Between January 2003 and June 2006, at least 490 Internal Revenue Service computers -- some containing sensitive data -- were lost or stolen, according to a new report from the Treasury Inspector General for Tax Administration.TIGTA said that the missing computers, and other data-sensitive equipment, were lost or stolen in 387 separate incidents. Worse, in more than 75 percent of the cases, IRS employees failed to notify the agency’s computer security office, which could have helped negate the risk to taxpayers.
Of the 387 incidents, TIGTA auditors determined that at least 126 involved the loss of personal information involving at least 2,359 taxpayers.
"This is a serious concern to both TIGTA and the IRS," said Inspector General J. Russell George, in a statement. "The American public relies on the IRS to protect the personal information they provide. They deserve no less."
Many of the losses occurred because employees stored their laptops in unlocked vehicles, left their computers on buses, trains or at airports, or checked their computers as airline baggage.
Although adequate documentation does not exist on most of the missing computers, in a separate examination of 100 laptop computers currently used by IRS employees, TIGTA found that 44 laptops contained unencrypted, sensitive taxpayer and employee data, and 14 of the 44 had incorrect settings that would allow anyone to bypass password controls and access their sensitive contents.
The IRS has more than 47,000 laptop computers assigned to its employees.
The full report, "The Internal Revenue Service Is Not Adequately Protecting Taxpayer Data on Laptop Computers and other Portable Electronic Media Devices," is available at
Earlier this week, as part of its audit of the IRS’s 2005-06 financial statements, the Government Accountability Office took a look at where the agency was falling short in correcting previously reported information security weaknesses.
