Information Security: IRS Electronic Filing Systems
Published: 2001-02-16T00:00:00

Fast Facts:

Highlights:
section_title: What GAO Found
paragraphs: A number of serious control weaknesses in the Internal Revenue Service's (IRS) electronic filing systems placed personal taxpayer data in IRS' electronic filing system at significant risk of unauthorized disclosure, use, and modification during the 2000 tax filing season. IRS recognized the importance of promptly addressing these weaknesses and stated that it has taken steps to correct them prior to the current tax filing season. Ensuring that ongoing controls over electronic filing are effective requires top-management support and leadership, disciplined processes, and consistent oversight. IRS' efforts to achieve the goal that 80 percent of all tax and information returns be filed electronically by 2007 must be balanced with the need to adequately ensure the security, privacy, and reliability of taxpayer and other sensitive information. Failure to maintain adequate security over IRS' electronic filing systems could erode public confidence in electronically filing tax returns, jeopardize IRS' ability to meet the 80 percent goal, and deprive IRS of the many benefits that electronic filing offers.

section_title: Letter
paragraphs: In connection with your request that we evaluate the effectiveness of the  Internal Revenue Service’s (IRS) computer controls over its external access  points and internal networks and systems, we assessed the effectiveness of  key computer controls designed to ensure the security, privacy, and  reliability of IRS’ electronic filing systems and electronically filed taxpayer  data during last year’s tax filing season. This report discusses computer  control weaknesses that existed in IRS’ electronic filing systems during the  2000 tax filing season and describes actions IRS has taken to correct these  weaknesses prior to the current 2001 tax filing season.
IRS maintains and operates several computerized information systems to  support its electronic filing (e-file) program. These electronic filing systems  receive tax returns telephonically from taxpayers or electronically from  IRS trading partners, acknowledge the receipt of information, perform  editing and data validation routines on tax return data received, format the  information for mainframe processing, and pass “perfected” information on  to the master files.
Electronic filing of income tax returns offers benefits to both taxpayers and  IRS. IRS reports that taxpayers receive refunds faster and believes that  electronic filing improves accuracy, decreases processing costs, and  ensures the security and privacy of taxpayer data.
IRS plans to significantly expand its electronic filing initiative. The IRS  Restructuring and Reform Act of 1998 established a goal for IRS that 80  percent of all tax and information returns be filed electronically by 2007.  Further, the President’s fiscal year 2001 budget request specified that IRS  offer, no later than tax year 2002, one or more options to the public for  preparing and filing individual income tax returns over the Internet at no  cost to the taxpayer.
subsections: section_title: Background
paragraphs: Information security is an important consideration for any organization  that depends on information systems and computer networks to carry out  its mission or business. The dramatic expansion in computer  interconnectivity and the rapid increase in the use of the Internet are  changing the way our government, the nation, and much of the world  communicate and conduct business. However, without proper safeguards,  these developments pose enormous risks that make it easier for individuals  and groups with malicious intent to intrude into inadequately protected  systems and use such access to obtain sensitive information, commit fraud,  disrupt operations, or launch attacks against other computer networks and  systems. Further, the number of individuals with computer skills is  increasing, and intrusion, or hacking, techniques are readily available and  relatively easy to use. The rash of cyber attacks launched in February 2000  against major U.S. firms illustrates the risks associated with this new  electronic age.
Computer-supported federal operations are also at risk. Our previous  reports, and those of agency inspectors general, describe persistent  computer security weaknesses that place a variety of critical federal  operations, including those at IRS, at risk of disruption, fraud, and  inappropriate disclosure. This body of audit evidence led us, in 1997 and  again in 1999 reports to the Congress, to designate computer security as a  governmentwide high-risk area. It remains so today.
