January 09, 2002
Grassley Seeks More Details on Lost IRS Computers
WASHINGTON – Sen. Chuck Grassley, ranking member of the Committee on Finance, isseeking information on whether approximately 2,300 missing Internal Revenue Service computerscontained access to sensitive taxpayer data. Grassley also is asking a key nominee to address thisissue.
(1) Senator Grassley’s letter today to the Treasury Inspector General for Tax Administration
(2) Senator Grassley’s questions for Edward Kingman Jr., nominee for assistant secretary ofTreasury for management and chief financial officer
January 9, 2002
Via Regular Mail and Facsimile: (202) 927-7323
Mr. David C. Williams
Inspector General for Tax Administration
1125 15th Street, NW
Washington, D.C. 20005
Re: Whether IRS’ Missing Computers Contain Confidential Taxpayer Information
Dear Inspector General Williams:
As Ranking Member of the Senate Committee on Finance (Committee), I continue to shareyour commitment to overseeing the Internal Revenue Service (IRS) to ensure that it effectivelyperforms its mission while protecting the integrity of its inventory. This letter responds toinformation reported by the Inspector General for Tax Administration (TIGTA) upon my requestrelating to IRS inventory controls over computers, firearms, and other sensitive items that, if lost orstolen, might compromise the public’s safety, national security, or ongoing investigations. See“Management Advisory Report: Review of Lost or Stolen Sensitive Items of Inventory at the InternalRevenue Service, November 2001 (Reference No.: 2002-10-030).” As you are aware, I havesimilarly asked the Inspector General of the Department of the Treasury (Treasury IG) to assess thatDepartment’s inventory practices. The Treasury IG’s initial, unaudited response identifies the lossor theft of approximately 80 weapons and 1,300 computers. I expect the final audit report to beissued in the Spring of 2002.
TIGTA states that for the past three years, IRS reported 2,332 missing computers, six lostor stolen firearms, and “502 other investigative items that were lost or stolen” to include 50communications devices, 40 identification badges, and 15 electronic surveillance devices that couldcompromise the public’s safety or ongoing investigations. These numbers do not account for anylosses pertaining to the events of September 11, 2001, and for IRS offices that did not providecomplete information on the number of lost or stolen firearms and sensitive investigative items ofinventory.
I am very concerned about the high number of missing IRS items, particularly those that maypotentially compromise public safety or law enforcement. I also continue to be concerned thatunauthorized users may be able to access information on missing computers, despite the securitycontrols that should function in theory. This concern is heightened given that lost or stolen IRScomputers may contain confidential taxpayer information. Our law provides that taxpayer returnsand return information are confidential and may not be accessed or disclosed except as authorizedby the Internal Revenue Code Section 6103. Civil actions for damages are permitted against thegovernment and criminal sanctions may be imposed upon intentional violators.
Given the limited scope of my initial inquiry, TIGTA could not provide a precise figure onhow many missing IRS computers might have had taxpayer information on the hard drives. IRS mayhave that information on the individual Reports of Survey (Forms 1933) that should be preparedwhenever a computer is lost or stolen. However, TIGTA did obtain four Forms 1933, one of whichindicated that there were computer files on the stolen computer related to taxpayer examinations, andthose files were encrypted. Here, I question the sufficiency of IRS’ computer encryption to protectconfidential taxpayer information.
Given the importance of protecting taxpayer information from unauthorized disclosure andto protect the taxpayers’ money, I appreciate your continuing your assessment of IRS inventory toinclude the following:
1. Identify the approximate value at the time of the loss, using an appropriate valuationmethod, for a representative sample of items from the reported 2,332 missingcomputers. Also, identify whether the missing computers were lost, stolen, ordestroyed, where possible.
2. Identify the approximate value at the time of the loss, using an appropriate valuationmethod, for the six lost or stolen firearms, and the 50 communications devices, 40identification badges, and 15 electronic surveillance devices that were missing. Also,identify whether these investigative items were lost, stolen, or destroyed, wherepossible.
3. For the items in 1 and 2 above, identify the types of disciplinary actions, if any, takenagainst employees found to be responsible for the loss or theft. Specifically, I ask thatyou provide me what follow-up there has been on lost or stolen computers and towhat extent IRS employees have reimbursed the government for missing computers.
Also, please identify how many of the missing computers were the responsibility ofa senior manager and what discipline action was taken against them. Finally, pleaseidentify if any individual has missing more than one computer, and what, if any,disciplinary action was taken against that individual.
4. For the missing computers in the sample, determine where possible how manycomputers contained confidential taxpayer information.
5. Assess the sufficiency of IRS encryption practices of taxpayer data maintained ondesktop and laptop computers to prevent the unauthorized disclosure of such data ifthe computer was lost or stolen.
6. Provide to this Committee copies of Forms 1933 and related documents receivedfrom IRS and reviewed during your assessment. Also, please identify the responsiblemanagers who failed to properly file a Form 1933 for a missing computer(s).
I appreciate receiving TIGTA’s written response to this request by February 25, 2002.
Charles E. Grassley
CC Via Telefax (202) 622-5756:
The Honorable Charles O. Rossotti, Commissioner, Internal Revenue Service
Questions for Edward Kingman Jr.
Nominee, Assistant Secretary of Treasury for Management and Chief Financial Officer (CFO),Department of Treasury
Please find attached a letter I sent to the Director of the Office of Management and Budget(OMB) regarding 2,300 missing computers at the Internal Revenue Service (IRS). Of note, theTreasury IG has found an additional 1,300 missing computers at the Department of Treasury (notincluding IRS).
1. The General Accounting Office (GAO) reported recently that serious weaknesses in the inventorycontrol systems continue to prevent the IRS from having equipment information available formanagement purposes, and from having reasonable assurance that the assets are properlysafeguarded.
Do you believe this is a serious matter and what steps do you intend to take to remedy this matter?
2. The IRS has reported a material weakness in inventory controls every year since 1983.Is this acceptable and at what month and year can we expect this to no longer be a materialweakness? Is there currently a person(s) who will be accountable if there continues to be a materialweakness? If there is not presently a person accountable, will you designate someone to beaccountable?
3. In what situations should an employee or manager be required to reimburse the federalgovernment for a missing computer? Of the 2,300 missing computers, how many has the federalgovernment received and/or sought reimbursement?
4. Do you have sufficient authority to remedy this matter at the IRS? If not, what additionalauthority do you require?
5. Please provide any additional comments you believe are appropriate in response to the letter toMr. Daniels.