Congress Might Actually Be Moving Forward On Fixing Outdated Email Privacy Law!

from the didn't-see-that-coming dept

We've been talking about and asking for ECPA reform for many, many years, and it might finally be moving forward. ECPA is the Electronic Communications Privacy Act, which details how the government can get access to your electronic communications. The law was written in the early 1980s, and as you've probably noticed, we live in a very different world these days as it pertains to electronic communications. One key example: the law says that messages left on a server for more than 180 days are considered abandoned and can be searched without a warrant. That may have made some sense (though, not really) in a client-server era, where everyone downloaded their messages leading to them being deleted from a server, but it makes no sense at all in an era of cloud computing.

The main foes against updating ECPA have been government agencies that have investigatory powers, but not the ability to get a warrant -- mainly the SEC and the IRS, with the SEC being the real stumbling block. The SEC really liked the fact that it could snoop through emails without a warrant. So, even with massive support in Congress, ECPA reform never went anywhere.

So it was a bit surprising to folks this week to see Rep. Bob Goodlatte announce that the Judiciary Committee will now markup the ECPA reform bill, meaning that the bill is moving forward again. It's not entirely clear why it's happening now, but at the very least, it sounds like the SEC's constant protests may no longer be an obstacle. Hopefully it does move forward, and whatever results from the process leads to much stronger privacy protections on electronic communications, such as actually requiring a warrant, like the 4th Amendment says should happen.

Filed Under: bob goodlatte, ecpa, ecpa reform, electronic communications, email, irs, judiciary committee, markup, sec, surveillance

IRS Identity Fraud Prevention Specialist Arrested For Identity Fraud, Filing Fraudulent Tax Returns

from the multiple-layers-of-thievery dept

In late spring of last year, more than 100,000 taxpayers had their personally-identifiable information accessed by criminals. It wasn't a security breach, nor was it accomplished by "hacking." Instead, it was the result of the IRS using common static identifiers to verify accounts -- information that could easily be found elsewhere. These were deployed to access transcripts of taxpayers' filing histories. The transcripts gave criminals the information they were actually seeking: Social Security numbers, birth dates and current addresses.

The IRS promised to be less easily "hacked" going forward. It didn't mention any specific steps it would take. "Protocols" would be "strengthened" and taxpayers known to be compromised (likely a smaller number than those actually compromised) were given the consolation prize of free credit monitoring and a "Sorry about that" letter from the IRS.

In addition, efforts were mounted to further protect taxpayers from identity fraud, which, to date, has produced a study, a "working group" and a press release. This may prove fruitful in the future (actual implementation date still TBA...), but it's too bad the agency couldn't be bothered to escalate its defensive efforts until after catastrophe had already struck. And it does nothing at all for past hurtful efforts made by "helpful" government employees. (via Overlawyered)

Federal officials today announced arrests and charges in a stolen identity tax-refund scheme believed to involve more than $1 million in false claims and run by an IRS employee who was supposed to be assisting taxpayers experiencing problems resulting from identity theft.

A federal grand jury earlier this month indicted NAKEISHA HALL, JIMMIE GOODMAN and ABDULLA COLEMAN for their involvement in a 2008 to 2011 scheme operated out of Birmingham that involved stealing personal identity information from the Internal Revenue Service to create fraudulent tax returns and collecting the stolen refunds…

Hall, having access to taxpayer information as an IRS employee, apparently orchestrated the scheme. Fraudulent tax refunds were routed to prepaid debit cards. These cards were then sent to a variety of fake home addresses set up by the three conspirators -- one of which is already doing time on an unrelated charge.

There you have it. The IRS is unable to protect you from outside threats or inside threats. It's still generally satisfactory when it comes to closing doors on empty barns, though. And, Nakeisha Hall -- tasked with preventing ID theft but instead engaging in it -- transfers to the US Dept. of Irony, joining such luminaries as Air Force chief of Sexual Assault Prevention (arrested for sexual assault) and the Obama administration (whose open government workshop was closed to the public).

Filed Under: identity fraud, identity theft, irs, nakeisha hall, scams

IRS Looking To Purchase Another Stingray; Promises To Start Obtaining Warrants

from the will-continue-to-investigate-murders-in-its-spare-time dept

Now that it's been a few weeks and we're used to the idea that the IRS has a Stingray device, more information has arrived to put us slightly more ill at ease. Sen. Ron Wyden asked IRS head John Koskinen some pointed questions about the IRS's cell tower spoofer ("WTF?" wasn't one of them) and has received some answers.

