It’s been over ten months since investigative outlet ProPublica began reporting on a trove of tax records that it never should have had access to in the first place. Since then, it has churned out report after report on the data, with the most recent coming just a few days ago. But for all taxpayers have heard, the Internal Revenue Service (IRS) is no closer to figuring out how this kind of massive leak happened in the first place, and how it will prevent it from happening in the future.
It’s worth responding to the actual analytical claims that ProPublica has made using this data, and I’ve done just that several times. In short, the documents don’t really reveal anything we didn’t already know about the tax code’s impact on the ultra wealthy. But at the end of the day, the IRS allowed a data breach in the form of hundreds of taxpayers’ private tax returns, and taxpayers filing their taxes this week deserve prompt certainty that the breach has been addressed and their tax filings are safe.
Just last week, the IRS had an opportunity to shed light on the status of investigations into the leak, when IRS Commissioner Chuck Rettig appeared before the Senate Finance Committee. But when asked, Rettig instead deflected, arguing that it was the purview of the Treasury Inspector General for Tax Administration (TIGTA).
Given that the leaked data is targeted at the wealthiest taxpayers and was leaked to a left-leaning investigative outlet, it can be fairly safely assumed that the leak was politically motivated. But even for those who feel their political objectives were furthered by the leak, counting on the benevolent intent of future data leaks is foolish.
Consider that when the IRS suffers data leaks, they are usually done to perpetrate identity fraud schemes. People were caught using IRS data to do this in 2016 and 2019, the latter of which was an erstwhile IRS employee. Given the IRS’s lax data security protocols, it’s entirely possible that more breaches have occurred without being caught.
What’s more, while the political motivation of the leak could suggest the leaker was a concerned IRS employee seeking to add to public knowledge, it could also point to a foreign actor seeking to foment unrest. Unfortunately, both possibilities are far more likely than they should be.
For the first possibility, ProPublica received confidential information from inside the agency as recently as a decade ago. TIGTA has repeatedly warned about poor internal tracking of unauthorized access to confidential information — in a 2020 report, TIGTA found that of the 67 applications for data that should have been monitored for unauthorized access that year, just six received complete and accurate audit trails.
As for the possibility of foreign interference, several government agencies suffered data breaches at the end of 2020 as part of the Russian-sponsored SolarWinds attack. TIGTA claims that there is no evidence the IRS suffered such a breach, but it is known that the Department of the Treasury did, and it’s possible that the IRS suffered a heretofore unknown breach. For its part, ProPublica says that it considered this possibility in deciding whether or not to publish reports on the data it received.
However, ProPublica’s description of its methodology may offer some new insight, if the IRS takes advantage of it. ProPublica notes that it accepted the IRS’s data except when it contained obvious keystroke errors, such as an extra digit in a line, that could be easily corrected.
Keystrokes get tracked by IRS IT personnel, and keystroke errors are eventually corrected, both of which are tracked. By comparing the date of the original keystroke error and the date of the fix for each of the keystroke errors in ProPublica’s data, the IRS could significantly narrow down the date range for when the data was leaked.
However the IRS or TIGTA get to the bottom of the leak, taxpayers of all political stripes should hope that they do so quickly. The IRS must know that it is entrusted with a great responsibility in the volume of private taxpayer information it handles. In cases where it fails to uphold that responsibility, quickly getting to the bottom of and closing leaks should be the agency’s first priority.