How well federal agencies are addressing these risks is a topic of  increasing interest in both the Congress and the executive branch. This is  evidenced by recent hearings on information security, recent legislation  intended to strengthen information security, and the President’s January  2000 National Plan for Information Systems Protection. As outlined in this  plan, a number of new, centrally managed entities have been established  and projects initiated to assist agencies in strengthening their security  programs and improving federal intrusion-detection capabilities.
subsections: section_title: IRS Is a Major Steward of Personal Taxpayer Information
paragraphs: In its role as the nation’s tax collector, IRS has a demanding responsibility  in collecting taxes, processing tax returns, and enforcing the nation’s tax  laws. IRS processes more than 150 million tax returns, accounts for  approximately $1.9 trillion in collections, and pays about $185 billion in  refunds to taxpayers annually. To efficiently fulfill its tax processing  responsibilities, IRS places extensive reliance on interconnected computer  systems to perform various functions, such as collecting and storing  taxpayer data, processing tax returns, calculating interest and penalties,  generating refunds, and providing customer service.
Due to the nature of its mission, IRS collects and maintains a significant  amount of personal and financial data on each American taxpayer. These  data typically include the taxpayer’s name, address, social security number,  dependents, income, source of certain types of income, and certain  deductions and expenses. The confidentiality of this sensitive information  is important because American taxpayers could be exposed to a loss of  privacy and to financial loss and damages resulting from identity theft and  financial crimes should this information be disclosed to unauthorized  individuals.
section_title: E-File Is a Major IRS Tax Filing Initiative
paragraphs: IRS’ e-file program offers taxpayers an alternative to filing traditional paper  returns. With e-file, a taxpayer may file an electronic tax return (1) through  a tax professional who is also an authorized IRS e-file provider, (2) through  a personal computer to an e-file transmitter, or (3) over the telephone. The  e-file program is beneficial because IRS receives tax and information  returns in electronic form and does not have to manually enter data into its  computer systems as it does with paper returns. IRS has asserted that data  on electronic tax returns cost less to process and are more accurate than  on paper returns, taxpayers receive refunds faster, and taxpayer privacy  and security are assured.
The number of individuals filing returns electronically is increasing. During  2000, IRS reported that over 35 million individual taxpayers, about 20 percent more than the previous year, filed their returns electronically.  The number of e-file individual returns represented about 28 percent of all  individual returns projected to be filed during 2000. The IRS Restructuring  and Reform Act of 1998 established a goal that 80 percent of all tax and  information returns be filed electronically by 2007.
In an attempt to meet this goal, IRS has aggressively marketed the e-file  program and has authorized private firms and individuals to be its e-file  trading partners. These partners include electronic return originators, who  prepare electronic tax returns for taxpayers, and transmitters, who  transmit the electronic portion of a return directly to IRS. Except for  taxpayers who file electronic returns using telephones, IRS does not allow  individual taxpayers to transmit their electronic tax returns directly to the  agency. Electronic filers must use the services of an IRS trading partner.
The Director, Electronic Tax Administration, is responsible for overseeing  IRS’ electronic tax programs, including e-file, and for improving taxpayer  awareness of electronic tax administration products and services. The  Chief Information Officer has overall responsibility for developing,  operating, and securing IRS information systems including those used for  electronic filing. The Director, Submission Processing, is responsible for  processing electronically filed tax returns.
section_title: E-File Vulnerabilities Could Have Allowed Intruders to Obtain Taxpayer Data During the 2000 Tax Filing Season
paragraphs: Computer access controls are key to ensuring that only authorized  individuals gain access to sensitive and critical agency data. They include a  variety of tools, such as telecommunications and network control devices,  including secure dial-in and firewalls, which can be used to prevent or  limit inappropriate access to information system resources; passwords,  intended to authenticate authorized users; and encryption, which can be  used to keep the contents of a message or data file confidential if security is  breached.
