IRS Should Improve Data Sanitization Procedures, TIGTA Says

Laptop and Desktop Sanitization Practices Need Improvement

September 20, 2021

This report has cleared the Treasury Inspector General for Tax Administration disclosure review process and information determined to be restricted from public release has been redacted from this document.

HIGHLIGHTS

Final Audit Report issued on September 20, 2021

What TIGTA Found

The IRS is not using an approved sanitization product to overwrite sensitive taxpayer data on laptop and desktop hard disks, nor is it annually testing its sanitization equipment and procedures at the Memphis Sanitization Site to verify that the intended sanitization results are being achieved. In addition, while the IRS is sanitizing most of its laptops and desktops, its process to independently verify the sanitization of each laptop and desktop is ineffective. Further, draft Memphis Sanitization Site Standard Operating Procedures need to be clarified concerning accounting for damaged or missing hard disks.

Based on a statistical interval sample of 87 laptops and desktops from a population of 3,882 computers sanitized between January and March 2021, TIGTA determined that one computer was not sanitized and two computers were missing hard disks. Projecting the sample results to the total population of computers sanitized during this period, TIGTA estimates that 45 computers may not have been properly sanitized and 89 computers may be missing hard disks. In addition, there were six computers in the sample with bad sector error messages, which could potentially allow readable information to be recovered. However, further testing did not identify any residual data.

TIGTA also observed the smartphone wiping process and tested a judgmental sample of eight smartphones to determine that the Memphis Sanitization Site had effectively sanitized them. No exceptions were noted.

What TIGTA Recommended

TIGTA recommended that the Chief Information Officer ensure that: 1) the IRS only uses approved sanitization products; 2) sanitization equipment and procedures are tested annually; 3) hard disks that were not sanitized or that had bad sector errors are degaussed or destroyed; 4) hard disks separated from their respective computers are properly accounted for throughout the sanitization process; 5) guidance is clarified to further define accounting for damaged or missing hard disks; and 6) hard disk sanitization results are independently verified using an approved verification software tool.

The IRS agreed with our recommendations. The IRS plans to 1) purchase and implement approved sanitization tools and products (contingent upon funding); 2) implement annual testing of the Memphis sanitization equipment and procedures; 3) degauss or destroy hard disks identified during this review that were not sanitized or had bad sector errors; 4) implement procedures to properly account for hard disks separated from their computers; 5) revise the standard operating procedures to clarify and further define procedures to account for damaged or missing hard disks; and 6) evaluate the Memphis hard disk sanitization process and implement an approved independent sanitization verification tool.

---

September 20, 2021

MEMORANDUM FOR:
COMMISSIONER OF INTERNAL REVENUE

FROM:
Michael E. McKenney
Deputy Inspector General for Audit

SUBJECT:
Final Audit Report — Laptop and Desktop Sanitization Practices Need Improvement (Audit # 202120013)

This report presents the results of our review to assess the effectiveness of the Information Technology organization's hardware asset sanitization process for laptops, desktops, and smartphones. This review is part of our Fiscal Year 2021 Annual Audit Plan and addresses the major management and performance challenge of Enhancing Security of Taxpayer Data and Protection of IRS [Internal Revenue Service] Resources.

Management's complete response to the draft report is included as Appendix III.

Copies of this report are also being sent to the IRS managers affected by the report recommendations. If you have any questions, please contact me or Danny R. Verneuille, Assistant Inspector General for Audit (Security and Information Technology Services).

---

Table of Contents

Background

Results of Review

Appendices

Appendix I — Detailed Objective, Scope, and Methodology

Appendix II — Outcome Measures

Appendix III — Management's Response to the Draft Report

Appendix IV — Glossary of Terms

Appendix V — Abbreviations

---

Background

The Internal Revenue Service (IRS) collects, processes, and maintains tax returns and related information. The IRS is required to protect the confidentiality of taxpayer information, including taxpayer information stored on laptops, desktops, and smartphones. Specifically, Internal Revenue Manual 10.5.1, Privacy and Information Protection Privacy Policy (September 2020), requires the IRS to protect and safeguard sensitive but unclassified data, including tax information and Personally Identifiable Information.

