IRS Failed To Properly Dispose of Sensitive Tax Documents, Report Finds
Some IRS offices routinely threw away sensitive material with regular trash, while others used unlocked or damaged storage bins.
Earlier this year, a federal judge sentenced a former IRS contractor to five years in prison for leaking the tax returns of multiple high-profile billionaires. The case involves genuine wrongdoing by someone entrusted with people's private information. But a new report from the U.S. Treasury Department found the IRS itself was routinely negligent with taxpayer documents in its possession.
"The IRS receives and creates a significant volume of sensitive documents and is responsible for protecting these sensitive documents from receipt to disposal," according to a report from the U.S. Treasury Inspector General for Tax Administration (TIGTA). Specifically, federal agencies must "shred, burn, mulch, pulp, or pulverize sensitive documents beyond recognition and reconstruction."
The TIGTA report notes that since 2009, the IRS has contracted with an unnamed "outside national vendor" to do this. The vendor provides IRS facilities with locked bins to store sensitive documents, which are later picked up to dispose of the documents securely.
This vendor services "387 (75 percent) of 514 IRS facilities," the report notes, while another 17 facilities contract with local companies. But for the rest, it's apparently a free-for-all: "We found that the IRS is unaware of what sensitive document destruction capabilities are in place for the 110 facilities not covered under a contract. For example, the IRS initially thought the Andover, Massachusetts, facility was covered by a local sensitive document destruction contract. After we inquired about the contract, the IRS discovered that this facility was not covered by any contract."
When the auditors then performed a site visit at that facility, they found "trash containers being used for all waste, including sensitive documents that contained tax information and Personally Identifiable Information."
The auditors also conducted seven other site visits, during which they found that "some bins were unlocked, altered, and/or damaged," including in such a way that inspectors "were able to reach their hands through the bin disposal slot and easily retrieve discarded sensitive documents."
At one facility in Ogden, Utah, inspectors even found an open trash can labeled "Classified Trash Only." According to the report, "IRS management instructed employees at this facility to store sensitive documents in these open containers, so employees did not have to leave their desks to throw the sensitive waste in the secured sensitive document destruction bins."
"The IRS has yet to establish or communicate to personnel at its various facilities the standard operating procedures for sensitive document destruction," the report notes—despite the fact that the agency had previously acknowledged the need to develop standard procedures after a 2009 TIGTA report.
The report "is the latest evidence the agency does not care about taxpayer privacy despite an enormous infusion of taxpayer funds," according to Americans for Tax Reform. "The IRS is failing taxpayers in this area."
It's unlikely that anyone will face serious consequences for these lapses—the report makes no mention of anyone being fired. But it's worth noting that for anybody else who misuses taxpayer information, the consequences are severe.
In 2020, The New York Times published stories drawn from then-President Donald Trump's tax returns, which the authors said "reveal the hollowness, but also the wizardry, behind the self-made-billionaire image." The following year, ProPublica reported details from the tax returns of uberwealthy tech CEOs Elon Musk, Jeff Bezos, and Mark Zuckerberg.
According to a 2023 indictment filed by the Department of Justice (DOJ) in the U.S. District Court for the District of Columbia, IRS contractor Charles Littlejohn was the source of the information. "From in or about 2018 until in or about 2020," prosecutors state, Littlejohn "stole tax returns and return information associated with…thousands of the nation's wealthiest people, including returns and return information dating back more than 15 years." Since then, the IRS has twice sent out notices to taxpayers whose information Littlejohn may have stolen.
The indictment charged Littlejohn with unauthorized disclosure of tax returns and return information—a felony punishable by up to five years in prison and a fine of up to $5,000—and he pleaded guilty in October 2023. According to his plea agreement, federal guidelines recommend a prison sentence between eight months and 14 months. Prosecutors recommended the maximum of five years, citing "the need for general deterrence" and that "the scope and scale of Defendant's unlawful disclosures appear to be unparalleled in the IRS's history."
Littlejohn's attorneys countered that he "committed this offense not for personal gain, not out of personal malice, but out of a belief that his violation of law would serve the public interest….The defendant was wrong to violate the law even if he believed it would serve the public interest. It is also wrong for the Government to request six times the Guidelines maximum on the facts of this case."
District Judge Ana Reyes sided with the government, sentencing Littlejohn to five years in prison, three years of supervised release, and a $5,000 fine. At the sentencing hearing, she seemed incredulous that prosecutors only charged Littlejohn with a single felony count.
"Someone can steal thousands and thousands and thousands of taxpayers' information, and the only count that the government could possibly bring is a disclosure count?" Reyes asked. "Because I'm confident that that's not the case."
In a letter to Acting Assistant Attorney General Nicole Argentieri, U.S. Rep. Jim Jordan (R–Ohio), chairman of the House Judiciary Committee, indicated he would be "opening an inquiry into the DOJ's unusual and questionable leniency" toward Littlejohn. "The DOJ's decision to pursue just one charge for thousands of separate criminal acts is highly concerning, and the Committee worries that the DOJ's decision may be politically motivated."
It's not clear from Jordan's letter what he would have preferred. Perhaps justice was not served by lumping together the thousands of returns Littlejohn stole under a single charge, but it would not be the best practice to charge him with thousands of felonies, either. Nonetheless, prosecutors threw the book at Littlejohn, even though he only released a handful of returns that he felt were newsworthy to journalists.
This is not to defend his actions: It should surprise no one that Donald Trump's image is built on smoke and mirrors or that billionaires like Bezos, Musk, and Zuckerberg make every possible effort to lower their tax burdens, and it certainly does not justify the massive invasion of privacy that Littlejohn undertook.
But it's worth considering that as prosecutors, a judge, and lawmakers competed to ramp up Littlejohn's punishment, the fact that numerous IRS offices were simply mishandling taxpayer data as a matter of course was treated like business as usual.