IRS did not adequately safeguard tax return data on e-file computers. Our  tests, conducted in May 2000, showed that access controls over IRS’  electronic filing systems were not effective in adequately reducing the risk  of intrusions and misuse of electronically filed taxpayer data. We  demonstrated that unauthorized individuals, both internal and external to  IRS, could have viewed and modified electronically filed taxpayer data on  IRS computers. For example, we were able to access a key electronic filing  system using a common handheld computer.
We identified weaknesses that, if exploited during the 2000 tax filing  season, could have allowed unauthorized individuals to have viewed,  copied, or modified files containing electronically filed tax return data  before they were sent to the IRS mainframe computer for further  processing and to have viewed, altered, deleted, or redirected network  traffic. In summary, during the 2000 tax filing season,   IRS did not effectively restrict external access to its computers  supporting the e-file program. A firewall and similar perimeter defenses  are an organization’s first line of defense against outside intrusion.  However, IRS had not installed effective perimeter defenses to protect  its e-file computers.
IRS did not securely configure the operating system on its e-file  computers. We demonstrated, for example, that the operating system  permitted the use of several risky and unnecessary services that could  have aided an intrusion attempt.
IRS did not implement adequate password management and user  account practices on its e-file computers. We identified serious  weaknesses in IRS’ controls over the confidentiality and complexity of  its passwords and in the administration of its user accounts. For  example, we were able to guess many passwords based on our  knowledge of commonly used passwords. We also found user-IDs and  passwords that were posted in clear view on a monitor in an unsecured  area at one IRS data processing facility. Poor password management  and user account practices increased the risk that unauthorized  individuals could determine password and user account combinations  to gain unauthorized access to IRS e-file systems.
IRS did not sufficiently restrict access to computer files and directories  containing tax return and other system data. We determined that certain  e-file system users with no need for access to electronically filed tax  return data could have viewed and modified that data, contrary to IRS’  “need to know” policy. In addition, we determined that all system users  had the capability to modify numerous files on e-file computers,  including sensitive data and system files, leaving those files much more  susceptible to inadvertent or deliberate unauthorized modification.
IRS did not encrypt tax return data while the data were stored on e-file  computers. The Internal Revenue Manual requires that cryptography be  used for protecting information systems from the threat of intruders  gaining access by way of remote telephone systems, a threat applicable  to e-file computers.
subsections: section_title: Intruders Could Have Accessed Other IRS Systems
paragraphs: IRS did not ensure the protection of sensitive business, financial, and  taxpayer data on other critical systems in its servicewide network during  the 2000 tax filing season. Weak controls over internal IRS networks could  have allowed intruders to use e-file computers to gain unauthorized access  to other IRS systems. Certain network control devices—largely intended to  protect other internal IRS computer systems from unauthorized access— were not effectively configured or deployed to prevent such intrusions. For  example, IRS personnel “turned off” (bypassed) the network control  devices in order to speed up the processing of electronic tax returns.  However, these actions exposed other systems attached to IRS’ wide area  network to unauthorized access. Along with the results of our computer  control reviews at several IRS facilities, we determined that control  weaknesses over other IRS networks and systems increased the risk of  successful intrusions into those other systems.
section_title: IRS Procedures for Detecting Intrusions Were Inadequate
paragraphs: Even strong controls may not block all intrusions and misuse, but  organizations can reduce the risks associated with such events if they take  steps to promptly detect intrusions and misuse before significant damage  can be done. Documenting and analyzing security problems and incidents  are effective ways for organizations to gain a better understanding of  threats to their information and operations and of the costs of their  security-related problems. Such analyses can pinpoint vulnerabilities that  need to be addressed to help reduce the risk of similar intrusions and  misuse.