The IRS assures Wyden -- and by extension, the American public -- that it only uses them correctly and in a limited fashion through its criminal investigation division.

IRS use of cell-site simulation technology is limited to the federal law enforcement arm of the IRS, our Criminal Investigation division. Only trained law enforcement agents have used cell-site simulation technology, carrying out criminal investigations in accordance with all appropriate federal and state judicial procedures.

The IRS has only one* Stingray at this point, but is acquiring another, because you just can't have enough cell site simulators these days. It will also start obtaining warrants, in accordance with the DOJ's non-legally-binding suggestion that its agencies do so going forward.

*Possibly two -- see Marcy Wheeler's comments towards the end of this post.

But everything it said above about its Stingray use being limited to the IRS's Criminal Investigation division isn't exactly true. It may have sent its agents out to assist other law enforcement agencies with their work, but it did not limit its Stingray usage to its own investigations.

In addition, IRS-CI has used the cell-site simulator to assist in four non-lRS-CI investigations, one other federal and three state investigations. The federal case was a Drug Enforcement Agency (DEA) federal grand jury narcotics investigation, and tracked one cellular device. In this instance, IRS-CI operated the cell-site simulator, based upon the appropriate federal court order obtained by DEA, and followed all applicable laws under the guidance of an Assistant United States Attorney. The three state cases were non-grand jury investigations involving attempted murder, murder, and gun trafficking, and tracked six cellular devices.

So, the IRS sent its Stingray out to assist other agencies with their investigations. It's understandable that the DEA would be aware the IRS had a Stingray in its possession, but the three state investigations were performed by local agencies that somehow knew to ask the IRS if it had a cell site simulator they could borrow.

Even more absurd is the fact that the IRS is in the process of acquiring another cell site simulator. It's not as though it's worn the other one out, as Marcy Wheeler notes.

In other words, over the course of its almost 4 year life, the Stingray has tracked just 44 devices.

That seems to suggest this tracking isn’t just a quick one-off, otherwise they wouldn’t need another device, as they’re currently in the process of getting.

Perhaps however, this is a testament to the obsolescence of these devices. In his response to Wyden, Koskinen doesn’t mention the Stingray IRS bought in 2009, suggesting it may not be in use anymore.

The government is sure blowing through these expensive surveillance toys in quick succession.

If everything adds up (including Daniel Rigmaiden's exposure of the IRS's cell phone tracking efforts in his case), this would be the third device the IRS has purchased -- or at least the third it will have access to. Stingrays aren't cheap and at ~4 deployments a year, it would seemingly make more sense for the IRS to borrow one from another federal agency when it needs one, rather than acting as a small-time Stingray lending library for state agencies.

If Wheeler's other conjecture is accurate -- that these devices need periodic replacement -- then Harris is no different than a host of other tech manufacturers who make planned obsolescence an integral part of the business model.

Filed Under: 4th amendment, imsi catcher, irs, privacy, stingray, warrants

The IRS Has A Stingray As Well Because Of Course It Does

from the you-get-a-Stingray!-and-you-get-a-Stingray!-every-agency-gets-a-Stingray! dept

Did this sort of thing come about because someone at the nation's most hated agency whined that "everyone else was getting one?" Because there seems to be no logical explanation for this:

The Internal Revenue Service is the latest in a growing list of US federal agencies known to have possessed the sophisticated cellphone dragnet equipment known as Stingray, according to documents obtained by the Guardian.

Invoices obtained following a request under the Freedom of Information Act show purchases made in 2009 and 2012 by the federal tax agency with Harris Corporation, one of a number of companies that manufacture the devices.

No explanation will be forthcoming. The documents The Guardian obtained were heavily redacted and requests for comments were met with silence. But there it is: the IRS not only has a Stingray, but it paid $65,000 to upgrade it to the Hailstorm model, allowing it to continue to intercept calls and data without being locked out by upgraded cell networks.

It appears the agency does have the legal authority to deploy the devices. (The IRS is part of the Treasury Department and not subject to the new, exception-loaded warrant requirement handed down by the DOJ.)

[Former IRS Deputy Commissioner Mark] Matthews said there are currently between 2,000 and 3,000 “special agents” in the IRS who form the criminal investigation division (CID). They have the ability to get PEN register orders – the only authority needed to use Stingray devices.

