas. In fact, I will even bring them up, for 
that matter, as you probably anticipated. They will not be part 
of my questioning, but I think they are issues that are 
important to my home State.
    I have heard from many of my constituents their strong 
concerns over the proposed IRS changes to the filing of 
information returns for reported winnings from bingo, keno, and 
slot machines. Due to the administrative burden proposed, 
13,000 customers have signed a petition so that the reporting 
threshold for bingo, keno, and slot machines would not be 
reduced, and I too share their concerns about these proposed 
rules.
    Across the U.S., the gaming industry supports 1.7 million 
jobs and about $240 billion in activity--no small sum. My staff 
has had multiple conversations with your office in regards to 
these proposed rules, and I am pleased that we had that 
opportunity to have the same discussion between you and me 
yesterday.
    That said, I, like many other taxpayers, was frankly kept 
in the dark with regards to receiving responses from the IRS to 
better address these proposed rules. My questions were answered 
yesterday, some of them. I am grateful for that. Your comment 
period is extended, and I appreciate that, since it did take a 
couple months in order to get a response from your office. So, 
as I mentioned yesterday, my comments will be coming in the 
next week or so. Anyway, thank you for your help and support in 
extending the deadline in order to get those questions in.
    The chairman talked a little bit about public trust for the 
IRS's success, and you are familiar with that. The number of 
weaknesses--the ability to effectively protect taxpayers' 
confidentiality, integrity, and availability of certain 
taxpayer data unfortunately was not implemented. The Inspector 
General is here. He spoke on it a little bit, and you alluded 
to it during your testimony.
    It is my opinion, though, that a properly done tax reform 
would not only provide a simpler code, but would also provide 
the IRS with tools to combat tax-related identity theft and 
assist the victims of this crime.
    I told you yesterday on the phone that I am here to help. 
How can I help you?
    Commissioner Koskinen. Well, I appreciate that, and I 
appreciate, again, the chairman's clarity about how we need to 
work together on this. It is not a political issue. As we have 
said for some time, we need to get information returns earlier. 
It would be a great help to us. We need to have the authority 
to do what is called ``mark'' W-2s so that we can assure that 
they are produced by legitimate companies, not by fraudulent 
companies, as we go forward.
    We may need authority, to work with the partnership we have 
with the tax preparers and tax software companies as well as 
the States, to provide minimum requirements for data that 
authenticates taxpayers when they file their tax returns as we 
go forward.
    And then, ultimately, as I have noted, our discussion today 
is not about something that was a result of a funding shortage, 
but the challenge we face more broadly dealing with the 
criminal enterprises around the world does depend upon making 
sure we have adequate funding to continue to rebuild our 
systems to get them into what I call ``the early 21st century'' 
rather than the late 19th century.
    Senator Heller. Yes. Commissioner, a previous Finance 
Committee Chairman, Max Baucus, had discussed a draft that 
would disallow taxpayer Social Security Numbers on W-2 forms. 
What is your view of this proposal? I would ask the same thing 
of the Inspector General.
    Commissioner Koskinen. We have suggested that actually we 
just ought to get the last four digits on a W-2 form. What is 
more important to us is, if we can put so-called hashtags on 
those--and then we may need legislative authority--much like 
the number of companies that can provide paper that produces 
the money is allowed to be constrained by statute, we may need 
to be able to have those who produce W-2s through a competitive 
process be limited in number so that we can make sure that W-2s 
and the hashtags are appropriate as a way of, again, trying to 
make sure that the identifier is legitimate.
    Senator Heller. Okay. Mr. George, do you think that would 
be helpful?
    Mr. George. I do, actually, Senator. I agree with the 
Commissioner there.
    Senator Heller. Okay. Mr. Chairman, my time has run out. 
Thank you.
    The Chairman. Well, thank you, Senator.
    Mr. George, let me just ask you an unrelated question while 
you are here. It is an important subject. For almost a year, at 
our request, TIGTA has been investigating Lois Lerner's hard 
drive crash. Last month, TIGTA gave the committee the last of 
the e-mails pulled from IRS backup tapes. As I understand it, 
the next and final step is for you to provide us with a report 
on your investigation, and now that all of the recovery work is 
done, can we get a commitment from you today to submit your 
report to us on the hard drive crash by mid-June?
    Mr. George. I can commit, Mr. Chairman, to having it to you 
by the end of the month. I spoke with my chief investigator 
prior to this hearing in anticipation of the subject coming up. 
As of now, we have conducted over 100, almost 150 interviews of 
people related to the lost e-mails, and, as you can imagine, 
each interview leads to more information that needs to be 
tracked down.
    Given the nature of this matter, we need to be as thorough 
as possible, and we are endeavoring to do just that. And I can 
say there are still very important interviews to come. So we 
will do our level best to try to accommodate that request, sir, 
but I can assure you, you will have it before the end of the 
month, the Congress will.
    The Chairman. Okay. Well, we will live with that. We would 
like to get our final report done, if we can.
    Commissioner Koskinen. I would just like to go on the 
record saying I would be delighted to get everybody's final 
reports.
    The Chairman. I am not sure that was helpful. [Laughter.] 
But we are glad you are glad, is all I can say.
    Senator Roberts has a question or two. Then I would like to 
start the second round.
    Senator Roberts. I would like to go back to that statement 
I inserted for the record. Nina Olson leads the Taxpayer 
Advocate Service, an independent office at the IRS. And in her 
annual report, she noted that victims must often navigate a 
labyrinth of IRS operations and recount their experience time 
and time again to different employees. Even when cases remain 
in one IRS function, they may be transferred from one assister 
to another with significant periods of non-activity. On 
average, the agency took nearly 6 months to resolve cases. She 
added that cases were also frequently closed prematurely before 
all related issues had been fully addressed. She recommended 
that a single officer be assigned to handle each case, and then 
she spoke to a broader issue, which I think really sums up what 
we are after here. While granting taxpayers enhanced access to 
their tax information, which was the laudable goal that even 
Congress agreed to when we passed this bill, the overriding 
priority now must be to protect taxpayers' confidential tax 
information from exposure. Is that a fair statement?
    Commissioner Koskinen. I think, you know, as the Inspector 
General said and most people have said, it is a balancing act. 
As I say, we had 23 million successful downloads of the 
transcript. If those people had to call us or show up in person 
to get their transcript, it would have been a problem.
    But, on the other hand, we need to make sure that we are as 
secure as possible. I think what is happening across the 
economy is that customers and taxpayers now understand that it 
may be harder to get access to their accounts, whether it is a 
bank account or--not harder in the sense it takes you 2 weeks, 
but there may be more hurdles you have to go through. You may 
have to have more information available to be able to get 
access. And I think taxpayers and customers are willing now and 
understand the need to accept the higher level of burden. And 
so we are reconsidering all of our work in that context in 
terms of where we go.
    It should be noted that over 20 percent of the people who 
try to get their transcript downloaded cannot answer the 
questions, their own personal questions. But on the other hand, 
I think what this does remind us all is that, no matter how 
important it is to be providing excellent taxpayer service, we 
have to focus as much as we can on the security of the data, 
and that is a critical issue for us.
    Senator Roberts. Mr. George, do you agree with that?
    Mr. George. I do, Senator.
    Senator Roberts. The IRS urged taxpayers not to contact the 
agency, the 104,000, saying it would only delay the already 
overburdened staff. Anyone whose information was stolen will be 
contacted. Sort of like ``hurry up and wait.''
    Commissioner Koskinen. Well, they will not have to wait 
long. The letters are already----
    Senator Roberts. Have letters been sent to all the 104,000?
    Commissioner Koskinen. Yes--104,000 letters.
    Senator Roberts. And what do the letters say that the 
person should do?
    Commissioner Koskinen. They basically give instructions 
about how to get credit protection at our expense. They give 
them information about how to obtain an IP PIN if they would 
like one, the documentation they will have to provide. It gives 
them a number to call, but suggests that if they have question, 
they go to our website where we have provided a set of 
frequently asked questions about the situation and what can be 
done.
    Senator Roberts. And you are confident you have the ability 
to protect this information with the suggestions you have in 
that letter?
    Commissioner Koskinen. Yes. In fact, we advise them in that 
letter that we have marked their account so that no one else 
can file a return with their own information, and we----
    Senator Roberts. I appreciate that. Thank you, Mr. 
Chairman.
    The Chairman. Thank you.
    Let me just ask--I apologize to you, Senator Carper. I 
should have called on you first.
    Senator Carper. Mr. Chairman, I have already had one bite 
out of the apple while you were out of the room, and I will 
wait my turn.
    The Chairman. Okay. Well, let me just--Mr. George, in 2012 
TIGTA did an audit of the IRS Computer Security Incident 
Response Center, or CSIRC, which is responsible for preventing 
and detecting computer security threats to IRS systems. In that 
2012 audit, TIGTA found that the IRS was not monitoring 34 
percent of its servers, and you noted that, ``Without adequate 
monitoring of IRS servers, the CSIRC may not timely detect 
malicious activity or cyber-security incidents.''
    Could the IRS's failure to monitor its servers lead to the 
type of breach that occurred in May? That is question number 
one. And does TIGTA plan to reassess whether the CSIRC is now 
actively monitoring all IRS servers?
    Mr. George. ``Yes'' is the answer to your first question, 
Mr. Chairman, and, yes, we will also be monitoring that.
    The Chairman. Okay. Mr. George, the IRS is planning to 
expand the additional online services that it offers in the 
coming years. One notable example is the secure messaging pilot 
program that is scheduled to launch in 2016 that will allow the 
IRS to e-mail taxpayers and practitioners about sensitive tax 
information, something which the IRS has not done in the past, 
as I understand it.
    In light of the recent data breach, do you have concerns 
about the security of online services that the IRS plans to 
introduce? And beyond current measures, what must the IRS do to 
ensure that these services are secure?
    Mr. George. The IRS has sent the message in the wake of a 
lot of these attempts to gain access to taxpayers' identity or 
other information, and the message was, you know, ``We never 
reach out to you by e-mail,'' and the like. And so they will 
have to engage in a public service information effort, I think, 
to inform taxpayers about these new ways of approaching the 
system of tax administration.
    Ultimately, it is a worthwhile goal to be able to contact 
people by way of e-mails and alternate ways of contacting them 
versus paper contact, which is much more expensive--and 
obviously so when you have individuals attempting to help 
taxpayers at Taxpayer Assistance Centers and the like. So it is 
a way for the IRS to more efficiently and effectively assist 
taxpayers to comply with their tax obligation. It is a good 
thing. There is no question that TIGTA will be looking at the 
overall proposal, how it is implemented, and the impact that it 
has on taxpayers.
    The Chairman. Well, thank you. We appreciate the service 
that you render. It is a tough job, both of you.
    Senator Heller, do you have any questions?
    Senator Heller. Mr. Chairman, thank you. I just have a 
couple of quick questions. I probably will not take all my 5 
minutes, but these are issues that I think are important.
    The last question I asked, Commissioner, was: How can we 
help? And I want you to explain to me why critical pay 
authority should be renewed.
    Commissioner Koskinen. The streamlined critical pay 
authority has two aspects. The most important in many ways is 
the streamlined part, and primarily we use it for advanced-
technology people. We can find somebody like the head of our 
Information Technology system, who worked at Boeing, and we can 
recruit them, and, much as in the private sector, if we find 
the right person, we can make them an offer, and they can 
accept it and start immediately.
    The government process requires us to go through a 
complicated process that takes sometimes 3 to 4 months, and for 
the kind of people, the handful you are talking about 
recruiting, they often cannot wait 3 to 4 months or will not 
wait 3 to 4 months. Our IT head told me we have two people we 
have tried to hire in the IT department who, if we had 
streamlined critical pay, would have come. They did not want to 
participate in a 3- to 5-month process and, therefore, turned 
us down.
    Senator Heller. The authority expired in 2013.
    Commissioner Koskinen. Correct.
    Senator Heller. What has been the impact between then and 
today, outside the story you just told me?
    Commissioner Koskinen. Well, we have had 29 people on 
streamlined critical pay authority. We were authorized no more 
than 40, and we never used more than 34 of them, so we did not 
just put people in. We are down now to 15 or 16. We have lost 
our Senior International Expert in Tax Enforcement. We have 
lost the Deputy CIO. We have lost the three people who are best 
at big data analysis, including our expert on authentication. 
Their term ran out, and we have not been able to replace them.
    Senator Heller. One follow-up. I do not have to tell you 
about your budget. You know your budget a lot better than I do. 
But in 2014, it is my understanding you spent in the area of 
$2.4 billion or 21 percent of your budget in information 
technology. With that budget being that substantial, do you 
have the experts that you need in cyber-security?
    Commissioner Koskinen. We at this point have the experts. 
In fact, a key executive in cyber-security is on streamlined 
critical pay. He will rotate off.
    Senator Heller. Okay. That was my next question.
    Commissioner Koskinen. If we do not have the possibility, 
we will not be able to get them in. Of the budget in 2014, 
about 80 percent of it goes to simply operating and maintaining 
our system, so that our challenge in 2014 was, for instance, we 
asked for $300 million in IT to implement the Affordable Care 
Act. We got zero. So we had to take $300 million out of other 
IT programs, and the same thing happened in 2015.
    Senator Heller. Do you feel you have well-qualified hires?
    Commissioner Koskinen. We have a spectacular workforce. It 
is the best workforce I have ever dealt with, and I have dealt 
with a lot of different enterprises in the private sector for 
20 years and in the government. It is a dedicated workforce. 
Even with all the pressure and sometimes the abuse they take, 
they are dedicated to the mission, and the mission is based on 
helping taxpayers.
    Senator Heller. Okay. Commissioner, thank you.
    Mr. Chairman, thank you.
    The Chairman. My understanding is that Senator Carper would 
like to ask a couple of questions, but first I would like to 
thank both of you for being here, and I appreciate the 
testimony you have given here today.
    Mr. Koskinen, you have a tough job. There is no question 
about it. I do not know anybody who approaches it with a smile 
like you do, and I would be upset every day. And I think there 
is something wrong with you that you are not upset every day. 
[Laughter.]
    On the other hand, I know you are.
    And, Mr. George, we are very pleased with the hard work 
that you do--and your group down there. It is important that we 
have both of you working in the best interests of our country 
and of our taxpayers, and I really have appreciated you over 
the time that I have known you and the time you have been 
advising the committee.
    Mr. George. Thank you, Senator.
    The Chairman. With that, we will turn to Senator Carper, 
and hopefully finish up with Senator Carper.
    Senator Carper. Thanks, Mr. Chairman.
    I am an old State treasurer and an old Governor, and I have 
been thinking about these attacks on the IRS. And, as you know, 
there are 50 States. They all have their own divisions of 
revenue. Has anyone given any thought to how to better help 
them prepare to defend information and defend their treasuries 
from attacks like this? Is there any discussion of that?
    Commissioner Koskinen. As I say, we have had and now have a 
much more formal partnership and working relationship with 
States, with tax administrators. We are sharing information. We 
are trying to provide them as much assistance as we can about 
what we know. As I say, this is no longer the problem of any 
individual organization. This is a systemic challenge across 
the entire economy. There is a website somebody sent me that 
had the indications that of the 25 cyber-attacks and data 
breaches in May alone, 25 around the world, we are just one of 
those 25.
    So we take it seriously. We need to deal with it 
aggressively. But we need to understand, it is in the context 
of a significant systemic set of attacks.
    Senator Carper. I think I heard you say, Commissioner 
Koskinen, describing the information that was included in the 
letters going out, I thought I heard you say the term ``IP 
PIN'' in one of your answers. Would you just elaborate on that, 
please?
    Commissioner Koskinen. Yes. An Identity Protection PIN is a 
separate 6-digit number that is given to taxpayers if they are 
the victims of identity theft which they use to file in 
addition to their Social Security Numbers. They will have their 
Social Security Number, because we can check that against W-2s. 
But on the 1040 there is a point where they will include their 
IP PIN. If the IP PIN does not appear, the return is not 
accepted. So it protects them against anyone filing a 
fraudulent return with their Social Security Number alone.
    Senator Carper. All right. Thank you. I know it is still 
early in the review process, but do you intend to reinstate the 
Get Transcript online application? And if so, how do you 
balance the need for additional security against the need for 
taxpayers to have a convenient means of gathering access to old 
returns?
    Commissioner Koskinen. Well, it is the conundrum we face in 
any of these applications. As I say, we had 23 million 
successful downloads. That is a lot of taxpayer service. We 
will not put it back up unless we are satisfied that the 
security is, in fact, appropriate. It does mean that it is 
going to be more difficult for taxpayers, and more of them will 
not be able to get through. Already some of them cannot get 
through the existing security measures. But again, I think 
taxpayers are in a position to understand that.
    We are looking at the lessons learned from this event. We 
are delving into at great length exactly how it happened, what 
could be done in the security issues to make it more difficult 
for it to happen, if not impossible. But as you know, it is a 
continual trade-off of trying to provide as much information as 
readily to taxpayers as we can, but at the same time protecting 
that data.
    Senator Carper. We have heard a fair amount today about 
upgrading the IRS's IT systems. Will the President's fiscal 
year budget request be sufficient, if it is met, to meet those 
needs? Or is that request from the President, from the 
administration, for 2016 just the beginning of a multiyear 
effort to upgrade your computer systems?
    Commissioner Koskinen. The President's budget would allow 
us to, in fact, make significant progress in 2016, but your 
point is well taken. We have been working on upgrading the 
system for some time. We are not going to be able to do it in 1 
year. One of the things we are working on with the 
appropriators is to give them a longer-term view of what it 
actually takes both to upgrade the systems and also to provide 
secure, increased availability of information to taxpayers.
    Senator Carper. All right. We talked a moment ago about 
partnership and reaching out to the States and making sure that 
they learn from us at the Federal level, and maybe we can learn 
a few things from them to provide better protection against 
these attacks. Are there any other countries that we are 
communicating with that have thought through these problems and 
responded to these same kinds of challenges that we may be able 
to glean some helpful ideas from?
    Commissioner Koskinen. We are in contact--I belong to a 
group of the 43, in effect, largest tax administrators around 
the world. We seem, primarily because, I think, of the size of 
the economy and the attractiveness of it, to have more of these 
challenges than others. But security is on all of their minds. 
Those with a value-added tax have less concern about individual 
taxpayers, as noted in the earlier discussion. But we are 
sharing information particularly with the OECD countries. But 
as I say, thus far in the meetings I have had with them, we 
seem to be having more challenges as an economy as well as a 
tax administration system.
    Senator Carper. And a last question, if I could, Mr. 
Chairman, maybe of Inspector General George. A year or so ago a 
firm, I want to say it might have been--I am not sure of the 
name of the firm--but a U.S. firm that specializes in 
protection against cyber-attacks, a private firm--Mandiant. I 
think it was Mandiant. Someone did a fair amount of work on 
attacks emanating from China, and they actually drilled down 
and said, ``These are the folks, this is where they are 
located, these are the people who are actually launching these 
attacks against our country.'' The Chinese did not accept it 
very well, but I have not seen anything to refute the veracity 
of the assertions.
    I always like to focus on root causes. I like to focus on 
root causes, and I keep trying to figure out how do we go on a 
root-cause approach to deal with this issue, but it is just 
spreading. In our own family, we have been involved in a hack 
against the university that we are associated with, with our 
health care provider, now in this case with the issue at hand. 
So I like to say, the third time is the charm, I hope. I hope 
it is over. But my guess is it is not for us. But how do we go 
about the root cause of getting to this? Again, is there some 
way--everybody keeps saying it is coming from Russia, Russian 
criminal organizations. Is there not anything we can do about 
that?
    Mr. George. Well, if it is addressed to me, sir, I mean, 
Willie Sutton said, ``That is where the money is.'' And of 
course, having the world's largest economy, as the Commissioner 
suggested, you know, it attracts the bad guys.
    While I am not familiar with the study you just cited 
citing China as the source of a lot of these problems, on a 
number of the criminal investigations that have been completed 
by us, a lot of them did emanate from former Soviet republics--
Belarus and places like that. It is again, sir, just too many 
people who have too much time on their hands, and with their 
sophistication that relates to computers and networks and 
servers and the like, it is truly a challenge, and not just for 
the Internal Revenue Service. As has been stated before, both 
by the Commissioner and members of this panel, this is a 
Federal, State, local, global problem. And I do not see it 
ending any time soon, sir, because, just as soon as the IRS 
increases its security posture, the bad guys will increase 
their efforts to overcome those, and they have a lot of time on 
their hands.
    Senator Carper. Mr. Chairman, I would just say in closing, 
we spend a lot of time trying to focus on the symptoms of 
problems in all kinds of ways. We do not always focus on the 
root causes. And one of the things that it is important that we 
focus on is the symptoms and defending against these attacks in 
ways that have been discussed here today. But at the same time, 
we need to be thinking about root causes as well. And I am not 
sure how to do that, but we need to think about that.
    Thank you so much, and thanks to our witnesses.
    The Chairman. Thank you, Senator Carper.
    Senator Nelson?
    Senator Nelson. Mr. Chairman, these are numbers of 
confirmed tax-related identity theft victims: Florida, 334,962; 
Utah, 10,654; Delaware, 4,703. Senator Carper, you had 4,703 of 
your constituency who were victims of identity theft. Total 
U.S., D.C.: 1,889,736. If you include the U.S. territories and 
unconfirmed residents, we are talking about 2.75 million.
    Now, Mr. Chairman, we have had six hearings on identity 
theft, and yet we continue to bring in the IRS. We ought to 
take care of this by passing legislation. I filed legislation, 
you filed legislation. Your legislation has a lot of 
similarities with our legislation. We ought to get something 
moving.
    The Chairman. Let us get together and get it done. I agree 
with you.
    Senator Nelson. Excellent.
    The Chairman. All right.
    Senator Nelson. So put on the record, Mr. Commissioner, 
what tool would help you on this, which I think is in the 
legislation, but I suspect you want to get that out there on 
the record.
    Commissioner Koskinen. Yes. As we said earlier in the 
hearing, the legislation we have increasing support on the Hill 
for--we need to get information returns, particularly W-2s, 
earlier. We need to get them in January when employees get them 
so that we can, in fact, before we send out refunds, have a 
better chance of checking the return data.
    We also need to have authority to, in effect, use what are 
called hashtags with industry on those W-2s to make sure that 
the W-2s themselves are accurate. Criminals are now forming 
false corporations and generating false W-2s to go along with 
their fraudulent returns.
    We need to provide minimum standards for qualifications for 
education for tax preparers, which you have talked about in 
your bill. We need to increase the penalties for engaging in 
identity theft and refund fraud. Those are requests in our 
budget proposal. They are in your legislation. We are delighted 
to work with you and with the chairman to put together a final 
package that would give us additional tools.
    I would stress they will be important and very helpful, but 
as the Inspector General and I have both been saying, there is 
no magic silver bullet that tomorrow morning is going to put 
this all to an end. We need to continue to be vigilant. We will 
need to continue to do everything we can with our systems, with 
our security, with our monitoring of it. But clearly, the items 
that are contained in the legislative discussions you and the 
chairman have been having are going to be important.
    Senator Nelson. Okay. That is my point, Mr. Chairman, and--
--
    The Chairman. Still, let us get together.
    Senator Nelson. Let us do it. And, Mr. Chairman, I became 
alerted to this--this is what is shocking. This was about 4 
years ago. Street crime in Tampa, FL dropped--burglaries, auto 
thefts, muggings dropped--because the criminals suddenly 
realized: get a laptop, go in and create a false return, and 
get a refund. And it was all of a sudden too easy to get money.
    Now, it is a good thing that people's homes were not being 
burglarized, but nevertheless, people were being robbed. In 
this case, it is not only individuals who had a nightmare, by 
the way--and thanks to the IRS; you have helped us 
administratively once a taxpayer has a false return in their 
name--but then all of the other ID trauma that they go through 
getting back their ID. But it suddenly had a whole shift, and 
the taxpayers are paying because of this theft.
    So thank you, Mr. Chairman.
    The Chairman. Thank you, Senator.
    I want to thank Commissioner Koskinen and Inspector General 
George for appearing before the committee today, as well as all 
of the Senators who have participated. This has been a very 
interesting hearing for me.
    Commissioner Koskinen, three unrelated but important points 
before we wrap up.
    First, in recent months I have written to you regarding the 
reissuance of the proposed rule on political activity by tax-
exempt organizations. You know how interested this committee is 
in this matter. Can you tell me when the IRS and Treasury 
Department will reissue the proposal?
    Commissioner Koskinen. If I had a crystal ball, I would be 
better at giving you that information. We have spent a lot of 
time, we had 160,000 responses we took very seriously. I 
personally have read over 1,200 pages of thoughtful responses. 
We are moving forward. My commitment has been that----
    The Chairman. Keep me informed.
    Commissioner Koskinen. Yes. My commitment has been that we 
will keep you informed. You will not be surprised. We will keep 
you updated before we actually issue a proposal, and it will 
provide for 90 days of comment and a subsequent public hearing. 
So we do not want anybody to think we are rushing this. We are 
only going to do this once. We are not going to do it every 2 
or 3 years.
    The Chairman. Well, I want to end that chapter of 
mistreatment of conservative groups--liberal groups. I do not 
care. It just should not happen, and I am counting on you to 
straighten it out.
    Commissioner Koskinen. Yes. As I have said, we want to have 
a rule that is clear, fair to everybody, easy to administer, 
and easy to operate a (c)(4) organization under so you do not 
have to worry about somebody second-guessing you in the future.
    The Chairman. That would be great.
    Second, in April, I wrote to Secretary Lew requesting 
documents relating to the 2013 political activity rule. He has 
declined that request, and I will be responding to him on the 
matter.
    Now, I wanted to give you notice that I will be sending a 
similar request to your agency, and I look forward to working 
with you on that in the near future.
    Finally, in April, I wrote to you regarding the IRS's 
spending on information technology, and I want to thank you for 
acknowledging my letter, and I look forward to receiving a 
thorough response as soon as possible, if you can.
    Commissioner Koskinen. It is a lot of data to pull 
together, but I think it will be very helpful because it does 
answer a range of very detailed questions about priorities, 
about our experience, how we monitor it all, and, with a little 
luck, we will get it to you very quickly.
    The Chairman. Well, thank you. I hope you are very lucky. I 
want to thank both of you very much. This has meant a lot that 
you would come up on such short notice.
    Any questions for the record should be submitted by no 
later than Tuesday, June 9th.
    With that, the hearing is adjourned.
    [Whereupon, at 11:56 a.m., the committee was adjourned.]

