Article: On the
Internal Revenue Service | An official website of the United States government website, the "log in" button was not in the top right on the navbar like it is on most websites. It was weirdly placed in the middle of the page below the fold.
An IRS engineer explained that the *soonest* this change could get deployed is July 21st... 103 days from now.
This engineer worked with the DOGE team to delete the red tape and accomplished the task in 71 minutes. See before/after pictures below.
There are great people at the IRS, who are simply being strangled by bureaucracy. Source:
https://x.com/doge/status/1910067646827057152
So ironically this is one I can actually speak to as, while not involved with the IRS, I do know what's going on to add time and, frankly, there's good reason for it, though not 103 days reason for it.
The Federal government requires that all changes to computer systems, including websites, go through a Change Management Process that has MANDATORY security review steps. This is to validate and ensure that everyone involved in making the change knows what the change entails AND how that impacts the security of the system in question.
Part of that process REQUIRES an independent third party analysis and verification of the change and that group will draft a document known as a Security Impact Assessment and determine if the change made is "Significant" (potentially impacting the security status of the system in question) or "Non-Significant" (not impacting the security status). This assessment than has to be agreed to by multiple stakeholders in the system and signed by the System Owner, that is, the government representative whom takes responsibility for the system (IE, the buck stops with them).
Now, for a change like this, ideally the security review process would not take long, it would be classified as a "Non-Significant" change and thus quickly get processed through the system. It would take longer than 71 minutes, yes, perhaps even days. But 103 days, over three months, means that the IRS' security assessment process is fundamentally broken and they need to improve their handling of change management.
And yes, that independent security assessment step IS, unfortunately, required. Both the contractors hired and the government employees have self interest in skipping it and ignoring security concerns about changes. Government focuses on availability and uptime, while contractors only care about what they're hired for, which is usually ALSO availability and uptime. They will CONSISTENTLY cut corners or falsify documentation to claim changes that WOULD impact the security status of a system would not, because it's faster, means less paperwork, and the person who ends up holding the bucket if things go wrong is that System Owner, not the people who made the changes. Basically everyone EXCEPT the independent security assessment team have conflicts of interest that potentially compromise their analysis, meanwhile the independent assessors are paid to ONLY care about that.