Best practices for sending tax data to and from a tax professional

Question

I started doing business with my tax preparers when we all lived in the same city. Recently I moved to a different state. I requested that they send my "Tax Organizer" which contains some personal data:

• Home address
• Date of birth
• Phone number
• Email address
• Bank name, but not account number
• Name of employer
• Some previous tax totals

I emailed them from the email address that I have on file with them, and gave them my name, address, and date of birth. Based on this, they emailed me a PDF file. The title of the file contained all but the last digit of my social security number. The file is password protected with my house number, which was included in my email to them.

I feel that I should have a discussion with my tax preparers about how they're handling my data, but I'm not sure what to tell them to do instead. What would a better way be for us to exchange data? Is there a way that doesn't involve me demanding they sign up for expensive new services?

Answer 1

In this case, using some form of encryption is the best. However, the problem with encryption when talking to non-technology professionals is usually two fold:

• Exchanging the password is often done insecurely, e.g. "send a password in a separate e-mail." Password exchange, if using password protection, should be done on the phone or offline. Also, as you've noted, often passwords are easy to guess.
• Difficulty to use: Often the user experience of using encryption tools (such as PGP) is so prohibitive, either for the person sending it or the recipient, that security measures are turned off or weakened in order to make it easier.

PDF encryption when using modern PDF software is actually pretty good and uses AES by default, at least in Adobe's implementation. However, if you use a weak password, then those benefits are largely undone.

However, there are some good solutions out there that are easy to use:

• E-mail encryption plugins: There are various easy-to-use software out there for securing e-mails. An example of this is Virtru.
• Self-hosted File sharing services like ownCloud: You can setup an instance of ownCloud to securely share files with a link and expiration dates can be set for files.
• Hosted file sharing services like box.com: You can share files encrypted with passwords and expiration dates.

I'd recommend suggesting these options to your tax preparation company, so they can avoid potentially costly and burdensome security incidents due to their current practices.

Answer 2

One way to solve this problem without breaking the bank and without too much complexity is to use a program like WinZip to encrypt your files. Current versions of WinZip support AES256 encryption, which is considered to be highly secure by industry experts (see http://kb.winzip.com/kb/entry/109 for more info).

This type of encryption (symmetric encryption) uses the same password to encrypt files and to decrypt files. Simply agree with your tax preparer by phone on a password to use (be sure to choose one that is sufficiently long and complex enough to prevent a brute-force attack), then ask your tax preparer to encrypt any file that they send to you using WinZip with this password. Then, use the same password to decrypt files that you receive from them.

Answer 3

I would say, as long as they only mail to a email adress that is on record with them (and this record of email adress have been securely instated by for example showing ID card and filling in a form physically at the tax office), theres a solution that the tax office can do, without doing anything complicated:

They can configure the system used to send these PDF files and sensitive data, to require STARTTLS support in the mail server on the receiver's end, and then fallback on for example encrypted PDF files with long passwords sent over SMS to a securely instated mobile number, if the target server does not support STARTTLS. This gives maximum compatibility, for example with clients that do not have any phone numbers with their tax office set up.

Most mailservers do support STARTTLS encryption, and if you require STARTTLS encryption, then the email will be encrypted over wire and thus no data will leak out.

Of course, this means some responsibility falls on the end user (who do receive the sensitive PDF) to configure his email client to use SSL for POP3/IMAP. But in most cases, its safe to run without encryption here, because as soon as the data has entered the mailserver, its inside the ISP's network provided the user uses his ISP mail, and thus it stays secure against any snooping.

Thus, the mail would be encrypted:

If the Client who are receiving the documents have not set up POP3S/IMAPS, it would go like this:

Tax Office Employee ===> Tax Office SMTP ========internet=========> Your ISP SMTP -----> Client

Where ----> is unencrypted, and ====> is encrypted.

And if POP3S/IMAPS is set up, it would get encrypted all the way.