The IRS has put millions of taxpayers at risk of identity theft by failing to perform background checks on contractors, according to a new inspector general report.
An IG audit performed by the Treasury Department, which oversees the IRS, found that several contractors who are responsible for handling sensitive taxpayer information do not perform any criminal or credit background checks on their employees. The agency provided millions of Social Security numbers to one contractor without any screening process in place, according to the report.
"Taxpayer and other SBU information may be at risk due to a lack of background investigation requirements in five contracts for courier, printing, document recovery, and sign language interpreter services," the IG said in a release. "For example, in one printing services contract, the IRS provided the contractor a compact disk containing 1.4 million taxpayer names, addresses, and Social Security Numbers; however, none of the contractor personnel who worked on this contract were subject to a background investigation."
The failure to conduct comprehensive background checks has allowed contractors with arrest records to obtain jobs handling taxpayer information. A courier tasked with transporting data, for example, had a history of violent crime.
"We found that a courier who performed the daily route previously served 21 years in prison for arson, retaliation, and attempted escape," the report says.
The IRS has been slow to correct its poor screening measures, despite the concerns raised by the inspector general. The IG warned the agency about the lack of background checks at the courier service in July of 2013 without any response from the IRS.
"As of February 2014, these contractors still had not undergone background investigations," the report says. "Allowing contractor personnel access to and custody of sensitive information prior to the appropriate background screening process increases the risk to taxpayers and the IRS of misuse of taxpayer and other sensitive data and possible identity theft."
The agency responsible for federal tax collection failed to put into place screening measures to protect the information of taxpayers in more than half of the 34 contracts it reviewed.
The IG identified 12 instances in which the IRS provided adequate background checks, while five contracts did not require any. Many contractors failed to perform follow-up screenings on employees in a timely fashion or only performed background checks on some employees.
Background checks are not the only problem area for the agency. Employees at 20 of the 28 contractors did not sign non-disclosure agreements that would prohibit them from sharing sensitive information about their work.
The IG recommended that the agency clarify its contracting rules and enhance its background check system, in order to ensure that sensitive taxpayer information is handled properly. The agency said it would implement those changes, according to the report.