Around one-third of the digital applications the IRS runs are out of date, raising fresh concerns about cybersecurity issues, workflow management and the agency’s ability to process hundreds of millions of U.S. tax returns, according to the U.S. Government Accountability Office.

GAO said in a recent study that about 33% of applications, 23% of software instances in use and 8% of hardware assets were considered legacy. The list includes applications ranging from 25 to 64 years in age, as well as software with up to 15 versions behind up-to-date versions.

The agency said: “As GAO has previously noted, and IRS has acknowledged, these legacy assets will continue to contribute to security risks, unmet mission needs, staffing issues and increased costs.”

According to the watchdog, IT modernization best practices require agencies to create plans that include milestones, a list of work to be performed and plans for disposing of legacy systems. As of August, IRS had plans for 21 IT system modernization initiatives underway, however, six out of the nine plans did not address disposal of currently operational legacy systems.

Although IRS officials said they would address this, they did not identify a timeframe for doing so.

The watchdog also noted that the IRS has recently suspended six operations, including two that are essential to replacing the 60-year-old Individual Master File, which is the agency’s authoritative data source for individual tax account data.

This latest study comes after the watchdog in September called on the IRS to improve the scope of its inside threat monitoring systems within the agency. According to the inspector general’s report at the time, information was missing for 234 of 351, or 67%, of systems included in a key enterprise security audit trails system list.

That watchdog intervention came shortly after the IRS unintentionally published confidential data relating to business tax return submissions on its website.

Readers of this blog will remember that I previously posted on the shocking case brought by whistleblower Paul Cimino against IBM arising out of a predatory software audit conducted by IBM of the Internal Revenue Service (“IRS”).   Although Cimino worked for IBM he was apparently so horrified by IBM’s complete fabrication of non-compliance findings in order to force the IRS into a new and more expensive ($265 million to be exact) license agreement that he blew the whistle and filed a claim under the federal False Claims Act (“FCA”).

The district court dismissed the key fraudulent inducement claim finding that it was not credible that the IRS would enter into a new and more expensive contract with IBM just to get out from under substantial audit penalties.   The D.C. Circuit Court of Appeal disagreed and found that Mr. Cimino had plausibly alleged that “but for” the fraudulent audit, the IRS would never had entered into the new license agreement.  The court remanded the case back to the trial court for further proceedings. This is a big win for Cimino and although decided under the FCA, can be instructive for all those companies out there who have suffered through predatory audits by major software publishers.

The Court explained the case as follows:

“This qui tam action began when Paul Cimino filed a complaint alleging that IBM violated the FCA. As a former senior sales representative for IBM, Cimino helped sell software to the IRS. Based on knowledge acquired on the job,  Cimino alleged that IBM fraudulently induced the IRS to enter a $265 million license agreement for “unwanted, unneeded” software.

Faced with the possibility of losing significant revenue, IBM allegedly devised a scheme to pressure the IRS into another long-term deal. IBM planned to conduct a “friendly” audit, anticipating that the IRS was overusing the software and therefore would owe a significant amount in compliance penalties. IBM would then leverage the penalties by offering to waive them in exchange for a new agreement.

IBM retained Deloitte LLP to perform the audit.  Contrary to IBM’s expectations, Deloitte’s initial audit showed the IRS was not significantly overusing the licenses and owed only $500,000 in compliance penalties—a relatively small amount for a contract of this size. IBM never released these audit results to the IRS. Instead, IBM worked with Deloitte to manipulate the results. For example, IBM counted licenses on discontinued servers as in constant use, even though they were never used. Deloitte first presented the number of overused licenses from this manipulated audit to Adam Kravitz at the IRS. Cimino alleged that “Kravitz rejected the audit findings because, in his words, ‘IBM cannot substantiate that the IRS is out of compliance.’”  IBM then manipulated the audit again to show an outstanding $292 million in compliance penalties. IBM shared this number with the IRS, despite the fact that one IBM employee considered the number “ridiculous,” and another “was ‘not comfortable representing’ that number to the IRS.”

As we have warned before, avoid “friendly” software audits by software publishers as there is nothing friendly about them.  If Oracle or IBM or whatever software company wants to conduct an audit, then they should issue a formal audit notice and do so.  These “friendly” audits are often nothing more than fishing expeditions where the sales team hopes to turn non-compliance findings into a big payday and a big contract.  Licensees should stand on their contractual rights and not fall into these traps.

Another interesting aspect of the case is how IBM allegedly was attempting to charge the IRS by claiming licensing fees for non-use of the IBM software.  The court pointed to allegations that IBM claimed fees for discontinued servers for constant use even though they were never used.  We see similar attempts by Oracle and others to charge customers a licensing fee on servers where no Oracle software is being used, such as in the case of Oracle’s expansive VMware assertions, which involve non-contractual and non-binding policies.  Customers under audit should carefully review license agreements and challenge during audit resolution negotiations policies that are not expressly incorporated into the contract.  Careful attention should be paid to assertions that payment must be made for non-use by the customer of the auditing company’s software, or for potential future use that has not yet occurred.  

We were pleased to see that the appellate court reversed the lower court’s dismissal and is allowing this whistleblower suit to proceed past the pleading stage.  Only when predatory software vendors are held to account by the courts will such behaviour end.  Tactical Law will continue to monitor the case.  Please check back here for periodic updates.

The Treasury Inspector General for Tax Administration said in a Sept. 18 report that the IRS prematurely closed 11 recommendations from three prior audits of the agency’s software license management.

The audits, which occurred between June 2013 and September 2014, outlined 14 recommendations to improve the tracking of software licenses across the agency’s mainframe, service, and desktop and laptop environments, including developing roles and responsibilities in the Internal Revenue Manual for managing software assets.

TIGTA officials also said that the IRS was not in compliance with the Making Electronic Government Accountable By Yielding Tangible Efficiencies, or MEGABYTE, Act of 2016 for a series of conditions it has yet to meet. The law requires agencies to create plans to manage and inventory software licenses.

For the 11 recommendations the IRS said it had taken steps to close in October 2016, investigators said the agency had not gone far enough into resolving the proposals before closing them.

Two recommendations centered on establishing an organizational structure to manage software assets and licenses. The IRS established the Enterprise Software Governance Board in December 2013 to oversee software assets, but it was decommissioned in 2015 as part of an agency organizational consolidation.

Presently, investigators say there is no organizational structure to oversee software asset management; information is sent to ex-ESGB members to resolve funding issues. Oversight issues are sent to Information Technology Infrastructure Strategy Team, an ESGB working group.

Two other recommendations called for the IRS to craft policy and guidance using the Information Technology Infrastructure Library, a recognized set of best practices for managing IT systems.

Agency officials did craft a policy for IT asset management titled IRM 2.149, but investigators said it didn’t “establish policy and guidance for IRS management as defined by the ITIL.” The report also said that the agency hadn’t written guidance of the level needed to close the recommendation.

The IRS also hasn’t created roles and responsibilities for personnel to handle software asset management or developed operating procedures for automated solutions to track software usage and costs, which represented four collective recommendations.

The agency is using an IBM-based program to track inventory, but TIGTA officials said asset management solutions should include license entitlement information.

The IRS has yet to implement software tools to fully track licensing data, and develop and maintain a software license inventory, saying that there is not one commercial-off-the-shelf tool to create an inventory. Since no tool has been implemented, TIGTA officials said a collective six recommendations should remain open.

“The IRS continues to be unable to report a complete and accurate inventory with associated costs. Until the IRS implements an effective SAM program to manage software licenses, it will continue to incur increased risks in managing software licenses,” the report said.

TIGTA officials offered three additional recommendations: