Cybersecurity Laws: Irs And Data Protection

The Internal Revenue Service (IRS) is tasked with protecting the sensitive financial and personal information of taxpayers from cybercriminals. To this end, the IRS has implemented various security measures and guidelines, such as the “Security Six” measures, which include the use of anti-virus software, two-factor authentication, and data backup solutions. Additionally, the IRS has launched initiatives like the “Identity Theft Central” and the “Taxpayer First Act” to combat identity theft and refund fraud. Federal law mandates that the IRS establish and maintain an information security plan for client data, and the IRS also collaborates with the Security Summit, a partnership with state tax agencies and the private sector tax industry, to safeguard taxpayer information. However, the IRS has faced criticism for its inconsistent information security standards for third-party software companies and paid preparers, which has led to recommendations for centralized leadership and explicit authority to regulate security measures.

The IRS and the Security Summit

The Security Summit is a unique public-private partnership formed in 2015 to protect taxpayers and the US tax system from identity theft refund fraud. The partnership consists of the IRS, state tax agencies, and the wider tax community, including tax preparation firms, software developers, payroll and tax financial product processors, tax professional organizations, and financial institutions. In total, the Security Summit comprises 42 state agencies and 24 industry offices, in addition to the IRS.

The Security Summit members are organized into six work groups, each tasked with addressing a specific area of need. Each work group has a co-lead from the IRS, states, and industry. The Security Summit has been instrumental in creating initiatives to combat identity theft and tax fraud.

One such initiative is the "Taxes-Security-Together Checklist", which is a guide to help tax professionals implement basic cybersecurity measures. The checklist includes recommendations such as deploying the "Security Six" measures, activating anti-virus software, opting for two-factor authentication, using backup software/services, and creating Virtual Private Networks. Federal law mandates that all "professional tax preparers" create and maintain an information security plan for client data.

The Security Summit also runs awareness campaigns, such as "Tax Security 2.0" and "Protect Your Clients; Protect Yourself," to educate taxpayers, tax professionals, and businesses about the risks of identity theft and the actions they can take to protect their data. These campaigns provide practical advice, such as using security software with firewall and anti-virus protections, encrypting sensitive files, and using strong, unique passwords for each account.

In addition, the Security Summit has been active in warning tax professionals about evolving threats, such as phishing emails and cloud-based attacks. They provide security tips and resources to help tax professionals protect their clients' sensitive information. The Security Summit also offers a sample Written Information Security Plan to help tax professionals protect themselves from ongoing security threats.

Identity theft and fraud

The Taxpayer First Act includes several provisions to combat identity theft and protect taxpayers:

• Public-private partnership to address refund fraud (Section 2001): The IRS collaborates with the public and private sectors to protect taxpayers from identity theft refund fraud.
• Electronic Tax Administration Advisory Committee (ETAAC) (Section 2002): ETAAC studies and recommends additional ways to prevent identity theft and refund fraud to the IRS.
• Information Sharing and Analysis Center (ISAC) (Section 2003): The IRS is authorized to participate in ISAC and disclose certain return information to participants to detect and prevent identity theft, validate taxpayer identities, and authenticate taxpayer returns.
• Confidentiality safeguards for federal, state contractors (Section 2004): The IRS will only provide taxpayer information to contractors or agents of federal, state, or local agencies if they can ensure confidentiality and conduct regular compliance reviews.
• Identity Protection Personal Identification Numbers (IP PIN) (Section 2005): The Secretary is required to establish a program to issue IP PINs to US residents upon request and expand the issuance of IP PINs to appropriate states annually.
• Point of contact for identity theft victims (Section 2006): The IRS must establish single-point-of-contact procedures for taxpayers affected by tax-related identity theft, tracking cases and coordinating with IRS employees for quick resolution.
• Notification of suspected identity theft (Section 2007): The IRS must notify taxpayers if it finds any suspected unauthorized use of their identity or that of their dependents and keep them informed about investigations and actions taken.
• IRS management of stolen identity cases (Section 2008): The IRS, in consultation with the National Taxpayer Advocate, must develop and implement guidelines to reduce administrative burdens for victims of identity theft refund fraud, minimizing wait times, interactions with IRS employees, and resolution timeframes.
• Improper disclosure by return preparers (Section 2009): The civil and criminal penalties for unauthorized disclosure or misuse of taxpayer information by return preparers have been increased.

To protect against identity theft and fraud, the IRS provides the following recommendations:

• Use security measures like anti-virus software, two-factor authentication, backup services, drive encryption, and Virtual Private Networks (VPNs).
• Create and maintain an information security plan for client data, focusing on employee management, training, information systems, and system failure detection and management.
• Educate yourself and your clients about phishing scams, spear phishing emails, and ransomware.
• Recognize the signs of client data theft, such as receiving IRS letters about suspicious tax returns or clients getting unexpected refunds.
• Report suspected identity theft or data loss immediately to the local IRS stakeholder liaison, who will assist in blocking fraudulent returns and provide support.
• Implement a data security plan with the help of cybersecurity staff or consultants to safeguard client information.
• Utilize resources like Publication 4557, "Safeguarding Taxpayer Data," and Publication 5293, "Data Security Resource Guide for Tax Professionals."
• Stay vigilant and use multifactor authentication for online tax preparation products to protect client accounts.
• Track returns filed and weekly EFIN usage to identify potential data breaches.
• Use strong passwords, password managers, and encrypt sensitive files and emails.
• Back up sensitive data to secure external sources and regularly update security software.

