[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]


 IRS: REVIEWING ITS LEGAL OBLIGATIONS, DOCUMENT PRESERVATION, AND DATA 
                                SECURITY

=======================================================================

                                HEARING

                               BEFORE THE

                         COMMITTEE ON OVERSIGHT
                         AND GOVERNMENT REFORM
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                           FEBRUARY 11, 2016

                               __________

                           Serial No. 114-93

                               __________

Printed for the use of the Committee on Oversight and Government Reform


[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

         Available via the World Wide Web: http://www.fdsys.gov
                      http://www.house.gov/reform
                      
                               _____________
                               
                               
                          U.S. GOVERNMENT PUBLISHING OFFICE
22-591 PDF                       WASHINGTON : 2016


_______________________________________________________________________________________  
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].  
                    
                      
                      
                      
              COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

                     JASON CHAFFETZ, Utah, Chairman
JOHN L. MICA, Florida                ELIJAH E. CUMMINGS, Maryland, 
MICHAEL R. TURNER, Ohio                  Ranking Minority Member
JOHN J. DUNCAN, Jr., Tennessee       CAROLYN B. MALONEY, New York
JIM JORDAN, Ohio                     ELEANOR HOLMES NORTON, District of 
TIM WALBERG, Michigan                    Columbia
JUSTIN AMASH, Michigan               WM. LACY CLAY, Missouri
PAUL A. GOSAR, Arizona               STEPHEN F. LYNCH, Massachusetts
SCOTT DesJARLAIS, Tennessee          JIM COOPER, Tennessee
TREY GOWDY, South Carolina           GERALD E. CONNOLLY, Virginia
BLAKE FARENTHOLD, Texas              MATT CARTWRIGHT, Pennsylvania
CYNTHIA M. LUMMIS, Wyoming           TAMMY DUCKWORTH, Illinois
THOMAS MASSIE, Kentucky              ROBIN L. KELLY, Illinois
MARK MEADOWS, North Carolina         BRENDA L. LAWRENCE, Michigan
RON DeSANTIS, Florida                TED LIEU, California
MICK MULVANEY, South Carolina        BONNIE WATSON COLEMAN, New Jersey
KEN BUCK, Colorado                   STACEY E. PLASKETT, Virgin Islands
MARK WALKER, North Carolina          MARK DeSAULNIER, California
ROD BLUM, Iowa                       BRENDAN F. BOYLE, Pennsylvania
JODY B. HICE, Georgia                PETER WELCH, Vermont
STEVE RUSSELL, Oklahoma              MICHELLE LUJAN GRISHAM, New Mexico
EARL L. ``BUDDY'' CARTER, Georgia
GLENN GROTHMAN, Wisconsin
WILL HURD, Texas
GARY J. PALMER, Alabama

                   Jennifer Hemingway, Staff Director
                 David Rapallo, Minority Staff Director
     Henry Kerner, Deputy Director of Oversight and Investigations
                         Jack Thorlin, Counsel
                    Sharon Casey, Deputy Chief Clerk
                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on February 11, 2016................................     1

                               WITNESSES

Mr. Terence Milholland, Chief Technology Officer, Internal 
  Revenue Service, Washington, D.C.
    Oral Statement...............................................     9
    Written Statement............................................    10
Mr. Jeff Tribiano, Deputy Commissioner, Operations, Internal 
  Revenue Service, Washington, D.C.
    Oral Statement...............................................    14
Mr. Edward Killen, Director of Privacy, Governmental Liaison, and 
  Disclosure, Internal Revenue Service, Washington D.C.
    Oral Statement...............................................    15

