    [Senate Hearing 114-580]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 114-580

                         CYBERSECURITY AND PROTECTING
                              TAXPAYER INFORMATION

    =======================================================================

                                    HEARING

                                   before the

                              COMMITTEE ON FINANCE
                              UNITED STATES SENATE

                        ONE HUNDRED FOURTEENTH CONGRESS

                                 SECOND SESSION

                                   __________

                                 APRIL 12, 2016

                                   __________

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                Printed for the use of the Committee on Finance

                                       ______

                             U.S. GOVERNMENT PUBLISHING OFFICE

    24-730-PDF                     WASHINGTON : 2017
    -----------------------------------------------------------------------
      For sale by the Superintendent of Documents, U.S. Government Publishing
      Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
             DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
                              Washington, DC 20402-0001

                              COMMITTEE ON FINANCE

                         ORRIN G. HATCH, Utah, Chairman

    CHUCK GRASSLEY, Iowa                 RON WYDEN, Oregon
    MIKE CRAPO, Idaho                    CHARLES E. SCHUMER, New York
    PAT ROBERTS, Kansas                  DEBBIE STABENOW, Michigan
    MICHAEL B. ENZI, Wyoming             MARIA CANTWELL, Washington
    JOHN CORNYN, Texas                   BILL NELSON, Florida
    JOHN THUNE, South Dakota             ROBERT MENENDEZ, New Jersey
    RICHARD BURR, North Carolina         THOMAS R. CARPER, Delaware
    JOHNNY ISAKSON, Georgia              BENJAMIN L. CARDIN, Maryland
    ROB PORTMAN, Ohio                    SHERROD BROWN, Ohio
    PATRICK J. TOOMEY, Pennsylvania      MICHAEL F. BENNET, Colorado
    DANIEL COATS, Indiana                ROBERT P. CASEY, Jr., Pennsylvania
    DEAN HELLER, Nevada                  MARK R. WARNER, Virginia
    TIM SCOTT, South Carolina

                         Chris Campbell, Staff Director

                  Joshua Sheinkman, Democratic Staff Director

                                      (ii)

                                C O N T E N T S

                                  ----------

                               OPENING STATEMENTS

                                                                       Page
    Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman,
      Committee on Finance...........................................     1
    Wyden, Hon. Ron, a U.S. Senator from Oregon......................     8

                                   WITNESSES

    Koskinen, Hon. John, Commissioner, Internal Revenue Service,
      Washington, DC; accompanied by Terence V. Milholland, Chief
      Technology Officer, Internal Revenue Service, Washington, DC...     2
    George, Hon. J. Russell, Treasury Inspector General for Tax
      Administration, Department of the Treasury, Washington, DC;
      accompanied by Michael E. McKenney, Deputy Inspector General
      for Audit, Treasury Inspector General for Tax Administration,
      Department of the Treasury, Washington, DC.....................     5
    Dodaro, Hon. Gene L., Comptroller General of the United States,
      Government Accountability Office, Washington, DC; accompanied
      by Gregory C. Wilshusen, Director, Information Security Issues,
      Government Accountability Office, Washington, DC...............     7

                   ALPHABETICAL LISTING AND APPENDIX MATERIAL

    Dodaro, Hon. Gene L.:
        Testimony....................................................     7
        Prepared statement...........................................    33
    George, Hon. J. Russell:
        Testimony....................................................     5
        Prepared statement...........................................    43
    Hatch, Hon. Orrin G.:
        Opening statement............................................     1
        Prepared statement...........................................    49
    Koskinen, Hon. John:
        Testimony....................................................     2
        Prepared statement...........................................    50
    Wyden, Hon. Ron:
        Opening statement............................................     8
        Prepared statement...........................................    60

                                 Communication

    Gyamfi, Kwame....................................................    63

                                     (iii)

               CYBERSECURITY AND PROTECTING TAXPAYER INFORMATION

                                  ----------

                            TUESDAY, APRIL 12, 2016

                                           U.S. Senate,
                                          Committee on Finance,
                                                        Washington, DC.
        The hearing was convened, pursuant to notice, at 10:13
    a.m., in room SD-215, Dirksen Senate Office Building, Hon.
    Orrin G. Hatch (chairman of the committee) presiding.
        Present: Senators Grassley, Crapo, Thune, Portman, Coats,
    Heller, Scott, Wyden, Stabenow, Cantwell, Nelson, Carper,
    Cardin, Brown, Bennet, and Casey.
        Also present: Republican Staff: Chris Armstrong, Deputy
    Chief Oversight Counsel; Eric Oman, Senior Policy Advisor for
    Tax and Accounting; and Mark Prater, Deputy Staff Director and
    Chief Tax Counsel. Democratic Staff: David Berick, Chief
    Investigator; Michael Evans, General Counsel; Daniel Goshorn,
    Investigative Counsel; and Tiffany Smith, Senior Tax Counsel.

     OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM
                  UTAH, CHAIRMAN, COMMITTEE ON FINANCE

        The Chairman. The committee will come to order. I will
    mention that Senator Wyden is delayed. He will be here a little
    later. He has asked that I proceed without him, and we will be
    happy to have him participate when he comes.
        Well, good morning. It is a pleasure to welcome everyone to
    today's hearing, which we have entitled, ``Cybersecurity and
    Protecting Taxpayer Information.''
        Now, these are really important issues that the Finance
    Committee has been working on for some time. In June of last
    year, for example, we had a hearing on the theft of Internal
    Revenue Service data affecting taxpayer information. Much has
    happened since that time.
        At the urging of the Finance Committee, the IRS, State
    revenue commissioners, and leaders in the tax return
    preparation industry came together last year to convene a
    Security Summit, which resulted in new information-sharing
    agreements to help identify suspicious activity in the tax
    filing and refund process. We look forward to hearing more
    about that effort today.
        But in the face of this progress, we have also seen
    unprecedented growth in the scope and scale of cyber-attacks
    aimed at stealing personal information and billions of dollars
    from our taxpayers. Last year alone, cyber-criminals obtained
    access to sensitive personal information from several large
    health insurers, exposing tens of millions of Americans to
    potential identity theft. Foreign governments gained access to
    poorly protected Federal Government databases, including a
    treasure trove of information at the Office of Personnel
    Management.
        Today, we will focus on three separate aspects of this
    problem. First, we will consider the ways the IRS authenticates
    taxpayer identities to prevent data thieves from using
    authentication information to gain access to even more
    information about taxpayers or to file false returns and obtain
    refunds under stolen identities.
        Second, we will examine how the IRS uses its resources to
    improve cybersecurity. This will include some discussion about
    the IRS Future State plan, which the agency has developed in
    order to adapt to the realities of the 21st century.
        Third and finally, we will consider the ongoing joint
    efforts of the IRS, State revenue collectors, and private tax
    preparers to see what can be accomplished to better secure
    taxpayer information and protect taxpayers from fraud.
        Taking a look at our witness table, it is clear that this
    is not a typical lineup of witnesses. Challenges to
    cybersecurity require not only smart and persistent leadership
    up at the top, but also technological expertise and up-to-date
    skills down on the ground.
        So today, we not only have with us the heads of the IRS,
    the Government Accountability Office, and the Treasury
    Inspector General for Tax Administration, but we have invited
    subject matter experts on the relevant issues from each of
    those agencies to testify as well.
        That is a total of six witnesses, and I suspect each of
    them will bring unique and important insights to this
    discussion.
        In closing, I will just say that while we are clearly
    making real progress in this area, the challenges are
    continuing to grow and criminals behind this kind of data theft
    are getting more sophisticated and aggressive, seemingly by the
    day, and American taxpayers and their livelihoods are their
    targets.
        In other words, we have a lot of work to do. My hope is
    that we will continue to be able to work on these issues on a
    bipartisan basis in order to do right by the American people.
        Now, with that, I would like to turn it over to Senator
    Wyden, when he gets here, for any opening remarks he might
    have.
        [The prepared statement of Chairman Hatch appears in the
    appendix.]
        The Chairman. Our first witness will be John Koskinen,
    Commissioner of the IRS. We will start with you first, Mr.
    Koskinen, and go from there.

    STATEMENT OF HON. JOHN KOSKINEN, COMMISSIONER, INTERNAL REVENUE
    SERVICE, WASHINGTON, DC; ACCOMPANIED BY TERENCE V. MILHOLLAND,
    CHIEF TECHNOLOGY OFFICER, INTERNAL REVENUE SERVICE, WASHINGTON,
                                   DC

        Commissioner Koskinen. Good morning, Chairman Hatch,
    Ranking Member Wyden, and members of the committee. Thank you
    for the opportunity to discuss the IRS's ongoing efforts in
    regard to cybersecurity and identity theft. As the chairman
    noted, I am delighted to have Terry Milholland, our Chief
    Technology Officer, here with me today for any specific
    technical questions you may have.
        Securing our systems and taxpayer data continues to be a
    top priority for the IRS. Even with our constrained resources,
    we devote significant time and attention to this challenge. We
    work continuously to protect our main computer systems from
    cyber-attack and to safeguard taxpayer information stored in
    our database.
        The systems withstand more than 1 million malicious
    attempts to access them each day. We are also continuing to
    battle the growing problem of stolen identity refund fraud.
    Over the past few years, we have made steady progress in
    protecting against fraudulent refund claims and criminally
    prosecuting those who engage in this crime, but we have found
    the type of criminal we are dealing with has changed.
        The problem used to be random individuals filing a few
    dozen or a few hundred false tax returns at a time. Now, we are
    dealing more and more with organized crime syndicates here and
    in other countries. They are gathering, as the chairman noted,
    almost unimaginable amounts of personal data from sources
    outside the IRS so they can do a better job of impersonating
    taxpayers, evading our return processing filters, and obtaining
    fraudulent refunds.
        To improve our efforts against this complex and evolving
    threat, in March 2015, we joined with leaders of the electronic
    tax industry, the software industry, and the States to create
    the Security Summit group. This is an unprecedented partnership
    that is focused on making the tax filing experience safer and
    more secure for taxpayers in 2016 and beyond.
        Our collaborative efforts have already shown concrete
    results this filing season. For example, Security Summit
    partners have helped us improve our ability to spot potentially
    false returns before they are processed.
        Over the past year, we have seen three examples of what
    identity thieves are capable of and why we cannot let up in
    this fight. In each case, we detected and stopped unauthorized
    attempts to access online services on our website, IRS.gov, by
    criminals masquerading as legitimate taxpayers. One of the
    services targeted was our Get Transcript online application,
    used by taxpayers to quickly obtain a copy of their prior year
    return.
        Another was an online tool to retrieve a lost Identity
    Protection Personal Identification Number, or IP PIN. Taxpayers
    who previously were victims of identity theft use these PINs to
    prove their identity when they file a return.
        The third was a tool that some people use to generate a PIN
    number when they e-file their tax return. In all three cases,
    criminals were trying to use our online tools to help them
    pretend to be legitimate taxpayers and sneak false returns past
    our fraud filters. These incidents, which, unfortunately, in
    the case of the Get Transcript access, resulted in the loss of
    taxpayer information for thousands of taxpayers before the
    applications were disabled, have shown us that improving our
    reaction time to suspicious activity is not enough.
        We need to be able to anticipate the criminals' next moves
    and attempt to stay ahead of them. The ongoing work of the
    Security Summit group will be critical to our success here.
        As we confront the challenge of identity theft, we are also
    working to expand and improve our ability to interact with
    taxpayers online to meet taxpayers' increasing demand for
    digital services. We are aware, however, that in building
    toward this enhanced online experience, we must continuously
    upgrade and improve our ability to verify the identity of
    taxpayers using these services.
        Taxpayers will only use these services if they are
    confident that they are safe and secure. So we are in the
    process of developing a strong, coordinated authentication
    framework. We have a delicate balance to maintain here. We need
    to keep the criminals out while letting the legitimate
    taxpayers in. Our goal is to have the strongest possible
    authentication process for our online services while
    maintaining the ability of taxpayers to access their data and
    use IRS services online.
        Congress can provide critical support by providing adequate
    resources for these efforts. We appreciate the $290 million in
    additional funding for fiscal year 2016, which included funds
    to improve cybersecurity and fight identity theft. Sustaining
    and increasing funding in this area will be critical as we move
    forward.
        Another way Congress helps us is by passing legislative
    proposals to improve tax administration and cybersecurity. One
    of the most important requests we have made is for the
    reauthorization of streamlined critical pay authority, the loss
    of which has made it very difficult, if not impossible, to
    recruit and retain employees with expertise in highly technical
    areas, such as information technology.
        Chairman Hatch, Ranking Member Wyden, and members of the
    committee, this concludes my statement, and Mr. Milholland and
    I would be happy to take your questions.
        [The prepared statement of Commissioner Koskinen appears in
    the appendix.]
        The Chairman. Thank you so much.
        Today's panel is a little bit unorthodox, at least as far
    as our typical hearings in this committee are concerned. In
    order to ensure that we have the most robust discussion
    possible--and I put that discussion into the record--we have
    invited the heads of three vital government offices to testify,
    as well as the subject matter experts in the relevant areas
    from each agency.
        Now, we have heard from the first witness, John Koskinen,
    who has a tremendous reputation and background for the job that
    he is doing.
        Our second witness will be Inspector General J. Russell
    George from the Treasury Inspector General for Tax
    Administration.
        Mr. George was confirmed to his current position in
    November 2004. Prior to that, he served as the Inspector
    General of the Corporation for National and Community Services.
        Mr. George began his career as a prosecutor in the Queens
    County District Attorney's Office in New York, following which
    he served as Assistant General Counsel in the Counsel's Office
    in the White House Office of Management and Budget.
        Mr. George also has served as the Associate Director for
    Policy in the Office of National Service, after which he moved
    to the private sector, where he practiced law at Kramer, Levin,
    Naftalis, Nessen, Kamin, and Frankel.
        Then in 1995, Mr. George returned to Washington, DC to join
    the Committee on Government Reform and Oversight as the Staff
    Director and Chief Counsel of the Government Management,
    Information, and Technology Subcommittee.
        Mr. George received his bachelor of arts degree from Howard
    University and his law degree from Harvard University School of
    Law.
        He will be joined by Deputy Inspector General for Audit,
    Michael McKenney. Mr. McKenney is responsible for providing
    audit oversight of IRS operations related to the preparation
    and processing of tax returns and the issuing of refunds to
    taxpayers.
        Then finally, from the Government Accountability Office, we
    welcome back Comptroller General Gene Dodaro. Mr. Dodaro was
    confirmed as the eighth Comptroller General of the United
    States and head of the U.S. Government Accountability Office in
    December 2010. Mr. Dodaro was confirmed to this position after
    serving as the Acting Comptroller General since March 2008.
    Including these 7 years of dedicated service, Mr. Dodaro has
    served the country for more than 40 years at the GAO. He served
    most recently as the Chief Operating Officer and is also head
    of GAO's Accounting and Information Management Division, where
    he directed the first-ever audit of the comprehensive financial
    statements covering all Federal departments and agencies.
        Mr. Dodaro has also worked closely with Congress in several
    administrations on major management reform initiatives,
    including the 1994 Government Management Reform Act, the
    revised 1995 Paperwork Reduction Act, and the Clinger-Cohen Act
    of 1996.
        He received a bachelor's degree in accounting from Lycoming
    College in Pennsylvania.
        Mr. Dodaro is joined by Information Security Issues
    Director Gregory Wilshusen, who leads cybersecurity and
    privacy-related studies and audits of the Federal Government.
        I want to thank all of you for coming. I know that this is
    an expansive topic, and the more insight and perspective we can
    get, the better off we will be.
        We will hear the witness testimonies in the order that I
    just introduced them.
        Mr. George, we will turn to you at this time.

    STATEMENT OF HON. J. RUSSELL GEORGE, TREASURY INSPECTOR GENERAL
    FOR TAX ADMINISTRATION, DEPARTMENT OF THE TREASURY, WASHINGTON,
       DC; ACCOMPANIED BY MICHAEL E. McKENNEY, DEPUTY INSPECTOR
         GENERAL FOR AUDIT, TREASURY INSPECTOR GENERAL FOR TAX
       ADMINISTRATION, DEPARTMENT OF THE TREASURY, WASHINGTON, DC

        Mr. George. Thank you, Chairman Hatch, members of the
    committee, for the opportunity to testify today on the IRS's
    processes to protect sensitive taxpayer information.
        As you noted, Mr. Chairman, I am joined by the Deputy
    Inspector General for Audit, Michael McKenney.
        Cybersecurity threats against the Federal Government
    continue to grow, and the IRS is a very prime target for
    attacks because of the extensive amount of taxpayer data it
    stores. As such, the security of taxpayer data is one of the
    top concerns facing the IRS.
        TIGTA has identified a number of areas in which the IRS
    could better protect taxpayer data. For example, TIGTA recently
    reported that the IRS is working towards continuous monitoring
    of its overall information security posture. This effort will
    eventually allow the IRS to perform ongoing real-time
    assessments of information security so that it knows when and
    where security vulnerabilities exist.
        We also reported that the IRS needs to fully implement
    unique user identification and authentication that complies
    with the Department of Homeland Security directives. Full
    implementation and integration of personal identity
    verification cards will help to ensure only authorized
    personnel can access computer systems and facilities.
        Further, TIGTA has evaluated the effectiveness of the
    security patch management process. This process is key to
    mitigating the security risks associated with known
    vulnerabilities to computer systems. We found the IRS is still
    working to expand a standard automated process needed to ensure
    that all IRS systems are patched timely and are operating
    securely.
        Web applications that provide online services are
    significantly vulnerable, because even without penetrating
    network security, hackers can and have cleared the
    authentication process to gain access to and steal valuable
    taxpayer information.
        The IRS has established processes and procedures to
    authenticate individuals requesting online access to IRS
    services; however, these processes and procedures do not comply
    with government standards. For example, the processes that the
    IRS used to authenticate users of its Get Transcript and
    Identity Protection Personal Identification Number, IP PIN,
    applications, required only single-factor authentication.
        Government standards require multi-factor authentication
    for such high-risk applications. Moreover, the authentication
    framework used for these applications did not comply with the
    government standards for a single-factor authentication.
        In August 2015, the IRS reported that unauthorized users
    had been successful in obtaining tax information on the Get
    Transcript application for an estimated 334,000 taxpayer
    accounts. To prevent further unauthorized access, the IRS
    removed the application from its website. Unfortunately,
    TIGTA's current review of the Get Transcript breach identified
    additional suspicious accesses to taxpayers' accounts that the
    IRS had not identified.
        Based on TIGTA's analysis, the IRS reported on February
    26th of this year that potentially unauthorized users had been
    successful in obtaining access to an additional 390,000
    taxpayer accounts.
        We also reported in November 2015 that the IRS did not
    complete the required authentication risk assessment for its IP
    PIN application and recommended that the IRS not reactivate
    this application for the 2016 filing season. However, the IRS
    reactivated the application on January 19, 2016.
        We issued a second recommendation to the IRS on February
    24th, advising it to remove the IP PIN application from its
    public website. On March 7th, the IRS reported that it was
    temporarily suspending use of the IP PIN application as part of
    an ongoing security review.
        The IRS does not anticipate having the technology in place
    for either the Get Transcript or IP PIN application to provide
    multi-factor authentication capability before the summer of
    2016.
        The number and sophistication of threats to taxpayer
    information will likely continue to increase, and these threats
    will be a continued focus of our audit and investigative
    activity.
        Chairman Hatch, Ranking Member Wyden, members of the
    committee, thank you for the opportunity to share my views.
        [The prepared statement of Mr. George appears in the
    appendix.]
        The Chairman. Thank you so much. We appreciate having your
    views.
        We will now turn to Mr. Dodaro, and then I understand the
    other two witnesses will be here to answer questions, if
    necessary.
        Mr. Dodaro, we will turn to you.

     STATEMENT OF HON. GENE L. DODARO, COMPTROLLER GENERAL OF THE
     UNITED STATES, GOVERNMENT ACCOUNTABILITY OFFICE, WASHINGTON,
    DC; ACCOMPANIED BY GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION
    SECURITY ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE, WASHINGTON,
                                   DC

        Mr. Dodaro. Thank you very much, Mr. Chairman. Good morning
    to you, Ranking Member Wyden, members of the committee.
        Greg and I are very pleased to be here today to discuss
    GAO's work related to computer security at IRS and identity
    theft refund fraud.
        Our most recent audit showed that IRS had instituted
    controls over its financial and tax processing systems.
    However, there were numerous weaknesses that we identified due
    to the inconsistent application of its information security
    program across IRS. These weaknesses included easily guessed
    passwords to gain access to servers supporting key systems at
    IRS, including those to access and manage taxpayer accounts,
    and users at the IRS who were given rights and privileges
    beyond what they needed to carry out their responsibilities,
    including access to electronic tax payment systems.
        We found that key systems that should have been encrypted
    were not. We found in other cases there were applications where
    user activity was not being logged so that IRS could
    potentially investigate or know who was using those systems,
    including those that were used to transfer financial data and
    to manage and access taxpayer accounts. Also, we found that
    software patches were not being implemented in a timely fashion
    in a couple key instances.
        Now, to address these weaknesses and strengthen IRS's
    security program, GAO made 45 new recommendations to the IRS.
    In addition, we reemphasized the importance of implementing 49
    recommendations that we had made previously that were not yet
    implemented. One area we were concerned about with this most
    recent audit was that in 28 instances, IRS asserted that it had
    implemented our prior recommendations, but our subsequent
    testing showed that in nine of those 28 instances, the problem
    had not been fixed. So we are very concerned about that.
        This included access by employees and visitors to one of
    IRS's computing facilities where access lists had not been
    updated as appropriate.
        So we made many recommendations to strengthen IRS's
    computer security program. We are hopeful that IRS will
    rigorously implement our recommendations over the next few
    years, all 94 recommendations that we have outstanding.
        Now, with regard to identity theft, I am very pleased to
    report that the Congress has acted on the recommendations that
    we had made to allow for more timely filing by employers of W-2
    data.
        As you recall, Mr. Chairman, I was here last year before
    this committee talking about the importance of providing
    earlier W-2 information to the IRS. In past years, IRS only
    received the W-2 information from employers in April. Having it
    earlier to match against early income tax filing will allow IRS
    to better detect tax returns that are filed using fake
    identities.
        The new law now gives IRS the ability to have that W-2
    information at the end of January. We think it is very
    important for IRS to implement changes to its processes and
    systems in order to take advantage of the new, earlier
    information.
        We also think that IRS needs to continue to test and assess
    the costs, benefits, and risks of different authentication
    techniques that could be used. This has been a key weakness in
    the past on Get Transcript and the IP authorizations. IRS also
    needs to give better feedback to those who provide external
    leads to them, such as tips that they can follow up to further
    identify identity theft cases.
        We also have a recommendation for the Congress. We think
    Congress should lower the requirement for electronic filing of
    W-2 data by employers from 250 employees down to a much lower
    number. This would give IRS more electronic information that it
    could use to match to help avoid identity theft in the future.
        So, again, thank you for the opportunity to be here today.
    GAO is very committed to computer security in the Federal
    Government. We actually designated it as a high-risk area
    across the entire Federal Government in 1997. We have been
    working on it since then and made thousands of recommendations.
        I am pleased to be here today to participate in this
    hearing, along with Mr. Wilshusen.
        Thank you very much, Mr. Chairman.
        [The prepared statement of Mr. Dodaro appears in the
    appendix.]
        The Chairman. Thank you so much.
        I want to apologize to Senator Wyden. I should have called
    on him right away, but we are going to call on him at this
    time.