                            A P P E N D I X

              Additional Material Submitted for the Record

                              ----------                              

   Prepared Statement of Hon. J. Russell George, Treasury Inspector 
       General for Tax Administration, Department of the Treasury
    Chairman Hatch, Ranking Member Wyden, and Members of the Committee, 
thank you for the opportunity to testify on the data breach that 
occurred at the Internal Revenue Service (IRS).

    The Treasury Inspector General for Tax Administration, also known 
as ``TIGTA,'' is statutorily mandated to provide independent audit and 
investigative services necessary to improve the economy, efficiency, 
and effectiveness of the IRS. TIGTA's oversight activities are designed 
to identify high-risk systemic inefficiencies in IRS operations and to 
investigate exploited weaknesses in tax administration. TIGTA's role is 
critical in that we provide the American taxpayer with assurance that 
the approximately 91,000 \1\ IRS employees, who collected over $3.1 
trillion in tax revenue, processed over 242 million tax returns and 
other forms, and issued $374 billion in tax refunds \2\ during Fiscal 
Year 2014, perform their duties in an effective and efficient manner 
while minimizing the risks of waste, fraud, or abuse. This includes 
investigating individuals who use the IRS as a means of furthering 
fraudulent, criminal activity that negatively impacts the operations of 
the IRS, as well as investigating allegations of serious misconduct by 
IRS employees and threats of violence against the IRS, its employees, 
and facilities. Over the past year, a significant part of our workload 
has been devoted to investigating scams that can negatively impact the 
integrity of tax administration.
---------------------------------------------------------------------------
    \1\ Total IRS staffing as of January 24, 2015. Included in the 
total are approximately 19,000 seasonal and part-time employees.
    \2\ IRS, Management's Discussion and Analysis, Fiscal Year 2014, 
page 2.
---------------------------------------------------------------------------
                 overview of the recent irs data breach
    On May 26, 2015, the IRS announced that criminals had used 
taxpayer-specific data acquired from non-IRS sources to gain 
unauthorized access to information onapproximately 100,000 tax accounts 
through the IRS's Get Transcript application.\3\ TIGTA's Office of 
Investigations continues to investigate this incident, coordinating 
with other Federal law enforcement agencies. We ask for patience while 
we gather the evidence we need to determine who is responsible for this 
intrusion so they can be brought to justice. In addition, the evidence 
we are gathering is also critically important for us to understand the 
impact on the victims as well as to document exactly how this happened 
so it can be prevented in the future.
---------------------------------------------------------------------------
    \3\ Information available on the Get Transcript application can 
include account transactions, line-by-line tax return information, and 
income reported to the IRS.

    According to reports we received from the IRS, which we have not 
yet validated, an individual or individuals succeeded in clearing an 
authentication process that required knowledge of information about the 
taxpayer, including Social Security information, date of birth, tax 
filing status, and street address. In addition, it appears that these 
third-parties had access to private personal information that allowed 
them to correctly answer questions which typically only the taxpayer 
would know. This type of information can be purchased from illicit 
---------------------------------------------------------------------------
sources or fee-based databases, or obtained from social media sites.

    The proliferation of data breaches reported in recent years and the 
types of information available on the Internet has resulted in a 
degradation of controls used to authenticate individuals accessing 
personal data in some systems. The expansion of e-commerce services 
often conflicts with the tenets of strict security standards. Providing 
taxpayers more avenues to obtain answers to their tax questions or to 
access their own tax records online also creates greater risk to an 
organization and provides more opportunities for exploitation by 
hackers and other fraudsters.

    In its most recent Strategic Plan,\4\ the IRS acknowledged that the 
current technology environment has raised taxpayers' expectations for 
online customer service interactions and it needs to meet these 
expectations. However, the risk for this type of unauthorized access to 
tax accounts will continue to grow as the IRS focuses its efforts on 
delivering taxpayers self-assisted interactive online tools. The 
Commissioner of Internal Revenue's vision is to provide taxpayers and 
tax professionals with electronic products and services that they 
desire to enable them to interact and communicate with the IRS. This 
includes more robust online services, based on the idea of accessing 
Government services anywhere, any time, on any device, in three to 5 
years. For example, the IRS is acquiring software and contractor 
services for a Secure Messaging Pilot Program to be launched in Fiscal 
Year 2016 that will lay the foundation for a broader taxpayer digital 
communication rollout in the future.
---------------------------------------------------------------------------
    \4\ Internal Revenue Service Strategic Plan--FY 2014-2017 (IRS 
Publication 3744), pgs. 6-7 (June 2014).

    In addition to the IRS's Get Transcript application, the IRS also 
requires taxpayers to authenticate their identities for certain other 
services on its public Internet site or its toll-free customer service 
lines, which could also pose a risk for unauthorized access. In June 
2014, the IRS established its Authentication Group to provide oversight 
and facilitate the development and implementation of authentication 
policies and processes across the IRS's business functions. Due to the 
significant risks in this area, we currently have an audit underway to 
assess the IRS's processes for authenticating taxpayers at the time tax 
returns are processed and when accessing IRS services.\5\
---------------------------------------------------------------------------
    \5\ TIGTA, Audit No. 201440016, Efforts to Authenticate Individual 
Income Tax Return Filers Before Tax Returns Are Processed, report 
planned for August 2015.
---------------------------------------------------------------------------
              data security remains a top concern of tigta
    Since Fiscal Year 2011, TIGTA has designated the security of 
taxpayer data as the top concern facing the IRS based on the increased 
number and sophistication of threats to taxpayer information and the 
need for the IRS to better protect taxpayer data and improve its 
enterprise security program. In addition, the IRS has declared its 
Information Security program as a ``significant deficiency'' from a 
financial reporting standpoint, which means weaknesses in its internal 
control environment are important enough to merit the attention of 
those charged with IRS governance.

    To provide oversight of the IRS's Information Security program, 
TIGTA completes approximately seven audits each year on various 
security programs, systems, and solutions. As of March 2015, these 
audits have resulted in 44 recommendations that have yet to be 
implemented. While most of these recommendations are based on recent 
audits, there are 10 recommendations from five audits that are over 
three years old. In addition, the IRS has disagreed with 10 of 109 
recommendations from 19 audits relating to security that we performed 
during the period of Fiscal Year 2012 through Fiscal Year 2014.

    We have identified a number of areas in which the IRS could better 
protect taxpayer data and improve its overall security posture. Most 
recently, we found two areas that did not meet the level of performance 
specified by the Office of Management and Budget and the Department of 
Homeland Security: (1) Identity and Access Management, and (2) 
Configuration Management.\6\
---------------------------------------------------------------------------
    \6\ TIGTA, Ref. No. 2014-20-090, Treasury Inspector General for Tax 
Administration--Federal Information Security Management Act Report for 
Fiscal Year 2014 (Sept. 2014).

