8 ms·

IRS accidentally releases taxpayers’ private data again

265 points by arkadiyt 4y ago

toomuchtodo 4y ago
Accenture is the contractor responsible.
- nvdrx 4y ago
  Perfect. It’s not like the gov to pass the buck to a corpo.
- systemvoltage 4y ago
  IMO the resposibility is entirely on IRS. They chose the contractor, they wrote the legal terms and conditions, they vetted them out and they presumably did the due diligence for security.
  - latency-guy2 4y ago
    They also provided them with training, access rights, and general governance over the data. I'd personally blame 70% of the blame on the IRS, 30% on the contractor. Organizations should not be able to skirt blame by way of contractor IMO. Hope the IRS gets fined for gross negligence and breach of data. (lol)
    - TechBro8615 4y ago
      How many non-background-checked foreign employees work at Accenture on this project and have access to all these files anyway?
      - toomuchtodo 4y ago
        I strongly encourage you, without a hint of sarcasm or glib, to file a FOIA request to find out. https://muckrock.com https://muckrock.com is my weapon of choice for data liberation, but a letter or email works equally well.
  - acdha 4y ago
    Here’s the problem: government contracting is complicated enough that only a few companies can wade through it and the overhead encourages big general services contracts so you don’t have to repeat that process every time someone wants to setup a Wordpress blog. Those companies put in bids featuring their key staff, who are qualified. That’s who the government meets with and who answers all of the questions. Contractors come and go, and the government isn’t supposed to micromanage them - that’s one of the features theoretically making them less expensive than staff - so those qualified people may never be seen after the start of the project, or they might be in some kind of “oversight” capacity where they’re quintuple booked theoretically keeping the much cheaper people doing the actual work from failing too badly. On the government side, they likely don’t have qualified technical staff (or enough of their time) after years of “cost savings” where every dollar cut from the staff budget corresponds to 2-3 dollars going to contractors. That means that problems will progress further, especially because the contract PM isn’t going to say that the contract developers are doing terribly after months of saying sprint velocity is good. Even if they’re on different contracts, the odds are good they’ve either worked together before or don’t want to rule out future work at the other company. So, things careened down the tracks and now people are realizing that the green lights on dashboards were in fact optimistic. The government can ask for things to be fixed but if there’s pushback, they risk _every_ project on that contract and it’s expensive because they have to show some kind of malfeasance to get money back or possibly even to stop wasting more (want to bet there’s never been any scope creep which could be blamed?). It’s _much_ easier to try seeing whether the claim that this was a one-time mishap was true than to deal with all of that. Any time you see something like this, it’s always possible that you have someone totally failing to do their job but it’s far more likely that you’re seeing a bunch of people trying to do their best with a system they know isn’t effective but which they have no direct means to improve.
  - andreareina 4y ago
    That the buck stops with the IRS (agree with you there) doesn't absolve Accenture of its responsibility to the IRS.
- yucky 4y ago
  My agreement is with the IRS, not Accenture. The IRS is 100% responsible.
  - sokoloff 4y ago
    I agree with your assessment of responsibility, but it’s not clear the extent that your obligation to the IRS is even an “agreement”.
    - macinjosh 4y ago
      Have you not been told the Good News of The Social Contract? /s
mistrial9 4y ago
the forms in question are US non-profit declarations 990-T. The same data was released a second time, minus less than 2% of them. There are a lot of dark corners in the USA non-profit world, in case you don't know it. The vast majority (a million?) of USA 990 non-profits are the sort of small time operation you might expect, but there is a tiger of a long-tail on that one. Many major hospitals and the US Football league NFL, are "non-profit" and would file the same forms.
- gumby 4y ago
  The US Football league NFL also has an antitrust exemption so is deserving of public scrutiny.
  - KennyBlanken 4y ago
    NCAA is predicted to go for antitrust exemptions as well as lobby for legislation to dump the requirement to pay student athletes - all things Baker is expected to do, leveraging his political connections as a former governor and figure in the republican party.
    - dmonitor 4y ago
      I'm under the impression that the NCAA (or at least the schools) fought hard to legalize paying student athletes. Most big schools were illegally paying their players before it was allowed. if they wanted to spin off college football to a semi-pro league and let actual students play the game instead of "students" who get private tutors, sleep in a private dorm, have a private cafeteria, take exclusive classes, and generally don't interact with the rest of the student body, I would support this movement.
  - yucky 4y ago
    I don't believe this is correct, which is why competing leagues pop up every few years. You might be thinking of Major League Baseball?
    - 4y ago
Lionga 4y ago
Ooopsie
deleted 4y ago
[deleted]
dossy 4y ago
> "The agency is reconsidering its relationship with the contractor Accenture on this project, according to a person familiar." Any time I start to feel that Impostor Syndrome creeping in, I need to remind myself that there's someone who's working at Accenture probably earning 2x or 3x what I am, who gets to fuck up big not once but _twice_ doing the same wrong thing.
- ipsum2 4y ago