                 OPENING STATEMENT OF HON. RON WYDEN,
                       A U.S. SENATOR FROM OREGON

        Senator Wyden. Mr. Chairman, thank you. And to colleagues,
    my apologies for being late as well. I was at the public
    proceeding to look at steel overcapacity. We care a great deal
    about enforcing the trade laws on this committee, particularly
    the ENFORCE Act and the Leveling the Playing Field Act.
        We are dealing with a steel overcapacity that would really
    cost us family-wage jobs, family-wage jobs in Oregon and across
    the country. We worked on this in a bipartisan way, and I was
    at the USTR's proceeding to make sure that they move
    aggressively to enforce the law.
        Now, we turn to the question of IRS cybersecurity, and it
    is pretty obvious that hackers and crooks, including many who
    work for foreign crime syndicates, are jumping at every
    opportunity to steal hard-earned money and sensitive personal
    data from American taxpayers. It happens online, and it happens
    in the real world.
        In my view, taxpayers have been failed by the agencies, the
    companies, and the policymakers here in the Congress that they
    are counting on to protect them.
        It was unacceptable for the IRS to leave the front door
    open to hackers by using a weak authentication process for its
    Get Transcript system. It meant that thieves could walk through
    the door and steal the tax information of three-quarters of a
    million taxpayers.
        To make matters worse, after the IRS mailed the special
    Identity Protection PIN numbers to the hacking victims, it
    repeated its mistake and used lax security online. For the tax
    scammers, once again, it was as easy as going online, plugging
    in the personal data you have already stolen, and pretending to
    be somebody who lost their IP PIN.
        So after leaving the front door open, the IRS left the back
    door open as well. There is simply no excuse for this.
        But poor protection of taxpayer information is not just a
    problem at the IRS. There is plenty of blame to go around.
    Already this tax season, hackers have gotten into the
    inadequately guarded system of private software companies and
    stolen personal information from thousands of people. And it is
    my judgment that you cannot have an honest discussion about
    protecting taxpayer information without including the
    vulnerabilities from the e-file providers, as well as crooked
    return preparers who operate in the shadows and steal from
    customers.
        For years, Republicans and Democrats have agreed on the
    need for minimum standards for return preparers, but the
    Congress has sat back and watched while criminals have come in
    and preyed on taxpayers. When it comes to blocking hackers,
    Congress has done next to nothing while the IRS loses its
    ability to hire the experts who can keep taxpayer information
    safe.
        If you are a top-notch tech expert, you already are taking
    a pay cut to work in public service compared to what you would
    earn at firms in Oregon or California. Now, without what is
    called streamlined critical pay authority, it can take 4 to 6
    months to bring a new hire on board at the IRS.
        So I want to be clear as we go to questions. Taxpayer
    information is under assault every single day, but the IRS does
    not have the legal authority it needs from the Congress to
    build a cybersecurity team that can beat back the crooks.
        Already there has been an exodus of high-ranking IRS tech
    staff. The Director of Cybersecurity Operations left 1 month
    ago. The terms for the remaining employees working under this
    authority continue to expire, including for one of our
    witnesses, Chief Technology Officer Terence Milholland. Come
    2017, there are not going to be any left.
        So today, instead of rehashing the past and just beating up
    on one agency or one firm, to me, the priority ought to be to
    focus on how to step up the fight against attackers and crooks
    across the board. It is my view that streamlined critical pay
    authority is a key part of the solution. There was a bipartisan
    bill, colleagues, ready to go last fall, and this committee
    ought to move forward on it as soon as possible.
        Furthermore, the Congress needs to make more than token
    investments in IT at the IRS. Congress has held the IRS tech
    budget below where it was 6 years ago, but you can bet that the
    hackers have not backed down since then.
        Next, the IRS and private firms need to do more to keep
    taxpayer information safe inside their systems. The Get
    Transcript hack I mentioned earlier has been well documented.
        A recent audit by the Online Trust Alliance found that the
    security maintained by private free-file services did not meet
    expectations. It is unacceptable for troves of taxpayer data to
    be more vulnerable to hacking than many social media or e-mail
    accounts, and the committee ought to consider whether the IRS
    has the authority it needs to guarantee that the security used
    by private software firms is up to snuff.
        While many tax preparers are honest practitioners, we know
    that there are always some bad apples in the barrel. Last year,
    Senator Cardin and I introduced a bill giving the IRS the
    authority to have basic minimum standards over these tax return
    preparers. We have worked to create a bipartisan identity theft
    bill for markup in the Finance Committee, which I had very much
    hoped would include at least these minimum standards for return
    preparers.
        It is still my view that people handling sensitive taxpayer
    information should have to meet what are minimum standards and
    that the committee should vote to require it. Anybody who
    thinks that Western civilization is going to end if we have
    minimum standards can come to my home State, because we have
    them, and it is working well, and we heard testimony from a
    preparer that that was the case.
        It is open season for hackers to steal money and data from
    hardworking Americans, so congressional inaction should not
    make this situation worse. With tax day approaching, millions
    of Americans are filing their returns online, through the mail,
    or with a private return preparer.
        The committee has a responsibility to protect taxpayers, no
    matter what filing method they choose. So I see this hearing as
    an opportunity to find some bipartisan solutions to do what the
    Finance Committee has always done best, which is to find common
    ground.
        I thank our witnesses, Mr. Chairman, and I look forward to
    working with you and our colleagues.
        [The prepared statement of Senator Wyden appears in the
    appendix.]
        The Chairman. Thank you, Senator. I appreciate it.
        Let me begin by asking this. The IRS is working with State
    revenue commissioners and the private tax industry in the so-
    called Security Summit and has made an agreement to create an
    information-sharing and analysis center, or ISAC, to facilitate
    the sharing of actionable information to prevent refund fraud
    and identity theft.
        Now, I understand the agency has made progress on this, but
    it remains incomplete. It hope that it moves forward as quickly
    as possible.
        I have two questions for the IRS and anyone else who would
    care to comment.
        One, when do you anticipate the ISAC will be up and
    running? What impediments are delaying its launch?
        Mr. Commissioner, given that we are nearing the end of the
    2016 tax filing season, describe the extent to which the IRS
    and its partners are currently sharing information to prevent
    stolen identity refund fraud and how you measure whether that
    is working or not.
        Commissioner Koskinen. Thank you, Mr. Chairman.
        The Security Summit has been thus far a great success. In
    fact, part of the indication of its success is that the
    private-sector members have requested, which we have honored,
    that we make it a permanent partnership going forward, because
    it has already demonstrated its great utility.
        We have been able to receive information from State tax
    commissioners, as well as preparers, about suspicious patterns.
    We have been able to exchange information, give them notice
    when we see suspicious patterns or Social Security numbers that
    have been abused, and we have been able to share that
    information in real time with the private sector and with State
    tax preparers.
        As you noted, we agreed early on that an information-
    sharing center would be very helpful to increase the utility of
    that information and its availability.
        I would stress the private sector and the IRS and the
    States are all protective of individual taxpayer information,
    so the information we are sharing is about patterns, it is
    about activities going on; but basically, we are not sharing
    individual taxpayer information, except in situations where we
    know there have been fraudulent attempts to access those
    accounts.
        We measure it. Thus far, we have had a significant increase
    in the amount of leads provided. We have had a significant
    increase in the volume of refund fraud stopped. We have stopped
    over a million tax returns this year that were suspicious. We
    identified thousands of them that were fraudulent.
        We have shared all that information back and forth. We do
    think that as soon as we can, we will try to implement the
    ISAC. It will take some time for this unique opportunity. We
    are funding it with some of the money that we were given out of
    the $290 million the Congress provided us additionally this
    year. Some of it is going, in fact, to the development of the
    ISAC.
        We hope to have it up and running as soon as we can. It is
    not clear that we will be able to get it fully operational by
    next tax season, but I would stress that we are already
    exchanging information back and forth in real time, and it has
    been very helpful.
        The Chairman. Thank you. This is a question for all of the
    witnesses regarding unimplemented recommendations related to
    information technology, cybersecurity, and identity theft.
        In a report released last month on IRS information
    security, GAO identified specific IRS vulnerabilities that
    leave the sensitive taxpayer information of millions of
    Americans ``unnecessarily vulnerable to inappropriate and
    undetected use, modification, or disclosure.'' GAO made 45 new
    recommendations on how to better protect this data and
    identified 49 prior information security recommendations that
    the IRS has failed to implement.
        Last year, Chairman Brady, Senator Rubio, Congressman Yoho,
    and I wrote to the IRS requesting an update on TIGTA
    recommendations relevant to today's hearing, and I was
    disappointed to learn that several continue to remain
    unimplemented.
        I would just like to ask both TIGTA and GAO to detail the
    recommendations that you deem most important and discuss
    whether incidents like the unauthorized access of the Identity
    Protection Personal Identification Number tool would have
    occurred had these recommendations been implemented.
        I would also ask the IRS to respond to the status of these
    recommendations.
        Mr. George. Mr. Chairman, as it relates to the latter
    point, we believe that if our recommendations had been
    implemented, while we could not guarantee that the breach would
    not have occurred, it would have been much more difficult for
    that to have happened.
        But I would like to defer to my colleague, Michael
    McKenney, for the additional response.
        Mr. McKenney. One thing, especially in the area of
    authentication, that is probably one of the more important
    recommendations to improve its authentication, is to move to
    the multi-factor authentication.
        There are also some concerns we have expressed in the past
    that I think are really primary here, such as the IRS's
    willingness to accept risks in these areas without really very
    well following a process to document why they have accepted
    those risks and the rationale for what they have done to
    mitigate those risks.
        So one of the most significant concerns we have is the
    agency itself, when it decides to accept risk. It is
    unavoidable, but it should be kept to a minimum, and when they
    do accept risk, they should thoroughly document why, the
    rationale, and what they will eventually be able to do to
    overcome those risks.
        The Chairman. Senator Wyden, we will turn to you now for
    your questions.
        Senator Wyden. Thank you very much, Mr. Chairman.
        Commissioner Koskinen, it seems to me you do not fight the
    cheats and the rip-off artists by osmosis. You do it by having
    the right kind of experts, the talent that you need to take
    them on.
        Many of those experts were hired using streamlined critical
    pay, including the head IRS official who is sitting next to
    you, Mr. Milholland. But that authority expired in 2013, and
    the IRS has already lost many of these experts.
        I think it would be very helpful if you laid out for the
    committee what are going to be the consequences of the Congress
    failing to renew this key tool, the streamlined critical pay
    authority, so you can go out there and get people who know how
    to beat the crooks.
        Commissioner Koskinen. Well, we are concerned about it.
    That is the reason I have been talking about it for the last
    2\1/2\ years, because what it gives us is the ability to find
    top-notch IT people and hire them, with suitable background
    checks, without going through the 3- to 6-month normal
    government application process--and these are all highly
    desirable people.
        Our people are being recruited every day, and when you tell
    somebody, ``We would love to hire you; we have a great position
    for you; now, if you will just sit around for 3 to 6 months, we
    will get back to you and, in the meantime, fill out the
    applications and apply for the job,'' needless to say, most of
    those people are not around when we come back.
        Now, there are good people who are willing to work through
    that process, but at the top of the heap, cybersecurity
    experts, people expert at development of new techniques and
    technologies, like Mr. Milholland, they simply do not need to
    go through that entire process.
        So authority was provided in the Restructuring Act of 1998,
    was renewed every 4 years, and the IG reviewed the program a
    year and a half ago and found that we had used it
    appropriately. It only applies to 40 slots, and we never used
    the full 40.
        But if we continue to lose people--we have 10 last IT
    people on the list--and by this time next year, they will all
    be gone, and our ability to replace them is very questionable.
        Senator Wyden. All right. Inspector George, we always value
    your work. I gather that you all have looked at this issue as
    well, and you largely agree with what the Commissioner has
    said, that these were justifiable hires, that these are
    exceptionally well-
    qualified individuals, and that this was something that really
    worked.
        Is that true?
        Mr. George. It is true, and it was actually even under
    budget. This is one of the programs implemented by the IRS that
    we have to say works. It is very successful and justified.
        Senator Wyden. I am going to repeat that for my colleagues.
    So here we have something that has been an essential tool. We
    are not going to have it any longer absent Congress getting
    serious on a bipartisan basis to renew it. And Inspector
    George, whose views we have long admired on both sides of the
    aisle, said the program came in under budget.
        I appreciate your doing that, Inspector, because if that is
    not a wakeup call to the Congress, I do not know what is. This
    is something that works, and if we are going to beat the
    crooks, we ought to have it.
        Now, Commissioner Koskinen, let me ask you about the
    private e-file providers, because I think we all understand
    that the IRS is not the only place where the bad guys, the
    crooks, can go after innocent taxpayers.
        In January, two e-file providers revealed that roughly
    16,000 taxpayer accounts had been breached. The Independent
    Online Trust Alliance concluded that 6 of 13 private online
    free-file tax preparation services failed the best practice
    assessment with respect to these cybersecurity tests.
        Are e-file providers doing enough to keep taxpayer
    information safe, and, in your view, what needs to be done on
    this issue--again, with the Finance Committee, Democrats and
    Republicans, working together to ensure that we are using the
    tools that are essential.
        Commissioner Koskinen. That is an important question. One
    of the great outcomes of the Security Summit, the partnership
    we have with the private sector, is from the start, in our
    meetings with them, all of the preparers and providers and
    software developers agreed that they would all meet the NIST
    standards of operation. Most of them already met them.
        So it has not been a question of our having to require it.
    They have actually voluntarily agreed to a standard system of
    security, and they have gone beyond that. They have agreed to
    standard authentication procedures for taxpayers who use their
    services.
        So it is one of the great examples of what happens if you
    have a public-private partnership where both sides are working
    together to solve a problem. You can make great progress, and
    we feel comfortable that our partners in the private sector see
    this as an important problem. They want to protect their
    clients. None of them wants to have a breach. And they have all
    been willing to work cooperatively with us to set appropriate
    standards and agree to them.
        Senator Wyden. So the last leg of this game plan, in
    addition to critical pay authority and the tools to deal with
    these e-file rip-offs, is tax preparers.
        Once again, Chairman Hatch and I have had bipartisan
    legislation on this ready to go, and, for the life of me, I
    cannot understand, when taxpayers are ripped off, why we cannot
    have minimum standards.
        Where you all are sitting, we had a witness from Oregon who
    made it very clear the sky is not going to fall, Western
    civilization is not going to end, if we have minimum standards.
        I just want to wrap up with a question for Mr. Koskinen and
    Mr. Dodaro, whose work we also have long appreciated.
        My understanding is, you both think that there should be
    minimum standards over preparers based on what you have seen
    over the years, with all the problems that stem from the fact
    that, while most preparers are honest and reputable business
    leaders, we, unfortunately, have some bad apples.
        So is that your judgment, gentlemen, that there need to be
    some minimum standards over these preparers?
        Mr. Dodaro. Yes, Senator Wyden, I believe that. We have
    recommended that Congress give IRS the authority to regulate
    paid tax preparers, and I say that for several reasons.
        One, we did an undercover investigation that sent teams out
    to 19 paid tax preparers. Only two of the 19 paid tax preparers
    gave us correct answers, and some were very wrong.
        We also looked at 3 years of data at that time and found
    that paid tax preparers made errors 60 percent of the time
    versus 50 percent of the time for taxpayers who filed on their
    own behalf.
        IRS found that paid tax preparers file about 68 percent of
    the Earned Income Tax Credit returns in a 1-year or 2-year
    period of time, and about 48 to 53 percent of those returns
    over-claimed the tax credit.
        I definitely think there needs to be authority given IRS to
    set minimum standards for paid tax preparers.
        I would also comment that we think the IRS should have more
    monitoring and oversight of the security and privacy standards
    that paid tax preparers agree to use. We have had an open
    recommendation in this area since 2009.
        Senator Wyden. Thank you for your professional work.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator.
        I would just say we have heard a lot today from the IRS and
    the ranking member regarding streamlined critical pay
    authority.
        As Senator Wyden noted, re-implementing this authority is
    included in a bipartisan bill the committee introduced last
    year, and we will be moving to consider this particular bill in
    the near future. So hopefully we can resolve some of these
    problems.
        Senator Grassley, we will turn to you.
        Senator Grassley. I am going to start with Director
    Wilshusen, please. I spent a little time comparing your 2015-
    2016 reports on information security at the IRS. Let me take a
    couple of examples.
        In 2015, one specific observation was that on two
    databases, account passwords were not set to expire every 90
    days, as they should be.
        In 2016, the report says two of the 13 databases reviewed
    again had passwords that did not expire every 90 days, as they
    should have.
        Do you know if these were the same two databases?
        Mr. Wilshusen. Yes, sir, they were.
        Senator Grassley. It is common to hear that the lack of
    funding is why we cannot have better cybersecurity. So I might
    ask you, what is the approximate cost of setting up a password
    to expire every 90 days?
        Mr. Wilshusen. It would be negligible, sir. It would not be
    a high-cost issue. It would be very low-cost, indeed.
        Senator Grassley. Again, both the 2015 and 2016 reports had
    a section dedicated to physical access control procedures that
    were not consistently implemented. The 2016 report observes
    that security guards control physical access to each IRS
    computing center.
        Quoting now from the 2016 report, quote, ``IRS has yet to
    address weaknesses pertaining to its review of its authorized
    access lists to sensitive areas for both employees and visitors
    at one of its computing centers.''
        So it is not an either/or. But I wonder if you could
    compare the cost of a dedicated guard force to the cost of
    reviewing a list of people who appropriately have access to the
    facility.
        Mr. Wilshusen. Well, certainly, employing and deploying a
    guard force would cost significantly more than what it would to
    just review an access list on a periodic basis. That would be
    basically very low-cost, and it is something that should be
    done as a normal course of business.
        Senator Grassley. Your 2015 report found the agency did not
    always ensure that contractors received security awareness
    training within 5 business days, as required.
        The 2016 report found the same problem and noted that the
    IRS acknowledged it had not addressed the issue.
        Could you say if this contractor problem is that they get
    the training, but that they get it late, or do they just not
    get it at all?
        Then I will follow that up right now. How expensive would
    it be to get the training in a timely manner rather than late?
        Mr. Wilshusen. Well, first of all, it is that they do not
    receive it in a timely manner. The contractors do not receive
    this training, for the most part, in a timely manner.
        And in terms of cost, if it is a web-based training, it
    should not cost much additional money to ensure that they
    receive it within the 5 days of gaining access to IRS systems.
        Senator Grassley. A couple of questions about mainframe
    security policy. Both your 2015 and 2016 reports say that,
    according to the mainframe manufacturer, policy should address
    who can administer the security software configurations that
    control access to mainframe programs.
        Is that correct?
        Mr. Wilshusen. Yes, sir.
        Senator Grassley. And both reports indicate that the IRS
    mainframe security policy does not address who can administer
    these configurations. Is that correct?
        Mr. Wilshusen. Yes, sir.
        Senator Grassley. What would be the cost of naming the
    person or persons who can administer the software
    configurations that control access to mainframe programs?
        Mr. Wilshusen. There should really not be much of any cost
    associated with that. It is just an assignment of
    responsibilities that IRS should make to assure that those
    individuals have been designated and take the appropriate steps
    to limit access as appropriate to those mainframes.
        Senator Grassley. So I would like to ask, Commissioner
    Koskinen, as you heard me ask Mr. Wilshusen about findings and
    recommendations that appear over and over in the GAO report--or
    at least each of the last 2 years--about cybersecurity at your
    agency, I took special note of four areas: setting passwords to
    expire every 90 days; two, a monthly review of lists of who
    should have access to computer centers; three, timely security
    awareness training for contractors; and, fourthly, the naming
    of administrators for software security on mainframe programs.
        Would you agree that these are low-cost changes that could
    improve cybersecurity, and if they are, then why have they not
    been done?
        Commissioner Koskinen. They are low-cost. I would note that
    we value highly both the reports and recommendations from GAO
    and from the IG, particularly in cybersecurity areas.
        In the last several years, we have counted up over 2,000
    GAO recommendations, of which we have already implemented about
    80 percent.
        In the internal security--and these are important internal
    security issues, not external, but they could become external,
    obviously--one of the things we are moving toward in terms of
    access is that passwords themselves turn out to be somewhat
    questionable, and we are moving toward what we call PIC cards,
    where you can actually only access servers--right now, you can
    only access e-mail with a Personal Identity Card you put into
    the computer.
        We are moving toward having that be the system for access
    to all servers, all mainframes, and security online, so that it
    does not matter if you have given away your password or
    somebody seeks it, they will not be able to have access without
    the card.
        But I agree, to the extent we can--we have a wide range and
    a large number of recommendations from both the IG and GAO. We
    do not disagree with those. We are working as quickly as we can
    to implement them, and these are particular ones internally to
    make sure that--we worry a lot about external threats. We also
    need to worry about internal threats, inadvertent or otherwise,
    and that is a high priority for us.
        Senator Grassley. Then I would expect that these will not
    be in the 2017 report.
        Commissioner Koskinen. I can almost guarantee you, working
    with GAO, they will not be. But GAO, I would note, has done a
    very important thing for us. Out of their range of
    recommendations, they have given us their priorities or what
    they think are the highest priority for us to do.
        Because there are limitations of time and resources, the
    ability to identify which of the recommendations have the
    highest priority is very helpful to us, and GAO has been very
    good about giving us that guidance.
        Senator Grassley. Thank you.
        The Chairman. Thank you, Senator.
        Senator Carper?
        Senator Carper. Thanks, Mr. Chairman.
        I want to associate myself with the comments of Senator
    Wyden earlier. I thought he nailed it with his comments with
    respect to the streamlined critical pay program. Mr. Chairman,
    you mentioned in your comments that legislation had been
    introduced, bipartisan legislation was introduced last
    Congress. I just think it is critical that we follow through on
    that.
        Year after year, Mr. Koskinen and others come to us and
    say, ``Please do this to enable us to do our jobs more
    effectively,'' and a lot of times we point the finger at them
    and say, ``You know, you screw up here and you screw up there,
    your people have as well.'' We have some responsibilities in
    this too, and one of the things that we could do to help out is
    to provide for the reestablishment of the streamlined critical
    pay program.
        Mr. Chairman, you are going to hear a lot from me in the
    months to come, saying we should do this, let us do it, let us
    get it done. We need to do our job. We need to do our job.
        We hear a lot about that lately. We need to do our job.
    This is another area where we need to do our job.
        Mr. Dodaro, I want to ask you--I want to come back to this
    other point that Senator Wyden raised, and that is the minimum
    standards for paid tax preparers.
        Would you just give--I think you guys have looked at this
    before, you folks have looked at this before. Just give us a
    minute or so on what we should be doing in this regard.
        Mr. Dodaro. We made a recommendation several years ago that
    IRS institute regulations over paid tax preparers, which it
    did, and then those regulations were overturned by the court
    because it viewed that IRS did not have statutory authority to
    do this.
        As I mentioned earlier, our work has consistently shown
    that there are problems with some paid tax preparers. We sent
    teams of people to 19 paid tax preparers. We checked in advance
    with the IRS what the right answers should be to our tax
    scenarios. Only two of the 19 paid tax preparers gave us
    correct answers. Some were very far off, to the point where
    they could have resulted in penalties and interest, both for
    themselves as well as for the people whom they were filing for.
        We also looked at IRS data, at a 3-year period of time, and
    found that paid tax preparers made errors 60 percent of the
    time versus 50 percent of the time for taxpayers filing on
    their own behalf.
        Senator Carper. It was actually worse.
        Mr. Dodaro. Yes. Yes.
        Senator Carper. What should we do?
        Mr. Dodaro. Well, I think you need to give the IRS the
    authority, the statutory authority, to regulate paid tax
    preparers. They need to set minimum standards. They should go
    through a due process procedure just as you would with any
    regulatory approach and set the standards and enforce those
    standards.
        This is a particular problem because of IRS's resource
    levels. If the government is going to rely on paid tax
    preparers to largely carry out a very important function on
    behalf of the government, then it needs to make sure that they
    are properly carrying out their responsibilities. IRS could
    greatly leverage the preparers' activities as opposed to a need
    to continually beef up the IRS.
        Senator Carper. Thanks so much.
        Last year, Mr. Koskinen, I worked with a number of our
    colleagues, some on the Homeland Security and Governmental
    Affairs Committee, some on the Intelligence Committee, and
    others, to eventually pass the Federal Cybersecurity
    Enhancement Act of 2015. Among other things, the bill
    strengthened an important cybersecurity system at the
    Department of Homeland Security that is known as EINSTEIN 3A.
    The EINSTEIN program uses the best threat intelligence from our
    national security agencies to block cyber-threats before they
    can actually reach our Federal agencies in many instances.
        It is my understanding that EINSTEIN 3A is now available to
    all Federal agencies. However, not all agencies, including the
    IRS, are signed up for EINSTEIN 3A.
        The bill we passed last year also made participation in the
    program mandatory for all Federal civilian agencies.
        When will the IRS adopt EINSTEIN 3A and start receiving its
    protections?
        Commissioner Koskinen. I would like to give you Mr.
    Milholland.
        Senator Carper. Mr. Milholland?
        Mr. Milholland. We are very familiar with the EINSTEIN
    program, 1 and 2, and we are scheduled to receive the EINSTEIN
    3 equipment this year, and then there is the issue of
    implementing it.
        So certainly by next filing season, I suspect that we will
    have it all done.
        Senator Carper. So by next filing season, like a year from
    now?
        Mr. Milholland. Yes, sir. As I say, we have to schedule
    ourselves with DHS to receive the equipment, install it, test
    it, and then implement it. It is not something that is done
    overnight.
        Senator Carper. That is a lot of nights. We have 365
    nights.
        Mr. Milholland. Again, we are not yet scheduled from DHS.
    So it is something we have to work out with another agency as
    to when we actually get the equipment.
        Senator Carper. We are going to go to work on that and make
    sure that we do everything we can to move you up in the queue.
        Mr. Milholland. Thank you, sir.
        Senator Carper. You bet. Thanks so much.
        Thanks, Mr. Chairman.
        The Chairman. Thank you, Senator.
        Senator Scott?
        Senator Scott. Thank you, Mr. Chairman.
        Good morning to the panel and thank you for taking the time
    to be here, and we certainly appreciate your investment of time
    and your energies toward making sure that taxpayers'
    information is secure as possible.
        I certainly know firsthand that identity theft is a
    terrifying experience and one that we should all hope that all
    taxpayers have an opportunity to avoid. The reality of it is
    that what we have seen over the last several years is too many
    taxpayers having too much information exposed inappropriately
    and, frankly, very poor results.
        Unfortunately, there seems to be a systemic failure at the
    IRS in protecting taxpayer information, despite repeated
    warnings that the IRS needed to strengthen and modernize
    protection of taxpayer information. Due to these failures, I
    have received a number of e-mails from constituents throughout
    South Carolina, one in the last couple of days specifically
    from a taxpayer in Lexington, SC, who seems just bewildered at
    what the Federal Government, particularly the IRS, is doing to
    protect personal information.
        I am interested in learning more about what the IRS is
    doing, and we certainly have heard a number of presentations
    and a lot of information about some programs that would be
    successful.
        Other than what has already been mentioned, what else do
    you think should be done and can be done? If you can take maybe
    50 seconds to answer that one.
        Commissioner Koskinen. We are doing a wide range of things.
    One is, we are getting ready to establish a significantly
    increased authentication protocol. It will mean more taxpayers
    will not be able to answer the questions or get in, but it will
    make the system more secure.
        As noted, we are moving to protect the systems with PIC
    cards, so people can only access e-mails or servers with
    personal identity cards.
        We are working, and the private sector is working very
    closely with us--and we have a public relations campaign going
    with them out to taxpayers, trying to give them information on
    how to protect their data.
        I would stress the accesses that have been obtained at the
    IRS were by criminals able to masquerade as taxpayers because
    they already had the information on the taxpayers.
        So we think it is important for individuals to be careful
    what they do with their information, not to give out their
    Social Security numbers, not to use the same user ID and
    passwords all across the board, because we are all in it
    together.
        Senator Scott. Thank you very much. Another issue that we
    have had many conversations about, and certainly one that I
    think should be deeply troubling to all of us, is the ruling
    last month by the Sixth Circuit Court that basically, in United
    States v. NorCal Tea Party Patriots, demanded that the IRS stop
    their games of delaying and turn over the documents requested
    by the plaintiffs.
        In fact, the Sixth Circuit called the conduct displayed by
    the IRS attorneys outside the tradition of defending the
    Nation's interests in enforcing its laws. And while we spend a
    lot of time on cyber-breaches, the reality of it is that
    protecting all taxpayers should be one of our top priorities.
        Has the IRS complied with that court order?
        Commissioner Koskinen. We have complied with that court
    order. We have given the plaintiffs the information they
    requested, the names and addresses of the organizations.
        As you know, our strong view was, that was taxpayer
    information. We have a lot of applications for a lot of things,
    whether it is private letter rulings or applications to become
    a c(3), (4), (5), (6), or (7), and oftentimes people, when they
    apply, do not assume that the application will be made public.
        So we disagreed with the court, but we have complied with
    the court, because we have that order, but we have only
    complied with the information specifically in that case, and we
    have only done it in that case. We have not made a decision
    about any other case.
        Senator Scott. Thank you.
        The Chairman. Senator Coats, you are next.
        Senator Coats. Thank you, Mr. Chairman.
        I would like to direct my question to Mr. George. Mr.
    George, I raised the issue of employment-related identity theft
    with the Commissioner the last time he testified before the
    committee here, and I know that TIGTA has done a lot of work on
    this issue.
        These are cases in which someone uses someone else's
    identity, their name or their Social Security number, to get a
    job illegally, on the employment side. A W-2 form with this
    false information is then sent to IRS and the Social Security
    Administration by an employer, or the W-2 may be attached to
    the tax return of the undocumented worker.
        Our staffs met to try to work this out. It was a couple of
    months ago. What we learned is that, one, the IRS continues to
    process tax returns with false W-2 information and issues
    refunds as if they were routine tax returns, saying, ``That is
    not really our job; we are there to process the returns and
    issue the refunds or collect what is overdue.''
        We also learned the IRS ignores notifications from the
    Social Security Administration that a name does not match a
    Social Security number, and you use your own system to
    determine whether or not a number is valid.
        We learned that employers are liable for IRS fines and
    penalties if they submit false W-2 information, yet neither the
    IRS nor SSA is notifying employers that the information they
    are submitting is false.
        We learned that IRS identified 200,000 new cases of
    employment-related identity theft last year and marked victims'
    accounts, yet did not notify the victims, again, saying, ``That
    is really not our job.'' In fact, the IRS forbids its employees
    from notifying victims that their information has been stolen.
    The IRS does not examine returns submitted on paper for
    employment-related identity theft.
        Lastly, we learned that when the IRS marks the account of a
    victim, it does not notify the Social Security Administration
    that the victims did not earn the income reported on the W-2,
    and, as a result, the victims could lose income-related
    benefits because their Social Security earnings are not
    corrected.
        My question to you is, one, have we made some progress
    since we met, on the basis of what we learned; and secondly, if
    you do not have the authority to better inform victims or
    connect with SSA on the potential fraud and notify each other,
    do you need authority to be able to do that? Do you need a
    statutory mandate here from the Congress to do that? Where do
    we go from here?
        I think all of us can agree that victims need to know that
    they are victims, and they need to know that an agency of the
    Federal Government, whether it is IRS or whether it is SSA, or
    both, ought to have some ability to talk to each other to make
    sure that they do not run afoul of one or the other.
        I am happy to hear your response.
        Mr. George. Thank you, Senator. What you stated at the
    outset of your question is completely accurate.
        I would note the IRS did have a pilot program to address
    this issue. That program ended. So they are not providing the
    information that you pointed out, but we are literally, sir, in
    the process now of assessing this overall issue and expect to
    issue our report in June of this year.
        Senator Coats. Well, I am glad to hear that, but was the
    pilot program false? I mean, it just did not work out, is
    that----
        Mr. George. I will defer to the Commissioner to describe
    whether or not he thinks it was--was it false? No, but they
    made a decision not to continue it, and I do not know whether
    it was resource-driven or what factors they took into
    consideration, Senator.
        Senator Coats. Commissioner, I would be happy to have your
    response.
        Commissioner Koskinen. Surely. Again, as you know, what
    happens in these situations is, someone is using a Social
    Security number to get a job, but they are filing their tax
    return with their ITIN--they are undocumented aliens. And so on
    that ground, they file taxes. It is in everybody's interest to
    have them pay the taxes they owe.
        The question is whether the Social Security number they are
    using to get the job has been stolen, though it is not the
    normal identity theft situation. We did run a pilot, and we are
    looking at--and I appreciated your discussions about this--
    whether there is a way we could simply advise people.
        A lot of times, those Social Security numbers are, in fact,
    borrowed from friends or acquaintances, and people know they
    have been used. Other times, they do not.
        So we are looking at--and one of the reasons for the pilot
    was--what is the most effective way to deal with this without
    necessarily having people decide not to file their taxes--
    obviously a priority for taxpayers and the IRS, which is
    collecting those taxes.
        So I would be delighted to have us get back to you with
    more detail on exactly where we are. And in some cases, there
    may be a need for statutory authority, and we are very
    sensitive about protecting taxpayer information on both sides.
        But we will be delighted to give you the update on what we
    have learned and what we might be able to do going forward.
        Senator Coats. Mr. George?
        Mr. George. Thank you, Senator. I just wanted to add that
    there was a bill introduced entitled the Social Security
    Identity Defense Act that would require the IRS to inform an
    individual whether their SS number has been fraudulently used.
    I do not know where it stands now in terms of the legislative
    process.
        Senator Coats. Well, we can check that out.
        Commissioner Koskinen. But I would note specifically, we do
    advise taxpayers, when there has been any kind of access to one
    of our online applications, that their Social Security number
    is in the hands of criminals.
        What we are talking about here is a very limited case of
    people filing taxes with an ITIN, but it is clear that they
    used the Social Security number to get the job.
        But in all the other cases, we have sent out hundreds of
    thousands of letters, even when our system has not been
    accessed, warning taxpayers, no information was obtained from
    us, but you should know criminals have your Social Security
    number and other identifiers, so you should take whatever
    actions you can to protect that information.
        Senator Coats. If I could, Mr. Chairman, just one last
    question.
        My tax preparer, by the way, who is fully certified, just
    sent me an e-mail asking would I prefer to have my tax returns
    filed electronically or by paper. How am I safer--which way?
        Commissioner Koskinen. You are actually safer
    electronically, because we can mark accounts. The only
    difference is, when you file on paper, it just takes longer to
    process, takes longer to get a refund.
        We get fraudulent paper returns. So it is not as if the
    criminals do not file paper as well.
        So we encourage everyone to e-file. Over 86 percent filed
    last year electronically, and as noted, it does give us the
    ability to track patterns more easily, and it is part of the
    data we share with the private sector and the States.
        So our advice to you is, file electronically.
        Senator Coats. Any other answer would probably flood your
    agency with a lot of paper. [Laughter.]
        I will put that in that context. Anyway, I ended up doing
    it electronically. I hope it works.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator.
        Senator Cardin, you are next.
        Senator Cardin. Thank you, Mr. Chairman. I thank all of our
    witnesses today in regards to the integrity of the system.
        We are very concerned about the recent warning that was
    given to Maryland, Virginia, and DC taxpayers, due to the
    phishing scams, trying to trick victims into verifying the last
    four digits of their IRS number in order to get unsuspecting
    taxpayers' information that can be used to compromise their
    privacy and their financial integrity.
        I guess I will go with the Commissioner. Could you just
    update us as to the status of that particular concern and
    whether there should still be high alert in our region in
    regard to this scam?
        Commissioner Koskinen. I think there should be. One of the
    things I think everyone should be aware of is--people should be
    aware of all the possible scams out there. There are the phone
    scams, where people call you and pretend to be from the IRS and
    threaten you, and we keep telling people, if you are surprised
    to be hearing from us, you are not hearing from us, and you
    should report that call. We work with the IG very closely on
    that.
        There are phishing expeditions of all kinds, from
    masquerading as coming from financial institutions to the IRS
    seeking information or personal information. A lot of times you
    will get a note that says your account is frozen, click here
    and you can unfreeze your account. You should never do that. No
    bank or financial institution will put you through that system.
        So this one is the most recent. We have had a couple new
    ones this year. We have had private-sector companies, where it
    would appear to be an e-mail from the CEO asking for personal
    information about employees, but it turns out to be an e-mail
    that is a phishing expedition from criminals.
        So in this area, we are encouraging people to always
    remember that no one is asking legitimately for any personal
    information like Social Security numbers online or on the
    phone, and so you should not either click on the link and you
    should not provide that information.
        Senator Cardin. Do you know why this has been
    geographically in this region that this particular scam is
    being used?
        Commissioner Koskinen. We do not. We know ID theft began,
    kind of flourished in Florida. We have a pilot program for IP
    PINs that has run for a couple of years in Florida, Georgia,
    and the District of Columbia.
        Why those were the three areas where we have had more
    identity theft is hard to know, but the District has always
    been one of the areas that has been most prone to identity
    theft. And so it is not unusual for a permutation on that scam
    or scheme to happen in the same geographic area, but there is
    no other indication.
        We cannot even tell you why the District of Columbia and
    Georgia are on the high end of identity theft. It just turns
    out to be one of those things that develops.
        Senator Cardin. One of the challenges in this environment
    is that we have to use all the resources we have at our
    disposal. That is, the Federal agencies need to work with the
    States and need to work with private entities and need to work
    with taxpayers.
        What efforts are underway to try to coordinate the
    resources to go after those who are committing these frauds?
        Commissioner Koskinen. We have a great effort--as I say, we
    work very closely with TIGTA. They have been tracking down
    people who are participating in phone scams. We have prosecuted
    and thrown in jail about 2,000 people for identity theft. We
    have about 1,700 investigations going on right now. We work
    closely with the Department of Justice in those areas.
        In more general phishing expeditions, they are harder to
    track down. We work with the Federal Trade Commission and
    others to make sure that that information is readily available
    to the public.
        As I said, the partnership we created a year ago with the
    private sector and the States has been a great vehicle for us,
    not only exchanging information about taxpayers, but exchanging
    information about fraud.
        We learned about the private-sector company CEO e-mail from
    one of our partners, and what has happened is, we all then can
    publicize that and put it out.
        So it is, I think, a significant step forward, but your
    point is well taken. We need everybody working together on this
    matter. As I told the States and the private sector when we
    brought them together, it is clear no one of us by ourselves is
    going to be able to successfully deal with this problem.
        Senator Cardin. Mr. George, do you want to respond?
        Mr. George. Senator, just to give you a sense, as of this
    week, we at TIGTA received approximately 1.2 million calls
    concerning impersonation cases, with approximately $31 million
    having been sent by people in scams.
        So as the Commissioner noted, we at TIGTA have engaged in
    public service announcements. We are doing as much local media
    as possible. The key is getting the word out, and you would be
    shocked how difficult it is sometimes to convince people that,
    as the Commissioner indicated, if you do not think you have an
    IRS problem and someone calls you out of the blue, you should
    hang up immediately, and they fail to do so.
        Senator Cardin. Let me just make one final point, and that
    is working with our State, in Maryland, our Comptroller has the
    ability to deal with paid preparers and is able to suspend
    their rights in Maryland. That, of course, has been compromised
    by the Supreme Court interpretation, and there will be an
    effort made to give the IRS the ability to regulate again those
    who are paid preparers.
        Mr. Commissioner, I know you have supported that, and
    hopefully we can use that as an opportunity to work more
    closely with our States.
        Commissioner Koskinen. Yes. We look forward to that. As I
    would say, the regulation is basically just requiring minimum
    standards in information, your ability to process tax returns.
    We are not talking about all sorts of other regulations.
        So it really is appropriately described as requiring
    minimum standards of paid preparers.
        Senator Cardin. Thank you, Mr. Chairman.
        The Chairman. Thank you.
        Senator Casey?
        Senator Casey. Mr. Chairman, thank you very much. I want to
    thank the panel for being here and for your public service.
        I am going to be addressing my question to Commissioner
    Koskinen. But I do want to say, because Mr. Dodaro has great
    Pennsylvania roots, that I apologize for probably not getting
    to you today, but I will tell everyone at Belle Vernon High
    School that you said hello. Is that okay?
        Mr. Dodaro. That is fine.
        Senator Casey. Thanks. And the chairman, of course, has
    Pennsylvania roots as well. So we want to highlight that.
        I want to start with, Commissioner, some of the data points
    that you had in your testimony. I know I missed your
    presentation, but the written testimony highlights a number of
    things we should focus on in terms of the volume of your work.
        In fiscal year 2015, you processed 244 million returns,
    issued more than $400 billion in refunds. Your new filters
    stopped 1.4 million returns filed by identity thieves, thereby
    preventing $8.7 billion in fraudulent returns.
        So I wanted to state that for the record, because I know
    those numbers bear repeating. But I want to focus on two areas.
    One is cyber-criminals and the Security Summit, if you can
    comment on that, and also on tax scams.
        With regard to the Security Summit itself, if you can just
    reiterate or amplify some of the earlier comments about some of
    the recommendations that came out of that Security Summit and,
    secondarily, how IRS can be more adaptive in terms of dealing
    with some of those security recommendations.
        Commissioner Koskinen. What we all agreed on at our first
    meeting of the Security Summit--and we have been developing it
    since then--was that it would be critical to exchange
    information in real time. We are very sensitive about
    protecting taxpayer information and as a result, over the
    years, have not been particularly forthcoming with our partners
    about sharing information back.
        One of their concerns was, they would give us leads and
    then we never told them whether the leads were good, and we
    never built on that.
        So one of the purposes of the summit was to change all that
    and to have a robust exchange back and forth about patterns of
    activities, suspicious activities. We created a rapid response
    team with representatives from the States, the private sector,
    and the IRS. If there ever is a significant incident--and there
    have been a couple of them--we immediately have a way of
    getting that information out simultaneously.
        They gave us and we all agreed on 20 different data points
    that we would get, what IP is being used on a computer, how
    long people are using it. If you are filing several returns
    very quickly, it is pretty clear you are not checking your
    deductions, you probably are a criminal filing.
        So all of that has helped significantly. The additional
    funding we got from the Congress allows us to fund the
    development of the information center for analysis, which will
    simply facilitate more quickly the ability for States and the
    private sector to access the data rather than having it come in
    to us and then have us push it back out.
        So we think that it is significant. It is important for it
    to be an ongoing partnership. One of the things that has been
    interesting to me was, at the first meeting, the private-sector
    preparers and software developers said that we, the IRS, are
    the only people who could set standards, and I told them that
    was fine as long as they worked with us to establish the
    standards as opposed to us just imposing them.
        That is how we ended up with security standards; it is how
    we ended up with increased authentication standards that all
    the preparers are using this year.
        We are working together to broaden those activities as we
    go forward. We will have more data points used in the next
    filing season, and we already see an up to 40 percent increase
    in the refund fraud stopped as a result of just sharing the
    information about leads.
        Senator Casey. Well, I appreciate that, and I hope as you
    begin to implement recommendations, that you keep us updated.
    Number two, if you find any either institutional obstacles or
    policy gaps that we can help with, I hope you tell us that.
        I want to move, in the remaining seconds I have, to tax
    scams. I went across the State on our break and held a number
    of roundtables regarding senior scams more broadly, a lot of
    them having their origin in IRS impersonation or tax scams.
        What can you tell us about that in terms of your recent
    work and what taxpayers should be focused on as we approach tax
    day?
        Commissioner Koskinen. As we approach tax day, I think the
    most important thing for taxpayers to focus on is, if you are
    surprised to be hearing from us and you have not gotten a
    letter before--you should have gotten several letters--then you
    are not hearing from us. We never threaten people. We never
    tell you you are going to jail the next day, and we never tell
    you to make your payment to a bank account or a debit card.
        If you are going to pay taxes, you pay them to the United
    States Treasury. If I could just get people--we have been
    working on this for over 2 years--to understand, (a) we do not
    threaten you; (b) we do not surprise you; and (c) if you are
    going to pay your taxes, make sure they go in a check payable
    to the United States Treasury.
        TIGTA has been very good at working with us; the private-
    sector partnership has been good at working with us. They were
    the ones who said we have to have a public campaign to get
    taxpayers to pay attention to all of this.
        Senator Casey. Well, that ``IRS will never do'' list is
    something we read at various meetings, but we need to
    reemphasize that to give people the information so they
    understand that.
        Commissioner Koskinen. The marketers say you have to make
    seven impressions before anybody hears you. We have tried to
    make more than seven impressions. TIGTA has been a wonderful
    partner with us with their work as well.
        We have had very good coverage from the media, local and
    national media, over the last couple of years. But the people
    most vulnerable are elderly, are immigrants, low-income people
    who kind of live in a state of worry or fear, and they are the
    most likely to be prey to these kinds of events, which is why
    we are so concerned.
        Senator Casey. Thank you, Commissioner.
        The Chairman. Senator Portman?
        Senator Portman. Thank you, Mr. Chairman. Thanks for
    holding this important hearing today. It is a topic that
    affects all of our constituents, I am sure.
        I will tell you that in 2014, we had one case, one
    constituent case, of identity fraud. In 2015, we had 32. I do
    not know if that is consistent across the States, but that kind
    of an increase, unfortunately, is an indication of the growing
    problem that we are all facing.
        I am very concerned particularly about, Mr. George, your
    report, as the Inspector General for Tax Administration,
    indicating that the IRS has not established an IRS-wide
    approach to authenticating someone's identity.
        I am open to more funding. I, for one, believe, as you
    know--we have talked about this--that more funding may be
    appropriate, as we did at year end, but I want to be sure the
    money is well spent. So I look forward to following up with you
    on that.
        But I want to, if I could, shift to another issue this
    morning. It has to do, Commissioner Koskinen, with a very
    urgent issue for a group of our constituents. And Senator Brown
    and I have worked closely on this issue, and I think he has
    similar concerns to mine. I look forward to hearing from him on
    it in a moment.
        But this has to do with the health coverage tax credit. As
    you know, section 407 of what is called the Trade Preferences
    Extension Act last year reinstated that health coverage tax
    credit through 2019. Basically, it extended the advance monthly
    payment program, which is essential. It is a program that gives
    advance premium payments to these HCTC recipients.
        In that statute, the program was to be in place 1 year from
    the date of enactment. So in this case, we enacted it in June
    of 2015. We said that it would have to be in place by June
    2016, this year, 1 year.
        We were, unfortunately, told on March 7th of this year, 9
    months after the bill had originally passed, by way of a letter
    from you, Mr. Commissioner, that the IRS would not be starting
    the advance monthly payment program by June, as required under
    law, but that you all hoped to start making advance payments by
    January of next year, so January of 2017.
        So this has caused a huge problem. Six months go by, we do
    not hear anything, and then all of a sudden, taxpayers are told
    that the rug is being pulled out from under them and that we
    are not going to go ahead with this required advance payment
    program.
        Expecting that they are going to get this advance monthly
    payment starting in mid-year, a lot of these taxpayers signed
    up for the health coverage in December and January. They
    thought they could get premium assistance, of course, starting
    on July 1st, as required under law.
        This is not an easy decision to make. These premiums, as
    you know, are thousands of dollars per month. In some cases,
    taxpayers had to borrow money from family and friends, borrow
    from a bank, or take money from their retirement accounts
    early, to pay for these full premium prices in the first 6
    months of this year, knowing that help was coming.
        Furthermore, in some cases, these taxpayers had the option
    of receiving premium subsidies for plans on the health-care
    exchanges, but they turned down that opportunity because they
    wanted to stay in their private plans, which a lot of people
    do, and because they expected to get this 72.5-percent premium
    starting in July.
        So, by the time the middle of March 2016 rolls around,
    these taxpayers have made a lot of life-altering decisions
    based on the fact that these advance payments are going to be
    there, and, again, they have the rug pulled out from under
    them.
        These are resilient folks. They have been through a lot.
    These are people who were left behind, frankly, by our own
    Federal Government in terms of their health care and pensions.
    They can plan for stuff and they have done this.
        When the HCTC was unavailable in 2014 and 2015, they made
    sacrifices and they got by, but, again, to pull a rug out from
    under them 3 months before they are expecting this help is
    unacceptable, completely unacceptable.
        The fact that the IRS had July, August, September, October,
    November, and December of last year to provide them with some
    sort of notice, to me, is also unacceptable. And the option
    left to these taxpayers now of trying to find another way to
    fund these premiums for the next 6 months or to have to drop
    health-care plans altogether because they cannot afford them is
    also unacceptable.
        So I understand our staffs--Senator Brown's staff and
    mine--have been working to try to find some sort of solution so
    that these advance monthly payment programs can get up and
    running by July. We have been having discussions about
    alternative methods of administering the advance monthly
    payment system so they are ready to go by July, as required by
    law.
        I would just ask today, Mr. Commissioner, that, as you have
    in the past on some issues, you get personally involved in this
    and help us to work out an arrangement so that we can be sure
    that we do not have an unacceptable result.
        Commissioner Koskinen. I have actually been personally
    involved since it was passed, because it is a critical program,
    and one of our obligations, we feel, is a high commitment to
    implement statutory mandates.
        As we advised people when they were considering this, the
    last time the program was initiated, we got a $74-million
    appropriation to go with it, and that allowed us to hire a
    contractor to set the program up, and it ran well.
        This time, we got no money, but we said, we are going to
    work to do our best. The reason we did not notify people until
    the 1st of March was, we worked very hard trying to see if, in
    addition to allowing people, which they can, to file in 2014
    and 2015 for reimbursement, we could get the advance payment up
    and running, and as soon as we figured out that we would not be
    able to be up in June, we notified you and everyone else.
        But I understand. Your points are well taken, and we do not
    take them lightly. If there were a way to do it, we would.
        I would say in addition to the $74 million, the last time
    the program was set up, it took 2 years. If we can get it up
    and running by January--and we are committed to doing that--it
    will be a year and a half. So without any funding at all, we
    will be 6 months faster than the last time.
        But your point is still valid. It does not necessarily help
    people who are, in fact, waiting for those payments. The fact
    that we will reimburse them after the fact is still a burden
    for them, and we regret that.
        We are delighted to work with you and Senator Brown to find
    any way to get there before January, but we have to build
    systems to make payments. We normally do not make monthly
    payments. So we have no system to do it.
        We can do the credit at the end of the year, because we
    give credits, which is why we could get 2014 and 2015 up and
    running. But we are delighted to work with you. We recognize
    that this is a burden on a number of people who have had a lot
    of other problems as well.
        Senator Portman. Well, it is a burden. Again, Mr. Chairman,
    thank you for your indulgence. But nothing you have said
    explains to me why we wait until March, mid-March of 2016, to
    tell people that these life-altering decisions that they made
    are not going to work out for them and they have to now find
    some alternative, which, in many cases, is going to mean,
    again, they are not going to have health-care coverage that
    they fully expected under law.
        So I do hope that you will instead work with Senator
    Brown's staff and my staff to come up with an acceptable
    solution so that we can get these people some sort of coverage
    through this advance health-care payment.
        Commissioner Koskinen. I would do that. The reason it took
    until February is, we actually made a good faith effort to see
    if we could get it done. We thought there was one possibility
    we could get it up and running. We worked on that and finally
    decided in February that the IT systems just would not be
    ready. But it was not because we did not care about it. It was
    because we were actually trying to see if we could make the
    one-year deadline. But we will work with you. We are delighted
    to do that.
        The Chairman. Senator Nelson?
        Senator Nelson. Thank you, Mr. Chairman.
        Mr. Commissioner, you were kind enough to respond to my
    March letter on April 1st. I hope that it was not an April
    fool's joke. But here was one of the questions in the letter,
    and let me read to you your office's response to me, and I need
    a clarification.
        The question was, under 26 CFR 1.501(c)(4)-1, the promotion
    of social welfare does not include direct or indirect
    participation or intervention in political campaigns on behalf
    or in opposition to any candidate for public office.
        Given these requirements, please provide examples, Mr.
    Commissioner, of when it is permissible for 501(c)(4),
    501(c)(5), or 501(c)(6) organizations to run ads supporting or
    attacking the positions of a candidate for elected office.
    Please provide examples of when this activity would be
    impermissible.
        Now, I know this is a delicate subject, especially in front
    of the chairman and those of us over here. This was your
    answer, and I think it is quite clear, quote: ``Unlike section
    501(c)(3) charitable organizations, organizations described in
    section 501(c)(4), 501(c)(5), and 501(c)(6) are not prohibited
    from engaging in political campaign intervention. However,
    section 501(c) organizations that engage in political campaign
    intervention may be subject to tax under 527(f) on their exempt
    function expenditures. Whether an organization is engaged in
    political campaign intervention depends upon all the facts and
    circumstances of each case.
        ``Revenue ruling'' such-and-such ``2004-6 provides six
    examples illustrating facts and circumstances to be considered
    in determining whether a section 501(c) organization that
    engages in public policy advocacy has expended funds for a
    section 527 exempt function; that is, influencing or attempting
    to influence the selection, nomination, election, or
    appointment of any individual to public office.''
        The final couple of sentences read: ``Revenue ruling 2007-
    41 provides an additional 21 examples illustrating facts and
    circumstances to be considered in determining whether a
    501(c)(3) organization's activities result in political
    campaign intervention. The analysis reflected in these revenue
    rulings for determining whether an organization has engaged in
    political campaign intervention or has expended funds for a
    section 527 exempt function is fact-intensive. A copy of both
    revenue rulings is enclosed with this letter.''
        That was a very extensive answer, and I want you to know I
    appreciate it.
        Now, here is the clarification that I need, please. So if
    that is the case, and if the IRS is really enforcing the law,
    how much tax revenue have you collected for political
    expenditures of 501(c)(4) groups this year or last year--or any
    year?
        I fully do not expect you to have that on the top of your
    head, but I would like you to give the answer to this member of
    the committee.
        Commissioner Koskinen. I carry around a lot of numbers in
    my head, but that is not one of them, as you suspected.
        Senator Nelson. Understandably.
        Commissioner Koskinen. Yes. We will be delighted to get you
    that information as quickly as we can, because it is important
    and we should be able to answer quickly.
        Senator Nelson. That is great. Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator Nelson.
        Senator Cantwell?
        Senator Cantwell. Thank you, Mr. Chairman. I thank the
    Senator for his work on this issue.
        I wanted to ask of the Commissioner, one of the issues that
    I think all government faces is the shortage of highly skilled
    IT personnel, and we previously had support that would allow
    you to streamline the pay and authority so that you could get
    the skill level that you need.
        My understanding is, though, that this legislative
    authority has expired and we need to re-legislate that
    streamlined authority so that you can have the critical pay.
        So how much is this affecting us in getting the workers
    that we need at the IRS?
        Commissioner Koskinen. Well, it is a significant challenge
    for us. We have only 13 or 14 people left. There were 40 slots.
    We never used more than 34 of that. There are 13 or 14 left; 10
    are senior IT people working on cybersecurity, online services.
        By this time next year, they will all be gone. Replacing
    them is very challenging for us at the IRS, although a lot of
    people want to come to us because we have very interesting
    challenges.
        IT people, high-level people, are in great demand, and
    putting them through the hiring process--we find you, we like
    you, yet you get to wait for 3 to 6 months while we put you
    through an application process. Our people are being recruited
    every day. Those people whom we are recruiting are being
    recruited every day.
        So saying, ``We really like you; we would like you to come
    work; sit still for 3 to 6 months, and we will get back to
    you,'' does not work. And so our concern is--and it is a
    serious concern--in the areas of information technology
    particularly, where we are talking about attracting the best in
    the country, without the authority--and we have not had it
    since 2013--it has made it almost impossible for us to recruit
    and retain at the level that we need to.
        Senator Cantwell. Is this affecting cybersecurity at the
    IRS?
        Commissioner Koskinen. Our head of cybersecurity left
    recently rather than wait until his term ran out. The reason it
    is four plus two would allow us, for the people remaining, to
    have 2 years to, in fact, replace them as we go forward. But it
    is a critical need. It is not a major expenditure. It is not a
    lot of people. But it is critical to us, because it is focused
    on an area of high need for us.
        Senator Cantwell. Well, the competition for people
    knowledgeable in cybersecurity in general is very high, and IT
    still also remains very high.
        So the fact is that, even in an ``I can hire you tomorrow''
    environment, you are facing very, very stiff competition.
        So I think, Mr. Chairman, this legislation--I think it
    keeps getting delayed or postponed based on markup, or maybe it
    is going to be on the next legislative schedule--it is really
    important for us to make sure that we have the flexibility.
        I think the issue for all of our government is to continue
    to make sure that we have the best technology people, which is
    challenging for a whole lot of reasons. But I think that this
    authority to help you streamline that hiring and pay is
    something that we need to do as quickly as possible. So thank
    you.
        Thank you, Mr. Chairman.
        Commissioner Koskinen. Thank you, Senator.
        The Chairman. I thank all of you for appearing here today.
    I also want to thank my colleagues for their participation.
        Considering that tax day is just a few days away, I hope
    this hearing has helped us better understand the current
    environment for all taxpayers, and I hope to continue working
    with my colleagues from both sides of the aisle as we continue
    to examine ways to improve cybersecurity and better protect
    taxpayer information at the IRS.
        I would ask that any questions for the record be submitted
    by Tuesday, April 26, 2016, and if you folks could get your
    answers back to us promptly, it would be very meaningful to us.
        So with that, we will recess until further notice.
        [Whereupon, at 11:54 a.m., the hearing was concluded.]

                                A P P E N D I X

                  Additional Material Submitted for the Record

                                  ----------

     Prepared Statement of Hon. Gene L. Dodaro, Comptroller General of the
                United States, Government Accountability Office

                                  GAO-16-589T

                                 April 12, 2016

                              INFORMATION SECURITY

     IRS Needs to Further Improve Controls Over Taxpayer Data and Continue
                     to Combat Identity Theft Refund Fraud

                                 what gao found
        In March 2016, GAO reported that the Internal Revenue Service (IRS)
    had instituted numerous controls over key financial and tax processing
    systems; however, it had not always effectively implemented other
    controls intended to properly restrict access to systems and
    information, among other security measures. In particular, while IRS
    had improved some of its access controls, weaknesses remained in key
    controls for identifying and authenticating users, authorizing users'
    level of rights and privileges, encrypting sensitive data, auditing and
    monitoring network activity, and physically securing facilities housing
    its information technology resources. These weaknesses were due in part
    to IRS's inconsistent implementation of its
    agency-wide security program, including not fully implementing prior
    GAO recommendations. GAO concluded that these weaknesses collectively
    constituted a significant deficiency for the purposes of financial
    reporting for fiscal year 2015. As a result, taxpayer and financial
    data continue to be exposed to unnecessary risk.

        Identity theft refund fraud also poses a significant challenge. IRS
    estimates it paid $3.1 billion in these fraudulent refunds in filing
    season 2014, while preventing $22.5 billion (see figure). The full
    extent is unknown because of the challenges inherent in detecting this
    form of fraud.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        IRS has taken steps to combat identity theft refund fraud such as
    improving phone service for taxpayers to report suspected identity
    theft and working with industry, States, and financial institutions to
    detect and prevent it. However, as GAO reported in August 2014 and
    January 2015, additional actions can further assist the agency in
    addressing this crime, including pre-refund matching of taxpayer
    returns with information returns from employers, and assessing the
    costs, benefits, and risks of improving methods for authenticating
    taxpayers. In addition, the Consolidated Appropriations Act 2016
    includes a provision that would help IRS with pre-refund matching and
    also includes an additional $290 million to enhance cybersecurity,
    combat identity theft refund fraud, and improve customer service.

        According to IRS and industry partners, the 2016 filing season has
    generally gone smoothly, with about 95 million returns and $215 billion
    in refunds processed through April 1, 2016. In addition, IRS increased
    its level of phone service to taxpayers, although it has not developed
    a comprehensive strategy for customer service as GAO recommended in
    December 2015.
    _______________________________________________________________________

        Chairman Hatch, Ranking Member Wyden, and members of the committee:

        Thank you for the opportunity to testify on cybersecurity and
    protecting taxpayer information. As taxpayers file their returns for
    2015, it is especially important that the Internal Revenue Service
    (IRS) ensure that adequate protections are in place to secure the
    sensitive information entrusted to the agency by members of the public.

        The Federal Government faces an evolving array of cyber-based
    threats to its systems and data. Reported incidents and data breaches
    at Federal agencies, including IRS, have affected millions of people
    through the compromise of sensitive personal information and underscore
    the continuing and urgent need for effective information security. We
    initially designated Federal information security as a government-wide
    high-risk area in 1997, and in 2003 we expanded this area to include
    computerized systems supporting the Nation's critical infrastructure.
    In 2015 we added the protection of personally identifiable information
    (PII)\1\ that is collected, maintained, and shared by both Federal and
    nonfederal entities.\2\
    ---------------------------------------------------------------------------
        \1\ PII is information about an individual, including information
    that can be used to distinguish or trace their identity, such as name,
    Social Security number, mother's maiden name, or biometric records, as
    well as any other personal information that is linked or linkable to an
    individual.
        \2\ See GAO, High-Risk Series: An Update, GAO-15-290 (Washington,
    DC: Feb. 11, 2015).

        In carrying out its mission to collect taxes, process tax returns,
    and enforce U.S. tax laws, IRS relies extensively on computerized
    systems and on information security controls to protect the
    confidentiality, integrity, and availability of sensitive personal and
    financial information for each U.S. taxpayer. Recent information
    security incidents at IRS further highlight the importance of ensuring
    ---------------------------------------------------------------------------
    that these controls are effectively implemented.

        As you know, the filing season is the time when most taxpayers
    interact with IRS. As in previous years, a major challenge during the
    filing season is protecting taxpayers' information and addressing
    identity theft (IDT) refund fraud, which occurs when a refund-seeking
    fraudster obtains an individual's Social Security number, date of
    birth, or other PII and uses it to file a fraudulent tax return seeking
    a refund.\3\ This crime burdens honest taxpayers because authenticating
    their identities is likely to delay processing their returns and
    refunds. Moreover, the victim's PII can potentially be used to commit
    other crimes. Given current and emerging risks, in 2015 we expanded the
    enforcement of our tax laws high-risk area to include IRS's efforts to
    address IDT refund fraud.\4\
    ---------------------------------------------------------------------------
        \3\ This statement discusses IDT refund fraud and not employment
    fraud. IDT employment fraud occurs when an identity thief uses a
    taxpayer's name and Social Security number to obtain a job.
        \4\ GAO-15-290.

        My statement today focuses on opportunities to assist IRS in
    addressing (1) information security weaknesses we have identified and
    (2) the challenge of identity theft refund fraud. I will also discuss
    ---------------------------------------------------------------------------
    the status of selected IRS filing season operations.

        Within the context of my testimony, it is important to note that,
    for fiscal year 2016, IRS received about $290 million in additional
    funding to support these areas. Specifically, the funding was intended
    to improve customer service, IDT identification and prevention, and
    cybersecurity efforts.\5\ According to IRS's spending plan this funding
    will be used to invest in (1) increased telephone level of service,
    including reduced wait times and improved performance on IRS's Taxpayer
    Protection Program/Identity Theft Toll Free Line ($178.4 million); (2)
    cybersecurity including network security improvements, protection from
    unauthorized access, and enhanced insider threat detection ($95.4
    million); and (3) IDT refund fraud prevention ($16.1 million).
    ---------------------------------------------------------------------------
        \5\ Consolidated Appropriations Act, 2016, Pub. L. No. 114-113,
    div. E, Sec. 113, 129 Stat. 2242 (Dec. 18, 2015).

        My statement is based in part on our previous reports issued
    between August 2014 and March 2016. We updated selected data in this
    statement with 2016 data from IRS on individual income tax return
    processing and telephone service, as well as IRS's fiscal year 2016
    spending plan for the additional $290 million in appropriated funds. We
    also incorporated IRS statements on recent data breaches and IRS
    actions to address our past recommendations. To assess data
    reliability, we reviewed IRS data and documentation and assessed
    documentation for data limitations. We found the data to be
    sufficiently reliable for our purposes. All the work on which this
    statement is based was conducted in accordance with generally accepted
    government auditing standards. Those standards require that we plan and
    perform audits to obtain sufficient, appropriate evidence to provide a
    reasonable basis for our findings and conclusions based on our audit
    objectives. We believe that the evidence obtained provides a reasonable
    basis for our findings and conclusions based on our audit objectives.
                                   background
        IRS's mission is to provide America's taxpayers top-quality service
    by helping them to understand and meet their tax responsibilities and
    to enforce the law with integrity and fairness to all. During fiscal
    year 2015, IRS collected more than $3.3 trillion; processed more than
    243 million tax returns and other forms; and issued more than $403
    billion in tax refunds. IRS employs about 90,000 people in its
    Washington, DC, headquarters and at more than 550 offices in all 50
    States, U.S. territories, and some U.S. embassies and consulates. Each
    filing season IRS provides assistance to tens of millions of taxpayers
    over the phone, through written correspondence, online, and face-to-
    face. The scale of these operations alone presents challenges.

        In carrying out its mission, IRS relies extensively on computerized
    information systems, which it must effectively secure to protect
    sensitive financial and taxpayer data for the collection of taxes,
    processing of tax returns, and enforcement of Federal tax laws.
    Accordingly, it is critical for IRS to effectively implement
    information security controls and an agency-wide information security
    program in accordance with Federal law and guidance.\6\
    ---------------------------------------------------------------------------
        \6\ In particular, the Federal Information Security Modernization
    Act of 2014 (FISMA), among other things, requires the head of each
    agency to provide information security protections commensurate with
    the risk and magnitude of harm resulting from unauthorized access, use,
    disclosure, disruption, modification, or destruction of the agency's
    information or information systems. Pub. L. No. 113-283, Sec. 2(a), 128
    Stat. 3074 (Dec. 18, 2014), codified at 44 U.S.C. Sec. 3554(a).

        Cyber incidents can adversely affect national security, damage
    public health and safety, and compromise sensitive information.
    Regarding IRS specifically, two recent incidents illustrate the impact
    ---------------------------------------------------------------------------
    on taxpayer and other sensitive information:

          In June 2015, the Commissioner of the IRS testified that
    unauthorized third parties had gained access to taxpayer information
    from its Get Transcript application.\7\ According to officials,
    criminals used taxpayer-specific data acquired from non-department
    sources to gain unauthorized access to information on approximately
    100,000 tax accounts. These data included Social Security information,
    dates of birth, and street addresses. In an August 2015 update, IRS
    reported this number to be about 114,000, and that an additional
    220,000 accounts had been inappropriately accessed. In a February 2016
    update, the agency reported that an additional 390,000 accounts had
    been accessed. Thus, about 724,000 accounts were reportedly affected.
    The online Get Transcript service has been unavailable since May 2015.
    ---------------------------------------------------------------------------
        \7\ This application provides users, via the IRS website, the
    ability to view, print, and download tax account, tax return, and
    record of account transcripts; wage and income documents; and proof of
    non-filing transcripts.

          In March 2016, IRS stated that as part of its ongoing security
    review, it had temporarily suspended the Identity Protection Personal
    Identification Number (IP PIN) service on IRS.gov. The IP PIN is a
    single-use identification number provided to taxpayers who are victims
    of identity theft (IDT) to help prevent future IDT refund fraud.\8\ The
    service on IRS's website allowed taxpayers to retrieve their IP PINs
    online by passing IRS's authentication checks. These checks confirm
    taxpayer identity by asking for personal, financial and tax-
    related information. The IRS stated that it was conducting further
    review of the IP PIN service and is looking at further strengthening
    the security features before resuming service. As of April 7, the
    online service was still suspended.
    ---------------------------------------------------------------------------
        \8\ In January 2014, IRS offered a limited IP PIN pilot program to
    eligible taxpayers in Florida, Georgia, and the District of Columbia.
    Taxpayers must confirm their identities with IRS to receive an IP PIN.
    IP PINs help prevent future IDT refund fraud because, once issued, the
    IP PIN must accompany their electronically filed tax return or else IRS
    will reject the return. If a paper return has a missing or incorrect IP
    PIN, IRS delays processing the return while the agency determines if it
    was filed by the legitimate taxpayer. See GAO, Identity Theft:
    Additional Actions Could Help IRS Combat the Large, Evolving Threat of
    Refund Fraud, GAO-14-633 (Washington, DC: Aug. 20, 2014), for more
    details on IRS's IP PIN service.

        The Commissioner of Internal Revenue has overall responsibility for
    ensuring the confidentiality, integrity, and availability of the
    information and systems that support the agency and its operations.
    Within IRS, the senior agency official responsible for information
    security is the Associate CIO, who heads the IRS Information Technology
    Cybersecurity organization.
      although irs has made improvements, information security weaknesses
             continue to place taxpayer and financial data at risk
        As we reported in March 2016,\9\ IRS has implemented numerous
    controls over key financial and tax processing systems; however, it had
    not always effectively implemented access and other controls,\10\
    including elements of its information security program.
    ---------------------------------------------------------------------------
        \9\ GAO, Information Security: IRS Needs to Further Improve
    Controls Over Financial and Taxpayer Data, GAO-16-398 (Washington, DC:
    Mar. 28, 2016).
        \10\ Information security controls include logical and physical
    access controls, configuration management, and continuity of
    operations. These controls are designed to ensure that access to data
    is properly restricted, physical access to sensitive computing
    resources and facilities is protected, systems are securely configured
    to avoid exposure to known vulnerabilities, and backup and recovery
    plans are adequate and tested to ensure the continuity of essential
    operations.

        Access controls are intended to prevent, limit, and detect
    unauthorized access to computing resources, programs, information, and
    facilities. These controls include identification and authentication,
    authorization, cryptography, audit and monitoring, and physical
    security controls, among others. In our most recent review we found
    ---------------------------------------------------------------------------
    that IRS had improved access controls, but some weaknesses remain.

          Identifying and authenticating users--such as through user
    account-password combinations--provides the basis for establishing
    accountability and controlling access to a system. IRS established
    policies for identification and authentication, including requiring
    multifactor authentication \11\ for local and network access accounts
    and establishing password complexity and expiration requirements. It
    also improved identification and authentication controls by, for
    example, expanding the use of an automated mechanism to centrally
    manage, apply, and verify password requirements. However, weaknesses in
    identification and authentication controls remained. For example, the
    agency used easily guessable passwords on servers supporting key
    systems.
    ---------------------------------------------------------------------------
        \11\ Multifactor authentication involves using two or more factors
    to achieve authentication. Factors include something you know (password
    or personal identification number), something you have (cryptographic
    identification device or token), or something you are (biometric).

          Authorization controls limit what actions users are able to
    perform after being allowed into a system and should be based on the
    concept of ``least privilege,'' granting users the least amount of
    rights and privileges necessary to perform their duties. While IRS
    established policies for authorizing access to its systems, it
    continued to permit excessive access in some cases. For example, users
    were granted rights and permissions in excess of what they needed to
    perform their duties, including for an application used to process
    electronic tax payment information and a database on a human resources
    ---------------------------------------------------------------------------
    system.