                                APPENDIX

2016-04-07 Mr. Tribiano IRS re: Hearing Follow-up Responses......    52

 
 IRS: REVIEWING ITS LEGAL OBLIGATIONS, DOCUMENT PRESERVATION, AND DATA 
                                SECURITY

                              ----------                              


                      Thursday, February 11, 2016

                   House of Representatives
       Committee on Oversight and Government Reform
                                           Washington, D.C.
    The committee met, pursuant to call, at 1:02 p.m., in Room 
2154, Rayburn Office Building, Hon. Jason Chaffetz [chairman of 
the committee], presiding.
    Present: Representatives Chaffetz, Mica, Jordan, Walberg, 
Amash, DesJarlais, Gowdy, Massie, Meadows, DeSantis, Buck, 
Walker, Blum, Hice, Russell, Carter, Grothman, Hurd, Palmer, 
Cummings, Maloney, Norton, Connolly, Kelly, Watson Coleman, 
Plaskett, DeSaulnier, Boyle, and Welch.
    Chairman Chaffetz. The Committee on Oversight and 
Government Reform will come to order. Without objection, the 
chair is authorized to declare a recess at any time.
    We are here today because the IRS' current leadership has 
proven irresponsible and negligent. The IRS cannot seem to 
properly preserve documents or ensure both privacy and security 
in accepting electronic tax returns. The Agency is in desperate 
need of new leadership to put it on a better course. There are 
already a number of examples of IRS incompetence and neglect in 
the past few years, but several incidents in recent weeks have 
made it clear for the need for further serious oversight and 
meaningful reform.
    As millions of individuals and companies prepare to file 
tax returns, the IRS must ensure its data systems are secure. 
Last summer, the IRS suffered a massive hack, leaving the tax 
information of 300-plus thousand individuals exposed. The 
hackers used that information to file fraudulent returns 
totaling something in the neighborhood of $50 million in 
refunds before the IRS figured out what was happening. But it 
has been well documented billions of dollars have 
inappropriately gone out the door.
    And the facts surrounding the recent events appear very 
similar. On January 25th, 2016, the IRS detected unusual IP 
traffic on its network. This turned out to be a coordinated bot 
attack or botnet aimed at the e-file system. The hackers' goal 
was to recover taxpayer e-PINs, electronic pins, which would 
allow them steal refunds of innocent taxpayers. Roughly 450,000 
unique social security numbers were used by hackers in at least 
950,000 attempts to obtain these electronic PIN numbers. All 
told, the hackers are estimated to have stolen more than 
101,000 of these electronic PIN numbers.
    This latest breach raises serious concerns about the 
security of the system overall as well as the potential for 
paying out fraudulent claims, but none of this should surprise 
the IRS. In the last evaluation of the IRS' information 
security, the inspector general in September of 2015 
determined, ``Until the IRS takes steps to improve its security 
program deficiencies and fully implement all security program 
areas in compliance with FISMA requirements, taxpayer data will 
remain vulnerable to inappropriate and undetected use, 
modification, and disclosure.'' It probably does not get any 
worse or dire in terms of a warning. This level of incompetence 
is intolerable for an agency where millions of individuals file 
their most personal financial information.
    We are also here to discuss the failure of the IRS to 
properly preserve documents subject to lawsuits, and/or 
internal preservation orders, as well as FOIA requests. We take 
FOIA very seriously. The Freedom of Information Act is the 
public's right to know. It also allows companies and other 
organizations to access data so they can defend themselves.
    On January 15th of 2016, the Department of Justice 
disclosed in a Federal court filing that the IRS had erased a 
hard drive belonging to a former senior Agency employee named 
Samuel Maruca. And if this story sounds similar to things we 
have heard about with Lois Lerner and others, it is, and that 
makes us sick. It is disgusting. It has to stop. We are doing 
everything we can to highlight. It is inappropriate, and yet it 
continues.
    The hard drive contained information subject to FOIA 
litigation. Despite the lawsuit, an internal preservation 
order, and the legal obligation to preserve related documents 
to the IRS, the IRS wiped the hard drive and scheduled it for 
recycling. This involved a multibillion-dollar issue relating 
to Microsoft. The hard drive likely sat in queue and was wiped 
up to 4 months after the internal preservation was ordered. 
Again, after. Internal preservation in place, then the wiping 
of a hard drive.
    We cannot say for sure to pinpoint the date because the IRS 
does not know when the hard drive was wiped clean. Hard drives. 
You go to Best Buy, you can buy them for less than a hundred 
bucks. In a multibillion-dollar situation, this is what we are 
talking about, but, again, this continues to be familiar.
    In March of 2014, the IRS destroyed backup tapes containing 
Lois Lerner's emails which were subject to investigation by 
Congress, the inspector general, the Department of Justice. 
There were five open investigations, two duly issued subpoenas, 
and the IRS wiped the data. Here we have another case where 
people properly filed FOIA requests, and they wiped it again. 
This is just 1 month after the Agency learned that a 
significant portion of the Lerner emails were missing, and, 
again, it happened. As it turns out in the Maruca case, the 
IRS, by sheer luck, already copied the hard drive because of a 
different lawsuit. It was not because of competence. It was 
just sheer luck.
    So if you look at the IRS, they have roughly $2.4 billion 
they spent on IT, and it is worthless. Absolutely worthless. 60 
to 70 percent of those funds are spent on legacy systems, 
preserving old things like COBOL and other types of things, but 
there are still billions of dollars in fraud running through 
the system.
    We have a situation we are going to talk about today where 
there was a reported hardware failure. The story we got is that 
there was a power outage, but then the redundant power, the 
backup power, it also went out. How does that happen? Why do 
you have redundant power if it also goes out? When we asked 
through questioning about a breach, I put out a tweet pretty 
quick and said, you know, this so-called hardware failure maybe 
was a breach. We start to go and probe and have an 
investigation. We have a bipartisan staff talking to the IRS, 
and then they say, oh, we should probably tell you about the 
breach. What breach?
    If you look at the timeline of this, let us go through this 
because this is just days ago. Our committee, Oversight and 
Government Reform, a week ahead email to the press confirmed 
that there would be a hearing on February 11th relating to IRS 
document destruction and data security. On February 8th, 
majority and minority committee staff has a call with the IRS 
regarding the e-filing outage and the status of the Maruca hard 
drive. The IRS gives an update on how it planned to recover the 
hard drive and confirmed it had been wiped. After that date, 
our staff asked about the breach referring to the e-filing 
issue. Mr. Milholland, who is here with us today, begins 
describing the previously unreported and undisclosed breach. 
The IRS legal staff intervened and said that he was talking 
about a different event, so we asked for more information about 
that.
    The next day, February 9th, miraculously in the Wall Street 
Journal, the IRS releases further details regarding the breach 
in another phone call with the majority and minority committee 
staff, and shortly thereafter the IRS releases a statement to 
the Wall Street Journal regarding the breach. If we had not 
been asking about another incident, we would not have known 
about this incident, and it affects over 100,000 people.
    This is a recurring theme. It is totally unacceptable. We 
look forward to peppering you with questions, and we expect 
answers.
    With that I will yield back, and now recognize the ranking 
member, Mr. Cummings.
    Mr. Cummings. Thank you very much, Mr. Chairman. I always 
try to start out hearings by stating what I think we can all 
agree on. Today I think we can agree that the IRS should have 
strong systems in place to properly preserve Federal records 
and to protect its computer systems from cyberattacks. I think 
we can agree on that, and those are valid goals, and I know 
that the IRS agrees with them.
    However, I do not believe this committee has been serving 
its intended purpose when it comes to the IRS generally. 
Unfortunately, Republicans have become obsessed with 
investigating any and every allegation relating to the IRS, no 
matter how small. I believe this is because Republicans were 
not able to find any evidence to support their baseless 
accusations that the White House conspired with Lois Lerner to 
target conservative groups for political reasons. They also 
were not able to identify any evidence that Commissioner 
Koskinen or any IRS employees destroyed evidence in order to 
obstruct our investigation.
    For the record, this is our 23rd hearing on the IRS. The 
23rd. 23rd. That is amazing. We have now interviewed 54 
witnesses. The IRS commissioner has testified six times, more 
than any other agency has over the past 3 years. The IRS had 
produced more than 1.3 million pages of documents from 88 
custodians in response more than 80 requests for documents. Yet 
despite this exhaustive multi-agency, multi-committee, 
multiyear investigation, this wild goose chase continues, and 
it has come up empty.
    Last year, the inspector general issued his report and 
identified no evidence to substantiate Republican claims of 
political motivation by the White House or intentional 
destruction of evidence. Specifically, the report found, ``No 
evidence was uncovered that any IRS employee had been directed 
to destroy or hide information from Congress, the DOJ, or 
TIGTA.''
    The Justice Department also conducted an investigation and 
concluded that, ``Not a single IRS employee reported any 
allegation, concern, or suspicion that the handling of tax 
exempt applications or any other IRS function was motivated by 
political bias, discriminatory intent, or corruption.'' The 
Justice Department also found, ``no evidence that any official 
involved in the handling of tax exempt applications or IRS 
leadership attempted to obstruct justice, and no evidence of 
any deliberate attempt to conceal or destroy information.'' 
Amazingly, none of these findings stopped the Republicans from 
trying to impeach the IRS commissioner, despite the fact that 
there is no evidence that he intentionally obstructed our work 
or destroyed documents.
    The problem now is that our committee is in a mindset where 
we are just trying to get the IRS, and unfortunately the public 
does not always get a complete or accurate picture as a result. 
For example, the impetus for today's hearing was a press report 
that an IRS employee, who was leaving the Agency, had his hard 
drive erased in violation of a court order. However, we 
received a letter from the IRS last week explaining that, in 
fact, the IRS copied this employee's hard drive first. Another 
example is the outage the IRS experienced last week. The 
chairman stated that his gut reaction was that the outage was, 
``It really does smell like a hack.'' However, the IRS has now 
briefed our committee that, in fact, it was due to a mechanical 
device failure, and there is, ``zero percentage chance that 
this was a cyberattack.''
    Yet another example Republicans have focused on is the 
incident involving PIN numbers that occurred in January. What 
is not mentioned is that, in fact, the IRS successfully blocked 
the IP addresses from which this attack was initiated. As a 
result, this week the IRS confirmed, ``No personal taxpayer 
data was compromised or disclosed by our IRS systems.'' These 
are critical facts, and I hope that the public understands them 
and any press that are here will repeat them. As I said 
earlier, this is our 23rd hearing on these types of allegations 
against the IRS.
    Imagine instead if we had held 23 hearings on the issue 
that actually matters to the American people. Imagine if we had 
held 23 hearings where we brought in drug company officials to 
explain their skyrocketing prices. Now, that is something that 
we could really help our fellow citizens on and would make a 
big difference. Going forward, I hope we will use the resources 
and the authority of this great committee to serve the 
interests of our constituents.
    I want to thank our witnesses for being with us today. I 
look forward to your testimony. And with that, Mr. Chairman, I 
yield back.
    Chairman Chaffetz. I thank the gentleman. I will now 
recognize Mr. Jordan of Ohio as the chairman of the 
Subcommittee on Healthcare Benefits and Administrative Rules, 
and recognize him for 5 minutes.
    Mr. Jordan. Thank you, Mr. Chairman. The ranking member 
said Republicans have had 23 hearings where they are ``trying 
to get the IRS.'' We are not trying to get the IRS. The IRS is 
trying to get conservative Americans who are exercising their 
1st Amendment free speech rights. 23 hearings is a pretty small 
price to pay when you are trying to protect fundamental 
liberties in the Constitution, for goodness sake. So I want to 
thank the chairman for this hearing on document preservation, 
data security. If anyone needs it, certainly the IRS needs a 
lesson in how to preserve documents.
    Let me give you a quick little history here. Several years 
back, Brian Downing orders destruction of documents that TIGTA 
needs in their audit. The person who was ordered to destroy the 
document comes forward as we want whistleblowers to come 
forward when something wrong is going on, comes forward and 
tells Stephen Whitlock, the then acting director of the Office 
of Professional Responsibility, and he says just keep 
destroying the documents.
    Fast forward to 2013. Again, the IRS gets caught with their 
hand in the cookie jar. Lois Lerner's now famous speech, May 
10th, 2013, where she goes to the Bar Association, lies to the 
American people, says it was not us, it was just those folks in 
Cincinnati. Complete lie. It was folks in Washington 
orchestrating this targeting against conservative groups. Later 
that year, later in 2013, Mr. Koskinen is brought in to clean 
up the mess. In fact, the President himself said, ``He's the 
expert at turning around institutions.''
    So what has the turnaround been? The chairman just talked 
about it, right? What has the turnaround been? We had this case 
with Microsoft where an IRS employee, Sam Maruca, his hard 
drive is wiped clean when there is a preservation order in 
place not to destroy any records relative to that court case 
and that investigation. And, of course, the one that I think is 
most important, Mr. Koskinen, brought in as the turnaround 
expert, learns that Lois Lerner's hard drive has had problems. 
He waits 2 months before he tells Congress and the American 
people, and, more importantly, under his watch, 422 backup 
tapes are destroyed after there are three preservation orders. 
Three orders, one from Mr. Milholland himself, do not destroy 
anything. And what does the IRS do? Three preservation orders, 
one from the IRS themselves, one from TIGTA, one from the 
Justice Department doing a criminal investigation, and two 
subpoenas from this committee, what does the IRS do? They 
destroy 422 backup tapes containing potentially 24,000 emails 
relevant to a congressional investigation and a criminal 
investigation. So there is a pattern here.
    Now, finally, Mr. Chairman, just to add insult to injury, 
guess what the Internal Revenue Service did? That very first 
example I gave you about Mr. Whitlock who said, no, keep 
destroying the documents that the whistleblower came forward 
and said we are doing. Guess what happens? I guess at the IRS 
if you destroy documents, you get a promotion. Mr. Whitlock was 
just named head of the Office of Professional Responsibility.
    So to the ranking member, I think a 24th hearing with that 
kind of history at this organization is more than warranted, 
for goodness sake. There is a pattern of destroying records, a 
pattern of destroying documents, and, frankly, a pattern of 
destroying records and documents when you have been told not 
to. Preservation orders and whistleblowers coming forward, and 
yet it continues, and when that happens, some people get 
promoted at the IRS. Of course we need this hearing, and I look 
forward to hearing from our witnesses.
    Chairman Chaffetz. I thank the gentleman. I will now 
recognize the gentleman from Virginia, Mr. Connolly, for 5 
minutes.
    Mr. Connolly. Thank you, Mr. Chairman, and thank you, Mr. 
Ranking Member. 23 hearings on the IRS. You know, when you 
cannot prove it, charge it anyhow. Repeat it. Do it louder. Try 
to suborn the TIGTA to make sure that his audit is limited with 
direct advice from you and your staff. Accuse people without 
facts. Hammer it home on your favorite network, and hopefully 
it will sink in and become true even if the facts belie it.
    Chairman Chaffetz. Will the gentleman yield?
    Mr. Connolly. No. I am tired of these hearings. I am tired 
of insinuation. I am tired, frankly, of what looks to a lot of 
people like demagoguery.
    Chairman Chaffetz. Will the gentleman yield?
    Mr. Connolly. No, Mr. Chairman, sadly I will not. I will 
finish my statement. We need the IRS. We need it to be 
functional. The same people that want to pillory you here today 
for your performance do not want to take responsibility for the 
fact they have starved the beast. They have cut a billion 
dollars from the IRS budget, degrading service, making it very 
difficult for the IRS to actually do its job. We leave $350 
billion on the table every year, taxes owed, but not collected. 
That could make a big dent in the debt. We could reduce the 
debt over 10 years by $3 and a half trillion without raising 
anyone's taxes and without cutting any essential services, but 
we do not want to do that.
    We do not want to do that because illogically the IRS is 
such a juicy target for our base and making the case that you 
represent the hard knell booted government on our necks. And 
why in the world would we want to do anything to strengthen 
you? And as a result, we have IT systems, according to John 
Koskinen, that go back to the Kennedy Administration. That is 
53 years ago. And we wonder why things are not totally 
functional? We wonder why IRS is not fully efficient? We wonder 
why hard drives crash when the average age of a computer at IRS 
with 91,000 employees is 7 years plus. In the private sector it 
is 2 to 3 years.
    So to archive stuff, we have to print and save because we 
cannot trust aging legacy technology systems, and this Congress 
will not reinvest in you to bring you up to the 21st century 
because that would make you more efficient. That actually might 
make you be able to better do your job, and dysfunctionality 
serves our purposes illogically and politically.
    So, yeah, that is why we have 23 hearings, and we demonize 
people, and we deny them their 5th Amendment rights, and make 
charges that turn out to be without foundation. It does a 
disservice to this committee, in my opinion, and I have sat 
through every one of these hearings.
    And I began truly concerned. Was this, in fact, going on? 
Did IRS, in fact, target a particular group or philosophy? As 
the ranking member said, all of the facts tell us no. Was there 
ineptitude? Was there political tone deafness? Yes. Was there a 
deliberate attempt by a Federal agency to target a particular 
political group or set of groups because of their political 
philosophy? No. And you can charge to the contrary all you 
want, but the evidence trail does not tell us that. But it 
makes for good television, and it riles up the base, and it 
probably raises money, but it is not worthy of the Oversight 
and Government Reform Committee.
    And as the ranking member said, had we spent 23 hearings 
looking at price gouging on pharmaceuticals, we actually might 
have improved someone's life. We might have actually helped 
some seniors better afford the drugs they need. We might have 
made a contribution to bettering government. But this is a 
charade. This is not about making government better, and it is 
not even really about holding you accountable. I wish it were. 
It is to pillory you for political purpose, and I regret that.
    Now, Mr. Chairman, I do yield.
    Chairman Chaffetz. For you to suggest and try to assign a 
motivation to our attempt here to get at the truth is beneath 
the gentleman from Virginia. Name one thing that I said in my 
opening statement that is not true. Name it. You do not have 
anything.
    Mr. Connolly. You do not have anything, Mr. Chairman.
    Chairman Chaffetz. Yes, I do.
    Mr. Connolly. I reclaim my time.
    Chairman Chaffetz. Will the gentleman yield?
    Mr. Connolly. No.
    Chairman Chaffetz. I have a point I want to make about IT.
    Mr. Connolly. The chairman can use his own time because he 
has got plenty of it, and he is more than prepared to use it. I 
reverse it. I echo what the ranking member said. I do not think 
you have proof.
    Chairman Chaffetz. The gentleman's time has expired. The 
gentleman's time has expired.
    Mr. Connolly. Okay, thank you.
    Chairman Chaffetz. With the concurrence with the ranking 
member, I would like to make a point about IT because I think 
that is part of the heart of why we are here today. Is the 
gentleman okay with that?
    Mr. Cummings. Go ahead.
    Chairman Chaffetz. I was elected at the same time as 
President Obama, so use that as a marker. The Federal 
government has spent more than $525 billion on IT, and it is 
worthless. One of the questions I have here with an operating 
budget for the IT sector roughly $2.4 billion a year, why is it 
that we have such poor systems? Why is it that we have DOS, and 
COBOL, and other things? We have got good hardworking, 
patriotic people that work at the IRS. We have 4,000 of them in 
the State of Utah, and they are using an old dilapidated 
system. I do not know how they do it. They try to patch and 
Band-Aid this thing together, and they cannot seem to have 
enough resources.
    The President puts out a thing saying I need $3 billion 
more? We were only $3 billion short? What happened to the other 
$525 billion? That is a legitimate bipartisan question. It is 
part of the reason I am here today. How is it that the IRS goes 
via the Department of Justice and tells a judge that they do 
not have these records? And it is not until this committee in a 
bipartisan way with the staff says where is this information 
that miraculously they said, oh, we actually do have it.
    That is a legitimate question. It is why we have another 
hearing. I did not even start the week before last thinking we 
were doing an IRS hearing. I yield to the gentleman from 
Maryland.
    Mr. Cummings. Questions have been raised by the chairman. I 
would hope that you would address those. One of the things that 
all of us, and I know the gentleman from Virginia is one who is 
an expert in IT and has spent a phenomenal amount of time 
trying to make sure our government properly functions 
effectively and efficiently. And the question that the chairman 
just raised with regard to the use of old systems when we 
should be in the modern age are questions that, I think, are 
legitimate questions.
    And so, I look forward to your responses. Does the 
gentleman ----
    Mr. Connolly. I would just add to my friend from Maryland, 
I could not agree more that those are legitimate lines of 
inquiry, but they have to be balanced with what has happened to 
your budget so that you can make those investments. Has it gone 
up or down? Has Congress shown a commitment to try to modernize 
your IT systems so that we do not have this kind of problem? 
Presumably we could find common ground. That is non-partisan 
agreement.
    Chairman Chaffetz. It is in my set of questions and why we 
are having this hearing today.
    Mr. Connolly. Except that it is not.
    Mr. Cummings. Reclaiming my time, Mr. Chairman, I yield 
back.
    Chairman Chaffetz. I just have to say, and I will give you 
equal time here. For the gentleman to suggest those are not my 
questions and to impugn the motive of any member is totally 
inappropriate.
    Mr. Connolly. I would simply say I did not impugn anybody's 
motive. I characterized this hearing and this process, and if 
the gentleman wishes to take exception to that or offense by 
that ----
    Chairman Chaffetz. Oh, I take deep exception to it.
    Mr. Connolly. Well, I regret ----
    Chairman Chaffetz. It is bipartisan. We get equal time, and 
there is a legitimate reason to understand why they go to the 
Department of Justice, represent that they do not have the 
documents. We ask for them, and then they miraculously say, oh, 
yes, I guess we do have them.
    Mr. Connolly. I think that the chairman can certainly 
appreciate questioning the process and the 23rd hearing on the 
IRS without necessarily personalizing it. The chairman knows I 
do respect him, and I certainly made no attempt to try to 
personalize it. But would I characterize this process 
negatively? Yes. I have made no secret of that, and I do not 
apologize for it, and I do not retract it.
    And it is not impugning you or any other individual to call 
into question that process. That is my right as a member of 
this committee, and I will not be silenced by deliberating 
trying to personalize it so that the critique somehow is 
diluted. The critique stands. You do not have to agree with it, 
Mr. Chairman.
    Chairman Chaffetz. I do not.
    Mr. Connolly. But I stand by it.
    Chairman Chaffetz. Let us move on. Let us move on.
    Mr. Connolly. Fine, let us move on.
    Chairman Chaffetz. I am pleased to welcome Mr. Terry 
Milholland, chief technology officer at the Internal Revenue 
Service, Mr. Jeff Tribiano, deputy commissioner of Operations 
at the Internal Revenue Service, and Mr. Ed Killen, Director of 
Privacy, Government Liaison, and Disclosure at the Internal 
Revenue Service. I appreciate you all being here today.
    If you will, please rise and raise your right hands.
    [Witnesses rise.]
    Chairman Chaffetz. Do you solemnly swear or affirm that the 
testimony you are about to give will be the truth, the whole 
truth, and nothing but the truth, so help you God?
    [Chorus of ayes.]
    Chairman Chaffetz. Thank you. You may be seated. Let the 
record reflect that the witnesses all answered in the 
affirmative.
    In order to allow time for discussion, we would appreciate 
it if you would limit your oral presentation to 5 minutes. Your 
entire written statement will be made part of the record. Mr. 
Milholland, you are now recognized for 5 minutes.

                       WITNESS STATEMENTS

                STATEMENT OF TERENCE MILHOLLAND

    Mr. Milholland. Chairman Chaffetz, Ranking Member Cummings, 
members of the committee, my name is Terence Milholland. I am 
the IRS chief technology officer and chief information officer. 
I appreciate the opportunity to testify today.
    In my role at the IRS, I'm responsible for all aspects of 
the systems and data that operate our tax infrastructure. We 
have a 7,000-person information technology organization that 
maintains 500-plus systems and data, and supports the 
processing of 200 million tax returns annually.
    Before joining the IRS 7 years ago, I spent 3 decades in 
the private sector and held a number of information technology 
leadership positions. My experiences included as executive vice 
president and chief technology officer of Visa International. I 
was also the chief information officer and chief technology 
officer for Electronic Data Systems Corporation, and before 
that the chief information officer for the Boeing Company.
    It is an honor for me to serve the public as the IRS CTO, 
and to support the tax system by helping the Service modernize 
its IT systems.
    This concludes my opening statement, and I'd be happy to 
take your questions.
    [Prepared statement of Mr. Milholland follows:]
    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

    
    Chairman Chaffetz. I thank the gentleman. Mr. Tribiano, you 
are now recognized for 5 minutes.

