10 ms·

IRS Awards Equifax $7.25M Contract to Help 'Verify Taxpayer Identities'

233 points by esalazar 9y ago

fractal618 9y ago
Nuts
thephyber 9y ago
The important part of the reply: > As noted in public records, the short-term contract was awarded to Equifax to prevent a lapse in service during a protest on another contract. The service relates to assisting in ongoing identity validation needs of the IRS. Equifax provided these identity proofing services to the IRS under a previous contract.
- lawnchair_larry 9y ago
  Well that's an obvious problem, because it means that whoever stole the equifax data, and whoever they sell it to, basically has the answer key to the IRS's identity verification questions.
  - 20after4 9y ago
    yep, also the answer to questions asked when applying for a birth certificate from any US state, among other identity verification services provided by the credit agencies. And this: https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/ https://krebsonsecurity.com/2017/10/usps-informed-delivery-i...
    - strictnein 9y ago
      This is just mind boggling to me: > "Perhaps this wouldn’t be such a big deal if the USPS notified residents by snail mail when someone signs up for the service at their address, but it doesn’t." That should be part of the authentication to enable the service (enter a code on the mailer to finalize setup). The fact that it doesn't send anything is just mind boggling.
  - r00fus 9y ago
    It's almost like it was planned.
  - jon_richards 9y ago
    I just watched Mr. Robot, so I've been following the equifax hack and jokingly been thinking "What's phase 2?" I guess I know now. It feels like they have House of Cards syndrome. They can't write something more ridiculous than real life.
deleted 9y ago
[deleted]
craftyguy 9y ago
https://news.ycombinator.com/item?id=15395639 https://news.ycombinator.com/item?id=15395639
zuttton 9y ago
What chiefly drives this sort of political corruption today is capitalism's structure. For many capitalist enterprises, competitive and other pressures exist to increase profits, growth rates, and/or market share. Their boards and top managers seek to find cheaper produced inputs and cheaper labor power, to extract more output from their workers, to sell their outputs at the highest possible prices and to find more profitable technologies. The structure provides them with every incentive of financial gain and/or career security and advancement to behave in those ways. Thus, boards and top managers seek the maximum obtainable assistance of government officials in all these areas and also try to pay the least possible portion of their net revenues as taxes. Boards of directors tap their corporations' profits to corrupt mostly the top echelons of the government bureaucracy, those needed to make advantageous official decisions.
- djrogers 9y ago
  Yup, exactly. Every non-capitalist society ever crafted has been free from corruption and greed. Nothing but selfless politicians and happy citizens there. [1] </s>
KekDemaga 9y ago
"The no-bid contract, which pays $7.25 million, is listed as a “sole source” acquisition, meaning the IRS has determined Equifax is the only business capable of providing this service." If they are the only business capable why not make them bid anyway just in case?
- rblatz 9y ago
  Seriously? They are the only ones? What about Lexis Nexis, experian, transunion?
  - dismantlethesun 9y ago
    Clearly only Equifax has the level of competence sorely needed by government sponsored work. Surely, if anything goes wrong---it will at least be the things the government wants to go wrong.
  - djKianoosh 9y ago
    it is likely this identity service product equifax bought in 2010: https://investor.equifax.com/news-and-events/news/2010/10-04-2010a https://investor.equifax.com/news-and-events/news/2010/10-04...
- mceoin 9y ago
  Because the functions of government bids are supposed to be clear and transparent. Large bidders over time build increasingly customized software for the government until there is lock-in. The greater problem here is the theory of competition when it comes to government, since it is often the case that there is little or no competition, and entrenched monopoly providers of government services and services to the government (separate things). Obvious to me that certain functions and competencies must remain inside the government and outside the profit motive. The inevitable outcome of niche provision of government services tends to be a parasitic relationship between government and corporate provider, and this ultimately costs citizens more in the long run - and not just taxes!
- IncRnd 9y ago
  If the IRS thinks that Equifax is the sole source for identity verification, especially after their breach, then the IRS must have realized how bad their identity verification of taxpayers has been for years...
dforrestwilson 9y ago
2017 has been the most bizarre year of my life so far.
- hu3 9y ago
  2018: Hold my beer. featuring: NK, Trump, Blockchains, Brexit, Nature doing Nature things, pending economic bubble burst, et al.
- dingo_bat 9y ago
  Your life will probably keep getting weirder and weirder: https://www.tor.com/2010/08/05/divided-by-infinity/ https://www.tor.com/2010/08/05/divided-by-infinity/
  - xapata 9y ago
    That was an excellent read. Thank you for the link.
willvarfar 9y ago
> "the IRS has determined Equifax is the only business capable of providing this service." Equifax and capable in the same sentence? Oh IRS... The hackers should incorporate! Then two businesses would be capable of providing the service. Would it be 'ethical hacking' if you hacked companies like Equifax so you could offer their data to tax-payer-funded clients for cheaper than companies like Equifax do? </silliness>
IceyEC 9y ago
So, why didn't the IRS just download their leak and do the verification in house? /snark
IncRnd 9y ago
> a contract to assist the IRS in verifying “taxpayer identities” I'm guessing they will use the last 6 digits of the SSN for verification purposes. > the IRS has determined Equifax is the only business capable of providing this service We all know that isn't true. There is something very rotten with this. Anyone in possession of the Equifax breach data can get validated as 143 million different individuals.
- VLM 9y ago
  Presumably the 143 million identities are valid. Would be an epic troll if 99% were salt/fake only to detect and track use. Authentication is verifying someone is the person represented by a valid ID Authorization in this case is some authenticated person having the legal authority to look at or fill out someone's tax paperwork, not necessarily the same as the person under discussion, consider my accountant or my wife's PoA over her elderly uncle, doing taxes and financial things. You can be super black pilled about the IRS or perhaps slightly more white pilled that they're only doing validation... if I live at 221B Baker Street and I type in 2218 Baker Street it would be nice if that could be caught and fixed. Yeah, yeah, I know, reality is probably some fuzzy location in between. Although it sounds weird for a company based on gatekeeping "secret" data (which hasn't been secret in a long time) to allow its secret data to leak, its an old business model to create a problem which surprisingly enough you also have a profitable solution. Its highly likely in a year or two we'll all have Equifax smart chip ID cards. Like a military CAC card but with 100 times more users.
  - IncRnd 9y ago
    > Presumably the 143 million identities are valid. Would be an epic troll if 99% were salt/fake only to detect and track use. The 143 million PII records likely represent almost every adult taxpayer in the US. These records didn't need to be released purposefully. Even if stolen, nothing but the possession of those records may be needed to authenticate as almost any one of the adult taxpayers in the US. > Authentication is verifying someone is the person represented by a valid ID Why do you believe that auth in this context requires validity of ID or even an ID of any kind? > Its highly likely in a year or two we'll all have Equifax smart chip ID cards. I'm not convinced this is a highly likely scenario.
tickerticker 9y ago
Now they can crowd source this project.
vasco 9y ago
How incredible it is that a Federal Agency needs a private company to identify its own citizens. You guys really should get smart ID cards like every other sane country. They have a certificate on them and you can even buy a card reader to use the chip and identify yourself in state-ran online services. Come join us in 2017, it's cool here.
- mtgx 9y ago
  Such cars could also probably be used as voter IDs, no? And there wouldn't be any issue of "restricting certain people from voting" because the federal government would have to provide everyone with one anyway. It could also lead to safer and more verifiable voting on voting machines (even though I still believe nothing beats pen and paper at this).
  - muninn_ 9y ago
    Any you know why this won't happen? Republicans don't want a national ID and Democrats don't want to anger their base. I am not a huge fan of the idea (from the Republican side although I'm not a Republican) but at this point I don't even care because companies cannot be trusted to handle this.
  - balabaster 9y ago
    This assumes that the version of democracy wanted in the U.S. is a version that allows everyone equal access to voting. You also make the mistake of assuming that the version of democracy that the people want is the same version that the government wants.
  - corpMaverick 9y ago
    Yes, a key point will be that they must be free.
    - mcny 9y ago
      Yes, that is a necessary condition but it is not sufficient. Accessibility is another issue. * Do replacements cost money? * Do I have to go somewhere in person to get the card? Is it within walking distance? * What are the days and the hours that this place is open? * ... (there are so many more questions but most importantly) * How do we pay for it?
emodendroket 9y ago
Awful time to be a satirist. How can you even parody this stuff?
sly010 9y ago
Clearly only Equifax has the level of incompetence needed by government sponsored work.
Koldark 9y ago
We need to remember that this process probably started months ago before the hack. Also, remember that Equifax (while not really loved) was not really thought about as being a really bad company.

