Prior GAO Work on IRS Computer Security

Over the past 3 years, we testified and reported numerous times on serious weaknesses with security and other internal controls used to safeguard IRS computer systems and facilities. The unauthorized electronic access of taxpayer data by IRS employees— commonly referred to as browsing—has been a longstanding problem for the Service. During our five on-site reviews, we found numerous weaknesses in the following eight functional areas: physical security, logical security, data communications management, risk analysis, quality assurance, internal audit and security, security awareness, and contingency planning.Primary weaknesses were in the areas of physical and logical security. The following are examples of these weaknesses:
Collectively, the five facilities could not account for approximately 6,400 units of magnetic storage media, such as tapes and cartridges, which could contain taxpayer data. Printouts containing taxpayer data were left unprotected and unattended in open areas of two facilities where they could be compromised. For example, two of the facilities had not audited operations within the last 5 years. None of the five facilities visited had comprehensive disaster recovery plans. Punishments Assessed for Browsing Not Consistently Publicized to Deter Violations

IRS facilities did not consistently publicize the penalties assessed in browsing cases to deter such behavior. Conclusions

IRS’ current approach to computer security is not effective. Serious weaknesses persist in security controls intended to safeguard IRS computer systems, data, and facilities and expose tax processing operations to the serious risk of disruption and taxpayer data to the risk of unauthorized use, modification, and destruction. Recommendations

Because of the serious and persistent security problems cited in our January 30, 1997, “Limited Official Use” version of this report, we recommended that the Commissioner of Internal Revenue, within 3 months of the date of that report, prepare a plan for (1) correcting all the weaknesses identified at the five facilities we visited, as detailed in the January 30, 1997 report, and (2) identifying and correcting security weaknesses at the other IRS facilities. Objectives, Scope, and Methodology

The objectives of our review were to (1) determine whether IRS is effectively managing computer security and (2) determine whether IRS is effectively addressing employee browsing of electronic taxpayer data.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the Internal Revenue Service's (IRS) computer security, focusing on whether IRS is effectively: (1) managing computer security; and (2) addressing employee browsing of electronic taxpayer data.

What GAO Found

GAO noted that: (1) over the last 3 years, GAO has reported on a number of computer security problems at IRS and has made recommendations for strengthening IRS' computer security management effectiveness; (2) nevertheless, IRS continues to have serious weaknesses in the controls used to safeguard IRS computer systems, facilities, and taxpayer data; (3) GAO's recent on-site reviews of security at five facilities disclosed many weaknesses in the areas of physical security, logical security, data communications management, risk analysis, quality assurance, internal audit and security, security awareness, and contingency planning; (4) for example, the five facilities could not account collectively for approximately 6,400 missing units of magnetic storage media, such as tapes and cartridges, which could contain taxpayer data; (5) in addition, printouts containing taxpayer data were left unprotected and unattended in open areas of two facilities where they could be compromised; (6) also, none of the facilities visited had comprehensive disaster recovery plans, which threaten the facilities' ability to restore operations following emergencies or natural disasters; (7) one area of unauthorized access that has been the focus of considerable attention is electronic browsing of taxpayer data by IRS employees; (8) despite this attention, IRS is still not effectively addressing the problem via thorough employee monitoring, accurate recording of browsing violations, or consistent application and publication of enforcement actions; (9) for example, IRS currently does not monitor all employees with access to automated systems and data for electronic browsing activities; (10) in addition, when instances of browsing are identified, IRS does not consistently investigate them or publicize them to deter others from browsing, and does not consistently punish browsers; (11) until these serious weaknesses are corrected, IRS runs the risk of its tax processing operations being disrupted and taxpayer data being improperly used, modified, or destroyed; and (12) IRS should prepare a plan for correcting the weaknesses at the five facilities GAO visited and for identifying and correcting security weaknesses at other IRS locations.