    Identity and Access Management ensures that only those with a 
business need are able to obtain access to IRS systems and data. 
However, we found that the IRS needs to fully implement unique user 
identification and authentication that complies with Department of 
Homeland Security directives, ensure that users are only granted access 
based on needs, ensure that user accounts are terminated when no longer 
---------------------------------------------------------------------------
required, and control the improper use of shared accounts.

    Configuration Management ensures that settings on IRS systems are 
maintained in an organized, secure, and approved manner, including 
timely updating patches to known security vulnerabilities. We found 
that the IRS needs to improve enterprise-wide processes for assessing 
configuration settings and vulnerabilities by means of automated 
scanning, timely remediating scan result deviations, timely installing 
software patches, and controlling changes to hardware and software 
configurations.

    Patch \7\ management is an important element in mitigating the 
security risks associated with known vulnerabilities to computer 
systems. This is critical to prevent intrusions by unauthorized 
individuals or entities. Due to its importance, TIGTA evaluated the 
effectiveness of the IRS security patch management process, which has 
been an ongoing challenge for the IRS.\8\ We found that the IRS has 
made progress in automating installation and monitoring in a large 
segment of its computers, but it has not yet implemented key patch 
management policies and procedures needed to ensure that all IRS 
systems are patched timely and operating securely. Any significant 
delays in patching software with critical vulnerabilities provides 
ample opportunity for persistent attackers to gain control over 
vulnerable computers and get access to the sensitive data the computer 
systems may contain, including taxpayer data.
---------------------------------------------------------------------------
    \7\ A patch is a fix of a design flaw in a computer program. 
Patches must be installed or applied to the appropriate computer for 
the flaw to be corrected.
    \8\ TIGTA, Ref. No. 2012-20-112, An Enterprise Approach Is Needed 
to Address the Security Risk of Unpatched Computers (Sept. 2012).

    We have also identified other areas that would improve the IRS's 
ability to defend its systems against cyber-attacks. Monitoring IRS 
networks 24 hours a day year-round for cyber-attacks and responding to 
various computer security incidents is the responsibility of the IRS's 
Computer Security Incident Response Center (CSIRC). TIGTA evaluated the 
effectiveness of the CSIRC at preventing, detecting, reporting, and 
responding to computer security incidents targeting IRS computers and 
data.\9\ We found that the CSIRC is effectively performing most of its 
responsibilities for preventing, detecting, and responding to computer 
security incidents. However, further improvements could be made. At the 
time of our review, the CSIRC's host-based intrusion detection system 
was not monitoring a significant percentage of IRS servers, which 
leaves that portion of the IRS network and data at risk. In addition, 
the CSIRC was not reporting all computer security incidents to the 
Department of the Treasury, as required. Finally, incident response 
policies, plans, and procedures were either nonexistent, inaccurate, or 
incomplete.
---------------------------------------------------------------------------
    \9\ TIGTA, Ref. No. 2012-20-019, The Computer Security Incident 
Response Center Is Effectively Performing Most of Its Responsibilities, 
but Further Improvements Are Needed (Mar. 2012).

    One of the Federal Government's latest security initiatives is the 
implementation of information security continuous monitoring, which is 
defined as maintaining ongoing, real-time awareness of information 
security, vulnerabilities, and threats to support organizational risk 
decisions. While the IRS has made progress and is in compliance with 
Department of Homeland Security and Department of the Treasury 
guidelines, we have found that, based on the large scale of the IRS's 
computer environment, a one-size-fits-all approach does not provide the 
best security for the IRS.\10\
---------------------------------------------------------------------------
    \10\ TIGTA, Ref. No. 2014-20-083, The Internal Revenue Service 
Should Implement an Efficient Internal Information Security Continuous 
Monitoring Program That Meets Its Security Needs (Sept. 2014).

    We have also previously raised concerns over the remediation of 
security weaknesses identified in our audits. Management controls are a 
major part of managing an organization and provide reasonable assurance 
that organizational objectives are achieved. We have reviewed closed 
corrective actions to security weaknesses and findings reported by 
TIGTA and identified weak management controls in the IRS over its 
closed planned corrective actions for the security of systems involving 
taxpayer data.\11\ During our audit, TIGTA determined that eight (42 
percent) of 19 planned corrective actions that were approved and closed 
by the IRS as fully implemented in response to reported security 
weaknesses from prior TIGTA audits were only partially implemented.
---------------------------------------------------------------------------
    \11\ TIGTA, Ref. No. 2013-20-117, Improved Controls Are Needed to 
Ensure That All Planned Corrective Actions for Security Weaknesses Are 
Fully Implemented to Protect Taxpayer Data (Sept. 2013).

    Management control also involves the use of risk-based decisions by 
IRS management to make an exception to its own policies and 
requirements based on suitable justification and a thorough assessment 
of evident and potential risks. For decisions related to the security 
of information systems, exceptions are allowed if meeting the 
requirement is: (1) not technically or operationally possible, or (2) 
not cost effective. We found that these risk-based decisions were not 
adequately tracked and documented. Without required supporting 
documentation, we could not determine why decisions were made and 
whether the information technology risks were appropriately accepted 
and approved.\12\
---------------------------------------------------------------------------
    \12\ TIGTA, Ref. No. 2014-20-092, The Internal Revenue Service Does 
Not Adequately Manage Information Technology Security Risk-Based 
Decisions (Sept. 2014).
---------------------------------------------------------------------------
         attempts to defraud tax administration are increasing
    Due to its mission, the trillions of dollars that flow through the 
IRS each year, and the hundreds of millions of taxpayer data sets used 
and maintained by the IRS, the IRS is continuously under attack by 
criminals using the tax administration system for personal gain in 
various ways. These scams, and the methods used to perpetrate them, are 
constantly changing and require constant monitoring by the IRS. For at 
least the last decade, the IRS has provided the public with information 
about what it sees as the ``Dirty Dozen'' tax scams on its website. 
These scams range from offshore tax avoidance to fake charities, and 
inflated refund claims. Compiled annually, the ``Dirty Dozen'' lists a 
variety of common scams that taxpayers may encounter.

    In addition to the data breach discussed previously, two of the 
most pervasive frauds currently being perpetrated that impact tax 
administration are the phone impersonation scheme and identity theft.
Phone Impersonation Scam
    The phone impersonation scam has proven to be so large that it is 
one of TIGTA's Office of Investigation's top priorities, and it has 
also landed at the top of the IRS's ``Dirty Dozen'' tax scams this 
year. It has proven to be a surprisingly effective and fast way to 
steal taxpayers' money, and in this fast-paced electronic environment, 
the money can be gone before the victims ever realize that they have 
been scammed. The number of complaints we have received about this scam 
makes it the largest, most pervasive impersonation scam in the history 
of our agency. It has claimed thousands of victims with reported losses 
totaling almost $19 million to date.

    We first started seeing concentrated reporting of these calls in 
August 2013. As the reporting continued through the fall, in October 
2013 we started to specifically track this crime. To date, we have 
received hundreds of thousands of complaints about these calls. 
According to the victims, the scam artists made threatening statements 
and then demanded that the victims immediately put money on prepaid 
debit cards in order to avoid being arrested. The callers often warned 
the victims that if they hung up, local police would come to their 
homes to arrest them. The scammers may also send bogus IRS e-mails to 
support their scam. Those who fell for the scam withdrew thousands of 
dollars from their bank accounts and then purchased the prepaid debit 
cards as instructed by the callers. Once the prepaid debit cards were 
purchased, the perpetrators instructed the victims to call them back 
and read them the numbers on the prepaid card. By the time the victims 
realized they had been scammed, the perpetrators had negotiated the 
prepaid cards and the money was gone.

    To date, TIGTA has received over 525,000 reports of these calls. We 
continue to receive between 9,000 and 12,000 reports of these calls 
each week. As of May 25, 2015, 3,700 individuals have been victimized 
by this scam and have paid a total of almost $19 million, an average of 
approximately $5,100 per victim. The highest reported loss by one 
individual was over $500,000. In addition, 296 of these victims also 
provided sensitive identity information to these scammers.

    The perpetrators do not discriminate; they are calling people 
everywhere, of all income levels and backgrounds. Based on a review of 
the complaints we have received, we believe the calls are now being 
placed from more than one source. This scam is the subject of an 
ongoing multi-agency investigation. There is much that we are doing to 
apprehend the perpetrators, but TIGTA is not at liberty to disclose 
specifically what is being done as it may impede our ability to 
successfully bring these criminals to justice. I can tell you that it 
is a matter of high priority for law enforcement.

    However, there is much more that needs to be done, as these 
examples are part of a broader ring of scam artists operating beyond 
our borders. This is unfortunately similar to most of the cyber-crime 
we are seeing today--it is international in nature and committed by 
means of technology (e.g., in the case of the phone fraud scam, the use 
of Voice over Internet Protocol technology), and much of it originates 
from computers outside the United States. To further deceive their 
intended victims, by using this technology, the criminals create false 
telephone numbers that show up on the victim's caller ID system. For 
example, the criminals make it appear as though the calls are 
originating from Washington, DC or elsewhere in the United States.
Identity Theft
    Another challenging area impacting tax administration is the growth 
in identity theft. At the same time the IRS is operating with a reduced 
budget, it continues to dedicate significant resources to detect and 
review potential identity theft tax returns as well as to assist 
victims. Resources have not been sufficient for the IRS to work 
identity theft cases dealing with refund fraud, which continues to be a 
concern. A critical component of preventing and combating identity 
theft refund fraud is the authentication of a taxpayer's identity at 
the time tax returns are processed.

    During the past several years, the IRS has continued to take steps 
to more effectively detect and prevent the issuance of fraudulent 
refunds resulting from identity theft tax return filings. The IRS 
reported that in Filing Season 2013, its efforts prevented between $22 
billion and $24 billion in identity theft tax refunds from being 
issued.\13\ This is a result of the IRS's continued enhancement of 
filters used to detect tax returns that have a high likelihood of 
involving identity theft at the time the returns are processed. For 
example, the IRS used 11 filters in Processing Year (PY) 2012 to 
identify tax returns with a high likelihood of involving identity 
theft, compared to the 114 filters it used in PY 2014. The use of these 
filters assists the IRS in more effectively allocating its resources to 
address identity theft tax refund fraud.
---------------------------------------------------------------------------
    \13\  IRS Identity Theft Taxonomy, dated September 15, 2014, page 
1.

    The IRS has also taken steps to more effectively prevent the filing 
of identity theft tax returns by locking the tax accounts of deceased 
individuals to prevent others from filing a tax return using their 
names and Social Security Numbers. The IRS has locked approximately 
26.3 million taxpayer accounts between January 2011 and December 31, 
2014. In addition, the IRS issues an Identity Protection Personal 
Identification Number (IP PIN) to any taxpayer who is a confirmed 
victim of identity theft or who has reported to the IRS that he or she 
could be at risk of identity theft. However, we reported that the IRS 
did not provide an IP PIN to 557,265 eligible taxpayers for Processing 
Year 2013.\14\ Once the IRS confirms the identity of a victim or ``at-
risk'' taxpayer, the IRS will issue the taxpayer an IP PIN for use by 
the taxpayer when filing his or her tax return. The presence of a valid 
IP PIN on the tax return tells the IRS that the rightful taxpayer filed 
the tax return, thus reducing the need for the IRS to screen the tax 
return for potential identity theft. The IRS has issued more than 1.5 
million IP PINs for PY 2015.
---------------------------------------------------------------------------
    \14\ TIGTA, Ref. No. 2014-40-086, Identity Protection Personal 
Identification Numbers Are Not Provided to All Eligible Taxpayers 
(Sept. 2014).

    Despite these improvements, the IRS recognizes that new identity 
theft patterns are constantly evolving and that consequently, it needs 
to adapt its detection and prevention processes. The IRS's own analysis 
estimates that identity thieves were successful in receiving over $5 
---------------------------------------------------------------------------
billion in fraudulent tax refunds in Filing Season 2013.

    In summary, the IRS faces the daunting task of protecting its data 
and IT environment from the ever-changing and rapidly-evolving hacker 
world. This incident provides a stark reminder that even security 
controls that may have been adequate in the past can be overcome by 
hackers, who are anonymous, persistent, and have access to vast amounts 
of personal data and knowledge. The IRS needs to be even more vigilant 
in protecting the confidentiality of sensitive taxpayer information. 
Otherwise, as shown by this incident, taxpayers can be exposed to the 
loss of privacy and to financial damages resulting from identity theft 
or other financial crimes.

    We at TIGTA are committed to our mission of ensuring an effective 
and efficient tax administration system and preventing, detecting, and 
deterring waste, fraud, and abuse. As such, we plan to provide 
continuing audit and investigative coverage of the IRS's efforts to 
effectively protect sensitive taxpayer data and investigate any 
instances of attempts to corrupt or otherwise interfere with tax 
administration.

    Chairman Hatch, Ranking Member Wyden, and members of the committee, 
thank you for the opportunity to share my view.
                                 ______
                                 
      Questions Submitted for the Record to Hon. J. Russell George
               Question Submitted by Hon. Mark R. Warner
    Question. It is my understanding that third-party vendors have 
signed up with the IRS to access taxpayer transcripts via the Income 
Verification Express Service. What is the IRS doing to ensure that 
these third-party vendors that have signed up with the IRS to access 
taxpayer transcripts have appropriate safeguards in place and are not 
vulnerable to data breaches?

    Answer. In January 2011, we evaluated regulations and Income 
Verification Express Service (IVES) enrollment policies to ensure 
lenders, such as banks, and companies that specialize in making third-
party requests for lenders (Income Verification Specialists) properly 
protect taxpayers' tax return information.\1\ At that time, we 
determined that the IRS did not have a screening process and did not 
define minimum requirements in the form of a user agreement to help 
ensure IVES Program participants meet minimum standards and protect tax 
return information. In addition, we found the IRS did not require IVES 
Program participants to maintain electronic security and not disclose 
the information they receive from the IRS to nonaffiliated third 
parties.
---------------------------------------------------------------------------
    \1\ TIGTA, Ref. No. 2011-40-014, The Income Verification Express 
Services Program Needs Improvements to Better Protect Tax Return 
Information (Jan. 2011).

    We recently performed a review to determine if the IVES and Return 
and Income Verification Services programs had adequate processes and 
procedures in place designed to prevent inadvertent disclosures of 
taxpayer information.\2\ The scope of this review was limited to the 
environment and processes under the IRS's direct control. We found that 
generally the appropriate controls were in place and that for Fiscal 
Years 2009 through 2013 approximately 118 million requests were 
processed and fewer than 800 inadvertent disclosure incidents were 
recorded. Our report recommendations related to how quickly disclosures 
should be reported, determining the method to document and fully report 
disclosures, ensuring quality review teams conduct all established 
tests, and ensuring that internal policies are properly updated to 
document the correct process for reporting inadvertent disclosures.
---------------------------------------------------------------------------
    \2\ TIGTA, Ref. No. 2015-IE-R004, Requests for Taxpayer Information 
Were Generally Processed Properly in the Return and Income Verification 
Services and the Income Verification Express Service Programs (Mar. 
2015).

    On June 1, 2016, we became aware of a fraud scheme in which 
perpetrators obtained sensitive tax and other identifying information 
and are using that information to order tax transcripts using the 
Transcript Delivery System (TDS). We have initiated a review to 
evaluate this issue as well as the adequacy of TDS's processes and 
procedures to ensure only authorized users obtain access to taxpayer 
information.\3\
---------------------------------------------------------------------------
    \3\ TIGTA, Audit No. 201640032, Review of the Transcript Delivery 
System, report planned for June 2017.

                                 ______
                                 
                 Questions Submitted by Hon. John Thune
    Question. I understand that based on TIGTA's audit of tax year 
2012, you reported that there were 787,000 fraudulent tax returns that 
went undetected by the IRS. This is actually an improvement, down from 
1.1 million years for tax year 2011. How would you assess the progress 
being made by the IRS in preventing identity-theft related tax fraud? 
What overall grade would you give the IRS in this area?

    Answer. The IRS continues to make significant improvements in its 
identification of identity theft tax returns at the time the returns 
are processed and before fraudulent tax refunds are released. For 
example, the IRS reports that in the 2013 Filing Season,\4\ it detected 
approximately $24.3 billion in identity theft refund fraud. However, 
the IRS also recognizes that new identity theft patterns are constantly 
evolving and, as such, it needs to continue to adapt its detection and 
prevention processes. Consequently, the IRS continues to expand its 
filters used to detect identity theft refund fraud at the time tax 
returns are processed.
---------------------------------------------------------------------------
    \4\ The period from January through mid-April when most individual 
income tax returns are filed.