Considering the criminal activity the IRS investigates most frequently -- tax evasion -- rarely involves highly-mobile suspects or the use of burner phones, it seems unlikely the IRS's Stingray sees much use. Then again, it does partner with other law enforcement agencies in criminal investigations, presumably under the Al Capone Theory of "tax evasion, if nothing else."

He said the IRS on its own usually uses gentler investigation tactics. But increasingly, investigating agents from the agency are brought on board for joint operations with the FBI and other agencies when the latter need financial expertise to look at, for example, money laundering from drug organisations.

Even if the IRS is frequently assisting with these investigations, it's pretty much guaranteed that whatever agency it's partnering with already has this technology on hand. The IRS's acquisition of a cell tower spoofer would seem to be redundant, at best. Then again, maybe it's redundancy the government wants. Can't have drug-running suspects slipping out of sight just because the local DEA office's Stingray is in the shop.

Of course, the IRS's Stingray could become the go-to device in the future, if federal law enforcement agents are looking for a way to circumvent the DOJ's new warrant requirement. They could send IRS agents with pen register paperwork to obtain permission to deploy cell tower spoofers.

But at the same time, the IRS's Stingray device seems to be more a product of "because it's available" thinking. Why not have one on hand, just in case? When the news arrives that Fish and Wildlife or the US Postal Inspector's Office has one, it will be greeted with "of course they do" shrugs, because that's just the way things go these days.The US government is sold on the "essentialness" of cell tower simulators and with funding for devices often tied to ever-swelling budget lines for Wars A (Drugs) and B (Terrorism), no agency should have to go without.

Filed Under: hailstorm, irs, stingray, surveillance, warrants
Companies: harris corp.

IRS Still Working To Complete Computer Upgrade From Windows XP To Windows 7

from the by-2020-it-will-be-2010 dept

Like many other entities (both singular and conglomerate), the IRS was reluctant to sever ties with Windows XP. Microsoft forced the issue, however, and gave everyone plenty of time to migrate to an operating system released sometime in the last ten years. Even with this head start, the IRS has yet to meet this target.

An Inspector General's report notes that the IRS is almost finishing upgrading its workstations to an operating system that's only eight years old (Windows 7). Almost.

As of May 2015, the IRS has completed most of the Windows XP workstation upgrades across the country. Approximately 1,300 workstations have yet to be located or confirmed as running the old operating system.

At this point, I'm going to do something I rarely do: cut a government agency some slack. The IRS did have plenty of workstations to upgrade -- nearly 110,000 -- so if 1,300 went "missing," it's somewhat understandable. On top of this, budget issues forced the agency to upgrade old workstations instead of replacing them with newer systems, which would have greatly sped up the process.

The IRS claims it does know where these missing 1,300 workstations are, but that the Inspector General won't listen to it. The included "Management Response" says the following:

The audit incorrectly concludes that IRS has not accounted for all XP workstations. We acknowledge there were challenges with our inventory data due to the many antiquated systems in our IT ecosystem. In spite of this, we took extraordinary steps to identify, document and upgrade every XP workstation in the IRS. On several occasions throughout the audit, the IRS provided information to the TIGTA team that clearly documented the number of workstations to be upgraded, where those workstations were located, and our strategy to complete the upgrades. Although footnoted in the report, TIGTA opted not to change their assertion that the IRS had not accounted for all XP workstations. As of this date, only 71 Windows XP workstations remain to be migrated.'

The IG's footnote tells a different story.

After the conclusion of our fieldwork, the IRS provided documentation that these workstations were located and upgraded to Windows 7, as of July 22, 2015. We were unable to verify this information.

Beyond the workstations, there's the IRS's servers, which are also running up against Microsoft's upgrade clock. This not-overly-optimistic statement by the IG suggests the IRS will be living in the (OS) past for much of the future.

Based on our discussions with management, we determined it is unlikely that the IRS will have its servers upgraded to Windows Server 2012 any time this Fiscal Year.

This is due to the fact that the IRS is still struggling to upgrade its servers to seven-year-old software.

In fact, the IRS still has not fully upgraded its servers from Windows Server 2003 to the 2008 release. Currently, the IRS has approximately 3,000 Windows servers still running the 2003 operating system. Management informed us that they have upgraded approximately 4,100 servers to the 2008 version which is already seven years old. The IRS currently has no servers running the 2012 operating system in production at this time.