  Doesn't Accenture offshore a lot of its work to India and other third-world countries? So the Accenture engineer probably gets paid a lot less than you. Edit: According to Wikipedia, yes: > In 2015, the company had about 150,000 employees in India,[31] 48,000 in the US,[32] and 50,000 in the Philippines.[33] Edit2: s/outsource/offshore, thanks. What I intended was: companies hire Accenture to outsource their development work to third-world countries.
  - eatYourFood 4y ago
  - birdymcbird 4y ago
    And is far less qualified too. I’ve crossed paths with these “consulting” types twice in my career. I don’t mean to generalize, but these so called “engineers” didn’t understand source control or versioning, didn’t understand basic programming concepts, and lacked any sort of communication skills. It seemed like you were working with someone who watched a couple YouTube videos (and no more than a couple videos) on some framework, with no former programming, design, or critical thinking skills, and they were now given a job title.
  - runako 4y ago
    > > In 2015, the company had about 150,000 employees in India,[31] 48,000 in the US,[32] and 50,000 in the Philippines.[33] Pedantic: Accenture assigning work to their employees in India or the Philippines is not "outsourcing." The work was outsourced when it was handed off from the client paying the bills to Accenture, regardless of where the Accenture employees are located. By definition, Accenture cannot outsource work to their own employees. "Offshoring" is what Accenture does by having the work done by their employees in lower-cost regions.
deleted 4y ago
[deleted]
lgbrandon 4y ago
sircastor 4y ago
Title should probably read IRS Contractor accidentally releases the data again… This is bad of course, but I’m kind of amazed it was only 112k. Given the 330some million citizens, and presumably some more entities that also pay taxes, this is a relatively small number.
theknocker 4y ago
rufus_foreman 4y ago
Hey. Mr. Wimbley, it happened again.
tiahura 4y ago
I'm less concerned about the occasional unintentional f'up, and much more concerned about the targeted and politically motivated intentional leaking of information.
- ComputerGuru 4y ago
  Are you saying “I’m not concerned about data leaks that I could potentially be affected by and have my own personal information leaked through as much as I am about a celebrity billionaire getting their tax records released after years of litigation and after lawsuits going all the way to the Supreme Court (or others like him)?”
  - AmericanChopper 4y ago
    I would say I find government corruption to be more concerning than government incompetence. For the same reason that I would find a crime committed with intent to be more concerning than a crime committed with negligence. Neither are unconcerning though.
    - ComputerGuru 4y ago
      Corruption is a very serious allegation and typically involves some form of quid-pro-quo (direct or indirect, tangible or non-tangible). There are contexts it likely applies, such as lobbyists and PACs getting favorable laws passed, wealthy donors getting ambassadorships, etc, but I can’t see how it applies in this case. Are you suggesting that everyone involved from attorney generals to congressmen, senators, federal judges, and Supreme Court justices (not a one of which - including the two Trump appointees - formally registered their disagreement with the unanimous decisions/reviews or lack thereof) were, somehow, making decisions and getting something out of deciding/acting contrary to how they would have otherwise?
      - throwaway-blaze 4y ago
        Look up Lois Lerner and all of the "oops we deleted those hard drives you subpoenaed from the IRS" during the Obama Administration. While some corruption involves a quid pro quo, the most damaging kind of corruption in our government today is ideological corruption. When an unelected person has an opinion (which they're certainly entitled to have in their private life) and uses their government position to put their thumb on the scale of how people / organizations are treated to match their ideological beliefs, that's a different kind of corruption.
johncessna 4y ago
I think I know the problem, they probably don't have one of those 25 minute annual data governance trainings to teach/remind them how to handle PII.
- godelski 4y ago
  I think I know the solution, we'll double the training session (we'll use the same training, but make them spend an hour on the same material and time them) and have them do it twice a year! That'll surely reduce error rates by a quarter!
- dumbotron 4y ago
  The place I work for (not the government) actually started blocking USB storage devices because of the risk of data leaks. Too many of them involve misplaced flash drives.
ccn0p 4y ago
What they really need are more agents. I think 87,000 should do the trick.
tamaharbor 4y ago
My new thesis is that an increasing number of problems is caused by human stupidity. We are entering a world as depicted by the movie Idiocracy.
khiqxj 4y ago
this could be solved by not requiring collection of citizens' private info at gunpoint. but im sure all the idiots who reacted to snowden by building half working "solutions" with "please donate" buttons will not get this.
godelski 4y ago
What a hostile website. I land on the page, a second goes by and then I get a flashing screen that redirects me... to the same page. A few more seconds go by and then I see a "validating credentials" loading message and again just get redirected to the same page. I'm sure my privacy plugins have something to do with this but come on, why do we need to do all this redirecting for just a web article? This could essentially be static!
- autoexec 4y ago
  You're not blocking enough. The site actually manages to display text even with JS disabled which is more than I can for some others.
vladsanchez 4y ago
IRS: Fucking IDIOTS! No Liability, No accountability! Who can SUE the IRS!? :/
hansvm 4y ago
While we're at it, what ever happened to the ID.me clusterfuck from earlier this year? As of February they said it wouldn't be mandatory, but all accounts are still being urged to switch to that privacy nightmare.

