GOP Senators Probe IRS on ProPublica Coverage, Technology

December 1, 2021

The Honorable Charles P. Rettig
Commissioner
Internal Revenue Service
1111 Constitution Avenue, NW
Washington, DC 20224

Dear Commissioner Rettig:

We are writing regarding the series of articles published by the website ProPublica that appear to be based on confidential taxpayer information that potentially was leaked or hacked from the Internal Revenue Service (IRS). On June 8, 2021, ProPublica published, “The Secret IRS Files: Trove of Never-Before-Seen Records Reveal How the Wealthiest Avoid Income Tax.”¹ This was the first in a series of articles that ProPublica continues to publish with no indication that any progress has been made by any federal agency regarding identification of the source or sources of the taxpayer information. Despite clear and ongoing evidence of a threat of a data breach, in response to a letter sent to you by Senators Grassley and Crapo, you responded in part that “We do not yet know whether there has been a data breach or a threat of a data breach.” Your letter of September 13, 2021, also notes that “We do not yet have any information concerning the source of the alleged taxpayer information published by ProPublica.”

These responses are very troubling, particularly because ProPublica continues to publish what appears to be confidential taxpayer information that is protected by law, and as Commissioner, you have been a proponent of the IRS being allowed access to even more information from taxpayers and a significant and mandatory enforcement budget.² The fact that the source of the information ProPublica continues to publish remains unknown means that the ability of the IRS to safeguard information already entrusted to it also remains unknown. It is possible that ProPublica obtained whatever information it has at one time from a specific source. However, if the ProPublica information was leaked or hacked from the IRS, and the IRS is unable to even determine if a leak or hack took place, this could indicate an ongoing and persistent problem with IRS information technology (IT) systems and the ability of the IRS to safeguard taxpayer information.

IRS Systems Are Notoriously Ineffective

Even before ProPublica began publishing articles utilizing taxpayer information, significant issues with IRS IT systems were well documented. In fact, the struggles of the IRS to modernize IT systems is something of an old chestnut in tax policy circles. Aside from a reliance on COBOL which is referred to as “geriatric code,” it is also reported that the “IRS main software "Master File" was developed in 1962 and uses nine-track tape for data storage. None of the IRS programs have ever been that well coordinated.”³ In written testimony delivered before the Subcommittee on Government Operations of the House Committee on Oversight and Reform on October 7, 2020, the Government Accountability Office (GAO) Director of Information Technology and Cybersecurity stated the following:

In May 2020, GAO reported that new and continuing deficiencies in information system security controls over financial and tax processing systems included deficiencies related to access controls, segregation of duties, and other areas. These collectively represented a significant deficiency in risks of unauthorized access to, modification of, or disclosure of financial reporting and taxpayer data and disruption of critical operations.⁴

In a recent audit, GAO also “identified new information system control deficiencies related to access controls and security management that contributed to IRS's continuing significant deficiency in its internal control over financial reporting systems.”⁵ When this report was published in May 2021, there were a total of 120 open recommendations to the IRS with 96 of those recommendations falling within the audit area of information systems.⁶ Among the open recommendations, GAO “identified one deficiency in access controls related to cryptography (i.e., encryption).”⁷ Specifically, “IRS did not enforce cryptographic protocols used for authentication and data integrity in a system environment that processes taxpayer data in accordance with agency policy and National Institute of Standards and Technology guidance.”⁸

GAO is not the only oversight entity that has recently identified IRS deficiencies with encryption of taxpayer data. On September 27, 2021, the Treasury Inspector General for Tax Administration (TIGTA) issued a report titled, “The Data at Rest Encryption Program Has Made Progress With Identifying Encryption Solutions, but Project Management Needs Improvement.”⁹ The report notes that “[t]he IRS has made progress to identify and test encryption and key management solutions for use with certain types of systems. However, it has not deployed this technology.”¹⁰ The protection of the vast amounts of taxpayer information collected and maintained by the IRS is critical to maintaining a basic level of confidence in the fair application and enforcement of our nation's tax laws. We believe many taxpayers would be shocked that the IRS has not already implemented a functioning system for protecting the information stored on its systems. According to the IRS, more than 167 million individual income tax returns had been filed by the week ending October 22, 2021, for the 2021 filing season.¹¹

More recently, in a September 28, 2021 report on IRS information security modernization, TIGTA reported on ineffectiveness of risk management. TIGTA concluded that:

Until the IRS takes steps to improve its security program deficiencies and fully implement all security program components in compliance with FISMA [Federal Information Security Modernization Act] requirements, taxpayer data could be vulnerable to inappropriate and undetected use, modification, or disclosure.”¹²

IRS Contractor Relationships Introduce Additional Security Vulnerabilities

The IRS's relationships with contractors represent an additional vulnerability to the security of IRS systems. Private contractors serve a vital role in helping the IRS efficiently perform its duties, which makes it vitally important adequate security measures are in place.

