The IRS’s effort to convert paper tax documents into digital records is supposed to make tax administration faster and less dependent on manual processing. But a new watchdog memo raises serious questions about whether the private contractors entrusted with that work are adequately protecting taxpayer information.

In an alert focused on the IRS’s Zero Paper Initiative (ZPI), the Treasury Inspector General for Tax Administration (TIGTA) identified several issues, including physical security failures, unresolved computer vulnerabilities, and weak system configuration controls at two contractor facilities.

The findings raise concerns about taxpayer privacy and the IRS’s use of private contractors who were permitted to handle some of the federal government’s most sensitive records without consistently meeting IRS security requirements.

That would be concerning under any circumstances. It is particularly so after the massive disclosure of taxpayer information by Charles Edward Littlejohn, a former IRS contractor employed by Booz Allen Hamilton. The leak returned to the news after a federal judge recently nixed the Trump administration’s proposed settlement of the president’s lawsuit over Littlejohn’s disclosure of his tax information.

What Did Littlejohn Do?

Littlejohn worked as an IRS contractor between 2018 and 2020. According to prosecutors, he evaded controls designed to detect or prevent large downloads and transferred private tax information to his personal storage devices. He then disclosed tax information related to Donald Trump and other individuals and entities to The New York Times and later provided ProPublica with tax information for thousands of wealthy taxpayers, including Elon Musk, Jeff Bezos, Warren Buffett, and Michael Bloomberg.

Those impacted weren’t just billionaires. Tax information involving businesses, partnerships, and other passthrough entities swept additional taxpayers into the breach through Schedules K-1, ownership records, and related documents. The IRS ultimately determined that approximately 406,000 taxpayers were affected.

Littlejohn pleaded guilty in October 2023 to unauthorized disclosure of tax returns and return information. In January 2024, he received the statutory maximum sentence of five years in federal prison.

Was There Any Meaningful Change?

Following the disclosure, the IRS apologized to affected taxpayers and said it would take steps to strengthen its safeguards against unauthorized access and disclosure. But during site visits in 2025, TIGTA found significant problems with contractor security and IRS oversight.

At the two ZPI facilities reviewed by TIGTA, 14 employees entered areas where taxpayer documents were scanned, digitized, or stored without authorization from the IRS. The entries occurred between May and August 2025 at one location and between October and December 2025 at the other.

The memo does not say that those employees accessed documents for an improper purpose or copied, photographed, removed, or disclosed taxpayer information. Rather, TIGTA said the 14 employees collectively entered restricted areas on 1,375 occasions over several months. The memo does not explain how those entries were distributed among the employees or whether they reflected........

© Forbes