TREASURY
INSPECTOR GENERAL FOR TAX ADMINISTRATION
Progress Has Been Slow in Meeting Homeland Security Presidential Directive–12 Requirements
June 20, 2007
Reference Number:
2007-20-110
This
report has cleared the Treasury Inspector General for Tax Administration
disclosure review process and information determined to be restricted from
public release has been redacted from this document.
Phone Number |
202-927-7037
Email Address | Bonnie.Heald@tigta.treas.gov
Web Site |
http://www.tigta.gov
June 20, 2007
MEMORANDUM FOR CHIEF, MISSION ASSURANCE AND SECURITY SERVICES
FROM: (for) Michael R. Phillips /s/ Margaret E. Begg
Deputy Inspector General for Audit
SUBJECT: Final Audit Report – Progress Has Been Slow in Meeting Homeland Security Presidential Directive–12 Requirements (Audit # 200620027)
This report presents the results of our review to determine whether the Internal Revenue Service (IRS)
took the necessary actions to comply with
Impact on the Taxpayer
The IRS has been experiencing
delays in issuing new identification cards to employees and contractors that enhance
security, reduce identity fraud, and protect the personal privacy of employees
and contractors. Initially, the IRS was
developing its own system for issuing the cards rather than joining with other
Federal Government agencies that had already incurred much of the upfront costs
associated with this effort. Consequently,
the IRS was at risk of wasting taxpayer funds and delaying the implementation
of this Presidential mandate.
Synopsis
On August 27, 2004,
President Bush signed Homeland Security
Presidential Directive-12, Policy for a Common Identification Standard for
Federal Employees and Contractors. The Directive, which is to be implemented in
several phases, established a new standard for issuing and processing Federal Government
identification cards for entering Federal Government facilities and for
accessing computer systems. In
the first phase, Personal Identity Verification (PIV) I, the Office of
Management and Budget required agencies to develop procedures no later than
October 2005 for registering employees, issuing cards, and maintaining the card
system. In the second phase, PIV II, the
Office of Management and Budget required agencies to demonstrate their ability
to issue the identification cards and be capable of issuing new cards to all
new employees and contractors no later than October 2006.
To satisfy the requirements of PIV I, the IRS completed its PIV I Procedures Manual on October 27, 2005. This manual contains step-by-step instructions that address PIV I requirements.
However, the IRS has been experiencing
delays in meeting the requirements of PIV II.
Initially, the IRS was attempting to produce its own identification cards
but had not demonstrated the ability to issue them. Despite assigning 68 employees and
contractors to this effort, the IRS had not yet purchased the hardware
and software necessary to produce the identification cards and did not expect
to complete the program until September 2010, 2 years after the Office of Management
and Budget mandated deadline.
The IRS stated, however, that it met the PIV II milestone because it contracted with the General Services Administration (GSA) for 100 identification cards to meet the Office of Management and Budget deadline, even though it did not plan to use the GSA to issue additional identification cards after the PIV II milestone. The GSA is making its solution available to all Federal Government agencies and, due to economies of scale, we believe the GSA should be able to issue the cards less expensively than agencies that produce their own cards.
The IRS was continuing to develop its own system for issuing identification cards because it believed it could issue cards that would meet all required technical specifications at less expense. However, the IRS had not provided cost projections for this Department of the Treasury initiative. The IRS also stated it believed it was in a better position than the GSA to produce and distribute identification cards at all Department of the Treasury office locations, provide compatible technology to identify and authenticate employees, and produce and distribute identification cards for the large number of temporary employees the IRS hires during the tax return filing season.
We believe the IRS was taking unnecessary risks, not only because its costs are likely to exceed the GSA solution, but because it was taking resources away from tax administration duties, increasing the likelihood of its cards being incompatible with other agencies, and likely will be delivering its system later than other agencies. During the course of this audit, we made the following recommendation to the IRS to consider the benefits of using a shared solution.
