IRS loses 490 laptops

According to an audit [PDF] conducted by the Treasury Inspector General for Tax Administration, the IRS has lost 490 laptops over the past three years. A "large number" of these lost laptops were stolen from cars and homes of IRS employees; 111 were stolen from IRS offices.

The audit concluded that the IRS is not adequately protecting confidential information. IRS employees are not aware of security protocols and thus confidential information is being left unencrypted.

"We conducted a separate test on 100 laptop computers currently in use by employees and determined 44 laptop computers contained unencrypted sensitive data, including taxpayer data and employee personnel data," the report said. "As a result, we believe it is very likely a large number of the lost or stolen IRS computers contained similar unencrypted data."

An audit in 2003 noted that data on laptops and other disk drives was being left unencrypted. Corrective actions have not been sufficient as the problems still persist.

The IRS has since deployed full disk encryption technology and cable locks for all laptops.

It seems clear that the problem is twofold: inadequate technology deployment and inadequate employee training. The audit identified risks being introduced by system administrators as well as poor employee awareness of what constitutes confidential information and how to protect it. Employee training is also underway to address these issues.

Via Computer World ; Tags: IRS, government, IRS laptop theft, laptop theft, data breach, security breach, IRS data breach, government data breach