Inside the fence at the IRS
On D-Day, the Equifax breach, and why a hackathon in the days just before April 15th would be a really hazardous idea
Wired reports that a White House-empowered team is planning a "hackathon" at the IRS in order to create an application programming interface (or API) to permit data to be moved more freely from one software system inside the tax agency to another.
â– There are very good reasons to be concerned about any large-scale effort to break down barriers that otherwise kept sensitive information (like taxpayer data) siloed and firewalled. Even in the best of circumstances, so much of that data is potentially so sensitive that it rises to the level where background checks, security clearances, and a whole lot of legal counsel ought to be involved.
â– But even if everything were to be conducted according to the strictest possible internal controls and safeguards, there is a bigger problem with the reported plan. A "hackathon" is a fine model to use when trying to assemble a group of smart, creative people in a single place to achieve a narrowly-defined goal. There are even charity hackathons that invite people with computer skills to donate their abilities to solve problems for public-benefit causes.
â– The IRS, though, maintains watch over one of the biggest troves of high-value sensitive personal data anywhere in the world. The Office of Personnel Management breach in 2015 and the cyberattack on Equifax in 2017 were huge. A successful breach of coordinated data at the IRS would be bigger than both events combined -- since nobody escapes the notice of the IRS.
â– The nature of a "hackathon" means that products -- perhaps incomplete, certainly not fully vetted -- will be tested, quite possibly on live data. And that means defenses will be lowered: At the very least, people whose job it is to watch for suspicious server activity will be expecting unusual activity to be taking place. There could be no more ideal time for an adversary to try to attack.
â– Just as Eisenhower took the weather into account when carrying out D-Day, a skilled cyber-adversary looks for exactly the kind of "hackathon" conditions that would offer cover for conducting their own operations. There is a time and a place for the "hackathon" approach -- but the servers and systems affecting every American taxpayer, in the days just prior to the deadline to file tax returns, is most certainly not it.
â– It's possible that the report is erroneous or flat-out wrong. It's also possible that something far more benign than a "hackathon" -- like a strategic planning meeting or a project kickoff -- is planned instead, and someone is using the wrong terms. But it's also possible, particularly based on what's happened at other Federal agencies, that "shock and awe" are indeed in the works.