                   STATEMENT OF JEFF TRIBIANO

    Mr. Tribiano. Chairman Chaffetz, Ranking Member Cummings, 
and members of this committee, my name is Jeff Tribiano, and I 
am the deputy commissioner for Operations Support for the IRS. 
I appreciate this opportunity to testify today.
    In my position at the IRS, I oversee internal operations, 
which includes information technology, human capital, finance, 
privacy, procurement, planning, facilities, and security. Prior 
to joining the IRS in June of 2015, I served as the associate 
administrator and chief operating officer of the Department of 
Agriculture's Food Nutrition and Consumer Services. And prior 
to joining the Federal government in 2010, I held a number of 
key leadership positions with Fortune 500 companies. In 
addition, for more than 22 years I have served and continue to 
serve our country as a captain in the United States Navy 
Reserves, to include three mobilizations and deployments to the 
Middle East.
    My experiences in the public sector, private sector, and 
military have given me a deep understanding of the importance 
of public service. I'm especially proud to be part of the 
leadership team at the IRS and to work for an agency with such 
an important mission. In my 8 months at the Agency, I have 
found this team to be an amazing organization filled with 
dedicated and talented people, and I'm privileged to work 
alongside of them.
    Turning to the subject of today's hearing, the IRS has been 
working for more than a year to modernize our records 
retentions practices in regard to emails and other electronic 
records. We are implementing the National Archives and Records 
Administration's Capstone approach to managing email, and are 
working towards full implementation by the end of Calendar Year 
2016. At that point, our systems will permanently preserve the 
email records of all employees in electronic format.
    Our ultimate goal is to end the reliance on computer hard 
drives of individual employees as an archive records store, and 
instead use network databases to preserve all records that are 
electronically generated by the workforce. As we make these 
improvements for the long term, we recognize we need additional 
interim measures to ensure we are doing everything possible to 
retain official records until a more comprehensive solution is 
in place.
    This need became apparent when an issue arose in connection 
with the Service's collection and production of documents 
related to a Freedom of Information Act case captioned 
Microsoft v. the IRS. In January of this year, the IRS advised 
the Court that we had discovered an issue regarding the 
computer hard drive of Samuel Maruca, a former IRS employee who 
we identified in a litigation hold effort undertaken in 
December of 2014 in connection with the case.
    Shortly after Mr. Maruca left the Service on August 1st, 
2014, his hard drive was designated for erasure so it could be 
securely reused or scrapped in line with the standard IRS 
procedures. Because Mr. Maruca's hard drive was designated for 
erasure before the issuance of the litigation hold, the hold 
did not prevent the erasure of this hard drive, which occurred 
in late 2014 or in early 2015.
    However, we do believe the erasure of Mr. Maruca's hard 
drive will have minimal effect on our ability to complete 
document production in this instance. We know that Mr. Maruca's 
hard drive was copied on July 16th, 2014 in connection with the 
document collection being undertaken for a separate litigation. 
We have, therefore, determined that the data stored on his 
computer hard drive up to July 16th, 2014 has been preserved. 
We also have emails copied on Mr. Maruca's network account in 
July of 2014, and if necessary, we also can access our backup 
tapes or disaster recovery tapes in order to produce documents.
    Even so, we recognize the situation will reflect a 
shortcoming in our document controls. Therefore, pending 
further review of the IRS' litigation hold procedures, the 
Commissioner has ordered a halt to the erasure and recycling of 
employees' devices, including computer hard drives and mobile 
devices, for all departing employees. We'll now copy material 
off the hard drive of every employee who leaves the Agency, and 
store that information in a digital format in addition to 
retaining the physical hard drive.
    We are also broadening our litigation hold procedures to 
ensure that hold instructions are provided not only to the 
pertinent employees, but also to the employee's supervisor. 
We'll also update our procedures for processing employees who 
leave the Service to ensure that appropriate personnel are 
advised of pending litigation holds and document collection 
efforts involving the records of custody for departing 
employees.
    In closing, I want to assure the committee that the IRS is 
committed to building on these efforts and to make further 
improvements, and continue focusing on serving the Nation's 
taxpayer.
    This concludes my statement, and I'll be happy to answer 
any questions.
    Chairman Chaffetz. Thank you. Mr. Killen, you are now 
recognized for 5 minutes.

