text: IRS Has Broad Efforts Underway to Address Authentication Challenges Our report noted that IRS has established organizational structures essential to supporting its taxpayer authentication efforts. Specifically, IRS created an Identity Assurance Office (IAO) in 2015 to work with stakeholders across IRS to review and assess the agency’s various authentication programs and efforts. In 2016, IAO led an effort that identified over 100 interactions between IRS and taxpayers that require authentication and categorized these interactions based on potential risks to the agency and taxpayers. Further, in December 2016, IAO released its Roadmap for developing a modern and secure authentication environment for all taxpayers regardless of how they interact with IRS— online, over the telephone, in person, or via correspondence. We also found that IRS is working to address its authentication challenges by collaborating with industry members and state partners via the Security Summit. The Security Summit was established in 2015 as an ongoing effort between industry experts from tax software companies, paid preparers, financial institutions, and states to improve information sharing and fraud detection and to address common IDT challenges. The Security Summit’s authentication workgroup leads several initiatives aimed at verifying the authenticity of the taxpayer and the tax return at the time of filing. One initiative involves analyzing data elements—such as trusted customer requirements and other characteristics of the return— that are collected during the tax return preparation and electronic filing process. In addition, in 2016 the authentication workgroup recommended improved account password standards to help protect taxpayers’ accounts from being taken over by criminals. Overall, we found that officials—representing IRS, industry, and states— expressed positive views about the level of commitment and cooperation guiding the group’s authentication efforts. Officials with whom we spoke stated that they are dedicated to continuing to address authentication issues collaboratively because they have a mutual interest in improving authentication to reduce tax refund fraud. IRS Has Begun to Implement Its Authentication Strategy, but Has Not Articulated Priorities and Resource Needs In its Roadmap, IRS outlined six core authentication objectives, 10 high- level strategic efforts, and 14 foundational initiatives to help it address authentication challenges and identify opportunities for future investment. While we found that IRS has made progress on some efforts identified in its Roadmap, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. For example, one of IRS’s foundational initiatives is to send event-driven notifications to taxpayers, such as when they file a return or request a tax transcript. Such notifications could help IRS and taxpayers detect potentially fraudulent activity at the earliest stage and help improve authentication of tax returns. The Roadmap identifies seven supporting activities for this foundational initiative. One is to provide taxpayers with greater control over their online accounts. Another supporting activity is to determine methods for sending notifications to taxpayers about activity on their account. However, IRS has not identified the resources required to complete these activities, and the Roadmap notes that six of the seven activities will take between 6 months to 3 years to complete. In December 2017, IRS officials stated that they had developed business requirements for the foundational initiative to give taxpayers greater control over their online accounts. However, IRS has not identified funding for the initiative’s other supporting activities—such as developing requirements to send push notifications to taxpayers—and implementation will depend on the availability of future resources. In December 2017, IRS officials stated that each of the strategic efforts and foundational initiatives identified in the Roadmap are a high priority, and they are working to address them concurrently while balancing the availability of resources against the greatest threats to the tax environment. As noted in our report, we recognize that a strategy is necessarily high-level and that IRS must remain flexible and use available resources to respond to unexpected threats. Identifying resources and prioritizing activities in its Roadmap will help IRS clarify tradeoffs between costs, benefits, and risks and aid in decision making. Further, such efforts may also help IRS establish clearer timelines and better respond to unexpected events. As such, we recommended that IRS estimate the resources (i.e., financial and human) required for the foundational initiatives and supporting activities identified in its Roadmap and prioritize its foundational initiatives. IRS agreed with our recommendations and is currently working to finalize its overall authentication approach. Additional Actions Could Help IRS Enhance Security and Stay Ahead of Fraudsters Given the widespread availability of personally identifiable information that fraudsters can use to perpetrate tax fraud, it is essential for IRS to further strengthen taxpayer authentication to stay ahead of fraudsters’ schemes. In our report, we identified two additional areas that IRS must address to better position the agency and protect taxpayers against future threats. First, we found that IRS has taken preliminary steps to implement NIST’s June 2017 guidance for secure online authentication, however it had not yet established detailed plans, including timelines, milestone dates, and resource needs to fully implement it. Among other things, NIST’s new guidance directs agencies to assess the risk for each component of identity assurance—identity proofing, authentication, and federation— rather than conducting a single risk assessment for the entire process. According to NIST officials, this approach gives agencies flexibility in choosing technical solutions; aligns with existing, standards-based market offerings; is modular and cost-effective; and enhances individual privacy. In short, following NIST’s new guidance will help provide IRS with better risk-based assurance that the person trying to access IRS’s online services is who they claim to be. As noted in our report, IRS has taken preliminary steps to implement the new NIST guidance. These efforts include forming a task force to guide IRS’s implementation of NIST guidance and working with the Security Summit to develop an implementation framework for state and industry partners. IRS has also begun analyzing gaps between IRS’s current authentication procedures and the new guidance. In addition, in December 2017, IRS implemented a more secure online authentication option consistent with the new guidance through its mobile application, IRS2Go. After taxpayers link their IRS online account with the mobile app, they can use it to generate a security code to log into their account. This option provides taxpayers with an alternative to receiving the security code