          Cryptography controls protect sensitive data and computer
    programs by rendering data unintelligible to unauthorized users and
    protecting the integrity of transmitted or stored data. IRS policies
    require the use of encryption and it continued to expand its use of
    encryption to protect sensitive data. However, key systems we reviewed
    had not been configured to encrypt sensitive user authentication data.

          Audit and monitoring is the regular collection, review, and
    analysis of events on systems and networks in order to detect, respond
    to, and investigate unusual activity. IRS established policies and
    procedures for auditing and monitoring its systems and continued to
    enhance its capability by, for example, implementing an automated
    mechanism to log user activity on its access request and approval
    system. But it had not established logging for two key applications
    used to support the transfer of financial data and access and manage
    taxpayer accounts; nor was the agency consistently maintaining key
    system and application audit plans.

          Physical security controls, such as physical access cards, limit
    access to an organization's overall facility and areas housing
    sensitive IT components. IRS established policies for physically
    protecting its computer resources and physical security controls at its
    enterprise computer centers, such as a dedicated guard force at each of
    its computer centers. However, the agency had yet to address weaknesses
    in its review of access lists for both employees and visitors to
    sensitive areas.

        IRS also had weaknesses in configuration management controls, which
    are intended to prevent unauthorized changes to information system
    resources (e.g., software and hardware) and provide assurance that
    systems are configured and operating securely. Specifically, while IRS
    developed policies for managing the configuration of its information
    technology (IT) systems and improved some configuration management
    controls, it did not, for example, ensure security patch updates were
    applied in a timely manner to databases supporting 2 key systems we
    reviewed, including a patch that had been available since August 2012.

        To its credit, IRS had established contingency plans for the
    systems we reviewed, which help ensure that when unexpected events
    occur, critical operations can continue without interruption or can be
    promptly resumed, and that information resources are protected.
    Specifically, IRS had established policies for developing contingency
    plans for its information systems and for testing those plans, as well
    as for implementing and enforcing backup procedures. Moreover, the
    agency had documented and tested contingency plans for its systems and
    improved continuity of operations controls for several systems.

        Nevertheless, the control weaknesses can be attributed in part to
    IRS's inconsistent implementation of elements of its agency-wide
    information security program. The agency established a comprehensive
    framework for its program, including assessing risk for its systems,
    developing system security plans, and providing employees with security
    awareness and specialized training. However, IRS had not updated key
    mainframe policies and procedures to address issues such as
    comprehensively auditing and monitoring access.

        In addition, the agency had not fully addressed previously
    identified deficiencies or ensured that its corrective actions were
    effective. During our most recent review, IRS told us it had addressed
    28 of our prior recommendations; however, we determined that 9 of these
    had not been effectively implemented.

        The collective effect of the deficiencies in information security
    from prior years that continued to exist in fiscal year 2015, along
    with the new deficiencies we identified, are serious enough to merit
    the attention of those charged with governance of IRS and therefore
    represented a significant deficiency in IRS's internal control over
    financial reporting systems as of September 30, 2015.\12\
    ---------------------------------------------------------------------------
        \12\ A significant deficiency is a deficiency, or a combination of
    deficiencies, in internal control that is less severe than a material
    weakness, yet important enough to merit the attention of those charged
    with governance. A material weakness is a deficiency, or combination of
    deficiencies, in internal control such that there is a reasonable
    possibility that a material misstatement of the entity's financial
    statements will not be prevented, or detected and corrected, on a
    timely basis. A deficiency in internal control exists when the design
    or operation of a control does not allow management or employees, in
    the normal course of performing their assigned functions, to prevent,
    or detect and correct, misstatements on a timely basis.
    ---------------------------------------------------------------------------
    Implementing GAO Recommendations Can Help IRS Better Protect Sensitive
            Taxpayer and Financial Data
        To assist IRS in fully implementing its agency-wide information
    security program, we made two new recommendations to more effectively
    implement security-related policies and plans. In addition, to assist
    IRS in strengthening security controls over the financial and tax
    processing systems we reviewed, we made 43 technical recommendations in
    a separate report with limited distribution to address 26 new
    weaknesses in access controls and configuration management.\13\
    ---------------------------------------------------------------------------
        \13\ GAO, Information Security: IRS Needs to Further Improve
    Controls Over Financial and Taxpayer Data, GAO-16-397SU (Washington,
    DC: Mar. 28, 2016).

        Implementing these recommendations--in addition to the 49
    outstanding recommendations from previous audits--will help IRS improve
    its controls for identifying and authenticating users, limiting users'
    access to the minimum necessary to perform their job-related functions,
    protecting sensitive data when they are stored or in transit, auditing
    and monitoring system activities, and physically securing its IT
    ---------------------------------------------------------------------------
    facilities and resources.

        Table 1 below provides the number of our prior recommendations to
    IRS that were not implemented at the beginning of our fiscal year 2015
    audit, how many were resolved by the end of the audit, new
    recommendations, and the total number of outstanding recommendations at
    the conclusion of the audit.

       Table 1: Status of GAO's Information Security Recommendations at the PConclusion of Fiscal Year 2015 Audit
    ----------------------------------------------------------------------------------------------------------------
                                      Prior       Recommendations       Prior                             Total
                                 recommendations   implemented or  recommendations        New          outstanding
                                 not implemented   considered no      not fully     recommendations  recommendations
            Control area              at the      longer relevant   implemented at    made during         at the
                                   beginning of    at the end of      the end of      fiscal year     conclusion of
                                   fiscal year      fiscal year      fiscal year       2015 audit      fiscal year
                                    2015 audit       2015 audit       2015 audit                        2015 audit
    ----------------------------------------------------------------------------------------------------------------
    Information security                      12                3                9                2               11
     program
    ----------------------------------------------------------------------------------------------------------------
    Access controls
    ----------------------------------------------------------------------------------------------------------------
        Identification and                     6                1                5                9               14
         authentication
    ----------------------------------------------------------------------------------------------------------------
        Authorization                         10                4                6               12               18
    ----------------------------------------------------------------------------------------------------------------
        Cryptography                           8                3                5               14               19
    ----------------------------------------------------------------------------------------------------------------
        Audit and monitoring                   6                1                5                3                8
    ----------------------------------------------------------------------------------------------------------------
        Physical Security                      4                2                2                0                2
    ----------------------------------------------------------------------------------------------------------------
    Other security controls
    ----------------------------------------------------------------------------------------------------------------
        Configuration                         21                5               16                5               21
         management
    ----------------------------------------------------------------------------------------------------------------
        Segregation of duties                  1                0                1                0                1
    ----------------------------------------------------------------------------------------------------------------
        Contingency planning                   2                2                0                0                0
    ----------------------------------------------------------------------------------------------------------------
    Total:                                    70               21               49               45               94
    ----------------------------------------------------------------------------------------------------------------
    Source: GAO analysis of IRS data. | GAO-16-589T

        In commenting on drafts of our reports presenting the results of
    our fiscal year 2015 audit, the IRS Commissioner stated that while the
    agency agreed with our new recommendations, it will review them to
    ensure that its actions include sustainable fixes that implement
    appropriate security controls balanced against IT and human capital
    resource limitations.

        In addition, IRS can take steps to improve its response to data
    breaches. Specifically, in December 2013 we reported on the extent to
    which data breach policies at eight agencies, including IRS, adhered to
    requirements and guidance set forth by the Office of Management and
    Budget and the National Institute of Standards and Technology.\14\
    While the agencies in our review generally had policies and procedures
    in place that reflected the major elements of an effective data breach
    response program, implementation of these policies and procedures was
    not consistent. With respect to IRS, we determined that its policies
    and procedures generally reflected key practices, although the agency
    did not require considering the number of affected individuals as a
    factor when determining if affected individuals should be notified of a
    suspected breach. In addition, IRS did not document lessons learned
    from periodic analyses of its breach response efforts. We recommended
    that IRS correct these weaknesses, but the agency has yet to fully
    address them.
    ---------------------------------------------------------------------------
        \14\ GAO, Information Security: Agency Responses to Breaches of
    Personally Identifiable Information Need to Be More Consistent, GAO-14-
    34 (Washington, DC: Dec. 9, 2013).
    ---------------------------------------------------------------------------
     billions of dollars have been lost to idt refund fraud, and irs faces
                  challenges in combating this evolving threat
        The importance of protecting taxpayer information is further
    highlighted by the billions of dollars that have been lost to IDT
    refund fraud, which continues to be an evolving threat. IRS develops
    estimates of the extent of IDT refund fraud to help direct its efforts
    to identify and prevent the crime. While its estimates have inherent
    uncertainty, IRS estimated that it prevented or recovered $22.5 billion
    in fraudulent IDT refunds in filing season 2014 (see figure 1).\15\
    However, IRS also estimated, where data were available, that it paid
    $3.1 billion in fraudulent IDT refunds. Because of the difficulties in
    knowing the amount of undetectable fraud, the actual amount could
    differ from these estimates.
    ---------------------------------------------------------------------------
        \15\ IRS's 2014 estimates cannot be compared to 2013 estimates
    because of substantial methodology changes to better reflect new IDT
    refund fraud schemes and to improve the accuracy of its estimates,
    according to IRS officials. GAO is reviewing IRS's IDT refund fraud
    estimates as part of ongoing work.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        IRS has taken steps to address IDT refund fraud; however, it
    remains a persistent and continually changing threat. IRS recognized
    the challenge of IDT refund fraud in its fiscal year 2014-2017
    strategic plan and increased resources dedicated to combating IDT and
    other types of refund fraud.\16\ In fiscal year 2015, IRS reported that
    it staffed more than 4,000 full-time equivalents and spent about $470
    million on all refund fraud and IDT activities.\17\ As described above,
    IRS received an additional $290 million for fiscal year 2016 to improve
    customer service, IDT identification and prevention, and cybersecurity
    efforts and the agency plans to use $16.1 million of this funding to
    help prevent IDT refund fraud, among other things. The administration
    requested an additional $90 million and an additional 491 full-time
    equivalents for fiscal year 2017 to help prevent IDT refund fraud and
    reduce other improper payments.\18\ IRS estimates that this $90 million
    investment in IDT refund fraud and other improper payment prevention
    would help it protect $612 million in revenue in fiscal year 2017, as
    well as protect revenue in future years.
    ---------------------------------------------------------------------------
        \16\ IRS, Strategic Plan: FY 2014-2017, (Washington, DC: June
    2014).
        \17\ IRS officials told us they do not track spending for identity
    theft activities separately from other types of refund fraud. A full-
    time equivalent reflects the total number of regular straight-time
    hours (i.e., not including overtime or holiday hours) worked by
    employees divided by the number of compensable hours applicable to each
    fiscal year.
        \18\ Improper payments are payments that should not have been made
    or that were made in an incorrect amount (including overpayments and
    underpayments).

        IRS has taken action to improve customer service related to IDT
    refund fraud. For example, between the 2011 and 2015 filing seasons,
    IRS experienced a 430 percent increase in the number of telephone calls
    to its Identity Theft Toll Free Line--as of March 19, 2016, IRS had
    received over 1.1 million calls to this line.\19\ Moreover, 77 percent
    of callers seeking assistance on this telephone line received it
    compared to 54 percent during the same period last year. Average wait
    times during the same period have also decreased--taxpayers are waiting
    an average of 14 minutes to talk to an assistor, a decrease from 27
    minutes last year.
    ---------------------------------------------------------------------------
        \19\ Total call volume to IRS's identity theft protection toll free
    telephone line includes automated and assistor calls answered, as well
    as those that received a busy signal or were abandoned or disconnected.

        IRS also works with third parties, such as tax preparation industry
    participants, States, and financial institutions to try to detect and
    prevent IDT refund fraud. In March 2015, the IRS Commissioner convened
    a Security Summit with industry and States to improve information
    sharing and authentication. IRS officials said that 40 State
    departments of revenue and 20 tax industry participants have officially
    signed a partnership agreement to enact recommendations developed and
    agreed to by summit participants. IRS plans to invest a portion of the
    $16.1 million it received in fiscal year 2016 into identity theft
    prevention and refund fraud mitigation actions from the Security
    Summit. These efforts include developing an Information Sharing and
    Analysis Center where IRS, States, and industry can share information
    ---------------------------------------------------------------------------
    to combat IDT refund fraud.

        Even though IRS has prioritized combating IDT refund fraud,
    fraudsters adapt their schemes to identify weaknesses in IDT defenses,
    such as gaining access to taxpayers' tax return transcripts through
    IRS's online Get Transcript service.\20\ According to IRS officials,
    with access to tax transcripts, fraudsters can create historically
    consistent returns that are hard to distinguish from a return filed by
    a legitimate taxpayer, potentially making it more difficult for IRS to
    identify and detect IDT refund fraud.
    ---------------------------------------------------------------------------
        \20\ As mentioned above, the online Get Transcript service has been
    unavailable since May 2015.

    Implementing Past GAO Recommendations Could Help IRS Combat IDT Refund
            Fraud
        Without additional action by IRS and Congress, the risk of issuing
    fraudulent IDT refunds could grow. We previously made recommendations
    to IRS to help it better combat IDT refund fraud:

          Authentication. In January 2015, we reported that IRS's
    authentication tools have limitations and recommended that IRS assess
    the costs, benefits and risks of its authentication tools.\21\ For
    example, individuals can obtain an e-file PIN by providing their name,
    Social Security number, date of birth, address, and filing status for
    IRS's e-file PIN application. Identity thieves can easily find this
    information, allowing them to bypass some, if not all, of IRS's
    automatic checks, according to our analysis and interviews with tax
    software and return preparer associations and companies. After filing
    an IDT return using an e-file PIN, the fraudulent return would proceed
    through IRS's normal return processing.
    ---------------------------------------------------------------------------
        \21\ GAO, Identity Theft and Tax Fraud: Enhanced Authentication
    Could Combat Refund Fraud but IRS Lacks an Estimate of Costs, Benefits
    and Risks, GAO-15-119, (Washington, DC: Jan. 20, 2015).

           In November 2015, IRS officials told us that the agency had
    developed guidance for its Identity Assurance Office to assess costs,
    benefits, and risk, and that its analysis will inform decision-making
    on authentication-related issues. IRS also noted that the methods of
    analysis for the authentication tools will vary depending on the
    different costs and other factors for authenticating taxpayers in
    different channels, such as online, phone, or in-person. In February
    2016, IRS officials told us that the Identity Assurance Office plans to
    complete a strategic plan for taxpayer authentication across the agency
    in September 2016. While IRS is taking steps, it will still be
    vulnerable until it completes and uses the results of its analysis of
    ---------------------------------------------------------------------------
    costs, benefits, and risk to inform decision-making.

          Form W-2, Wage and Tax Statement (W-2) Pre-refund Matching. In
    August 2014 we reported that the wage information that employers report
    on Form W-2 is not available to IRS until after it issues most refunds,
    and that if IRS had access to W-2 data earlier, it could match such
    information to taxpayers' returns and identify discrepancies before
    issuing billions of dollars of fraudulent IDT refunds.\22\ We
    recommended that IRS assess the costs and benefits of accelerating W-2
    deadlines.
    ---------------------------------------------------------------------------
        \22\ GAO, Identity Theft: Additional Actions Could Help IRS Combat
    the Large, Evolving Threat of Refund Fraud, GAO-14-633 (Washington, DC:
    Aug. 20, 2014).

        In response to our recommendation, IRS provided us with a report in
    September 2015 discussing (1) adjustments to IRS systems and work
    processes needed to use accelerated W-2 information, (2) the potential
    impacts on internal and external stakeholders, and (3) other changes
    needed to match W-2 data to tax returns prior to issuing refunds, such
    as delaying refunds until W-2 data are available. In December 2015, the
    Consolidated Appropriations Act of 2016 amended the tax code to
    accelerate W-2 filing deadlines to January 31.\23\ IRS's report will
    help IRS determine how to best implement pre-refund W-2 matching, given
    the new January 31st deadline for filing W-2s. Additionally, we
    suggested that Congress should consider providing the Secretary of the
    Treasury with the regulatory authority to lower the threshold for
    electronic filing of W-2s, which could make more W-2 information
    available to IRS earlier.
    ---------------------------------------------------------------------------
        \23\ Pub. L. No. 114-113, div. Q, Sec. 201, 129 Stat. 2242 (Dec.
    18, 2015). This change goes into effect for W-2s reporting payments
    made in 2016 and filed in 2017.

          External Leads. IRS partners with financial institutions and
    other external parties to obtain information about emerging IDT refund
    trends and fraudulent returns that have passed through IRS detection
    systems. In August 2014, we reported that IRS provides limited feedback
    to external parties on IDT external leads they submit and offers
    external parties limited general information on IDT refund fraud trends
    and recommended that IRS provide actionable feedback to all lead
    generating third parties.\24\
    ---------------------------------------------------------------------------
        \24\ GAO-14-633.

           In November 2015, IRS reported that it had developed a database
    to track leads submitted by financial institutions and the results of
    those leads. IRS also stated that it had held two sessions with
    financial institutions to provide feedback on external leads provided
    to IRS. In December 2015, IRS officials stated that the agency sent a
    customer satisfaction survey asking financial institutions for feedback
    on the external leads process and was considering other ways to provide
    feedback to financial institutions. In April 2016, IRS officials stated
    they plan to analyze preliminary survey results by mid-April 2016.
    Additionally, IRS officials reported that the agency shared information
    with financial institutions in March 2016 and plans to do so on a
    quarterly basis, with the next information sharing session scheduled in
    June 2016.
               the 2016 filing season has generally been smooth,
                       and telephone service has improved
        IRS and industry partners have characterized that returns
    processing and refund issuance during this filing season has been
    generally smooth. Through April 1, 2016, IRS had processed about 95
    million returns and issued 76 million refunds totaling about $215
    billion. While IRS experienced a major system failure in February that
    halted returns processing for about a day, the agency reported that it
    had minimal effect on overall processing of returns and refunds.

        In addition to filing returns, many taxpayers often call IRS for
    assistance. IRS's telephone service has generally improved in 2016 over
    last year. From January 1 through March 19, 2016 IRS received about
    35.4 million calls to its automated and live assistor telephone lines,
    about a 2 percent decrease compared to the same period last year.\25\
    Of the 13.4 million calls seeking live assistance, IRS had answered 9.1
    million calls--a 75 percent increase over the 5.2 million calls
    answered during the same period last year.
    ---------------------------------------------------------------------------
        \25\ Total call volume to IRS's toll free telephone lines include
    automated and assistor calls answered, as well as those that received a
    busy signal or were abandoned or disconnected.

        IRS anticipated that 65 percent of callers seeking live assistance
    would receive it this filing season, which runs through April 18, and
    47 percent of callers would receive live assistance through the entire
    2016 fiscal year.\26\ As of March 19, 2016, 75 percent of callers had
    received live assistance, an increase from 38 percent during the same
    period last year. Further, the average wait time to speak to an
    assistor also decreased from 24 to 9 minutes. As we reported in March
    2016, however, IRS's telephone level of service for the full fiscal
    year has yet to reach the levels it had achieved in earlier years.\27\
    ---------------------------------------------------------------------------
        \26\ This year, most taxpayers have until April 18 to file a tax
    return with IRS. IRS's projected telephone level of service for the
    filing season covers the period between January 1, 2016 and April 23,
    2016.
        \27\ GAO, Internal Revenue Service: Preliminary Observations on the
    Fiscal Year 2017 Budget Request and 2016 Filing Season Performance,
    GAO-16-459R (Washington, DC: Mar. 8, 2016).

        IRS attributed this year's service improvement to a number of
    factors. Of the additional $290 million IRS received in December 2015,
    it allocated $178.4 million (61.5 percent) for taxpayer services to
    make measurable improvements in its telephone level of service. With
    the funds, IRS hired 1,000 assistors who began answering taxpayer calls
    in March, in addition to the approximately 2,000 seasonal assistors it
    had hired in fall 2015.\28\ To help answer taxpayer calls before March,
    IRS officials told us that they detailed 275 staff from one of its
    compliance functions to answer telephone calls.\29\ IRS officials said
    they believe this step was necessary because the additional funding
    came too late in the year to hire and train assistors to fully cover
    the filing season. IRS also plans to use about 600 full-time
    equivalents of overtime for assistors to answer telephone calls and
    respond to correspondence in fiscal year 2016, compared to fewer than
    60 full-time equivalents of overtime used in fiscal year 2015.
    ---------------------------------------------------------------------------
        \28\ In contrast, IRS reduced the number of assistors answering
    telephone calls between fiscal years 2010 and 2015, which contributed
    to the lowest level of telephone service in fiscal year 2015 compared
    to recent years.
        \29\ IRS has not yet determined the amount of foregone revenue from
    taking this action.

        In December 2014, we recommended that IRS systematically and
    periodically compare its telephone service to the best in business to
    identify gaps between actual and desired performance.\30\ IRS disagreed
    with this recommendation, noting that it is difficult to identify
    comparable organizations. We do not agree with IRS's position; many
    organizations run call centers that would provide ample opportunities
    to benchmark IRS's performance.
    ---------------------------------------------------------------------------
        \30\ GAO, Tax Filing Season: 2014 Performance Highlights the Need
    to Better Manage Taxpayer Service and Future Risks, GAO-15-163
    (Washington, DC: Dec. 16, 2014).

        In fall 2015, Department of the Treasury (Treasury) and IRS
    officials said they had no plans to develop a comprehensive customer
    service strategy or specific goals for telephone service tied to the
    best in the business and customer expectations. Without such a
    strategy, Treasury and IRS can neither measure nor effectively
    communicate to Congress the types and levels of customer service
    taxpayers should expect and the resources needed to reach those levels.
    Therefore, in December 2015 we suggested that Congress consider
    requiring that Treasury work with IRS to develop a comprehensive
    customer service strategy.\31\ In April 2016, IRS officials told us
    that the agency established a team to consider our prior work in
    developing this strategy or benchmarking its telephone service.
    ---------------------------------------------------------------------------
        \31\ GAO, 2015 Tax Filing Season: Deteriorating Taxpayer Service
    Underscores Need for a Comprehensive Strategy and Process Efficiencies,
    GAO-16-151 (Washington, DC: Dec. 16, 2015).

        In summary, while IRS has made progress in implementing information
    security controls, it needs to continue to address weaknesses in access
    controls and configuration management and consistently implement all
    elements of its information security program. The risks IRS and the
    public are exposed to have been illustrated by recent incidents
    involving public-facing applications, highlighting the importance of
    securing systems that contain sensitive taxpayer and financial data. In
    addition, fully implementing key elements of a breach response program
    will help ensure that when breaches of sensitive data do occur, their
    ---------------------------------------------------------------------------
    impact on affected individuals will be minimized.

        Weaknesses in information security can also increase the risk posed
    by identity theft refund fraud. IRS needs to establish an approach for
    addressing identity theft refund fraud that is informed by assessing
    the cost, benefits, and risks of IRS's various authentication options
    and improving the reliability of fraud estimates.

        While this year's tax filing season has generally gone smoothly and
    IRS has improved customer service, it still needs to develop a
    comprehensive approach to customer service that will meet the needs of
    taxpayers while ensuring that their sensitive information is adequately
    protected.

        Chairman Hatch, Ranking Member Wyden, and members of the committee,
    this concludes my statement. I look forward to answering any questions
    that you may have at this time.

                                     ______

       Prepared Statement of Hon. J. Russell George, Treasury Inspector
           General for Tax Administration, Department of the Treasury
        Chairman Hatch, Ranking Member Wyden, and members of the committee,
    thank you for the opportunity to testify on the Internal Revenue
    Service's (IRS) controls to protect sensitive taxpayer information.