                   STATEMENT OF EDWARD KILLEN

    Mr. Killen. Chairman Chaffetz, Ranking Member Cummings, and 
members of the committee, my name is Edward Killen, and I am 
the director of Privacy, Governmental Liaison, and Disclosure 
at the IRS. I appreciate the opportunity to testify today.
    In my role at the IRS, I represent the Agency's interests 
in multiple aspects, including records management, information 
protection, disclosure, data sharing, and combatting identity 
theft. My office manages relationships with Federal, State, and 
local agencies by facilitation and oversight of various data 
sharing programs and initiatives. We also work to ensure the 
protection of Federal tax information in the custody of our 
data exchange partners.
    The bottom line for my office is that we're working every 
day to protect taxpayers, safeguard their personal data, and 
promote both privacy and transparency principles, including the 
appropriate availability of Agency records.
    I've spent my career in public service, beginning as a 
presidential management fellow with an appointment to the 
Social Security Administration. In 2003, I joined the IRS as a 
policy analyst in our Wage and Investment Division. Since then, 
I've had the opportunity to carry out a wide range of 
assignments in different areas at the Service, including 
leadership positions as the director of Governmental Liaison, 
Disclosure, and Safeguards, and senior advisor to the deputy 
commissioner of Operations Support. I have also engaged in 
numerous and diverse detail assignments across the IRS, 
including stints within our Chief Counsel's Office and the 2008 
economic stimulus team.
    I'm proud of the years I've spent in public service and 
grateful for the chance to continue to serve the American 
taxpayer.
    This concludes my statement, and I would be happy to take 
your questions.
    Chairman Chaffetz. Thank you. You all seem like decent 
individuals. The question is, why do we have to keep coming 
back and asking for the same basic information? The IRS advice 
to individuals in businesses is that they should hold their own 
personal business and tax information for how long? How long 
are you supposed to hold onto your own personal information? 
Mr. Tribiano?
    Mr. Tribiano. Sir, that is not my area. I am with 
Operations Support, so I ----
    Chairman Chaffetz. Mr. Killen, how long? How long does the 
IRS advise you to hold onto your own personal information?
    Mr. Killen. Well, I think it would depend on the particular 
circumstances. But, you know, as a general matter, probably 7 
years or so is probably ----
    Chairman Chaffetz. 7 years. I mean, that is what I have 
generally heard as well, 7 years. So how long does the IRS hold 
onto its own data and information? Mr. Maruca leaves the 
employment. Why the swift erasure of everything that he has? 
Why does that happen? Mr. Killen?
    Mr. Killen. Well, I think in the particular case of Mr. 
Maruca, as the written testimony shows and as I think we will 
probably talk through the day, that was largely a factor of 
sequencing and of particular circumstances. But I think the 
thing that I would reiterate about that is that essentially we 
have found the file, the data ----
    Chairman Chaffetz. Okay, but, yes, you did find the file 
because we pushed the issue, forced the issue. But on January 
15th of this year, the Department of Justice on the behalf of 
the IRS actually filed a notice with the Federal court that 
they had erased Mr. Maruca's hard drive.
    Here is the fundamental problem. You require us, the 
people, to hold onto their information for 7 years. The IRS 
erases their information. There is no consequence. Nobody is 
held accountable. There was an internal preservation order, but 
it was ignored, and there is no consequence for that, right? 
Who issued the internal preservation order?
    Mr. Tribiano. That came from our legal department.
    Chairman Chaffetz. How does that process not hold that 
information?
    Mr. Tribiano. The internal preservation order came, it was 
actually a litigation hold order, came after Mr. Maruca left 
the Agency.
    Chairman Chaffetz. What originally happened is Microsoft 
filed a Freedom of Information Act request. That was not 
complied with, so they had to go to court and wait to get a 
court date, and then get to the court to try to say where is 
this information, and you had already erased it in less than a 
year. I do not understand why the IRS asks us to hold 
information or 7 years, and you do not even hold it for 7 
months. How does that happen? Why does that happen?
    Mr. Tribiano. Well, Mr. Chairman, it was a timing issue. 
Again, Mr. Maruca left the Agency on August 1st.
    Chairman Chaffetz. But if we have to hold our information 
for 7 years, how come the IRS does not have to hold its 
information for 7 years?
    Mr. Tribiano. The information from Mr. Maruca's system is 
backed up with our backup tapes. It is just harder to get into 
that system, and Mr. Milholland can walk through that. It is 
the hard drive that is easier to access, and that ----
    Chairman Chaffetz. Right now today, how long does the IRS 
preserve its own internal documents? How long?
    Mr. Tribiano. It depends on the documents. Mr. Killen can 
walk you through that.
    Mr. Killen. That is true. You know, there are various 
records, disposition schedules for different types of records, 
both across the Federal government as a general matter, but 
certainly within IRS, so it is largely fact dependent. But ----
    Chairman Chaffetz. Give me a range. What is the shortest 
amount of time, what is the longest amount of time.
    Mr. Killen. Oh, it can really vary.
    Chairman Chaffetz. You have a $1.7 billion dispute, and you 
have the person who is working on the issue, they leave 
employment for whatever reason. I am sure it was a legitimate 
reason. But why is all that information suddenly erased, and 
how do you go in front of a judge and say we no longer have 
that information? How does that happen?
    Mr. Killen. Well, I mean, so certainly we ----
    Chairman Chaffetz. Because neither--sorry--neither of those 
things were true, right? Neither of those things were true. You 
actually did have the information, but you represented to the 
Department of Justice that you did not have it. But it was 
erased even though there was an internal preservation order.
    Mr. Tribiano. At the time that the Department of Justice 
was notified, we thought that there was information saved. When 
we went back to take a look at it and to go through the 
records, we found that we did back it up for another litigation 
hold up through July 16th of 2014. Mr. Maruca left the Agency 
on August 1st.
    Chairman Chaffetz. Can you help detail for us, and you are 
not going to be able to get through it verbally now. My time 
has expired. I have two things that I would love to understand. 
How do preservation orders internally work, and why are they 
not adhered to because we had that happen in the Lois Lerner 
case. We have that happening in the Microsoft case. How does 
that happen? And then the second thing is I would like to know 
what documents you do and do not retain and for how long? And I 
fundamentally do not understand why it is not the same for the 
IRS as it is for the American people.
    Could you between the three of you get back to the 
committee on those two topics? Is that fair?
    Mr. Tribiano. Yes, sir.
    Chairman Chaffetz. Let the record reflect all three of them 
thought it was fair. All right.
    Chairman Chaffetz. My time has expired. I will now 
recognize the gentleman from Virginia, Mr. Connolly, for 5 
minutes.
    Mr. Connolly. And let the record show this member has felt 
the chairman has always conducted himself fairly. We do not 
always agree, but I think he has always been fair.
    I want to talk a little bit about investments and capacity. 
Mr. Tribiano, is it true that the Agency's inflation-adjusted 
budget has been cut by 17 percent since 2010?
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. Is it further true that by Fiscal Year 2015 
we whittled down your funding and your budget to the lowest 
level in 5 years?
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. Is it also true that, in effect, when you 
count inflation, that means that your budget has the buying 
power of the budget of 1998?
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. That is a long time ago. The reduction has 
been about $1.2 billion?
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. And in Fiscal Year 2015 alone, the budget was 
cut another $346 million from the previous year funding. Is 
that correct??
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. Well, let me see. Because of these cuts, as I 
understand it, the workforce has been cut by 17,000 since 2010. 
Is that correct??
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. Two-thirds of your top managers have left in 
the last 5 years. Is that correct??
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. 40 percent of your workforce, by the way, on 
top of that is eligible to retire by 2019 largely because of 
the baby boom generation. Is that correct?
    Mr. Tribiano. Yes, sir.
    Mr. Connolly. Well, do these cuts and reductions have an 
impact on productivity, customer service?
    Mr. Tribiano. Yes, sir, it has a direct impact.
    Mr. Connolly. Does it impact your audit capability?
    Mr. Tribiano. It impacts our audit capability and our 
revenue collection of capability as well.
    Mr. Connolly. Well, Mr. Milholland, do these cuts have any 
impact at all on the IT budget?
    Mr. Milholland. Yes, sir.
    Mr. Connolly. How so? Do you want to elaborate a little?
    Mr. Milholland. It affects people, processes, and 
technology. For example, in the people area, we know that we 
have 67 people who are the single points of failure, so to 
speak, for particular systems. If they left, we would not have 
any knowledge to deal with an issue in that particular system 
they support. That is how thin we have become is that we now 
can identify the places where we are truly thin, so we have to 
deal with risk mitigations for those particular systems.
    Mr. Connolly. So Mr. Koskinen was quoted last week as 
saying we have got systems that go back to the Kennedy 
Administration. What was he talking about?
    Mr. Milholland. What he was referring to are systems like 
the individual master file or the business master file, where 
these systems were literally designed and architected in the 
1960s and rolled out in the 1970s. Those systems are where 
literally your tax returns, the master file record of your tax 
returns, are kept. We have been ----
    Mr. Connolly. Let me interrupt you one second there. So my 
tax returns might be kept on a system that goes back to the 
1960s and 1970s?
    Mr. Milholland. That was architected in the 1960s and 
1970s. That is correct, sir.
    Mr. Connolly. What could go wrong with that?
    Mr. Milholland. Well, that is one of the many issues that 
we deal with is the sustainability of those long-lasting legacy 
systems so that every year we can have a smooth filing season.
    Mr. Connolly. So when we talk sometimes about retrieving 
information, archiving information, being able to produce 
documents or evidence with respect to a court case, we are 
relying in many cases on technology to be our friend that goes 
back 40, almost 50 years.
    Mr. Milholland. Obviously depending on the case, so to 
speak, if individual taxpayer data is being accessed, that 
architecture is that old. The access mechanisms might be more 
current.
    Mr. Connolly. Right.
    Mr. Milholland. But the fundamental underlying structure is 
reliant upon systems that were built in that era.
    Mr. Connolly. Okay. You come from private sector?
    Mr. Milholland. Yes, sir.
    Mr. Connolly. You are now the CTO for a public sector 
entity. Real quickly in the time I have got left, what would 
you do and what would it cost to do what you do to modernize 
and upgrade the IRS so it is functioning as a modern 
technology-oriented entity in 2016?
    Mr. Milholland. Yes, sir. I will try to be very brief. We 
built a technology roadmap. We did that a few years ago and 
have been executing against it for the future state; that is, 
to bring the IRS so it looks like a digital company in the 
financial area; that is, comparable to the way a large 
financial institution would operate. That means that we have to 
upgrade a number of the underlying processes which are based in 
these, as I say, the 1960s architecture, bring them into a 21st 
century architecture, and implement the technology that allows 
that.
    We have standardized on modern programming languages, for 
example. All new developments since I have arrived, they are in 
Java, for example, rather than the more ancient languages like 
assembly language, or COBOL, or these, I will just say, simply 
legacy programming languages. We have standardized on a 
different operating system, in our case, Linux, for example, a 
very modern operating system environment that is very common 
across all of private enterprise.
    And we have been slowly and steadily migrating new systems 
of what we have had to invest in to support things like FATCA, 
the Affordable Care Act, the Revenue Return Program, our fraud 
detection system, all are built, I will say, the right way so 
that we can slowly remove ourselves from dependencies on these 
older systems.
    And then the last comment I would make, we have plans to 
get off, so to speak, of that dependency. The Congress has 
supported us in our business systems modernization program in a 
program called CADE 2, Customer Account Data Engine. The second 
transition state of that is underway in which we are converting 
off of that master file system into a modern relational 
database program, at the same removing the financial material 
weakness of the older individual master file systems.
    Let me stop there because I could certainly go on and on 
and on.
    Chairman Chaffetz. I thank the gentleman. I would simply 
ask that the digital roadmap that you are talking about, if you 
could provide this committee that copy of this roadmap, I think 
we would both like to look at it. When you can provide that to 
this committee?
    Mr. Milholland. As soon as our release mechanism allows us. 
Soon if I can get away with that.
    Mr. Connolly. Mr. Chairman, if we could also to that 
request the cost. What would it cost?
    Chairman Chaffetz. Yes, that would be great because ----
    Mr. Connolly. Thank you.
    Chairman Chaffetz.--the IRS has had over the last 5 years 
more than $11 billion in just IT expenditures. It is a 
significant amount of money. We would appreciate you sharing 
that plan with us.
    Mr. Milholland. Mr. Chairman, could I add one other thing?
    Chairman Chaffetz. Sure.
    Mr. Milholland. The roadmap does not stand by itself. It 
goes along with a business plan which we call a future state 
vision, in which all of the businesses as outlined, how do they 
want to actually operate in the next 3 to 5 years, and then 
that roadmap supports that plan. So you would actually need to 
understand both.
    Chairman Chaffetz. If you could provide both, that would be 
appreciated.
    Mr. Milholland. All right.
    Chairman Chaffetz. Fair enough? And I appreciate it.
    Chairman Chaffetz. I thank the gentleman for his questions, 
and I am surprised after 23 hearings you still have questions.
    Mr. Connolly. It was a struggle, Mr. Chairman.
    Chairman Chaffetz. Yes. Yeah, you still have questions, and 
so do we. We will now recognize the gentleman from Ohio, Mr. 
Jordan, for 5 minutes.
    Mr. Jordan. Thank you, Mr. Chairman. Mr. Milholland, in May 
of 2013, the country learns that the IRS has been targeting 
conservative groups. Congressional investigations are 
announced. The President has a big press conference. The 
Attorney General announces that there is a criminal 
investigation that will be following. As the chief information 
officer, did you take any action to preserve information data 
and documents?
    Mr. Milholland. Yes, sir.
    Mr. Jordan. And what action was that?
    Mr. Milholland. We issued a directive to my staffs down 
through every level of management and individuals to hold onto 
every piece of information.
    Mr. Jordan. Was your order clear?
    Mr. Milholland. I certainly thought it was clear.
    Mr. Jordan. I am going to read from it. ``Do not reuse, or 
refresh, or wipe information from any personal computer that is 
being reclaimed, returned, refreshed, updated from any employee 
or contractor of the IRS. Effective immediately, the email 
retention policy for backups is to be indefinite rather than 6 
months.'' Pretty clear, right?
    Mr. Milholland. Yes, sir.
    Mr. Jordan. You go on in that email to say this, ``In other 
words, retain everything.'' Now, ``everything'' is a pretty big 
universe, so I do not know how you could be more clear. So the 
chairman has asked this a couple times. How in the world did 
the IRS end up destroying, with that clear directive, end up 
destroying 422 backup tapes that were extremely relevant to the 
investigation?
    Mr. Milholland. As you are undoubtedly aware having that 
email, TIGTA did their report out. They looked at every step of 
the process along the way of how did we end up doing that. In 
fact, I think I was quoted in there when they interviewed me as 
I was literally blown away by the fact that it had happened 
because, again, I thought the instructions were remarkably 
clear.
    Mr. Jordan. So I think they are clear, too, if I could just 
interrupt, Mr. Milholland. So I think they were pretty clear, 
too. So did you do anything else? Did you just send this email 
out or this directive out that says keep everything and then 
that was it? Is that all you did?
    Mr. Milholland. Within IT, the information technology 
organization, we discussed it with staff and with the executive 
team that we needed to do this. We were also in the midst of 
consolidating all the email servers that were sitting around 
the country into our two primary data ----
    Mr. Jordan. Let me interrupt again. I only got 5 minutes 
here. Were there other preservation orders that came to the 
Internal Revenue Service, other orders to preserve documents, 
not just the one you sent out internally, but were there others 
that come in from the outside?
    Mr. Milholland. I really do not know. You would have to ask 
the chief counsel about that.
    Mr. Jordan. Yeah, well, there were two, right? There was 
one from the Justice Department and one from TIGTA that said, 
hey, they want to just reinforce and preserve documents. So did 
you take any action relevant to those other orders to preserve 
all information?
    Mr. Milholland. I do not recall seeing those orders, so --
--
    Mr. Jordan. When the legal staff got the order from the 
Justice Department to preserve all the information, they did 
not say, hey, you better make sure we do not destroy anything. 
They did not communicate it to you, and then you did not 
communicate another email like the one we were just talking 
about.
    Mr. Milholland. I am totally unfamiliar with the order that 
you are discussing. We always have a practice generally when a 
request comes in that counsel needs us to hold onto items, they 
send an email around to the responsible individuals ----
    Mr. Jordan. Okay.
    Mr. Milholland.--and tell them to literally--sorry. Go 
ahead.
    Mr. Jordan. What about the subpoenas? This committee sent 
two subpoenas. Did that warrant or did that trigger you taking 
any further action than this one email that you sent?
    Mr. Milholland. No, sir.
    Mr. Jordan. So the two subpoenas and the other two 
preservation orders, the IRS chief information technology 
officer, that did not trigger you to do anything else. You sent 
this one email that I think is pretty clear, but that is all 
you did.
    Mr. Milholland. As I tried to express earlier, Congressman, 
we discussed the request to hold on to all of those items that 
were in that email throughout our staffs so the executive team, 
the management team, would understand how serious this was. 
And, therefore, to protect ----
    Mr. Jordan. So there is ----
    Mr. Milholland.--basically the retention of information.
    Mr. Jordan. I got it, yeah.
    Mr. Milholland. So it was reinforced constantly to do so.
    Mr. Jordan. So then why was it not? So there are two key 
questions. There are two questions, and I have got 30 seconds 
here. Two questions. One, when you say ``keep everything'' and 
then 422 tapes, 24,000 emails are destroyed, I want to know how 
that happened and why that happened. Second, this is the 
question I get all the time from folks back home. Who is held 
responsible? So there is an order given from the chief 
technology officer to keep everything, and it is not kept. In 
fact, it is destroyed. Who was disciplined? Who was held 
accountable? That is what we would like to know.
    Mr. Milholland. I will answer the second question first. I 
held myself accountable as it was reported in the TIGTA report 
that it starts at the top. I was at the top, and, therefore, 
myself and my management chain were held to be accountable. 
That was part of our performance plans and such and was 
discussed appropriately when we discovered this particular 
incident when it happened.
    Mr. Jordan. Let me just ask one other question. Did you get 
a raise the last few years? Have you had a raise in your 
salary?
    Mr. Milholland. Because I am in the senior critical, I got 
an adjustment because of this senior critical pay.
    Mr. Jordan. Did your pay go up?
    Mr. Milholland. Yes, it did.
    Mr. Jordan. The last 2 years?
    Mr. Milholland. I think only once in the last 2 years.
    Mr. Jordan. Who is your direct boss? Who do you report to? 
When I look at your chain of command, it looks to me like you 
report to Mr. Tribiano.
    Mr. Milholland. Mr. Tribiano.
    Mr. Jordan. And, Mr. Tribiano, your office is a direct 
report to the commissioner of the IRS. Is that right?
    Mr. Tribiano. Yes, sir.
    Mr. Jordan. All right. So what happened there? You find out 
this guy does an order, and that is as clear as it gets, retain 
everything. It is not followed. Tapes are destroyed, 24,000 
emails. That information comes to you. What did you tell Mr. 
Koskinen?
    Mr. Tribiano. Well, sir, I was not part of the IRS during 
that time.
    Mr. Jordan. What did your office tell Mr. Koskinen?
    Mr. Tribiano. I do not know what my office told Mr. 
Koskinen.
    Mr. Jordan. You come to the hearing, you know we are 
talking about record retention, and you do not know what 
happened?
    Mr. Tribiano. I did not say that, sir. I said I was not 
responsible, and I was not there.
    Chairman Chaffetz. The gentleman's time has expired.
    Mr. Jordan. Thank you, Mr. Chairman.
    Chairman Chaffetz. We will now recognize the gentlewoman 
from the District of Columbia, Ms. Norton, for 5 minutes.
    Ms. Norton. Thank you, Mr. Chairman. I understand that we 
are here talking about what we loosely call data preservation 
and security, but we are doing so for the IRS, where the data 
that we most want to keep to ourselves is to be found. I have 
often wondered how the IRS is able to attract the advance 
technical professional employees to do what needs to be done. 
You know, it is easy enough for us to tell you what you should 
do.
    So I am interested in exploring what we can do to make it 
possible for you to do what you are supposed to do. Now, what 
intrigued me was this notion of critical pay authority that 
allows the IRS--other agencies have it, too--to hire people who 
it would be very difficult to attract to the public service 
otherwise. Do I understand, Mr. Milholland, that you are a 
critical pay employee?
    Mr. Milholland. Yes, ma'am.
    Ms. Norton. Is it fair to say that in order to come to the 
IRS, you took a pay cut?
    Mr. Milholland. Yes, ma'am.
    Ms. Norton. Would that have been a significant pay cut?
    Mr. Milholland. Yes, ma'am.
    Ms. Norton. So when we look at how important this data is, 
I wanted to see how many people were in this position. I 
understand that you are authorized in these critical positions, 
that the IRS is authorized only for 168, only for 40 at one 
time. I am quite amazed at that. And even they can only serve 4 
terms. You would be lucky to keep them for 4 years. You would 
be lucky to keep them for 4 years when you consider how 
critical these people are. We do H-B1 visas that are so 
critical in our own country.
    Is my information correct that here are only 19, Mr. 
Milholland, of these critical technical people at the IRS at 
this point?
    Mr. Milholland. I can answer for the number in information 
technology. There are 11. I believe Mr. Tribiano can cover the 
rest.
    Mr. Tribiano. Yes, ma'am, we have 14. And I would just like 
to note, ma'am, that we do not have that authority anymore. 
That authority expired.
    Ms. Norton. Well, that was going to be my next question. I 
understand that this number, since they can only stay 4 years, 
that that number is depleted every time you get to the end of 
the 4-year term. And that critical person, even if they have 
not already left to go to some high tech company, has to go 
then.
    Mr. Tribiano. Yes, ma'am.
    Ms. Norton. And you have had no authority for at least 2 
years ----
    Mr. Tribiano. Yes, ma'am.
    Ms. Norton.--to hire people. That is why you are down to 
19.
    Mr. Tribiano. 14 in total.
    Ms. Norton. 14 for you, Mr. Tribiano, and ----
    Mr. Tribiano. No, 14 in total for the Agency, ma'am.
    Ms. Norton. Oh, for the entire Agency out of 168 that are 
authorized.
    Mr. Tribiano. Yes, ma'am. We lose one this year, and then 
the remaining 13 next year.
    Ms. Norton. This is malfeasance it seems to me, but it is 
on our part. I do not know how we could have gotten without at 
least authorizing. I do not know if there is enough funds even 
if authorized, but if you were able to even attract such 
people, you deserve our congratulations. But if we can continue 
to reprimand you for things you do not do in data collection 
while we do not recognize our responsibility to authorize you 
to have what I regard as a very small number of technical 
professionals on board, then there is a disparity here that I 
think the government has to take account of.
    Chairman Chaffetz. Would the gentlewoman yield?
    Ms. Norton. Yes, sir.
    Chairman Chaffetz. My understanding of this process is that 
the Office of Management and Budget has the opportunity to 
offer 800 people within the Federal government critical pay 
authority in consultation with the Office of Personnel 
Management. Of the 800 available slots for critical pay 
authority, they are only using 4. Not 400, 4 of the 800 that 
are already ----
    Ms. Norton. Where is this, in this Agency?
    Chairman Chaffetz. Well, throughout government. So if the 
IRS commissioner needs critical pay authority, for instance, 
for IT specialists, which I would probably actually agree with, 
there is already a process and authorization in place where OMB 
with OPM goes and gets that authorization.
    Ms. Norton. Well, I understand they do not even have to go 
through OPM. Is this authority authority that you think the 
Agency needs?
    Mr. Tribiano. Yes, ma'am. Streamlined critical pay is very 
important to us, and if we are able ----
    Ms. Norton. But do you think you have the authority? The 
chairman thinks you already have the authority.
    Mr. Tribiano. Not under what we had before, which is 
streamlined critical pay. What the chairman is referring to, I 
believe, is, if I understood right, is an OMB, I mean, an OPM 
process that exists for critical IT.
    Ms. Norton. But the people we are talking about do not have 
to go through that process, do they?
    Mr. Tribiano. Streamlined critical pay, no, ma'am. We would 
recruit directly from the private sector into the top IT 
positions.
    Chairman Chaffetz. If the gentlewoman would yield, if the 
IRS has a case, the mechanism that Congress previous to me had 
set up is that they make the case to the Office of Personnel 
Management or through the OMB. In concurrence, they can grant 
that all within the executive branch without having to come to 
Congress.
    Ms. Norton. But it expired 2 years ago.
    Chairman Chaffetz. No. Well, I will work with the 
gentlewoman to help clarify this, but I do believe it is 
currently available. The gentlewoman's time has expired, but I 
will work with the gentlewoman on this topic.
    Ms. Norton. I wish you would because the testimony has been 
pretty direct here that it has expired, and our own research 
shows it has expired.
    Chairman Chaffetz. Okay. Well, again, we will be happy to 
work with you. We now recognize the gentleman from Michigan, 
Mr. Walberg, for 5 minutes.
    Mr. Walberg. Thank you, Mr. Chairman. And just in reference 
to statements made earlier by a member of our committee 
concerning several senior-level administrators leaving under 
the guise of the challenges of doing the job here, remember 
some of those left under a rather dark cloud pleading the 5th 
under potential impeachment, et cetera. So we do not need to 
forget that also.
    Mr. Milholland, you mentioned that when finding out that 
your direct orders for preservation were disregarded, you were 
blown away. Coming from your experience in the private sector, 
extensive experience and background in the private sector, I 
would assume that orders like that would not have been 
disregarded clearly without significant consequence. So I do 
want to go back to a question made by a colleague of mine, Mr. 
Jordan, and just get a more direct answer. Do you know of 
anyone who was reprimanded for not following the preservation 
notice? Reprimanded or worse.
    Mr. Milholland. The way we handled the situation was 
waiting until the TIGTA report was in where basically, as I 
say, the TIGTA concluded there was no criminal wrongdoing, 
which was peace of mind. Someone did not deliberately set out 
to do this. And then, in reading through their report, what 
conclusion do you come to?
    As I say, management--me--took accountability for our 
management chain's failure to see that the instruction was 
followed. That then was dealt with through performance reviews 
and feedback to people for their whole entire performance 
through the appropriate chain and such. We did not penalize or 
punish anyone on the floor because they thought they were doing 
what they were supposed to do. They had received instructions. 
They were following a process, and ----
    Mr. Walberg. But the leadership team, any one reprimanded?
    Mr. Milholland. In the sense of in their performance review 
feedback, yes.
    Mr. Walberg. But no other consequences beyond that.
    Mr. Milholland. No other consequences, no, sir.
    Mr. Walberg. I doubt that in the private sector it would 
have been as simple as that. Let me move on. Let me move on. 
The taxpayer advocate recently released a report on the IRS 
future state plan that stated the IRS's intent to move all 
taxpayer filing and help systems to an online platform.
    In the last 9 months, the IRS has experienced at least two 
electronic data breaches surrounding taxpayer P-2s. This 
includes the May 2015 breach that exposed more than 100,000 
taxpayers' sensitive information. The taxpayer advocate also 
found that roughly 1 in 5 taxpayers who were victims of 
taxpayer identity theft had their IRS files closed. Despite 
unresolved issues remaining, taxpayers, in other words, still 
had to wait an average of 6 months before the negative impact 
of taxpayer identity theft was addressed.
    Mr. Tribiano, in light of these breaches, why does IRS feel 
that now is the best time to roll out a more expansive and 
pervasive online tax system?
    Mr. Tribiano. Well, sir, if I can just add one thing to 
that. We are not abandoning and going everything to digital or 
to online. We still have to take care of the taxpayers that 
still want to file paper returns and go that route. But the 
customers in this case, the taxpayers, have advocated for us, 
or for the IRS, to operate more as a large multinational type 
of bank to be able to do things online. As you can imagine, 
they would rather deal with us online more so than deal with us 
in person, so we are shifting.
    It is a 3- to 5-year process to go to where we want to go, 
what we call future state. And that is to be able to have 
interactions with the taxpayers electronically the way they are 
asking for it.
    Mr. Walberg. How do you propose to protect them, though, 
online?
    Mr. Tribiano. As we build out the technology, we are 
changing and adapting it, and I think Mr. Milholland can walk 
you through some of the things ----
    Mr. Walberg. Walk me through that, some of the means by 
which you can stop the breaches that could very clearly come 
that has taken place in person, but it could take place 
extensively online.
    Mr. Milholland. Yes, sir. We have an initiative we call the 
eAuthentication Authorization and Access Initiative. The first 
part of this is what we are doing to get transcripts back 
online. If you recall, with that original issue from last May 
and June, we took it offline until we could get it right; that 
is, the underlying authentication. Can we really identify that 
the individuals coming in are who they say they are. That work 
is underway. We hope to roll that application back up some time 
this spring.
    But we also have done other things that we started changing 
the way that we handle, I will say, the online environment. The 
particular technologies we, in fact, deployed as a result of 
the ``Get Transcript'' incident were, in fact, what allowed us 
to stop this bot attack from 2 weeks ago explicitly. The 
ability to capture and see that this attack was ongoing is a 
direct result of us improving that environment.
    A number of other tools and such are built into our cyber 
investment plan. It is what we are going to use some of the 
monies that are now made available to us from the Congress 
through an extra $290 million. About $100 million of that has 
been assigned to IT specifically for cyber. That is where the 
investments will be made. The President has certainly 
recognized it in his Fiscal Year 2017 budget submission for 
what he wants to do across the Administration. And then part of 
those monies will be used to improve aspects of the IRS online 
presence.
    There are a number of specific tools I could talk about 
here, Congressman. I do not know exactly ----
    Mr. Walberg. I appreciate this getting on record of what 
you are doing, and that down the road we will not be blown away 
by mistakes that come, but I want to make sure that this is 
taken care of. That is part of our oversight, and we want to 
make sure that you are doing oversight as well. I yield back.
    Chairman Chaffetz. The gentleman's time has expired. If Mr. 
Milholland can continue to provide the committee with what they 
are doing in that regard, we would appreciate it.
    I will now recognize the gentlewoman from New Jersey, Ms. 
Watson Coleman, for 5 minutes.
    Ms. Watson Coleman. Thank you, Mr. Chairman. Mr. 
Milholland, it has been almost 4 years since the committee 
launched its investigation of the IRS, and to date IRS has 
produced more than 1.3 million pages of documents from 88 
custodians in response to over 80 document and information 
requests. According to the information I have, on June the 3rd, 
2015, the IRS' senior privacy official testified before this 
committee. Is that you, Mr. Killen? Is that you?
    Mr. Killen. Not at the time.
    Ms. Watson Coleman. Okay, thank you. Well, let me read to 
you what was said. ``More than 250 IRS employees have spent 
more than 160,000 hours working directly on complying with 
investigations at a cost of $20 million, which also includes 
the cost of adding capacity to our limited information 
technology systems to accommodate the voluminous information 
requests.'' And that figure does not include that at least $2 
million additional have been spent by the inspector general. 
Mr. Milholland, what sort of capacity has been added to the IRS 
information technology system in order to accommodate this 
information and this investigation?
    Mr. Milholland. There is an investment plan to build out 
the entire process of record retention. This ranges from saving 
all of the email and all of its attachments, the archiving of 
information that are on hard drives in turn being saved. And 
the first elements of this, if we are able to complete our 
project, would start to roll out at the end of December, 
beginning of January.
    Ms. Watson Coleman. Do you have the resources and the 
personnel to be able to accommodate this effort?
    Mr. Milholland. At the current moment we do not. We have 
what we need to implement toward the end of this year, but for 
the long-term needs of the record retention initiative, to do 
everything that is being asked in the sense of build a system 
that can search for anything and do it instantly, that has not 
yet been, I will say, completely planned out, nor staffed, nor 
resourced.
    Ms. Watson Coleman. You have made some improvements because 
you were able to detect some suspicious behavior most recently 
in the system. And you do not have any reason to believe that 
that was anything terrorist related or anything of that nature 
or ----
    Mr. Milholland. Ma'am, are you referring to the bot attack 
that was 2 weeks ago?
    Ms. Watson Coleman. Mm-hmm.
    Mr. Milholland. I cannot speak to who it was. There is an 
investigation going on right now by the investigative side of 
TIGTA. This was done from international sites using malware 
placed on individual machines and servers that attacked the IRS 
attempting to get these e-file PINs, no other taxpayer data. In 
fact, the e-file PIN is not taxpayer data, so I cannot 
characterize who they were. They were, you know, more than 
likely criminals, but I cannot really say.
    Ms. Watson Coleman. After Mr. Maruca's file was detected, 
after there was this belief that it did not exist and then you 
found out that you had a backup to it, you all have done 
something that would ensure that this problem does not occur in 
the future until you can take care of it in a more 
technologically savvy way? You have made decisions that no 
information gets erased until after something happens, right? 
Until after what happens, and when would that happen?
    Mr. Milholland. Is that a question toward me? I just was 
not sure.
    Ms. Watson Coleman. Well, to whomever can answer it.
    Mr. Milholland. I was not sure if it was to the deputy 
commissioner.
    Ms. Watson Coleman. Well, if the deputy commissioner is the 
one that should answer it, I am fine with that. Thank you.
    Mr. Milholland. Okay.
    Mr. Tribiano. The answer to that, ma'am, is yes. We put a 
non-destruct order in for all hard drives and devices for all 
employees of the IRS when they depart the IRS, and we 
immediately back up the hard drive itself electronically so we 
would have two copies until we get to the long-term solution 
that Mr. Milholland was talking about.
    Ms. Watson Coleman. So minimally, would you say that you 
have a future desire to hold this information as long as we are 
responsible as citizens to hold our information at 7 years, 
that incredible 7 years that we are talking about, or is there 
something other that you all would be presenting?
    Mr. Tribiano. Well, I think that is a question for Mr. 
Killen.
    Ms. Watson Coleman. Mr. Killen?
    Mr. Killen. Thank you for the question. We are working 
vigorously to ensure that we migrate our records management 
practices from sort of the current state to where we need to 
get to, you know, in the future in order to be compliant with 
all of the respective guidances out there from NARA and from 
OMB.
    So principally, we have taken, you know, really a multi-
