The IRS's software issue

[Burzmali]

According the a recent TIGTA audit, the IRS is chock full of pirated software:
http://www.treasury.gov/tigta/auditrepo ... 0025fr.pdf

I suppose it's kind of sad, considering that the cost of getting into compliance with that software, and implementing the proper controls on top, is probably lower than the cost of implementing Open source solution in many cases.

Though I do wonder, if the BSA showed up at the IRS's doorstep and slapped down their Jack Webb, and then the IRS declined to be extorted, who would win the foot race to the court house?

[AndyK]

Been through that.

My systems development Section had 12 people, all of whom received their computers at different times AND had at least one hardware refresh each.

We (over the years) migrated from MSDOS (anyone remember that one?) to Windows, Windows XP, and (just before I left) Windows 7.

Over the course of those changes, we upgraded our user software MANY times. Every single package we used had either a purchased license or relied on an enterprise license. Unfortunately, there was no central repository for the license information.

Thus, I am not the least bit surprised that employees under the Chief Information Officer (du jour -- they were in and out like revolving doors) were "unable to produce" the specific licensing information for every one of the hundreds of thousands of desktops and laptops deployed throughout the IRS.

I'd bet dollars to donuts that TIGTA couldn't come up with the same information, either.

Oh, by the way, one also has to throw into the equation the (at least) biannual reorganizations within the CIO's office and the reduced funding which drew resources away from infrastructure support staff in favor of operational support staff.

It would be interesting to conduct a similar audit of any other non-IT business in the world. I sincerely doubt if any one of them would fare much better than did the IRS.

[Burnaby49]

Been through that.

My systems development Section had 12 people, all of whom received their computers at different times AND had at least one hardware refresh each.

We (over the years) migrated from MSDOS (anyone remember that one?) to Windows, Windows XP, and (just before I left) Windows 7.

Over the course of those changes, we upgraded our user software MANY times. Every single package we used had either a purchased license or relied on an enterprise license. Unfortunately, there was no central repository for the license information.

Thus, I am not the least bit surprised that employees under the Chief Information Officer (du jour -- they were in and out like revolving doors) were "unable to produce" the specific licensing information for every one of the hundreds of thousands of desktops and laptops deployed throughout the IRS.

I'd bet dollars to donuts that TIGTA couldn't come up with the same information, either.

Oh, by the way, one also has to throw into the equation the (at least) biannual reorganizations within the CIO's office and the reduced funding which drew resources away from infrastructure support staff in favor of operational support staff.

It would be interesting to conduct a similar audit of any other non-IT business in the world. I sincerely doubt if any one of them would fare much better than did the IRS.

Exactly the same in the Canada Revenue Agency. We had the same route of dos to windows to XP to whatever they have now with multiple upgrades of Word, Excel, and a mass of other programs. All entirely legit licensed copies but I doubt, government record keeping being what it is, that the CRA could prove it in a court.

[notorial dissent]

Actually, it shouldn't make any difference. If the copies were not pirated, then they were most likely bought from a vendor, license and all, and when they were activated that license was recorded by the manufacturer, and if you call said manufacturer and give them the SN of the software, they will be able to give you its life history, and tell yo how many you are allowed to have on a given license, and thus you will know whether it is properly registered or not. In an institutional setting like yours, I am doubting that you will have more than a few machines out of compliance, only because you may have activated more than your license allowed, due to miscounting.

[Burzmali]

It would be interesting to conduct a similar audit of any other non-IT business in the world. I sincerely doubt if any one of them would fare much better than did the IRS.

In the non-governmental world companies actually face consequences for failing to track licensing. The BSA will have you shutdown if you won't pay their exorbitant true-up fees or present an ironclad defense. I've lost more than a few servers to internal true-ups due to sloppy record-keeping by my co-workers, so I can assure you that many businesses pay attention to this. Companies like Microsoft won't even sell you enterprise licenses if you can't show that you have sufficient controls in place...

Actually, it shouldn't make any difference. If the copies were not pirated, then they were most likely bought from a vendor, license and all, and when they were activated that license was recorded by the manufacturer, and if you call said manufacturer and give them the SN of the software, they will be able to give you its life history, and tell yo how many you are allowed to have on a given license, and thus you will know whether it is properly registered or not. In an institutional setting like yours, I am doubting that you will have more than a few machines out of compliance, only because you may have activated more than your license allowed, due to miscounting.

The problem tends to be with software that is part of standard installs on machines. You get 10,000 licenses, and, over time, move far more machines to the new standard image. Also, this tends to happen with server software as well, system running slow? Just spin up another VM and add it to the cluster.

[notorial dissent]

The software is still registered, particularly if it is Microsoft, and they should still have the license information. I can understand a business buying 1 and 2 machines from a vendor overtime, but something like the gov't buys them in job lots, and the licensing information should go with them.

[Burzmali]

The software is still registered, particularly if it is Microsoft, and they should still have the license information. I can understand a business buying 1 and 2 machines from a vendor overtime, but something like the gov't buys them in job lots, and the licensing information should go with them.

Depends on the software, for your OS licenses, in a organization as big as the IRS, you are buying blank laptops from IBM or someone and imprinting them with a standard image that uses the organization's enterprise license keys. It's your organization's responsibility to ensure that you aren't exceeding your volume licensing agreement, Microsoft doesn't track that for you, though if they see too many activations (i.e. 10,000 new activations in a year on a 5,000 user volume license) it might trigger an audit.

[AndyK]

Ignoring the fact that very few software vendors require registration of licenses with them to activate the software:

Consider a business IT configuration composed of many servers in each of many cities based on the need to provide reasonable response time to the users of each of the servers AND the legally-mandated requirement to segregate information between organizations (i.e: IRS in general, Chief Counsel, Criminal Tax, TIGTA)

Throw into the above mix the fact that each of these organizations in each of these cities is using the same software -- MS Office, for example) -- under some sort of legitimate license.

Also, consider that all of these players are using MS Office, Office 07, and/or Office 10 (in some cases multiple versions to maintain backwards compatibility)

How in hell could anyone expect an understaffed, underfunded office, even with the assistance of cutting-edge software, to keep track of who has what, what just happens to be sitting somewhare because it wasn't deleted as part of an upgrade, or what was acquired via a separate procurement OR was a freebie someone won at an IT conference?

The TIGTA report, although factual, is totally off the mark. However, someone was tasked with an audit which they completed. Remember: Audit results are never published nless they have negative findings -- even if those findings have to be manufactured.