While IRS stated that it did not have evidence that intruders accessed or  modified taxpayer data on its e-file systems, its capabilities for detecting  intrusions and misuse resulting from the exploitation of vulnerabilities on  e-file systems during the 2000 tax filing season were not adequate. IRS did  not record certain key events in system audit logs, did not regularly review  those logs for unusual or suspicious events or patterns, and had not  deployed software to facilitate the detection and analysis of logged events.  For example, IRS did not recognize or record much of the activity  associated with our test activities.
section_title: IRS Did Not Ensure Ongoing Security of E-File Systems
paragraphs: These serious access control weaknesses existed because IRS had not  taken adequate steps during the 2000 tax filing season to ensure the  ongoing security of electronically transmitted tax return data on its e-file  systems. For example, IRS had not followed or fully implemented several  of its own information security policies and guidelines when it developed  and implemented controls over its electronic filing systems. It decided to  implement and operate its e-file computers before completing all of the  security requirements for certification and accreditation. Also, IRS had  not fully implemented a continuing program for assessing risk and  monitoring the effectiveness of security controls over its electronic filing  systems.
section_title: IRS Acted to Correct E-File Access Control Weaknesses Prior to the 2001 Tax Filing Season
paragraphs: IRS’ senior management moved promptly to address the access control  weaknesses related to electronic filing. In meetings with senior IRS  management and technical staff, we alerted IRS to significant security  vulnerabilities identified by our testing that warranted immediate  remediation. This interaction was productive. IRS developed corrective  action plans that identified the specific actions required to improve the  security over e-file computers and IRS internal networks.
According to IRS officials, they have completed most of the planned  improvements, including correction of the critical vulnerabilities, in time  for the 2001 tax filing season. IRS officials stated that they have revamped  the e-file system architecture, installed effective perimeter defenses,  improved their configuration management practices, strengthened  password controls, reconfigured the operating systems of e-file systems,  established a process to identify excessive file permissions, added  intrusion-detection capability, and made certain management changes. IRS  stated that its actions demonstrate that it has taken a systematic, risk- based approach to correcting these weaknesses. Such an approach is  important in helping to ensure that improvement efforts are effective and  appropriate. It is also important that these actions to strengthen technical  controls be supported by improvements in the way IRS continually  manages information security. As part of our normal follow-up review of  IRS’ implementation of the recommendations contained in this report, we  will test the effectiveness of IRS’ recent improvement actions.
section_title: Other Opportunities to Strengthen the Reliability of Electronically Filed Taxpayer Data Exist
paragraphs: Application controls should be designed and implemented to help ensure  the reliability of data processed by the application. Such controls help  make certain that transactions are valid, properly authorized, and  completely and accurately processed. IRS believes that electronically filed  tax returns are more accurate than paper returns for several reasons. For  example, commercial software used by taxpayers to prepare electronic  returns contains mathematical formulas and edit routines that can help to  reduce computational errors on returns. Electronic returns also eliminate  the data entry errors associated with typing paper return data into IRS’ tax  processing systems. In addition, IRS has implemented many application  controls that were designed to enhance the reliability of data processed by  e-file computers. However, we identified additional opportunities to  strengthen application controls for IRS’ processing of electronic tax return  data. These opportunities are discussed below.
subsections: section_title: IRS Paid Refunds Claimed on Unauthenticated Electronic Returns
paragraphs: A key control relating to the authenticity and accuracy of a tax return is the  taxpayer’s signature and certification that the return is true, correct, and  complete to the best of the taxpayer’s knowledge and belief. IRS  requirements state that taxpayers who file tax Form 1040 electronically  must submit this signature and certification to IRS on Form 8453. Certain  taxpayers participating in an IRS pilot program may use an IRS-provided  personal identification number to authenticate their electronically filed  return in lieu of submitting Form 8453.
