Okay, so like me, you take the obvious route of using a tax preparation software package, a la TurboTax to take care of your federal and state income tax returns. It’s silly not to: if you have all the data needed on-hand, and there’s nothing complex about your financial situation, you can either save a hundred bucks over going to an accountant, or save hours over filling out the forms yourself. It’s fast, easy, and the software tends to find deductions that you wouldn’t have thought of if you do the forms yourself.

So you have your tax software do its job, you submit the claim electronically, you print out your forms, and then you have the software save the tax files in case you ever need them. The tax software has done its job, and can then be removed from your computer. All that you need for your own records is the actual tax files the program created.

But there’s one major problem here, something that the tax software doesn’t even try to address: security. These files contain an awful lot of very important personal data. If they were to fall into the wrong hands, you can kiss your identity goodbye. Social security number, address, employer, salary, it’s all right there in one easy-to-handle package. Good for filing your taxes, bad for security.

So what do you do? Personally, I used GnuPG to deal with this mess. GPG isn’t exactly intuitive, nor user-friendly, though, so I’d also recommend adding in kgpg (or whatever it’s Gnome equivalent is) to help with creating/maintaining keys.

But I digress. GnuPG (gpg for short) is an open-source public/private key encryption application. It is the open-source equivalent of Pretty Good Privacy (PGP), and provides encryption that is at least as good as PGPs.

(Note: It is outside of the scope of this article to explain public/private keys.)

The basic idea is this: You create a personal private key that is only ever stored on your computer. This key is protected with a passphrase (think a password on steroids) that you generate. Any file that is encrypted using your public key can then only be decrypted using your private key + your passphrase. Assuming you are careful with your private key and passphrase, this should keep anyone but you from being able to access the file.

So I used kgpg’s Konqueror plugin to encrypt my tax files, then used kgpg to shred (securely delete) the original files (after verifying that I could decrypt the original files, of course). Instantly, the security on my tax files has gone way up. Since I don’t have my gpg passphrase stored anywhere on my computer, I am safe, even if someone steals my computer. (Unless they are either lucky enough to guess my passphrase, which is highly unlikely, or they are willing to dedicate some serious computing horsepower to hacking the passphrase.)

The general steps to follow are:

1. Install gpg
2. Install kgpg
3. If you don’t already have a public/private key pair, choose the Generate Key Pair option in kgpg. Be sure you choose a strong passphrase that you can remember. Single words are bad. Dictionary words are bad. A passphrase like “frankie” is going to be broken into. A better passphrase is “Frankie is 33 next week!” An even better passphrase is “Frankie l0vz Pf dS0tM!” How would you remember that? Say to yourself, “Frankie loves Pink Floyd’s Dark Side of the Moon!” It’s up to you to remember which letters are upper-case and which are replaced with numbers.
4. In Konqueror, right-click on the tax file (e.g. mytaxes.tax). Go to Actions, and you should see an option to Encrypt the file. Clicking this will fire up kgpg’s front-end. The defaults are fine, so you can choose OK.
5. kgpg’s window will close, and you’ll now have a new file, mytaxes.tax.asc (per our example). This is the actual encrypted file.
6. Copy this new file to an easy-to-find location.
7. Navigate to this directory, then try to open the file. You should be presented with kgpg’s window, requesting that you enter your passphrase (unless you are using gpg-agent, which stores your passphrase in memory). Either way, the file should decrypt.
8. Check the now-decrypted file (mytaxes.tax in our example) to make sure it still works.
9. Once you’ve verified everything works, right-click on the original file and choose the Shred option. Shred will ask if you are positive you want to do this. Assuming the above test worked, it is safe to say yes.
10. Make sure that you Shred all decrypted copies of the file. Shred copies random data multiple times over the part of the disk where the file was stored. On most filesystems, this ensures that the file cannot be recovered
11. Save and backup the encrypted file (mytaxes.tax.asc in our example).

Yes, this procedure is a bit involved. But it is more than worth the time it takes.