Small Business Reading Room

Tuesday, April 19, 2005

More on identity theft risk

Russell has been blogging extensively on the risk of identity theft and the actual loss of personal data at ChoicePoint, LexisNexis and HSBC.

Now it turns out the Internal Revenue Service is taking a verbal beating for allowing unauthorized people to review, and even change, income tax data.

According to The Washington Post Online, a congressional report released this week indicates that over 7500 people have access to, and the ability to change, tax and financial crimes records. The GAO reported that 32 of the 53 problems cited in 2002 were fixed, but they identified 39 new flaws in addition to the 21 that were not fixed since the last review.

The usual congressmen are posturing on this report and demanding changes. Of course no changes will be forthcoming.

In a 1997 report the GAO titled "IRS SYSTEMS SECURITY - Tax Processing Operations and Data Still at Risk Due to Serious Weaknesses" The General Accounting Office found serious data handling flaws.

And in a 2001 review of the 2000 tax filing season the GAO again cited the IRS for a serious lack of data security. For example:

IRS did not ensure the protection of sensitive business, financial, and
taxpayer data on other critical systems in its servicewide network during the 2000 tax filing season. Weak controls over internal IRS networks could have allowed intruders to use e-file computers to gain unauthorized access to other IRS systems. Certain network control devices—largely intended to protect other internal IRS computer systems from unauthorized access— were not effectively configured or deployed to prevent such intrusions. For example, IRS personnel “turned off” (bypassed) the network control devices in order to speed up the processing of electronic tax returns.

There appears to be no incentive for the government to keep our personal data secure. After all, the only price to be paid in this case is political. In the case of ChoicePoint, Inc. or LexisNexis, the harmed parties can seek recovery. So in the end, we might feel safer with our personal data in the hands of private enterprise than we do with it in the hands of our own government.

posted by Larry at 9:50 AM - permalink 0 comments

Small Business Reading Room

More on identity theft risk

0 Comments: