Privacy Digest

FCW.com News - Report: Lost IRS laptops puts taxpayer data at risk: "Thousands of taxpayers are potentially at risk of identity theft because the Internal Revenue Service has lost or experienced the theft of 490 laptops over the last three years, a government report concludes.

The agency has compiled a list of 387 data breach incidents among the missing computers due to inadequate encyrption of taxpayers' personal data and weak password controls, said the Treasury Inspector General for Tax Administration (TIGTA).

TIGTA determined that at least 24 of those incidents that involved 480 individuals could have been prevented if employees had followed IRS policies and procedures, TIGTA said in a recent report.

The IRS reported the computers went missing from 2003 to 2006, many stolen from vehicles and homes and some from IRS facilities. The devices included flash drives, CDs and DVDs. TIGTA reported similar findings in 2003, but said the IRS did not thoroughly correct the problems.

'As a result, it is likely that sensitive data for a significant number of taxpayers have been unnecessarily exposed to potential identity theft and/or other fraudulent schemes,' said Michael Phillips, TIGTA's deputy inspector general for audit.

For its audit, TIGTA tested 100 laptops currently in use and determined that 44 still contained unencrypted sensitive data. Fifteen of the 44 were found to have weak security controls that were easy to bypass and gain access.

'Employees did not follow encryption procedures because they were either unaware of security requirements, did so for their own convenience, or did not know their own personal data were considered sensitive,' Phillips said.
"