IRS processed electronic tax returns and paid refunds even when it did not  receive a signed Form 8453 or when a personal identification number was  not used to authenticate the return. This practice is inconsistent with the  IRS practice of withholding payments for refunds claimed on unsigned  paper returns. Agency statistics through August 24, 2000, showed that IRS  did not receive Forms 8453 for almost 1.2 million—about 3 percent—of tax  returns filed electronically during the 2000 tax filing season and that about  93 percent of electronically filed returns were entitled to a refund or had no  balance due. According to IRS, the average refund issued for the 1999 tax  filing season for on-line filers was $2,041, and for practitioner-prepared  electronic returns, $1,910. Based on these statistics, IRS paid refunds of  about $2.1 billion on electronic tax returns that were not authenticated by  taxpayers as of August 24, 2000. Further, according to agency criminal  investigators, the absence of a signed Form 8453 may preclude perjury  prosecutions against taxpayers who provide false information on  electronic tax returns. Unless electronic returns are supported with a  signed Form 8453 or a personal identification number before paying  claimed refunds, IRS is vulnerable to paying improper refunds based on  unauthenticated electronically filed tax returns.
section_title: Certain Data Validation and Editing Controls Could Be Improved
paragraphs: Another control activity involves identifying erroneous data at the point  that it enters the application system, or at some later point in the  processing cycle. This is accomplished through a process called data  validation and editing. Programmed validation and edit checks are key to  this process and are generally performed on transaction data entering the  system (before the master files are updated) and on data resulting from  processing.
We identified several instances in which an e-file system did not detect  erroneous or invalid data in our test transactions. For example, an e-file  system did not detect several arithmetical errors and inconsistent data or  amounts between related data fields on the Form 1040 and the  attachments. As a result, there was an increased risk that IRS did not detect  certain erroneous or inconsistent data on electronically filed tax returns.
section_title: Software Development Controls Could Be Improved
paragraphs: An essential control for ensuring the integrity of a computer application is  to prevent software programmers and developers from having access to the  application in the production environment. Denying such access to  software programmers and developers can help to reduce the risk of  unauthorized changes to production programs and data.
However, a software developer was capable of viewing and modifying  taxpayer data on production e-file computers during the 2000 tax filing  season. In addition, software development tools were installed on those  computers. As a result, there was an increased risk last year that the  software developer could have introduced unauthorized programs, made  unauthorized changes to production programs, and viewed or modified  electronically filed taxpayer data on e-file computers.
section_title: Taxpayers May Not Be Aware of Privacy Considerations in Filing Electronic Returns
paragraphs: Taxpayers who electronically file tax returns may not have been aware that  transmitters could view and modify taxpayers’ electronic tax return data  and that such data are transmitted to IRS in clear text. Transmitters have  this level of access because IRS decided (1) not to allow taxpayers to file  most electronic returns directly with IRS, (2) to require taxpayers who  elect to file electronically to use the services of third-party transmitter, and  (3) not to accept electronic tax returns in encrypted form. Also, taxpayers  may not have been aware of other risks related to electronic filing.
Links provided on the IRS Web site to certain IRS trading partners  emphasized the use of state-of-the-art encryption when electronic filers  send tax information over the Internet to IRS trading partners, but these  links did not disclose that the trading-partner-to-IRS portion of the data  transfer was sent in clear text. Thus, taxpayers who prepared their  electronic tax returns and sent the returns in an encrypted form to a  transmitter for transmission to IRS may not have known that the  transmitter could have viewed, modified, or copied their tax returns, or  that their returns were transmitted to IRS in clear text. Similarly, taxpayers  who used the services of an electronic return originator to prepare their  electronic returns may not have realized that their returns were sent to IRS  in clear text or that the electronic return originator may have sent their  returns to a transmitter for transmission to IRS. As a result, taxpayers may  not have been fully informed as to which businesses and individuals could  have viewed, modified, and copied the personal and financial data  contained on their electronically filed tax returns.
IRS did not adequately inform taxpayers of other risks related to filing  electronic tax returns. Although IRS noted that it did not endorse the  products, services, or privacy or security policies of its electronic filing  trading partners, IRS asserted in promotional materials on e-file that the  security and privacy of tax return data filed electronically was “assured.”  However, the security and privacy of such data were subject, in part, to the  (1) effectiveness of the transmitters’ security controls over their computing  environments and (2) character of the transmitters’ employees who had  access to the taxpayer data. IRS had no assurance about the security of  transmitter systems that contained or transmitted tax return data to IRS’s e- file systems, including whether users of such systems were properly  authorized, and had only limited assurance about the character or  background of the transmitters.