    For example, the IRS used 11 filters in Processing Year 2012 to 
detect approximately 325,000 tax returns that prevented the issuance of 
approximately $2.2 billion in fraudulent tax refunds. In Processing 
Year \5\ 2014 as of September 30, 2014, the IRS increased its filters 
to 114 and detected 832,412 tax returns, preventing the issuance of 
approximately $5.5 billion in fraudulent tax refunds. According to the 
IRS, for Processing Year 2015, it has increased the number of filters 
to 196 and detected 306,708 tax returns, preventing the issuance of 
about $2.2 billion in fraudulent tax refunds as of May 31st, 2015.
---------------------------------------------------------------------------
    \5\ The calendar year in which the tax return or document is 
processed by the IRS.

    In addition, the IRS continues to expand the locking of tax 
accounts, which results in the rejection of an electronically filed (e-
filed) tax return (i.e., the IRS will not accept the tax return for 
processing). A locked tax account also prevents paper-filed tax returns 
from posting to the Master File if the Social Security Number 
associated with the locked tax account is used to file a tax return. 
Between January 2011 and May 31, 2015, the IRS locked approximately 
28.6 million taxpayer accounts of deceased individuals. For Processing 
Year 2015 as of May 31, 2015, the IRS stopped 18,996 processed tax 
returns with refunds totaling approximately $31.4 million from posting 
to the Master File using the account locks. Additionally, the IRS has 
rejected (i.e., did not accept for processing) 85,811 e-filed tax 
---------------------------------------------------------------------------
returns through the use of these locks.

    For the 2013 Filing Season, the IRS also developed and implemented 
a clustering filter tool in response to TIGTA's continued 
identification of large volumes of undetected potentially fraudulent 
tax returns for which tax refunds had been issued to the same address 
or deposited into the same bank account. Tax returns identified are 
withheld from processing until the IRS can verify the taxpayer's 
identity. For Filing Season 2015 as of May 2, 2015, the IRS reports 
that, using this tool, it has identified 201,373 tax returns and 
prevented the issuance of approximately $496.5 million in fraudulent 
tax refunds.

    Despite the improvements in identification of identity theft tax 
returns at the time the returns are processed and before fraudulent tax 
refunds are released, the IRS still does not have timely access to 
third-party income and withholding information. Most third-party income 
and withholding information is not received by the IRS until well after 
tax return filing begins. For example, the deadline for filing most 
information returns with the IRS is March 31st, yet taxpayers can begin 
filing their tax returns as early as mid-January. In its Fiscal Year 
2015 Revenue Proposal, the IRS once again included a request for a 
legislative proposal to accelerate the deadline for filing third-party 
income and withholding information returns and eliminate the extended 
due date for electronically filed information returns.

    In continuing our assessment of the IRS's identification of 
fraudulent tax returns involving identity theft, we initiated a review 
in August 2015 to follow-up on the IRS's identity theft detection and 
prevention efforts, including assessing the IRS's efforts to quantify 
undetected identity theft through its Taxonomy project.\6\ The Taxonomy 
project aggregates the impact and loss of identity theft protection 
efforts across several IRS organizations and its goal is to achieve the 
level of precision and completeness required to provide critical 
strategic insights on identity theft affecting tax administration. We 
plan to issue our report by December 2016.
---------------------------------------------------------------------------
    \6\ TIGTA, Audit No. 201540001, Detection and Prevention of 
Identity Theft on Individual Tax Accounts--Follow-Up, report planned 
for Dec. 2016.

    Question. Mr. George, in your testimony you note that there are 44 
recommendations by TIGTA to the IRS in the area of information security 
that the IRS has yet to implement. Do you believe that these are 
recommendations the IRS can implement within its current budget? Has 
---------------------------------------------------------------------------
the IRS made a commitment to TIGTA to implement these recommendations?

    Answer. We cannot definitively answer whether the IRS can implement 
our recommendations as it is up to the IRS to prioritize its planned 
corrective actions.

    As of June 15, 2015, the IRS reported that it had recently closed 
eight of the 44 recommendations cited in our testimony. Of the 36 
remaining recommendations, the IRS indicated in its response to our 
report that the completion of corrective actions in response to two of 
these recommendations may be contingent on available funding: (1) 
identifying funding needed to support implementation of a Homeland 
Security Directive to require Personal Identity Verification card 
access to the IRS network and information systems;\7\ and (2) fully 
implementing software that will enable the IRS to identify where its 
most sensitive data are stored, who has access to the data, and where 
and by whom the data are sent to outside the IRS network.\8\
---------------------------------------------------------------------------
    \7\ TIGTA, Ref. No. 2014-20-069, Progress Has Been Made; However, 
Significant Work Remains to Achieve Full Implementation of Homeland 
Security Presidential Directive (Sept. 2014).
    \8\ TIGTA, Ref. No. 2014-20-087, While the Data Loss Prevention 
Solution Is Being Developed, Stronger Oversight and Process 
Enhancements Are Needed for Timely Implementation Within Budget (Sept. 
2014).

    As part of our audit process, the IRS can either agree or disagree 
with our audit recommendations. When it agrees, the IRS commits that 
they will correct the deficiency that we identified. In a prior audit, 
we assessed whether closed corrective actions to security weaknesses 
and findings reported by TIGTA had been fully implemented, validated, 
and documented as implemented.\9\ During our audit, we determined that 
eight (42 percent) of 19 corrective actions that were approved and 
closed as fully implemented to address reported security weaknesses 
from prior TIGTA audits were only partially implemented. These 
corrective actions involved systems with taxpayer data.
---------------------------------------------------------------------------
    \9\ TIGTA, Ref. No. 2013-20-117, Improved Controls Are Needed to 
Ensure That All Planned Corrective Actions for Security Weaknesses Are 
Fully Implemented to Protect Taxpayer Data (Sept. 2013).

    On occasion, the IRS will disagree with our audit recommendations. 
In fact, during the last three fiscal years (Fiscal Years 2012 to 
2014), the IRS disagreed with 10 of our 109 recommendations relating to 
---------------------------------------------------------------------------
information security in the following reports.

        Using SmartID Cards to Access Computer Systems Is Taking 
Longer Than Expected (Ref # 2012-20-115, dated September 28, 2012). The 
IRS disagreed with two of nine recommendations.
        Improvements Are Needed to Ensure the Effectiveness of the 
Privacy Impact Assessment Process (Ref # 2013-20-023, dated February 
27, 2013). The IRS disagreed with two of 11 recommendations.
        Better Cost-Benefit Analysis and Security Considerations Are 
Needed for the Bring Your Own Device Pilot Project (Ref # 2013-20-108, 
dated September 24, 2013). The IRS disagreed with one of five 
recommendations.
        While Efforts Are Ongoing to Deploy A Secure Mechanism to 
Verify Taxpayer Identifies, the Public Still Cannot Access Their Tax 
Account Information Via the Internet (Ref # 2013-20-127, dated 
September 25, 2013). The IRS disagreed with one of four 
recommendations.
        Improved Controls Are Needed to Ensure All Planned Corrective 
Actions for Security-Related Weaknesses Are Fully Implemented to 
Protect Taxpayer Data (Ref # 2013-20-117, dated September 27, 2013). 
The IRS disagreed with one of six recommendations.
        Planning is Underway for the Enterprise-Wide Transition to 
Internet Protocol Version 6 but Further Actions Are Needed (Ref # 2014-
20-016, dated February 27, 2014). The IRS disagreed with two of seven 
recommendations.
        While the Data Loss Prevention Solution Is Being Developed, 
Stronger Oversight and Process Enhancements Are Needed for Timely 
Implementation Within Budget (Ref # 2014-20-087, dated September 22, 
2014). The IRS disagreed with one of 12 recommendations.

                                 ______
                                 
              Question Submitted by Hon. Thomas R. Carper
    Question. Please provide additional information on the cost of 
critical pay at the Internal Revenue Service (IRS).

    Answer. TIGTA determined that the extra salary costs of the 
Streamlined Critical Pay program totaled approximately $1.7 million 
over the period reviewed (Calendar Years 2010 through 2013). The 
average pay of the highest graded Senior Executive Service Positions 
(ES-6) was approximately $179,000 a year while the average pay for the 
Streamlined Critical Pay positions was $ 198,000.
                                 ______
                                 
              Prepared Statement of Hon. Orrin G. Hatch, 
                        a U.S. Senator From Utah
WASHINGTON--Senate Finance Committee Chairman Orrin Hatch (R-Utah) 
today delivered the following opening statement at a committee hearing 
regarding the data theft at the Internal Revenue Service (IRS) which 
compromised the private information of over 100,000 taxpayers:

    Our hearing today concerns recent revelations that the Internal 
Revenue Service was the target of an organized service breach aimed at 
roughly 200,000 taxpayer accounts. We understand that over 100,000 of 
these breaches were successful, with cyber-criminals obtaining 
confidential taxpayer information from the agency's Get Transcript 
application.

    In dealing with this breach here in the Senate, this Committee 
stands alone, having legislative jurisdiction over the Internal Revenue 
Code, oversight jurisdiction over the IRS, and wide-ranging abilities 
to conduct investigations dealing with individual taxpayer information.

    While I have raised questions in the past about the way the IRS 
prioritizes its spending, today's hearing is about finding out how 
criminals stole vast amounts of taxpayer information. Any questions 
regarding funding levels for the agency should wait until we have a 
complete understanding about what occurred.

    Before we turn to the technological issues, let's focus for a 
moment on the victims. Because of this breach, criminals were able to 
get personal information about roughly 104,000 taxpayers, potentially 
including Social Security Numbers, bank account numbers, and other 
sensitive information. These taxpayers, and their families, must now 
begin the long and difficult process of repairing their reputations. 
And they must do so with the knowledge that the thieves who stole their 
data will likely try to use it to perpetrate further fraud against 
them.

    Commissioner Koskinen, put simply, your agency has failed these 
taxpayers.

    This hearing is of utmost importance as we work to find out what 
individuals and organizations were behind this breach; discover how 
this breach occurred, and what steps the IRS might have taken to 
prevent it; find out what taxpayer information was compromised, and how 
this may affect both taxpayers and tax administration going forward; 
and determine what tools and resources are necessary to better protect 
taxpayers, catch cyber-criminals, and prevent this type of breach from 
being successful in the future.

    Most of all, we must pledge to work together to make sure that this 
type of breach does not happen again.

    The secure movement of information is the lifeblood of 
international commerce and a necessary predicate for efficient 
government administration. Unfortunately, this information is also 
highly valuable to criminals.

    We see it in the headlines nearly every week--a major insurance 
company, bank, or retailer, has its information security compromised 
and personal information or corporate data is stolen. Federal 
departments--especially defense related agencies--come under attack 
each and every day.

    The IRS is not, and will never be, exempted from this constant 
threat.

    In fact, there is reason to believe the IRS will be more frequently 
targeted in the future. After all, the IRS stores highly sensitive 
information on each and every American taxpayer, from individual 
taxpayers to large organizations and from mom and pop businesses to 
multinational corporations. The challenge of data security matters a 
great deal to every single taxpayer and will continue to be a central 
challenge to tax administration in the coming years.

    Of course, data security and the protection of taxpayer information 
are of the highest importance in the prevention of stolen identity 
refund fraud. Identity theft, and the resulting tax fraud, costs 
taxpayers billions of dollars every year, and, once it occurs, it can 
take months or years for a taxpayer to mitigate the damage.

    It was out of concern over stolen identity refund fraud that 
Ranking Member Wyden and I quietly launched an investigation earlier 
this year, requesting information and documents from the country's 
largest tax return preparers and debit card companies.

    We look forward to working with the IRS as we move forward with 
this investigation and consider policy changes. We also look forward to 
hearing the report from your preparer working groups, and the committee 
looks forward to weighing in on those matters in the near future.

    So I welcome our witnesses today, IRS Commissioner Koskinen and 
Inspector General George. Commissioner Koskinen, earlier this year, 
when I first welcomed you before the Committee as Chairman, I noted 
that I hoped it would be the beginning of a new chapter in the long, 
historic relationship between the Internal Revenue Service and the 
Senate Finance Committee. I said that because the issues before us are 
too great for that relationship to be anything but open, honest, and 
productive.

    Today's topic is a great example of why that relationship is so 
important. Cyber-threats will only continue to grow, and those types of 
threats go to the core of our voluntary tax system. We must work 
together to figure out what happened, what went wrong in allowing the 
breach to occur, and how we can prevent another successful attack from 
taking place in the future.

    Finally, I would like to acknowledge that today's hearing occurs 
during somewhat unusual circumstances.

    The issue before us is the subject of several recently opened 
investigations, including a criminal investigation conducted by TIGTA. 
I caution members of the committee to be sensitive to these 
investigations when asking questions of the witnesses, and be aware 
that they may not be able to provide full answers to every question in 
this public forum. In spite of these limitations, it is important to 
discuss this matter today as fully and candidly as possible.

                                 ______
                                 
      Prepared Statement of Hon. John A. Koskinen, Commissioner, 
                        Internal Revenue Service
    Chairman Hatch, Ranking Member Wyden, and members of the committee, 
thank you for the opportunity to appear before you today to provide 
information on the recent unauthorized attempts to obtain taxpayer data 
through the IRS's Get Transcript online application.

    While we are continuing our in-depth analysis of what happened, the 
analysis thus far has found that the unauthorized attempts to request 
information from the Get Transcript application were complex and 
sophisticated in nature. These attempts were made using taxpayers' 
personal information already obtained from sources outside the IRS--
meaning the parties making the attempts had enough information to clear 
the Get Transcript application's multi-step authentication process.

    For now, our biggest concern is for the affected taxpayers, to make 
sure they are protected against fraud in the future. We recognize the 
severity of the situation for these taxpayers, and we are doing 
everything we can to help them.

    Securing our systems and protecting taxpayers' information is a top 
priority for the IRS. Even with our constrained resources as a result 
of cuts to our budget totaling $1.2 billion since 2010, we continue to 
devote significant time and attention to this challenge. At the same 
time, it is clear that criminals have been able to gather increasing 
amounts of personal data as the result of data breaches at sources 
outside the IRS, which makes protecting taxpayers increasingly 
challenging and difficult.

    The problem of personal data being stolen from sources outside the 
IRS to perpetrate tax refund fraud exploded from 2010 to 2012, and for 
a time overwhelmed law enforcement and the IRS. Since then, we have 
been making steady progress, both in terms of protecting against 
fraudulent refund claims and prosecuting those who engage in this 
crime. Over the past few years, almost 2,000 individuals were convicted 
in connection with refund fraud related to identity theft. The average 
prison sentence for identity theft-related tax refund fraud grew to 43 
months in Fiscal Year (FY) 2014 from 38 months in FY 2013, with the 
longest sentence being 27 years.

    Additionally, as our processing filters have improved, we have also 
been able to stop more suspicious returns at the door, rather than 
accepting them for processing. This past filing season, our fraud 
filters stopped almost 3 million fraudulent returns before processing 
them, an increase of over 700,000 from the year before. But, even 
though we have been effective at stopping individuals perpetrating 
these crimes, we find that we are dealing more and more with organized 
crime syndicates here and around the world.

    At the same time, over the last several years, the IRS has been 
working to meet taxpayers' increasing demand for self-service and 
electronic service options by providing them with more web-based tools, 
to make their interactions with us simpler and easier. As part of that 
effort, we launched the Get Transcript online application in January 
2014. Get Transcript allows taxpayers to view and print a copy of their 
prior-year tax information, also known as a transcript, in a matter of 
minutes. Prior to the introduction of this online tool, taxpayers had 
to wait 5 to 7 days after placing an order by phone or by mail to 
receive a paper transcript by mail. Taxpayers use tax transcript 
information for a variety of financial activities, such as verifying 
income when applying for a mortgage or student loan.

    To access Get Transcript, taxpayers must go through a multi-step 
authentication process to prove their identity, consistent with many 
organizations in the financial services industry. They must first 
submit personal information such as their Social Security Number (SSN), 
date of birth, tax filing status, and home address, as well as an e-
mail address. The taxpayer then receives an e-mail from the Get 
Transcript system containing a confirmation code that they enter to 
access the application and request a transcript. Before the request is 
processed, the taxpayer must respond to several ``out-of-wallet'' 
questions--a customer authentication method that is standard within the 
financial services industry. The questions are designed to elicit 
information that only the taxpayer would normally know, such as the 
amount of their monthly mortgage or car payment.

    During the 2015 filing season, taxpayers used the Get Transcript 
application to successfully obtain approximately 23 million copies of 
their recently filed tax information. If this application had not 
existed and these taxpayers had to call or write us to order a 
transcript, it would have stretched our limited resources even further. 
That is important to note, given our limitations during the past filing 
season. We would have been much less efficient in providing taxpayer 
service, not to mention the additional burden placed on taxpayers.