Time to start reeling in the slack I cut the agency earlier. This logistical issue seems especially absurd.

The IRS also discovered nearly 6,000 applications being used by employees to do their jobs that required an assessment of each application to determine whether it would operate on Windows 7.

Unfortunately, the report doesn't provide more details on the massive amount of applications being used by the IRS. Every interlocking piece presents a new possibility for a hole or an exploitable flaw, something compounded by the use of unsupported system software.

The IRS has already seen its system exploited by scam artists, who were able to use the credentials of taxpapyers to fraudulently obtain refunds. That its "user data" (the tax records and personally-identifiable information of millions of Americans) is secured behind a patchwork of outdated software presents criminals and rival governments other opportunities for exfiltration and exploitation of taxpayer data.

Even if the IRS manages to hit its self-imposed targets for the most recent round of upgrades, support for those operating systems is also on its way out.

Despite the eventual progress made by the IRS on the Windows XP upgrade efforts, we believe the IRS provided inadequate oversight and monitoring during the early phases of this effort, starting with including it among other Microsoft product upgrades rather than making this effort its own project up to the decision made by the CTO to oversee the project himself. In addition, after taking four years to upgrade to Windows 7, the IRS is now faced with the challenge of addressing Microsoft’s announcement to end extended support for Windows 7 in January 2020.

The IRS has agreed to a majority of the Inspector General's recommendations which means… well, it probably doesn't mean much of anything. Chances are the IG will revisit this in a few years and still see the agency struggling to stay current with its operating system software. It's eight years behind on system software and seven years behind on server software, with the latter's migration less than 50% complete. The IRS doesn't have it easy, not with 110,000 workstations, 7,000 servers and -- for god knows what reason -- 6,000 applications, but unless it's willing to give this the priority it deserves, it will always be in danger of making a flawed, bulky system even more insecure.

Filed Under: computers, government, government it, irs, windows 7, windows xp

Legislators Send Letter To Treasury Department Demanding Release Of Funds Seized In Bogus Structuring Case

from the IRS:-we-won't-do-this-anymore,-but-probably-not-any-LESS,-either dept

Asset forfeiture finally found its way into the mainstream after years of coverage by media outsiders. The sudden increase in negative attention brought about some needed reform efforts. The DOJ issued new guidelines on civil asset forfeiture, as did the IRS, which announced it would no longer pursue seizure of funds under "structuring" statutes unless there was evidence the money came from criminal sources.

One of the victims of the IRS's bogus "structuring" seizures (made pre-policy shift) is Randy Sowers, a dairy farmer who had $63,000 seized by the agency in 2012. The cash came from sales made at local farmers' markets, but the IRS viewed it as a criminal act simply because Sowers never topped the magical $10,000 mark with his deposits.

The Sowers were "working" with the IRS to have the funds returned (this implies a modicum of due process that doesn't actually exist in civil forfeiture). Then Randy Sowers almost screwed things up, as Melissa Quinn of the Daily Signal reports.

While the couple was in the midst of settlement negotiations with the government, hoping to have most of their money returned, Randy Sowers spoke with a reporter from The City Paper in Baltimore, Md., about his experience with structuring and civil asset forfeiture.

On the day the article was published, Stefan Cassella, the assistant U.S. attorney overseeing Sowers’ structuring case, told the family’s lawyer he had a “problem” and was no longer willing to negotiate a settlement amount, according to court filings.

This attitude seems to be common to IRS prosecutors. They don't mind taking your money for the flimsiest of reasons and they don't mind fighting you every step of the way should you choose to challenge the seizure, but goddamn if it doesn't piss them off if you decide to discuss your situation in public.

If you'll recall, another victim of a bogus structuring seizure took his case (mostly anonymously) to a Congressional hearing. The prosecutor in that case reacted just as badly to the public airing of IRS-related grievances. He sent a letter to the Institute of Justice (which is representing the convenience store owner who had $107,000 seized by the IRS) that basically stated any publicity resulting from this would only harm this person's case. Because vindictiveness.

I do not know who did that, and I am accusing no one, but it was not from our office and could only have come from your clients. That was certainly not my intent in making this available. Whoever made [the document] public may serve their own interest but will not help this particular case…

Your client needs to resolve this or litigate it. But publicity about it doesn't help. It just ratchets up feelings in the agency.