265 points by arkadiyt 4y ago

toomuchtodo 4y ago

Accenture is the contractor responsible.

nvdrx 4y ago
Perfect. It’s not like the gov to pass the buck to a corpo.
systemvoltage 4y ago
IMO the resposibility is entirely on IRS. They chose the contractor, they wrote the legal terms and conditions, they vetted them out and they presumably did the due diligence for security.
- latency-guy2 4y ago
  They also provided them with training, access rights, and general governance over the data. I'd personally blame 70% of the blame on the IRS, 30% on the contractor. Organizations should not be able to skirt blame by way of contractor IMO. Hope the IRS gets fined for gross negligence and breach of data. (lol)
  - TechBro8615 4y ago
    How many non-background-checked foreign employees work at Accenture on this project and have access to all these files anyway?
    - toomuchtodo 4y ago
      I strongly encourage you, without a hint of sarcasm or glib, to file a FOIA request to find out. https://muckrock.com https://muckrock.com is my weapon of choice for data liberation, but a letter or email works equally well.
- acdha 4y ago
  Here’s the problem: government contracting is complicated enough that only a few companies can wade through it and the overhead encourages big general services contracts so you don’t have to repeat that process every time someone wants to setup a Wordpress blog. Those companies put in bids featuring their key staff, who are qualified. That’s who the government meets with and who answers all of the questions. Contractors come and go, and the government isn’t supposed to micromanage them - that’s one of the features theoretically making them less expensive than staff - so those qualified people may never be seen after the start of the project, or they might be in some kind of “oversight” capacity where they’re quintuple booked theoretically keeping the much cheaper people doing the actual work from failing too badly. On the government side, they likely don’t have qualified technical staff (or enough of their time) after years of “cost savings” where every dollar cut from the staff budget corresponds to 2-3 dollars going to contractors. That means that problems will progress further, especially because the contract PM isn’t going to say that the contract developers are doing terribly after months of saying sprint velocity is good. Even if they’re on different contracts, the odds are good they’ve either worked together before or don’t want to rule out future work at the other company. So, things careened down the tracks and now people are realizing that the green lights on dashboards were in fact optimistic. The government can ask for things to be fixed but if there’s pushback, they risk _every_ project on that contract and it’s expensive because they have to show some kind of malfeasance to get money back or possibly even to stop wasting more (want to bet there’s never been any scope creep which could be blamed?). It’s _much_ easier to try seeing whether the claim that this was a one-time mishap was true than to deal with all of that. Any time you see something like this, it’s always possible that you have someone totally failing to do their job but it’s far more likely that you’re seeing a bunch of people trying to do their best with a system they know isn’t effective but which they have no direct means to improve.
- andreareina 4y ago
  That the buck stops with the IRS (agree with you there) doesn't absolve Accenture of its responsibility to the IRS.
yucky 4y ago
My agreement is with the IRS, not Accenture. The IRS is 100% responsible.
- sokoloff 4y ago
  I agree with your assessment of responsibility, but it’s not clear the extent that your obligation to the IRS is even an “agreement”.
  - macinjosh 4y ago
    Have you not been told the Good News of The Social Contract? /s

