Matt Bracken Archives | FedScoop https://fedscoop.com/author/matt-bracken/ FedScoop delivers up-to-the-minute breaking government tech news and is the government IT community's platform for education and collaboration through news, events, radio and TV. FedScoop engages top leaders from the White House, federal agencies, academia and the tech industry both online and in person to discuss ways technology can improve government, and to exchange best practices and identify how to achieve common goals. Fri, 07 Jun 2024 21:17:28 +0000 en-US hourly 1 https://wordpress.org/?v=6.5.4 https://fedscoop.com/wp-content/uploads/sites/5/2023/01/cropped-fs_favicon-3.png?w=32 Matt Bracken Archives | FedScoop https://fedscoop.com/author/matt-bracken/ 32 32 IRS dinged by GAO for subpar documentation of AI audit models https://fedscoop.com/irs-ai-audit-models-gao-report/ Fri, 07 Jun 2024 21:17:27 +0000 https://fedscoop.com/?p=78723 The tax agency has taken steps to address the watchdog’s concerns over how AI is used to select audit cases.

The post IRS dinged by GAO for subpar documentation of AI audit models appeared first on FedScoop.

]]>
An IRS pilot program that uses artificial intelligence to select audit cases and identify noncompliance didn’t properly document elements of the technology’s sample selection models, a new watchdog report found.

Because the tax agency had “not completed its documentation of several elements” of the models used for its National Research Program audits, the IRS could struggle to “retain organizational knowledge, ensure the models are implemented consistently, and make the process more transparent to future users,” according to the Government Accountability Office.

The IRS first piloted AI techniques for sampling tax returns in NRP audits during the 2019 filing season. The tax agency selected 4,000 returns for audit through that new AI-powered methodology, while an equal share was chosen through its traditional selection process. The following year, the NRP sample was approximately 1,500, all selected with the AI-informed process, and in 2021, 4,000 returns were picked based on two different AI samples.

The GAO noted that the implementation of redesigned sample selection processes “can be a complex undertaking,” especially when an emerging technology like AI is added to the mix. With that in mind, the watchdog pointed to the usefulness of its AI accountability framework.

“The AI Framework emphasizes the importance of documentation to help ensure that the AI system’s objectives are met,” the GAO wrote. “It further emphasizes that documentation can offer a way for agencies to provide transparency, such as (1) what the system is for, (2) what it is not for, (3) how it was designed, and (4) what its limitations are.”

The GAO’s audit found that the IRS had fallen short in two framework areas: clearly defining and documenting roles and responsibilities for each step of the AI sample selection process, and documenting the variables used to develop and run those selection models.

As the IRS reviewed the GAO report in April and responded with comments, it made two changes to address the watchdog’s concerns: writing a draft memo that listed the people responsible for steps in the AI development and sample selection process, and updating a technical document with specifics on variables and the code behind the AI models. 

“These actions will increase IRS’s ability to effectively implement and ensure operational effectiveness of the AI models,” the GAO said.

The post IRS dinged by GAO for subpar documentation of AI audit models appeared first on FedScoop.

]]>
78723
Treasury seeks information on AI uses and risks in the financial sector https://fedscoop.com/treasury-department-ai-rfi-janet-yellen/ Thu, 06 Jun 2024 20:48:40 +0000 https://fedscoop.com/?p=78710 The RFI continues an agency push for “stakeholder engagement to improve our understanding of AI in financial services,” Secretary Janet Yellen says.

The post Treasury seeks information on AI uses and risks in the financial sector appeared first on FedScoop.

]]>
The Treasury Department is seeking public feedback from financial institutions, consumers, academics, advocates and other industry stakeholders on the uses, opportunities and risks posed by artificial intelligence as part of an ongoing agencywide exploration of the technology’s potential.

The request for information, released Thursday, asks for comments on advancements in existing AI tools and on emerging AI technologies that can benefit the financial sector. The RFI has specific callouts for information on the use of AI in financial products and services, risk management, capital markets, internal operations, customer service, marketing and regulatory compliance. 

“Treasury is proud to be playing a key role in spurring responsible innovation, especially in relation to AI and financial institutions. Our ongoing stakeholder engagement allows us to improve our understanding of AI in financial services,” Under Secretary for Domestic Finance Nellie Liang said in a statement. “The Biden administration is committed to fostering innovation in the financial sector while ensuring that we protect consumers, investors, and our financial system from risks that new technologies pose.”

Treasury listed 19 questions, plus numerous follow-ups, for respondents within its RFI, including: asking for feedback on any AI models that financial institutions are currently using; whether AI use cases differ within institutions; what barriers small banks face in AI deployment; how AI has benefited low-to-moderate income consumers and/or underserved individuals and communities; the extent to which AI models are developed in-house, by third parties or via open-source code; and how industry is applying risk management frameworks to AI use.

During remarks Thursday at the Financial Stability Oversight Council Conference on Artificial Intelligence and Financial Stability in Washington, D.C., Treasury Secretary Janet Yellen touted the release of the RFI as a way of “continuing our stakeholder engagement to improve our understanding of AI in financial services.” Yellen also announced a future roundtable discussion, convened by Treasury’s Federal Insurance Office, on the benefits and challenges of AI use for insurers. 

“FSOC will continue its efforts to monitor AI’s impact on financial stability, facilitate the exchange of information, and promote dialogue among financial regulators,” Yellen said. “Given how quickly AI technology is developing, with fast-evolving potential use cases for financial firms and market participants, scenario analysis could help regulators and firms identify potential future vulnerabilities and inform what we can do to enhance resilience.”

Much of Treasury’s RFI is informed by the agency’s previous work on AI, including a March report that sounded the alarm on AI-specific cybersecurity risks to the financial sector. Just last month, the department issued a national strategy for combating terrorism and other illicit financing, which called out the benefits AI might have in winning that fight.

Closer to home, Treasury has experimented with its own AI use cases, while also engaging in public-private partnerships to ensure that smaller financial institutions have the same defensive AI capabilities as the country’s biggest banks. 

The post Treasury seeks information on AI uses and risks in the financial sector appeared first on FedScoop.

]]>
78710
House Republicans aim to end IRS’s Direct File in 2025 appropriations bill https://fedscoop.com/house-republicans-irs-direct-file-cuts-appropriations-budget/ Thu, 06 Jun 2024 15:00:37 +0000 https://fedscoop.com/?p=78694 A GOP policy rider zeroes out funding for government-run tax preparation software, a week after the agency said its free electronic filing program would be made permanent.

The post House Republicans aim to end IRS’s Direct File in 2025 appropriations bill appeared first on FedScoop.

]]>
During a week in which the IRS announced a notable milestone for one of its signature digital initiatives, Republicans on the House Appropriations Committee released a proposal that would derail the tax agency’s newest technological priority. 

The House GOP’s Financial Services and General Government Appropriations Bill, released this week by committee Chair Tom Cole, R-Okla., targets the IRS’s Direct File program via a policy rider that prohibits the funding of “a government-run tax preparation software that Congress has not authorized.” 

Just last week, the IRS announced that Direct File would be made permanent following a pilot program that saw more than 140,000 taxpayers across 12 states use the free electronic filing system. The tax agency said the program received more than $90 million in refunds and reported $35 million in balances due during its pilot run. 

Treasury Secretary Janet Yellen touted Direct File further this week during testimony before the Senate Appropriations Subcommittee on Financial Services and General Government, noting that all states will be invited to participate in the program “as soon as next filing season,” with expansion on the horizon “to support all of the most common tax situations over the next few years.”

House Republicans’ bill, which cuts the IRS’s budget by $2.2 billion from fiscal 2024 funding levels, is the culmination of months of sustained attacks on Direct File from GOP members of Congress, state attorneys general and state treasurers and comptrollers

The highly lucrative tax preparation industry has also been gunning for Direct File. In an April statement to FedScoop, a spokesperson for Intuit — maker of TurboTax — said the tax agency’s Direct File post-mortem included estimates that were “clearly low, inaccurate, and the IRS even acknowledges conveniently leaving out necessary costs to build and run the pilot.”

Democrats, meanwhile, railed against Republicans’ proposed cuts to the IRS — which include a $2 billion reduction in enforcement funding — and especially the move against Direct File. Senate Finance Committee Chairman Ron Wyden, D-Ore., said in a statement that “the centerpiece” of Republicans’ budget plan for the IRS is “helping rich people cheat on their taxes.”