pronged approach at that. Mr. Milholland and Mr. Tribiano both 
talked about various aspects of that, but I think, you know, 
first and foremost, again, ensuring that we no longer wipe or 
----
    Ms. Watson Coleman. Erase.
    Mr. Killen.--sanitize existing hardware, ensuring that we 
have copies that are in place on the machines. But we are, in 
addition to that, we have put a process in place for our 
senior-most Agency officials throughout IRS at the executive 
level because those are the individuals most likely to create 
Federal records. And so, we have an approach that we have 
implemented called the Capstone approach to ensure that we 
maintain and appropriately archive those records of our senior-
most officials. At the same time, we are currently in the 
process of implementing a plan for December 2016 where all IRS 
employees' email accounts will be archived electronically. And 
that is per directives that we have ----
    Ms. Watson Coleman. Thank you, Mr. Killen.
    Chairman Chaffetz. The gentlewoman's time has expired. How 
convenient. December of 2016, then we will start that process. 
There we go.
    All right. I will now recognize the gentleman from 
Tennessee, Mr. DesJarlais, for 5 minutes.
    Mr. DesJarlais. Thank you, Mr. Chairman. Mr. Milholland, 
did the IRS hire a new director of the Office of Personal 
Responsibility in the past year?
    Mr. Milholland. I actually do not know.
    Mr. DesJarlais. Mr. Tribiano?
    Mr. Tribiano. We transferred an individual into that 
office.
    Mr. DesJarlais. Who was that?
    Mr. Tribiano. That is Mr. Whitlock.
    Mr. DesJarlais. Mr. Whitlock. Okay. And that is basically 
the director of the IRS ethics department, correct?
    Mr. Tribiano. It could be categorized as that, yes, sir.
    Mr. DesJarlais. Okay. Did they review this individual's 
history with the Department?
    Mr. Tribiano. With the Department of Treasury? I am not 
aware, sir.
    Mr. DesJarlais. Do you know why the individual's record 
would not be reviewed prior to hiring someone for this 
position?
    Mr. Tribiano. Why it was not sent to the Department of 
Treasury?
    Mr. DesJarlais. Why they would not review his record before 
hiring someone to oversee the IRS' ethics department.
    Mr. Tribiano. The Executive Resources Board would have 
reviewed the record before making the recommendation of the 
movement of that individual into that position.
    Mr. DesJarlais. Okay. Mr. Milholland, did that ring any 
bells? Are you aware of Mr. Whitlock?
    Mr. Milholland. Not at all, sir.
    Mr. DesJarlais. No knowledge of him?
    Mr. Milholland. No, sir.
    Mr. DesJarlais. That was not run by you, Mr. Killen?
    Mr. Killen. No, sir.
    Mr. DesJarlais. No. Okay. So the IRS hires a new director 
to head up their personal ethics program. And, Mr. Tribiano, 
are you aware that he has a history of illegally shredding 
documents?
    Mr. Tribiano. Sir, well, first, let me say I cannot 
discuss. There is an IG investigation. But our internal review 
that was done in 2005 found that Mr. Whitlock, there was no 
intent from that office, and that there was no wrongdoing in 
that process.
    Mr. DesJarlais. Okay. I have seen different reports. Mr. 
Milholland, would you be blown away if you learned that you 
hired an ethics director that had illegally shredded documents?
    Mr. Tribiano. Just for the record, this position does not 
report to Mr. Milholland. The position reports to the deputy 
commissioner for Service and Enforcement.
    Mr. DesJarlais. Okay. So you have not reviewed the TIGTA 
audit of the OPR that was completed while the individual was 
destroying taxpayer records, or you have not read the 
investigation record, or the record destruction, or 
whistleblower retaliation?
    Mr. Tribiano. No, sir. What I reviewed was our internal 
review of the process that happened. Again, I cannot discuss 
the TIGTA investigation, and our internal review showed that 
there was no wrongdoing by that individual. That individual did 
not order the destruction that was done by the acting director 
at that time.
    Mr. DesJarlais. Okay. I guess I am just kind of shocked 
that, you know, this is a person that the IRS hired to be the 
head of their Office of Personal Responsibility, and he has got 
this history, and no one on the panel today seems to know 
anything about him.
    Mr. Tribiano. He was transferred, sir. He has been part of 
the IRS. He was in there as the deputy director of that office, 
was transferred to head up another office for us, and then was 
transferred back in.
    Mr. DesJarlais. Is this typical of how the IRS handles new 
hires?
    Mr. Tribiano. He was a transfer, sir, not a new hire who 
has been with the IRS ----
    Mr. DesJarlais. So when somebody gets in trouble, they 
transfer him around. Is that how it works?
    Mr. Tribiano. I am not saying that, sir.
    Mr. DesJarlais. Okay.
    Chairman Chaffetz. Will the gentleman yield?
    Mr. DesJarlais. Yes.
    Chairman Chaffetz. Mr. Tribiano, you said there is a new 
non-destroy policy. When did that come into place?
    Mr. Tribiano. That came into place right after we found out 
that we had that gap with Mr. Maruca.
    Chairman Chaffetz. That you had destroyed things. So can 
you give me a specific time?
    Mr. Tribiano. January, sir. I do not know the exact date, 
but it was in January.
    Chairman Chaffetz. So just in the last 30 days?
    Mr. Tribiano. Yes, sir. When we realized we had the gap 
when Mr. Maruca before the ----
    Chairman Chaffetz. Why did you not put this in a policy 
when Mr. Milholland put this into place into 2013? Did you ever 
lift that non-destruction order, Mr. Milholland?
    Mr. Milholland. I have never lifted the non-destruct order 
for the tapes, the backup tapes, which we were dealing with at 
the time.
    Chairman Chaffetz. The gentleman from Ohio.
    Mr. Jordan. The chairman asked my question. When was the 
order rescinded that you wrote in 2013 which says effective 
immediately, email retention policy for backups is to be 
indefinite? So if it is indefinite, is that still in place?
    Mr. Milholland. Yes, sir. Email is saved indefinitely.
    Mr. Jordan. Well, but the key question is, what about the 
backup tapes. They are saved indefinitely?
    Chairman Chaffetz. If the gentleman will yield, it says, 
``Do not destroy, wipe, or reuse any of the existing backup 
tapes for email or archiving of other information for IRS 
personal computers.''
    Mr. Jordan. Okay. And our question is, was that rescinded 
in any way.
    Mr. Milholland. If I understand your question correctly, 
sir, no. What we have, we still back up email and ----
    Mr. Jordan. Okay. Good.
    Mr. Milholland. Excuse me. I am sorry. I am interrupting 
you.
    Mr. Jordan. No, if it was not rescinded, then why did you 
have to issue a new order that Mr. Tribiano just referenced?
    Mr. Tribiano. I believe what Mr. Milholland was saying is 
that ----
    Mr. Jordan. Is it so that you could have another one that 
people will not follow? I mean, that is our point. If you have 
one in place, obviously it was not followed. You said nothing 
is being rescinded, and Mr. Tribiano said just last month we 
issued a new order to preserve all documents and not destroy 
anything. Why was that necessary?
    Mr. Tribiano. The order that Mr. Milholland was referring 
to, the one that he did that was about backup tapes and 
disaster recovery tapes. What we are talking about is the 
cleaning of hard drives for recycling back into the IRS system 
for computers or for destruction when they go out. And the 
reason that is in place is because some of those hard drives 
contain 6103 data, so we cannot leave them around now for a 
longer period, so we have to secure them. So now with the new 
order we have to secure those hard drives, put them in a secure 
location, document them, and put them away because it has 
information on them.
    Chairman Chaffetz. And the time has expired. We are going 
to recognize Ms. Kelly here. But that is not what Mr. 
Milholland's memo of May 22nd, 2013. It says, ``Do not destroy, 
wipe, reuse any of the existing backup tapes or email or 
archiving of other information from IRS computers. Further, do 
not reuse, or refresh, or wipe information from any personal 
computer that is being reclaimed, returned, refreshed, updated 
from any employer or contractor of the IRS.'' I mean, it could 
be not be more explicit.
    Mr. Milholland. Again, Chairman, if I may, that was 
referring to our backup tapes of the email systems and all the 
information ----
    Chairman Chaffetz. You can dance around this all the time. 
You had a preservation order in place. You had a do not 
destroy, and you continued to destroy them. You have 
represented to the Department of Justice, and to the courts, 
and to the United States Congress that you are not doing this. 
This issue has never been fixed, and that is why we continue to 
have these hearings.
    We have gone way past your time. We will recognize the 
gentlewoman from Illinois, Ms. Kelly, for 5 minutes.
    Ms. Kelly. Thank you, Mr. Chairman. Mr. Killen, I wanted to 
talk about what the IRS is doing to ensure that document and 
preservation measures are being implemented so that we do not 
end up here again, which no one wants. It seems strange that we 
are having a full committee hearing because of one employee's 
hard drive, especially since all but 2 weeks of his emails were 
preserved. What is the current IRS policy with respect to 
document preservation for departing employees, and how long are 
their emails kept?
    Mr. Killen. Thank you for the question. As I stated a 
little earlier, we have essentially a multi-pronged strategy 
and approach that we are taking with respect to email. First 
and foremost, we have implemented the Capstone approach, which 
is an approach that has been developed by National Archives 
that is focused on your role within the organization, because 
you want to ensure that the senior-most officials in an 
organization who are most likely to create records, that those 
records are preserved.
    And so, about a year ago we implemented that process across 
IRS to ensure that our senior executives all across IRS, that 
we had the appropriate electronic preservation of those emails. 
And so, that has been in place for the last year, and that was 
really one of the significant early pieces of the strategy.
    Ms. Kelly. And how long are they kept?
    Mr. Killen. They will be kept, there are ranges. But for 
our most senior executives, they will be kept permanently. For 
sort of our second tier of executives on down, they will be 
kept for 15 years. And that is very consistent with a role-
based approach because you want to ensure that you have the 
preservation of records, you know, in the most appropriate 
fashion.
    So the second piece of that strategy related to email is 
that by the end of this calendar year, by December 2016, 
consistent with the directives that we have received from OMB 
that applies across the government, not just to IRS employees, 
we will ensure that all of our employee email is available in 
an electronically accessible environment. And then we are also 
taking a variety of other steps to shore up our other processes 
and procedures with regards to records retention for separating 
employees and for, you know, an entire gamut of issues that we 
are working towards. So we are making significant progress.
    Ms. Kelly. Okay. What is the IRS doing right now to ensure 
that an instance such the Maruca case does not occur again?
    Mr. Killen. Thank you for that question. So, again, as part 
of sort of the multi-pronged strategy that we have, because, 
you know, the key issue with Mr. Maruca is he separated from 
the Service.
    Ms. Kelly. Right.
    Mr. Killen. And so, we have a process in place now where if 
an employee separates from the Service, we are ensuring that we 
do not wipe the machine. In addition, we are making the copies 
of the machine. So really, you know, our whole approach around 
records management and retention is first and foremost ensuring 
that we follow the relevant guidance and directives that are 
out there. But then secondly, trying to, you know, build in 
multiple layers of redundancy so that we do what we can to 
reduce, you know, the likelihood of the human element where 
people make mistakes as well.
    Ms. Kelly. So would you look at this as your longer-term 
solution, or do you have other long-term solutions as it 
relates to hard drive inventory management?
    Mr. Killen. There is a very long-term solution because, you 
know, you can imagine the volume of records, and particularly 
as just in all walks of life, as we move more towards a digital 
environment. And so, you know, our first focus and emphasis is 
on email. We have paper records, as you might imagine, that we 
do a pretty good job of maintaining, but we have improvement 
opportunities there as well. But longer term, you know, there 
is guidance that talks about by 2019 the Federal government 
should be able to migrate to a place where all records are 
stored in that, you know, accessible electronic medium. Our 
focus is initially on email, but that will extend to, you know, 
all of the various avenues of record creation towards that 2019 
directive.
    Ms. Kelly. And once you get there, this will allow you to 
answer inquiries from Congress faster or FOIA requests? Do you 
feel like you will be faster at that?
    Mr. Killen. It will certainly help. It will certainly help 
because, you know, the first thing is that the documents have 
to be available certainly. But when you get beyond the actual 
availability of the documents, and when you talk in terms of 
document production, you also need to have the ability to 
search. And ideally you would want to have the ability to do 
key word searches because those are things that allow you to 
have, you know, very efficient document production.
    So my answer to your question is that having the 
documentation retained is a necessary predecessor first step, 
but there is also the need to have the ability to do, you know, 
adequate search, find, and redaction capability. And that will 
be a separate effort, but it certainly is one that we have our 
eye on as well.
    Ms. Kelly. I am out of time. Thanks.
    Chairman Chaffetz. I thank the gentlewoman. I will now 
recognize the distinguished and always dapper gentleman from 
South Carolina, Mr. Gowdy, for 5 minutes.
    Mr. Gowdy. Chairman Chaffetz, I appreciate your leadership 
on this issue as I do Chairman Jordan's. And for that reason, I 
would like to yield to the gentleman from Ohio, Mr. Jordan.
    Mr. Jordan. I thank the gentleman. Mr. Milholland, who told 
you to issue the May 22nd, 2013 order, or I think ``directive'' 
is what you called it.
    Mr. Milholland. The email we talked about earlier, sir?
    Mr. Jordan. Preserve all documents. In other words, retain 
everything. That email.
    Mr. Milholland. That was a request that came from Chief 
Counsel's Office, and the way to do it was to send an email out 
as quick as we could to the people involved dealing with the 
backup tapes and such.
    Mr. Jordan. And when you did that, did you like have just a 
couple people you were sending it to, or was it like send to 
everyone, send all?
    Mr. Milholland. Principally directed to the operations team 
who deal with the backup tape processes and such, but the IT 
staffs all knew about it.
    Mr. Jordan. And the chart that I see, you got five agencies 
or five groupings that answer to Mr. Tribiano. Were the heads 
of all five of those groupings sent your email plus all your 
staff, or just within your area?
    Mr. Milholland. It was just within IT.
    Mr. Jordan. Okay. Okay. I just want to be clear. And do you 
know if the commissioner at the time, Commissioner Werfel, knew 
about your directive to preserve all documents?
    Mr. Milholland. I am pretty sure he did because this was 
one of the subjects we were talking about, how we were going to 
protect ----
    Mr. Jordan. Okay. And then when Mr. Koskinen came on board, 
do you know if he knew about the directive that was in place 
and, as you have testified today, still in place? Did Mr. 
Koskinen know about that, and does he know that it is still in 
place today?
    Mr. Milholland. I cannot testify to that, but can I add one 
correction to my earlier statement?
    Mr. Jordan. Sure.
    Mr. Milholland. Okay. As I tried to say earlier--I may not 
have been very clear--that was intended to cover backup tapes 
for email and anything to do with anyone's information that 
dealt with attachments, calendars, and such. At the same time, 
we also were not allowing hard drives to go anywhere. We, in 
fact, locked up all of the TEGE employees' hard drives in a 
cabinet, so to speak, so they would not go anywhere and such.
    During the Windows 7 implementation 2 years ago and such, 
basically because of budgetary problems, we went and asked, 
hey, if we copy all the hard drives we have been saving, can we 
now reuse them so that we can implement Windows 7. And we got 
permission to do that, so in that sense those non-TEGE hard 
drives were reused. So in that sense, they were rescinded. I 
hope that is clear.
    Mr. Jordan. I mean, it is not, a lot of the stuff you said 
there. But nowhere in there did you talk about still how the 
backup tapes, which you said your order applied to, were 
actually ultimately destroyed. So that did not cover what he 
just described, at least I did not think so.
    Mr. Milholland. No, sir. I responded earlier describing how 
that happened through employee mistakes.
    Mr. Jordan. Okay. Well, we obviously know there were 
mistakes because you gave an order, and it was not followed, 
and tapes were destroyed, and information and data that is 
important to the investigation was lost. I am going to go back 
to the question I asked you in the first round. I want to be 
clear. So you received a bonus this year and last year?
    Mr. Milholland. No, sir.
    Mr. Jordan. You said your pay went up. So it was not a 
bonus?
    Mr. Milholland. I am capped salary wise. I do not receive a 
bonus.
    Mr. Jordan. How about this management team you referred to 
when I asked, you know, how this could happen that tapes were 
destroyed in light of your order, in light of your directive? 
Anyone on your management team, did they receive a bonus this 
past 2 years?
    Mr. Milholland. Yes, sir.
    Mr. Jordan. They did?
    Mr. Milholland. Yes, sir.
    Mr. Jordan. And do you okay that, or does that go up 
through Mr. Tribiano and then up to the commissioner?
    Mr. Milholland. It certainly comes through me. I believe it 
goes to a committee Mr. Tribiano sits on called the Executive 
Review Board.
    Mr. Jordan. Mr. Tribiano?
    Mr. Tribiano. Yes, sir. It starts at the division head 
area, so Mr. Milholland would gather up performance awards, not 
bonuses, and they would make those recommendations coming 
forward. I would get them. Either I agree or disagree.
    Mr. Jordan. Performance awards. If you get a performance 
award, that results in additional pay?
    Mr. Tribiano. It results in a performance awards, so, yes, 
sir, your pay. Not your pay salary pay, but your cash.
    Mr. Jordan. You get more money.
    Mr. Tribiano. Yes, sir, but it is not on a continuous 
basis. It is a one-time performance award.
    Mr. Jordan. Mr. Milholland said he takes responsibility for 
the fact he was blown away when this happened after his 
directive. His pay is topped out. He cannot go any higher. And 
the people on his management team who were responsible for the 
directive not being carried and for the backup tapes being 
destroyed all got performance pay increases. Is that accurate?
    Mr. Tribiano. I have to ask Mr. Milholland if he put them 
forward in that fashion.
    Mr. Milholland. Not all the managers and executives who 
report to me got pay increases or bonuses. I do not recall 
explicitly in the chain that led down to where this incident 
occurred what the actuals were.