233 points by esalazar 9y ago

Nuts

The important part of the reply: > As noted in public records, the short-term contract was awarded to Equifax to prevent a lapse in service during a protest on another contract. The service relates to assisting in ongoing identity validation needs of the IRS. Equifax provided these identity proofing services to the IRS under a previous contract.

lawnchair_larry 9y ago
Well that's an obvious problem, because it means that whoever stole the equifax data, and whoever they sell it to, basically has the answer key to the IRS's identity verification questions.
- 20after4 9y ago
  yep, also the answer to questions asked when applying for a birth certificate from any US state, among other identity verification services provided by the credit agencies. And this: https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/ https://krebsonsecurity.com/2017/10/usps-informed-delivery-i...
  - strictnein 9y ago
    This is just mind boggling to me: > "Perhaps this wouldn’t be such a big deal if the USPS notified residents by snail mail when someone signs up for the service at their address, but it doesn’t." That should be part of the authentication to enable the service (enter a code on the mailer to finalize setup). The fact that it doesn't send anything is just mind boggling.
- r00fus 9y ago
  It's almost like it was planned.
- jon_richards 9y ago
  I just watched Mr. Robot, so I've been following the equifax hack and jokingly been thinking "What's phase 2?" I guess I know now. It feels like they have House of Cards syndrome. They can't write something more ridiculous than real life.

deleted 9y ago

[deleted]

craftyguy 9y ago

https://news.ycombinator.com/item?id=15395639 https://news.ycombinator.com/item?id=15395639

zuttton 9y ago

What chiefly drives this sort of political corruption today is capitalism's structure. For many capitalist enterprises, competitive and other pressures exist to increase profits, growth rates, and/or market share. Their boards and top managers seek to find cheaper produced inputs and cheaper labor power, to extract more output from their workers, to sell their outputs at the highest possible prices and to find more profitable technologies. The structure provides them with every incentive of financial gain and/or career security and advancement to behave in those ways. Thus, boards and top managers seek the maximum obtainable assistance of government officials in all these areas and also try to pay the least possible portion of their net revenues as taxes. Boards of directors tap their corporations' profits to corrupt mostly the top echelons of the government bureaucracy, those needed to make advantageous official decisions.

djrogers 9y ago
Yup, exactly. Every non-capitalist society ever crafted has been free from corruption and greed. Nothing but selfless politicians and happy citizens there. [1] </s>

KekDemaga 9y ago

"The no-bid contract, which pays $7.25 million, is listed as a “sole source” acquisition, meaning the IRS has determined Equifax is the only business capable of providing this service." If they are the only business capable why not make them bid anyway just in case?

rblatz 9y ago
Seriously? They are the only ones? What about Lexis Nexis, experian, transunion?
- dismantlethesun 9y ago
  Clearly only Equifax has the level of competence sorely needed by government sponsored work. Surely, if anything goes wrong---it will at least be the things the government wants to go wrong.
- djKianoosh 9y ago
  it is likely this identity service product equifax bought in 2010: https://investor.equifax.com/news-and-events/news/2010/10-04-2010a https://investor.equifax.com/news-and-events/news/2010/10-04...
mceoin 9y ago
Because the functions of government bids are supposed to be clear and transparent. Large bidders over time build increasingly customized software for the government until there is lock-in. The greater problem here is the theory of competition when it comes to government, since it is often the case that there is little or no competition, and entrenched monopoly providers of government services and services to the government (separate things). Obvious to me that certain functions and competencies must remain inside the government and outside the profit motive. The inevitable outcome of niche provision of government services tends to be a parasitic relationship between government and corporate provider, and this ultimately costs citizens more in the long run - and not just taxes!
IncRnd 9y ago
If the IRS thinks that Equifax is the sole source for identity verification, especially after their breach, then the IRS must have realized how bad their identity verification of taxpayers has been for years...

dforrestwilson 9y ago

2017 has been the most bizarre year of my life so far.

hu3 9y ago
2018: Hold my beer. featuring: NK, Trump, Blockchains, Brexit, Nature doing Nature things, pending economic bubble burst, et al.
dingo_bat 9y ago
Your life will probably keep getting weirder and weirder: https://www.tor.com/2010/08/05/divided-by-infinity/ https://www.tor.com/2010/08/05/divided-by-infinity/
- xapata 9y ago
  That was an excellent read. Thank you for the link.