mistrial9 4y ago

the forms in question are US non-profit declarations 990-T. The same data was released a second time, minus less than 2% of them. There are a lot of dark corners in the USA non-profit world, in case you don't know it. The vast majority (a million?) of USA 990 non-profits are the sort of small time operation you might expect, but there is a tiger of a long-tail on that one. Many major hospitals and the US Football league NFL, are "non-profit" and would file the same forms.

gumby 4y ago
The US Football league NFL also has an antitrust exemption so is deserving of public scrutiny.
- KennyBlanken 4y ago
  NCAA is predicted to go for antitrust exemptions as well as lobby for legislation to dump the requirement to pay student athletes - all things Baker is expected to do, leveraging his political connections as a former governor and figure in the republican party.
  - dmonitor 4y ago
    I'm under the impression that the NCAA (or at least the schools) fought hard to legalize paying student athletes. Most big schools were illegally paying their players before it was allowed. if they wanted to spin off college football to a semi-pro league and let actual students play the game instead of "students" who get private tutors, sleep in a private dorm, have a private cafeteria, take exclusive classes, and generally don't interact with the rest of the student body, I would support this movement.
- yucky 4y ago
  I don't believe this is correct, which is why competing leagues pop up every few years. You might be thinking of Major League Baseball?
  - 4y ago

Lionga 4y ago

Ooopsie

deleted 4y ago

[deleted]

dossy 4y ago

> "The agency is reconsidering its relationship with the contractor Accenture on this project, according to a person familiar." Any time I start to feel that Impostor Syndrome creeping in, I need to remind myself that there's someone who's working at Accenture probably earning 2x or 3x what I am, who gets to fuck up big not once but _twice_ doing the same wrong thing.

ipsum2 4y ago
Doesn't Accenture offshore a lot of its work to India and other third-world countries? So the Accenture engineer probably gets paid a lot less than you. Edit: According to Wikipedia, yes: > In 2015, the company had about 150,000 employees in India,[31] 48,000 in the US,[32] and 50,000 in the Philippines.[33] Edit2: s/outsource/offshore, thanks. What I intended was: companies hire Accenture to outsource their development work to third-world countries.
- eatYourFood 4y ago
- birdymcbird 4y ago
  And is far less qualified too. I’ve crossed paths with these “consulting” types twice in my career. I don’t mean to generalize, but these so called “engineers” didn’t understand source control or versioning, didn’t understand basic programming concepts, and lacked any sort of communication skills. It seemed like you were working with someone who watched a couple YouTube videos (and no more than a couple videos) on some framework, with no former programming, design, or critical thinking skills, and they were now given a job title.
- runako 4y ago
  > > In 2015, the company had about 150,000 employees in India,[31] 48,000 in the US,[32] and 50,000 in the Philippines.[33] Pedantic: Accenture assigning work to their employees in India or the Philippines is not "outsourcing." The work was outsourced when it was handed off from the client paying the bills to Accenture, regardless of where the Accenture employees are located. By definition, Accenture cannot outsource work to their own employees. "Offshoring" is what Accenture does by having the work done by their employees in lower-cost regions.