“If Republicans have the opportunity, they will deprive law-abiding taxpayers of the choice to file their taxes for free with the IRS’s new direct file program by shutting it down before it expands nationwide,” Wyden said. “In short, the winners in this plan are rich tax cheats like Donald Trump, and the losers are typical Americans who earn a wage, follow the law and want to file their tax returns every spring without getting ripped off by big tax software companies.”

News of the GOP’s Direct File targeting came amid a victory lap for the IRS and its Document Upload Tool, which processed its one millionth taxpayer submission. The agency had a limited rollout of the tool in 2021 and expanded it substantially in 2023 thanks in part to funding from the White House’s Inflation Reduction Act.

“The Document Upload Tool is a key part of our ambitious initiative to transform the IRS into a virtually paperless agency, and we continue to see increased use of this by taxpayers,” IRS Commissioner Danny Werfel said in a statement. “This tool saves time for taxpayers and helps IRS employees process responses faster and more efficiently.”

The post House Republicans aim to end IRS’s Direct File in 2025 appropriations bill appeared first on FedScoop.

]]>
78694
AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say https://fedscoop.com/ai-cyberattacks-federal-agencies-fbi-treasury-state-department/ Wed, 05 Jun 2024 15:07:46 +0000 https://fedscoop.com/?p=78674 Officials from Treasury, State and the FBI say information-sharing is increasingly important as AI enables so-so hackers to level up.

The post AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say appeared first on FedScoop.

]]>
A day in the life of the Treasury Department’s top cybersecurity official is an unrelenting game of Whac-a-Mole that has only grown more intense in the age of artificial intelligence and the corresponding rise of inexperienced-yet-prolific attackers. 

For Sarah Nur, Treasury’s chief information security officer and associate CIO for cyber, that arcade-style battle to protect federal networks from adversarial threats is “nonstop.”

AI has made it “a lot easier” for “unsophisticated threat actors … to create these attack scenarios,” Nur said, “so that they can go ahead and launch and play around in our current infrastructure.”

Speaking Tuesday at a Scoop News Group-produced GDIT event in Washington, Nur and other federal cyber officials spoke of the proliferation of AI-fueled cyberattacks and how much more critical coordination and information-sharing has become as use of the technology among amateur hackers has surged.     

Cynthia Kaiser, deputy assistant director of the FBI’s cyber division, said she’s seen “a crop of adversaries who are becoming at least mildly better” at their craft due to AI. The technology eases hackers’ ability to perform basic scripting tasks and identify coding errors, Kaiser said, while deepfakes are leveraged in social engineering campaigns and increasingly refined spearphishing messages.

“A beginner hacker can go to the intermediate level,” she said, “and even the most sophisticated adversaries can be more efficient.”

Gharun Lacy has also observed a leveling up among threat actors in his role as deputy assistant secretary for cyber and technology security in the State Department’s Bureau of Diplomatic Security. Those adversaries are “using AI as an amplifier,” bettering their best skills as a result. 

“Do you have a threat actor that is extremely proficient in human engineering? Then they’re going to get better at human engineering,” Lacy said. “That phishing email will now call you by a nickname that you had in high school.” 

The Treasury Department is especially susceptible to this onslaught of new-age threats given its role as the federal government’s sanctions arm, Nur said, not to mention the fact that the financial industry is one of the most targeted critical infrastructure sectors. Hackers today can simply look up a CVE, plug it into an AI system and ask it to provide “an undetected attack scenario that I can utilize,” Nur said, noting that packages of this kind on the dark web are “ready to go.”

“I heard someone say ‘fight AI with AI.’ I get what that means,” Nur said, “and I think that’s a very key concept. We really have to look at leveraging AI to quickly detect these anomalies and any kind of fraud or unusual suspicious activity.”

The silver lining for federal security officials is that AI still provides defenders with a decided advantage over attackers in cyberspace. The key to maintaining that advantage, they say, is doubling down on coordination with public and private-sector partners.

Kaiser said the use of large language models to “more rapidly draft text” for interagency memos and private-sector alerts represents “a huge win for everybody” in the battle against threat actors. 

At the State Department, the chief AI officer, chief data officer and members of the agency’s Center for Analytics have successfully leveraged AI in “reducing the noise in terms of threat intelligence,” Lacy said, sifting through “massive amounts of data” to make it “more actionable directly for us.” Streamlining data and threat intel leads to more valuable insights that State can provide to its partners, he added. 

“If I know this piece of information is not useful for me, but it may very well be useful to one of my private industry partners, I need to know how to get that information to them quickly,” Lacy said, noting that the White House has provided a quality blueprint for sharing intelligence and has encouraged agencies to be “very forthcoming now in terms of naming, blaming [and] shaming when incidents happen — and doing it quickly.”

Lacy pointed to a State Department collaboration with foreign ministries from the United Kingdom, Australia, Canada and New Zealand that brings together those countries’ cyber defenders in a quarterly meeting to “share a lot of information.” 

“I think we’re past the sharing; we’re on to collaborating,” Lacy said. “I think that’s … the phase we’re in right now. But the collaboration has to yield collective action.”

Treasury’s in a similarly collaborative mode at the moment, fresh off its launch last month of Project Fortress, a public-private partnership aimed at protecting the financial sector from cyber threats. Nur said the agency has been active in onboarding companies and organizations to the group, ensuring that participating financial institutions have access to top tools and are practicing good cyber hygiene before truly “aggressive AI attacks” become the norm.

Whether it’s meeting regularly with other CISOs, coordinating with international partners or establishing communication channels with industry, agency cyber officials across the board agree that mitigating AI-fueled threats will only be possible with more collaboration and better sharing of information.

“In the past, what really prevented us from sharing that information is that embarrassment, that reputational impact,” Nur said. “We can no longer think in those ways. We need to shift our mindset to say, ‘hey, look, we’re going to expect at least two to three a year, maybe even more, and that’s OK.’” 

The post AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say appeared first on FedScoop.

]]>
78674
Fed, SEC need more consistent blockchain coordination, GAO says https://fedscoop.com/federal-reserve-sec-blockchain-coordination-gao-report/ Mon, 03 Jun 2024 21:43:32 +0000 https://fedscoop.com/?p=78624 Priority open recommendations from the watchdog ding the financial regulators for lacking consistency in mechanisms to identify and respond to blockchain risks.

The post Fed, SEC need more consistent blockchain coordination, GAO says appeared first on FedScoop.

]]>
Coordination among two financial regulators to take on the risks posed by blockchain technology has lacked consistency, a congressional watchdog said Monday.

In a pair of priority open recommendations, the Government Accountability Office said the Federal Reserve and the Securities and Exchange Commission have succeeded in establishing coordination mechanisms with other federal regulators and financial working groups to identify the risks posed by blockchain-related products and services. But neither the Fed nor the SEC has “regularly” convened those bodies since the GAO delivered its recommendation in August 2023.

Lacking a cadence in convening these groups, the GAO said, means both agencies are unable “specifically to identify the full range of risks and regulatory challenges of existing and emerging blockchain products and services and provide a timely response to any unaddressed risks.”

The Fed, which neither agreed nor disagreed with the GAO’s recommendation, said it “routinely engages with the other federal financial regulators on emerging risks posed by blockchain-related products and services.” The banking regulator noted that it participates in information-sharing on identifying blockchain risks with other regulators in the Digital Asset Working Group, but the GAO is pushing for “planning processes for identifying and addressing such risks” within that group. 

“Fully implementing this priority recommendation would help the Federal Reserve and other financial regulators collectively identify risks posed by blockchain-related products and services and develop and implement a regulatory response in a timely manner,” the GAO stated.

The SEC, meanwhile, told the GAO that it works to identify crypto-related risks in the agency’s work with the Financial Stability Oversight Council, the President’s Working Group on Financial Markets and some international bodies. FSOC “established a coordination mechanism” through the Digital Asset Working Group, the SEC reported to the GAO, adding that the working group “meets regularly and has discussed a variety of topics, including regulatory developments, rulemakings, risks, data collection, and market developments.”

The GAO called the Digital Asset Working Group “a positive step,” but prodded the SEC to embrace planning documents.