        The Treasury Inspector General for Tax Administration (TIGTA) is
    statutorily mandated to provide independent audit and investigative
    services necessary to improve the economy, efficiency, and
    effectiveness of IRS operations, including the IRS Chief Counsel.
    TIGTA's oversight activities are designed to identify high-risk
    systemic inefficiencies in IRS operations and to investigate exploited
    weaknesses in tax administration. TIGTA's role is critical in that we
    provide the American taxpayer with assurance that the approximately
    86,000 IRS employees \1\ who collected over $3.3 trillion in tax
    revenue, processed over 244 million tax returns, and issued more than
    $400 billion in tax refunds during Fiscal Year (FY) \2\ 2015,\3\ have
    done so in an effective and efficient manner while minimizing the risks
    of waste, fraud, and abuse.
    ---------------------------------------------------------------------------
        \1\ Total IRS staffing as of October 3, 2015. Included in the total
    are approximately 15,400 seasonal and part-time employees.
        \2\ The Federal Government's fiscal year begins on October 1 and
    ends on September 30.
        \3\ IRS, Management's Discussion and Analysis, Fiscal Year 2015.

        TIGTA's Office of Audit (OA) reviews all aspects of the Federal tax
    administration system and provides recommendations to: improve IRS
    systems and operations; ensure the fair and equitable treatment of
    taxpayers; and detect and prevent waste, fraud, and abuse in tax
    administration. The Office of Audit has examined specific high-risk
    issues such as identity theft, refund fraud, improper payments,
    information technology, security vulnerabilities, complex modernized
    computer systems, tax collections and revenue, and waste and abuse in
    ---------------------------------------------------------------------------
    IRS operations.

        TIGTA's Office of Investigations (OI) protects the integrity of the
    IRS by investigating allegations of IRS employee misconduct, external
    threats to IRSemployees and facilities, and other attempts to impede or
    otherwise interfere with the IRS's ability to collect taxes.
    Specifically, the Office of Investigations investigates misconduct by
    IRS employees which manifests itself in many ways, including
    unauthorized access to taxpayer information and the use of the
    information for the purposes of identity theft; extortion; theft of
    government property; taxpayer abuses; false statements; and other
    financial fraud. The Office of Investigations is statutorily charged to
    investigate threats made against the IRS's employees, facilities and
    data. We are committed to ensuring the safety of IRS employees and the
    taxpayers who conduct business at more than 670 IRS facilities
    nationwide.

        TIGTA's Office of Inspections and Evaluations performs responsive,
    timely, and cost-effective inspections and evaluations of challenging
    areas within the IRS, providing TIGTA with additional flexibility and
    capability to produce value-added products and services to improve tax
    administration. Inspections are intended to monitor compliance with
    applicable laws, regulations, and/or policies; assess the effectiveness
    and efficiency of programs and operations; and inquire into allegations
    of waste, fraud, abuse, and mismanagement. Evaluations, on the other
    hand, are intended to provide in-depth reviews of specific management
    issues, policies, or programs.

        Cybersecurity threats against the Federal Government continue to
    grow. According to the Department of Homeland Security's U.S. Computer
    Emergency Readiness Team, Federal agencies reported 77,183 cyberattacks
    in FY 2015, an increase of more than 10 percent from FY 2014.\4\ The
    IRS reported that more than 1,000 security incidents occurred to its
    systems during the period August 1, 2014, to July 31, 2015.
    ---------------------------------------------------------------------------
        \4\ Office of Management and Budget, Annual Report to Congress:
    Federal Information Security Management Act (Mar. 2016).

        The IRS, the largest component of the Department of the Treasury,
    has primary responsibility for administering the Federal tax system.
    The IRS's role is unique within the Federal Government in that it
    administers the Nation's tax laws and collects the revenue that funds
    the Government. It also works to protect Federal revenue by detecting
    and preventing the growing risk of fraudulent tax refunds and other
    improper payments. The IRS relies extensively on its computer systems
    to support both its financial and mission-related operations. These
    computer systems collect and process extensive amounts of taxpayer
    data, including Personally Identifiable Information. For Calendar Year
    2015, the IRS processed more than 150 million individual tax returns
    and more than 55 million business tax returns that contain taxpayers'
    ---------------------------------------------------------------------------
    sensitive financial data.

        TIGTA has identified a number of areas in which the IRS could
    better protect taxpayer data and improve its overall security position.
    My comments today will focus on our work related to the IRS's ability
    to prevent and detect breaches to its computer systems and the IRS's
    processes to authenticate users accessing its online services.
                  data security remains a top concern of tigta
        Since FY 2011, TIGTA has designated the security of taxpayer data
    as the top concern facing the IRS based on the increased number and
    sophistication of threats to taxpayer information and the need for the
    IRS to better protect taxpayer data and improve its enterprise security
    program. To provide oversight of the IRS's Information Security
    program, TIGTA conducts ongoing audit coverage of various security
    programs, systems, and solutions. As of March 2016, 14 TIGTA audits
    still have 23 recommendations that have yet to be implemented. These
    recommendations address weaknesses related to connections with external
    partners, continuous efforts to monitor information security,
    implementation of the Homeland Security Presidential Directive 12
    initiative,\5\ and information technology asset management.
    ---------------------------------------------------------------------------
        \5\ Homeland Security Presidential Directive 12, Policy for a
    Common Identification Standard for Federal Employees and Contractors,
    requires agencies to follow specific technical standards and business
    processes for the issuance and routine use of Federal identity
    credentials to ensure that only authorized personnel have access to
    Government systems and applications.

        TIGTA continues to identify significant security weaknesses that
    could affect the confidentiality, integrity, and availability of
    financial and sensitive taxpayer data. For example, during our most
    recent Federal Information Security Modernization Act \6\ evaluation of
    the IRS's information security programs and practices,\7\ we found
    three security program areas, i.e., Continuous Monitoring Management,
    Identity and Access Management, and Configuration Management, that did
    not meet the level of performance specified by the Department of
    Homeland Security.\8\
    ---------------------------------------------------------------------------
        \6\ Pub. L. No. 113-283, 128 Stat. 3073 (2014). This bill amended
    chapter 35 of title 44 of the United States Code to provide for reform
    to Federal information security.
        \7\ TIGTA, Ref. No. 2015-20-092, Treasury Inspector General for Tax
    Administration--Federal Information Security Modernization Act Report
    for Fiscal Year 2015 (Sept. 2015).
        \8\ To assist the Inspectors General in evaluating Federal
    agencies' compliance with the Federal Information Security
    Modernization Act, the Department of Homeland Security issued the
    Fiscal Year 2015 Inspector General Federal Information Security
    Modernization Act Reporting Metrics, which specified 10 information
    security program areas and listed specific attributes within each area
    for evaluation.

        One of the Federal Government's latest security initiatives is the
    implementation of continuous monitoring of information security, which
    is defined as maintaining ongoing, real-time awareness of information
    security, vulnerabilities, and threats to support organizational risk
    decisions. While the IRS has made progress and is in compliance with
    guidelines from the Department of Homeland Security and the Department
    of the Treasury, we found that the IRS is still in the process of
    implementing its Information Security Continuous Monitoring program
    required by the Office of Management and Budget to automate asset
    management and maintain the secure configuration of assets in real
    ---------------------------------------------------------------------------
    time.

        Specifically, we reported that the IRS Continuous Monitoring
    Management program is at a maturity level of one on a scale of one to
    five, where one is the least mature and five is the most mature. In
    July 2014, the Department of the Treasury decided to adopt a uniform
    approach across the Department and to use the toolset selected by the
    Department of Homeland Security to meet the program requirements. The
    Department of Homeland Security is currently in the process of
    procuring a standard set of cybersecurity tools and services for use by
    Federal agencies. These tools will include sensors that perform
    automated searches for known cyber flaws and send the results to
    dashboards that inform system managers in real time of cyber risks that
    need remediation.

        The Identity and Access Management program ensures that only those
    with a business need are able to obtain access to IRS systems and data.
    However, we found that this program did not meet a majority of the
    attributes specified by the Department of Homeland Security, largely
    due to the IRS's failure to achieve Government-wide goals set for
    implementing logical (system) and physical access to facilities in
    compliance with Homeland Security Presidential Directive 12
    requirements. Homeland Security Presidential Directive 12 requires
    Federal agencies to issue personal identity verification cards to
    employees and contractors for accessing agency systems and facilities.

        Configuration Management ensures that settings on IRS systems are
    maintained in an organized, secure, and approved manner that includes
    the timely installation of patches to resolve known security
    vulnerabilities. We found that the IRS has not fully implemented
    enterprise-wide automated processes to identify computer assets,
    evaluate compliance with configuration policies, and deploy security
    patches. Specifically, these processes have not been fully implemented
    enterprise-wide and still rely on many tedious manual procedures.
    Eventually, the IRS's Configuration Management program will benefit
    from the implementation of the Information Security Continuous
    Monitoring program, which is intended to automate configuration
    management in real time for the universe of IRS assets.

        Patch \9\ management is an important element in mitigating the
    security risks associated with known vulnerabilities to computer
    systems. This is critical to prevent intrusions by unauthorized
    individuals or entities. TIGTA evaluated the effectiveness of the IRS
    security patch management process, which has been an ongoing challenge
    for the IRS.\10\ In 2012, we found that the IRS had made progress in
    automating installation and monitoring in a large segment of its
    computers, but it had not yet implemented key patch management policies
    and procedures needed to ensure that all IRS systems are patched timely
    and operating securely. Any significant delays in patching software
    with critical vulnerabilities provides ample opportunity for persistent
    attackers to gain control of vulnerable computers and get access to the
    sensitive data the computer systems may contain, including taxpayer
    data. The Government Accountability Office reported in March 2015 that
    the IRS was still not effectively applying security patches in a timely
    manner.\11\ We also reported in September 2015 that the IRS is still
    working to expand a standard automated process to deploy operating
    system patches enterprise-wide.\12\
    ---------------------------------------------------------------------------
        \9\ A patch fixes a design flaw in a computer program. Patches must
    be installed or applied to the appropriate computer for the flaw to be
    corrected.
        \10\ TIGTA, Ref. No. 2012-20-112, An Enterprise Approach Is Needed
    to Address the Security Risk of Unpatched Computers (Sept. 2012).
        \11\ GAO-15-337, IRS Needs to Continue Improving Controls over
    Financial and Taxpayer Data (Mar. 2016).
        \12\ TIGTA, Ref. No. 2015-20-092, Treasury Inspector General for
    Tax Administration--Federal Information Security Modernization Act
    Report for Fiscal Year 2015 (Sept. 2015).

        We have also identified other areas that would improve the IRS's
    ability to defend its systems against cyberattacks. Monitoring IRS
    networks 24 hours a day, year-round, for cyberattacks and responding to
    various computer security incidents is the responsibility of the IRS's
    Computer Security Incident Response Center (CSIRC). TIGTA evaluated the
    effectiveness of the CSIRC at preventing, detecting, reporting, and
    responding to computer security incidents targeting IRS computers and
    data, and identified areas for improvement.\13\ At the time of our
    review, the CSIRC's host-based intrusion detection system was not
    monitoring a significant percentage of IRS servers, which leaves that
    portion of the IRS network and data at risk. In addition, the CSIRC was
    not reporting all computer security incidents to the Department of the
    Treasury, as required. Finally, incident response policies, plans, and
    procedures were nonexistent, inaccurate, or incomplete. We are
    currently evaluating the effectiveness of the CSIRC at preventing,
    detecting, reporting, and responding to computer security incidents
    targeting IRS computers and data, and plan to issue our report later
    this year.\14\
    ---------------------------------------------------------------------------
        \13\ TIGTA, Ref. No. 2012-20-019, The Computer Security Incident
    Response Center Is Effectively Performing Most of Its Responsibilities,
    but Further Improvements Are Needed (Mar. 2012).
        \14\ TIGTA, Audit No. 201620003, Effectiveness of the Computer
    Security Incident Response Center, report planned for September 2016.

        TIGTA also found that many interconnections \15\ in use at the IRS
    do not have proper authorization or are not covered by security
    agreements. Although the IRS has established an office to provide
    oversight and guidance for the development of security agreements, that
    office is not responsible for managing or monitoring agreements for all
    external interconnections in use in the IRS environment. TIGTA believes
    the lack of a centralized inventory and of an enterprise-level approach
    to ensure that all external interconnections are monitored have
    contributed to interconnections that are active but lack proper
    approvals and assurances necessary to meet current security
    requirements.\16\
    ---------------------------------------------------------------------------
        \15\ The National Institute of Standards and Technology defines a
    system interconnection as the direct connection of two or more
    information technology systems for the purpose of sharing data and
    other information resources.
        \16\ TIGTA, Ref. No. 2015-20-087, Improvements Are Needed to Ensure
    That External Interconnections Are Identified, Authorized, and Secured
    (Sept. 2015).

        In addition, TIGTA reported \17\ that the IRS was unable to upgrade
    all of its workstations with the most current Windows'
    operating system.\18\ Because of their importance, operating systems
    must be updated on a regular basis to patch security vulnerabilities
    and, if necessary, upgraded completely in order to fix crucial
    weaknesses or to address new threats to their functionality. TIGTA
    found that the IRS did not follow established policies with respect to
    project management and provided inadequate oversight and monitoring of
    the Windows upgrade early in its effort. As a result, the IRS had not
    accounted for the location or migration status of approximately 1,300
    workstations and had upgraded only about one-half of its applicable
    servers at the conclusion of our audit.
    ---------------------------------------------------------------------------
        \17\ TIGTA, Ref. No. 2015-20-073, Inadequate Early Oversight Led to
    Windows Upgrade Project Delays (Sept. 2015).
        \18\ The software that communicates with computer hardware to
    allocate memory, process tasks, access disks and peripherals, and
    serves as the user interface.

                 irs authentication processes need improvement
        The increasing number of data breaches in the private and public
    sectors means more personal information than ever before is available
    to unscrupulous individuals. Much of these data are detailed enough to
    enable circumvention of most authentication processes. Therefore, it is
    critical that the methods the IRS uses to authenticate individuals'
    identities provide a high level of confidence that tax information and
    services are provided only to individuals who are entitled to receive
    them.

        The risk of unauthorized access to tax accounts will continue to
    grow as the IRS focuses its efforts on delivering online tools to
    taxpayers. The IRS plans to increase the availability and quality of
    self-service interactions, allowing it to free up in-
    person resources for taxpayers who truly need them. The IRS's goal is
    to eventually provide taxpayers with dynamic online account access that
    includes viewing their recent payments, making minor changes and
    adjustments to their accounts, and corresponding digitally with the
    IRS. As tax administration evolves, the challenge of providing adequate
    data security will continue.

        The IRS recognized that there was a lack of consistency in the
    techniques it had employed for authentication; therefore, in June 2014,
    it established the Authentication Group. In a report issued in November
    2015, TIGTA found that although the IRS recognizes the growing
    challenge it faces in establishing effective authentication processes
    and procedures, the IRS has not established a Service-wide approach to
    managing its authentication needs.\19\ As a result, the level of
    authentication the IRS uses for its various services is not consistent.
    TIGTA found that while the Authentication Group is evaluating potential
    improvements to existing authentication methods for the purpose of
    preventing identity theft, it is not developing overall strategies to
    enhance authentication methods across IRS functions and programs. TIGTA
    recommended that the IRS develop a Service-wide strategy that
    establishes consistent oversight of all authentication needs across IRS
    functions and programs. In addition, the IRS should ensure that
    responsibility for implementing the strategy is optimally aligned to
    provide centralized oversight and facilitate decision making for the
    development and integration of all forms of authentication, including
    frameworks, policies, and processes across the IRS.
    ---------------------------------------------------------------------------
        \19\ TIGTA, Ref. No. 2016-40-007, Improved Tax Return Filing and
    Tax Account Access Authentication Processes and Procedures Are Needed
    (Nov. 2015).

        Office of Management and Budget (OMB) Memorandum M-04-04, E-
    Authentication for Federal Agencies,\20\ establishes criteria for
    determining the risk-based level of authentication assurance required
    for specific electronic applications and transactions. E-Authentication
    is the process of establishing confidence in user identities
    electronically presented to an information system. The OMB guidance
    requires agencies to review new and existing electronic transactions to
    ensure that authentication processes provide the appropriate level of
    assurance. This guidance is intended to help agencies identify and
    analyze the risks associated with each step of the authentication
    process. As the outcome of an authentication error becomes more
    serious, the required level of assurance increases.
    ---------------------------------------------------------------------------
        \20\ OMB, M-04-04, E-Authentication for Federal Agencies (Dec.
    2003).

        In addition, the U.S. Department of Commerce National Institute of
    Standards and Technology (NIST) Special Publication 800-63-2,
    Electronic Authentication Guideline \21\ provides the technical
    requirements for the four levels of assurance defined in OMB guidance
    as shown in the following table.
    ---------------------------------------------------------------------------
        \21\ NIST, NIST SP-800-63-2, Electronic Authentication Guideline
    (Aug. 2013).

                     Table 1--Levels of Electronic Assurance
    ------------------------------------------------------------------------
     Level of  Assurance          Requirements          Level of Confidence
    ------------------------------------------------------------------------
    Level 1               No identity proofing is      Provides little or no
                           required.                    confidence.
    ------------------------------------------------------------------------
    Level 2               Requires basic identity      Provides some
                           proofing data, a valid       confidence in the
                           current Government           validity of an
                           identification number, and   individual's
                           a valid financial or         identity.
                           utility account number.
                           Access occurs only after
                           identity proofing data and
                           either the Government
                           identification number or
                           financial/utility account
                           number are verified by the
                           agency.
    ------------------------------------------------------------------------
    Level 3               Requires basic identity      Provides high
                           proofing data, a valid       confidence in the
                           current Government           validity of an
                           identification number, and   individual's
                           a valid financial or         identity.
                           utility account number as
                           well as the use of a
                           second authentication
                           factor such as a one-time
                           supplemental code issued
                           via text message or e-mail
                           to the telephone number or
                           e-mail address associated
                           with the individual.
    ------------------------------------------------------------------------
    Level 4               Requires in-person identity  Provides very high
                           proofing and verification.   confidence in the
                                                        validity of an
                                                        individual's
                                                        identity.
    ------------------------------------------------------------------------

        OMB standards require Federal agencies to conduct an assessment of
    the risk of authentication error for each online service or application
    they provide. An authentication error occurs when an agency confirms
    the identity provided by an individual when in fact the individual is
    not who he or she claims to be. In addition, NIST Special Publication
    800-63 establishes specific requirements that agencies' authentication
    processes must meet to provide a specific level of authentication
    assurance. However, we found that, although the IRS has established
    processes and procedures to authenticate individuals requesting online
    access to IRS services, these processes and procedures do not comply
    with Government standards for assessing authentication risk and
    establishing adequate authentication processes.

        Our analysis of the e-Authentication processes used to authenticate
    users of the IRS's online Get Transcript and Identity Protection
    Personal Identification Number (IP PIN) \22\ applications found that
    these authentication methods provide only
    single-factor authentication despite NIST standards requiring
    multifactor authentication for such high-risk applications.
    ---------------------------------------------------------------------------
        \22\ To provide relief to tax-related identity theft victims, the
    IRS issues IP PINs to taxpayers who are confirmed by the IRS as victims
    of identity theft, taxpayers who are at a high risk of becoming a
    victim such as taxpayers who call reporting a lost or stolen wallet or
    purse, as well as taxpayers who live in three locations that the IRS
    has identified as having a high rate of identity theft (Florida,
    Georgia and the District of Columbia).

        The IRS assessed the risk of the Get Transcript application as
    required. However, the IRS determined that the authentication risk
    associated with Get Transcript was low to both the IRS and taxpayers.
    The IRS defines a low risk rating as one in which the likelihood of an
    imposter obtaining and using the information available on an
    application is low. In addition, a low risk rating indicates that
    controls are in place to prevent, or at least significantly impede, an
    imposter from accessing the information. As a result, the IRS
    implemented single-factor authentication to access the Get Transcript
    ---------------------------------------------------------------------------
    application.

        The IRS's current e-Authentication framework also does not comply
    with NIST standards for single-factor authentication. Specifically, the
    e-Authentication framework does not require individuals to provide
    Government identification or a financial or utility account number, as
    required by NIST standards. According to IRS management, the IRS
    decided to not request financial or utility account information because
    the information cannot currently be verified. IRS management informed
    us that the IRS obtained and verified the taxpayer filing status to
    mitigate the risk of its being unable to use financial information to
    authenticate individuals.

        Although the IRS required taxpayers to provide a filing status,
    this requirement does not bring it into compliance with NIST standards,
    and the IRS remains noncompliant with single-factor authentication
    requirements. The IRS received guidance from the NIST at the time the
    e-Authentication framework was being developed indicating that a
    Taxpayer Identification Number (TIN) was an acceptable form of
    identification. However, in August 2015, the NIST informed us that a
    TIN is not currently an acceptable Government identification number for
    the purpose of authentication. We brought this discrepancy to the IRS's
    attention and IRS management agreed that a TIN is no longer an
    acceptable form of identification. Management also indicated that the
    IRS would take steps to conform to NIST standards for verifying an
    individual's identity.

        In August 2015, the IRS indicated that unauthorized users had been
    successful \23\ in obtaining tax information \24\ on the Get Transcript
    application for an estimated 334,000 taxpayer accounts. According to
    the IRS, one or more individuals succeeded in clearing the IRS's
    authentication process that required knowledge of information about the
    taxpayer, including Social Security information, date of birth, tax
    filing status, and street address. To prevent further unauthorized
    accesses, the IRS removed the application from its website.
    ---------------------------------------------------------------------------
        \23\ A successful access is one in which the unauthorized users
    successfully answered identity proofing and knowledge-based
    authentication questions required to gain access to taxpayer account
    information.
        \24\ The tax information that can be accessed on the Get Transcript
    application can include the current and 3 prior years of tax returns, 9
    years of tax account information, and wage and income information.

        TIGTA's current review \25\ of the Get Transcript breach identified
    additional suspicious accesses to taxpayers' accounts that the IRS had
    not identified. Based on TIGTA's analysis of Get Transcript access
    logs, the IRS reported on February 26, 2016 that potentially
    unauthorized users had been successful in obtaining access to an
    additional 390,000 taxpayer accounts. The IRS also reported that an
    additional 295,000 taxpayer transcripts had been targeted but the
    access attempts had not been successful. TIGTA was able to identify the
    additional unauthorized accesses due to our use of advanced analytics
    and cross-discipline approaches. The IRS had not previously identified
    these accesses because of limitations in the scope of its analysis,
    including its method of identifying suspicious e-mail accounts and the
    time frame it analyzed.
    ---------------------------------------------------------------------------
        \25\ TIGTA, Audit No. 201540027, Evaluation of Assistance Provided
    to Victims of the Get Transcript Data Breach, report planned for May
    2016.

        In response to TIGTA's identification of the additional accesses,
    the IRS started on February 29, 2016 mailing notification letters to
    the affected taxpayers and placing identity theft markers on their tax
    accounts. It should be noted that the actual number of individuals
    whose personal information was available to the potentially
    unauthorized individuals accessing these tax accounts is significantly
    greater than the number of taxpayers whose accounts were accessed
    because the tax accounts accessed include certain information on other
    ---------------------------------------------------------------------------
    individuals listed on a tax return (e.g., spouses and dependents).