    Mr. Jordan. But many of them did.
    Chairman Chaffetz. Will the gentleman ----
    Mr. Milholland. Probably, but I really do not know, sir.
    Mr. Jordan. I would be happy yield back.
    Chairman Chaffetz. The gentleman's time has expired. Will 
you provide that to this committee, Mr. Milholland?
    Mr. Milholland. If I am allowed to legally. I do not know 
if I am allowed to release personal information.
    Chairman Chaffetz. Well, when the United States Congress 
asks you, you have legal authority to provide that information 
to Congress. There is nothing classified about people's 
compensation and bonuses. Would you agree?
    Mr. Milholland. Not to me, sir, but I am not a lawyer, so.
    Chairman Chaffetz. Well, there are some positive qualities. 
I appreciate that. That is a real plus in your column. I get 
it. I am asking you all to provide this information to this 
committee.
    Mr. Milholland. Yes, sir.
    Chairman Chaffetz. Thank you.
    Chairman Chaffetz. I will now recognize the gentlewoman 
from New York, Ms. Maloney, for 5 minutes.
    Ms. Maloney. I thank the gentleman for yielding. And I 
would like to talk about another outage that was treated 
differently than one recently at the IRS, and that was one that 
many New Yorkers were concerned about. It concerned the New 
York Stock Exchange on July 9th of 2015, and a number of my 
constituents work there and suffered an outage that completely 
suspended all of financial trading for roughly 4 hours. And 
this committee sent letters to the SEC and to the Stock 
Exchange trying to understand the circumstances surrounding the 
outage. And they briefed our staff in July, and they told us 
that a software problem--it was basically a glitch--caused them 
to go offline in order to respond and to solve the problem.
    Now, the Department of Homeland Security in response to 
questioning by this committee reported that there was no 
suspicious activity, and the FBI saw absolutely no reason for 
any type of enforcement action. And since the committee 
received those briefings, we saw no reason to hold a public 
hearing or to hold an investigation since everybody involved 
said that it was merely a glitch.
    Yet we are going after the IRS today for a similar 
temporary and subsequently resolved website outage. And I just 
feel that there is a little bit of an unequal treatment, and I 
think we should not have unequal treatment. I mean, I will not 
suggest that the New York Stock Exchange should come in for a 
hearing. I am suggesting that we should not be having a hearing 
on a technical outage for any organization, and the IRS seems 
to be getting a little unequal treatment on this.
    And I would like to elaborate, Mr. Milholland, to ask you 
about an incident earlier this month when portions of the IRS 
website were shut down for roughly 30 hours. And I understand 
that some members of Congress thought, and questioned, and 
rightfully so, I think, in the world we live in that it was a 
cyberattack. But the IRS briefed our staff earlier this week, 
and they told us that this was definitely not a cyberattack. 
They told us, in fact, that it was just a mechanical hardware 
failure similar to what happened at the Stock Exchange, a 
glitch, a hardware failure.
    Now, is my description of what happened to the IRS somewhat 
correct?
    Mr. Milholland. Yes, ma'am.
    Ms. Maloney. So this was not a failure of an IRS 
information system, but just the failure of a singular piece of 
mechanical equipment, correct?
    Mr. Milholland. That is correct, ma'am.
    Ms. Maloney. And can you describe what sort of hardware we 
are talking about?
    Mr. Milholland. Yes, ma'am. Our Enterprise server is the 
primary engine for processing tax returns. It is made up of 
various components, including a storage subsystem, which has 
voltage regulators in it. Now, while the root cause analysis is 
still underway, it was those voltage regulators that failed. 
They are mechanical components that are under somewhat high 
stress conditions when the computer is operating. And over 
time, one of the modules that held the voltage regulators 
literally said I'm failing, called for an alert to the 
mechanic--that is, the technician--to come and fix it.
    During the process of attempting to fix the mechanical 
device, the redundant voltage regulator module also failed. 
Then it took time to restore the equipment to its natural 
state, bring the system back up so tax returns could be 
processed. Total outage time was roughly about 30 hours.
    No software was involved. No micro code. This was with 
absolute certainty not a cyberattack. It was a failure of 
mechanical device. What we are most interested is the root 
cause analysis as to why did the two fail relatively close 
together. That work is going on. I expect to have the root 
cause analysis, you know, within a week. I have a draft root 
cause analysis now, but it is not done. We have working 
questions with the supplier on this. But no question that this 
was a mechanical failure.
    Ms. Maloney. So mechanical failure, such as what the IRS 
experienced, is not unique to the IRS. It happens to many 
organizations. In fact, there was a highly publicized 
mechanical failure with the New York Stock Exchange which was 
similar. They went offline for a while to repair it. So I feel 
that there is a little bit of an unfair or unequal treatment, 
and maybe a little bit of a major focus on the IRS and 
questioning of the IRS for a long time that is not the same 
treatment that other organizations that handle a great number 
of filings experience. So I just wanted to point that out. The 
failures were very similar for the Stock Exchange and the IRS 
of mechanical equipment failure.
    In any event, my time has expired, and thank you for your 
testimony today.
    Chairman Chaffetz. Thank the gentlewoman. We will now 
recognize the gentleman from North Carolina, Mr. Walker, for 5 
minutes.
    Mr. Walker. Thank you, Mr. Chairman. Thank you, Panel. I 
appreciate you being here today.
    I want to go back to something that I heard a little bit 
earlier. First of all, I want to talk about something that 
Commissioner Koskinen has said repeatedly. His quote says, ``I 
believe that the underfunding of the Agency is the most 
critical challenge facing the IRS today.'' He has made this 
comment pretty much in several different speeches whether it is 
the Tax Policy Conference or other places where he is pretty 
adamant that that is a major issue.
    But something said earlier by one of my colleagues, I want 
to go back talking about the systems that you said that were 
dating back to John F. Kennedy time, I believe was the comment. 
It was not so much the application as it was the system. Would 
you repeat a little bit earlier and go into that for me just a 
minute?
    Mr. Milholland. Certainly. What they built back in the 
1960s for implementation in the 1970s was a system designed 
based around the technology that was available to them then.
    Mr. Walker. Sure.
    Mr. Milholland. That design still exists. Even though we 
are running the application now with much more modern 
underpinning--that is, this Enterprise server that we just 
discussed with the congresswoman ----
    Mr. Walker. Sure.
    Mr. Milholland.--the actual design of the application is 
still built upon that 1960s approach.
    Mr. Walker. And I appreciate you clearing that up, but that 
is not what Commissioner Koskinen said. What he said in his 
ploy to try to get more funding, more than the $11 billion 
already, he said, ``We have many applications that were running 
when John F. Kennedy was president.'' Is that an untruthful 
statement?
    Mr. Milholland. No, I think that is true. The application, 
individual master file, and the business master file, and a 
number of those other clearly legacy applications, while some 
of the platforms they run on have changed and the code has been 
updated numerous times due to legislation, the programming 
language is still the one that we had then.
    Mr. Walker. Well, he seems to be disagreeing with you on 
the code as well because he said, ``The code has been out of 
date so long, it has the unintended effect to keep hackers from 
hacking in.'' So is that just something he is not 
technologically current with that? I mean, are you running code 
from John F. Kennedy because it seems 50-something years ago we 
are still running those kinds of systems, and we are still 
operating with that code? Is that correct?
    Mr. Milholland. There are elements of the code that exist 
back that far, but the ----
    Mr. Walker. COBOL? FORTRAN? What are we talking about here?
    Mr. Milholland. COBOL, yes. COBOL programming language 
code. Assembly language code is the principle engine. While we 
have modified it numerous times with particularly legislation, 
the fact of the matter is that system was designed and built in 
the 1960s to start running in the 1970s. And so, you know, I 
believe that the commissioner is correct.
    Mr. Walker. Okay. Let me transition while I have got some 
time left. I am going to go back to Form 3210 that was filled 
out authorizing the destruction of Mr. Maruca's hard drive. If 
so, if that was ordered, who authorized the destruction of that 
hard drive?
    Mr. Milholland. What would have happened would be that--I 
must say ``presumed happened''--was whoever was checking out 
Mr. Maruca from the IRS would have called the IT organization, 
filled out a request to say take his IT assets and follow the 
normal disposition procedures.
    Mr. Walker. Did you assume that would have happened? Why 
was Mr. Maruca's hard drive not covered by the litigation hold 
the IRS put in place? Why did that not cover that?
    Mr. Milholland. At the time, I mean, he had left before 
that particular litigation hold was put into place.
    Mr. Walker. Well, did he take his stuff with him? Did he 
take the information with him?
    Mr. Milholland. It had already been entered into the 
process of disposition.
    Mr. Walker. Well, so what happens when he leaves? When an 
employee leaves, do their records get destroyed like this? I 
mean, what happened? Who made the decision? Who authorized 
that, to destroy what he was working on?
    Mr. Milholland. I am sorry. I really am not understanding 
your question.
    Mr. Walker. His hard drive, okay?
    Mr. Milholland. Pardon me?
    Mr. Walker. Mr. Maruca's hard drive.
    Mr. Milholland. Yes, sir.
    Mr. Walker. Who destroyed it? Who authorized it?
    Mr. Milholland. That would have followed the normal IT 
process of dispositioning of old equipment. And in that sense, 
the authorization is the IRS process.
    Mr. Walker. Is there a timeline for how long an employee 
leaves that hard drives are destroyed? Is there a standard on 
it?
    Mr. Milholland. No, there is not. It follows ----
    Mr. Walker. So it is up to discretion.
    Mr. Milholland. There is a lot discretion. There are a 
number of steps that are followed as to where it goes. Because 
we have had shortfalls in our staffing, oftentimes machines can 
sit around before they are disposed of. They may oftentimes 
even get so stacked up until someone gets to it.
    Mr. Walker. But his did not get stacked up. Mr. Chairman, 
my time has expired.
    Chairman Chaffetz. I thank the gentleman. I recognize the 
gentleman from Alabama, Mr. Palmer, for 5 minutes.
    Mr. Palmer. Mr. Chairman, I only have one question. 
According to a September 2015 inspector general report, the IRS 
spent $139 million in 4 years on upgrading its workstations 
from the outdated Microsoft XP to Windows 7, but you still 
missed the Microsoft April 2014 end of life deadline. I think 
you understand that using a supported version of Windows is 
critical to securing data. Yet according to a TIGTA report from 
September 28th, 2015, you have got approximately 1,300 
workstations that you either cannot locate or you confirmed are 
running an old operating system.
    My question is, where are you on locating those 
workstations and getting them updated?
    Mr. Milholland. I think there are a number of questions in 
your statement, sir, and I will try answering each one.
    Mr. Palmer. Well, just answer the one where you are on the 
status of locating those workstations and updating the 
software.
    Mr. Milholland. We got support from Microsoft to go beyond 
the original expiration of XP so we were not taking a risk with 
those particular workstations. Second, we took them off the 
network so they would be isolated, and would not, therefore, be 
possible to hack into them through, I will say, anyone having 
access to the network. Where we are with the actual remaining 
numbers, if I recall correctly, we are complete. I would have 
to double check that, sir, if I can get back to you.
    Mr. Palmer. Could you inform the committee where you are on 
that, and I would like to have that answer in 7 days. Can we do 
that?
    Mr. Milholland. Sure.
    Mr. Palmer. Mr. Chairman, I will yield the balance of my 
time to the chair.
    Chairman Chaffetz. I thank the gentleman. Mr. Milholland 
and Mr. Tribiano, it is May 2013. TIGTA issues its audit, and 
you issue an internal preservation order that is extensive. It 
is capped with ``in other words, retain everything to do with 
email or information that may have been stored locally on a 
personal computer.'' It is pretty broad, but also very 
definitive. Did you ever rescind that order? That is a yes or 
no question. Did you ever reverse that order?
    Mr. Milholland. I changed the order with, as I tried to 
explain earlier with a TEGE situation where we had to start 
using some of the hard drives that we were saving ----
    Chairman Chaffetz. Can you provide that ----
    Mr. Milholland.--in order to implement Windows ----
    Chairman Chaffetz. Can you provide that to this committee?
    Mr. Milholland. Provide which list, sir?
    Chairman Chaffetz. When you rescinded that, send that to 
this committee. Fair enough?
    Mr. Milholland. I will, yes.
    Chairman Chaffetz. Thank you.
    Mr. Milholland. Yes, sir.
    Chairman Chaffetz. Mr. Tribiano, did the IRS ever change 
that or rescind the order that Mr. Milholland put out to 
preserve?
    Mr. Tribiano. Not to my knowledge, sir.
    Chairman Chaffetz. After the issuance of that audit, did 
the IRS put any new procedures or policies in place regarding 
the preservation of emails, hard drives, or anything to do with 
people's interaction with the computers?
    Mr. Tribiano. That was during the time period where we 
initially started the Capstone Project, sir.
    Chairman Chaffetz. Okay. You started a project, but was 
there any change to the internal functionality of the 
preservation of computers, hardware, emails, that sort of 
thing? What changed?
    Mr. Tribiano. Sir, I was not there. I would have to go back 
and look at ----
    Chairman Chaffetz. Mr. Killen, what changed?
    Mr. Killen. So, following those events, again, in late 
calendar year 2014, early calendar 2015, we implemented the 
Capstone approach for our senior-most Agency officials. And so, 
that ----
    Chairman Chaffetz. All government records. You do not have 
to be a senior-most official at the IRS to generate a record 
that needs to be in compliance with the Federal Records Act or 
to be in compliance with FOIA. I want to know after TIGTA had 
issued their report in May of 2013, what did the IRS do 
internally to preserve and protect the records that they should 
have been protecting in the first place?
    Mr. Killen. Well, Mr. Chairman, I think that does represent 
a fairly substantive change, and ----
    Chairman Chaffetz. What does?
    Mr. Killen. Well, first of all, implementing the Capstone 
approach, you know. We had significant consultation with the 
National Archives ----
    Chairman Chaffetz. Do you feel it was fully implemented?
    Mr. Killen. The Capstone process that we initiated with our 
senior officials, yes, that has been fully implemented.
    Chairman Chaffetz. If the policy is in place, why was Mr. 
Maruca's information destroyed?
    Mr. Killen. Fair question. It is an issue of timing because 
we implemented the Capstone approach in actually late December 
2014. Mr. Maruca had already left the Service by that point.
    Chairman Chaffetz. So it takes you more than a year and a 
half to implement a new policy. How hard is it to just save a 
hard drive? I mean, how hard is that? How expensive is that? 
How much does a hard drive cost, do you know?
    Mr. Killen. I will defer to Mr. Milholland on that.
    Chairman Chaffetz. How much is a hard drive? You want two 
gigs.
    Mr. Milholland. $100 to $250, depending on the ----
    Chairman Chaffetz. Yeah, we are talking about a hundred 
bucks here. You got a $1.7 billion issue with Microsoft, and 
you all went out and destroyed something that is maybe a 
hundred bucks. Mr. Tribiano, you had to issue a new policy in 
2016, correct?
    Mr. Tribiano. A new policy was issued in 2016.
    Chairman Chaffetz. What does that policy do?
    Mr. Tribiano. We will not destroy any hard drives or mobile 
devices for any departing IRS employees, and we will copy the 
hard drives digitally to a server.
    Chairman Chaffetz. Congress has been investigating the IRS 
since 2011, and you are just now getting the memo to start 
preserving things in 2016? Why does it take almost 5 years to 
get the message that you should not be destroying things? Why 
does it take so long?
    Mr. Tribiano. Well, sir, I mean, we have a records 
retention policy ----
    Chairman Chaffetz. Yeah, but you did not follow it. You did 
not follow it. Mr. Maruca's stuff was destroyed, and it should 
not have been. And you are misstating the facts, by the way, 
because there was another case that they actually copied Mr. 
Maruca's, and then they happened to find that. I mean, I find 
it totally unbelievable. It truly is an unbelievable set of 
circumstances. 24 to 48 hours after this committee issues a 
bulletin that we are going to have a hearing, and then suddenly 
you find the information?
    And the Department of Justice had gone to the courts and 
said this stuff had been inadvertently destroyed, but then you 
actually did find it. Do you see why we have zero confidence in 
the record retention policy and the ability to execute on it?
    Mr. Tribiano. Well, sir, you said that I misled you, and if 
that is the case, that was not the intent, so I just want to 
clarify that. We did find those records, and we found it 
because of another litigation hold. I thought I made that clear 
in my opening statement. It was not because there was some 
other thing. It was pure coincidental that we had another 
litigation, and we ----
    Chairman Chaffetz. And coincidental and 24 hours after I 
issue a notice that you are going to have to come appear here, 
suddenly you do find them. That is what is unbelievable. You 
had gone to the courts via the Department of Justice and put it 
on the record that you did not have them. That was not true, 
was it?
    Mr. Tribiano. At that time that, that was true, yes, sir.
    Chairman Chaffetz. It was not true.
    Mr. Tribiano. Well, in hindsight it is not, but at the time 
that we went to them and said we might have an issue, it was 
true. When it was found that we did copy it for another 
litigation hold, we corrected it. We found that there was 
another litigation hold.
    Chairman Chaffetz. Okay. The gentlemen's time has expired. 
I now recognize myself or recognize Mr. Carter for 5 minutes.
    Mr. Carter. Thank you, Mr. Chairman. Mr. Milholland, help 
me out here. I am just trying to educate myself. What is the 
timeline between when an employee leaves the IRS and when their 
hard drive is erased?
    Mr. Milholland. Yeah, that timeline can vary from immediate 
to 6 months.
    Mr. Carter. What determines that? What determines the 
variation?
    Mr. Milholland. Where the person is when they leave. For 
example, if you are in ----
    Mr. Carter. I mean, what hallway they are in?
    Mr. Milholland. What office they are in. For example, the 
