Facebook is facing serious criticism after dolling out user information to corporate analytics companies and political campaigns – but there’s another group likely trolling through that data and getting far less attention: The Internal Revenue Service.
In a 2017 report, Kim Houser, a clinical assistant professor of business law at Washington State University, found that the IRS was breaking the law by trolling through data collected from Facebook and private social media posts. Federal law (the Privacy Act of 1974) states that citizens have to be informed when that sort of data is collected, and citizens must be able to review that information for accuracy. But a year after talking to the IRS and the American Civil Liberties Union and spreading the word, nothing about the illegal practice seems to have changed, Houser said.
“No. Nothing. Nothing at all,” she said. “I keep following the ACLU website and their ethics website, but nothing’s happened. People don’t seem to be as concerned about the government and what they’re doing versus what private companies are doing. But they should be.”
Houser said she came across the issue after attending a 2012 meeting at which an IRS speaker talked about the agency’s use of analytics.
“I looked at his Power Point presentation, and what he was saying was that private industry would be jealous if they knew what data we were collecting for the IRS,” Houser said. “That set off a huge red flag.”
The ACLU filed a Freedom of Information Act (FOIA) request to the IRS over the issue back in 2013, but the process appears to have stalled.
“The current IRS policy manual relies on the outdated Electronic Communications Privacy Act (ECPA), which only requires a warrant for some emails and other electronic communications,” Nathan Freed Wessler, an ACLU staff attorney, said in his blog in 2013, not long after the FOIA request.
“In order to uniformly protect the privacy of Americans’ private communications, lawmakers must update ECPA to require a warrant for the contents of all electronic communications, regardless of age or other factors,” Wessler said.
The IRS audit process is supposed to be random. In the past, the agency generally looked for mathematical errors or mismatches to determine who to audit.
But more recently, due to budget and staffing cuts, the agency has turned to data analytics, using information typically provided to corporations to mine consumer data.
“This is the exact type of information that would be really inappropriate for the IRS to be purchasing,” Houser said. “This gives such a deep amount of detail on people that it’s not acceptable.”
The IRS authorized the new data collection practice in its audit manual, but it violates the Electronic Communications Privacy Act and contradicts a 2010 U.S. v. Warshak ruling that says citizens should have an expectation of privacy when using their email.
The audit manual specifically states that “investigators can obtain everything in an account except for unopened email or voice mail stored with a provider for 180 days or less.”
That means investigators can still look at opened email, and there are no restrictions looking at data from services like Paypal, Google or Facebook, Houser said.
So, for example, the IRS could look at your private Facebook page for evidence of expensive, undeclared items or travel. If your taxes were low, but your Facebook had pictures of you on your new yacht, that could get you in trouble, Houser said.
Part of the problem is that a lot of our country’s privacy laws were created in the 1970s and 1980s, before the internet revolution and the rise of Facebook and other social media platforms. The goal of the older laws is to limit what sort of data can be collected, but those laws haven’t been updated for modern technological uses, she added.
“There’s no internal limit on what Google and Facebook could potentially sell to the IRS or any other agency,” Houser said. “And we’ve seen instances where the IRS has brought up things like eBay purchase data and Facebook posts in court cases.”
Consumer behavior on Google and Paypal have also been brought up in IRS court cases, signaling that the practice may be widespread across several platforms, she added.
“I’ve also read recently a couple of tax accountant bloggers – and the audits they’ve been asked to show up for lately, the IRS seems to know exactly what to ask for when they meet,” Houser said.
The IRS shifted to analytics after budget cuts in 2011. The goal was to use algorithms to pick through the data and select people appropriate for audits, while saving money on actual man hours. But the problem is the agency’s algorithms are private, so nobody outside the IRS knows exactly what they’re mining, Houser said.
“They could be looking at race, religion, nationality – all of that could be tracked,” Houser said. “But we don’t know exactly what they’re looking at because we don’t know what the algorithm is looking for.”
Until the issue is addressed, the only way to really avoid the problem is to stay off the internet, which Houser said she understands is nearly impossible in modern times. But beyond that, she did have some more modest advice.
“Be careful when you’re posting online to not exaggerate,” Houser said. “If they’re showing things that don’t match your income, showing expensive travel or things like that, you want to be careful. I think the best we can do is just keep in mind what we’re presenting on Facebook is being looked at by the IRS.”
People can also talk to their members of Congress to try to build some momentum for changing the practice. But after publishing an opinion piece on the subject in The Hill on Jan. 20 of this year, Houser said she still hasn’t heard anything from politicians interested in the subject.
“I think at some point we should all write our Congresspeople and tell them we’re concerned about this,” she said.