Federal law and the IRS

Federal law and guidance require that the Internal Revenue Service (IRS) protect the confidentiality, integrity, and availability of the sensitive financial and taxpayer information that resides on its systems. The IRS also works closely with the Security Summit, a partnership with state tax agencies and the private-sector tax industry, to help protect taxpayer information and defend against identity theft.

To further this goal, the IRS, state tax agencies, and tax industry partners have created a Taxes-Security-Together Checklist to help tax professionals cover the basics of cybersecurity. The checklist includes recommendations such as deploying the "Security Six" measures, activating anti-virus software, opting for two-factor authentication, using backup software and services, and using drive encryption.

Federal law also requires all "professional tax preparers" to create and maintain an information security plan for client data. This requirement is flexible and can be adapted to fit any size of tax preparation business, from small to large. Tax preparers are asked to focus on key areas such as employee management and training, information systems, and detecting and managing system failures.

Additionally, the IRS has implemented the Taxpayer First Act, which includes several provisions to enhance cybersecurity and protect taxpayers from identity theft. For example, the Act authorizes the IRS to participate in the Information Sharing and Analysis Center (ISAC) and allows the IRS to disclose certain return information to ISAC participants to detect or prevent identity theft and cybersecurity threats. The Act also establishes an Identity Protection Personal Identification Number (IP PIN) program, requiring the Secretary to issue IP PINs to US residents who request them and to expand the issuance of IP PINs to appropriate states.

The IRS has also launched Identity Theft Central, a resource for taxpayers, tax professionals, and businesses to access information on identity theft. The IRS provides tips for taxpayers to minimize their cyber footprints and protect their personal information, such as safeguarding personal data, using strong passwords, and avoiding phishing scams.

Third-party providers

To address this issue, the IRS has implemented several measures and guidelines for third-party providers to enhance cybersecurity and protect taxpayer information. Firstly, the IRS has established the Authorized e-file Provider program, which seeks to safeguard electronic tax return filing for various third-party providers. However, the IRS acknowledges that their efforts may not provide sufficient assurance that taxpayers' information is adequately protected.

One of the challenges the IRS faces is the lack of consistent information security requirements for all software companies and paid preparers. This inconsistency leaves taxpayer information unprotected from potential hackers. To address this, the IRS has been recommended to establish centralized leadership to coordinate its efforts in protecting taxpayer information held by third-party providers.

Additionally, the IRS has introduced the "Security Six" measures, which include guidelines such as activating anti-virus software, enabling two-factor authentication, using backup software and services, and creating and securing Virtual Private Networks (VPNs). These measures aim to strengthen the security of taxpayer data held by third-party providers.

Furthermore, federal law requires all "professional tax preparers" to create and maintain an information security plan for client data. This requirement is flexible and adaptable to the size of the tax preparation business, ranging from small to large operations. Tax preparers are advised to focus on critical areas such as employee management and training, information systems, and detecting and managing system failures.

The IRS also emphasizes the importance of educating oneself about phishing scams and ransomware, as these are common tactics used by cybercriminals to steal sensitive data. By recognizing these threats, third-party providers can better protect taxpayer information.

To further strengthen cybersecurity, third-party providers are encouraged to contract with cybersecurity experts to stop data theft and create a data theft recovery plan. Additionally, the IRS provides resources such as Publication 4557, "Safeguarding Taxpayer Data," and Publication 5293, "Data Security Resource Guide for Tax Professionals," to assist third-party providers in implementing effective security measures.

The Taxpayer First Act

Independent Appeals Process:

The TFA establishes the Internal Revenue Service Independent Office of Appeals, headed by a Chief of Appeals. This office aims to resolve federal tax controversies without litigation, promote fair and impartial tax law application, and enhance public confidence in the IRS.

Improved Service:

The Act mandates the Department of the Treasury to submit a comprehensive customer service strategy for the IRS to Congress. This includes plans to update guidance and training materials for IRS customer service employees. Additionally, low-income taxpayers are exempt from paying a user fee when submitting an offer-in-compromise.

Sensible Enforcement:

The TFA revises provisions related to property seizure, limiting it to property derived from illegal sources and providing due process safeguards. It also addresses equitable relief from joint tax liability, restricts third-party summons, and limits referrals of tax debts to private debt collection agencies, especially for low-income taxpayers.

Organizational Modernization:

The Act permits modification of National Taxpayer Advocate directives and changes reporting requirements. It also mandates the Treasury to provide statistical support to the National Taxpayer Advocate. By the end of FY2020, the Treasury must submit a comprehensive plan to redesign the organization of the IRS.

Cybersecurity and Identity Protection:

The TFA directs the Treasury to collaborate with the public and private sectors to protect taxpayers from identity theft refund fraud. It establishes a program to issue identity protection identification numbers to taxpayers and requires the Electronic Tax Administration Advisory Committee to study and recommend methods to prevent identity theft and refund fraud. Additionally, the IRS must establish a single point of contact for taxpayers affected by tax-related identity theft.

Development of Information Technology:

The Act establishes the position of Chief Information Officer in the IRS, responsible for information technology development, implementation, and maintenance. The Treasury is also required to make an Internet platform available for Form 1099 filings by January 1, 2023.

The TFA includes various other provisions, such as the Community Volunteer Income Tax Assistance Matching Grant Program, mandatory electronic filing for tax-exempt organizations, and expanded use of electronic systems for filing tax returns. These measures aim to improve the efficiency and effectiveness of the IRS while enhancing taxpayer rights and protections.

Frequently asked questions