Treasury Auditors Fault Security at Private Collection Agencies

Press Release August 3, 2018

Washington D.C. – A new audit has found that private contractors hired to collect overdue federal tax debt are not adequately securing taxpayer data, more evidence that the IRS’ private collection program should be cancelled.

“Not only does this program lose money and punish low-income taxpayers, now we learn that taxpayers’ personal information may be compromised by insufficient security protocols, which will cost even more taxpayer money to address,” National Treasury Employees Union National President Tony Reardon said. “Congress was wrong to force this program on the IRS and replace the professionally trained civil servants of the IRS with for-profit companies that work on commission.”

Despite two previous failed attempts, Congress mandated that the IRS again use private collection agencies. Starting in April 2017, the IRS has been referring collection cases to four different companies.

The Treasury Inspector General for Tax Administration, in a new audit, reports that one of the companies “could not provide monthly vulnerability scans of systems containing taxpayer data.” And three of the four “were not timely remediating critical- and high-risk vulnerabilities within the required 30 calendar days.”

There were also shortcomings in how the companies’ mailrooms operate. For example, one company did not have “a secure mail processing area for payments and did not secure misdirected payments prior to sending them to the IRS.” Also, three of them “did not back up their video footage to an offsite location.”

Finally, the audit said that the IRS will not have a true sense of the companies’ security posture without additional information.

“Americans are already under siege from cyberattacks and hackers who are trying to steal their personal data and financial information. Congress should make sure that the IRS does not expose them to even more threats because they let private contractors do government work,” Reardon said.

The National Taxpayer Advocate recently reported that the private debt collection program has cost $45.5 million to administer but has resulted in collections of $35.4 million, through March 15. And in response to growing concerns that the program disproportionately targets lower-income people, the U.S. House passed legislation to prevent taxpayers making less than 250 percent of the federal poverty level from being referred to the private companies.

NTEU represents about 70,000 frontline IRS workers around the country and opposes efforts to privatize part of the agency’s workload.

NTEU represents 150,000 employees at 33 federal agencies and departments.