Treasury report: IRS email systems insecure

By Ericka Chickowski on Aug 16, 2006 10:31PM

A new report released last week found that the majority of employees working for the Internal Revenue Service (IRS) abuse the agency's email service.

Released by the Treasury Inspector General for Tax Administration, the report found that a whopping 74 percent of IRS employees had email in their inboxes that violated the IRS personal use policy for email. Some of the offending messages included chain letters, jokes and offensive and sexually explicit content.

"While the IRS has conducted awareness presentations and distributed communications to encourage employees to comply with its personal use policy, it does not effectively monitor the email of its employees to ensure compliance with the policy," the report said.

Also included in the report were the results of a random sampling of 28 of the agency's 228 email servers. Inspectors found that these servers had more than 700 security vulnerabilities that could disrupt IRS operations. The majority of these were a result of poor patch management.

"The majority of the security vulnerabilities on the email servers cited above occurred because system administrators had not installed current security patches to the email servers," the report said.

In addition, the inspection of IRS email systems found thousands of IP-addressable devices serving as unofficial email servers—approximately 4,913 in all.

Inspectors warned that such flagrant disregard of agency policies combined with vulnerabilities in IRS email systems and an overabundance of ad-hoc servers put the entire IRS IT infrastructure at risk. According to the report, the Treasury Inspector General is working with IRS technical staff to fix these problems.