A Treasury inspector general audit found that IRS employees could look up public figures by name without triggering any alarm, that 22 workers caught browsing taxpayer records kept their jobs, and that 276 victims were never told. The rules that shaped those discipline decisions changed this month.
Between 2022 and 2025, 52 Internal Revenue Service employees made 86 suspicious searches of the tax accounts of 30 prominent Americans — government officials, business leaders and entertainers — and the IRS’s own monitoring did not flag a single one. That finding comes not from a leak or an anonymous source but from a final audit report issued September 29, 2026 by the Treasury Inspector General for Tax Administration (TIGTA), Report No. 2026-300-058.
The report’s headline conclusion is blunt: the IRS’s program for preventing unauthorized access to taxpayer records “is not adequately addressing the risk of unauthorized access to taxpayers’ accounts.” The details matter more than the conclusion, because they show where the system fails — at detection, at discipline and at telling victims what happened.
Coverage of the report has been thin and has centered on the celebrity angle. The more consequential findings concern a search tool the IRS does not treat as sensitive, a disciplinary guide that IRS officials described to auditors as optional, and a notification law that lets the victims of a confirmed violation go uninformed if the employee resigns first.
What the auditors were testing
Congress addressed employee “browsing” of tax files nearly three decades ago. The Taxpayer Browsing Protection Act of 1997 made it unlawful for IRS employees to access or inspect taxpayer records without a legitimate tax administration purpose. According to the TIGTA report, willful unauthorized access is punishable by a fine of up to $1,000 and up to one year in prison; unauthorized disclosure carries up to $5,000 and five years. Either can cost a federal employee his job, and the statute gives victims a right to sue for civil damages.
The IRS implements that law through what it calls the UNAX program (unauthorized access, attempted access, or inspection of taxpayer records). The report notes that, in congressional testimony leading up to the 1997 law, the IRS Deputy Commissioner “pledged a zero-tolerance policy for substantiated UNAX violations.” The agency’s own glossary, reproduced in the report, defines zero tolerance this way: substantiated unauthorized access, “absent mitigating circumstances, will result in their removal from the IRS.”
The stakes are not abstract. The report recounts the case of Charles Littlejohn, an IRS contractor who accessed more than 400,000 taxpayer accounts, disclosed tax return information to media outlets, pleaded guilty and was sentenced to five years in prison. RSN examined the litigation that grew out of that leak in its analysis of the Trump–IRS sanctions ruling. TIGTA’s audit asks a narrower question: whether the everyday controls that are supposed to stop employees from looking where they should not are working.
Finding one: a name search the IRS does not watch
Most queries in the IRS’s Integrated Data Retrieval System require the user to enter a taxpayer identification number, such as a Social Security number. A handful of research commands — which the report groups as “NAMES” — instead let an employee type in the first ten characters of a taxpayer’s last name and retrieve the identification number and address.
According to TIGTA, use of these commands “bypasses the current IRS monitoring methods used for identifying UNAX accesses.” The commands are not classified as sensitive, and the auditors “determined that there are no systemic preventative or monitoring controls” on them. The IRS’s existing automated alerts are built mainly around “covered relationships” — an employee looking up a spouse, ex-spouse, relative, neighbor or co-worker. The report states that the IRS “does not have a mechanism to prevent or systemically detect browsing of celebrities” and does not maintain a comprehensive list of public officials or celebrities to protect.
To test the gap, auditors reviewed almost 6 million NAMES searches logged from 2022 through November 2025. Using what the report describes as “a limited number of high-profile taxpayer names,” they identified 86 suspicious accesses involving 30 taxpayer accounts by 52 employees, including contact service representatives and tax examining technicians. The report’s example: a customer service representative searching for a prominent business leader by name — a taxpayer who, as TIGTA notes, would not typically deal with the IRS without an open case file that already contains his identification number.