    During the middle of May, our cyber-security team noticed unusual 
activity on the Get Transcript application. At the time, our team 
thought this might be a ``denial of service'' attack, where hackers try 
to disrupt a website's normal functioning. Our teams worked 
aggressively to look deeper into the situation during the following 
days, and ultimately uncovered questionable attempts to access the Get 
Transcript application.

    As a result, the IRS shut down the Get Transcript application on 
May 21st. The application will remain disabled until the IRS makes 
modifications and further strengthens security for the application. It 
should be noted that the third parties who made these unauthorized 
attempts to obtain tax account information did not attempt to gain 
access to the main IRS computer system that handles tax filing 
submissions. The main IRS computer system remains secure, as do other 
online IRS applications such as ``Where's My Refund?'' Unlike Get 
Transcript, the other online applications do not allow taxpayers to 
access their personal tax data.

    As they continued to investigate, our team determined that a total 
of approximately 200,000 suspicious attempts to gain access to taxpayer 
information on the Get Transcript application had been made between 
mid-February and mid-May. About 100,000 of the attempts were 
unsuccessful, with the parties making these attempts unable to work 
their way through the protections in place.

    But we know that the other 100,000 or so attempts to request 
information from the Get Transcript application between mid-February 
and mid-May were successful. We are analyzing what, if anything, was 
done with the personal information of these taxpayers obtained using 
the Get Transcript application, and have discovered the following:

    About 35,000 taxpayers had already filed their 2014 income tax 
        returns before the unauthorized attempts at access. This means 
        that these taxpayers' 2014 returns and refund claims were not 
        affected by this fraudulent activity, because any fraudulent 
        return subsequently filed in their names would be automatically 
        rejected by our systems;

    For another 33,000, there is no record of any return having been 
        filed in 2015. This could be the case for a number of reasons. 
        For example, the SSNs associated with these individuals may 
        belong to those who have no obligation to file, such as 
        children, or anyone below the tax filing threshold;

    Unsuccessful attempts were made to file approximately 23,500 
        returns. These 23,500 returns were flagged by our fraud filters 
        and stopped by our processing systems before refunds were 
        issued; and

    Since this activity occurred, about 13,000 suspect returns were 
        filed for tax year 2014 for which the IRS issued refunds. 
        Refunds issued for these 13,000 suspect returns totaled about 
        $39 million, and the average refund was approximately $3,000 
        per return. We are still determining how many of these returns 
        were filed by the actual taxpayers and which were filed using 
        stolen identities. We will work with any of these affected 
        taxpayers who had fraudulent returns filed in their name.

    As I mentioned at the outset, our analysis thus far has found that 
the unauthorized attempts to access information using the Get 
Transcript application were complex and sophisticated in nature. These 
attempts were made using personal information already obtained from 
sources outside the IRS--meaning the parties making the attempts had 
enough information to clear the Get Transcript application's multi-step 
authentication process, including answers to the out-of-wallet 
questions.

    We believe it is possible that some of the attempts to access tax 
transcripts were made with an eye toward using the information to file 
fraudulent tax returns next year. For example, any prior-year return 
information criminals obtain would help them more easily craft 
seemingly authentic returns, making it more difficult for our filters 
to detect the fraudulent nature of the returns.

    As noted above, since we have already disabled Get Transcript, our 
biggest concern right now is for the affected taxpayers, to make sure 
they are protected against fraud in the future. We recognize the 
severity of the situation for these taxpayers, and have taken a number 
of immediate steps to assist the affected taxpayers in protecting their 
data against fraud that might be perpetrated against them. First, we 
have placed an identifier on the accounts of the roughly 200,000 
affected taxpayers on our core tax account system to prevent someone 
else from filing a tax return in their name--both now and in future 
years.

    Second, we are in the process of writing to all 200,000 taxpayers 
to let them know that third parties appear to have gained access from 
outside the IRS to personal information such as their SSNs, in an 
attempt to obtain their tax information from the IRS. Although half of 
this group did not actually have their transcript accessed because 
those who were trying to gain this information failed the 
authentication tests, the IRS believes it is important to make these 
taxpayers aware that someone else has their personal data. We want them 
to be able to take steps to safeguard their data.

    Letters have already been sent to all of the approximately 100,000 
taxpayers whose tax information was successfully obtained by 
unauthorized third parties. We are offering credit monitoring, at our 
expense, to this group of taxpayers. We strongly encourage people who 
receive this letter to take advantage of this offer. We are also giving 
them the opportunity to provide us with the authentication 
documentation necessary to obtain an Identity Protection Personal 
Identification Number (IP PIN). This will further safeguard their IRS 
accounts and help them avoid any problems filing returns in future 
years.

    As further analysis is done, we may uncover evidence that personal 
information of others, such as spouses and dependents of the taxpayers 
already identified, was also compromised, and we will take similar 
steps to protect those individuals.

    More broadly, the IRS continues to work to help taxpayers who have 
been victims of identity theft. For example, for the 2015 filing 
season, the IRS has issued IP PINs to 1.5 million taxpayers previously 
identified by the IRS as victims of identity theft. Also during this 
period, the IRS notified another 1.7 million taxpayers that they were 
eligible to visit IRS.gov and opt in to the IP PIN program. Meanwhile, 
taxpayers living in Florida, Georgia, and Washington, DC--three areas 
where there have been particularly high concentrations of identity-
theft related refund fraud--are eligible to participate in a pilot 
where they can receive an IP PIN upon request, regardless of whether 
the IRS has identified them as a victim of identity theft.

    In terms of our investigative work on identity theft, it is 
important to note that our Criminal Investigation (CI) division has 
seen an increase in identity theft crime being perpetrated by organized 
crime syndicates. The IRS is working closely with law enforcement 
agencies in the U.S. and around the world to prosecute these criminals 
and protect taxpayers. But the fact remains that these cyber-criminals 
are increasingly sophisticated enemies, with access to substantial 
volumes of data on millions of people.

    For that reason, we recently held a sit-down meeting with the 
leaders of the tax software and payroll industries and state tax 
administrators, and agreed to build on our cooperative efforts of the 
past and find new ways to leverage this public-private partnership to 
help battle identity theft. The working groups that were formed out of 
this meeting have continued to meet, and later this month we expect to 
announce an agreement on short-term solutions to help better protect 
personal information in the upcoming tax filing season, and to continue 
to work on longer-term efforts to protect the integrity of the nation's 
tax system.

    One of the three working groups formed out of this meeting focuses 
on authentication. As criminals obtain more personal information, 
authentication protocols need to become more sophisticated, moving 
beyond information that used to be known only to individuals but now, 
in many cases, is readily available to criminal organizations from 
various sources. We must balance the strongest possible authentication 
processes with the ability of taxpayers to legitimately access their 
data and use IRS services online. The challenge will always be to keep 
up with, if not get ahead of, our enemies in this area.

    Congress has an important role to play here. Congress can help by 
approving the President's FY 2016 Budget request, which includes $101 
million specifically devoted to identity theft and refund fraud, plus 
$188 million for critical information technology infrastructure. Along 
with providing adequate funding, lawmakers can help the IRS in the 
fight against refund fraud and identity theft by passing several 
important legislative proposals in the President's FY 2016 Budget 
proposal. A key item on this list is a proposal to accelerate 
information return filing dates.

    Under current law, most information returns, including Forms 1099 
and 1098, must be filed with the IRS by February 28 of the year 
following the year for which the information is being reported, while 
Form W-2 must be filed with the Social Security Administration (SSA) by 
the last day of February. The due date for filing information returns 
with the IRS or SSA is generally extended until March 31st if the 
returns are filed electronically. The Budget proposal would require 
these information returns to be filed when copies of this information 
are provided to the taxpayers, generally by January 31st of the year 
following the year for which the information is being reported, which 
would assist the IRS in identifying fraudulent returns and reduce 
refund fraud related to identity theft.

    There are a number of other legislative proposals in the 
Administration's FY 2016 Budget that would also assist the IRS in its 
efforts to combat identity theft, including: giving Treasury and the 
IRS authority to require or permit employers to mask a portion of an 
employee's SSN on W-2s, which would make it more difficult for identity 
thieves to steal SSNs; adding tax-related offenses to the list of 
crimes in the Aggravated Identity Theft Statute, which would subject 
criminals convicted of tax-related identity theft crimes to longer 
sentences than those that apply under current law; and adding a $5,000 
civil penalty to the Internal Revenue Code for tax-related identity 
theft cases, to provide an additional enforcement tool that could be 
used in conjunction with criminal prosecutions.

    Chairman Hatch, Ranking Member Wyden, and members of the committee, 
thank you again for the opportunity to provide information on the 
recent unauthorized attempts to obtain taxpayer data through the IRS's 
Get Transcript online application. This concludes my statement, and I 
would be happy to take your questions.

                                 ______
                                 
      Questions Submitted for the Record to Hon. John A. Koskinen
                Questions Submitted by Hon. Dean Heller
    Question. The recent IRS data breach of 104,000 victims only 
emphasizes how tax schemes, such as identity theft and return preparer 
fraud, are on the rise. For the 2014 tax year, it is estimated there 
have been close to 2 million in confirmed tax related identity thefts. 
In my home state alone, there have been over 14,000 victims. These 
numbers are disturbing, but what is more upsetting is the complex and 
frustrating process that these innocent victims are put through. It is 
my understanding refunds can take almost a year to get back to the true 
taxpayer. For this recent data breach, how is the IRS addressing the 
affected taxpayers, especially the ones where a return had been 
illegally filed and a refund issued?

    Answer. We realize the importance of resolving cases involving 
identity theft quickly and efficiently, thus allowing taxpayers 
victimized by identity theft to receive their refunds as soon as 
possible and helping to reduce the risk that adverse enforcement 
actions will be taken against them. To that end, we continue to develop 
and implement new procedures to improve the service provided to 
identity theft victims.

    Due to the complexity of these situations, identity theft victim 
case resolution can be a time-consuming process. However, the IRS has 
successfully reduced the case-processing and resolution time for 
identity-theft cases to improve service to the taxpayer. During the 
past fiscal year, taxpayers who became identity theft victims had their 
situations resolved in roughly 120 days, far more quickly than in 
previous years, when cases could take over 300 days to resolve. The IRS 
continues to evaluate systems and processes to improve the taxpayer 
experience.

    The IRS continues to expand its outreach initiatives to provide 
taxpayers, return preparers, state tax agencies, and other stakeholders 
with the information they need to prevent tax-related identity theft 
and, when identity theft does occur, to resolve issues as quickly and 
efficiently as possible. We also partner with other federal agencies to 
further these outreach efforts.

    Ensuring the security of our systems and the protection of 
taxpayers and their information are top priorities. Even with our 
constrained resources over the past few years, we continue to devote 
significant time and attention to these challenges. Ongoing data 
breaches involving other companies and organizations, through which 
criminals have been able to gather increasing amounts of personal data, 
make it even more challenging and difficult to protect taxpayers.

    You asked how the IRS is addressing the taxpayers affected by the 
recent unauthorized-access incident involving the Get Transcript 
application. In May, the IRS determined unauthorized third parties 
already had sufficient information from a source outside the tax agency 
before accessing the Get Transcript application. This allowed them to 
clear a multi-step authentication process, including several personal 
verification questions that typically are only known by the taxpayer.

    When the IRS first identified the problem in May, we determined 
that these third parties with taxpayer-specific sensitive data from 
non-IRS sources had cleared the Get Transcript verification process on 
about 114,000 total attempts. In addition, it appeared at that time 
that third parties had made attempts that failed to pass the final 
verification step, meaning they were unable to access account 
information through the Get Transcript service.

    Since then, as part of the IRS's continued efforts to protect 
taxpayer data, the IRS conducted a deeper analysis over a wider time 
period covering the 2015 filing season, analyzing more than 23 million 
uses of the Get Transcript system. The new review identified an 
estimated additional 220,000 attempts where individuals with taxpayer-
specific sensitive data cleared the Get Transcript verification 
process. The review also identified an additional 170,000 suspected 
attempts that failed to clear the authentication processes.

    The IRS mailed letters to all taxpayers identified in May and, 
later, we also mailed letters to the population identified in August as 
part of our continued analysis. To the taxpayers whose tax information 
was successfully obtained by unauthorized third parties, we are 
offering credit monitoring, at our expense. We strongly encourage the 
recipients of these letters to take advantage of the credit monitoring. 
We are also giving them the opportunity to provide us with the 
authentication documentation necessary to get an Identity Protection 
Personal Identification Number (IP PIN). This will further safeguard 
their IRS accounts and help them avoid any problems filing returns in 
future years. The IRS is marking all of the affected accounts with 
indicators that will help identify and prevent any fraudulent returns 
from being filed under those Social Security Numbers (SSN).

    The Get Transcript application was shut down in May, and the IRS 
continues to work on strengthening the system. In the meantime, 
taxpayers have several other options to obtain transcripts.

    The IRS takes the security of taxpayer data extremely seriously, 
and we are working aggressively to protect affected taxpayers and 
continue to strengthen our systems.

    The matter remains under review by the Treasury Inspector General 
for Tax Administration as well as IRS Criminal Investigation.

    Question. I understand that the IRS is considering allowing these 
individuals to receive a secure PIN, also known as the IP PIN, as part 
of an IRS pilot program. Could a secure PIN be provided to all 
taxpayers? If not, why not?

    Answer. The Identity Protection Personal Identification Number (IP 
PIN) is one component of the IRS arsenal to combat identity theft and 
fraud. We have many other tools and solutions in use and under 
development to increase security of taxpayer data.

    We are conducting research and analysis to determine the 
feasibility of expanding the IP PIN program. Although additional 
expansion of the IP PIN program may help safeguard more taxpayers from 
tax-related identity theft and refund fraud, it would require a 
substantial investment of financial resources which are not available 
at this time.

    Question. Public trust is crucial to the IRS's success. I was 
disturbed to understand that a recent GAO report found that a number of 
weaknesses, to effectively protect taxpayers' confidentiality, 
integrity and availability of sensitive taxpayer data, had not been 
implemented. My understanding is that less than a third of changes were 
implemented remain open between the last GAO audit and this year. How 
can the committee or taxpayers have faith in the IRS, if significant 
deficiencies in internal controls are not being addressed? Follow-up 
when do you expect to have these weaknesses addressed?

    Answer. The security and privacy of taxpayer information and the 
integrity of our computer systems continue to be sound. Our Cyber-
security program provides proactive defenses by implementing world-
class security practices in planning, implementation, management, and 
operations involving people, process, and technologies. We continually 
monitor the security controls in our information systems and the 
environments in which those systems operate. We also maintain awareness 
of information security, vulnerabilities, and threats to support 
organizational risk management decisions. We remain committed to our 
ongoing programs to manage the security risks in our IT infrastructure 
in accordance with industry standards and as required by the Federal 
Information Security Management Act (FISMA) and the National Institute 
of Standards and Technology guidance, and we continue to decrease the 
number of our unresolved weaknesses.

    We are working diligently to address all of the findings identified 
by GAO. The IRS has submitted 31 of the 79 open findings to GAO for 
closure during the FY 2015 audit. Currently, up to 30 of the remaining 
open items are in progress and scheduled to be submitted to GAO for 
closure in FY 2016. The balance of the open findings are scheduled for 
closure by FY 2019. It should be noted that GAO's recommendations do 
not concern fundamental weaknesses in taxpayer-facing systems. Rather, 
they concern weaknesses in our controls for internal systems--that is, 
systems and data that are behind our portal and firewalls. These 
systems have less risk of experiencing security issues because they are 
not connected directly to the external internet. In addition, factors 
such as budget uncertainties, hiring freezes, skillset deficits, and 
complexities associated with our antiquated legacy environment, as well 
as cutbacks affecting our ability to update our infrastructure, must 
also be considered. Nonetheless, we continue to review and evaluate all 
of GAO's recommendations along with other outstanding recommendations 
in light of risk and security controls and processes currently in 
place. We are building corrective action plans where appropriate to 
address the recommendations, and we are prioritizing and addressing 
them as resources permit. Significant progress has been made in 
addressing these recommendations in areas where we are most vulnerable.

    Our efforts to install software patches for security 
vulnerabilities continue to improve with the implementation of newer 
releases of more efficient and effective patching tools. We are 
developing our enterprise-wide processes to deliver software patches 
across all of our environments. This extensive effort continues to 
improve our vulnerable systems and the timeliness of patching provided 
by our patching teams. These improvements have been realized in spite 
of increasing challenges such as more sophisticated attackers, 
increased system complexity in our environments, and loss of some of 
our most experienced staff. While some patch management activities may 
take longer than we would like due to funding reductions, resource 
constraints, and the complexity of our environments, we expect to 
address the GAO findings related to patch management in FY 2016 as we 
continue to improve the program.

