How the IRS snoops on you

The Internal Revenue Service says it will not snoop online to see if you are evading taxes--unless your tax return signals something suspicious.

Once you are flagged, however, the IRS can draw on massive amounts of personal data it routinely compiles on peoples' electronic activities--everything from credit card transactions to Facebook postings. Most recently, the American Civil Liberties Union says it has IRS documents that reveal the IRS believes it has the legal authority even to open private emails without people's knowledge and sometimes without a warrant.

The agency has invested heavily in a new technology now coming online to fully exploit new powers to mine personal data that became law five years ago. But the agency has been quiet about what it has been doing. "They hold their cards pretty close to the vest at the IRS," says Bill Smith, managing director at the accounting firm CBIZ MHM. "It's not clear what they are using and how. But for sure don't brag on Facebook about how you are cheating. The IRS can see that. They are not idiots."

This does not mean everyone is under constant surveillance. But it does signal a new reliance on technology by the IRS to capture, analyze and use much more personal data.

With IRS staff sharply reduced in recent budget cuts, computerized tax processing and "data matching" of third-party networks are becoming the new normal. The IRS is using data to catch tax cheats and identify theft. But taxpayers who document legitimate expenses carefully could also be snarled in the digital dragnet and face time-consuming audits and costly appeals.

How can taxpayers prepare for this era of robo-audits?

File returns truthfully and make sure your online postings don't contradict what you tell the IRS.

Ultimately, truthful filing of allowable credits or deductions will likely win an audit, or the appeal of an audit. But a lot of time and money might be spent before it's over. Check your online postings and emails against your tax filings to make sure they are consistent. It's easy to make a mistake. For example, when you travel somewhere and post about it--on Facebook, for example--those dates become a matter of record. Be consistent.

Know what is public and what is private.

People using anonymous online "cloud" dropboxes, "cloud" storage or anonymous email addresses are not really concealing much. Even former CIA Director David Petraeus slipped up on this, as his attempts to conceal a private romance were exposed from his online storage space.

"Private browsing does work; it instructs the browser not to save data, and the browser doesn't save it," says Bruce Schneier, chief security technology officer at BT, the British telecommunications company. "Anonymous postings depend on what sort of investigation is done. The FBI, and by extension the IRS, could get at the data on a specific person."

Understand that once you are targeted for an audit, everything you do or have done in online and electronic transactions can be used against you.

The online footprints you leave stay with you for a long period of time. The IRS has broad investigatory powers (and now the technology) to go back and look. It is ingesting and storing many kinds of data that could be used for specific audits. As an example, even a college student's careless tweets about never paying back that loan or "going on this scammy free travel junket" could be used later to profile economic behavior.

"A tweet or post with specific information around location or activities is archived and can be potentially called up under a subpoena years later, if needed," says Venkat Viswanathan, chief executive officer of LatentView Analytics, a data analytics company.

"Taxpayers should pay close attention to this," he says. "In the digital and social media world, the trails tend to stay persistent for long periods of time because of the high-quality data storage and retrieval mechanisms that social networks employ."

Remember that those "robo-audits" screen for unusual items. Even legitimate tax deductions that don't conform to a "normal" profile can trigger an audit.

A legitimate expense--for example, buying an intern's lunch every day for $6--could appear as a $1,500 expense that might be unusual and give the IRS cause to dig deeper. "They will go after things that pop up in the computer screening," says Smith. He advises keeping detailed explanations and offering them on tax forms "in the hope that a real person might see it and decide it's okay."

Know that IRS "mission creep" into Big Data goes outside its stated mission of informing the public about tax policy.

What the IRS does with all the information it can now access is not clear even to the agency's oversight boards and congressional overseers. The IRS's Information Reporting Program Advisory Committee, made up of tax professionals and advisers, in its annual report, raised "many questions" and numerous concerns over how the agency will use and manage data and said there was "a strong need for guidelines."

The agency's mission statement says it will give "America's taxpayers top-quality service by helping them understand and meet their tax responsibilities and enforce the law with integrity and fairness to all."

But the agency would make no comment for a story by U.S. News & World Report in early April that documented the growing array of new technology the agency has in its arsenal, including a $350 million investment in data mining tools. The agency declined numerous requests to detail any portion of its online policies. It did make a statement later to refute a charge not made in the story, that the IRS targets taxpayers for audit based on their online information.

"Suggestions that the IRS is using social media to target taxpayers for audit are wrong. Audits are based on the information contained on a person's tax return, not a posting on a social media site," said IRS spokesman Anthony Burke in a statement.

But tax court cases record cite numerous cases in which online activity on eBay and Facebook are used in completing audits. The IRS itself says it goes outside of returns "to [verify] amounts reported on individual returns and [identify] individual nonfilers," according to a Frequently Asked Questions posting on its site.

For example, the agency won the power to review and house all credit card and digital payments for use in audits. The IRS won that big concession thanks to a little-noticed item quietly attached the Housing Assistance Tax Act of 2008, passed in the midst of the financial crisis. That provision is now being implemented by IRS but the extent of its use has not been fully explained, as the IRS and even tax lawyers are uncertain of its impact. With budget concerns still paramount, Congress has pushed the agency to do more to collect an estimated $300 billion lost each year due to unreported income. Guidelines to protect individual taxpayers from abuses have been a lesser concern.

In another disclosure under a Freedom of Information Act action by the ACLU, the IRS audit manuals show that "the IRS Criminal Tax Division has long taken the position that the IRS can read your emails without a warrant." CBIZ's Smith, who once prosecuted tax cases for the government, calls the development "disturbing." In a statement on ACLU's disclosure, the IRS said: "Respecting taxpayer rights and taxpayer privacy are cornerstone principles for the IRS. Our job is to administer the nation's tax laws, and we do so in a way that follows the law and treats taxpayers with respect."

"Contrary to some suggestions, the IRS does not use emails to target taxpayers. Any suggestion to the contrary is wrong," the IRS added in its statement. It did not directly comment on whether email is used for audits and whether warrants are required. "The Justice Department is holding that any data about you that is elsewhere--email on Gmail, Facebook posts, documents stored in Dropbox, etc.--can be gotten without a warrant," says network security specialist Schneier. He says the IRS, which shares data with other law enforcement agencies, has claimed similar powers and "people should be aware of it."