Other than providing guidance about protecting certain passwords, IRS did  not prescribe minimum computer security requirements for transmitters  and did not assess or require an independent assessment of the  effectiveness of computer controls within the transmitters’ operating  environment. IRS monitored transmitters for compliance with the  applicable revenue procedure and e-file program requirements. According  to IRS, monitoring may have included reviewing e-file submissions,  investigating complaints, scrutinizing advertising material, visiting offices,  examining files, observing office procedures, and conducting annual  suitability checks. However, IRS did not assess computer security over  transmitters’ computer systems as part of its monitoring efforts.
In addition, although IRS stated it performed an annual suitability check of  its trading partners, including e-file transmitters, most were not subjected  to criminal background or fingerprint checks. The Treasury Inspector  General for Tax Administration reported in September 1999 that although  IRS improved the 1998 suitability screening process, the overall process  was not completely successful in preventing inappropriate e-file trading  partners from participating in the e-file program. For example, IRS had  approved individuals to be e-file trading partners who had unpaid tax  liabilities, filed tax returns late, filed false tax returns, or had been assessed  Trust Fund Recovery penalties. Importantly, however, transmitters and  electronic return originators may be subject to criminal or civil penalties if  they improperly disclose or misuse tax return information.
section_title: Conclusions
paragraphs: A number of serious control weaknesses in IRS’ electronic filing systems  placed personal taxpayer data in IRS’ electronic filing systems at significant  risk of unauthorized disclosure, use, and modification during last year’s tax  filing season. IRS recognized the importance of promptly addressing these  weaknesses and stated that it has taken steps to correct them prior to the  current tax filing season. Ensuring that ongoing controls over electronic  filing are effective requires top-management support and leadership,  disciplined processes, and consistent oversight. IRS’ efforts to achieve the  goal that 80 percent of all tax and information returns be filed  electronically by 2007 must be balanced with the need to adequately ensure  the security, privacy, and reliability of taxpayer and other sensitive  information. Failure to maintain adequate security over IRS’ electronic  filing systems could erode public confidence in electronically filing tax  returns, jeopardize IRS’ ability to meet the 80 percent goal, and deprive IRS  of the many benefits that electronic filing offers.
section_title: Recommendations for Executive Action
paragraphs: The following recommendations are based on information security  weaknesses identified during last year’s 2000 tax filing season. As noted in  this report, IRS has acted to correct critical weaknesses prior to the 2001  tax filing season. We will assess the effectiveness of these corrective  actions as part of our normal follow-up review.
We recommend that the IRS Commissioner direct the Chief Information  Officer to complete efforts to implement an action plan for strengthening  access controls over IRS electronic filing systems and networks. To assist  in this effort, we have provided technical recommendations that addressed  specific access control weaknesses that IRS should address as part of its  efforts. Because of the significance of the electronic filing systems to the  future operations of IRS, we also recommend that the Chief Information  Officer periodically report to the Commissioner on progress made to  implement this action plan and on the results of efforts to continually  monitor the risks and effectiveness of security controls over IRS electronic  filing systems and electronically filed taxpayer data.
We also recommend that the IRS Commissioner direct the Chief  Information Officer to  complete actions required for the certification and accreditation of an  fully implement procedures to assess risks and monitor the  effectiveness of security controls over IRS’ electronic filing systems on  an ongoing basis;   enhance the edit and data validation routines in an e-file system to  detect erroneous or invalid data on electronically filed tax returns; and  improve the integrity of the e-file production environment by   removing software development tools from the production  environment, if feasible, or restricting access to the tools to the  minimum number of users who require it and  disallowing developers access to production environments and  taxpayer data.