“Such planning documents could include (1) objectives and meeting frequency; (2) processes for identifying the full range of risks and regulatory challenges concerning blockchain-related products and services (not only those related to financial stability); and (3) processes for responding to these risks and challenges within agreed-upon timeframes,” the GAO said.

Beyond blockchain, the GAO re-upped a second priority recommendation to the Federal Reserve, which was originally delivered in 2019. The watchdog wanted the Fed, along with other banking regulators and the Consumer Financial Protection Bureau, to finalize “written communication that gives banks specific direction on the appropriate use of alternative data in the underwriting process when partnering with fintech lenders.”

The Fed teamed with the Federal Deposit Insurance Corp. and the Office of the Comptroller of the Currency a year ago in issuing interagency guidance on third-party risk management, but the GAO said that the guidance falls short on specificity.

The guidance “does not include specific direction to banks that engage with fintech lenders on the appropriate use of alternative data in the underwriting process,” the GAO wrote. “Rather, the guidance broadly applies to all topics and third-party relationships. Accordingly, it does not address specific topics, such as the use of alternative data, or specific types of third-party relationships, such as relationships with fintech companies.”

The post Fed, SEC need more consistent blockchain coordination, GAO says appeared first on FedScoop.

]]>
78624
IRS makes Direct File permanent, with plans for expansion https://fedscoop.com/irs-direct-file-program-permanent-status-expansion/ Thu, 30 May 2024 18:54:56 +0000 https://fedscoop.com/?p=78597 The 2024 free electronic filing pilot program will continue indefinitely, “inviting all states” to participate next tax season.

The post IRS makes Direct File permanent, with plans for expansion appeared first on FedScoop.

]]>
The IRS’s Direct File program is here to stay and will be expanded for the 2025 tax season, the agency announced Thursday.

The decision to make Direct File a permanent program comes after a pilot this year that allowed taxpayers in 12 states to electronically file their federal returns directly with the agency at no cost.

IRS Commissioner Danny Werfel said in a statement that taxpayers this filing season delivered a “clear message” to the agency in wanting “one no-cost option for filing electronically.”

“Giving taxpayers additional options strengthens the tax filing system,” Werfel said. “And adding Direct File to the menu of filing options fits squarely into our effort to make taxes as easy as possible for Americans, including saving time and money.”

More than 140,000 taxpayers — in Arizona, California, Florida, Massachusetts, Nevada, New Hampshire, New York, South Dakota, Tennessee, Texas, Washington and Wyoming — used Direct File in 2024, according to the agency, receiving more than $90 million in refunds and reporting $35 million in balances due.

The IRS said in a Direct File 2024 post-mortem last month that there was “steadily increasing interest” in the program, though Werfel had to “consult a wide variety of stakeholders” before rendering a decision on its future. 

Now that Treasury Secretary Janet Yellen has accepted Werfel’s recommendation that Direct File continue indefinitely, the agency said it is “examining options to broaden” the system’s availability across the country, “including covering more tax situations and inviting all states to partner with Direct File next year.”

There will be “no limit” on the number of participating states in 2025, the IRS noted, and going forward, Direct File will expand “to support most common tax situations, with a particular focus on those situations that impact working families.”

Werfel said Direct File’s user experience, both within the product and in state-wide systems integrations, “will continue to be the foundation” for the program. 

“Accuracy and comprehensive tax credit uptake will be paramount concerns to ensure taxpayers file a correct return and get the refund they’re entitled to,” he said. “And our North Star will be improving the experience of tax filing itself and helping taxpayers meet their obligations as easily and quickly as possible.”

Though the agency touted positive user feedback in the weeks after the conclusion of the 2024 filing season, Direct File wasn’t without its critics. A Government Accountability Office report last month found that estimated start-up costs for the program were incomplete and “a comprehensive accounting” was needed if the pilot were to be continued and expanded. 

“A review by the Treasury Inspector General for Tax Administration found that IRS had no documentation to support the underlying data, analysis, or assumptions used for Direct File cost estimates. We found this as well,” the GAO wrote. “Without collecting the information needed during the 2024 pilot to inform a comprehensive assessment of the costs associated with Direct File and its benefits, IRS risks making longer-term decisions without full information.”