Within the Information Technology organization,¹ the User and Network Services (UNS) function manages the Memphis Sanitization Site (MSS) located at the Enterprise Computing Center — Memphis. The MSS is responsible for receiving IRS end-user laptops, desktops, and smartphones for sanitization, properly sanitizing them, and transferring them to the Facilities Management and Security Services (FMSS) function for disposal.

Sanitization refers to a process that renders access to target data on the laptop, desktop, or smartphone unrecoverable. Sanitization is a key element in assuring confidentiality. The National Institute of Standards and Technology (NIST) Special Publication 800-60, Volume II, Revision 1, Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories (August 2008), defines confidentiality as preserving authorized restrictions on information access and disclosure, including the means to protect personal privacy and proprietary information. A loss of confidentiality is the unauthorized disclosure of information. Hard disk sanitization and disposal is significant because of the sensitive or critical information stored on the laptops, desktops, and smartphones.

Applying effective sanitization techniques and tracking hardware asset inventory are critical aspects to ensure that sensitive data are protected against unauthorized disclosure. It is important to ensure that no residual data remain on the laptops, desktops, and smartphones before they leave the IRS's control. Overwriting or wiping with sanitization software is a process whereby sensitive information on a computer is overwritten with at least a single write pass of nonsensitive information with a fixed data value, such as all zeros. Comparatively, degaussing uses a machine to apply a reverse magnetic field on a computer's hard disk to render it permanently unusable. While the goal of sanitization software is to replace the sensitive data on the hard disk with nonsensitive data, the goal of degaussing is to ensure complete erasure of the hard disk.

NIST guidance further outlines the security categories of the information types that the IRS uses, which include 1) taxation management information and 2) personal identity and authentication information. Both information types are assigned a security category of moderate confidentiality. If an unauthorized disclosure of information having a moderate confidentiality occurred, this could be expected to have a serious adverse effect on organizational operations, organization assets, or individuals.

In January 2016, the Associate Chief Information Officer, UNS function, issued a memorandum that mandated that UNS function personnel refrain from sanitizing the data from any hard disk associated with an end-user. This applied to all end-user computers and smartphones, including those belonging to separating employees. In addition, personnel were instructed that hard disks were to remain intact with their respective computers.

In July 2019, the Associate Chief Information Officer, UNS function, issued a memorandum lifting the sanitization moratorium, advising UNS function personnel that, effective August 5, 2019, they were to resume information technology equipment wiping and disposal operations. This guidance applied to all end-user computers and smartphones. The MSS subsequently resumed sanitization operations using a first in, first out rotation of stockpiled computers and smartphones. As of October 2020, the MSS had 61,809 unsanitized computers (28,370 laptops and 33,439 desktops) and 7,996 unsanitized smartphones.

Results of Review

Laptops and Desktops Were Sanitized Using an Unapproved Sanitization Product

The UNS function was unable to provide sufficient evidence that the software product it is using as a sanitization tool is properly approved for use by the Federal Government. * * * 2 * * *. However, the UNS function only provided:

We reviewed the list of sanitization software that the Common Criteria Recognition Arrangement² has certified using the Common Criteria for Information Technology Security Evaluation.³ The Common Criteria Recognition Arrangement is comprised of 31 government agencies representing their respective member countries, with the Department of Defense representing the United States. While the Common Criteria Recognition Arrangement certified at least four sanitization software products between November 2017 and August 2020, the product that the UNS function is using is not on the list of certified products. Once certified, the products remain on the Certified Products List for five years.

In addition, the IRS has not tested the MSS's sanitization equipment and procedures to verify that the intended sanitization is being achieved. * * * 2 * * *

* * * 2 * * *. The IRS responded that this policy, Internal Revenue Manual 10.8.1, is only applicable to systems categorized as having a Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems (February 2004), rating for high confidentiality. We asked the IRS to provide a list of IRS systems with a security categorization of high confidentiality. There were two * * * 2 * * *-owned systems, which deal with * * * 2 * * * and two IRS systems that * * * 2 * * * assigned this categorization. However, * * * 2 * * * are also stored on * * * 2 * * * that do not have this security categorization.

We believe that security over * * * 2 * * *, regardless of where or how it is stored, should not be treated differently. This is consistent with Internal Revenue Manual 10.5.1, which provides that
systems “. . . with moderate or high confidentiality levels means the potential for harm ranges from serious to severe or catastrophic, with significant to severe impact to an individual or the IRS. * * * 2 * * * is an example of high risk Personally Identifiable Information.”