Recommendation
To reduce costs and to improve the likelihood of meeting the Office of Management and Budget’s subsequent milestones for developing identification cards compliant with Homeland Security Presidential Directive-12 requirements, we recommended during the course of the audit that the Chief, Mission Assurance and Security Services, consider the benefits of using shared solutions such as the one offered by the GSA for issuing identification cards to IRS employees and contractors. Rather than spending resources on developing its own system, we recommended the IRS coordinate with the GSA to resolve concerns and customize the GSA solution to meet IRS needs.
Response
IRS management stated the Department of the Treasury Homeland Security Presidential Directive-12 Program Management Office, with concurrence from the Department of the Treasury Homeland Security Presidential Directive-12 Executive Steering Committee and the Bureau Advisory Board, agreed with our recommendation. The Program Management Office has discontinued development efforts for a Department of the Treasury-wide enterprise Homeland Security Presidential Directive-12 solution. On May 18, 2007, a letter was issued to the GSA stating the IRS’ intention to use the GSA services to the extent possible. Management’s complete response to the draft report is included as Appendix IV.
Copies of
this report are also being sent to the IRS managers affected by the report
recommendations. Please contact me at
(202) 622-6510 if you have questions or Margaret E. Begg, Assistant Inspector
General for Audit (Information Systems Programs) at (202) 622-8510.
The Internal Revenue
Service Met the First Homeland Security Presidential Directive-12 Milestone
Appendices
Appendix
I – Detailed Objective, Scope, and Methodology
Appendix
II – Major Contributors to This Report
Appendix
III – Report Distribution List
Appendix IV
– Management’s Response to the Draft Report
Abbreviations
|
GSA |
General Services Administration |
|
HSPD–12 |
|
|
IRS |
Internal Revenue Service |
|
PIV |
Personal Identity Verification |
On August 27, 2004,
President Bush signed Homeland
Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification
Standard for Federal Employees and Contractors. The Directive established a new standard for issuing
and processing Federal Government identification cards for entering Federal Government
facilities and for accessing computer systems.
The Directive was designed to enhance security, reduce identity fraud,
and protect the personal privacy of employees and contractors issued Federal Government
identification. The National Institute
for Standards and Technology[1] developed Federal
Information Processing Standards Publication Personal Identity
Verification (PIV) of Federal Employees and Contractors (Publication 201),
which contains the minimum standards, recommendations, guidelines, and
conformance tests for components for the Federal PIV project. Essentially, the PIV project was initiated to
standardize identification cards, perform background checks of employees and
contractors, and issue identification cards for accessing computer systems.
Three other Federal Government
agencies have specific responsibilities for implementing HSPD-12
Governmentwide. The General Services
Administration (GSA)[2] is responsible for assisting agencies in
procuring and operating PIV subsystems such as employee identification cards
and biometric[3] card readers. The Office of Management and Budget[4] is responsible for overseeing implementation
of the Directive and is developing implementation guidance for Federal
agencies. Additionally, the Office of
Personnel Management[5] is responsible for assisting agencies in
authenticating and vetting applicants before they are provided identification cards.
Implementation of HSPD-12
will first be achieved in two phases. In
the first phase, PIV I, agencies must develop procedures for registering
employees, issuing identification cards, and maintaining the identification card
system. In the second phase, PIV II,
agencies must demonstrate their ability to issue the identification cards and
be capable of issuing new cards to all new employees and contractors.
The first
phase of HSPD-12 required procedural guidelines to be in place; the second
phase required identification card issuance.
The Office of
Management and Budget established deadline dates[6] for all Federal agencies to become
compliant, in stages, with HSPD-12:
In addition to issuing identification cards, the Internal Revenue Service (IRS) will have to integrate any new systems necessary to operate with the new identification cards into existing security, personnel, and other systems. Agencies must consider numerous factors when integrating multiple systems, including physical and logical access issues, privacy matters, and software and hardware compatibility. For example, many card readers currently used for physical access are using technology that is up to 20 years old and may not be compatible with the technology necessary to use the new HSPD-12 cards. The Treasury Inspector General for Tax Administration will continue to monitor these milestones as the IRS starts implementing the program in more detail.