The highly lucrative tax preparation industry has also been exceedingly critical of Direct File, calling the program “a solution in search of a problem” given other no-cost filing options

Those companies have sought to draw a contrast between the 140,000-plus Direct File pilot users and the millions that use their services each year. Derrick Plummer, an Intuit spokesperson, said in a statement to FedScoop that the company’s TurboTax program “has filed millions of completely free tax returns annually and has provided more than 124 million free tax returns over the past decade.”

Shortly after the Direct File announcement, Werfel made another move Thursday to bolster its taxpayer experience, naming Fumi Tamaki its chief taxpayer experience officer. Previously an adviser in the IRS Transformation and Strategy Office focused on “enterprisewide taxpayer journey improvement initiatives,” per an IRS announcement, Tamaki will now set the agency’s vision for continuously improving the taxpayer experience as part of the IRS’s larger digital transformation.

“This is a critical time for IRS, and I am excited to continue working with IRS leaders and our external partners in this role,” Tamaki said in a statement. “The Taxpayer Experience Office team and IRS have made tremendous strides in improving the taxpayer experience. I am committed to build on this work to deliver the experience that taxpayers expect and deserve.”

Billy Mitchell contributed to this article.

This story was updated May 30, 2024 with comments from an Intuit spokesperson.

The post IRS makes Direct File permanent, with plans for expansion appeared first on FedScoop.

]]>
78597
Interior awards $2 billion cloud hosting contract to 7 vendors https://fedscoop.com/interior-department-cloud-services-contract-billions/ Thu, 30 May 2024 17:06:33 +0000 https://fedscoop.com/?p=78595 The Foundation Cloud Hosting Services II contract is a recompete of a $10 billion cloud contract awarded to 10 vendors in 2013.

The post Interior awards $2 billion cloud hosting contract to 7 vendors appeared first on FedScoop.

]]>
The Interior Department this week awarded spots on its latest cloud hosting services contract to seven vendors, estimated to be worth up to $2 billion total over 10 years.

The companies that landed awards under Interior’s Foundation Cloud Hosting Services II contract are Accenture Federal Services, IBM, CGI Federal, SAIC, Cognosante, Zivaro and Smartronix. Those seven vendors will compete for task orders under the greater indefinite-delivery, indefinite-quantity contract. 

The announcements of the seven awards detail Interior’s statement of work for the contract, requiring cloud license and support services for infrastructure, platform and software in a cloud environment. 

This contract comes as the initial iteration of the Foundation Cloud Hosting Services vehicle is set to expire later this year. Awarded in 2013 to 10 contractors, the initial contract has a $10 billion ceiling.

In the department’s initial statement of work, it wrote about the latest contract: “This follow-on FCHS contract is shifting to multiple service provider focus and integration among our solutions and a hybrid model hosting environment vision. Providing interoperability and data integrations between multiple technologies and services across the Department bureaus and offices.”

It also complements Interior’s $1 billion cloud contract award to Peraton last year for its Cloud Hosting Solutions III acquisition, which enlists the IT contractor to manage the department’s portfolio of cloud services.

The post Interior awards $2 billion cloud hosting contract to 7 vendors appeared first on FedScoop.

]]>
78595
EPA says it’s ‘on target’ to complete process for cybersecurity risk assessment https://fedscoop.com/epa-cybersecurity-risk-assessment-timeline-gao/ Thu, 30 May 2024 15:07:55 +0000 https://fedscoop.com/?p=78569 Five years after a GAO recommendation, the agency commits to finishing its work by Nov. 22.

The post EPA says it’s ‘on target’ to complete process for cybersecurity risk assessment appeared first on FedScoop.

]]>
The Environmental Protection Agency said it is “on target” to establish a process to conduct organization-wide cybersecurity risk assessments within the next six months, putting a hard timeline on its long-awaited response to a watchdog report critical of the agency’s cyber posture.

An agency spokesperson said in an email to FedScoop that the cyber risk assessment process — recommended to the EPA in a July 2019 Government Accountability Office report — is on track to be finished “by November 22.” The EPA had previously told the GAO that it was committed to a “late summer to early fall” timeline.

In its original recommendation, the GAO made the case for the administrator of the EPA to establish a process to conduct an agency-wide cybersecurity risk assessment as a means to protect against “a growing number of threats to their information technology systems and data” — a recommendation applicable to all federal agencies. Adopting a “risk-based approach to cybersecurity by effectively identifying, prioritizing, and managing cyber risks,” the GAO said at the time, would help the EPA “better manage” its cyber risks.

