Information security is an important consideration for any organization that depends on information systems and computer networks to carry out its mission or business. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. However, without proper safeguards, these developments pose enormous risks that make it easier for individuals and groups with malicious intent to intrude into inadequately protected systems and use such access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer networks and systems. Further, the number of individuals with computer skills is increasing, and intrusion, or hacking, techniques are readily available and relatively easy to use. The rash of cyber attacks launched in February 2000 against major U.S. firms illustrates the risks associated with this new electronic age. Computer-supported federal operations are also at risk. Our previous reports, and those of agency inspectors general, describe persistent computer security weaknesses that place a variety of critical federal operations, including those at IRS, at risk of disruption, fraud, and inappropriate disclosure. This body of audit evidence led us, in 1997 and again in 1999 reports to the Congress, to designate computer security as a governmentwide high-risk area. It remains so today. How well federal agencies are addressing these risks is a topic of increasing interest in both the Congress and the executive branch. This is evidenced by recent hearings on information security, recent legislation intended to strengthen information security, and the President’s January 2000 National Plan for Information Systems Protection. As outlined in this plan, a number of new, centrally managed entities have been established and projects initiated to assist agencies in strengthening their security programs and improving federal intrusion-detection capabilities. In its role as the nation’s tax collector, IRS has a demanding responsibility in collecting taxes, processing tax returns, and enforcing the nation’s tax laws. IRS processes more than 150 million tax returns, accounts for approximately $1.9 trillion in collections, and pays about $185 billion in refunds to taxpayers annually. To efficiently fulfill its tax processing responsibilities, IRS places extensive reliance on interconnected computer systems to perform various functions, such as collecting and storing taxpayer data, processing tax returns, calculating interest and penalties, generating refunds, and providing customer service. Due to the nature of its mission, IRS collects and maintains a significant amount of personal and financial data on each American taxpayer. These data typically include the taxpayer’s name, address, social security number, dependents, income, source of certain types of income, and certain deductions and expenses. The confidentiality of this sensitive information is important because American taxpayers could be exposed to a loss of privacy and to financial loss and damages resulting from identity theft and financial crimes should this information be disclosed to unauthorized individuals. IRS’ e-file program offers taxpayers an alternative to filing traditional paper returns. With e-file, a taxpayer may file an electronic tax return (1) through a tax professional who is also an authorized IRS e-file provider, (2) through a personal computer to an e-file transmitter, or (3) over the telephone. The e-file program is beneficial because IRS receives tax and information returns in electronic form and does not have to manually enter data into its computer systems as it does with paper returns. IRS has asserted that data on electronic tax returns cost less to process and are more accurate than on paper returns, taxpayers receive refunds faster, and taxpayer privacy and security are assured. The number of individuals filing returns electronically is increasing. During 2000, IRS reported that over 35 million individual taxpayers, about 20 percent more than the previous year, filed their returns electronically. The number of e-file individual returns represented about 28 percent of all individual returns projected to be filed during 2000. The IRS Restructuring and Reform Act of 1998 established a goal that 80 percent of all tax and information returns be filed electronically by 2007. In an attempt to meet this goal, IRS has aggressively marketed the e-file program and has authorized private firms and individuals to be its e-file trading partners. These partners include electronic return originators, who prepare electronic tax returns for taxpayers, and transmitters, who transmit the electronic portion of a return directly to IRS. Except for taxpayers who file electronic returns using telephones, IRS does not allow individual taxpayers to transmit their electronic tax returns directly to the agency. Electronic filers must use the services of an IRS trading partner. The Director, Electronic Tax Administration, is responsible for overseeing IRS’ electronic tax programs, including e-file, and for improving taxpayer awareness of electronic tax administration products and services. The Chief Information Officer has overall responsibility for developing, operating, and securing IRS information systems including those used for electronic filing. The Director, Submission Processing, is responsible for processing electronically filed tax returns. Computer access controls are key to ensuring that only authorized individuals gain access to sensitive and critical agency data. They include a variety of tools, such as telecommunications and network control devices, including secure dial-in and firewalls, which can be used to prevent or limit inappropriate access