clock menu more-arrow no yes

The IRS is sending out documents full of private Social Security numbers

Carl Malamud
Carl Malamud
Joi Ito

You've probably never heard of Form 990, but it's surprisingly important in the non-profit world. It's a tax form non-profits use to disclose key information, such as how they raise money and who is on their boards of directors. The 990 provides the same kind of basic transparency in the non-profit world that SEC filings provide for public companies. Everyone from donors to law enforcement relies on them to understand the non-profit sector.

Some 990s are available from third parties such as Guidestar and the Economic Research Institute. But if you want to get them directly from the IRS — and these are theoretically public documents available to everyone — they can be maddeningly difficult to get.  A Monday post from the transparency project Open Secrets mocks the IRS for the convoluted process required to get 990 data from the IRS. Instead of posting the documents for free on its website, the IRS charges hundreds of dollars to ship them out on DVDs. The process is expensive, cumbersome, and radically limits who has access.

Open government advocate Carl Malamud has been trying to get the IRS to change how it distributes 990s for years. The problems go beyond the DVD-by-mail thing. When organizations file 990s, they sometimes disclose peoples' private Social Security numbers. That's against the rules, but the IRS has done little to address the problem.

Malamud runs a non-profit organization that promotes open government by publishing public documents online. But he has become so concerned by these privacy issues — and so frustrated by the lack of action by the IRS — that he recently yanked his database offline in protest.

The problems at the IRS are a microcosm of the federal government more generally. Technologies that long ago became ubiquitous in the private sector are being adopted only slowly and grudgingly by federal agencies. If President Obama wants to lead a 21st Century government, Malamud argues, he's going to have to make better information technology a priority.

I got 990 problems

Non-profit organizations must file Form 990 annually to disclose important information such as their major income sources and the names of their board members. These are public documents and they've become essential reading for donors, economists, and anyone else interested in understanding the non-profit world.

Malamud has been working to make public documents like this more accessible for decades. In the 1990s, he successfully pressured the Securities and Exchange Commission to make public its database of filings from public companies. He also played a key role in getting information about patents available online. Now Malamud and his non-profit organization Public.resource.org are hoping to accomplish the same feat with 990 forms.

990s are not like the private tax returns of individuals. They describe the financial health of hospitals, universities, and other charitable organizations. They are intended for public consumption, and are theoretically available to any member of the public.

But the IRS's outmoded techniques for distributing the documents means that they're much less accessible than they could be. Instead of posting public documents as PDFs on its website, the IRS converts them to TIFF image files, burns them to DVDs, and sells the DVDs for hundreds of dollars per year.

Malamud is eager to help. Indeed, for years, he's been forking over hundreds of dollars per year for IRS DVDs with 990 files on them. He rips the DVDs and posts them online. It's a comically inefficient process, but the IRS has ignored requests from Malamud and other activists to make the files available online, or in a more useful format than TIFF images.

An identity thief's dream

4349710332_4cf278d95c_b

For years, Malamud has been buying IRS DVDs, ripping them, and posting them online. (Timothy Vollmer)

At the same time, Malamud has been wrestling with another problem. The 990 is a public document, so it's not supposed to contain confidential information. But Malamud has found numerous examples where non-profits have ignored these rules and included Social Security numbers of individuals in its filings.

Some of the most egregious examples are organizations that grant scholarships. Malamud sent me several examples of organizations — an academic society and a professional society in the South, a union in the Midwest, and a educational foundation in the Great Plains — that filed lists of every single person who had received scholarships. The result: the names, addresses, and Social Security numbers of hundreds of innocent people are freely available to anyone who requests them.

This kind of information is a gold mine for identity thieves (which is why I'm being vague about the specific organizations), and Malamud says that putting this kind of information in a public tax document is illegal. It's also a headache for people who want to make the information more readily available to the public.

Malamud has poured hundreds of hours into finding and redacting sensitive data in 990s. But he says it's not practical — or fair — to expect him to do this kind of work forever. And because the IRS refuses to update its own copy of documents that compromise privacy, the agency is continuing sending out DVDs full of privacy problems to people who request them. Other organizations who have purchased IRS DVDs may be inadvertently facilitating privacy problems when they republish unredacted 990s.

"We put them on disk and we sell them to folks"

Former IRS official Lois Lerner is best known for accusations that the Tax Exempt Division, which she headed, singled conservative political groups out for special treatment. But her division was also responsible for handling 990s.

In a March 21, 2013 speech, the Lerner stated that "we cannot redact Social Security numbers on the 990s unless they are on Schedule B. Legally, the only thing we can redact is Schedule B."

However, she said, "we do have a process when we see them, we put them on disk and we sell them to folks" — a transcript shows the audience laughed at this point — "not the Social Security numbers, the 990s."

Lerner appeared to be making light of the problem last year, and the IRS hasn't shown much concern about the problem since she left the agency.

The IRS didn't return a call seeking comment. A spokesman for the Treasury department also declined to comment, but pointed me to a Treasury proposal (page 231 of this document) for requiring all organizations to e-file their 990s and then making those documents available online. Having 990s in electronic form would be a big help. Not only would it make online distribution easier, but it's easier to search electronic data for Social Security numbers.

But the Treasury proposal requires Congressional approval and the agency contemplates a 3-year phase-in period even after Congress acts. Malamud argues there's a lot the IRS could do immediately to address the problem. For example, the agency could reject 990s that include Social Security numbers, just as it currently rejects forms that are missing other key information such as a signature.

Moreover, larger non-profits are already required to e-file. It should be easy for the agency to publish these organizations' 990s, which are most likely to be of public interest, and also the least likely to have major privacy problems. Instead, the IRS converts these electronic files to TIFFs, burns them on DVDs, and sends them to people in the mail.

A New Deal for data?

Malamud argues that this is part of a cultural problem that begins at the very top of the executive branch. He points to the successful effort to turn around healthcare.gov late last year. That only occurred after President Obama, with his signature policy initiative on the brink of failure, recruited experienced IT experts and gave them the authority to shake up the bureaucracy that had been building the health care website.

The president hasn't taken such an aggressive approach in other parts of government. And that, Malamud argues, has hobbled many of the president's policy initiatives. It's hard to reform agencies whose IT systems are decades old and hamstrung by bureaucracy. Malamud argues, for example, that IT problems contributed to the problems at the Veterans Administration — better IT could have allowed senior Obama administration officials to notice the problems earlier and react to them more quickly. And of course the IRS has had its own share of IT problems, even aside from 990s.

Malamud draws a parallel to an initiative by President Roosevelt to reform how the government managed paper records. The executive branch was beginning the expansion of the modern welfare state and Roosevelt realized that effective records management would be essential to making the welfare state work.

"Roosevelt called a meeting with all these agency heads and he was at that first meeting and they talked about the importance of records management," Malamud says. Roosevelt named the nation's first archivist, R.D.W. Connor, and gave him the clout he needed to make sure that other federal agencies were taking records management seriously.

"We need something at that high level" for information technology, Malamud argues. "Obama needs to call a meeting" with agency heads, and appoint senior officials to ensure IT problems are taken seriously across the federal government.

Disclosure: My graduate school research was partially funded by a 2010 donation from Malamud's organization, Public.resource.org.

Update: I tweaked the second paragraph to mention that some 990s are available from Guidestar.