via a text message, which NIST considers to be less secure. We recommended that IRS develop a plan—including a timeline, milestone dates, and resources needed—for implementing changes to its online authentication programs consistent with new NIST guidance, and also implement these improvements. IRS agreed with our recommendations, but noted that its ability to complete these efforts will depend on the availability of resources. Second, we found that IRS lacks a comprehensive, repeatable process to identify and evaluate potential new authentication technologies and approaches. Our discussions with representatives from industry and financial institutions and with government officials indicate that there is no single, ideal online authentication solution that will solve IRS’s challenges related to IDT refund fraud. These representatives advocate an approach to authentication that relies on multiple strategies and sources of information, while giving taxpayers options for further protecting their information. We identified several authentication options in our report that IRS could consider, including the following: Possession-based authentication. This type of authentication offers users a convenient, added layer of security when used as a second factor for accessing websites or systems that would otherwise rely on a username and password for single-factor authentication. For example, as noted in our report, according to an industry official, authentication using a trusted device or “security key” based on Universal Second Factor standards complies with NIST’s new guidance for digital authentication. While IRS is not likely to provide the devices to taxpayers, it could enable its systems to accept these trusted devices as authenticators for taxpayers who elect to use them. Working with trusted partners. IRS could partner with organizations it trusts that are accessible to taxpayers and enable the partners to identity-proof and authenticate taxpayers. Trusted partners could include tax preparers, financial institutions, or other federal or state agencies. In the course of our work, IRS officials stated that they had been exploring such options with both the Social Security Administration and the U.S. Postal Service; however, at the time of our report, the agencies had not yet made decisions about next steps. Expanding existing IRS services to further protect taxpayers. IRS could expand the functionality of its online account to further protect taxpayers from IDT refund fraud. For example, IRS could develop additional functionality that allows the taxpayer to designate a bank account or a preference for a paper check for receiving a tax refund. If a fraudster filed a return with different information, the return would be automatically rejected. IRS officials told us the agency continually researches new identity assurance processes and technologies and has talked with other agencies, industry groups, and vendors to better understand how particular technology solutions could apply to IRS’s environment. However, during the course of our work, IRS could not provide us evidence of a repeatable, comprehensive process to identify and evaluate available authentication technologies and services. Such a process could compare options for in-house authentication solutions with off-the-shelf solutions based on estimates of cost, schedule, and benefits, as applicable. To this end, we recommended that IRS develop a process to identify and evaluate alternative options for improving taxpayer authentication, including technologies in use by industry, states, or other trusted partners; and based on this approach, include and prioritize these options, as appropriate, in its Roadmap. IRS agreed with these recommendations, but did not provide additional details on how it plans to address them. In conclusion, IRS’s authentication environment is one component of a broad, complex information technology infrastructure, and we have previously reported on the many challenges the agency faces as it modernizes its tax systems. Taxpayer authentication has become more difficult with the wide availability of personally identifiable information and fraudsters’ ability to develop more complex and sophisticated methods to commit fraud undetected. Addressing the issues we describe above could better position IRS to identify and mitigate vulnerabilities in its authentication efforts and better protect taxpayers and the Treasury. Chairman Jenkins, Ranking Member Lewis, and members of the Subcommittee, this concludes my prepared remarks. I look forward to answering any questions that you may have at this time. GAO Contacts and Staff Acknowledgments If you or your staff have any questions about this testimony, please contact James R. McTigue, Jr. at (202) 512-9110 or mctiguej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Key contributors to this testimony include Neil Pinney, Assistant Director; Heather A. Collins, Analyst-in-Charge; Dawn Bidne; and Bryan Sakakeeny. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.
target: This testimony summarizes the information contained in GAO's June 2018 report, entitled Identity Theft: IRS Needs to Strengthen Taxpayer Authentication Efforts ( GAO-18-418 ). The Internal Revenue Service (IRS) has identified over 100 interactions requiring taxpayer authentication based on potential risks to IRS and individuals. IRS authenticates millions of taxpayers each year via telephone, online, in person, and correspondence to ensure that it is interacting with legitimate taxpayers. IRS's estimated costs to authenticate taxpayers vary by channel. IRS has made progress on monitoring and improving authentication, including developing an authentication strategy with high-level strategic efforts. However, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. Doing so would help IRS clarify relationships between its authentication efforts and articulate resource needs relative to expected benefits. Further, while IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes. As a result, IRS may not identify current or emerging threats to the tax system. IRS can further strengthen authentication to stay ahead of fraudsters. While IRS has taken preliminary steps to implement National Institute of Standards and Technology's (NIST) new guidance for secure digital authentication, it does not have clear plans and timelines to fully implement it by June 2018, as required by the Office of Management and Budget. As a result, IRS may not be positioned to address its most vulnerable authentication areas in a timely manner. Further, IRS lacks a comprehensive process to evaluate potential new authentication technologies. Industry representatives, financial institutions, and government officials told GAO that the best authentication approach relies on multiple strategies and sources of information, while giving taxpayers options for actively protecting their identity. Evaluating alternatives for taxpayer authentication will help IRS avoid missing opportunities for improving authentication.