Two points require care. First, these are suspicious accesses, not adjudicated violations. TIGTA has referred all 86 to its Office of Investigations; the report does not say what came of them. Second, the report does not state that any of the information was disclosed or misused. What it does state is that “Privacy Office officials could not provide a business purpose as to why the 52 employees accessed the tax accounts of government officials, business leaders, and entertainers,” and that none of the accesses had been identified by the IRS itself.
One inference is worth drawing explicitly, and it is RSN’s analysis rather than a finding in the report: because auditors searched only a limited list of names, 86 should be read as a floor for that category of activity, not an estimate of its full extent.
The report also notes that after the Littlejohn case the IRS added post-access alerts for one category of sensitive accounts (the specifics are redacted), so “the technology is available” to extend similar alerts to celebrities’ and public officials’ records.
Finding two: 22 employees kept on after substantiated browsing
TIGTA reviewed the IRS’s labor-relations case system for fiscal years 2023 through 2025 and found 53 cases in which an employee accessed a taxpayer’s account without the taxpayer’s knowledge or consent. In 31 cases (58 percent), the employee was fired. In 22 cases (42 percent), the employee was not. All 22 received some lesser discipline, ranging from reprimands to suspensions. In 13 of them, the deciding official cited length of service and a first offense as the reasons for keeping the employee.
The IRS’s Manager’s Guide to Penalty Determinations, excerpted in the report, lists a single penalty for a first offense of unauthorized access without the taxpayer’s knowledge and consent: removal. Its examples include employees who “accessed an account out of curiosity” or sought to locate a spouse, family member or friend. TIGTA cited three of the 22 retained cases as examples; their details are redacted, but the auditors described all three as “serious and intentional” and wrote that “a zero-tolerance policy would have resulted in the removal of those employees.”
The IRS’s answer, as the report records it, rests on three points. Human Capital Office officials said the agency meets the zero-tolerance standard “by referring all UNAX cases for investigation.” When auditors pointed out that the Penalty Guide lists only removal for a first offense, those officials “stated that adherence to this document is not a requirement and only serves as a guide.” And they said the Merit Systems Protection Board has reversed UNAX removals in the past.
On that last point, the record the IRS produced was thin. Asked for evidence of such reversals, the IRS provided one case, from 2002, in which the Board found that management had made procedural errors — including treating an employee’s long service as an aggravating rather than a mitigating factor. TIGTA, for its part, cited several Board decisions, from 2006, 2012 and 2022, sustaining IRS removals for unauthorized access, including first offenses by employees with otherwise satisfactory records.
The IRS’s lawyers raised a fair legal point, and it deserves a full hearing. IRS Counsel told auditors that a manager “cannot have a predetermined outcome of removal” before weighing the case, and must consider mitigating and aggravating circumstances “as required by the law.” That was the framework set by Douglas v. Veterans Administration (1981), whose twelve “Douglas factors” have governed federal penalty decisions for 45 years. Due process for federal employees is not a technicality; a removal that ignores the required analysis can be overturned. But Human Capital officials also agreed with TIGTA that the most important factor is the first one — the nature and seriousness of the offense — and the report notes that weighing that factor properly “recognizes that removal may be the correct remedy given the seriousness of the misconduct, even on the first offense.”
The rule that just changed
The report mentions, almost in passing, that on July 2, 2026 the Office of Personnel Management and the MSPB jointly proposed a rule (91 Fed. Reg. 40444) under which the Board would “no longer apply the 12 factors established in Douglas” and would instead assess penalties under “a more flexible totality of the circumstances standard.”
The report, dated September 29, describes that change as a proposal. In fact, the MSPB had already finalized its portion. A final rule titled “Determining the Appropriate Penalty for Federal Employees Charged With Misconduct,” scheduled for Federal Register publication on September 3, 2026, provides that the Board “will evaluate whether the agency’s penalty is within the tolerable limits of reasonableness” in light of “the totality of the circumstances,” with “no particular set of enumerated factors required to be addressed in every case.” The Douglas factors remain available where they are material. The rule took effect 30 days after publication and applies to appeals filed on or after that date; pending appeals continue under the old framework. OPM’s separate portion remains in the proposal stage; the agency reopened public comment on September 15.
