Hacker News Reader

Comment by d_burfoot | Hacker News Reader

It's worth remembering that the main reason this kind of data breach is a real problem is mostly due to the incompetence of the IRS. For any serious financial organization, knowing a person's SSN, name, address, etc doesn't allow you to access or withdraw that person's finances.

But the stupidity of the IRS means that people are easily targeted by false tax return attacks. File a fake tax return for someone, using their SSN/name/address, but tell the IRS you changed address. Then the IRS sends your tax refund to the new address, and boom, you just collected some poor sod's refund. To add insult to injury, the IRS is probably going to audit the person whose refund you stole.

View on HN

But not just the IRS; the banking system, most healthcare providers, states for most of a century, and the credit bureaus for REusing SSN as unique identifier "passwords".

I agree. The IRS should be better funded so they can afford to update their systems and hire more tech experts.

I hope this is meant to be satirical. The IRS has a massive budget. Maybe just reallocate their current funds instead of giving them more is a better idea.

I don’t think the parent is satirical at all; as an enumerated power, the IRS needs modernization and better funding.

Recent hiring expansions have increased audits for high earners and generated additional revenue. Turbotax’s lobbyists are losing influence and we’re enjoying free filing options for individuals in some states. It’s also reasonable to say that a revenue service is not responsible for defining authentication security standards.

Why do you think reallocating funds is worth it as a response to this issue? Where would those funds go?

I'm sure you've seen teams that have bad leadership / a culture of dysfunction. They're always asking for more headcount and no much how much you add they don't get any better. I assume parent was pointing out that no matter how many resources you give to the IRS they won't get functionally better. You need to change the leadership/incentives/culture, which is hard with govt agencies but resources also won't make the problem go away.

I simply don't agree that the issues faced are the same; published reports detail how the complexities inherent to high-income non-filers and filers alike leave plenty of room for more accurate assessments. [0][1]

0. https://www.gao.gov/products/gao-24-106112

1. https://www.irs.gov/newsroom/irs-launches-new-effort-aimed-a...

This comment is shockingly misguided.

The IRS doesn't have the authority to mandate the creation of a secure national ID system and enforce it's use by the financial system. Only congress has the ability to really do that. The IRS collects revenue.

Even if it did have that authority, it doesn't have the budget to accomplish that goal.

isn't it funny how no government service is ever at fault, it's always just a problem of funding? The IRS is good, just under funded. Public schools are good, just under funded. The NHS is good, just under funded. The roads are good, just under funded

except then funding is raised, and it's still a problem of funding. and inevitably, it's the evil side of the government (you know the one) that is to blame, even if there is no money to spend.

how does a public service determine when they have enough funding?

This is neither a problem of funding or any government service being at fault. This is the fault of American culture. A national ID system sounds too scary to too many Americans. Politicians aren't going to waste their political capital on pushing through something so unpopular. It really isn't any more complicated than that. There is a huge desire for some sort of national ID system and SSNs are the closest we got so they filled the vacuum. It is silly to blame that on the IRS. It is a societal failure.

I'm not trying to be combative, but this sentiment just doesn't pass the smell test to me.

Yes, I agree that there is a cultural undercurrent of fear around a national ID system, and I also agree that politicians are likely to game their political capital for the greatest return in their career.

What I do NOT believe is that the Social Security number just sort of came about and started being used by government services such as the IRS without anyone being responsible for that huge organizational decision or the initial (current?) lack of security controls around its implementation.

To me, it seems to be an almost certainty that it is both an organizational problem at the government service level AND (as a result) a funding problem.

>What I do NOT believe is that the Social Security number just sort of came about and started being used by government services such as the IRS without anyone being responsible for that huge organizational decision or the initial (current?) lack of security controls around its implementation.

They didn’t “just sort of come about”, they were created for this exact purpose of tracking government services. Over the years, the number of government services expanded because of the lack of other alternative like I said.

And the lack of security around SSNs is because they weren't intended to be secret. It is generally private sector groups like banks and credit agencies that have turned this into a problem by treating SSNs as if they are a proof of identification. They were created as usernames, but people treated them as passwords.

> They were created as usernames, but people treated them as passwords.

Fully agree, but I don't see how this refutes what I and the root-level comment (anti-IRS sentiment aside) are saying.

> the lack of security around SSNs is because they weren't intended to be secret.

The lack of security is not BECAUSE they weren't intended to be secret. The lack of security is because numerous organizations (including the IRS, until their introduction of an IP PIN) treated these "usernames" as though they were passwords.

It's not a design problem with original intent of SSNs, it's an implementation problem with any organization using them improperly. Gov't services are just as responsible as banks and credit agencies when they misuse them.

In the private sector, OKRs and KPIs are used to track performance and provide metrics on whether a company is meeting its goals. Boards review these metrics and decide on additional investments based on thorough cost/benefit analyses.

I imagine it's similar in the public sector, where funding is determined by the needs of the public, political considerations, long-term planning, and so on.

When exactly has funding EVER been raised for any of those things??

That's one of the biggest political fights in the past century: austerity, cutting public spending, and means-testing the fuck out of every social program the government even still offers. This has been the case since the 80s reagan-thatcher year. You can literally look at the budgets of major cities and easily see where the majority of spending goes. Hint: it ain't public schools. Were you not paying attention when people were talking about how much police departments get paid out of the budgets of their cities a couple years back? Have you EVER thought to actually substantiate your beliefs by actually looking up the policies that effect public spending and government budgets?

Is the answer "no"?

And it isn't just a problem with funding, it's a legislative and cultural problem too. But in the short term, without drafting up new laws or changing the culture of society, the best we can do to fix these issues is provide more funding.

What you describe might be out of date. Someone tried to use my identity to file a fake tax return. The IRS caught it and now I get issued a PIN every tax season for kinda-sorta two factor auth.

Reply on news.ycombinator.com