We recommend that the Commissioner direct the Director of Submission  Processing to implement an alternative means for taxpayers to  authenticate electronically filed returns or to strengthen procedures for  receiving signed Forms 8453 for electronically filed tax returns.
We recommend that the Commissioner direct the Director of Electronic  Tax Administration to provide notice to taxpayers concerning (1) transmitter access to electronic tax return data in clear text and  (2) electronic transmission of tax returns to IRS in clear text.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, the Commissioner of Internal  Revenue stated that the report accurately identified areas that needed  strengthening during last year’s filing season and that IRS initiated timely  actions to strengthen important security controls when the audit findings  were brought to its attention. He further indicated that IRS has completed  actions for correcting all of the critical access control vulnerabilities we  identified and for certifying the systems. As a result, the Commissioner  stated, the electronic filing systems now satisfactorily meet critical federal  information security requirements to provide strong controls to protect  taxpayer data and that taxpayers can feel safe and secure using e-file  during the 2001 filing season. The Commissioner added that the report’s  findings and GAO’s assistance have been instrumental in supporting IRS’  continuing efforts to improve its computer security capabilities.
The Commissioner’s written response indicated that it has taken or will  take appropriate steps to implement eight of our nine recommendations.  IRS’ Director of Security Evaluation and Oversight stated orally that IRS  has taken corrective action to resolve the final recommendation. We will  assess the effectiveness of IRS’ corrective actions as part of our normal  follow-up review on recommendations.
In addition to responding to our recommendations, the IRS Commissioner  provided additional comments about IRS’ security program, our report, and  other controls over electronic filing. We addressed these comments in  appendix II.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we will not distribute it until 30 days from the date of  this letter. At that time, we will send copies to Senator Joseph Lieberman  and other interested congressional committees. We will also send copies of  this report to the Honorable Paul H. O’Neill, Secretary of the Treasury; the  Honorable Charles O. Rossotti, Commissioner of Internal Revenue; and the  Honorable Mitchell E. Daniels, Jr., Director of the Office of Management  and Budget. Copies will be made available to others upon request.
If you have questions about this report, please contact me at (202) 512-3317  or by e-mail at DaceyR@gao.gov. Key contributors to this assignment were  West Coile, Hal Lewis, Karlin Richardson, and Gregory Wilshusen, (202)  512-6244, WilshusenG@gao.gov.
section_title: Objectives, Scope, and Methodology
paragraphs: Our objective was to assess the effectiveness of key computer controls that  were designed to ensure the security, privacy, and reliability of IRS’  electronic filing systems and electronically filed taxpayer data. To  accomplish our objective, we applied appropriate sections of our Federal  Information System Controls Audit Manual (GAO/AIMD-12.19.6), which  describes our methodology for reviewing information system controls that  affect the confidentiality, integrity, and availability of computerized data.
To assess the security over IRS’ electronic filing systems and privacy of  electronically filed taxpayer data, we tested the effectiveness of key  computer access controls over electronic filing systems, reviewed IRS  policies and procedures, researched prior reports by IRS’ Internal Audit  and the Treasury Inspector General for Tax Administration, interviewed  system administrators and program officials, assessed the design and  architecture of e-file systems, and examined the operating system  configuration and control implementation for electronic filing systems’  host computers and network servers, routers, and control devices. In  addition, we attempted to exploit identified control weaknesses to verify  the vulnerabilities they presented. We also met with officials at IRS national  offices to discuss the possible reasons for the vulnerabilities we identified  and their plans for future improvement.
To assess the reliability of electronically filed tax return data processed by  e-file systems, we examined controls designed to ensure that electronically  filed tax return data were valid, properly authorized, and accurately and  completely processed. In addition, we reviewed IRS policy and procedures;  examined application system documentation; interviewed system and  security administrators, users, and officials at selected IRS facilities;  observed procedures and controls in place; examined transaction source  documents and control documents; processed test transactions and  assessed results; and inspected application logs and reports. We also  assessed IRS’ information system general controls and their impact on  these applications.