The change has critics. The American Federation of Government Employees warned in its comment, as reported by FedManager, of “an analytical vacuum where agencies and the MSPB will be at sea.” That concern is not frivolous: flexible standards can produce inconsistent outcomes, which is the very problem TIGTA identified.
For present purposes, the consequence is narrower and clearer. The IRS’s stated worry — that removals for browsing will not survive appeal — now has to be weighed against a Board standard that no longer requires a factor-by-factor checklist. The IRS has committed to clarify its guidance on discipline in intentional UNAX cases by December 7, 2026. Whether that guidance treats removal as the default the agency’s own Penalty Guide already describes is the test of whether “zero tolerance” means anything.
Finding three: victims the law lets go uninformed
Federal law, at 26 U.S.C. § 7431(e), requires the IRS to notify a taxpayer “as soon as practicable” when someone is criminally charged with unlawfully inspecting or disclosing that taxpayer’s return information, or when an agency proposes disciplinary action against an employee for doing so. Notice lets the victim take protective steps such as identity-theft monitoring.
TIGTA reviewed the 122 UNAX cases the IRS closed in fiscal years 2023 through 2025. The IRS properly notified 64 taxpayers in 39 cases. In the other 83 cases, 276 taxpayers were never notified. The failures fell into two groups:
- 175 taxpayers (42 cases) were not notified because the IRS did not follow its own procedures. The Human Capital Office’s Employee Relations staff failed to send investigation reports and discipline letters to the Privacy Office unit that mails the notices, or to confirm receipt. The IRS agreed these taxpayers should have been notified.
- 101 taxpayers (41 cases) were not notified because of how the law is written. Notice is triggered by criminal charges or proposed discipline. In these cases, the employees resigned or retired before discipline was proposed — so no trigger occurred.
The second group is the structural problem. Under the current trigger, an employee whose browsing has been substantiated can, by leaving before discipline is proposed, also prevent the victim from ever learning of it. Whether any employee has done so deliberately is not something the report addresses, and RSN does not suggest it. The point is that the statute’s design permits the outcome regardless of intent.
Timeliness was also a problem. Applying a 30-day standard that the report describes as “a common standard applied by the IRS,” auditors found that in 26 of the 39 cases where notice was sent, it arrived late. According to the report’s timeliness table, 11 taxpayers waited between 1,001 and 1,423 days. In the Littlejohn case, criminal charges were filed in September 2023, but some victim notices were not sent until December 2024, and a separate TIGTA review found 12,200 of those notices came back undeliverable.
How the IRS responded
The IRS’s formal response, signed September 16 by Acting Chief Privacy Officer John J. Walker and reproduced in the report, states that the agency “remains firmly committed to safeguarding taxpayer information.” Of TIGTA’s eight recommendations, the IRS agreed with five, partially agreed with two and disagreed with one. Its commitments include:
- Studying preventive controls against unauthorized access, by April 5, 2027.
- Developing requirements to restrict and monitor NAMES command access, by May 29, 2027.
- Clarifying discipline guidance for intentional UNAX cases, by December 7, 2026.
- Requesting a Chief Counsel opinion on whether existing law allows the IRS to notify all victims of confirmed willful access regardless of the employee’s status, by December 1, 2026.
- Designating the Chief Privacy Officer as the single executive accountable for the program (reported as done).
On the 276 uninformed taxpayers, the IRS partially agreed, stating that after reviewing 54 investigation reports it notified 182 taxpayers. TIGTA accepted that as substantial compliance and said notifying the rest depends on the legal review. The IRS disagreed outright with a recommendation to set a timeliness standard for victim notices, saying it already has one. TIGTA replied that the standard the IRS produced covers data breaches generally, not all § 7431(e) cases, and that the audit “found a 67 percent failure rate to notify victims within 30 days, showing that the IRS is not following its current standard.”