For example, TIGTA has previously recommended that the IRS implement end-to-end encryption in transferring taxpayer data to Private Collection Agencies (PCAs).¹³ The IRS utilizes PCAs as part of a very successful program to pursue and collect tax debt that the IRS has elected not to pursue. It is important that any taxpayer information that is transferred as part of this program is fully protected against unauthorized access and disclosure. The September 27, 2021 TIGTA report notes that “the IRS verified the taxpayer information was being encrypted through e-mail verification with the PCAs.”¹⁴ However, the IRS dropped the ball on its end. According to TIGTA, “PCA information residing at the IRS had not been encrypted in the production environment.”¹⁵

Moreover, the TIGTA report raises questions about any other contractors the IRS has allowed to access taxpayer information. For example, a 2018 article published by Bloomberg Tax describes how “[a] contract with . . . Palantir Technologies will give the IRS new firepower to pursue tax cheats by connecting the dots in millions of tax filings, bank transactions, phone records, and even social media posts.”¹⁶ In reporting on an earlier contract with Palantir, the story notes that in 2013 the IRS “spent $30.8 million on a five-year contract with 13 Federal LLC, a Palantir subsidiary, and granted it access to files for more than 1 million people, according to a privacy audit report.”¹⁷ No doubt these contractors do important work that facilitates the fair and effective working of our federal tax system. However, this is a massive amount of taxpayer information. And it is critical that the IRS ensure contractors are complying with their obligation to safeguard it. These requirements are documented in IRS Publication 4812, Contractor Security & Privacy Controls. In part, this publication requires that

Contractors and subcontractors shall have adequate programs in place to protect the information received from unauthorized use, access, and disclosure. The contractor's programs for protecting information received must include documented notification to employees and subcontractors (at any tier) regarding, the importance of protecting returns and return information.¹⁸

IRS is Expanding Private Data Acquisitions and Requesting Unprecedented Funding

In a contract that may have been finalized by Treasury and the IRS with Babel Street, Inc., the IRS seeks “a third-party digital media search and reporting solution that captures information from public facing digital media records that can be used in taxpayer compliance and tax administration cases.”¹⁹ Such data apparently will be obtained for the IRS by artificial intelligence (AI)-enabled software that scrubs the internet for information on taxpayers, including current and historical publicly posted communications, images, videos, and cached pages of those taxpayers. The “solution,” according to a solicitation/contract order by Treasury to Babel Street, Inc. is supposed to provide: “Secure access to publicly available information without posing a security and public policy perception risk.”

Gathering troves of taxpayer information from anywhere it can possibly be found by AI algorithmic robots should be counted as a public policy perception risk in and of itself. Having the IRS gather such information to combine with troves of personal taxpayer information already possessed by the IRS amplifies our concerns about data security in IRS systems.

The IRS appears to be expanding its collection of information on taxpayers to house it in systems with known security deficiencies and shortfalls. Meanwhile, the IRS and Treasury are advocating for an unprecedented, nearly $80 billion, amount of mandatory funding from general taxpayer resources. In the funding scheme being advocated, the IRS is to be provided with a mandatory stream of $80 billion, after which the IRS would report to Congress on how it plans to use the funds — that is; fund now, plan later. Such a scheme, in the face of ongoing alleged privacy leaks of what appear to be IRS information, the source(s) of which no federal agency appears to have any knowledge, and in the face of known serious deficiencies in IRS data protections, defines irresponsibility.

As we enter month six with no information about how ProPublica obtained protected taxpayer information, the risks we highlighted in this letter are of growing concern. It is our constitutional obligation to ensure that IRS enforcement remains effective, and that requires the IRS to properly secure taxpayer information. Accordingly, we request responses to the following questions by December 15, 2021.

Thank you for your attention to these important matters.

Sincerely,

Mike Crapo
U.S. Senator

Charles E. Grassley
U.S. Senator

John Cornyn
U.S. Senator

John Thune
U.S. Senator

Richard Burr
U.S. Senator

Rob Portman
U.S. Senator

Pat Toomey
U.S. Senator

Tim Scott
U.S. Senator

Bill Cassidy, M.D.
U.S. Senator

James Lankford
U.S. Senator

Steve Daines
U.S. Senator

Todd Young
U.S. Senator

Ben Sasse
U.S. Senator

John Barrasso, M.D.
U.S. Senator