Booz Allen Tech Contractor Took IRS Job Specifically to Leak Trump's Tax Records

The US Treasury Department announced yesterday that it was canceling all contracts it holds with consulting firm Booz Allen Hamilton because the company failed to prevent one of its contractors from stealing and leaking tax records years ago when he was working on behalf of the firm for the Internal Revenue Service.

In a press release, Treasury Secretary Scott Bessent announced that the unusual move was in response to Booz Allen contractor Charles Littlejohn, who stole the tax returns of more than 400,000 US taxpapers between 2018 and 2020 and gave some of them to the media. Bessent said that canceling Booz Allen's contracts "is an essential step to increasing Americans’ trust in government."

The announcement didn't identify which records Littlejohn stole or which media outlets received them, but court records and previously published stories about his case reveal that he stole tax returns for President Donald Trump, Jeff Bezos, Elon Musk and other billionaires and leaked them to the New York Times and ProPublica. Between them, the two outlets published dozens of stories in 2020 and 2021 based on the records, which showed, among other things, how little in federal taxes these and other super-rich Americans had paid on their massive earnings over the years, as well as the strategies they used to achieve this.

Although the leaks occurred several years ago, and Littlejohn was sentenced to five years in prison in January 2024, the announcement yesterday adds new dimensions to the case.

This is the first time I'm aware that a major federal agency has cancelled significant government contracts over an infosec leak.* Even after another Booz Allen contractor – Edward Snowden – stole and leaked a massive cache of documents he downloaded from computers belonging to the National Security Agency, Booz Allen retained its federal contracts with the spy agency. So the cancellation yesterday is significant. The Treasury press release says the department currently has 31 contracts with Booz Allen "totaling $4.8 million in annual spending and $21 million in total obligations," all of which will now go to someone else.

This prompted me to go back and examine the court records for Littlejohn's case, which I didn't follow at the time his sentencing occurred, to understand how he managed to steal more than 400,000 taxpayer records without being detected.

In those documents, prosecutors allege that Littlejohn took the contracting job with the IRS specifically to leak tax records to the media. This is similar to Edward Snowden who told the South China Post in 2o13, after he went public with his leaks, that he specifically sought a Booz Allen contracting position with the NSA in order to gain access to information about the government's surveillance programs and leak it to the media.

According to the court records, Littlejohn, who was 38 at the time of his 2024 sentencing, worked in on and off for Booz Allen (identified in the documents only as Company A) between 2008 and 2013, principally on contracts that Booz Allen had with the IRS. The work gave him access to vast amounts of "unmasked" taxpayer records in IRS databases. He took time off in 2013, according to a memo his attorney filed with the court, because his younger sister was diagnosed with cancer and he returned to St. Louis, Missouri to help care for her. After her death that year, he quit his job and moved back to Missouri from Washington, DC.

In 2016, during the presidential election campaign, the subject of then-candidate Trump's tax returns became a hot topic. Democratic presidential nominee Hilary Clinton released her 2015 tax returns weeks before the election, but Trump, the Republican presidential nominee, refused to follow suit.

Two days after his January 2017 inauguration, President Trump reiterated that he would not release his tax return, and the New York Times reported at the time that he was the first president to refuse to do so since the 1970s. According to Littlejohn's attorney, his client felt it was "morally wrong" for the president to withhold the records from the public.

According to prosecutors, Littlejohn then sought to return to Booz Allen in DC with the "hope and expectation" of getting a contract with the IRS that would provide him with access to tax returns for a "high-ranking government official" whom he viewed as "dangerous and a threat to democracy” and leak them. Although prosecutors don't identify the government official in their statement of facts, the memo filed by Littlejohn's attorney identifies the official as President Trump.

Littlejohn doesn't deny this motive for returning to work in DC. According to his attorney, he actually applied to two different consulting firms "that might put him on a project to access the President’s tax returns," and Booz Allen chose to rehire him. It did so in September 2017, but it took another few months before the consulting firm to assign Littlejohn to an IRS contract.

In February 2018, he was back in a position with access to IRS taxpayer data but didn't immediately steal records. Prosecutors say he developed a "sophisticated" scheme to download the documents nine months later. This included not searching directly for the documents related to the government official, which might have triggered an alert, but to query the database "using more generalized parameters." Prosecutors don't specify the search terms Littlejohn used, but they note that the search parameters he used would have produced not only the tax records of the government official he sought to expose, but also those of other taxpayers he wasn't targeting. By November 2018, he had extracted 15 years worth of tax records for President Trump, per the court documents.

Because IRS protocols can detect and prevent "large downloads or uploads from IRS systems and devices," according to prosecutors, Littlejohn avoided copying the records to removable media such as a USB stick – as Edward Snowden had done when he took documents from NSA servers. Instead Littlejohn "exploited a loophole in those controls" by transmitting the stolen tax records to a private website that he controlled, which was not accessible to the public.

It's not clear how the IRS system could have been configured to detect and prevent "large downloads or uploads from IRS systems and devices" and not also detect and prevent large transfers of data from an IRS server to a private web site server – unless perhaps the domain name and IP address for Littlejohn's web site were such that they resembled a legitimate IRS system and therefor the transfer didn't trigger an alert. But this is just speculation on my part.

In any case, Littlejohn then used a personal computer to download the data from his website and store it on an Apple iPod. The document notes that he used his "specialized technical skills" to configure the iPod into a storage drive.

Six months later, in May 2019, he contacted reporters at the New York Times to talk about leaking the IRS data belonging to the government official to them, and sometime between August and October he provided them with with the IRS records. Prosecutors note, and Littlejohn's attorney agrees, that after speaking with the Times reporters, Littlejohn continued to extract even more Trump records from IRS databases to give to the Times.

