Santa Rosa Tax Office Theft
On Tuesday, March 20, 2007, the Press Democrat carried a story on the front page
about a computer theft at a tax preparation business. This is one of our biggest
fears in our business. The potential effects from identity theft are significant
and there is information about that posted on our web site.
We think it is useful to understand where the vulnerabilities are in dealing
with a tax preparation business, and have detailed these here. We think it is
also important for our clients to understand that we have sufficient confidence
in the steps we have taken that our own personal records are included right
along with our clients'.
People Involved
This is the most serious risk. If there are people involved with your
information that fall short of the highest moral fiber, you are at risk.
This applies to both the owners and operators of a business, and their employees.
This is not unrelated to news we heard a year ago about some large
companies out-sourcing returns into Asia.
Note that the article in the Press Democrat stated that the theft must have
been done by someone who had been there, since 6 computers with partial data
were not taken, but the one computer that backs up all the data was taken.
We submit that this means the crime was committed not by someone who had
just been there before, but someone who knew the business operation. That
suggests an employee (current or previous).
At this time we still have no plans to ever have any employees. And we do not
out-source our work to others.
Tax Documents
An office must have your tax documents while working on your tax return.
The risk here is unavoidable, although the business should take precautions
of locking your records up when not being used, protecting them from other
clients, etc. Still, few alternatives would stop a criminal from accessing
these during a break-in short of a bank vault - and the cost of that would
be unwelcome by most clients. The things that can help in this area are:
-
Minimize the duration that the service has your documents. This is more
often driven by how responsive you as a client are to missing information
that will allow the completion of your return.
-
Minimize what documents are kept after your return is filed. There are
legal requirements for some items, but storage options differ in the
vulnerability. (See below on stored records.)
We return all documents to our clients.
Tax Software
Certainly the information maintained in the computer files used by the
tax software present a vulnerable situation. However, most modern
professional tax software stores information in encrypted ways that
make it unusable unless accessed through the tax software package
itself. Therefore the key is whether the practitioner is employing
password access to the software (which many packages include).
We use passwords to secure access to our tax software.
Archive Information
One of the requirements for e-filing is that the practitioner must
save certain documents. (Don't consider this a negative of e-filing,
as it is still far more advantageous than paper-filing.) So some
archival is required.
A tax return preparation office will also save other documents that permit them to provide better
service. At a minimum they will keep tax returns from previous years, but often
some of the supporting documentation will be saved too. (You may be very
grateful that they saved these items if you are audited.)
The key to security is how this is saved. If archived in paper form
then protecting the information is very difficult. But on the other
hand, it is difficult for a criminal to carry off multiple file cabinets.
In a paperless office the information is easier to protect, but easier
to carry off as in the theft reported by the Press Democrat. So a key
is to archive the information using an encryption technique that truly
protects the information. Generally simple file password schemes are
not very secure.
Offices should also back up their data for disaster recovery purposes.
There are many techniques for this, with varying degrees of data security.
At our office we are converting the legacy paper files to electronic
storage, and use only electronic storage for all current work. We also
employ a very secure encryption tool with a very strong password key to
protect the data. No system is perfect, but we are located at the
high-end extreme among tax professionals.
So, should you be concerned about the security of your information when
using a tax return preparation service? It is always good to use care
in dealing with such private information. As for The Master's Tax Service
we have taken serious steps to protect your information. We are confident
enough to keep our own personal information in the same way.
| 