        We are currently evaluating the appropriateness of the IRS's
    response to the Get Transcript incident and the IRS's proposed
    solutions to address the authentication weakness that allowed the
    incident to occur.\26\ To date, we have learned that the IRS is working
    with the U.S. Digital Service \27\ on its new e-authentication and
    authorization policies and procedures. In addition, TIGTA is
    participating in a multi-agency investigation into this matter, and we
    have provided the IRS with some of our investigative observations to
    date in order to help them secure the e-authentication environment in
    the future.
    ---------------------------------------------------------------------------
        \26\ TIGTA, Audit No. 201520006, Review of Progress to Improve
    Electronic Authentication, report planned for July 2016.
        \27\ The U.S. Digital Service is part of the Executive Office of
    the President. Its goal is to improve and simplify the digital services
    that people and businesses have with the Government.

        We also reported in November 2015 that the IRS did not complete the
    required authentication risk assessment for its IP PIN application. In
    addition, on January 8, 2016, we recommended that the IRS not
    reactivate its online IP PIN application for the 2016 Filing Season,
    due to concerns that the IP PIN authentication process requires
    knowledge of the same taxpayer information that was used by
    unscrupulous individuals to breach the Get Transcript application.
    However, the IRS reactivated the application on January 19, 2016. We
    issued a second recommendation to the IRS on February 24, 2016,
    ---------------------------------------------------------------------------
    advising it to remove the IP PIN application from its public website.

        On March 7, 2016, the IRS reported that it was temporarily
    suspending use of the IP PIN application as part of an ongoing security
    review. The IRS reported that it is conducting a further review of the
    application that allows taxpayers to retrieve their IP PINs online and
    is looking at further strengthening its security features. The IRS does
    not anticipate having the technology in place for either the Get
    Transcript or IP PIN application to provide multifactor authentication
    capability before the summer of 2016.

        On February 9, 2016, the IRS announced that it had identified and
    halted an automated botnet \28\ attack on its Electronic Filing (e-
    file) PIN application on IRS.gov. Using personal data stolen elsewhere
    outside the IRS, identity thieves used malware in an attempt to
    generate e-file PINs for stolen Social Security Numbers (SSN). An e-
    file PIN is used in some instances to electronically file a tax return.
    While no personal taxpayer data was compromised or disclosed by IRS
    systems in the attack, the IRS did identify unauthorized attempts
    involving approximately 464,000 unique SSNs, of which 101,000 were used
    to successfully access an e-file PIN.
    ---------------------------------------------------------------------------
        \28\ A botnet is a number of Internet computers that, although
    their owners are unaware of it, have been set up to forward
    transmissions (including spam or malware) to other computers on the
    Internet, usually for the purpose of a cyberattack or denial of service
    attack.

        No single authentication method or process will prevent
    unscrupulous individuals from filing identity theft tax returns or
    attempting to inappropriately access IRS services. However, strong
    authentication processes can reduce the risk of such activity by making
    it harder and more costly for such individuals to gain access to
    resources and information. Therefore, it is important that the IRS
    ensure that its authentication processes are in compliance with NIST
    standards in order to provide the highest degree of assurance required
    and to ensure that authentication processes used to verify individuals'
    identities are consistent among all methods used to access tax account
    ---------------------------------------------------------------------------
    information.

        In response to concerns expressed by the IRS Commissioner during
    2015, the IRS received an additional $290 million in appropriated funds
    for FY 2016. The IRS plans to use $111.5 million of the additional
    funding to enhance cybersecurity to safeguard taxpayer data.
    Specifically, the IRS plans to increase staffing, replace outdated
    equipment, and make network improvements for monitoring and analyzing
    data traffic. In addition, the IRS plans to implement actions from the
    Security Summit \29\ and to relaunch the Get Transcript application. We
    are planning a review to assess IRS's use of these funds to improve
    cybersecurity.
    ---------------------------------------------------------------------------
        \29\ On March 19, 2015, the IRS Commissioner convened a meeting
    with IRS officials, the chief executive officers of the leading tax
    preparation firms, software developers, payroll and tax financial
    product processors, and representatives from 22 States to discuss
    common challenges and ways to leverage their collective resources and
    efforts for identity theft detection and prevention.

        We at TIGTA take seriously our mandate to provide independent
    oversight of the IRS in its administration of our Nation's tax system
    and will continue to expand our oversight related to cybersecurity.
    Based on the increased number and sophistication of threats to taxpayer
    information and the need for the IRS to better protect taxpayer data
    and improve its enterprise security program, we plan to provide
    continuing audit and investigative coverage of the IRS's efforts to
    ---------------------------------------------------------------------------
    protect the confidentiality of taxpayer information.

        Chairman Hatch, Ranking Member Wyden, and members of the committee,
    thank you for the opportunity to share my views.

                                     ______

                  Prepared Statement of Hon. Orrin G. Hatch,
                            a U.S. Senator From Utah
    WASHINGTON--Senate Finance Committee Chairman Orrin Hatch (R-Utah)
    today delivered the following opening statement at a hearing examining
    how the Internal Revenue Service (IRS) is safeguarding private taxpayer
    information this filing season and to determine what improvements may
    be necessary for the agency to fully protect taxpayers from
    cybercriminals:

        Good morning. It's a pleasure to welcome everyone to today's
    hearing, which we've titled ``Cybersecurity and Protecting Taxpayer
    Information.''

        These are important issues that the Finance Committee has been
    working on for some time. In June of last year, for example, we held a
    hearing on the theft of Internal Revenue Service data affecting
    taxpayer information. Much has happened since that time.

        At the urging of the Finance Committee, the IRS, State revenue
    commissioners, and leaders in the tax return preparation industry came
    together last year to convene a Security Summit, which resulted in new
    information-sharing agreements to help identify suspicious activity in
    the tax filing and refund process. We look forward to hearing more
    about that effort today.

        But in the face of this progress, we have also seen unprecedented
    growth in the scope and scale of cyber-attacks aimed at stealing
    personal information and billions of dollars from taxpayers.

        Last year alone, cyber-criminals obtained access to sensitive
    personal information from several large health insurers, exposing tens
    of millions of Americans to potential identity theft. Foreign
    governments gained access to poorly protected Federal Government
    databases, including a treasure trove of information at the Office of
    Personnel Management.

        Today we will focus on three separate aspects of this problem.

        First, we will consider the ways the IRS authenticates taxpayer
    identities to prevent data thieves from using authentication
    information to gain access to even more information about taxpayers or
    to file false returns and obtain refunds under stolen identities.

        Second, we will examine how the IRS uses its resources to improve
    cybersecurity. This will include some discussion about the IRS Future
    State plan, which the agency has developed in order to adapt to the
    realities of the 21st century.

        Third and finally, we will consider the ongoing joint efforts of
    the IRS, State revenue collectors, and private tax preparers to see
    what can be accomplished to better secure taxpayer information and
    protect taxpayers from fraud.

        Taking a look at our witness table, it is clear that this is not a
    typical lineup of witnesses. Challenges to cyber-security require not
    only smart and persistent leadership up at the top, but also
    technological expertise and up-to-date skills down on the ground. So
    today, we not only have with us the heads of the IRS, the Government
    Accountability Office, and the Treasury Inspector General for Tax
    Administration, we've invited subject matter experts on the relevant
    issues from each of those agencies to testify as well.

        That's a total of six witnesses. And, I suspect each of them will
    bring unique and important insights to this discussion.

        In closing, I'll just say that, while we are clearly making real
    progress in this area, the challenges are continuing to grow and
    criminals behind this kind of data theft are getting more sophisticated
    and aggressive, seemingly by the day. And, American taxpayers--and
    their livelihoods--are their targets.

        In other words, we have a lot of work to do. My hope is that we'll
    continue to be able to work on these issues on a bipartisan basis in
    order to do right by the American people.

                                     ______

            Prepared Statement of Hon. John Koskinen, Commissioner,
                            Internal Revenue Service
                                  introduction
        Chairman Hatch, Ranking Member Wyden, and members of the committee,
    thank you for the opportunity to discuss the IRS's ongoing efforts to
    safeguard our systems and protect taxpayer information from
    cybersecurity threats, as well as our work to combat stolen identity
    refund fraud.

        Securing our systems and taxpayer data continues to be a top
    priority for the IRS. Even with our constrained resources as a result
    of repeatedly decreased funding over the past few years, we continue to
    devote significant time and attention to this challenge, which is
    twofold.

        First, the IRS works continuously to protect our main computer
    systems from cyber incidents, intrusions and attacks, but our primary
    focus is to prevent criminals from accessing taxpayer information
    stored in our databases. These core tax processing systems remain
    secure, through a combination of cyber defenses, which currently
    withstand more than 1 million attempts to maliciously access our
    systems each day. Second, the IRS is waging an ongoing battle to
    protect taxpayers and their information as we confront the growing
    problem of stolen identity refund fraud. Our multipronged approach to
    this problem is discussed in more detail below.

        As we confront these challenges, the IRS has also been working to
    expand and improve our ability to interact with taxpayers online. While
    we already engage taxpayers across numerous communications channels, we
    realize the need to meet taxpayers' increasing demand for digital
    services.

        We are aware, however, that in building toward this enhanced online
    experience, we must continuously upgrade and improve our authentication
    protocols. The reality is criminals are becoming increasingly
    sophisticated and are gathering vast amounts of personal information as
    the result of data breaches at sources outside the IRS. We must balance
    the strongest possible authentication processes with the ability of
    taxpayers to legitimately access their data and use IRS services
    online. It is important to note that cybercrime (theft by unauthorized
    access) and privacy breaches are increasing across the country in all
    areas ofgovernment and industry. Cyber criminals and their methods
    continue to grow in sophistication, frequency, brazenness, volume and
    impact. IRS will continue to be challenged in our ability to maintain
    currency with latest technologies, processes and counter-measures.
                     making progress against identity theft
        Discovering that your identity has been stolen by having your tax
    return rejected because someone else has already filed a return using
    your name and Social Security Number (SSN) can be a personal and
    traumatic experience. We are constantly working to improve our
    processes and methods to protect taxpayers from this situation. The
    problem of personal data being used to file fraudulent tax returns and
    illegally obtain refunds exploded from 2010 to 2012, and for a time
    overwhelmed private industry, law enforcement, and government agencies
    such as the IRS. Since then, we have been making steady progress within
    our reduced resources, both in terms of protecting against fraudulent
    refund claims and criminally prosecuting those who engage in this
    crime.

        Thanks to the work of our Criminal Investigation Division, about
    2,000 individuals have been convicted on Federal charges related to
    refund fraud involving identity theft over the past few years. We
    currently have about 1,700 open investigations being worked by more
    than 400 IRS criminal investigators.

        Meanwhile, we continue to improve our efforts at stopping
    fraudulent refunds from going out the door. For example, we have
    improved the filters that help us spot suspicious returns before they
    can be processed. Using those filters, we stopped 1.4 million returns
    last year that were confirmed to have been filed by identity thieves.
    By stopping those returns, we kept criminals from collecting about $8.7
    billion in fraudulent refunds.

        Importantly, the IRS also continues to help taxpayers who have been
    victims of identity theft. Last year, the IRS worked with victims to
    close more than 700,000 such cases.

        But while we have stopped many crimes, we find that the type of
    criminal we are dealing with constantly evolves. Previously we were
    dealing with individuals stealing personal information and filing a few
    dozen or maybe a few hundred false tax returns, and while we still see
    this, the threat has grown to include organized crime syndicates here
    and in other countries.
    Security Summit Group
        To improve our efforts against this complex and evolving threat,
    the IRS held a sit-down meeting in March 2015 with leaders of the
    electronic tax industry, software industry and State tax officials. We
    agreed to build on our past cooperative efforts and find new ways to
    leverage our public-private partnership to help battle stolen identity
    refund fraud. Motivating us was the understanding that no single
    organization can fight this type of fraud alone.

        This meeting led to the development of the Security Summit group,
    an unprecedented partnership that has focused our joint efforts on
    making sure the tax filing experience would be safer and more secure
    for taxpayers in 2016 and beyond. This is an important step for
    taxpayers and for tax administration, because the critical work being
    done by this group is giving everyone involved a better defense against
    stolen identity refund fraud.

        Over the past year, the Security Summit group has made progress on
    a number of initiatives including:

          Summit group members identified and agreed to share 20 data
    components from Federal and State tax returns to improve fraud
    detection and prevention this filing season. For example, group members
    are sharing computer device identification data tied to the return's
    origin, as well as the improper or repetitive use of the numbers that
    identify the Internet ``address'' from where the return originates.

          Tax software providers agreed to enhance identity requirements
    and strengthen validation procedures for new and returning customers to
    protect their accounts from being taken over by criminals. This change
    is one of the most visible to taxpayers during the 2016 filing season,
    because it includes new verification procedures they need to follow to
    log in to their accounts. These actions will serve as the baseline for
    ongoing discussions and additional enhancements for the 2017 filing
    season.

          The Summit group created a new memorandum of understanding (MOU)
    regarding roles, responsibilities and information sharing pathways
    currently in circulation with States and industry. So far, 40 State
    departments of revenue and 21 tax industry members have signed the MOU,
    along with the IRS and endorsing organizations.

          Tax industry participants have aligned with the IRS and the
    States under the National Institute of Standards and Technology (NIST)
    cybersecurity framework to promote the protection of information
    technology infrastructure. The IRS and States currently operate
    consistently with this framework, as do many in the tax industry. Next
    steps in this area include follow-up sessions to develop strategy for
    how the NIST cybersecurity framework will be employed by all
    organizations within the tax industry.

          Summit group members agreed on the need to create a tax
    administration Information Sharing and Analysis Center (ISAC) to
    centralize, standardize, and enhance data compilation and analysis to
    facilitate sharing actionable data and information.

          Recognizing the critical role that the Nation's tax
    professionals play within the tax industry in both the Federal and
    State arenas, the Summit group created a team that will examine issues
    related to return preparers, such as how the preparer community can
    help prevent identity theft and refund fraud.

        Our collaborative efforts are already showing concrete results this
    filing season. For example, Security Summit partners have helped the
    IRS improve its ability to spot potentially false returns before they
    are processed and thus before a possibly fraudulent refund is issued.
    Under our industry leads program, Security Summit partners and other
    external stakeholders such as banks provide information that allows us
    to improve our fraud filters, which in turn leads to more suspicious
    returns being identified for further review. In Calendar Year (CY) 2016
    through mid-March, leads from industry partners directly resulted in
    the suspension of 27,000 returns on which a total of $119 million in
    refunds was claimed, up from 8,000 returns claiming $57 million during
    the same period last year.
    Identity Theft Public Awareness Campaign
        Despite the progress being made against stolen identity refund
    fraud, we recognized that we were missing an important partner in this
    effort--the taxpaying public. So in November 2015, with the strong
    support of all the Security Summit partners, we launched the ``Taxes,
    Security, Together'' campaign to raise awareness about actions people
    can take to protect themselves and avoid becoming victims of identity
    theft.

        Many of the steps are basic common sense, but given that 150
    million households file tax returns every year, we believe these steps
    cannot be stressed enough. People continue to fall prey to clever
    cybercriminals who trick them into giving up SSNs, bank account
    numbers, password information or other sensitive personal data. So
    having the public's help will greatly strengthen and improve our new
    tools we have to stop the crime of identity theft.

        As part of this public awareness campaign, the IRS, in the weeks
    leading up to the 2016 filing season, issued weekly tax tips describing
    the actions people could take to protect their data. We have updated
    several publications for taxpayers and tax professionals. We have
    posted YouTube videos on this subject, and public-
    awareness information is being shared online across IRS.gov, State
    websites and platforms used by the tax software industry and many
    others in the private-sector tax community. I would note our public
    awareness campaign is not confined to the tax filing season, but is an
    ongoing effort.

        Our efforts to educate and inform members of the public about the
    need to protect themselves against identity thieves extend to
    businesses as well. Information returns, especially Form W-2, are
    becoming a major target of these criminals, as they seek new sources of
    information that will help them file false returns that have a better
    chance of going undetected by our fraud filters. In this effort, they
    attempt to trick companies into providing the information returns.

        One scheme uncovered recently involved identity thieves posing as a
    company's chief executive and sending a legitimate-looking e-mail to
    the payroll department requesting a list of all company employees and
    their Forms W-2. In March, the IRS issued an alert to payroll and human
    resources professionals warning them about this scam.

        Identity thieves' efforts to obtain Forms W-2 have not stopped
    there. We are increasingly concerned about efforts to create
    counterfeit Forms W-2 that are filed along with the false returns to
    make the return appear legitimate. That concern led the IRS to launch a
    pilot program earlier this year testing the idea of adding a
    verification code to Form W-2 that would verify the integrity of Form
    W-2 data being submitted to the IRS.

        For this pilot, the IRS partnered with four major payroll service
    providers. These providers added a special coded number on
    approximately 2 million individual Forms W-2 in a new box on the Form
    W-2 labeled ``Verification Code.'' Each coded number is calculated
    based on a formula and key provided by the IRS, using data from the
    Form W-2 itself, so that each number generated was known only to the
    IRS, the payroll service provider, and the individual who received the
    Form W-2. The verification code cannot be reverse engineered. Since
    this identifier is unique, any changes to the Form W-2 information
    provided when filed are detected by the IRS. Individuals whose Forms W-
    2 were affected by the pilot and who used tax software to prepare their
    return entered the code when prompted to by the software program. The
    IRS plans to increase the scope of this pilot for the 2017 filing
    season by expanding the number and types of Form W-2 issuers involved
    in the test.
          verifying identities and stopping suspicious online activity
    Following the OMB Guidance and NIST Standards
        The IRS continues to make every effort to ensure that we provide
    tax account-related services only after verifying the identity of
    individuals seeking those services. This is true for all of our
    communications channels, some of which allow for extremely strong
    assurance processes that are not possible in other channels.

        For example, IRS employees at our Taxpayer Assistance Centers
    provide face-to-face help to taxpayers, and thus can easily verify
    identity through photo identification. This method provides the
    strongest possible level of assurance, but is obviously not feasible
    with phone or online interactions. Additionally, in-person assistance
    is more time-consuming for the taxpayer and costly for the IRS than the
    help we provide through other communications channels.

        Given the ability of cybercriminals and identity thieves to evolve
    and improve their methods of stealing personal data, the need to
    properly verify the identity of taxpayers using online services is
    particularly great. In developing authentication procedures for online
    interactions with taxpayers, the IRS continues to follow the Office of
    Management and Budget (OMB) memorandum issued in 2003, E-Authentication
    for Federal Agencies.

        This memorandum establishes criteria for determining the risk-based
    level of authentication assurance required for specific electronic
    applications and transactions. It requires agencies to review new and
    existing electronic transactions, to ensure authentication processes
    provide the appropriate level of assurance from among four levels,
    which are as follows:

        Level 1: Little or no confidence in the asserted identity's
    validity;
        Level 2: Some confidence in the asserted identity's validity;
        Level 3: High confidence in the asserted identity's validity; and
        Level 4: Very high confidence in the asserted identity's validity.

        Each increase in level requires users to take additional steps to
    validate their identity and gain access to a given online transaction.

        In addition to the OMB memorandum, we also follow the technical
    requirements set by NIST for the four levels of assurance defined in
    the OMB guidance. It is important to note that the NIST standards
    anticipate and require varying levels of assurance depending on the
    nature of a given online transaction and the information being
    exchanged.

        In following the NIST standards, the IRS employs differing levels
    of authentication assurance among the various digital services used by
    taxpayers. For example, the level of authentication required for an
    online tool that only accepts payments from a taxpayer can reasonably
    be set lower than an application that provides the taxpayer with their
    personal tax information.

        Thus, in establishing a risk assurance level to a particular online
    digital service, the IRS, in addition to assigning one of the four
    numerical levels of risk assurance, also assigns a letter representing
    the amount and types of validation that a taxpayer would have to
    provide, in order to gain access to the digital service in question:

        A: No credential required (OMB Level 1);
        B: User ID and password required, but no identity proofing (OMB
    Level 1);
        C: User ID and password, plus basic identity proofing--providing
    information such as name, address, date of birth, SSN (OMB Level 2);
        D: Everything included in C above, plus knowledge-based
    authentication--answers to so-called ``out of wallet'' questions that
    only the legitimate taxpayer should know (OMB Level 2);
        E: Everything included in D above, plus financial validation, such
    as providing the taxpayer's prior-year adjusted gross income (OMB Level
    2);
        F: Everything included in C above, plus financial validation and an
    additional authentication factor, such an authentication code texted or
    mailed to the user--so-called multifactor identification (OMB Level 3);
    and
        G: In-person authentication.
    Recent Unauthorized Attempts to Access IRS Online Services
        Over the past year, unauthorized attempts were made to access
    online services on our website, IRS.gov. These attempts were not on our
    main computer system, which remains secure. Instead, in each situation
    criminals were attempting to use taxpayer information they had stolen
    from other sources to access IRS services by impersonating legitimate
    taxpayers, in order to file false tax returns and claim fraudulent
    refunds.

        Each of the situations, which are described in more detail below--
    involving the Get Transcript online application, the Identity
    Protection Personal Identification Number (IP PIN) retrieval tool and
    the Get Your Electronic Filing PIN tool--illustrate both the progress
    we have made and the challenges we continue to face in detecting
    suspicious activity and ensuring the digital services we provide are
    used only by taxpayers who legitimately seek them.

        For all three services, the improvements made to our system-
    monitoring capabilities allowed the IRS to uncover the suspicious
    activity. We continue to improve these monitoring capabilities and
    enhance our return processing filters so that we can thwart criminal
    activity as quickly as possible.

        But improving our ability to react to these threats is not enough.
    The three situations are examples of how nimble criminals have become
    in attempting to access our systems by masquerading as legitimate
    taxpayers. In each case, those who were making the unauthorized
    attempts to gain access had already obtained vast amounts of stolen
    individual taxpayer data and were using it to help them get into our
    systems, with the ultimate goal of claiming a fraudulent refund. We are
    finding that, as the IRS improves monitoring capabilities and shuts off
    certain avenues of entry, identity thieves find new ways to file false
    returns. As the IRS enhances return processing filters and catches more
    fraudulent returns at the time of filing, criminals have become more
    sophisticated at faking taxpayers' identities so they can evade those
    filters and successfully obtain fraudulent refunds.

        Therefore, the IRS is working not just to react better and faster,
    but to anticipate the criminals' next moves and stay ahead of them. To
    fully protect taxpayers and the tax system, the IRS must not only keep
    pace with, but also get ahead of, criminals and criminal organizations,
    as they improve their efforts to obtain personal taxpayer information.
    The ongoing collaborative work of the Security Summit group along with
    additional funding received in FY 2016 as part of the Section 113
    Administrative Provision have been crucial. The FY 2017 budget requests
    additional funding including a Departmentally-managed Cybersecurity
    Enhancement account which allows the IRS and the Department to leverage
    enterprise-wise services and capabilities.

        Following are descriptions of the three situations referenced above
    involving suspicious online activity:

        Get Transcript Application. The Get Transcript online application
    allows taxpayers to view and print a copy of their prior-year tax
    information, also known as a transcript, in a matter of minutes.
    Taxpayers use tax transcript information for a variety of non-tax
    administration, financial activities, such as verifying income when
    applying for a mortgage or financial aid.

        Prior to the introduction of this online tool in January 2014,
    taxpayers needing a transcript had to order a transcript by mail, by
    phone, or in person at one of our Taxpayer Assistance Centers, and then
    have it mailed to them.

        The development of the Get Transcript online application began in
    2011. The IRS conducted a risk assessment and determined that the e-
    authentication risk assurance level appropriate for this application
    was 2D, which required the taxpayer to provide basic items of personal
    information and also answer out-of-wallet questions. At that time, this
    type of authentication process was the industry standard, routinely
    used by financial institutions to verify the identity of their
    customers conducting transactions online.

        During the 2015 filing season, taxpayers used the Get Transcript
    online application to successfully obtain approximately 23 million
    transcripts. If this application had not existed and these taxpayers
    had to call or write us to order a transcript, it would have stretched
    the IRS's limited resources even further.