In addition, UNS function management stated that they used the sanitization software with the understanding that the IRS had attained approval to use the tool in the past. However, without using a currently approved sanitization product and annually testing the sanitization equipment and procedures to ensure that the desired results are being achieved, the risk exists that the sanitization product could fail to remove residual information from laptop and desktop hard disks. If not sanitized properly, release of the hard disks outside of the IRS could lead to unauthorized disclosure of confidential taxpayer information.

Management Action:

In June 2021, UNS function management stated that they acquired and are now using a National Security Agency–approved degausser to purge data on hard disks at the MSS for laptops and desktops that will be disposed of outside of the IRS. Because the IRS acquired the degausser at the end of our audit work, we were unable to test its effectiveness. However, if calibrated correctly, we believe that the degausser will effectively ensure complete erasure of the hard disks.

For the remaining computers that the UNS function expects to reuse within the IRS, UNS function management is working to identify and implement a sanitization software solution. The UNS function is also in the process of acquiring a Solid State Drive Disintegrator, which is designed specifically for the destruction of solid state hard drives.

Most Sampled Laptops and Desktops Were Sanitized

To test the effectiveness of the computer sanitization process, we selected and tested a random statistical sample⁴ of sanitized laptops and desktops to determine whether residual data remained on the computers' hard disks. Specifically, we randomly selected a statistical interval sample of 87 (2.24 percent) computers from a population of 3,882 computers that the MSS sanitized between January and March 2021. We used sanitization verification software from a different vendor to independently test if the sanitization was effective. Figure 1 shows the results of our sanitization verification testing.

Figure 1: Sample Results of Testing Sanitized Computers for Residual Data

Test Results	Computers in Sample
Hard Disk Not Sanitized but Encrypted	1
Hard Disk Was Missing	2
Hard Disk With “Error Accessing Drive Sectors”5 Message	6
Hard Disk Sanitized	78
Total	87
Source: Treasury Inspector General for Tax Administration analysis of a statistical interval sample of laptops and desktops the MSS sanitized between January and March 2021.

For the one unsanitized computer, we observed that the hard disk was encrypted. * * * 2 * * *. If encryption is properly enabled, the risk of inadvertent disclosure of confidential information is significantly reduced even if the hard disk was not sanitized. At our request, the IRS tried to locate the two computers with missing hard disks, but it ultimately was unable to do so. As a result, we were unable to test these two hard disks to determine if they had been sanitized and if the sanitization process was effective.

Projecting our sample results to the total population of computers the MSS sanitized between January and March 2021, we estimate that 45 (1.16 percent)⁶ of the 3,882 sanitized computers may not have been properly sanitized. Further, we estimate that 89 (2.30 percent)⁷ of the 3,882 computers may have been missing hard disks that were not identified in the MSS's hardware asset inventory (the inventory issue is discussed in the next section).

For the remaining six computers with bad sector error messages, we used a different vendor's data recovery software to retest the hard disks for the existence of residual data. Although our additional testing did not identify any residual data, NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization (December 2014), states that overwriting cannot be used for media that are damaged or not rewriteable. However, degaussing or destruction are acceptable methods to purge damaged media containing sensitive information.

Draft MSS Standard Operating Procedures need to be clarified concerning accounting for damaged or missing hard disks

During our review, two sampled computers with missing hard disks were incorrectly stored on a pallet with sanitized devices and incorrectly recorded as accounted for in the MSS's hardware asset inventory. Internal Revenue Manual 2.149.1, Asset Management, Asset Management (AM) Policy (September 2018), states that the Information Technology organization is “responsible for the accounting and recording of IT [information technology] property in the inventory system. . . . This process supports the integrity of the data by ensuring accurate and complete asset records are maintained.” However, draft MSS Standard Operating Procedures state that personnel should remove the computer's damaged hard disk and give it to the tape library at the Enterprise Computing Center — Memphis but does not clearly define under what circumstances to do so, any time frame for doing so, or how to account for the hard disks in the MSS's hardware asset inventory. In addition, these procedures do not explain how to account for computer shells sent to the MSS with missing hard disks. This lack of detailed guidance resulted in the IRS misplacing hard disks most likely containing taxpayer data and errors in the hardware asset inventory records.