to information system resources; passwords, intended to authenticate authorized users; and encryption, which can be used to keep the contents of a message or data file confidential if security is breached. IRS did not adequately safeguard tax return data on e-file computers. Our tests, conducted in May 2000, showed that access controls over IRS’ electronic filing systems were not effective in adequately reducing the risk of intrusions and misuse of electronically filed taxpayer data. We demonstrated that unauthorized individuals, both internal and external to IRS, could have viewed and modified electronically filed taxpayer data on IRS computers. For example, we were able to access a key electronic filing system using a common handheld computer. We identified weaknesses that, if exploited during the 2000 tax filing season, could have allowed unauthorized individuals to have viewed, copied, or modified files containing electronically filed tax return data before they were sent to the IRS mainframe computer for further processing and to have viewed, altered, deleted, or redirected network traffic. In summary, during the 2000 tax filing season, IRS did not effectively restrict external access to its computers supporting the e-file program. A firewall and similar perimeter defenses are an organization’s first line of defense against outside intrusion. However, IRS had not installed effective perimeter defenses to protect its e-file computers. IRS did not securely configure the operating system on its e-file computers. We demonstrated, for example, that the operating system permitted the use of several risky and unnecessary services that could have aided an intrusion attempt. IRS did not implement adequate password management and user account practices on its e-file computers. We identified serious weaknesses in IRS’ controls over the confidentiality and complexity of its passwords and in the administration of its user accounts. For example, we were able to guess many passwords based on our knowledge of commonly used passwords. We also found user-IDs and passwords that were posted in clear view on a monitor in an unsecured area at one IRS data processing facility. Poor password management and user account practices increased the risk that unauthorized individuals could determine password and user account combinations to gain unauthorized access to IRS e-file systems. IRS did not sufficiently restrict access to computer files and directories containing tax return and other system data. We determined that certain e-file system users with no need for access to electronically filed tax return data could have viewed and modified that data, contrary to IRS’ “need to know” policy. In addition, we determined that all system users had the capability to modify numerous files on e-file computers, including sensitive data and system files, leaving those files much more susceptible to inadvertent or deliberate unauthorized modification. IRS did not encrypt tax return data while the data were stored on e-file computers. The Internal Revenue Manual requires that cryptography be used for protecting information systems from the threat of intruders gaining access by way of remote telephone systems, a threat applicable to e-file computers. IRS did not ensure the protection of sensitive business, financial, and taxpayer data on other critical systems in its servicewide network during the 2000 tax filing season. Weak controls over internal IRS networks could have allowed intruders to use e-file computers to gain unauthorized access to other IRS systems. Certain network control devices—largely intended to protect other internal IRS computer systems from unauthorized access— were not effectively configured or deployed to prevent such intrusions. For example, IRS personnel “turned off” (bypassed) the network control devices in order to speed up the processing of electronic tax returns. However, these actions exposed other systems attached to IRS’ wide area network to unauthorized access. Along with the results of our computer control reviews at several IRS facilities, we determined that control weaknesses over other IRS networks and systems increased the risk of successful intrusions into those other systems. Even strong controls may not block all intrusions and misuse, but organizations can reduce the risks associated with such events if they take steps to promptly detect intrusions and misuse before significant damage can be done. Documenting and analyzing security problems and incidents are effective ways for organizations to gain a better understanding of threats to their information and operations and of the costs of their security-related problems. Such analyses can pinpoint vulnerabilities that need to be addressed to help reduce the risk of similar intrusions and misuse. While IRS stated that it did not have evidence that intruders accessed or modified taxpayer data on its e-file systems, its capabilities for detecting intrusions and misuse resulting from the exploitation of vulnerabilities on e-file systems during the 2000 tax filing season were not adequate. IRS did not record certain key events in system audit logs, did not regularly review those logs for unusual or suspicious events or patterns, and had not deployed software to facilitate the detection and analysis of logged events. For example, IRS did not recognize or record much of the activity associated with our test activities. These serious access control weaknesses existed because IRS had not taken adequate steps during the 2000 tax filing season to ensure the ongoing security of electronically transmitted tax return data on its e-file systems.