This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/world/2015/jun/02/irs-data-breach-senate-hearing-security-upgrades

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
IRS data breach would have been 'much more difficult' with security upgrades IRS data breach would have been 'much more difficult' with security upgrades
(35 minutes later)
The Internal Revenue Service failed to implement dozens of security upgrades that might have prevented the hacking of more than 104,000 US taxpayers, according to J Russell George, treasury inspector general for tax administration, at a Senate committee hearing on Tuesday.The Internal Revenue Service failed to implement dozens of security upgrades that might have prevented the hacking of more than 104,000 US taxpayers, according to J Russell George, treasury inspector general for tax administration, at a Senate committee hearing on Tuesday.
Related: IRS says breach provided hackers with information on 100,000 taxpayersRelated: IRS says breach provided hackers with information on 100,000 taxpayers
“It would have been much more difficult if they had implemented all of the recommendations we made,” George, told the Senate finance committee about the data breach. “It would have been much more difficult if they had implemented all of the recommendations we made,” George told the Senate finance committee about the data breach.
The data breach occurred in Get Transcript, a system set up to make taxpayers’ interactions with the IRS more convenient and allow them to download their tax “transcript” online. The hackers, who attempted to download transcripts from around 200,000 questionable email domains, made about 104,000 successful downloads. To successfully download the transcripts, the hackers must have passed a security screen that asked for required information including a social security number, date of birth, tax filing status and street address.The data breach occurred in Get Transcript, a system set up to make taxpayers’ interactions with the IRS more convenient and allow them to download their tax “transcript” online. The hackers, who attempted to download transcripts from around 200,000 questionable email domains, made about 104,000 successful downloads. To successfully download the transcripts, the hackers must have passed a security screen that asked for required information including a social security number, date of birth, tax filing status and street address.
The hackers must have obtained this information from somewhere other than the IRS, according to the agency’s commissioner, John Koskinen.The hackers must have obtained this information from somewhere other than the IRS, according to the agency’s commissioner, John Koskinen.
The two witnesses, George and Koskinen, present at Tuesday’s hearing took pains to remind lawmakers that cybersecurity is an increasingly complicated challenge. The two witnesses present at Tuesday’s hearing, George and Koskinen, took pains to remind lawmakers that cybersecurity is an increasingly complicated challenge.
“What worked yesterday, what worked a year ago might not be working today, so you continually have to attack that problem,” said Koskinen.“What worked yesterday, what worked a year ago might not be working today, so you continually have to attack that problem,” said Koskinen.
“This incident provides a stark reminder that even security controls that may have been adequate in the past can be overcome by hackers, who are anonymous, persistent and have access to vast amounts of personal data and knowledge,” said George.“This incident provides a stark reminder that even security controls that may have been adequate in the past can be overcome by hackers, who are anonymous, persistent and have access to vast amounts of personal data and knowledge,” said George.
The officials said the IRS needed more resources to tackle escalating hacking issues. “Securing our system and protecting taxpayers’ information is a top priority for the IRS. Even with our constrained resources as a result of cuts to our budget totaling $1.2bn since 2010, we continue to devote significant time and attention to this challenge,” said Koskinen.The officials said the IRS needed more resources to tackle escalating hacking issues. “Securing our system and protecting taxpayers’ information is a top priority for the IRS. Even with our constrained resources as a result of cuts to our budget totaling $1.2bn since 2010, we continue to devote significant time and attention to this challenge,” said Koskinen.
The IRS has struggled to attract the best minds in the technology sector, said Koskinen. “I was just talking to our IT head – we have lost two senior sophisticated IT people because they did not want to go through the normal government process,” Koskinen said during the hearing. Later he explained that the normal hiring process can take three to five months.The IRS has struggled to attract the best minds in the technology sector, said Koskinen. “I was just talking to our IT head – we have lost two senior sophisticated IT people because they did not want to go through the normal government process,” Koskinen said during the hearing. Later he explained that the normal hiring process can take three to five months.
The IRS can currently hire 40 people through a program that allows it to pay more for talent and expedite hiring. But that authority is due to expire, and Koskinen said it is “critical for the small number of people we need who are going to be world-class experts at dealing not only with technology but with security”.The IRS can currently hire 40 people through a program that allows it to pay more for talent and expedite hiring. But that authority is due to expire, and Koskinen said it is “critical for the small number of people we need who are going to be world-class experts at dealing not only with technology but with security”.
Of the 168 positions filled through the program from 1998 to 2013, over half were information technology positions. According to Koskinen, the annual cost of the higher salaries under the program is $400,000 to $500,000 a year, which he said outweighs the costs of potential future data breaches.Of the 168 positions filled through the program from 1998 to 2013, over half were information technology positions. According to Koskinen, the annual cost of the higher salaries under the program is $400,000 to $500,000 a year, which he said outweighs the costs of potential future data breaches.