deleted 4y ago

[deleted]

lgbrandon 4y ago

sircastor 4y ago

Title should probably read IRS Contractor accidentally releases the data again… This is bad of course, but I’m kind of amazed it was only 112k. Given the 330some million citizens, and presumably some more entities that also pay taxes, this is a relatively small number.

theknocker 4y ago

rufus_foreman 4y ago

Hey. Mr. Wimbley, it happened again.

tiahura 4y ago

I'm less concerned about the occasional unintentional f'up, and much more concerned about the targeted and politically motivated intentional leaking of information.

ComputerGuru 4y ago
Are you saying “I’m not concerned about data leaks that I could potentially be affected by and have my own personal information leaked through as much as I am about a celebrity billionaire getting their tax records released after years of litigation and after lawsuits going all the way to the Supreme Court (or others like him)?”
- AmericanChopper 4y ago
  I would say I find government corruption to be more concerning than government incompetence. For the same reason that I would find a crime committed with intent to be more concerning than a crime committed with negligence. Neither are unconcerning though.
  - ComputerGuru 4y ago
    Corruption is a very serious allegation and typically involves some form of quid-pro-quo (direct or indirect, tangible or non-tangible). There are contexts it likely applies, such as lobbyists and PACs getting favorable laws passed, wealthy donors getting ambassadorships, etc, but I can’t see how it applies in this case. Are you suggesting that everyone involved from attorney generals to congressmen, senators, federal judges, and Supreme Court justices (not a one of which - including the two Trump appointees - formally registered their disagreement with the unanimous decisions/reviews or lack thereof) were, somehow, making decisions and getting something out of deciding/acting contrary to how they would have otherwise?
    - throwaway-blaze 4y ago
      Look up Lois Lerner and all of the "oops we deleted those hard drives you subpoenaed from the IRS" during the Obama Administration. While some corruption involves a quid pro quo, the most damaging kind of corruption in our government today is ideological corruption. When an unelected person has an opinion (which they're certainly entitled to have in their private life) and uses their government position to put their thumb on the scale of how people / organizations are treated to match their ideological beliefs, that's a different kind of corruption.

johncessna 4y ago

I think I know the problem, they probably don't have one of those 25 minute annual data governance trainings to teach/remind them how to handle PII.

godelski 4y ago
I think I know the solution, we'll double the training session (we'll use the same training, but make them spend an hour on the same material and time them) and have them do it twice a year! That'll surely reduce error rates by a quarter!
dumbotron 4y ago
The place I work for (not the government) actually started blocking USB storage devices because of the risk of data leaks. Too many of them involve misplaced flash drives.

ccn0p 4y ago

What they really need are more agents. I think 87,000 should do the trick.

tamaharbor 4y ago

My new thesis is that an increasing number of problems is caused by human stupidity. We are entering a world as depicted by the movie Idiocracy.

khiqxj 4y ago

this could be solved by not requiring collection of citizens' private info at gunpoint. but im sure all the idiots who reacted to snowden by building half working "solutions" with "please donate" buttons will not get this.

godelski 4y ago

What a hostile website. I land on the page, a second goes by and then I get a flashing screen that redirects me... to the same page. A few more seconds go by and then I see a "validating credentials" loading message and again just get redirected to the same page. I'm sure my privacy plugins have something to do with this but come on, why do we need to do all this redirecting for just a web article? This could essentially be static!

autoexec 4y ago
You're not blocking enough. The site actually manages to display text even with JS disabled which is more than I can for some others.

vladsanchez 4y ago

IRS: Fucking IDIOTS! No Liability, No accountability! Who can SUE the IRS!? :/

hansvm 4y ago

While we're at it, what ever happened to the ID.me clusterfuck from earlier this year? As of February they said it wouldn't be mandatory, but all accounts are still being urged to switch to that privacy nightmare.