We performed our review at several IRS facilities and at our headquarters  in Washington, D.C., at various times from July 1999 through August 2000,  in accordance with generally accepted government auditing standards and  our Federal Information System Controls Audit Manual.
section_title: Comments From the Internal Revenue Service
subsections: section_title: GAO Comments
paragraphs: 1. We have previously reported that although IRS has made significant  strides in improving computer security at certain facilities, an effective  computer security management program had not yet been fully  implemented across the service.  2. We agree that the report does not focus on the likelihood of the threats  occurring and focuses on the risks associated with the threats.  However, we do not believe the report’s message unreasonably  promotes undue concern about the risks associated with electronic  filing. In our view, we are presenting the facts about certain risks that  accompany electronic filing−risks that may or may not be present in  paper filing, and risks that the public is entitled to know. Because of its  role as the nation’s tax collector, IRS’ computer systems may be a target  for certain individuals or groups. Our tests, which successfully  identified and exploited weaknesses in IRS’ e-file computers, were not  sophisticated. It is important to note that IRS immediately recognized  the seriousness of the weaknesses we identified and said it has taken  prompt action to correct all of the critical vulnerabilities.  3. We neither state nor imply that sending data unencrypted over public  switched networks is an unacceptable risk. However, we continue to  believe that the risk of unauthorized disclosure is greater when  electronic tax returns are transmitted in clear text than in encrypted  text. It is important to note that IRS regulations require encryption and  secure dial-in for remote access from the public switched telephone  network to any IRS system that contains sensitive data.  4. As noted in the report, although IRS did not have evidence that  intruders accessed or modified taxpayer data on its e-file systems, its  capabilities for detecting intrusions and misuse resulting from the  exploitation of vulnerabilities on e-file systems during the 2000 tax  filing season were not adequate. 5. The Treasury Inspector General for Tax Administration reported in  September 1999 that although IRS improved the 1998 suitability  screening process, the overall process was not completely successful in  preventing inappropriate e-file trading partners from participating in  the e-file program.  6. We recognize in the report that IRS performs annual suitability checks  and monitors its trading partners. However, we continue to believe that  taxpayers have a right to know that IRS does not subject most of its  trading partners to criminal background or fingerprint checks and does  not assess computer security over transmitters’ computer systems as  part of its monitoring efforts. 7. We do not believe that “total assurance” is necessary, only full  disclosure. At the time IRS asserted on its Web page that taxpayers’  “privacy and security are assured,” we identified serious access control  weaknesses over IRS electronic filing systems that could have allowed  unauthorized individuals to view and modify taxpayer data. Further,  IRS had no assurance about the effectiveness of computer controls  within the transmitters’ operating environments—environments that  affect the privacy and security of electronically filed tax return data. We  believe that IRS should inform taxpayers of the risks as well as the  benefits of filing electronic tax returns so they can make informed  decisions on the tax filing method that is appropriate for them.
section_title: Ordering Information
paragraphs: The first copy of each GAO report is free. Additional copies of  reports are $2 each. A check or money order should be made out to  the Superintendent of Documents. VISA and MasterCard credit  cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are  discounted 25 percent.
Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Orders by visiting: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders by phone: (202) 512-6000 fax: (202) 512-6061 TDD (202) 512-2537 Each day, GAO issues a list of newly available reports and  testimony. To receive facsimile copies of the daily list or any list  from the past 30 days, please call (202) 512-6000 using a touchtone  phone. A recorded menu will provide information on how to obtain  these lists.
section_title: To Report Fraud, Waste, or Abuse in Federal Programs
paragraphs: Web site: http://www.gao.gov/fraudnet/fraudnet.htm  e-mail: fraudnet@gao.gov  1-800-424-5454 (automated answering system)