        In May 2015, the IRS announced that criminals, using taxpayer
    information stolen elsewhere, had been able to access the Get
    Transcript online application. Shortly thereafter, we disabled the
    application. We are now strengthening the authentication process and
    expect to bring the Get Transcript application back on-line, in the
    near future. In reevaluating the application, we have changed the risk
    assurance level for this application to 3F, which will require
    taxpayers toundergo a multifactor authentication process in order to
    gain access. In the meantime, taxpayers can still place an order for a
    transcript online, and have it mailed to their address of record.

        The IRS, immediately focusing on last year's filing season,
    initially identified approximately 114,000 taxpayers whose transcripts
    had been accessed and approximately 111,000 additional taxpayers whose
    transcripts were targeted but not accessed. We offered credit
    monitoring, at our expense, to the group of 114,000 for which the
    unauthorized attempts at access were successful. We also promptly sent
    letters to all of these taxpayers to let them know that third parties
    may have obtained their personal information from sources outside the
    IRS in an attempt to obtain their tax return data using the Get
    Transcript online application.

        Our review of the situation continued and, in August 2015, we
    identified another 220,000 taxpayers whose transcripts may have been
    accessed and approximately 170,000 taxpayers whose transcripts were
    targeted but not accessed. We again notified all of these taxpayers
    about the unauthorized attempts, and offered credit monitoring to the
    220,000.

        In addition, the Treasury Inspector General for Tax Administration
    (TIGTA) conducted a 9-month investigation looking back to the launch of
    the application in January 2014 for additional suspicious activity.
    This expanded review identified additional unauthorized attempts to
    access taxpayer information using the Get Transcript online
    application. This review found potential access of approximately
    390,000 additional taxpayer accounts during the period from January
    2014 through May 2015. An additional 295,000 taxpayer transcripts were
    targeted but access was not successful. Again, the IRS sent letters to
    these taxpayers alerting them to the unauthorized attempts, offering
    credit monitoring to those whose accounts were accessed.

        The additional attempts uncovered by TIGTA brought the total number
    of potential unauthorized accesses to the Get Transcript online
    application to 724,000. So far, we have identified approximately
    250,000 potentially fraudulent returns that were filed on behalf of
    these taxpayers, and we have stopped the majority of the known
    fraudulent refunds from going out.

        I would note that our analysis of the attempts to access the Get
    Transcript online application is ongoing, and we may yet discover that
    some accesses classified as unauthorized were, in fact, legitimate. For
    example, family members, tax return preparers or financial institutions
    could have been using a single e-mail address to attempt to access more
    than one account. However, in an abundance of caution, IRS notified any
    and all taxpayers whose accounts met these criteria.

        Additionally, as a result of the Get Transcript online application
    problem, we added an extra layer of protection for taxpayers who use
    our online services. We started sending a letter, known as a CP301
    notice, to taxpayers when they first create a login and password for
    any web application on IRS.gov. This notice tells the taxpayer that
    someone registered for an IRS online service using their information.
    If the taxpayer was not the one who registered, the notice instructs
    the taxpayer to contact the IRS. Mailing this notice conforms to NIST
    guidance, and is a best practice similar to that used by the Social
    Security Administration and other financial institutions.

        Since we began sending these notices, we have disabled
    approximately 5,100 online accounts at the request of taxpayers who
    received a CP301. The majority of these accounts were disabled between
    January and March of this year, and we estimate that approximately 80
    percent of these requests were related to the unauthorized attempts to
    access the IP PIN retrieval tool described below.

        IP PIN Retrieval Tool. One aspect of the IRS's efforts to help
    taxpayers affected by identity theft involves the IP PIN, a unique
    identifier that authenticates a return filer as the legitimate
    taxpayer. If the IRS identifies a return as fraudulently filed, the IRS
    offers the legitimate taxpayer the ability to apply for an IP PIN for
    use when filing their next return. The IRS mails the IP PIN to the
    taxpayer's address of record, and the IP PIN is valid for only one
    filing season.

        The IP PIN program began as a pilot in 2011, and since then has
    grown significantly. For the 2016 filing season, the IRS issued IP PINs
    to 2.7 million taxpayers previously identified by the IRS as victims of
    identity theft or participants in a pilot program. This pilot is for
    taxpayers living in Florida, Georgia and Washington, DC--three areas
    where there have been particularly high concentrations of stolen
    identity refund fraud--who can request an IP PIN regardless of whether
    the IRS has identified them as a victim of identity theft.

        In 2015, the IRS developed an online tool that allowed taxpayers
    who had received an IP PIN to retrieve it if they lost or misplaced the
    number before filing their return. Taxpayers accessed this tool on
    IRS.gov by entering personal information to authenticate their
    identity. The retrieval tool has been used by only a small subset of
    all taxpayers receiving an IP PIN: this filing season, out of the 2.7
    million who received an IP PIN, just 130,000, or about 5 percent, used
    the retrieval tool.

        After discovering the problems with the Get Transcript online
    application, we began in July 2015 to monitor every request to recover
    a forgotten or lost IP PIN. In February 2016, as part of this
    proactive, ongoing security review, the IRS temporarily suspended this
    retrieval tool after detecting potentially unauthorized attempts to
    obtain IP PINs using the tool. Thus far, the IRS has confirmed and
    stopped about 5,000 false returns using a fraudulently obtained IP PIN.
    While our analysis is ongoing, at this time we do not believe any
    fraudulent refunds were issued as a result of successful unauthorized
    attempts to retrieve an IP PIN.

        We are conducting a further review of this online tool and will
    strengthen its security features before bringing it back online. The
    IRS conducted an e-authentication risk assessment, following OMB
    guidelines, for the IP PIN retrieval tool, and has assigned an
    assurance level of 3F to this tool, so that taxpayers will have to
    undergo a multifactor authentication process to gain access once we
    bring the tool back online. Taxpayers who still need to retrieve a lost
    IP PIN in order to file their 2015 tax return can call the IRS, and we
    will mail the replacement IP PIN to the taxpayer's address of record.

        Get Your Electronic Filing PIN Online Tool. Another way in which
    the IRS employs personal identification numbers involves the electronic
    signature on a tax return. When taxpayers electronically file a return,
    they sign their return by obtaining one of several types of PINs
    available through IRS.gov.

        For example, the self-select PIN (SSP) method requires the taxpayer
    to use their prior-year adjusted gross income (AGI) or their prior-year
    SSP to authenticate their identity. They then select a five-digit PIN
    that can be any five numbers to enter as their electronic signature.

        The IRS also provides an alternative to taxpayers unable to access
    their prior-year tax year return information for electronic signature
    authentication purposes. Using the Get Your Electronic Filing PIN
    application, taxpayers can enter identifying information and receive a
    temporary electronic filing PIN that can be used only for the current
    tax filing season. During FY 2015, taxpayers obtained approximately 25
    million e-File PINs. On average, e-File PINs are used to sign about 12
    million returns a year.

        In January of this year, the IRS identified and halted an automated
    ``bot'' intrusion upon the Get Your Electronic Filing PIN application.
    In this intrusion, identity thieves employed malicious software,
    commonly known as ``malware,'' to gain access to the application and
    generate e-File PINs for SSNs they had stolen from sources outside the
    IRS. Based on our review, we identified unauthorized attempts involving
    approximately 464,000 unique SSNs, of which 101,000 SSNs were used to
    successfully access an e-File PIN.

        Nonetheless, our analysis of the situation found that no personal
    taxpayer data was compromised or disclosed by IRS systems, and no
    fraudulent refunds were issued. The IRS has taken steps to notify
    affected taxpayers by mail that their personal information was used in
    an attempt to access this IRS application. The IRS has also put returns
    filed under these SSNs through additional scrutiny to protect against
    future tax-related identity theft.
                             looking to the future
    Building an Authentication Framework
        These incidents illustrate the challenges we face in developing
    appropriate authentication procedures for online transactions. The IRS
    takes protection of taxpayer data very seriously, and with that in
    mind, we must constantly strike a balance between citizen convenience
    and strong authentication and security protocols in an ever-changing
    cybercrime environment. The incidents also illustrate a wider truth
    about identity theft in general, which is that there are no perfect
    systems. No one, either in the public or private sector, can give an
    absolute guarantee that a system will never be compromised. For that
    reason, we continue our comprehensive efforts to update the security of
    our systems, protect taxpayers and their data, and investigate crimes
    related to stolen identity refund fraud.

        We are reviewing our current e-authentication risk assessment
    process to ensure that the level of authentication risk for all current
    and future IRS online services accurately reflects the risk to the IRS
    and taxpayers should an authentication vulnerability occur.

        We also realize that more needs to be done. A key element in our
    efforts to improve protections for existing online tools and new ones
    contemplated for the future is the development of a strong, coordinated
    and evolving authentication framework. This framework, once fully
    developed, will enable us to require multifactor authentication for all
    online tools and applications that warrant a high level of assurance.

        To ensure proper development of our authentication framework, the
    IRS recently created a new position, the IRS Identity Assurance
    Executive. This executive will develop our Service-wide approach to
    authentication. In addition, we have engaged with the U.S. Digital
    Service (USDS), which uses the best of product design, engineering
    practices and technology professionals to build effective, efficient,
    and secure digital channels to transform the way government works for
    taxpayers.

        We are joining forces with a team from USDS as we develop the
    future taxpayer digital experience and the foundational authentication
    standards that will enable secure digital exchanges between the IRS and
    taxpayers. In addition, we will leverage NIST standards to ensure that
    authentication processes used for all current and future online
    applications provide the required level of assurance for the determined
    level of authentication risk.

        Going forward, we will continue to review and adjust our
    authentication protocols accordingly. The sophistication of today's
    cybercriminals and identity thieves requires us to continually reassess
    and modify these protocols.
    Enhancing the Taxpayer Experience

        Our efforts to detect and stop suspicious online activity and to
    develop a strong authentication framework are especially critical now,
    as the IRS builds toward the future and works to improve the online
    taxpayer experience for those taxpayers who prefer to communicate with
    us this way.

        Within our tight budget constraints, the IRS has continued to
    analyze and develop plans for improving how the agency can fulfill its
    mission in the future, especially in delivering service to taxpayers.

        We are looking forward to a new and improved way of doing business
    that involves a more robust online taxpayer experience. This is driven,
    in part, by business imperatives, since it costs between $40 and $60 to
    interact with a taxpayer in person, and less than $1 to interact
    online. But we also need to provide the best possible taxpayer
    experience, in response to taxpayer expectations and demands.

        While we have spent the last several years developing new tools and
    applications to meet these taxpayer expectations and demands, we are
    now at the point where we believe the taxpayer experience needs to be
    taken to a new level. Our goal is to increase the availability and
    quality of self-service interactions, which will give taxpayers the
    ability to take care of their tax obligations online in a fast, secure
    and convenient manner.

        The idea is that taxpayers would have an account with the IRS where
    they, or their preparers, could log in securely, get all the
    information about their account, and interact with the IRS as needed.
    Most things that taxpayers need to do to fulfill their Federal tax
    obligations could be done virtually, and there would be much less need
    for in-person help, either by waiting in line at an IRS assistance
    center or calling the IRS.

        As we improve the online experience, we understand the
    responsibility we have to serve the needs of all taxpayers, whatever
    their age, income, or location. We recognize there will always be
    taxpayers who do not have access to the Internet, or who simply prefer
    not to conduct their transactions with the IRS online. The IRS remains
    committed to providing the services these taxpayers need. We do not
    intend to curtail the ability of taxpayers to deal with us by phone or
    in person.

        In building toward the future of taxpayer service, we will need to
    strike a delicate balance with our efforts to improve our
    authentication protocols described above. Authentication protocols will
    need to be high, but not so high as to preclude taxpayers from
    legitimately using the online services we provide. As criminals become
    increasingly sophisticated, we will need to continue recalibrating our
    approach to authentication to continue maintaining this balance.

        The Get Transcript online application is a good example of these
    tradeoffs. Under the original authentication method we required for the
    Get Transcriptonline application, we estimate that about 22 percent of
    legitimate taxpayers trying to access the application were unable to
    get through. We anticipate that under the multifactor authentication
    protocol to be implemented, an even higher percentage of taxpayers will
    be unable to use the tool. We will explain to taxpayers why these
    strong protections are necessary. All taxpayers will be able to order a
    transcript, online or by phone, and have it mailed to their address of
    record, if the online tool does not work for them, or if they prefer
    not to interact with us online.
    Need for Adequate Resources and Legislative Solutions
        An important consideration as we move into the future is the need
    for adequate resources to continue improving our efforts against
    identity theft and protecting our systems against cybercrime involving
    incidents, intrusions, and attacks. The IRS has been operating in an
    extremely difficult budget environment for several years, as our
    funding has been substantially reduced. In FY 2016, our funding level
    is more than $900 million lower than it had been in FY 2010.

        Despite those reductions, the IRS still devotes significant
    resources to cybersecurity and identity theft, even though our total
    needs still exceeded our available funds.

        Congress provided $290 million in additional funding for FY 2016,
    to improve service to taxpayers, strengthen cybersecurity and expand
    our ability to address identity theft. This action by lawmakers was a
    helpful development for the IRS and for taxpayers, and we appreciate
    it. Sustaining and increasing funds available for cybersecurity efforts
    at the IRS is critical this year and in the future. The IRS is using
    the new resources wisely and efficiently. This includes:

          Cybersecurity. We are using approximately $95.4 million to
    invest in a number of critical security improvements, including more
    effective monitoring of data traffic and replacement of technology that
    supports the development, maintenance and operation of IRS applications
    to make processes more secure, reliable and efficient. The funding will
    help us to improve systems and defenses across the entire IRS, thereby
    helping to protect taxpayer data. We are also investing in systems to
    allow for enhanced network segmentation, which involves further
    subdividing our network, so that if any vulnerabilities occur, they
    would be contained to just one portion of the network.

          Identity Theft. We are using approximately $16.1 million to
    develop advanced secure access capabilities for applications such as
    Get Transcript, IP PIN and others. This will also fund advanced
    analytics and detection of anomalies in returns filed. In addition,
    this investment will allow the IRS to partner with private industry and
    State tax agencies through the Security Summit to, for the first time,
    share information systemically about suspicious activity in the tax
    system.

          Taxpayer Service. We are using approximately $178.4 million
    provided in the additional $290 million to add about 1,000 extra
    temporary employees to help improve our service on our toll-free phone
    lines. As a result, we are already seeing service improvements. So far
    this filing season, the telephone level of service (LOS) is nearly 75
    percent, and the average for the entire filing season will probably be
    above 70 percent, which is a vast improvement over last year. The IRS
    has prioritized LOS during filing season, and was operating at
    historically low levels up until the new appropriations were provided
    in December. In fact, we expect LOS for the full year to be about 47
    percent. The 2017 Budget provides LOS above 70 percent for the full
    year with an investment of $150 million above current levels, and by
    supplementing with user fees.

        The FY 2017 President's Budget sustains and bolsters funding for
    these important programs. This includes $90 million in additional
    funding to help prevent identity theft and refund fraud and to reduce
    improper payments. This funding will increase the capacity of our most
    important programs discussed above, including external leads and
    criminal investigations. New funds will allow the IRS to close almost
    100,000 additional identity theft cases per year by helping victimized
    taxpayers who have engaged the IRS for assistance. The number of
    identity theft cases has grown from 188,000 in FY 2010 to 730,000 in FY
    2014, and current resources can only close about 409,000 per year.

        The FY 2017 President's Budget also requests cybersecurity funds
    provided through a Department wide Cybersecurity Enhancement account,
    which will bolster Treasury's overall cybersecurity posture. Of the
    nearly $110 million requested in the account, $54.7 million will
    directly support IRS cybersecurity efforts by securing data, improving
    continuous monitoring, and other initiatives. An additional $7.4
    million will be used to continue development and implementation of
    electronic authentication systems currently being developed for the Get
    Transcript online application for our expanding set of digital
    services.

        While adequate funding is critical to improving our cybersecurity
    efforts, Congress also provides important support to the IRS by passing
    legislative proposals that improve tax administration. An excellent
    example is the enactment last December of the requirement for companies
    to file Form W-2s and certain other information returns earlier in the
    year than now. Having W-2s earlier will make it easier for the IRS to
    verify the legitimacy of tax returns at the point of filing and to spot
    fraudulent returns.

        Although the new law is not effective until the 2017 filing season,
    some employers that issue large volumes of W-2s agreed this year to
    voluntarily file them earlier in the year, so the benefit of the change
    is already beginning to be felt. This year we received early
    submissions of about 26 million W-2s, most of which came in by the end
    of January. The IRS is using this data in our program to verify claims
    of wages and withholding on individual income tax returns. We expect
    this to assist in the quicker release of refunds for those returns we
    are able to verify.

        We have asked Congress for other changes to enhance tax
    administration and help us in our efforts to improve cybersecurity. An
    important proposal is the reauthorization of so-called streamlined
    critical pay authority, originally enacted in 1998, to assist the IRS
    in bringing in individuals from the private sector with the skills and
    expertise needed in certain highly specialized areas, including IT,
    international tax and analytics support. This authority, which ran
    effectively for many years, expired at the end of FY 2013 and was not
    renewed.

        The loss of streamlined critical pay authority has created major
    challenges to our ability to retain employees with the necessary high-
    caliber expertise in the areas mentioned above. In fact, out of the
    many expert leaders and IT executives hired under critical pay
    authority, there are only 10 IT experts remaining at the IRS, and we
    anticipate there will be no staff left under critical pay authority by
    this time next year. The President's FY 2017 Budget proposes
    reinstating this authority, and I urge the Congress to approve this
    proposal.

        Chairman Hatch, Ranking Member Wyden, and members of the committee,
    this concludes my statement. I would be happy to take your questions.

                                     ______

                     Prepared Statement of Hon. Ron Wyden,
                           a U.S. Senator From Oregon
        Hackers and crooks, including many working for foreign crime
    syndicates, are jumping at every opportunity they have to steal hard-
    earned money and sensitive personal data from U.S. taxpayers. It
    happens online and in the real world. And in my view, taxpayers have
    been failed by the agencies, the companies, and the policymakers here
    in Congress they rely on to protect them.

        It was unacceptable for the IRS to leave the front door open to
    hackers by using a weak authentication process for its Get Transcript
    system. It meant thieves could walk through the door and steal the tax
    information of three quarters of a million taxpayers.

        And to make matters worse, after the IRS mailed special Identity
    Protection PIN numbers to the hacking victims, it repeated its mistake
    and used lax security online. For the tax scammers, once again it was
    as easy as going online, plugging in the personal data you've already
    stolen, and pretending to be somebody who's lost their IP PIN. So after
    leaving the front door open, the IRS left the back door open, too.
    There is no excuse for this.

        But poor protection of taxpayer information is not just a problem
    at the IRS--there's a lot of blame to go around. Already this tax
    season, hackers have gotten into the inadequately guarded systems of
    private software firms and stolen personal information from thousands
    of people. And it's my judgement that you can't have an honest
    discussion about protecting taxpayer information without including the
    vulnerabilities from e-file providers, as well as crooked return
    preparers who operate in the shadows and steal from customers.

        For years Republicans and Democrats agreed on the need for minimum
    standards for return preparers, but Congress has sat back and watched
    while criminals have come in and preyed on taxpayers. When it comes to
    blocking hackers, Congress has done next to nothing while the IRS loses
    its ability to hire the experts who can keep taxpayer information safe.

        If you're a top-notch tech expert, you're already taking a pay cut
    to work in public service compared to what you'd earn at firms in
    Oregon or California. Now, without what's called ``streamlined critical
    pay authority,'' it can take 4 to 6 months to bring a new hire on board
    at the IRS. So let's be clear: taxpayer information is under assault
    every day, but the IRS does not have the legal authority it needs from
    Congress to build a cybersecurity team that can beat back the crooks.

        Already there's been an exodus of high-ranking IRS tech staff. The
    Director of Cybersecurity Operations left a month ago. The terms for
    the remaining employees working under this authority continue to
    expire, including for one of our witnesses, Chief Technology Officer
    Terence Milholland. Come 2017, there will not be any left.

        So today, instead of rehashing the past and beating up on one
    agency or one firm, this committee ought to focus on how to step up the
    fight against hackers and crooks across the board. It's my view that
    streamlined critical pay authority is a key part of the solution. There
    was a bipartisan bill ready to go last fall, and this committee ought
    to move forward on it as soon as possible. Furthermore, Congress needs
    to make more than token investments in IT at the IRS. Congress has held
    the IRS' tech budget below where it was 6 years ago, but you can bet
    that the hackers haven't backed down since then.

        Next, the IRS and private firms need to do much more to keep
    taxpayer information safe in their systems. The Get Transcript hack I
    mentioned earlier has been well documented. And a recent audit by the
    Online Trust Alliance found that the security maintained by private
    free-file services did not meet expectations. It is unacceptable for
    troves of taxpayer data to be more vulnerable to hacking than many
    social media or e-mail accounts. And the committee ought to consider
    whether the IRS has the authority it needs to guarantee that the
    security used by private software firms is up to snuff.

        While many tax preparers are honest practitioners, there are always
    some bad apples in the barrel. Last year Senator Cardin and I
    introduced a bill giving IRS the authority to regulate tax return
    preparers. Senator Hatch and I have worked to create a bipartisan
    identity theft bill for markup in the Finance Committee, which I had
    hoped would include the regulation of return preparers. It is still my
    view that people handling sensitive taxpayer information should meet
    minimum standards and that the committee should vote to require that.

        It's already open season for hackers to steal money and data from
    hard-working Americans, so congressional inaction should not make the
    situation worse. With tax day approaching, millions of Americans are
    filing their returns online, through the mail, or with a private return
    preparer. This committee has a responsibility to protect taxpayers no
    matter what filing method they choose. So I see this hearing as an
    opportunity to find bipartisan solutions on all fronts.

                                     ______

                                 Communication

                                  ----------

                    Statement for the Record by Kwame Gyamfi

             ``Cybersecurity and Protecting Taxpayer Information''

                                 April 12, 2016

    Senate Committee on Finance
    Dirksen Senate Office Building
    Washington, DC 20510-6200

    I had the opportunity to attend the ``Cybersecurity and Protecting
    Taxpayer Information'' panel discussion on April 12, 2016. The purpose
    of this statement is to bring to this committee's attention the
    importance of developing safeguards to protect the public after a data
    breach has been uncovered. As a matter of public record, the OPM data
    breach of former and present federal employees and contractors
    indicated that the personal and private information had been breached
    from the eQip system. The OPM then instituted an identity theft
    monitoring system designed to safeguard the victims of this data breach
    in the event their private information was used against them.
    Unfortunately, these traditional safeguards are antiquated and
    outdated.

    Hence, cyber-criminals are far more sophisticated and have developed
    tools and applications to subvert the traditional methods of targeting
    fraud victims. Therefore, this honorable committee must consider
    encouraging the executive branch to consider monitoring sophisticated
    ``shadow'' and ``ghost'' applications that act as front-end
    applications that mimic official government systems. Unfortunately,
    during the hearing the focus was primarily a discussion about hiring
    industry leaders in cybersecurity to assist the agency (IRS) in
    protecting the taxpayer information. However, this discussion did not
    take into consideration the ``real-world'' applications of how cyber-
    criminals manage and process breached taxpayer data.

    In closing, ``shadow''' and ``ghost'' applications are systems that
    simulate official government systems, but are instead fraudulent
    applications. These systems are able to process millions of taxpayer
    dollars via bogus government letterhead ``.us'' domains and skewed
    legal jargon designed to confuse the targeted victims in banking and
    private industries. Hence federal government agencies must be vigilant
    in leading the charge against cybersecurity fraud and not just focus on
    the breach within the agency, but consider the sophistication of cyber-
    criminals that lay within and outside the federal government.

                                       [all]