“The pay increase differential is relatively modest, we only got about three people who have taken advantage of it,” he said.“The pay increase differential is relatively modest, we only got about three people who have taken advantage of it,” he said.
The staffing troubles at the IRS do not stop with its technology department.The staffing troubles at the IRS do not stop with its technology department.
An increased numbers of attacks similar to the recent breach are coming from “criminal syndicates in eastern Europe and Asia”, according to Koskinen. An increased number of attacks similar to the recent breach are coming from “criminal syndicates in eastern Europe and Asia”, according to Koskinen.
“We have 300 fewer criminal investigators than we had four or five years ago,” he pointed out. In February, IRS had 2,402 investigators, 63 fewer than in September 2014. The year prior, the number of investigators had shrunk by 3%. “Expedition, finding and tracking those people down, is much more difficult. And as a general matter, we don’t get a lot of cooperation [from the foreign governments].” “We have 300 fewer criminal investigators than we had four or five years ago,” he pointed out. In February, the IRS had 2,402 investigators, 63 fewer than in September 2014. The year prior, the number of investigators had shrunk by 3%. “Expedition, finding and tracking those people down, is much more difficult. And as a general matter, we don’t get a lot of cooperation [from the foreign governments].”
Related: The $42 phone call: IRS budget cuts mean half of taxpayers will be ignoredRelated: The $42 phone call: IRS budget cuts mean half of taxpayers will be ignored
Addressing reports that the recent data breach was orchestrated by hackers residing in Russia, George said: “I want to make clear: that’s not the case. It’s beyond Russia.” When prompted to clarify, he continued: “The domains are located in nations other than Russia, in addition to Russia.” He did say that the investigation pinpointed some countries where unauthorized access of transcript data came from, but because of the ongoing investigation he would not disclose them publicly.Addressing reports that the recent data breach was orchestrated by hackers residing in Russia, George said: “I want to make clear: that’s not the case. It’s beyond Russia.” When prompted to clarify, he continued: “The domains are located in nations other than Russia, in addition to Russia.” He did say that the investigation pinpointed some countries where unauthorized access of transcript data came from, but because of the ongoing investigation he would not disclose them publicly.
Despite the many bipartisan pledges to assist the IRS with preventing future cyber-attacks, a dislike for the agency was felt throughout the hearing.Despite the many bipartisan pledges to assist the IRS with preventing future cyber-attacks, a dislike for the agency was felt throughout the hearing.
Georgia senator Johnny Isakson pointed out that his tax information includes details about how much money he makes, what church he goes to and gives money to, his stocks and bonds, and how much he owes on his house.Georgia senator Johnny Isakson pointed out that his tax information includes details about how much money he makes, what church he goes to and gives money to, his stocks and bonds, and how much he owes on his house.
“I just want to put things in perspective,” he said. “That information is a lot more private, a lot more personal ... and much more dangerous to the average American citizen than whatever the NSA ever does, and they are looking out for our physical safety. I just had to make that statement.”“I just want to put things in perspective,” he said. “That information is a lot more private, a lot more personal ... and much more dangerous to the average American citizen than whatever the NSA ever does, and they are looking out for our physical safety. I just had to make that statement.”
According to South Carolina senator Tim Scott, his constituents are “incredibly concerned about the IRS”.According to South Carolina senator Tim Scott, his constituents are “incredibly concerned about the IRS”.
“This breach will only add more fire to people who are absolutely petrified by the IRS,” he said. “And now having their information exposed to criminal elements, criminal cartels, is even more disconcerning.”“This breach will only add more fire to people who are absolutely petrified by the IRS,” he said. “And now having their information exposed to criminal elements, criminal cartels, is even more disconcerning.”
“No one at the IRS is under any illusion that we are not at risk,” Koskinen told him.“No one at the IRS is under any illusion that we are not at risk,” Koskinen told him.
“This is a federal, state, local, global problem. And I don’t see it ending anytime soon,” George said in the final moments of the hearing. “Just as soon as IRS increases their security posture, the bad guys will increase their efforts to overcome those.”“This is a federal, state, local, global problem. And I don’t see it ending anytime soon,” George said in the final moments of the hearing. “Just as soon as IRS increases their security posture, the bad guys will increase their efforts to overcome those.”
“’There is no magic silver bullet that tomorrow morning is going to put this all to an end,” said Koskinen. “We need to continue to be diligent, we need to continue to do everything that we can with our systems, with our security, with our monitoring of it.”“’There is no magic silver bullet that tomorrow morning is going to put this all to an end,” said Koskinen. “We need to continue to be diligent, we need to continue to do everything that we can with our systems, with our security, with our monitoring of it.”