The prosecutor then offered a take-it-or-leave-it deal of 50% of the seized cash back. C-store owner Lyndon McLellan chose the latter.

Sowers, however, did eventually settle with the IRS, receiving (coincidence?!) half of the seized funds. Why settle when you're clearly in the right? Because it's tough to run a business when your liquid assets have suddenly vanished. Half is better than nothing, especially if you want to remain solvent.

Now, he wants the other half. And he's brought backup.

A bipartisan group of lawmakers on the House Ways and Means Oversight Subcommittee is coming together to ask the Treasury Department to return nearly $30,000 it seized from Maryland dairy farmers in 2012.

The letter, sent August 11 to Treasury Secretary Jack Lew, calls on the agency to return $29,500 the Internal Revenue Service seized from Frederick-based dairy farmers Randy and Karen Sowers through civil asset forfeiture.

The lawmakers also asked Lew to review similar cases and return money seized by the tax agency under the practice.

The letter reminds the Treasury Department that the seizure program is in place to stop money laundering, drug trafficking and disrupt the funding of terrorist organizations. It is not just a quick and dirty way for the government to take money from cash-heavy businesses who frequently deposit cash in sub-$10,000 quantities. In many of these cases, it appears business owners have received bad advice from well-meaning family members or friends. In other cases, the bad advice comes from the bank employees themselves. What doesn't appear to be integral to these disputed cases is any link to criminal activity.

A very long petition for the return of the money has been lodged with the DOJ. It points out that under the agency's current rules, the sort of seizure they've experienced would not even be initiated. It also points out that the couple was apologized to by several members of the Congressional committee and the IRS Commissioner himself. And yet, the Treasury Department refuses to cede any ground on the other half of the Sowers' funds. Hopefully, a three-page letter from a bunch of legislators will compel the return of the Sowers' money -- something their 209-page complaint has yet to accomplish.

Filed Under: asset forfeiture, asset seizure, irs, legislators, treasury department

IRS Encrypts An Entire CD Of Redacted Documents In Response To FOIA Request

from the how-nice-of-them dept

Muckrock has a story of Alex Richardson, seeking information on the IRS's Whistleblower Office, which has been receiving some scrutiny lately. Richardson filed a bunch of FOIA requests and discovered that the IRS apparently would like to make his life as difficult as possible. First he got an infamous GLOMAR "neither confirm nor deny" response -- which was supposed to be limited to national security issues. However, with at least one request, a package with a CD just arrived... and Richardson was dismayed to find the contents of the CD encrypted. That seems a bit strange for a response to a FOIA request, since whatever is being delivered is supposed to be public, but whatever. The letter accompanying the CD explains, for reasons unknown, that while the IRS was only returning 6 of the 23 pages that had been located, it was doing so with encryption, and it would send the key separately. Again, this seems like weird operational security for public documents. Now, also, in the response letter, it noted that the reason only 6 pages are included is because the rest were withheld under FOIA exemptions: So you had to imagine that in those 6 pages, there should at least be some relevant information. Nope. It appears that the IRS went through all that to give a final middle finger to Richardson, because when he finally decrypted the documents... they're all redacted too. Six pages, entirely blacked out. Which makes you wonder why the other 17 were "withheld" in the first place. What difference could it have made?

As Muckrock notes at the end of its piece:

Just GLOMAR us next time, IRS. Save us both a lot of grief, and it's a lot less cruel.

Filed Under: encryption, foia, irs, redaction

Financial Info On 100,000 Taxpayers Now In The Hands Of Criminals, Thanks To The IRS's Weak Authentication Processes

from the time-for-everyone-to-start-lying-about-their-first-pet's-name dept

The government that wants so badly to be the world's leading cyberwarfare force still seems largely unable to fence in its own backyard. In Yet Another Breach™, the sensitive financial information of thousands of Americans is now in the hands of criminals.

The IRS announced today that criminals used taxpayer-specific data acquired from non-IRS sources to gain unauthorized access to information on approximately 100,000 tax accounts through IRS’ “Get Transcript” application. This data included Social Security information, date of birth and street address.

These third parties gained sufficient information from an outside source before trying to access the IRS site, which allowed them to clear a multi-step authentication process, including several personal verification questions that typically are only known by the taxpayer.

