The law made willful unauthorized inspection of taxpayer data illegal. We also did not assess the effectiveness of the various actions taken by IRS since enactment of Public Law 105-35. According to IRS, modernization will (1) allow it to restrict employees’ access to only those taxpayer records that they have a specific work-related reason to look at and (2) enable it to detect unauthorized accesses almost as soon as they happen. However, IRS does not expect to implement those modernization efforts for several years. In the meantime, IRS has taken several steps directed at deterring, preventing, and detecting unauthorized access and ensuring that appropriate disciplinary action is taken when unauthorized access is proven. These actions focus on awareness. In an attempt to make certain that all employees are explicitly informed about unauthorized access and the related penalties, IRS, among other things, adopted a policy that proven instances of unauthorized access will result in removal from IRS, absent any extenuating circumstances; sent a memo in October 1997 to all IRS employees that discussed, among other things, the penalties associated with unauthorized access; started giving annual agencywide briefings in November 1997 to inform all employees of IRS’ unauthorized access policy and the penalties for violations; created a form that is to be signed by employees and managers to acknowledge attendance at a briefing and receipt of guides on what constitutes unauthorized access; created a policy that all employees who join or return to IRS after the annual awareness briefings have been administered will be given their briefing within 30 days; developed a standard message to be given in all training courses in which access to tax information is discussed; developed a video and guides on unauthorized access to ensure that managers deliver a consistent message in briefing employees; and finally, established an unauthorized access steering committee and unauthorized access support team to address questions and issues raised by employees and managers. In the meantime, IRS has taken some steps to prevent unauthorized access. Number of Potential and Proven Instances of Unauthorized Access and the Penalties Imposed

Between October 1, 1997, and November 30, 1998, the Office of the Chief Inspector received 5,468 leads (information indicating potential unauthorized accesses) and completed work on 4,392 of those leads. As of January 25, 1999, action had been completed on 36 of these cases, and 28 remained open. In 15 of the 36 completed cases, IRS determined that an intentional unauthorized access had occurred. According to IRS, the offending employees in those 15 cases either resigned in lieu of termination or were terminated. According to IRS data, proven cases of unauthorized access that occurred after enactment of Public Law 105-35 have generally been referred to U.S. Attorneys for possible prosecution. In almost every case, according to IRS data, the U.S. Attorney declined to prosecute. As of February 2, 1999, one case had been accepted for prosecution. According to IRS, although the case was still open, the employee had been removed from the agency. Pursuant to the law, IRS notified the three taxpayers whose data the employee had accessed.
Why GAO Did This Study

Pursuant to a congressional request, GAO provided information on the Internal Revenue Service's (IRS) implementation of the Taxpayer Browsing Protection Act, focusing on: (1) actions IRS has taken to implement the law; and (2) the number of potential and proven incidents of unauthorized access by IRS employees that IRS has identified since enactment of the law, as well as penalties imposed in cases where unauthorized access was proven.

What GAO Found

GAO noted that: (1) the IRS has two approaches for implementing the law; (2) over the long term, IRS believes that modernizing its core automated systems offers the best means to prevent and detect unauthorized access to taxpayer data; (3) according to IRS, modernization will: (a) allow it to restrict employees' access to only those taxpayer records that they have a specific work-related reason to look at; and (b) enable it to detect unauthorized accesses almost as soon as they happen; (4) it will be several years, however, before this modernization becomes a reality; (5) in the meantime, IRS has taken several other steps directed at deterring, preventing, and detecting unauthorized access and ensuring that consistent disciplinary action is taken when unauthorized access is proven; (6) between October 1, 1997, and November 30, 1998, the Office of the Chief Inspector identified 5,468 potential instances of unauthorized access and completed preliminary investigative work on 4,392 of those leads; (7) of those 4,392 leads, 338 were determined to warrant further investigation; (8) many of these 338 cases were still under investigation or adjudication as of January 25, 1999; (9) using data provided by IRS, GAO identified 36 cases for which investigation and adjudication had been completed; (10) of those 36 cases, 15 involved an IRS determination that IRS employees had intentionally accessed taxpayer data without authorization; (11) in the other 21 cases, IRS determined that either there was no unauthorized access or the access was accidental; (12) according to IRS, employees involved in the 15 cases of intentional unauthorized access either resigned in lieu of termination or were terminated; (13) according to IRS data, proven cases of unauthorized access that occurred after enactment of Public Law 105-35 have generally been referred to U.S. Attorneys for prosecution, and these U.S. Attorneys have, with one exception, declined to prosecute; (14) according to IRS, the one case that was accepted for prosecution was still open as of February 2, 1999, but the employee had been removed from the agency; and (15) as required by the law, IRS notified the three taxpayers whose data the employee had accessed.