willvarfar 9y ago

> "the IRS has determined Equifax is the only business capable of providing this service." Equifax and capable in the same sentence? Oh IRS... The hackers should incorporate! Then two businesses would be capable of providing the service. Would it be 'ethical hacking' if you hacked companies like Equifax so you could offer their data to tax-payer-funded clients for cheaper than companies like Equifax do? </silliness>

IceyEC 9y ago

So, why didn't the IRS just download their leak and do the verification in house? /snark

IncRnd 9y ago

> a contract to assist the IRS in verifying “taxpayer identities” I'm guessing they will use the last 6 digits of the SSN for verification purposes. > the IRS has determined Equifax is the only business capable of providing this service We all know that isn't true. There is something very rotten with this. Anyone in possession of the Equifax breach data can get validated as 143 million different individuals.

VLM 9y ago
Presumably the 143 million identities are valid. Would be an epic troll if 99% were salt/fake only to detect and track use. Authentication is verifying someone is the person represented by a valid ID Authorization in this case is some authenticated person having the legal authority to look at or fill out someone's tax paperwork, not necessarily the same as the person under discussion, consider my accountant or my wife's PoA over her elderly uncle, doing taxes and financial things. You can be super black pilled about the IRS or perhaps slightly more white pilled that they're only doing validation... if I live at 221B Baker Street and I type in 2218 Baker Street it would be nice if that could be caught and fixed. Yeah, yeah, I know, reality is probably some fuzzy location in between. Although it sounds weird for a company based on gatekeeping "secret" data (which hasn't been secret in a long time) to allow its secret data to leak, its an old business model to create a problem which surprisingly enough you also have a profitable solution. Its highly likely in a year or two we'll all have Equifax smart chip ID cards. Like a military CAC card but with 100 times more users.
- IncRnd 9y ago
  > Presumably the 143 million identities are valid. Would be an epic troll if 99% were salt/fake only to detect and track use. The 143 million PII records likely represent almost every adult taxpayer in the US. These records didn't need to be released purposefully. Even if stolen, nothing but the possession of those records may be needed to authenticate as almost any one of the adult taxpayers in the US. > Authentication is verifying someone is the person represented by a valid ID Why do you believe that auth in this context requires validity of ID or even an ID of any kind? > Its highly likely in a year or two we'll all have Equifax smart chip ID cards. I'm not convinced this is a highly likely scenario.

tickerticker 9y ago

Now they can crowd source this project.

vasco 9y ago

How incredible it is that a Federal Agency needs a private company to identify its own citizens. You guys really should get smart ID cards like every other sane country. They have a certificate on them and you can even buy a card reader to use the chip and identify yourself in state-ran online services. Come join us in 2017, it's cool here.

mtgx 9y ago
Such cars could also probably be used as voter IDs, no? And there wouldn't be any issue of "restricting certain people from voting" because the federal government would have to provide everyone with one anyway. It could also lead to safer and more verifiable voting on voting machines (even though I still believe nothing beats pen and paper at this).
- muninn_ 9y ago
  Any you know why this won't happen? Republicans don't want a national ID and Democrats don't want to anger their base. I am not a huge fan of the idea (from the Republican side although I'm not a Republican) but at this point I don't even care because companies cannot be trusted to handle this.
- balabaster 9y ago
  This assumes that the version of democracy wanted in the U.S. is a version that allows everyone equal access to voting. You also make the mistake of assuming that the version of democracy that the people want is the same version that the government wants.
- corpMaverick 9y ago
  Yes, a key point will be that they must be free.
  - mcny 9y ago
    Yes, that is a necessary condition but it is not sufficient. Accessibility is another issue. * Do replacements cost money? * Do I have to go somewhere in person to get the card? Is it within walking distance? * What are the days and the hours that this place is open? * ... (there are so many more questions but most importantly) * How do we pay for it?

emodendroket 9y ago

Awful time to be a satirist. How can you even parody this stuff?

sly010 9y ago

Clearly only Equifax has the level of incompetence needed by government sponsored work.

Koldark 9y ago

We need to remember that this process probably started months ago before the hack. Also, remember that Equifax (while not really loved) was not really thought about as being a really bad company.