So, not actually "hacking," per se, as much as the gaming of system just begging to be gamed. The information criminals needed to obtain this data may have been "specific" to each registered taxpayer, but it was also information that rarely, if ever, changed.

This sort of authentication, called knowledge-based authentication, is highly vulnerable to fraud. It's based on information that never changes, and such data is widely available to anyone willing to pay for it from stolen financial information marketplaces. The transcripts that were fraudulently downloaded were likely made accessible due to leaked Social Security numbers and other personal data from any one of the many recent data breaches, including those at health insurers Anthem and CareFirst. In fact, security reporter Brian Krebs reported on the risks inherent in the IRS' transcript request system way back in March. He warned taxpayers to sign up for accounts on IRS.gov if only to prevent someone from creating a fraudulent account for their records first.

The IRS is reassuring Americans that its "core systems" remain secure, something of little comfort to the 100,000 taxpayers who will be receiving mea culpa letters (and free credit monitoring) from the agency over the next few weeks. What the IRS considers to be adequate protection is apparently not nearly adequate enough. Once the data is out there, verification information can be used to gain access to credit cards, bank accounts or anywhere else the same sort of canned questions are presented during the signup process. The 50% success rate suggests unique personally-identifiable information isn't necessarily all that unique.

In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles.

The IRS is quick to add that 23 million records were "safely" downloaded during this same time period, which isn't really the comforting statement it means it to be. All this means is that millions of downloads weren't linked to "questionable" email domains. That's not the same thing as 23 million downloads going to the actual owners of that information.

The IRS is vowing to "strengthen its protocols" going forward. This is the only response it can offer, unfortunately. Stronger processes are needed, but additional steps and more obscure verification questions will manifest themselves as hurdles a certain percentage of taxpayers won't be willing to leap for online IRS access. Going paperless won't seem nearly as advantageous, not when a motherlode of financial information can be pulled out of the ether by cybercrooks armed with the fruits of years of financial breaches, both public and private.

Filed Under: data breach, irs, leaks, privacy, private info, security

IRS Drops Forfeiture Case, Returns $107,000 Taken In Bogus 'Structuring' Prosecution

from the teaching-old-thieves-new-tricks dept

The streak continues. A highly-dubious IRS asset forfeiture case receives some media attention, closely followed by the agency dropping the case.

Federal prosecutors have dropped an attempt to seize $107,000 from a North Carolina small business owner using asset forfeiture laws following several weeks of media scrutiny.

According to the Institute for Justice, a public interest law firm, the Internal Revenue Service and Justice Department moved Wednesday to voluntarily dismiss their case against Lyndon McLellan.

McLellan's case was raised (as a "hypothetical") by Rep. George Holding during IRS testimony in front of the House Ways and Means Committee. Holding asked IRS Commissioner John Koskinen why the agency was continuing to pursue a questionable "structuring" case against McLellan, considering both the IRS and the DOJ had issued policy revisions stating the government would not do this unless there was evidence the deposited money originated from criminal activity.

Koskinen agreed that McLellan's case should be dropped and promised to look into it. Meanwhile, the prosecutor overseeing McLellan's case contacted the Institute for Justice, claiming that its release of case details to House members would not only not help McLellan's case but could actually make it worse for him -- citing the vaguely-threatening "ratcheting" of "feelings" within the IRS by this public disclosure. He then offered McLellan a "final offer" of half his money back.

McLellan didn't take the offer. Now, he's getting all of his money back -- which he'll need, considering he's already racked up plenty of expenses fighting the IRS and DOJ.

McLellan still had to pay for a lawyer, not to mention $19,000 to have his business audited. The government also refuses to pay for interest earned on money after it has been seized.

While the IRS may be curbing its dubious forfeitures, there are still problems that need to be addressed within the DOJ itself.

Last week, the Justice Department said it would investigate two other prosecutors after one business owner whose assets were seized said he had been punished more harshly after publicizing his case and another said he had been threatened with a felony charge if he did not agree to give up some of his money.

Kind of dispels the notion that asset forfeiture has anything to do with "justice." As these programs continue to suffer from mainstream exposure, those heading up prosecutions seem unwilling to scale back their efforts accordingly. They can see the revenue stream drying up and they're getting desperate. There will be more than a few forfeiture victims whose cases will stay off the radar. Unfortunately for them, these "zealous" prosecutors appear willing to do whatever they can to ensure funds seized with no evidence of criminal intent or origin remain inaccessible to those who actually earned them.