    We are making steady progress in closing vulnerabilities and 
addressing GAO findings associated with passwords. We have implemented 
standards that create systemic fixes for common issues in creating 
employee and administrator passwords. We also conduct monthly 
vulnerability scanning to ensure systems compliance with the password 
policy. Although we have not had sufficient funding and capacity to 
implement the Homeland Security Presidential Directive (HSPD)-12 
initiative as quickly as we would like, we are continuing to transition 
from using passwords to using the Personal Identity Verification (PIV) 
card for system sign-on for all users. This required substantial effort 
due to the number of systems that need updating, the advanced age of 
some of these systems, the complexity of system interactions, and the 
high cost to update them. We expect 100% of users with regular access 
privileges to be HSPD-12 ready by the end of FY 2016.

    We are enhancing our auditing and monitoring capabilities by 
dedicating our limited resources in this area to our highest risk 
systems. This will help us track security violations and confirm 
individual accountability. In FY 2014, we developed a risk-based 
prioritization strategy to align the schedules of systems needing audit 
trails. Since FY 2014, we have been dedicating significant financial 
resources to ensure all new systems are implemented with audit trails, 
and to expand the audit trails infrastructure capacity to support the 
new data collection. We have prioritized the audit trails findings in 
the GAO report and we expect that the systems documented in the report 
will be completed in FY 2016 and FY 2017.

    Question. The Committee held a hearing, earlier this year, on tax 
scams including identity theft, ``Protecting Taxpayers from Schemes and 
Scams during the 2015 Filing Season.'' Mr. Alley, the Commissioner of 
the Indiana Department of Revenue, stressed that the identity 
confirmation quiz was a significant and powerful tool to combat ID 
fraud. Has the IRS considered implementing a similar procedure such as 
this to reduce tax scams?

    Answer. The IRS currently uses an identity-confirmation quiz, 
called out-of-wallet questions, to authenticate taxpayers. The name 
refers to questions that would not be easily answerable with the 
information in a person's wallet if it were stolen.

    The IRS is reviewing multiple-authentication policy and 
capabilities in response to the unauthorized disclosures associated 
with the Get Transcript application. We are researching internal 
capabilities as well as those available from third parties through 
existing and planned contracts. These options include, but are not 
limited to:

        Third-party configuration changes to strengthen out-of-wallet 
questions;

        Internal IRS configuration updates to limit fraud and 
vulnerabilities to scripting attacks;

        Additional levels of assurance and authentication points; and

        Additional risk-based authentication capabilities.

    We must balance the strongest possible authentication processes 
with the ability of taxpayers to legitimately access their data and use 
IRS services online. The challenge will always be to keep up with, if 
not get ahead of, fraudsters in this area.

    Question. In Mr. Alley's testimony, he also focused on how the 
identity confirmation quiz is only part of a larger process to 
strategically focus on identity theft and refund fraud. This 
encompassed hiring additional talent, implementing new procedures and 
new IT systems and conducting a public relations campaign. What steps 
are the IRS taking to address identity theft?

    Answer. The IRS has a comprehensive and aggressive identity-theft 
strategy focused on preventing refund fraud, investigating these 
crimes, and assisting taxpayers victimized by identity thieves. We are 
also continuously conducting analysis and looking for ways to improve 
identity-theft detection. Because identity-theft criminals have 
significant resources to devote to these schemes, their methods are 
constantly evolving, forcing us to continually adjust our filters and 
processes accordingly.

    Realizing that we are only one stakeholder in the battle against 
identity theft, in March we organized a Security Summit that included 
representatives from the IRS, state tax agencies and private industry, 
such as software vendors, to work on collaborative solutions to combat 
fraud schemes. The Summit established a new public/private partnership 
effort to combat identify theft, refund fraud and protect the nation's 
taxpayers. In addition, participants reached agreement on several 
initiatives to address identity theft. These initiatives were announced 
on June 11, 2015. The agreement includes identifying new steps to 
validate taxpayer and tax return data at the time of filing. The effort 
will increase information sharing between industry and government. This 
public/private partnership is continuing to work on initiatives to be 
implemented in 2017 and beyond.

    In addition to victim assistance and outreach, the IRS's identity 
theft strategy also focuses on preventing refund fraud and 
investigating these crimes. Additional initiatives include these FY 
2015 items:

        We now limit the number of tax refund deposits to a single 
account to three (3). Additional refunds to the same account are 
converted to paper checks. We believe this initiative has had a 
positive impact on our efforts to deter fraud and identity theft.

        We began receiving device ID information to identify potential 
identity theft or fraud. The device ID is the serial number (or 
fingerprint) of the device (for example, computer, smart phone, or 
tablet). The unique ID is transmitted as part of the electronically 
filed return via our existing transmission process and enables the IRS 
to associate fraudulent returns that are filed from the same device.

        In addition to the nearly 1.5 million taxpayers that are given 
an Identity Protection Personal Identification Number (IP PIN), we 
expanded the population eligible for IP PINs to taxpayers previously 
identified by the IRS as victims of identity theft. This allowed 
approximately 1.7 million more taxpayers to opt in to the IP PIN 
program.

        We continue to accelerate the use of more types of information 
returns to identify mismatches earlier.

        We provide phone, online and in person channels to enable 
taxpayers inadvertently caught up in our protective filters to validate 
their identity and have their return processed. We continue to 
implement new identity theft screening filters to improve our ability 
to spot false returns before we process them and issue refunds.

    The IRS also continues to collaborate with software companies and 
financial institutions to identify patterns, trends and schemes that 
affect refund returns.

    The IRS also has initiated additional collaboration with the Bureau 
of Fiscal Service (BFS) on multiple direct deposits and payments shared 
between government agencies in the development of the new Payment 
Processing System. This collaboration provides an opportunity for IRS 
and other government agencies to work through BFS to identify 
fraudulent payments, increase recovery opportunities, improve data 
access, and reduce time in extracting or analyzing information from 
multiple data sources. This will also afford the opportunity for IRS 
and BFS to collaborate on refunds that have made it through IRS systems 
but appear suspicious based upon additional information and data 
external to IRS. The BFS system is expected to be online in September 
2016.

    In addition, Congress can help us in the fight against refund fraud 
and identity theft, by enacting several important legislative proposals 
in the President's FY 2016 Budget proposal, including the following:

        Acceleration of information return filing due dates. Under 
current law, most information returns, including Forms 1099 and 1098, 
must be filed with the IRS by February 28th of the year following the 
year for which the information is being reported, while Form W-2 must 
be filed with the Social Security Administration (SSA) by the last day 
of February. The due date for filing information returns with the IRS 
or SSA is generally extended until March 31st if the returns are filed 
electronically. The Budget proposal would require these information 
returns to be filed earlier, which would assist the IRS in identifying 
fraudulent returns and reduce refund fraud, including refund fraud 
related to identity theft.

        Correctible error authority. The IRS has authority in limited 
circumstances to identify certain computation or other irregularities 
on returns and automatically adjust the return for a taxpayer, 
colloquially known as ``math error authority.'' At various times, 
Congress has expanded this limited authority on a case-by-case basis to 
cover specific, newly enacted tax code amendments. The IRS would be 
able to significantly improve tax administration--including reducing 
improper payments and refund fraud as well as cutting down on the need 
for costly audits--if Congress were to enact the Budget proposal to 
replace the existing specific grants of this authority with more 
general authority covering computation errors and incorrect use of IRS 
tables. Congress could also help in this regard by creating a new 
category of ``correctable errors,'' allowing the IRS to fix errors in 
several specific situations, such as when a taxpayer's information does 
not match the data in certain government databases. To correct these 
errors today, IRS must open an audit, and we are limited in the number 
of audits we conduct by the resources available to engage with the 
taxpayer in the full audit process. Being able to correct certain 
mismatch errors would help with reducing some types of refund fraud.

        Authority to ensure minimum qualifications for return 
preparers. In the wake of court decisions striking down the IRS's 
authority to regulate unenrolled and unlicensed paid tax return 
preparers, Congress should enact the Budget proposal to provide the 
agency with explicit authority to ensure paid preparers maintain 
minimum qualifications. This authority would help promote high quality 
services from tax return preparers, reduce refund fraud, improve 
voluntary compliance, foster taxpayer confidence in the fairness of the 
tax system, and protect taxpayers from preparer errors.

        Expanded access to Directory of New Hires. Under current law, 
the IRS is permitted to access the Department of Health and Human 
Services' National Directory of New Hires only for purposes of 
enforcing the Earned Income Tax Credit and verifying employment 
reported on a tax return. The proposal would allow IRS access to the 
directory for tax administration purposes that include data matching, 
verification of taxpayer claims during return processing, preparation 
of substitute returns for non-compliant taxpayers, and identification 
of levy sources.

    There are a number of other legislative proposals in the 
Administration's FY 2016 Budget request that would also assist the IRS 
in its efforts to combat identity theft, including: giving Treasury and 
the IRS authority to require or permit employers to mask a portion of 
an employee's SSN on W-2s, which would make it more difficult for 
identity thieves to steal SSNs; adding tax-related offenses to the list 
of crimes in the Aggravated Identity Theft Statute, which would subject 
criminals convicted of tax-related identity theft crimes to longer 
sentences than those that apply under current law; and adding a $5,000 
civil penalty to the Internal Revenue Code for tax-related identity 
theft cases, to provide an additional enforcement tool that could be 
used in conjunction with criminal prosecutions.

    It is important to note that these legislative proposals, while 
they would be very helpful, only would be partially effective in 
achieving their intended goals without adequate resources for the 
agency.

    With limited resources and information, the IRS currently is only 
able to review fewer than 5% of the 100 million returns that request a 
refund. If, prior to issuing refunds, the IRS had access to third-party 
documents for matching earlier in the filing season (e.g., W-2), we 
would be able to stop more refund fraud.

    With additional resources, the IRS could implement the following 
improvements to protect revenue and taxpayers:

        Expand the pre-refund filters and improve systemic coverage of 
potential ID Theft returns;

        Increase the number of analysts manually reviewing filing 
patterns to identify new suspicious patterns and react to newly 
submitted leads; and

        Improve service to victims of identity theft by increasing the 
number of IRS employees who manually review returns, contact taxpayers 
when needed, and make account adjustments for taxpayers affected by ID 
Theft.

    Question. During the summer of 2012, the IRS worked with an 
incumbent consulting firm to conduct tests of third-party, commercially 
available analytics to determine how well those solutions could detect 
and prevent fraudulent tax returns. What were the results of those 
tests and if they were successful, why have none of those solutions 
been implemented?

    Answer. In 2012, the IRS conducted a study to determine if third-
party, commercially available analytics might improve identity theft 
protection beyond existing IRS Identity Theft (IDT) capabilities. 
Today, the IRS uses third-party data to facilitate validating 
identities and deterring ID theft fraud. For example, the Taxpayer 
Protection Program currently uses a third-party vendor's data to 
support ID Verify challenge questions used to authenticate taxpayers 
whose returns appear to be compromised by identity theft. In addition, 
the IRS is further partnering with industry to determine if new data 
sources and data elements can help IRS increase identity theft 
detection capabilities.

    Question. Does IRC 7216 need to be permanently amended to allow for 
the disclosure of limited filer information for the purposes of 
preventing fraudulent returns?

    Answer. Section 7216 does not require amendment to allow for the 
disclosure of limited filer information for purposes of preventing 
fraudulent returns. Regulations under section 7216 currently allow any 
disclosure of tax return information to an officer or employee of the 
IRS. Treas. Reg. Sec. 301.7216-2(b). They also allow disclosure of any 
tax return information to the proper Federal, State, or local officials 
to inform them of activities that may constitute a violation of any 
criminal law or to assist the investigation or prosecution of a 
violation of criminal law. Treas. Reg. Sec. 301.7216-2(q).

    Question. Has the IRS considered allowing consumers to opt into an 
alerting service that would notify them whenever a tax return has been 
filed using a consumer's personal information?

    Answer. Given current funding limitations, the IRS does not plan to 
implement an opt-in plan to notify a taxpayer whenever a tax return has 
been filed using a taxpayer's SSN or Individual Taxpayer Identification 
Number (ITIN). Currently, taxpayers are contacted when an individual 
tax return passes through IRS filters and is flagged for potential 
identity theft.

                                 ______
                                 
              Questions Submitted by Hon. Debbie Stabenow
    Question. Over the last couple of years, we have seen several large 
data breaches involving tens of millions of customers: Target--40 
million people, JPMorgan--76 million people, Home Depot--56 million 
people, Anthem--80 million people.

    The information stolen in the large data breaches is the kind of 
information that is then used to file false tax returns to obtain 
refunds, or, in this case, to access taxpayer information through the 
IRS. It emphasizes the need for greater security throughout the payment 
chain, before identity thieves get to the point of using stolen 
information to file false returns.

    As Commissioner of the IRS, you are limited in your ability to 
combat certain kinds of identity theft because you don't have control 
over the payment chain--identity thieves are using information that 
they have already obtained to file fraudulent returns.

    Can you tell us more about some of the steps that the IRS has been 
exploring to protect against fraudulent returns?

    Answer. The IRS has a comprehensive and aggressive identity theft 
strategy focused on preventing refund fraud, investigating these 
crimes, and assisting taxpayers victimized by identity thieves. We are 
also continuously conducting analysis and looking for ways to improve 
identity theft detection. Because identity theft criminals have 
significant resources to devote to these schemes, their methods are 
constantly evolving, forcing us to continually adjust our filters and 
processes accordingly. Realizing that we are only one participant in 
the battle against identity theft, we recently organized a Security 
Summit and invited representatives from state tax agencies and private 
industry, such as software vendors, to work on collaborative solutions 
to combat fraud schemes.

    In addition to victim assistance and outreach, the IRS's identity 
theft strategy also focuses on preventing refund fraud and 
investigating these crimes. Additional initiatives include these FY 
2015 items:

        We now limit the number of tax refund deposits to a single 
account to three (3). Additional refunds to the same account are 
converted to paper checks. We believe this initiative has had a 
positive impact on our efforts to deter fraud and identity theft.

        We began receiving Device ID information to identify potential 
identity theft or fraud. The Device ID is the serial number (or 
fingerprint) of the device (for example, Computer, Smart Phone or 
Tablet). The unique ID is transmitted as part of the electronically 
filed return via our existing transmission process and enables the IRS 
to associate fraudulent returns that are filed from the same device.

        In addition to the nearly 1.5 million taxpayers that are given 
an Identity Protection Personal Identification Number (IP PIN), we 
expanded the population eligible to opt-in for IP PINs to taxpayers 
previously identified by the IRS as victims of identity theft. This 
allowed approximately 1.7 million more taxpayers to opt in to the IP 
PIN program.

        We continue to accelerate the use of more types of information 
returns to identify mismatches earlier.

        We provide phone, online and in person channels to enable 
those taxpayers, inadvertently caught up in our protective filters, to 
validate their identities and have their return processed.

        We continue to implement new identity theft screening filters 
to improve our ability to spot false returns before we process them and 
issue refunds.

    The IRS also continues to collaborate with software companies and 
financial institutions to identify patterns, trends and schemes that 
impact refund returns. The IRS also has initiated additional 
collaboration with the Bureau of Fiscal Service (BFS) on multiple 
direct deposits and payments shared between government agencies in the 
development of the new Payment Processing System. This collaboration 
provides an opportunity for IRS and other government agencies to work 
through BFS to identify fraudulent payments, increase recovery 
opportunities, improve data access, and reduce time in extracting or 
analyzing information from multiple data sources. This will also afford 
the opportunity for IRS and BFS to collaborate on refunds that have 
made it through IRS systems but appear suspicious based upon additional 
information and data external to IRS. The BFS system is expected to be 
online in September 2016.

    Question. Over the last few years, TIGTA and GAO have issued a 
number of reports on data security at the IRS, identifying a great many 
vulnerabilities and making recommendations for how those 
vulnerabilities might be addressed.

    While the IRS has made several efforts to implement recommendations 
and secure vulnerable information, follow-up reports suggest that many 
recommendations, those with which IRS agreed, remain unimplemented and 
many vulnerabilities still exist.

    Can you tell us more about the difficulties that the IRS has 
experienced in securing taxpayer data and protecting against fraud?

    Have any factors limited your ability to implement some of the 
measures you might want to take?

    Answer. The IRS is confident that its systems demonstrate high 
resistance to the normal daily cyber-attacks seen across government. 
However, there are no absolutes and, as with nearly all such current 
commercial cyber-defenses, it is very difficult to defend against 
sophisticated technologies. The IRS continues to devote scarce 
resources to cyber-security but after five years of cuts to our budget, 
it is currently much more challenging for the IRS to continuously stay 
ahead of evolving threats to its cyber-security.