On March 24, 2006, the IRS assumed leadership of the Department of the Treasury HSPD-12 Program Management Office. In this role, the IRS is providing leadership to all 13 Department of the Treasury bureaus in developing an integrated Department of the Treasury approach for meeting HSPD-12 requirements.
This review was
performed at the IRS National Headquarters in New Carrollton, Maryland, in the office
of the Chief, Mission Assurance and Security Services, during the period June
through December 2006. The audit was
conducted in accordance with Government
Auditing Standards. Detailed information on our audit objective,
scope, and methodology is presented in Appendix I. Major contributors to the report are listed
in Appendix II.
The Internal Revenue Service Met the First Homeland Security Presidential Directive-12 Milestone
The first HSPD-12 milestone required agencies to comply with the PIV I requirements by October 27, 2005. Specifically, agencies were required to develop procedures for installing and maintaining identification cards that:
· Are issued based on sound criteria for verifying an individual’s identity.
· Are strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation.
· Can be rapidly authenticated electronically.
· Are issued by providers whose reliability has been established by an official accreditation process.
To satisfy the requirements of PIV I, the IRS completed its PIV I Procedures Manual on October 27, 2005. This manual contains step-by-step instructions organized into three main process streams: identity proofing and registration, PIV identification card issuance, and PIV identification card maintenance. This structure follows the organization of Publication 201 PIV I requirements.
In addition, on October 24, 2005, the IRS appointed a Designated Accreditation Authority who granted approval for its PIV identification card plan. The Designated Accreditation Authority determined the Operations Plan and Procedures complied with Publication 201 PIV I requirements and the privacy and security policies were acceptable. We agree with that assessment.
All Necessary
Actions Were Not Taken to Fully Comply With Homeland Security Presidential
Directive-12
To comply with PIV II, the Office of Management and Budget directed agencies to demonstrate by October 27, 2006, their ability to issue the new identification cards. In addition, by that date agencies were required to issue and require the use of identification cards for all new employees and contractors. Currently, the IRS can do neither.
The IRS claims, however, that it met the milestone for PIV II because it contracted with the GSA for 100 identification cards to meet the Office of Management and Budget deadline. The GSA had contracted with a vendor to develop an HSPD-12 solution all agencies could use that included registering employees, ensuring their identities, and producing and issuing identification cards.
The GSA produced the identification cards timely. While the cards contained errors such as the wrong address and misspellings, they otherwise met Publication 201 guidelines.
The IRS is not yet capable of issuing new
identification cards as required by HSPD-12.
The IRS stated it met the PIV II milestone, even though it did not plan to use the GSA solution or any other solutions already available to Federal agencies. Instead, the IRS was attempting to produce its own identification cards but had not yet demonstrated its ability to do so. At least 68 employees and contractors were assigned to the IRS HSPD-12 Program Management Office, but it still had not purchased the hardware and software necessary to produce the identification cards and did not expect to complete the program until September 2010, 2 years after the Office of Management and Budget mandated deadline.
The IRS believed it could develop its own system to issue cards that meet all required technical specifications at less cost than the GSA and it was in a better position to:
· Provide and distribute identification cards at all Department of the Treasury locations. The GSA plans to have over 225 enrollee stations (25 mobile) throughout the country that will service up to 80 percent of the Federal workforce, while the Department of the Treasury plans to have 80 enrollment stations. The IRS was concerned about the costs involved with employees having to travel to the GSA locations and the time it would take to issue the identification cards at these locations.
· Provide compatible technology to identify and authenticate employees. The previous GSA solution relied on technology that may not have been compatible with existing Department of the Treasury software that authenticates computer users’ identities.
· Provide and timely distribute identification cards for the large number of temporary employees the IRS hires for the annual tax return filing season.[7] The IRS stated its hiring practices for temporary and other employees requires identification cards to be issued almost immediately after employees are hired, something they doubted the GSA solution could accomplish.
In addition to the error-prone cards it produced for the IRS, the GSA solution has also experienced problems. Most significantly, the contract with its vendor was suspended and production was consequently stopped. We believe the barriers mentioned by the IRS could be overcome through coordination with the GSA. In addition, we believe the GSA solution, when available, offers several advantages over the IRS approach. Specifically:
In summary, the IRS was at risk of wasting taxpayer funds and delaying the implementation of this Presidential mandate. During the course of this audit, we made the following recommendation to consider the benefits of using a shared solution.