Filed Under: asset forfeiture, irs, lyndon mclellan, publicity, stealing

IRS Continuing To Pursue An Asset Forfeiture Case That Contradicts Its Own Policy On 'Structuring' Prosecutions

from the the-pettiest-of-discounts dept

Late last year, the IRS began dropping some of its more questionable asset forfeiture cases, most likely in response to reams of bad press about its sketchy enforcement of structuring laws. Many of these cases were built on nothing more than a series of deposits that came close to -- but never exceeded -- the $10,000 needed to trigger federal reporting. While the IRS may say it's looking for tax cheats, fraudsters and money launderers, its targets were often small, cash-based businesses like restaurants and vending suppliers.

The IRS also announced that, going forward, it would only pursue asset forfeiture cases that showed the money came from an illegal source. The DOJ followed this up with its own policy shift that roughly matched the IRS's.

Despite this change of heart, the IRS and DOJ are still pursuing a case against Lyndon McLellan -- a convenience store owner who had $107,000 taken from him by the feds late last year. McLellan -- on the advice of his banker -- began inadvertently "structuring" his deposits, again to "save" his bank from the burden of extra paperwork. There was seemingly no doubt his business generated the cash he deposited, but the IRS went after him anyway.

McLellan's legal representatives (from the Institute of Justice) forwarded details of his case to legislators ahead of IRS testimony in front of the House Ways and Means Committee. One legislator took this time to confront IRS Commissioner John Koskinen about his agency's contradictory prosecution of McLellan.

Without naming McLellan, Rep. George Holding (R-N.C.), a former U.S. attorney, asked Koskinen about the seizure:

Holding: Are you saying that under the new policy, you have to aver that we have probable cause to believe an illegal act is taking place other than the act of structuring?

Koskinen: Yes.

Holding: You sure about that?

Koskinen: That's what I'm advised by the people who run the Criminal Investigation Division.

Holding: The staff pulled for me a case from North Carolina, from my former prosecutorial district, after your policy change. And I've read through the affidavit and the associated documents. There's no allegation of illegal activity, other than the act of structuring...

Koskiken: If that case exists, it's not following the policy.

This should have resulted in the IRS dropping the case, or at least providing something in terms of evidence justifying its continued pursuit of McLellan. If nothing else, the agency could have played this off as an unfortunate oversight by its prosecutorial arm. Instead of any logical outcome, this questioning resulted in the federal prosecutor handling McLellan's case claiming the real problem wasn't the pursuit of a bogus prosecution. No, the real problem here was people disrespecting the power of a gag order.

Prosecutor Steve West emailed this to the Institute of Justice.

I'm a bit concerned. At your request, I provided you a copy of the application for seizure warrant, which remains under seal with the Court, and now it appears it has been made available to a congressional committee? I do not know who did that, and I am accusing no one, but it was not from our office and could only have come from your clients. That was certainly not my intent in making this available. Whoever made [the document] public may serve their own interest but will not help this particular case.

Oh, and that the public exploration of this contradictory prosecution hurt the feelings of West's office, if not the IRS itself.

Your client needs to resolve this or litigate it. But publicity about it doesn't help. It just ratchets up feelings in the agency.

And, finally, a half-off sale on sour grapes.

My offer is to return 50% of the money. The offer is good until March 30th COB.

As Reason's Jacob Sullum points out, there are valid reasons for filing these affidavits under seal. Notifying a structuring suspect of the IRS's intent to seize funds would probably result in a swift draining of targeted accounts. Whether the seizure is justified or not, there's at least a solid reason for the gag order. But in this case, the IRS had already seized the funds and moved forward with its prosecution. There was no "fear of flight," at least not in terms of the money in McLellan's accounts. West's nod to the power of sealed affidavits isn't due to fear of a compromised investigation, but rather due to his irritation at having one of his prosecutions publicly outed as running contrary to both the IRS's and DOJ's policies on structuring seizures.

As for the 50% offer, that's similarly disingenuous. At this point, the IRS commissioner has publicly acknowledged that such a case would be in violation of IRS policy. It's already likely on its way to being dropped, despite the prosecutor's suggestion that publicly embarrassing his office and the IRS's forfeiture team might result in the case being pursued out of spite, rather than based on any evidence of criminal activity.

Filed Under: asset forfeiture, convenience store, doj, irs, lyndon mclellan