On September 27 that year, the Times published the first of several stories about Trump's tax records, but did not identify the source who provided the records that were the basis for the story. Times Editor-in-Chief Dean Baquet published a note accompanying the story explaining the reason for publishing the information.

"Every president since the mid-1970s has made his tax information public. The tradition ensures that an official with the power to shake markets and change policy does not seek to benefit financially from his actions," Baquet wrote. "Mr. Trump, one of the wealthiest presidents in the nation’s history, has broken with that practice. As a candidate and as president, Mr. Trump has said he wanted to make his tax returns public, but he has never done so. In fact, he has fought relentlessly to hide them from public view and has falsely asserted that he could not release them because he was being audited by the Internal Revenue Service."

The following year, in July and August 2020, Littlejohn decided to extract more records from IRS servers pertaining to "thousands of the nation’s wealthiest people, including returns and return information dating back over 15 years." His attorney suggests it was happenstance that brought him to this action:

"While working with the New York Times on the analysis of President Trump’s tax records," he writes in his memo to the court, "Mr. Littlejohn noted an anomaly in the data: earlier versions of certain IRS databases truncated numbers with large numbers of digits (for example, registering $1,230,000,000 as $230,000,000). This led Mr. Littlejohn to run queries for taxpayers with large gains and losses to try to figure out the issue with the database. After repeatedly observing tax records of ultra-high net worth taxpayers with relatively small tax payments, Mr. Littlejohn became increasingly focused on the systemic inequality."

In June of 2020, he created a query to pull "the top 500 taxpayers by income by year for the past 15 years" from IRS databases. He used two virtual machines to receive the data (virtual machines are simulated versions of a computer rather than physical computers) then erased the virtual machines after he was done with them. Prosecutors don't say how many records the search produced or how many Littlejohn extracted.

He contacted a different media outlet this time, ProPublica, and in September that year physically mailed the documents to the outlet on a password-protected USB drive. After communicating with a reporter there, he disclosed the password to a reporter there, and in June 2021, ProPublica began publishing a lengthy series of stories based on the tax records Littlejohn had provided.

Littlejohn's attorney says his client obtained assurances from both the New York Times and ProPublica that they would securely store and handle the documents before he provided them with the records. This included in-person meetings with the Times reporters to discuss how they would secure the records and report on them.

For all of this, the Justice Department charged Littlejohn with just one count of unauthorized disclosure of tax returns. He was charged under a statute that imposes criminal liability on IRS contractors and employees who willfully disclose any tax return or tax return information to an unauthorized person. The charge carries a maximum sentence of five years, but based on the sentencing guidelines and Littlejohn's lack of a criminal record and other factors, he was reasonably expected to get a sentence of between 8 and 14 months. He was sentenced instead to five years.

The fact that the Justice Department, under the Biden administration, charged him with only one criminal count garnered a lot of criticism from Republican lawmakers at the time. They implored the court to "throw the book" at Littlejohn and give him the maximum sentence, which the court did. Shortly after his sentencing, in February 2024, Littlejohn notified the court of his intention to appeal the sentence as unfairly harsh.

This brings us to this week, and the Treasury Department's decision to cut Booz Allen contracts.

After Littlejohn's sentencing in 2024, the IRS began to reveal the total impact of the breach when it sent out notices to 70,000 individual and corporate taxpayers who the department said were impacted by it. That figure has since changed. Last February, the IRS informed the House Judiciary Committee that Littlejohn had stolen and leaked tax data for at least 405,427 taxpayers, not 70,000. The following month, the Judiciary committee, angry over the "sweetheart plea deal" that the Justice Department under the Biden administration had given Littlejohn, sent a letter to Littlejohn's attorney calling him to testify before the committee about the breach and his sentence. Littlejohn's attorney declined, however, citing the 5th Amendment due to the fact that he's appealing the sentence.

"The testimony that you seek from Mr. Littlejohn directly implicates his Fifth Amendment privilege against self-incrimination," his attorney wrote.

In November, a DC Circuit Court panel heard arguments from Littlejohn's public defender seeking to vacate his 5-year sentence. The Trump Organization has inserted itself in the case by seeking permission from the court to weigh in on Littlejohn's request for an appeal, given that President Trump was impacted by Littlejohn's leak.

"The Trump Organization has a distinct and vital interest in the outcome of this appeal. As one of the intended targets of Littlejohn's corrupt scheme, his actions severely impacted The Trump Organization," the Trump Organization wrote in its request to the court. "Littlejohn unlawfully disclosed highly sensitive and confidential tax records of President Trump, his family, and hundreds of Trump Organization-affiliated entities and employees to multiple mainstream media outlets. This breach represents an unprecedented violation of trust, and any reduction of Littlejohn's sentence would overlook the real and tangible harm suffered by his victims."

In the meantime, a taxpayer impacted by the breach has sued Booz Allen and has so far defeated an attempt by the consulting firm to get the case dismissed.

Following the Treasury Department's announcement yesterday about the cancellation of Booz Allen's contracts, the consulting firm released a statement saying:

“Booz Allen has zero tolerance for violations of the law and operates under the highest ethical and professional guidelines. When Littlejohn’s criminal conduct occurred over 5 years ago, it was on government systems, not Booz Allen systems."

The company further noted that it "stores no taxpayer data on its systems and has no ability to monitor activity on government networks" and that it had fully supported the government's investigation into the breach and the prosecution of their contractor.

"We look forward to discussing this matter with Treasury,” the statement concluded.

*If readers know of any other cases where a federal consulting firm lost all of its contracts with a government agency due to an infosec breach, please let me know.