    The IRS has been storing taxpayer data in digital form since 1970 
and has a strong culture of protecting this data. Currently, the IRS 
takes a very aggressive approach to protecting taxpayer data through: 
restrictions on internet access; encryption of taxpayer data for any 
transmission externally; content filtering and strict firewall 
policies; and network security monitoring. In fact, the IRS has 
developed a Cyber-security Strategy that is focused on managing 
information security risk on a continuous basis; monitoring the 
security controls in IRS information systems and the environments in 
which those systems operate on an ongoing basis; and maintaining 
ongoing awareness of information security, vulnerabilities and threats.

    The critical risk to continuing to implement this strategy is not 
the sophistication or frequency of cyber-attacks, but instead is the 
IRS's current budget situation which has resulted in the reduction of 
Cyber-security staff and the inability to fill vacant positions. These 
skill sets and talents are under high demand across both the public and 
private sectors. The IRS's Cyber-security staff is currently 356 
personnel, which is down from its high of 408 employees in FY 2012. The 
inability to hire and retain certified Cyber-security staff prevents 
the IRS from sustaining its vigilance against cyber-attack. This 
creates a capacity issue within cyber-security, where there are simply 
too many priorities and not enough time and resources to do all the 
work that needs to be done. In this situation, even high risk 
initiatives are put on hold, which is certainly not optimal with a 
mission as critical as the IRS.

    The IRS's current budget situation is also hampering our ability to 
modernize our antiquated systems and keep current our IT 
infrastructure, which is thwarting progress in implementing security 
controls and protecting us against today's cyber-attacks. For example, 
the design and logic of many of our IT systems dates back to the 1960s, 
and those systems simply do not support protective measures recommended 
by GAO and others that are needed in today's technological environment. 
Similarly, many of our off-the-shelf applications are running on older, 
less secure versions, and some are even reaching end-of-life and are no 
longer supported by the software companies, meaning they are no longer 
receiving security and other patches to ward off cyber-attacks and 
performance issues.

    Funding has clearly limited IRS's ability to improve data security. 
As explained further in response to the next question, fully funding 
the IRS's information-security operations at the levels specified in 
the President's FY 2016 Budget request would allow for significant 
improvements in data security at the IRS.

    Question. Year after year, Congress has cut the budget of the IRS 
while asking you to take on more responsibility. We've given you less 
money and fewer employees with which to protect the information of so 
many millions of taxpayers across the country.

    Some of my colleagues are fond of the saying: when you tax 
something you get less of it. However, I would point out that when you 
pay for less of something, you get less of it. When you pay less for 
data security, you get less data security. It's a pretty 
straightforward concept, but unfortunately, here we are, after five 
years of cutting the IRS budget, being concerned about why more 
resources weren't put into data security.

    Commissioner Koskinen, if this Committee and this Congress would 
give you more tools to combat this sort of data breach and the money to 
implement those tools, could you improve data security at the IRS?

    Answer. Yes. Additional data security tools, and funding for 
people, processes and technologies to implement those tools, would 
allow for significant improvements in data security at the IRS.

    Congress can help by approving the President's FY 2016 Budget 
request for the IRS. The IRS budget includes $281 million (including 
1,270 Full Time Equivalents (FTE)) specifically devoted to combating 
stolen identity refund fraud, cyber-security enhancements and related 
activities. This amount includes:

        $65 million to provide secure digital communications for 
taxpayers and provide leading-edge technologies to protect U.S. 
Treasury revenue through use of the IRS Return Review Program as well 
as advance IRS effectiveness in detecting, addressing, and preventing 
tax refund fraud;

        $42.6 million to enhance investigations of transnational 
organized crime;

        $40.7 million to address international and offshore compliance 
issues;

        $17.2 million to pursue employment tax and abusive tax 
schemes; and

        $8.2 million to improve taxpayer services through e-file 
authentication and mailing address data verification.

    The budget also includes $188 million (including 157 FTE) for 
critical information technology infrastructure that will help ensure 
taxpayer data remains safe.

    In FY 2017, the IRS will continue its commitment to taxpayers by 
building a new era of tax administration that will feature, among other 
priorities, stronger foundational capabilities and greater protection 
for the accounts of America's taxpayers. Additional funding will allow 
us to make these investments to strengthen cyber-defense and prevent 
identity theft and refund fraud by investing in technology and 
workforce skills that will allow for timely risk assessments, efficient 
analysis of vast volumes of data, and quicker reaction times to 
potential risks and incidents.

    Data breaches and identity theft place a huge burden on their 
victims and present a challenge to businesses, organizations, and the 
IRS. The IRS is making progress against these crimes, but in the 
absence of sufficient resources and tools, these problems will continue 
and only compound over time.

    Question. A number of my colleagues, including the Chairman and 
Ranking Member, Senator Nelson, and others, have introduced legislation 
addressing identity theft. The Individual Tax Reform Working Group, of 
which I am a co-chair, has been looking at identity theft and other tax 
administration issues. I hear from constituents who have fraudulent 
returns filed in their names, or whose family members are victimized by 
scammers, with very serious consequences and even heartbreaking 
consequences.

    I hope that we will take up some of these proposals to prevent 
these issues in the near future.

    Are there specific tools or proposals that would be especially 
helpful to you in efforts to prevent identity theft?

    Answer. Congress can help us in the fight against refund fraud and 
identity theft by passing several important legislative proposals in 
the President's FY 2016 Budget proposal, including the following:

        Acceleration of information return filing due dates. Under 
current law, most information returns, including Forms 1099 and 1098, 
must be filed with the IRS by February 28 of the year following the 
year for which the information is being reported, while Form W-2 must 
be filed with the Social Security Administration (SSA) by the last day 
of February. The due date for filing information returns with the IRS 
or SSA is generally extended until March 31 if the returns are filed 
electronically. The Budget proposal would require these information 
returns to be filed earlier, which would assist the IRS in identifying 
fraudulent returns and reduce refund fraud, including refund fraud 
related to identity theft.

        Correctible error authority. The IRS has authority in limited 
circumstances to identify certain computation or other irregularities 
on returns and automatically adjust the return for a taxpayer, 
colloquially known as ``math error authority.'' At various times, 
Congress has expanded this limited authority on a case-by-case basis to 
cover specific, newly enacted tax code amendments. The IRS would be 
able to significantly improve tax administration--including reducing 
improper payments and refund fraud as well as reducing costly audits--
if Congress were to enact the Budget proposal to replace the existing 
specific grants of this authority with more general authority covering 
computation errors and incorrect use of IRS tables. Congress could also 
help in this regard by creating a new category of ``correctible 
errors,'' allowing the IRS to fix errors in several specific 
situations, such as when a taxpayer's information does not match the 
data in certain government databases. To correct these errors today, 
IRS must open an audit, and we are limited in the number of audits we 
conduct by the resources available to engage with the taxpayer in the 
full audit process. Being able to correct certain mismatch errors would 
help with reducing some types of refund fraud.

        Authority to regulate return preparers. In the wake of court 
decisions striking down the IRS's authority to ensure unenrolled and 
unlicensed paid tax return preparers maintain minimum standards of 
competency, Congress should enact the Budget proposal to provide the 
agency with explicit authority to ensure all paid preparers maintain 
minimum standards. This legislation would help promote high quality 
services from tax return preparers and reduce refund fraud, improve 
voluntary compliance, foster taxpayer confidence in the fairness of the 
tax system, and protect taxpayers from preparer errors

        Expanded access to Directory of New Hires. Under current law, 
the IRS is permitted to access the Department of Health and Human 
Services' National Directory of New Hires only for purposes of 
enforcing the Earned Income Tax Credit and verifying employment 
reported on a tax return. The proposal would allow IRS access to the 
directory for tax administration purposes that include data matching, 
verification of taxpayer claims during return processing, preparation 
of substitute returns for non-compliant taxpayers, and identification 
of levy sources.

    There are a number of other legislative proposals in the 
Administration's FY 2016 Budget request that would also assist the IRS 
in its efforts to combat identity theft, including: giving Treasury and 
the IRS authority to require or permit employers to mask a portion of 
an employee's SSN on W-2s, which would make it more difficult for 
identity thieves to steal SSNs; adding tax-related offenses to the list 
of crimes in the Aggravated Identity Theft Statute, which would subject 
criminals convicted of tax-related identity theft crimes to longer 
sentences than those that apply under current law; and adding a $5,000 
civil penalty to the Internal Revenue Code for tax-related identity 
theft cases, to provide an additional enforcement tool that could be 
used in conjunction with criminal prosecutions.

    It is important to note that these legislative proposals, while 
they would be very helpful, only would be partially effective in 
achieving their intended goals without adequate resources for the 
agency.

    With limited resources and information, the IRS currently is only 
able to review fewer than 5% of the 100 million returns that request a 
refund. If, prior to issuing refunds, the IRS had access to third-party 
documents for matching earlier in the filing season (e.g., W-2), the 
IRS would be able to identify fraudulent returns for which there were 
no matching information returns. This would help reduce refund fraud, 
including refund fraud related to identity theft.

    With additional resources, the IRS could implement the following 
improvements to protect revenue and taxpayers:

        Expand the pre-refund filters and improve systemic coverage of 
potential ID Theft returns;

        Increase the number of analysts manually reviewing filing 
patterns to identify new suspicious patterns and react to newly 
submitted leads; and

        Improve service to victims of identity theft by increasing the 
number of IRS employees who manually review returns, contact taxpayers 
when needed, and make account adjustments for taxpayers affected by ID 
Theft.

                                 ______
                                 
               Questions Submitted by Hon. Mark R. Warner
    Question. Commissioner Koskinen, based on your testimony, taxpayers 
used the Get Transcript application to successfully obtain over 20 
million copies of their recently filed tax information. In previous 
statements, you have also mentioned that the ``Where's my Refund?'' 
application has been hugely successful. What does the IRS consider when 
balancing the availability of these services with protecting taxpayer's 
personally identifiable information?

    Answer. In accordance with the National Institute Standards and 
Technology (NIST), the IRS has implemented a holistic, organization-
wide Cyber-security risk management process with the principal goal of 
protecting the IRS organization and the ability to perform the IRS 
mission. The Cyber-security risk management process is treated as an 
essential management function of the organization balancing the 
assessment of management, operational, and technical controls to 
protect IRS systems. This approach includes applying NIST and Federal 
Information Security Management Act (FISMA) guidelines in identifying 
appropriate levels of identity proofing and authentication needed to 
protect IRS data and systems from identity and cyber-thieves.

    We developed our on-line services to facilitate taxpayers' 
increasing demand for self-service and electronic service options by 
providing them with more web-based tools, to make their interactions 
with us simpler and easier. As part of that effort, we launched an 
updated version of the Where's My Refund (WMR) application for the 2003 
filing season and the Get Transcript online application in January 
2014. WMR enables taxpayers to check the status of their refund online 
or through their mobile device. Get Transcript allows taxpayers to view 
and print a copy of their prior-year tax information, also known as a 
transcript, in a matter of minutes. Prior to the introduction of this 
online tool, taxpayers had to wait five to seven days after placing an 
order by phone or by mail to receive a paper transcript by mail. 
Taxpayers use tax transcript information for a variety of financial 
activities, such as verifying income when applying for a mortgage or 
student loan.

    During the 2015 filing season through May 22, 2015, taxpayers used 
WMR more than 217 million times. Without the WMR application, these 
contacts would have been driven primarily to our telephone application 
during a time when less than 40% of taxpayer calls were being answered.

    Before the Get Transcript application was shut down for security 
reasons, taxpayers had used that application to successfully obtain 
approximately 23 million copies of their recently filed tax information 
during the 2015 filing season. If this application had not existed and 
these taxpayers had to call or write us to order a transcript, it would 
have stretched our limited resources even further. That point is 
important to note, given our limitations during the past filing season. 
We would have been much less efficient in providing taxpayer service, 
not to mention the additional burden placed on taxpayers.

    The IRS considers many factors in making decisions around the 
appropriate level of identity proofing and authentication. Striking the 
right balance between a high level of confidence that the data and 
application are secure, and the ability of legitimate taxpayers to 
execute the authentication process and use the services, requires the 
IRS to make risk-based decisions. Today, striking the right balance 
between ease of access for legitimate taxpayers and protection of their 
data is an increasing challenge. As criminals obtain more personal 
information, authentication protocols need to become more 
sophisticated, moving beyond information that used to be known only to 
individuals but now, in many cases, is readily available to criminal 
organizations from various sources.

    The IRS continues to scrutinize and strengthen our authentication 
processes. In March 2015, we held a sit-down meeting with the leaders 
of the tax software and payroll industries and state tax 
administrators. We agreed to build on our cooperative efforts of the 
past and find new ways to leverage this public-private partnership to 
help battle identity theft.

    We formed three working groups, one focusing on authentication, 
that continue to meet. They have agreed on short-term solutions to help 
taxpayers in the next tax season, and continue to work on longer-term 
efforts to protect the integrity of the nation's tax system. We 
identified numerous new data elements that can be shared at the time a 
tax return is filed to detect stolen identity refund fraud. Some issues 
we're focusing on include:

        Reviewing the transmission of the return, including the 
improper or repetitive use of Internet Protocol numbers, and the 
Internet address from which the return is originating.

        Reviewing computer device identification data tied to the 
return's origin.

        Reviewing the time it takes to complete a return, so computer 
mechanized fraud can be detected.

        Capturing meta-data in the computer transaction that will 
allow review for fraud.

    This data will give us a stronger line of sight than ever before at 
the front end of the process and we believe this will help catch more 
bad returns immediately.

    We must balance the strongest possible authentication processes 
with the ability of taxpayers to legitimately access their data and use 
IRS services online. The challenge will always be to keep up with, if 
not get ahead of, fraudsters in this area. The eventual approaches to 
authentication may include a combination of continued IT investments as 
well as modified business processes.

    We continue to work with other federal agencies across government 
to identify best practices, leverage information and identify broader 
solutions. Ultimately, it is investment in our staffing and IT systems 
that will be critical to properly equipping the IRS to combat and 
prevent fraudulent and criminal activity.

    Question. Commissioner Koskinen, last month, I co-sponsored the 
Social Security Identity Defense Act of 2015 with Senators Johnson and 
Ayotte. This bill would require the IRS to notify an individual if the 
agency has reason to believe the individual's Social Security Number 
has been fraudulently used. It also requires that the IRS notify law 
enforcement and that the Social Security Administration notify 
employers who submit fraudulently used Social Security Numbers. In 
addition to this legislation, I have written to you on several 
occasions to understand what the IRS is doing to notify victims of tax-
related identity theft.

    What steps is the IRS taking to notify victims of this recent 
attack, and what will you be doing in the future to protect their tax 
information?

    Answer. Ensuring the security of our systems and the protection of 
taxpayers and their information are top priorities. Even with our 
constrained resources over the past few years, we continue to devote 
significant time and attention to these challenges. Ongoing data 
breaches involving other companies and organizations, through which 
criminals have been able to gather increasing amounts of personal data, 
make it even more challenging and difficult to protect taxpayers.

    In May, the IRS determined unauthorized third parties already had 
sufficient information from a source outside the tax agency before 
accessing the Get Transcript application. This allowed them to clear a 
multi-step authentication process, including several personal 
verification questions that typically are only known by the taxpayer.

    When the IRS first identified the problem in May, we determined 
that these third parties with taxpayer-specific sensitive data from 
non-IRS sources had cleared the Get Transcript verification process on 
about 114,000 total attempts. In addition, it appeared at that time 
that third parties made another 111,000 attempts that failed to pass 
the final verification step, meaning they were unable to access account 
information through the Get Transcript service.

    Since then, as part of the IRS's continued efforts to protect 
taxpayer data, the IRS conducted a deeper analysis over a wider time 
period covering the 2015 filing season, analyzing more than 23 million 
uses of the Get Transcript system. The new review identified an 
estimated additional 220,000 attempts where individuals with taxpayer-
specific sensitive data cleared the Get Transcript verification 
process. The review also identified an additional 170,000 suspected 
attempts that failed to clear the authentication processes.

    The IRS mailed letters to all taxpayers identified in May and later 
we also mailed letters to the population identified in August (as part 
of our continued analysis). To the taxpayers whose tax information was 
successfully obtained by unauthorized third parties, we are offering 
credit monitoring, at our expense. We strongly encourage the recipients 
of these letters to take advantage of the credit monitoring. We are 
also giving them the opportunity to provide us with the authentication 
documentation necessary to get an Identity Protection Personal 
Identification Number (IP PIN). This will further safeguard their IRS 
accounts and help them avoid any problems filing returns in future 
years. The IRS is marking all of the impacted accounts will indicators 
that will help identify and prevent any fraudulent returns from being 
filed under those SSNs.