While the EPA has updated its cybersecurity risk management strategy, the agency told the GAO last month that it “was continuing to plan” for the assessment and was “in the process of updating an internal procedure to address ongoing risk assessment activities.” 

The EPA spokesperson told FedScoop that updates to the agency’s enterprise risk assessment procedure would include a variety of additional performance metrics, citing logging maturity, strong authentication, critical vulnerability remediation and priority security control specifically.

The agency’s updated procedure for assessing cyber risks will also feature a modified risk-scoring system, the spokesperson added. That portion of the assessment will now include “enterprise and component-level risk scores, which will be added to the senior executive dashboard.”

“The procedures also include activities to consolidate the various cybersecurity dashboards into one overall dashboard that provides an executive level view of EPA’s risk posture,” the spokesperson said. 

In the priority open recommendations document released by the GAO this week, the watchdog warned that absent an established process for overseeing a cyber risk assessment, the EPA “may be missing opportunities to identify trends in cybersecurity risks, target systemic risks to the agency and its systems, and prioritize investments in risk mitigation activities.”

The EPA has been active recently on the cybersecurity front, stepping up its warnings to the country’s water utilities of increasingly serious cyber threats. This month, the agency issued an alert about rising threats to the water sector and said it will boost its inspections and enforcement efforts. 

That alert came two months after an EPA and White House warning to U.S. governors about cyberattacks capable of “disabling” water facilities. The EPA said it would establish a task force focused specifically on defending the water sector from cyber threats.

The post EPA says it’s ‘on target’ to complete process for cybersecurity risk assessment appeared first on FedScoop.

]]>
78569
NIST would ‘have to consider’ workforce reductions if appropriations cut goes through https://fedscoop.com/nist-budget-cuts-ai-safety-institute/ Fri, 24 May 2024 21:15:01 +0000 https://fedscoop.com/?p=78501 Director Laurie Locascio said the agency is “fully on track” to meet its AI executive order requirements, but proposed cuts loom over its work.

The post NIST would ‘have to consider’ workforce reductions if appropriations cut goes through appeared first on FedScoop.

]]>
Recent reductions to the National Institute of Standards and Technology’s budget have forced the agency’s chief to do some “cutting to the bone,” though the workforce has so far been protected. That could change if another proposed cut goes through. 

During a House Science, Space and Technology Committee hearing Wednesday, ranking member Zoe Lofgren, D-Calif., asked NIST Director Laurie Locascio if a 6% cut, proposed by Republicans on the House Appropriations Committee, would result in staff reductions.

“We will have to look at that, for sure. Yes, we will have to consider that,” Locascio said. “It was said that we were lean and mighty, and we’re proud of that — we are lean and mighty and we’ve worked very hard to be the best bang for your buck. … But it really does cut into the bone when we have to get into these kind of deep cuts.”

In response to NIST’s fiscal year 2024 cuts, Locascio said the agency was forced to “stop hiring and filling gaps,” noting specific pauses in adding to its CORE standards program, building out new electric vehicle standards and pursuing new capacity for clinical and biological standards.

“It really put a big halt on the momentum moving forward in several critical areas,” she said.

Financial uncertainties notwithstanding, the agency has been able to push forward in its artificial intelligence work. In response to questioning from committee Chair Frank Lucas, R-Okla., about NIST’s progress on President Joe Biden’s AI executive order, Locascio said the agency is “on target to meet all” of the EO’s deadlines, pointing to recent publications on synthetic content, a draft plan for international AI standards and a vision paper for the AI Safety Institute.  

The AI Safety Institute, which last month added five members to its executive leadership team, drew plenty of interest from committee members during Wednesday’s hearing. Reps. Suzanne Bonamici, D-Ore., and Gabe Amo, D-R.I., both asked Locascio how the scope of the AI Safety Institute might be scaled back if funding for the group remains low.

NIST is currently spending $6 million on the institute, Locascio said, but it will be “very, very tough” to continue its work on developing guidelines, evaluating models and engaging in research absent additional funding.

