Staff Reports
The Treasury Inspector General for Tax Administration (TIGTA) just dropped a report that should make every taxpayer uneasy. The audit found the IRS couldn’t reliably detect employees using search commands to browse the tax records of government officials, business leaders, and celebrities. In plain language: the agency charged with protecting your financial privacy has gaping holes, slow notifications, and mixed punishment for snooping staff.
What the TIGTA audit found
TIGTA reviewed millions of IDRS searches and flagged 86 suspicious accesses of 30 high‑profile taxpayer accounts, referring those incidents to investigators. The report shows the problem isn’t a few bad apples — it’s a system design problem. Certain “NAMES” search commands can be run in ways that bypass the IRS’s monitoring tools, meaning curious or malicious employees could look up famous taxpayers without tripping alarms. TIGTA bluntly concluded the IRS’s unauthorized access program is not adequately addressing the risk to taxpayer privacy.
How the IRS dropped the ball on discipline and notification
The audit found uneven discipline: in a sample of closed cases, supervisors fired 31 employees but kept 22, often citing length of service or a first offense. That weakens deterrence. Equally bad, hundreds of affected taxpayers went without timely notification — some waited years. If the IRS expects Americans to hand over our most private financial details, we should be able to expect prompt warning when someone inside the agency pokes around for the wrong reasons.
The technical hole and the Littlejohn warning
The report highlights a technical shortcut in the IRS’s legacy IDRS system that allows name-based lookups to skirt detection. That should sound familiar: a prior contractor, Charles Littlejohn, exploited access and leaked returns, including those tied to President Donald Trump. That criminal case proved the harm when controls fail. Yet TIGTA’s review shows the agency still hasn’t fully fixed the avenues that make that kind of theft and disclosure possible.
Fixes, accountability, and what Congress should do next
TIGTA made clear recommendations: tighten controls on NAMES usage, require executive oversight of the unauthorized access program, standardize penalties, and ensure timely victim notices. The IRS agreed or partially agreed with most fixes — which is better than nothing, but promises after a report don’t restore trust. Congress should demand faster, verifiable changes, tougher criminal penalties for willful disclosure, and real audits to prove the IRS can actually protect taxpayer privacy. The goal is simple: if the government wants your financial records, it must first prove it can keep them safe and hold its people to a zero‑tolerance standard for snooping.
