After recent breaches, IRS promises to add additional security measures to protect against fraud and identity theft by early 2016
Patricia Cohen / New York Times :
Context & Ripple Effects
The IRS's pledge of new fraud safeguards by early 2016 comes twelve days after a watchdog report found the agency had failed to address known computer-security weaknesses, making an attack on 104,000 taxpayer accounts more likely. The promise lands at the start of a disclosure arc that keeps widening: within two months the agency concedes the cyberattacks were more extensive than first reported, touching more than 300K taxpayer accounts, and by early 2016 it revises the figure again to hackers accessing 700K-plus accounts.
The credibility problem is structural: the same protection tooling the IRS deploys becomes an attack surface itself, as when identity thieves steal hundreds of PINs from the Get IP PIN feature built for breach victims, forcing its suspension. Years later the pattern repeats with the abandonment of facial-recognition identity verification via ID.me after bipartisan backlash — each remediation layer generating its own controversy.
First-order effects
- Affected taxpayers face a rolling notification cycle — the agency's own account-access figures double twice within nine months, so the population told their data was compromised keeps growing.
- The IRS must now deliver on a dated commitment (early 2016) while simultaneously operating remediation features like Get IP PIN that are actively being abused.
Second-order effects
- Every protective feature the IRS adds gets stress-tested by the same fraud economy it targets — thieves pivoting from stolen credentials to stealing the recovery tools themselves, which raises the cost of each new safeguard.
- Congressional oversight pressure compounds as watchdog findings and successive upward revisions land on the record, making each subsequent disclosure a political event rather than just a technical one.
Third-order effects
- If the pattern holds, government identity-verification infrastructure converges on a cycle where each authentication mechanism (knowledge-based questions, PINs, biometrics) fails under attack or public backlash and gets replaced — leaving no stable endpoint, only successive regimes.
- Tax-agency breach disclosure becomes a multi-year revision process rather than a single announcement, eroding the assumption that initial incident counts are reliable and reshaping how agencies sequence public communication.
The trend: Government identity infrastructure is locked in a remediation treadmill where each security fix becomes the next attack surface or political flashpoint, forcing repeated regime changes in how citizens prove who they are to the tax authority.