Why this matters beyond the IRS
Taxpayer privacy is not a partisan cause, and the report should not be read as one. Its findings cover employees of unknown politics browsing the records of officials, executives and entertainers of every stripe. But conservatives have particular reason to pay attention. The IRS’s handling of politically sensitive information has been a recurring concern since the 2013 controversy over the scrutiny of Tea Party applicants, which RSN covered at the time — including a 2014 report, “IRS Had ‘Secret Research Project’ For Conservative Donor Lists,” on emails obtained by Judicial Watch. RSN also reported in 2014 on the IRS’s continued employment of a worker who had been prosecuted for tipping off a terrorism suspect — an earlier instance of the same question this audit raises about who the agency chooses to keep.
The common thread is not any single scandal. It is that an agency holding the most detailed financial information most Americans ever surrender to government has, by the account of its own inspector general, a monitoring gap an employee can walk through by typing a name, and a discipline system whose written standard its officials describe as optional. Voluntary tax compliance, as TIGTA itself notes, depends on public trust that the information will be used only for tax administration.
What Congress has — and has not — done
On June 11, 2026, Senators Steve Daines (R-Mont.) and Catherine Cortez Masto (D-Nev.) introduced bipartisan legislation, identified in bill trackers as S. 4752, that would raise the maximum criminal penalty for unauthorized disclosure of tax returns from $5,000 and five years to $250,000 and seven years, create a felony for IRS contractors who willfully fail to enforce required safeguards, and raise minimum civil damages from $1,000 to $5,000. The bill was referred to the Senate Finance Committee; trackers show no further action.
TIGTA’s report observes that the bill “does not address unauthorized access without disclosure” — which is precisely the conduct this audit documents. A Littlejohn-style leak would face steeper penalties under the bill; an employee looking up a celebrity’s file out of curiosity would not.
What is proven, what is not
Established by the audit: NAMES searches bypass IRS monitoring and are not classified as sensitive; auditors found 86 suspicious accesses of 30 high-profile accounts by 52 employees that the IRS had not detected; 22 of 53 employees found to have accessed records without consent or authorization were not fired; 276 taxpayers in closed cases were not notified, 101 of them because the employee left before discipline was proposed; most notices that were sent were late.
Not established: that any of the 86 suspicious accesses was unlawful (they remain under investigation), that any information was disclosed or misused, or which public figures were searched (the report does not name them).
Disputed: whether retaining the 22 employees was a reasonable application of federal due-process standards, as the IRS’s lawyers contend, or a departure from the zero-tolerance policy the agency promised Congress, as TIGTA concludes.
What accountability would look like
Several steps follow directly from the record:
- Report the referral outcomes. TIGTA’s Office of Investigations should disclose, in aggregate, how the 86 referred accesses are resolved — how many were substantiated, how many employees were disciplined or removed, and whether any case was referred for prosecution.
- Close the resignation gap. If Chief Counsel concludes in December that § 7431(e) does not allow notice once an employee leaves, the Senate Finance and House Ways and Means committees should amend the trigger so that a confirmed violation, not proposed discipline, requires notice.
- Extend reform to browsing. Any taxpayer-privacy bill that moves should address unauthorized access under section 7213A, not only disclosure.
- Publish the guidance. The IRS’s revised discipline guidance, due December 7, should be made public so taxpayers can see whether “zero tolerance” still means removal.
The IRS has set its own deadlines. The months ahead will show whether they are met.
Sources: TIGTA Report No. 2026-300-058 (Sept. 29, 2026); OPM/MSPB proposed rule, 91 Fed. Reg. 40444 (July 2, 2026); MSPB final rule, FR Doc. 2026-18061; OPM comment-period reopening (Sept. 15, 2026); 26 U.S.C. § 7431; 26 U.S.C. § 7213A; Sen. Daines press release (June 11, 2026); Accounting Today (Oct. 7, 2026).
Featured image: The Internal Revenue Service Building, Federal Triangle, Washington, D.C. Photograph by Carol M. Highsmith, Library of Congress, Prints and Photographs Division (public domain), via Wikimedia Commons.