Treasury Watchdog Warns That the IRS Direct File Program Is Vulnerable to Hackers

Residents of 12 states participating in the IRS's Direct File pilot program should know that doing so could put their most confidential financial records at risk of being stolen by hackers, according a government watchdog.

Selected residents of Washington, New Hampshire, New York, Massachusetts, Texas, Florida, Tennessee, Wyoming, South Dakota, Nevada, California, and Arizona can volunteer to participate in the program under which IRS agents would receive their tax data and prepare their annual returns for them.

Doing so could, however, expose taxpayers to some ugly and potentially catastrophically costly consequences from IRS incompetence or ineptitude exposed by the report released September 25 by the Department of Treasury's Inspector-General for Tax Administration (TIGTA).

According to the report: 

"The Direct File Pilot team issued Memorandums of Understanding (MOUs) to participating states without relevant security or technical details for managing the exchange of taxpayer data," TIGTA said.

The Direct File Pilot team initially developed high-level requirements in their test plan and test schedule; however, the repositories used for source code and issue tracking lacked traceability and reporting capabilities.

None of the tests in the issue tracker were able to be traced back to the test plan.  In addition, the Direct File Pilot contained sufficient documentation on bug, also called defect, remediation for only 12 (46 percent) of the 26 testing issues reviewed.

In other words, let the IRS have all of your most sensitive financial and other data, including bank records, Social Security numbers, and health data, and you run a genuine risk of that information being stolen. Here's how the TIGTA report put it:

If the Direct File Pilot is not properly developed, tested, and secured, the IRS risks delays to taxpayers and submission errors. In addition, taxpayer data could be vulnerable to loss or theft. (emphasis added) 

Officials within the IRS in responding to the TIGTA findings were described by auditors as having "taken steps to mitigate potential unauthorized disclosure of taxpayer data." Readers may be forgiven for not being reassured by those claims, considering the federal government's recent record on digital security. It wasn't that long ago that both the IRS (2015) and Office of Personnel Management (OPM) (2014) suffered serious hacks.

The TIGTA report issued September 25 is the latest revelation concerning a program the federal tax agency has used and abused since first proposing it. The program was authorized by Congress under President Joe Biden's Inflation Reduction Act of 2022 as a pilot project to test the feasibility of citizens allowing IRS officials to prepare their tax returns.

But Sen. Mike Crapo (R-Idaho) claims the IRS has pushed beyond the pilot project authorization it received from Congress to prepare to make the program a standard feature of the tax agency's daily operations. In effect, the IRS would become a giant competitor to the thousands of privately owned tax preparation businesses like H&R Block.

"The Direct File program is a permanent government detour into the tax preparation business, is not authorized by statute, and wastes taxpayer funding that could be put to better use,” the Idaho Republican recently told The Epoch Times.

And today, September 26, Sen. Crapo tells PJ Media that the TIGTA report is more evidence that the Direct File program should be shuttered:

This report once again confirms the IRS’s failure to safeguard confidential taxpayer information, this time with the unauthorized and unnecessary taxpayer experiment known as the Direct File "pilot."

Despite receiving over $60 billion in additional funding from the so-called Inflation Reduction Act and a history of leaking confidential information affecting thousands of taxpayers, the IRS still cannot adhere to basic security protocols. The IRS should end Direct File and stop diverting resources and attention to a redundant, expensive and troubled new government-run program.

Interesting, isn't it, that advocates of more Big Government insist that the feds stay out of our bedrooms, but they have no qualms at all about those same officials digging into our checkbooks and bank accounts.