Recommendation
Recommendation 1: To reduce costs and improve the likelihood of meeting the Office of Management and Budget’s subsequent milestones for developing identification cards compliant with HSPD-12 requirements, we recommended during the course of this audit that the Chief, Mission Assurance and Security Services, consider the benefits of using shared solutions such as the one offered by the GSA for issuing identification cards to IRS employees and contractors. Rather than spending resources on developing its own system, we recommended the IRS coordinate with the GSA to resolve concerns and customize the GSA solution to meet IRS needs.
Management’s Response: The Treasury HSPD-12 Program Management Office, with concurrence from the Department of the Treasury HSPD-12 Executive Steering Committee and the Bureau Advisory Board, agreed with the recommendation. The Program Management Office has discontinued development efforts for a Department of the Treasury-wide enterprise HSPD-12 solution. On May 18, 2007, a letter was issued to the GSA stating the IRS’ intention to use GSA services to the extent possible.
Appendix I
Detailed Objective, Scope, and Methodology
The overall objective of this review was to determine whether the IRS
took the necessary actions to comply with HSPD-12 requirements. To accomplish this objective, we:
I.
Determined
whether the IRS met the HSPD-12 requirements for Federal Information Processing
Standards Publication 201 PIV I compliance by October 27, 2005.
A. Compared the IRS’ procedures to Publication 201
standards for:
1.
Control objectives.
2.
Personnel identity proofing and registration.
3.
Card issuance and maintenance.
4.
Privacy.
5.
Background investigations.
B.
Determined whether the procedures were approved
in writing.
C.
Determined whether the implementation plan was
timely submitted and approved by the Office of Management and Budget.
II.
Determined
whether the IRS had procedures in place to be PIV II compliant by October 27, 2006.
A. Reviewed the IRS business case for PIV II
compliance.
B.
Reviewed the IRS budget for HSPD-12.
C.
Reviewed the IRS infrastructure and
procedures for the issuance of PIV cards.
Appendix II
Major Contributors to This Report
Margaret
E. Begg, Assistant Inspector General for Audit (Information Systems Programs)
Steve
Mullins, Director
Thomas
Polsfoot, Audit Manager
David
Brown, Senior Auditor
George
Franklin, Senior Auditor
Jimmie
Johnson, Senior Auditor
Appendix III
Acting Commissioner C
Office of the Commissioner – Attn:
Chief of Staff C
Deputy Commissioner for Operations Support OS
Chief Information Officer OS:CIO
Chief Counsel CC
National Taxpayer Advocate TA
Director, Office of Legislative Affairs CL:LA
Director, Office of Program Evaluation and
Risk Analysis RAS:O
Office of Internal Control OS:CFO:CPIC:IC
Audit Liaisons:
Chief Information Officer OS:CIO
Chief,
Appendix IV
Management’s Response to the Draft Report
The response was removed due to its size. To see the response, please go to the Adobe
PDF version of the report on the TIGTA Public Web Page.
[1] Founded in 1901, the National Institute for Standards and Technology is a non-regulatory Federal agency within the United States Commerce Department’s Technology Administration. Its mission is to promote national innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.
[2] The GSA is an independent Federal agency that manages Federal property, records, and construction.
[3] Biometrics are automated methods of recognizing a person based on a physiological or behavioral characteristic. Among the features measured are face, fingerprints, hand geometry, handwriting, iris, retina, vein, and voice.
[4] The Office of Management and Budget is the organization within the Executive Office of the President that prepares and administers the Federal budget and improves management in the Executive Branch.
[5] The Office of Personnel Management manages the Federal Government’s human resources and its key responsibilities include supporting agencies in recruiting, hiring, and retaining employees.
[6] Office of Management and Budget Memorandum M-05-24, dated
August 5, 2005, Implementation of
[7] The period from January through mid-April when most individual income tax returns are filed.