The tape library at the Enterprise Computing Center — Memphis stores the damaged disks until they are eventually shipped to the Enterprise Computing Center — Martinsburg for degaussing. Keeping an inventory of hard disks is problematic because they are not labeled with an inventory barcode, which are affixed to the laptop or desktop shells that initially contained the hard disks. The IRS has established an Asset Sanitization Certification process, which includes procedures for documenting the removal of a hard disk from its computer shell when required. However, we question whether the IRS is consistently following this process because UNS function personnel were unable to find an Asset Sanitization Certification Form or a Standard Form 120, Report of Excess Personal Property, for our two sampled computers with missing hard disks. The IRS believes that the two computers may have been inadvertently placed on the wiped pallet given the IRS's challenging environment of sanitizing the large stockpile of computers that accumulated during the moratorium.

While we acknowledge that resuming hard disk sanitization and establishing the Asset Sanitization Certification process were a huge undertaking, some improvement can be made. We believe that clarification is needed in the draft MSS Standard Operating Procedures to allow for better accountability over hard disks throughout the entire MSS sanitization process that are too damaged to wipe or missing from their respective computers.

Smartphone Sanitization

In addition to testing sanitized computers, we reviewed the process the IRS uses to wipe smartphones. MSS personnel enter an incorrect password several times to initiate the wipe. We observed this wiping process and also tested a judgmental sample⁸ of eight smartphones and determined that the MSS had effectively sanitized them. To verify the success of the wipes, we observed that the smartphones booted up to the initial setup screens.

The Process to Independently Verify the Sanitization of Laptops and Desktops Is Ineffective

After the computers are sanitized, the MSS transfers them to the FMSS function for disposal. At the time of transfer, MSS and FMSS function personnel together visually compare the description of the computers listed on the Standard Form 120 to the bar codes on the pallets of sanitized laptops and desktops. In addition, MSS personnel complete and sign an Asset Sanitization Certification Form to document that the MSS sanitized the computers prior to physical custody of the assets being transferred to the FMSS function.⁹

The UNS function's Asset Sanitization Certification process includes procedures for UNS function personnel to document the independent verification that each individual computer was effectively sanitized. While UNS function management stated that an individual conducting the verification process should boot up the computer to a command level prompt to demonstrate that the computer was sanitized, we did not see this procedure documented in the draft MSS Standard Operating Procedures or observe it being performed.

Further, NIST Special Publication 800-88 suggests that the verification process should be performed using a different verification software tool, that is, not simply booting up the computer or reusing the original sanitization tool to perform the verification. The UNS function's verification procedures for computers do not include an effective test of each computer using a verification software tool to verify that the sanitization was effective and that residual data cannot be read.

NIST Special Publication 800-88 also states that effective sanitization techniques are a critical aspect of ensuring that sensitive data are effectively protected by an organization. The goal of sanitization verification is to ensure that the data were effectively sanitized prior to leaving the control of the organization. Specifically, NIST Special Publication 800-88 states:

Verifying the selected information sanitization and disposal process is an essential step in maintaining confidentiality. Two types of verification should be considered. The first is verification every time sanitization is applied. The second is a representative sampling verification, applied to a selected subset of the media. If possible, the sampling should be executed by personnel who were not part of the original sanitization action. The goal of sanitization verification is to ensure that the target data was effectively sanitized. A full verification should be performed, if time and external factors permit.

Further, the UNS Hardware Asset Management User Guide (September 2019) states “. . . verification of the disk wipe will be completed on 100 percent of the assets readied for disposal. The verification ensures that sensitive but unclassified data has been removed prior to equipment transfer to [the] FMSS [function] for final disposal.”

UNS function management believed that the MSS met the intent of the sanitization verification guidance through 1) performing the visual inspection of the computers on the sanitized pallets and 2) having a person independent of the sanitization process boot up the computers to a command prompt. However, if the MSS had performed actual verification testing of its sanitized computers using a verification software tool, missing hard disks and hard disks with residual data or bad sector errors would have been identified.¹⁰

Because the MSS verification process is ineffective, the UNS function cannot ensure that residual taxpayer data or Personally Identifiable Information does not remain on those items disposed outside of the IRS. If an unauthorized disclosure of tax or Personally Identifiable Information occurred, it could result in substantial harm, embarrassment, and loss of public confidence in the IRS. An unauthorized disclosure could also harm an individual.