    The Get Transcript application was shut down in May, and the IRS 
continues to work on strengthening the system. In the meantime, 
taxpayers have several other options to obtain transcripts.

    The IRS takes the security of taxpayer data extremely seriously, 
and we are working aggressively to protect affected taxpayers and 
continue to strengthen our systems.

    The matter remains under review by the Treasury Inspector General 
for Tax Administration as well as IRS Criminal Investigation.

    Question. Commissioner Koskinen, the nation's economy and 
Americans' personal and financial information are increasingly under 
threat from cyber-attacks aimed at stealing personal data. In recent 
years, hundreds of millions of Americans have had their information 
compromised through high-profile breaches at Target, Neiman Marcus, 
Michaels, Home Depot, JPMorgan and Anthem.

    I am working on a proposal to create a comprehensive, nationwide 
and uniform data breach law that is consistently applied and enforced 
across industries, and requires minimum data security standards and 
consumer notification for breaches of financial data and other 
sensitive information.

    This recent theft at the IRS of over 100,000 taxpayer records by 
sophisticated attackers is yet another example of how stolen personal 
data can perpetuate an even larger fraud problem. What is the IRS doing 
to understand and react to the newest developments in cyber-security 
and data breach?

    Answer. Cyber-security is a primary component of the IRS's 
information technology infrastructure. We use a proactive, layered set 
of cyber-defenses, and we assess risks in our management approach. The 
IRS's policy is to assume that a penetration can occur, and so we focus 
on prevention, constantly assessing our digital defenses, seeking to 
detect intrusions rapidly, quarantining infections, and taking prompt 
counter measures. The IRS works closely with partners in the Federal 
Government, such as: the Treasury Department's Government Security 
Operations Center (GSOC); the Department of Homeland Security's (DHS) 
Computer Emergency Readiness Team (US-CERT) as well as DHS's Government 
Forum of Incident Response and Security Team (GFIRST); and the Treasury 
Inspector General for Tax Administration (TIGTA).

    While the IRS has a long history of successfully defending against 
attempts to steal taxpayer data, constant vigilance is needed, as the 
Get Transcript incident shows. Currently, the IRS takes a very 
aggressive approach to protecting taxpayer data by: restricting 
internet access; encryption of taxpayer data for any transmission 
externally; content filtering and strict firewall policies, and network 
security monitoring. In fact, the IRS has developed a Cyber-security 
Strategy that is focused on managing information security risk on a 
continuous basis; monitoring the security controls in IRS information 
systems and the environments in which those systems operate on an 
ongoing basis; and maintaining ongoing awareness of information 
security, vulnerabilities and threats to support organizational risk 
management decisions. The critical risk to continuing to implement this 
strategy is not the sophistication or frequency of cyber-attacks, but 
instead is the IRS's current budget situation which has resulted in the 
reduction of Cyber-security staff and the inability to fill vacant 
positions. These skill sets and talents are under high demand across 
both the public and private sectors. The IRS's Cyber-security staff is 
currently 356 personnel, which is down from its high of 408 employees 
in FY 2012. The inability to hire and retain certified Cyber-security 
staff prevents the IRS from sustaining its vigilance against cyber-
attack.

    In addition to addressing the cyber-security issues of today, the 
IRS is working to anticipate the challenges of evolving technology used 
by taxpayers. The IRS is currently trying to move to a more robust 
interactive web-based means of interacting with taxpayers. The American 
people have grown accustomed to instant financial exchanges with 
lenders, brokers, and banks. The IRS believes that delivering top 
quality service to America's taxpayers requires catching up to those 
expectations in order to operate seamlessly but securely in a digital 
and global environment.

    This evolution will increase cyber-security risks, requiring more 
resilience and protection of data. In response to the recent fraud 
incident referenced in your question, we are reviewing multiple 
authentication policies and capabilities with particular focus on 
updating our e-Authentication system for accessing a variety of online 
applications. The IRS is researching internal capabilities as well as 
those available from third parties through existing and planned 
contracts. These options include, but are not limited to:

        Internal IRS configuration updates to limit fraud and 
vulnerabilities to scripting attacks;

        Implementing the ability to add additional levels of 
assurance;

        Layering additional capabilities such as multi-factor 
authentication to complement assurance gained through taxpayer 
interactions; and

        Third-party configuration changes to improve and strengthen 
out-of-wallet questions for applications with the ability to use this 
type of authentication, such as online payment options.

    We must balance the strongest possible authentication processes 
with the ability of taxpayers to legitimately access their data and use 
IRS services online. The challenge will always be to get ahead of our 
enemies in this area.

    In addition to e-authentication improvements, the IRS also plans to 
enhance return filing by conducting the Processing Year W-2 
Verification Code Pilot which will test the capability of a hash-based 
authentication code. The test will confirm the authenticity of Forms W-
2 data on a pilot population of e-filed Forms 1040. The pilot is one of 
multiple IRS efforts to develop capabilities for authenticating 
taxpayers, and taxpayer data, at the point of filing to prevent 
identity theft and first party refund fraud.

    And finally, Cyber-security and related initiatives submitted as 
part of the President's FY 2016 budget submission are specifically 
devoted to combating identity theft and refund fraud, as well as 
investing in critical information technology infrastructure. These 
initiatives will help enhance security in digital communications for 
taxpayers; provide leading-edge technologies to protect tax revenue 
through use of the IRS Return Review Program as well as advance IRS 
effectiveness in detecting, addressing, and preventing tax refund 
fraud; and improve taxpayer services with e-file authentication 
enhancements.

    Question. Commissioner Koskinen, it is my understanding that third-
party vendors have signed up with the IRS to access taxpayer 
transcripts via the Income Verification Express Service. What is the 
IRS doing to ensure that these third-party vendors that have signed up 
with the IRS to access taxpayer transcripts have appropriate safeguards 
in place and are not vulnerable to data breaches?

    Answer. The IRS discloses return information to an Income 
Verification Express Services (IVES) participant pursuant to the 
taxpayer's authorization and request pursuant to Internal Revenue Code 
(IRC) section 6103(c). The taxpayer provides this authorization by 
completing and signing Form 4506-T, Request for Transcript of Tax 
Return. Form 4506-T includes this important statement to the taxpayer:

        Caution. If the tax transcript is being mailed to a third 
        party, ensure that you have filled in lines 6 through 9 before 
        signing. Sign and date the form once you have filled in these 
        lines. Completing these steps helps to protect your privacy. 
        Once the IRS discloses your tax transcript to the third party 
        listed on line 5, the IRS has no control over what the third 
        party does with the information. If you would like to limit the 
        third party's authority to disclose your transcript 
        information, you can specify this limitation in your written 
        agreement with the third party.

    Once the IRS discloses the information to the IVES participant 
pursuant to a valid Form 4605-T authorization, the IRS generally has no 
legal control over what the third party does with the information.

    The IRS added a checkbox to Form 13803, IVES Applicant Agreement, 
listing additional limited use or non-disclosure restrictions. The 
checkbox states:

        By marking this box, you acknowledge that you have read 
        Publication 4557, Safeguarding Taxpayer Data, and will abide by 
        the guidelines of the publication. In addition, you agree to 
        use the taxpayer information you receive only for the 
        purpose(s) the taxpayer/requestor intended on the Form 4506-T. 
        Failure to complete this box will result in the application 
        being rejected and returned.

    By checking the box, each IVES applicant acknowledges these non-
disclosure restrictions as a condition of participating in the program. 
In addition, Publication 4557 addresses the responsibility of non-
government service providers to secure information systems and security 
systems in addition to facilities and personal security required.

                                 ______
                                 
       Submitted by Hon. Pat Roberts, a U.S. Senator From Kansas

                           The New York Times

                              May 28, 2015

      I.R.S. Data Breach May Be Sign of More Personalized Schemes
                           By Patricia Cohen
    The plot to steal information on 100,000 taxpayers from the 
Internal Revenue Service and hijack nearly $50 million in refunds not 
only reveals a previous security breach but hints at a wider fraud that 
may bedevil Americans in the future.

    Some security and tax experts warned that this latest data theft 
might be a prelude to more targeted schemes aimed at duping taxpayers 
into handing millions of dollars over to criminals or to help thieves 
circumvent the agency's security filters next year and beyond.

    ``This breach is not just about what this single group is going to 
do with the information, but what happens when this information gets 
sold on the black market,'' said Peter Warren Singer, the author of 
``Cybersecurity and Cyberwar: What Everyone Needs to Know.'' ``It's 
rare for the actual attackers to turn the information directly into 
money. They're stealing the data and selling it off to other people.''

    It is almost impossible to find a business or government agency 
that has not had some kind of security breach, he noted. Millions of 
customers at companies like Target and the private insurer Anthem have 
had data compromised. And this year, TurboTax temporarily halted 
electronic filing of state income tax returns after seeing an uptick in 
attempts to use stolen information to file fraudulent returns and 
wrongly claim tax refunds.

    With the I.R.S., it was not the agency's own system that was 
hacked. Criminals had already obtained individuals' Social Security 
Numbers, addresses and birth dates and then used the information to 
trick the network and gain access to taxpayers' returns and filings 
through an application on the I.R.S. website.

    ``There was no identity theft within the I.R.S.'s actual system,'' 
said Aaron Blau, a tax expert in Tempe, AZ. ``These people already had 
all of this data. They could have used this information to call your 
bank, your doctor, your insurance carrier, and they would have gotten 
through 100 percent of the time. In this case they chose to use the 
I.R.S.''

    Many Americans are being attacked more directly, Mr. Blau said. One 
popular scheme is to cold-call taxpayers and threaten them with 
prosecution if they do not immediately pay money supposedly owed to the 
I.R.S. by directing them to purchase a prepaid debit card and then 
transfer the money. Now, with more detailed information from returns, 
criminals could better target potential victims, and bolster their 
credibility with information stolen from taxpayer filings, Mr. Blau 
said.

    Reusable prepaid cards have become a magnet for fraud, according to 
law enforcement officials, with criminals often posing as bill 
collectors, government agents and others.

    Without more information about the individuals who were targeted, 
it is hard to know the endgame, said Marc Goodman, the author of 
``Future Crimes.'' Mr. Goodman noted that previous security breaches 
had sometimes been used to embarrass politicians, celebrities or 
corporate figures, and tax returns would provide a rich source of 
personal information.

    Although some critics have been quick to condemn the I.R.S., 
several tax experts said using this episode to vilify the agency was 
unfair.

    ``The I.R.S. takes data, privacy and data security extremely 
seriously,'' said Edward Kleinbard, a professor of law at the 
University of Southern California and former staff director of the 
Joint Tax Committee of Congress. ``They do their best, but the 
resources arrayed against it have become increasingly well-funded and 
sophisticated, and the problems will only compound over time.''

    William Gale, co-director of the tax policy center at the Brookings 
Institution, agreed that the issue extended beyond a single agency. ``I 
don't think this is an I.R.S. problem per se. It is facing the same 
problems that all the major data providers have.''

    The I.R.S. has repeatedly said that protecting taxpayer information 
and combating fraud were priorities. Half of the attempted information 
thefts were rebuffed through a system of filters that are used to 
detect fraud, the agency said.

    Still, there is little debate that its efforts have been hampered 
by budget cuts. Just two months ago, an agency overseer issued what now 
seems to be a prescient warning.

    ``Resources have not been sufficient for the I.R.S. to work 
identity theft cases dealing with refund fraud, which continues to be a 
concern,'' J. Russell George, the Treasury Inspector General for Tax 
Administration, testified before a Senate subcommittee.

    The agency's budget has been cut by 17 percent over the last four 
years after taking inflation into account, and its work force, now at 
roughly 83,000, has been reduced by 12,000. This year, John A. 
Koskinen, the I.R.S. commissioner, warned that impending budget cuts 
would have devastating effects, including the delay of new protections 
against identity theft and refund fraud.

    Chuck Marr, director of federal tax policy at the Center on Budget 
and Policy Priorities in Washington, said that the agency has been 
starved for funds: ``The Congress has been targeting the I.R.S. for 
years.''

    Nina E. Olson, who leads the Taxpayer Advocate Service, an 
independent office at the I.R.S., has criticized the agency for its 
handling of identity theft cases.

    In her annual report, she noted that victims often must ``navigate 
a labyrinth of I.R.S. operations and recount their experience time and 
again to different employees. Even when cases remain in one I.R.S. 
function, they may be transferred from one assistor to another with 
significant periods of non-activity.'' On average, the agency took 
nearly six months to resolve cases.

    She added that cases were also frequently closed prematurely, 
``before all related issues have been fully addressed.''

    Her office recommended that a single officer be assigned to handle 
each case.

    In an email, she spoke to a broader issue: ``While granting 
taxpayers enhanced access to their tax information remains a laudable 
goal, the overriding priority must be to protect taxpayers' 
confidential tax information from exposure.''

    As for this most recent data theft, the I.R.S. urged taxpayers not 
to contact the agency, saying it would only delay the already 
overburdened staff. Anyone whose information was stolen will be 
contacted, the agency said.

    The best advice at this stage, Mr. Blau, the tax expert, said, is, 
``Hurry up and wait.''

                                 ______
                                 
                 Prepared Statement of Hon. Ron Wyden, 
                       a U.S. Senator From Oregon
    Three months ago, the Finance Committee met in a hearing on the 
latest ID theft and other scams plaguing taxpayers, and I said that 
wave of attacks sure looks to me like organized crime. Today, we meet 
after 104,000 tax returns have been hoovered up by what appears to be a 
sophisticated organized crime syndicate.

    This problem continues to spiral, with hackers targeting Federal 
agencies, State governments including Oregon's, and private companies 
alike to steal money and data. One recent report from the Department of 
Homeland Security said federal agencies' computer systems come under 
attack hundreds of times a day, tens of thousands of times a year.

    The investigation of the stolen tax returns is ongoing as of this 
morning. But once again, it seems the thieves are one step ahead of the 
authorities. They gained access to enormous amounts of personal data, 
which is up for purchase at extraordinary cost in the Internet's 
shadowy corners. These rip-off artists used that data to slip past the 
security filters at the IRS and steal taxpayers' most sensitive 
financial information.

    So in my view, it's fair to say that once again, this conduct fits 
the definition of organized crime.

    The thieves who steal taxpayer information could wipe out people's 
life savings and leave them in financial ruin. They could falsify tax 
returns next year or further down the road. They could take out huge, 
fraudulent home or student loans. And on a bigger scale, the money 
stolen in this cyber-crime wave could be funneled into more criminal 
activity. It could wind up in war zones. There's a possibility that it 
could fund acts of terrorism without being traced.

    Just like when the White House and the Department of Defense were 
targeted in the past, this was an attack on Americans' security. I will 
be very direct about what's needed here. To protect taxpayers from this 
onslaught of cyber-crime, the IRS needs a 21st-century IT system.

    This is not just a question of resources, and certainly it is not a 
lack of commitment from the IRS staff. It's also a question of 
expertise. The era of punch cards and paper forms ended long ago. 
Federal agencies like the IRS need to tap into the expertise of our 
leading web firms--the pros who serve not millions or tens of millions, 
but hundreds of millions of users.

    That expertise will allow the IRS to avoid the pitfalls of the past 
and to implement a 21st-century IT system that protects taxpayers' 
privacy, catches hackers and cheats, and funds the government as 
efficiently as possible. When that system is in place, Congress must 
step up and appropriate the funds necessary to manage it effectively.

    Legislators would not call for the DOD or White House security 
budgets to be slashed after cyber-attacks, but the IRS's security 
funding has been shrinking for years. No company would try to defend 
against modern cyber-criminals with technology that's 20 or 30 years 
old, but that's what the IRS is stuck using in the absence of the 
expertise and resources to serve the American taxpayer.

    Congress could also make sure the IRS has the information it needs 
to mount the strongest possible fight against fraudsters. If the IRS 
had access to the data on 
W-2 and 1099 forms from the very beginning of tax season, it would be 
much easier to catch fraudulent returns early and save taxpayers the 
nightmare of a stolen refund. Senator Hatch and I developed a 
bipartisan proposal to add an extra level of security by expanding the 
program that distributes unique passwords for individual taxpayers to 
use when they file.

    And when taxpayers do become victims of fraud, they should get more 
help undoing the damage quickly and restoring their credit.

    It should be clear to everybody that beefing up cyber-security at 
the IRS must be a top priority and draw on the tech expertise that 
exists in Oregon and in states across the country. So it's my hope that 
our hearing today will set aside politics and focus on fresh ideas of 
how to best protect taxpayers.

                                   [all]
```