“We are fully on track to meet the president’s executive order requirements and stand up the AI Safety Institute,” Locascio added. “But so much more is asked of us and we don’t want to let down the country and we definitely are working as hard as we can to do what we can with the money that we have. We can do more with more.”

Rep. Val Foushee, D-N.C., meanwhile, expressed concerns about the “ambiguities in the scope and direction” of the AI Safety Institute, as well as whether it would focus too much on the technology’s existential threats as opposed to the “concrete tangible harms confronting us right now.”

“The AI Safety Institute is going to be focused very clearly on safety science,” Locascio said, adding that the group will also be “working with the international community and then doing testing of large language models to carry out testing and evaluation to make sure that they’re safe for use. … I can also promise you that … everything that we do will be science based.”

The post NIST would ‘have to consider’ workforce reductions if appropriations cut goes through appeared first on FedScoop.

]]>
78501
IRS’s AI system to flag returns for audit may include unintended bias, report finds https://fedscoop.com/irs-ai-systems-bias-audits-racial-disparities-gao-report/ Thu, 23 May 2024 15:28:57 +0000 https://fedscoop.com/?p=78474 Following a report identifying racial disparities in audit selection, the GAO says the tax agency hasn’t conducted a “comprehensive review” of the rules and filters in its Dependent Database.

The post IRS’s AI system to flag returns for audit may include unintended bias, report finds appeared first on FedScoop.

]]>
The IRS’s primary tool for flagging tax returns for audit is a “first-wave” AI system that includes inputs from humans, according to a new watchdog report, opening the door for unintended bias at a time when the agency is attempting to combat racial disparities in auditing. 

The Government Accountability Office found no evidence that the tax agency has conducted a “comprehensive review of the rules and filters contained” in its Dependent Database, an automated program that identifies returns with possible noncompliance risk. The DDB is considered first-wave AI by the GAO due to it having “expert knowledge encoded into a computer system.” 

“While IRS regularly reviews the program, the review process does not comprehensively consider data inputs and assumptions that could inform IRS about the demographic equity of the audit selection process, creating the potential for unintended bias in audit selection,” the report stated. “For example, GAO found that some risk scores contained in the DDB program vary by sex, which could skew selection, and have not been updated since 2001.”

A 2023 Stanford University study found that Black taxpayers are roughly three-to-five times more likely to be audited than filers of other races. The IRS later confirmed the study’s findings, with Commissioner Danny Werfel writing in a letter to Congress that the agency would be “laser-focused” on addressing racial disparities in auditing.  

The GAO noted that the tax agency does not collect data about taxpayers’ race and ethnicity, meaning that predictions about a return’s risk for noncompliance with tax codes doesn’t take either factor into account. But according to the GAO, IRS research still shows “the existence of racial disparities in audits,” with “unintentional algorithmic biases” identified as a possible source.

“Specifically, that research noted (1) limitations in the data used to determine residency and relationship tests for [Earned Income Tax Credit] eligibility, and (2) outdated models as possible contributions to algorithmic bias and, consequently, racial disparities in audits,” the report states.

Once a return is flagged by the DDB program, it is then evaluated by the agency’s Systems Research and Application (SRA) model, which determines the filer’s risk score. Considered second-wave AI, the SRA is a data-mining and machine-learning model that the IRS uses to pinpoint audit patterns and predict outcomes. 

The GAO identified “some components” of the IRS Wage & Investment Division’s “automated audit selection process that could potentially skew selection toward returns with certain demographic characteristics that may not necessarily represent returns with the highest risk of noncompliance.” The SRA ranks risk scores from highest to lowest, and W&I starts with the highest until meeting “its predetermined audit workload,” the watchdog noted.

The GAO pushed the IRS to abide by its AI accountability framework, particularly with regard to “a variety of monitoring activities” that should be followed “to ensure AI systems function as intended.”  

“The agency may be missing opportunities to improve the likelihood that IRS is properly identifying returns at highest risk of noncompliance if it does not consider additional performance measures in reviewing its automated audit selection process,” the report said.

The GAO delivered six recommendations to the IRS regarding its audit selection processes, all of which were agreed to by the agency.

The post IRS’s AI system to flag returns for audit may include unintended bias, report finds appeared first on FedScoop.

]]>
78474