equipment, if it is picked up by IT, has to be shipped to 
another location. But if you are in the D.C. area, for example, 
it might happen very quickly and such. We typically send these 
devices to a particular data center for the degaussing once we 
separate the hard drive from the rest of the PC.
    Mr. Carter. Okay. When was Mr. Maruca's hard drive erased? 
What day?
    Mr. Milholland. The deputy commissioner can answer the 
details, but ----
    Mr. Carter. Okay.
    Mr. Tribiano. Well, we do not know the date, and I think 
that is what the problem is. We know we sent it or consolidated 
it on August 5th. We picked it up from the manager. We 
consolidated it with other hard drives and other laptops, and 
we sent it to our Memphis facility. It arrived in ----
    Mr. Carter. Now, where was Mr. Maruca because you said, Mr. 
Milholland, that it depended on what office he was in. Which 
office was Mr. Maruca in?
    Mr. Tribiano. Go ahead.
    Mr. Milholland. He was in D.C. as I ----
    Mr. Carter. He was in D.C. So you just said if he is in 
D.C., it ought to be pretty quick.
    Mr. Milholland. It could be depending, again, on the 
process being followed and the staff that we have to do that 
work. If there was an intent that we say, hey, we could reuse 
this device very quickly, then at that point we would separate 
the hard drive from the rest of the platform and put a new hard 
drive in.
    Mr. Carter. But in the case of Mr. Maruca, you do not know 
what day it was destroyed?
    Mr. Tribiano. No, sir. It was sent down to the Memphis 
facility, and it was stored down there with other laptops and 
other computers that were marked for disposal.
    Mr. Carter. Okay. So where it was sent down to, do they 
have a record of it? Can you call them and find out? I mean, 
surely they keep a record to tell you, okay, we destroyed this 
hard drive this day, this one this day.
    Mr. Milholland. No, sir. What we keep a record of is the 
asset. Once we separate the hard drive from the rest of the 
computer, the rest of the computer is sent off for salvage by 
an outside contractor.
    Mr. Carter. I am not worried about the rest of the 
computer.
    Mr. Milholland. Yeah, you are saying ----
    Mr. Carter. I am worried about what gets erased. It would 
just occur to me or it would appear to me that you would have a 
day on there, somebody would keep a day that said that this is 
the day it was erased.
    Mr. Milholland. Not necessarily, sir, because we do not 
view it as a major asset at that point. Its disposition, we 
have flagged for destruction. It is sent into the system. Okay, 
this ----
    Mr. Carter. Do you ever consider it to be an asset, an 
important asset?
    Mr. Milholland. Once it is flagged for disposition to be 
destroyed, no.
    Mr. Carter. Okay. And this is even after we have had the 
experience with Ms. Lerner and with her hard drive being 
destroyed and being wiped out. Even after that we still do not 
have in place when exactly we destroyed it. We still do not 
know. So you are telling me that is a matter of policy?
    Mr. Milholland. It is a matter of the workload and the 
resources we have to do that task.
    Mr. Carter. The workload and the resources.
    Mr. Milholland. Yes, sir.
    Mr. Carter. So everything is determined by the workload and 
the resources, not by its importance.
    Mr. Milholland. Well, the importance is that we had already 
decided that this particular drive could be, in fact, be 
destroyed. At that point it is deemed worthless, so it is 
stacked up with other hard drives.
    Mr. Carter. I just find it to be a very poor excuse about 
resources. I mean, it would seem to me like that you would have 
been really on your toes, especially in light of what has 
happened in the past. It would seem to me that you would want 
to absolutely know when a hard drive was destroyed or wiped 
out. I mean, you see where I am going here.
    I am just getting the impression from where I am sitting, 
it looks like the IRS is just taking the attitude, hey, we are 
above the law here. I mean, that is what it looks like to me, 
and I can imagine what it looks to a regular citizen who is 
being audited by the IRS. It is really confounding to me that 
we do not keep better records than this. It would appear to me 
the IRS, in light of everything that has happened in the way of 
hard drives being wiped out, that your policy would be better 
and that you would be keeping better records. So you can 
understand why the general public thinks, well, they think they 
are above the law here.
    I am just flabbergasted by this. Mr. Chairman, I do not 
know what to say except that I hope that you will take it as a 
lesson and understand that, you know, there are people out 
there who are being audited by the IRS who feel like they are 
being targeted, feel like they are being treated unfairly, and 
feel like the IRS thinks they are above the law. And in 
instances like this, you can understand why they feel that way. 
This is unacceptable.
    Mr. Chairman, I yield back.
    Chairman Chaffetz. I thank the gentleman. Myself and Mr. 
Jordan have just a couple of other questions, and we are going 
to wrap up the hearing. And members are advised we have votes 
on the floor soon.
    Since when has the IRS preserved all of its internal 
emails? When did they start to do that?
    Mr. Killen. So our internal email, again, there are nuances 
to it. So ----
    Chairman Chaffetz. You are either saving them all or not. 
Do you save all the emails?
    Mr. Killen. All our internal emails--all--are not being 
saved, but we have the plan in place in order to get there. All 
of our emails for our senior-most officials are saved. We have 
actually had substantial interaction with NARA, so I do want to 
get this point across that NARA ----
    Chairman Chaffetz. Hold on. I want to get to this point. 
You still to this day do not preserve all of the IRS emails 
internally. You do not save those.
    Mr. Milholland. May I answer that question, Mr. Chairman?
    Chairman Chaffetz. Yeah.
    Mr. Milholland. The answer is we save them on our backup 
tapes and have since that original email that Representative 
Jordan was referring to.
    Chairman Chaffetz. Then why did Mr. Killen just tell me 
that we do not do that?
    Mr. Milholland. I think he was referring to all the ----
    Chairman Chaffetz. No, no. He can tell you what he is 
referring to.
    Mr. Milholland. I am sorry, sir.
    Chairman Chaffetz. Mr. Killen, you just told me that they 
do not preserve all the emails.
    Mr. Killen. I think there is a distinction between what we 
have preserved on the network and what we have preserved via 
backup and disaster recovery process. And I think that is the 
distinction that Mr. Milholland was going to make.
    With respect to, because I do want to be clear about this 
point. The directive that we are under is that all email should 
be in an electronically accessible format by the end of 
calendar year 2016. That is the plan that we have implemented. 
That is the plan that we are on a trajectory to meet. But in 
the interim, and, again, this has all been a process that we 
have worked with NARA on. In the interim, our senior-most 
Agency officials' emails are being preserved, and that is sort 
of, I talked about this multi-pronged approach that we have 
implemented. That is ----
    Chairman Chaffetz. Is there anything, Mr. Milholland, that 
you would disagree with that he just said?
    Mr. Milholland. No, sir. We are going to be NARA compliant.
    Chairman Chaffetz. Here is the problem, okay? Here is the 
problem with the testimony. This is testimony from John 
Koskinen of June 23rd, 2014, and here is what he says: ``I 
would note, however, since the investigations into the 
application process for 501(c)(4) organizations began in May of 
last year, the IRS''--here it is--``the IRS has saved backup 
tapes for all emails on the IRS' servers, which includes tapes 
for the 6 months preceding May of 2013.'' And you are telling 
me that is not true, and that is why we keep coming after the 
IRS, and that is why we are not going to let go of this.
    I recognize the gentleman from Ohio.
    Mr. Milholland. Sir, could I make one statement, please?
    Chairman Chaffetz. The gentleman from Ohio.
    Mr. Jordan. If I could, Mr. Chairman, this will be my third 
time, and the right fine gentleman from North Carolina has not 
went. I just have two questions anyway, Mr. Chairman.
    Mr. Meadows. I will yield to the gentleman from Ohio for 
two questions, and then take up the balance. How about that?
    Mr. Jordan. Okay. So, Mr. Milholland, on March 4th when you 
discovered the tapes are destroyed, March 4th, 2014, the backup 
tapes are destroyed. You testified in the TIGTA investigation 
that you were blown away by the fact that your directive was 
not followed. What did you do then? And I guess specifically 
what I am asking is, did you have any conversations with your 
direct report, Mr. Tribiano's office, or the person who runs 
Mr. Tribiano's office, and/or Mr. Koskinen?
    Mr. Milholland. At that particular time, the TIGTA 
investigation was still going on, so I was not allowed to talk 
about the conversation I had with TIGTA until after the report 
was released.
    Mr. Jordan. Okay. So when you learned that the tapes had 
been destroyed, your directive was not followed, you had no 
conversation with the commissioner?
    Mr. Milholland. No.
    Mr. Jordan. Subsequent to when it became public, have you 
had conversations with the commissioner?
    Mr. Milholland. Yes, sir.
    Mr. Jordan. About this specific issue.
    Mr. Milholland. The general conversation around backup 
tapes, yes, sir, and that is what I was trying to correct 
earlier. We have retained backup tapes for indefinitely since 
that email was issued. Those are off of the exchange system, 
which is the primary email system of the Enterprise.
    Mr. Jordan. I get that, but I am asking more specific. Did 
you have a conversation with Mr. Koskinen and say, look, I gave 
a directive. It was not followed. 422 backup tapes were 
destroyed. We no longer have those records at all. Did you have 
that conversation with Mr. Koskinen?
    Mr. Milholland. No, I did not specifically.
    Mr. Jordan. Okay. One final one here. In your opening 
statement, this is Mr. Maruca's situation. His hard drive was 
designated for erasure before the issuance of the litigation 
hold. Is that right?
    Mr. Tribiano. Yes, sir.
    Mr. Jordan. Okay. Yet you said later that his data was, in 
fact, though, backed up because you had another litigation 
hold.
    Mr. Tribiano. Yes, sir.
    Mr. Jordan. So why didn't the previous litigation hold 
prevent you from destroying the hard drive?
    Mr. Tribiano. Because the data was backed up, and it was 
sent to the digital. What happens is when the attorneys request 
the information, it goes into their--I might be calling it the 
wrong thing--their e-Discovery system where they can access the 
data and do whatever they need to do for discovery purposes.
    Mr. Jordan. And just to be clear, a litigation hold does 
not trigger preservation of hard drives. That only triggers it 
goes to a backup?
    Mr. Tribiano. No, sir. It preserves the records for use in 
the litigation.
    Mr. Jordan. And the best record would be the hard drive, 
not the backup. But under this situation, you did not do that.
    Mr. Tribiano. The records are what was on the hard drive 
and backed up at that point in time.
    Chairman Chaffetz. Will the gentleman yield?
    Mr. Jordan. Sure.
    Chairman Chaffetz. Then why did the Department of Justice 
on behalf of the IRS go to the court and say these records had 
been destroyed?
    Mr. Tribiano. Because at that time that we notified the 
Department of Justice, we did not know that we had the backup 
of that hard drive for that other litigation. So we told the 
Department of Justice that we did not have the hard drive.
    Chairman Chaffetz. And you have no records of what you 
destroy and when you destroy it, correct?
    Mr. Tribiano. That is correct. What we know is that on 10/
27, it was received in Memphis, and between that period and the 
period of April 16th, I believe, when the shell of the computer 
was delivered to the third party vendor, it was during that 
time period.
    Chairman Chaffetz. How convenient. You have no records of 
what is destroyed and when, and yet you require every American 
to keep all their records. That is what so fundamentally wrong 
and screwed up with the IRS. That is just wrong. And there a 
lot of good people that work at the IRS, but you know what? You 
go after Americans, but you do not take care of business at the 
IRS. It is just wrong. It is just wrong.
    And it causes mess. We are talking about a $1.7 billion 
case, and you guys cannot keep track of what you destroy and 
when you destroy it. How hard is it to put a log in there, 
``destroyed this one at this time?'' How long does that take? I 
mean, you can go to Best Buy and buy something off the shelf 
for like 50 bucks. I just do not understand that. Do you have 
an answer for that?
    Mr. Tribiano. I do not think it would be that difficult, 
sir.
    Chairman Chaffetz. Then why is it not done?
    Mr. Tribiano. I can turn that over to the Mr. Milholland 
who runs the IT shop and runs those procedures, and ask what 
that would mean from a staffing perspective and from a 
documentation perspective. But I think what Mr. Milholland 
alluded to was that it is an asset, and it is kept into the 
assets, and it is kept into the system up to the point where it 
is marked for disposal. And at that point it stops.
    Chairman Chaffetz. I yield back to the gentleman from North 
Carolina.
    Mr. Meadows. Thank you, Mr. Chairman. Mr. Milholland, let 
me tell you the issue that most Americans have with this. 
Storage is cheap. I mean, we have gotten to a point where even 
storage of millions of records is really cheap. We have gotten 
to a situation where it would have been so much easier when the 
first hearing happened, not 24 hearings later, but the first 
hearing, to say, you know what? Gosh, we are going to have this 
problem. We had better preserve everything. What precluded you 
from doing that, from preserving everything at that point? When 
Lois Lerner first came in here and took the 5th, what stopped 
you from saying let us just preserve everything?
    Mr. Milholland. I cannot recall the subject ever coming up, 
sir.
    Mr. Meadows. Now, you cannot recall the subject coming up. 
It was in the headlines, I mean, almost every major newspaper, 
and the subject did not come up about keeping it? And yet your 
testimony today says that you are NARA compliant. Would you 
care to revise your statement, because I do not believe that 
you are NARA compliant at this point. Having the National 
Archives underneath my subcommittee, I would probably beg to 
differ with that. So would you like to revise your ----
    Mr. Milholland. I would ask that Mr. Killen to respond to 
whether or not we are NARA compliant since that is his area of 
expertise.
    Mr. Meadows. All right. So are you NARA compliant?
    Mr. Killen. We are generally NARA compliant.
    Mr. Meadows. No, there is a ``yes'' or ``no.'' 
``Generally'' is if I am speeding and I generally go below the 
speed limit I do not get a ticket. But only those couple of 
times that I go beyond the speed limit I actually do get a 
speed limit ticket. Tell me, are you compliant or not?
    Mr. Killen. Well, I have to speak to the wording of the 
report, I mean, because we have had NARA reviews. And so, 
certainly we have opportunities for improvement, and ----
    Mr. Meadows. Then you are not NARA compliant.
    Mr. Killen. But on the whole, NARA has opined that we are 
generally ----
    Mr. Meadows. You are making progress I think is what they 
are saying.
    Mr. Killen. We are certainly making progress, and we have 
opportunities ----
    Mr. Meadows. But today you are not NARA compliant, which 
means that all communication would be preserved, would it not?
    Mr. Killen. We certainly have work to do.
    Mr. Meadows. Okay. So if you have work to do, then you can 
revise your statement that you are NARA compliant because 
obviously you are not.
    Mr. Milholland. In that sense, you are correct, sir.
    Mr. Meadows. All right. So let me go a little bit further, 
and I am going to piggyback on what the chairman talked about. 
Mr. Killen, why is it taking so long? I mean, why is this 
taking so long for us to get it right? Why December of 2016?
    Mr. Killen. Well, I think that the 2016 date is predicated 
on the OMB directive. That does not extend to just IRS.
    Mr. Meadows. So it is OMB's fault.
    Mr. Killen. No, no, it is not an issue of fault. It is an 
issue of what is the origin of the December 2016 date. And the 
origin of that December 2016 date is the OMB directive that 
says that all Federal agencies should have email in an 
electronically accessible format.
    Mr. Meadows. So it would not have anything to do with the 
change of Administration.
    Mr. Killen. I could not speak on that. I do not ----
    Mr. Meadows. Well, do you not find it curious that December 
2016 and Administration change would happen within 20 days of 
that date?
    Mr. Killen. I really cannot speak on that.
    Mr. Meadows. Okay. All right. So let me go on a little bit 
further because part of this whole hearing process has been 
other types of communications. And you all have been very 
careful to say ``email communications,'' but there are a number 
of other electronic communications that go on the system and go 
back and forth. Is that correct, Mr. Milholland?
    Mr. Milholland. Are you referring to instant messaging, 
sir?
    Mr. Meadows. Yeah. I mean, do you not have substantial 
communications among some senior-level people at the IRS that 
happens outside of email?
    Mr. Milholland. Yes, sir. There are obviously phones. There 
are ----
    Mr. Meadows. Okay. How about on text messages or instant 
messaging?
    Mr. Milholland. Actually I do not actually ----
    Mr. Meadows. You do not. Does anybody there use instant 
messaging?
    Mr. Tribiano. I do not, sir. It is on our system.
    Mr. Meadows. Yeah. You know, our gray hair probably throws 
this away, but I will go to the end. Mr. Killen, I am sure you 
do, do you not?
    Mr. Killen. I certainly do.
    Mr. Meadows. I figured you would, so it may be a general 
thing. But, Mr. Killen, do you use that instant messaging to do 
anything more than ``is it time to go to lunch or a coffee 
break?'' I mean, do you conduct business on instant messaging?
    Mr. Killen. Generally speaking, I do try to be careful 
about what I ----
    Mr. Meadows. Has there ever been a case where you have used 
instant messaging for business?
    Mr. Killen. I am sure there probably has been.
    Mr. Meadows. Yeah. And so, here is the issue, Mr. 
Milholland, and I am going to finish with this. Storage has 
become cheap. Backup tapes are becoming a thing of the past. I 
remember backup tapes, and I do not understand why with the 
amount of money that we are spending that we are still using 
backup tapes, unless they are just such legacy programs that we 
have to use the backup tapes for storage.
    We are committed to providing the resources. What we have 
not seen is the commitment to really get serious about 
preserving everything like Commissioner Koskinen has said he 
would do. And until we see that, we are going to take issue. 
Does that make sense?
    Mr. Milholland. I understand you, sir.
    Mr. Meadows. All right. I will yield back.
    Chairman Chaffetz. I thank the gentleman. The committee 
stands adjourned.
    [Whereupon, at 3:18 p.m. the committee was adjourned.]


                                APPENDIX

                              ----------                              


               Material Submitted for the Hearing Record
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]


                                 [all]