IRS taxpayer-data contractor left a loading dock unguarded
Summary
A Treasury inspector general found that a contractor site supporting the IRS's Zero Paper Initiative -- the agency's effort to digitize tax paperwork, backed by more than $2.3 billion in contracts -- left its loading dock unguarded and let 14 employees into restricted document-storage areas 1,375 times. At that same site, 20 critical software vulnerabilities sat unpatched for an average of 223 days -- seven times the IRS's own 30-day deadline. A separate, earlier audit found the interim contractor digitized just 7% of the forms it received that summer, after the IRS's pre-ZPI contractors managed only 5% during the same filing season.
A dock with no guard, a fence left open
In a July 2026 management alert⧉, reported that 14 employees at two ZPI contractor sites accessed areas holding taxpayer documents without authorization -- a combined 1,375 times, over May-August 2025 at one site and October-December 2025 at the other. At the first site, auditors found the perimeter fence and the loading dock used to receive taxpayer paperwork were open and unsecured, with no guard controlling the entry point that leads straight into the document-storage area. The contractor told the dock is left open during the day and locked at night, and that its contract doesn't require guards. disagreed: security policy requires reinforced perimeters, locked buildings, and a guarded or alarmed gate wherever a fence secures a site holding taxpayer information.
View data as table
| Critical | 223 | 30-day requirement -- 7.4x over |
|---|---|---|
| High | 231 | 60-day requirement -- 3.9x over |
| Medium | 423 | 120-day requirement -- 3.5x over |
| Low | 504 | 180-day requirement -- 2.8x over |
128 of 269 vulnerabilities missed their own deadline
The same memo found that at one site, 128 of 269 security vulnerabilities in systems handling taxpayer information (48%) weren't fixed within the 's required time frames -- and the ones that were overdue were badly overdue. Critical vulnerabilities, which the requires to be patched within 30 days, sat open for 223 days on average; one involved software so outdated the vendor no longer supported it. At the second site, couldn't even measure vulnerability age: the contractor was scanning its own systems with open-source software that doesn't meet federal Security Content Automation Protocol standards, and it kept no record of how long a flaw had existed. The Cybersecurity function's contractor-assessment team knew about the noncompliant software and did nothing about it. Configuration scanning fared no better -- policy requires a monthly scan of every device at a contractor site, but in August 2025 the first site scanned just 1 of its 203 devices.
The scanning itself is barely happening
A separate, February 2026 TIGTA audit⧉ found the underlying program is also badly behind on its actual job. Contractors scanned only 517,000 of the 9.8 million paper Forms 940, 941, and 1040 the received for the 2025 Filing Season -- 5% -- as of May 2025. The interim ZPI contractor did little better afterward, digitizing about 425,000 of 5.7 million forms (7%) that summer. Auditors traced the shortfall to a staffing bottleneck: as of August 2025, the 's Human Capital Office had cleared only 250 of the 496 people the interim contractor had submitted for background checks, and just 184 of those approvals covered scanning-floor roles -- against a workforce the contractor said it needed at roughly 600 to hit its contracted volumes. That clearance office had itself lost 28% of its staff to federal workforce reductions, then furloughed 84% of its remaining employees during the 43-day government shutdown that October. Before any of this, the had already spent nearly $61 million building an in-house scanning system it cancelled in April 2025 without ever running a single return through it.
View data as table
| 2025 Filing Season (Forms 940/941/1040) | 5% | 517,000 of 9.8M forms scanned as of May 2025 |
|---|---|---|
| Interim ZPI contractor | 7% | 425,000 of 5.7M forms, May 19-Aug 9, 2025 |
| Historical Forms 709 archive | 41% | 58.7M of 143M pages -- just 6% of the full 1B-page historical backlog |
The takeaway
- A $2.3 billion contract, awarded to four firms in September 2025, is meant to fix a problem the has been failing to solve since at least 2023 -- including a cancelled in-house system that cost nearly $61 million and processed zero returns before it was shut down.
- At the two contractor sites inspected, taxpayer paperwork wasn't secured the way the 's own rules require. An unguarded loading dock, 1,375 unauthorized building entries, and critical software vulnerabilities open for an average of 223 days -- more than seven times the 30-day limit.
- The bottleneck isn't just security -- it's staffing. As of August 2025, only about 31% of the scanning-floor workforce the interim contractor said it needed had actually cleared background checks, in part because the office that grants those clearances had lost more than a quarter of its own staff and then furloughed most of the rest.
- The agreed to fix the specific gaps flagged -- monthly access-log reviews, monthly vulnerability check-ins -- but says it plans to inspect the ZPI's other contractor sites as they come online, and will report what it finds in a future audit.
The two reports measure different things at different times and shouldn't be read as describing identical sites: the February 2026 report (No. 2026-408-003) covers the overall paperless-processing program, contract costs, and scanning volumes through July 2025; the July 2026 management alert (Audit No. 2026208008) covers physical- and information-security findings at two specific ZPI contractor locations, referred to only as Site 1 and Site 2, inspected on different visits between May and December 2025. does not identify the contractors by name in either document. The 7.4x and per-employee figures in this piece are this outlet's arithmetic on 's reported totals, not 's own framing; see the analysis note on each for its basis and limits.
Sources(2) ▾
- Treasury Inspector General for Tax Administration (TIGTA), Management Alert: Zero Paper Initiative Information Security (Audit No. 2026208008) (2026-07-14) — management alert memo to the Commissioner flagging physical-security and information-system-security deficiencies at two contractor sites supporting the 's Zero Paper Initiative (ZPI), based on site visits. Fetched directly via curl and read with pdftotext -layout; a Wayback Machine capture from 2026-07-16 exists as a backup. tigta.gov · original document
- Treasury Inspector General for Tax Administration (TIGTA), The IRS Has Made Limited Progress Achieving Paperless Processing (Report No. 2026-408-003) (2026-02-06) — final audit report assessing progress digitizing paper-filed tax returns and historical documents, covering the pilot programs, the cancelled in-house scanning system, and the launch of the Zero Paper Initiative (ZPI); fieldwork June 2024-July 2025. Fetched directly via curl and read with pdftotext -layout; a Wayback Machine capture from 2026-02-14 exists as a backup. tigta.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
The receives about 90 million paper documents a year, and processing them costs 43 times more than an electronically filed return. To close that gap, the agency has spent five years and committed more than $2.3 billion in contracts trying to get taxpayer paperwork off paper -- most recently through the Zero Paper Initiative (ZPI), a program that pays outside contractors to scan and digitize tax returns, correspondence, and information returns. Two Treasury Inspector General for Tax Administration⧉ audits, five months apart, describe the same program from two angles: one found the contractors are barely keeping pace with the paperwork; the other found that at the sites where they store and scan it, taxpayer data was left exposed.