Safeguarding taxpayer info

Monday, Oct. 20, 2008 | 2:06 a.m.

Law enforcement authorities warn repeatedly about the evils of identity theft and encourage consumers to take steps that could help them avoid becoming victims of fraud. Sometimes, though, the inadvertent leak of personal information is not the fault of the consumer.

A case in point was the disclosure Thursday by the Treasury Department’s inspector general for tax administration that the Internal Revenue Service knowingly activated two new computer systems with insufficient privacy safeguards. One system, the Customer Account Data Engine, manages all taxpayer accounts. The other system, Account Management Services, is designed to provide faster and improved access by IRS employees to taxpayer accounts.

“The IRS continues to struggle with security vulnerabilities in its modernized systems,” Inspector General J. Russell George said. “In the case of the CADE and AMS the (Internal Revenue) Service was aware of, and even self-identified, these weaknesses. This is very troublesome.”

The IRS said it didn’t believe the deficiencies were significant. But the inspector general found the vulnerabilities increase the risk that an unscrupulous person could gain unauthorized access to taxpayer information and that the computer systems cannot be restored effectively during an emergency.

Taxpayers also will not be happy to learn that these computer systems will end up costing at least $1.7 billion. For that amount of money the IRS could have done a much better job of ensuring that taxpayer data could be adequately safeguarded.

This is not the first time the agency has come under criticism for computer security flaws. As in the past, the IRS said no taxpayer information was compromised and the problems would be corrected. But because of the amount of personal information contained in taxpayer returns, including Social Security numbers and addresses, these security gaps should be addressed with a sense of urgency.

Ultimately, this is an issue that deserves a full airing in Congress. The IRS has repeatedly demonstrated by its actions that it considers the security of taxpayer information a low priority. The time has come for that attitude to change.