10.5.5. IRS Unauthorized Access, Attempted Access or Inspection of Taxpayer Records (UNAX) Program Policy, Guidance, and Requirements

(1) Since the inception of the Integrated Data Retrieval System (IDRS) in 1972, IRS has worked continuously to prevent and detect unauthorized access, attempted access and inspection of taxpayer records (UNAX) in all IRS internal and external computer systems.

(2) After UNAX concerns were reported in 1993, the Service implemented an information system to perform detection analyses of audit trail information.

(3) On August 5, 1997, the Taxpayer Browsing Protection Act (Public Law No. 105-35) (codified at 26 U.S.C. (IRC) 7213A, 7431) was signed into law, making willful unauthorized access or inspection of taxpayer records a crime. “Upon conviction, penalties can include fines up to $1,000 and/or up to one year in prison (together with the costs of prosecution), as well as termination of employment for federal employees. This law also established the right of taxpayers to seek civil damages in federal court.”

(1) Taxpayer Browsing Protection Act (Public Law No. 105-35).

(2) IRC 7213A, Unauthorized inspection of returns or return information.

(3) IRC 7431, Civil Damages for Unauthorized Inspection or disclosure of returns and return information.

(1) IRM 10.5.5.3 through IRM 10.5.5.3.4 contain UNAX roles and responsibilities for:

1. Servicewide applications

2. The IRP office

3. IRS managers

4. Head of Office Designee (HOD)

5. Contractors and Contracting Officer’s Representative (COR)

6. IRS employees

(1) IRP in PGLD manages the UNAX Program through the following reviews and reports:

1. Annual Review of UNAX Awareness Briefing – formal review of mandatory briefing which includes updates when needed, and development of new UNAX vignettes periodically to keep employees engaged and mitigate potential UNAX violations.

2. ALERTS Statistics and Metrics – Retrieve extract from Automated Labor and Employee Relations Tracking System (ALERTS) and analyze extract to assess Servicewide statistics and metrics for unauthorized access including the number of employees that were removed, resigned, prosecuted, suspended, cleared, or had other administrative actions taken.

(1) UNAX Certification – The Service requires employees to complete the Annual UNAX Mandatory Awareness briefing and certify they completed the briefing regardless of whether they have access to taxpayer information. Every employee is responsible for protecting the confidentiality and privacy of taxpayer information.

(2) Annual UNAX Completion Report – review information from HCO regarding completion rate for mandatory briefing cycle and share July – October completion reports with business units points of contacts.

(1) UNAX: The willful unauthorized access, attempted access or inspection of taxpayer returns or return information.

(2) Employee: Includes all IRS personnel. Also includes all contractors who have staff-like access. .

(3) Staff-like access: This is when a contracted individual is granted access to IRS facilities or IRS systems, or has opportunity to be exposed to IRS information.

(4) Covered Relationships: Personal or outside business relationships that can raise questions about the employee’s impartiality in the handling of a tax matter.

(5) Inspection: The terms "inspected" and "inspection" mean any observation, review, or examination of a return or return information (paper or electronic).

(6) The following table contains definitions for the acronyms most commonly used in this IRM:

(1) UNAX Knowledge Base site at: https://portal.ds.irsnet.gov/sites/vl003/lists/unax1/landingview.aspx.

(2) Document 10281, Safeguarding Taxpayer Records Renewing Our Commitment - UNAX Employee Booklet.

(3) Document 12612, Stop UNAX In Its Tracks.

(4) Document 12692, UNAX If/Then Chart.

(5) Document 11500, IRS Manager’s Guide to Penalty Determinations.

(1) The IRS is committed to preventing the willful unauthorized access, attempted access, and inspection of taxpayer records (UNAX). The UNAX Program Office’s mission is to ensure all employees:

1. Understand what UNAX is.

2. Understand what the consequences of accessing, attempting to access, or inspecting taxpayer records or tax information (electronic or paper ) for other than management authorized tax administration reasons.

3. Work to prevent all instances of UNAX violations. Please refer to the UNAX Knowledge Management site for additional information: https://portal.ds.irsnet.gov/sites/vl003/Lists/UNAX1/DispItemForm.aspx?ID=1

(2) The UNAX Program Office must develop and implement a Servicewide UNAX Program in partnership with TIGTA, HCO, IT Cybersecurity, and other stakeholders that includes:

1. UNAX education

2. UNAX detection through analysis of accesses to IRS systems and unauthorized access complaint investigations

3. UNAX policy compliance .

(3) The UNAX Program Office must, in partnership with TIGTA, HCO, IT Cybersecurity, and other stakeholders take action to:

1. Mitigate weaknesses in programs and systems that lead to low UNAX compliance rates.

2. Identify areas for compliance improvement.

3. zProvide training

4. Implement other measures designed to foster voluntary UNAX compliance to include periodic communications, outreach ad hoc training and UNAX Forums

5. Reduce willful unauthorized access, attempted access, and inspection of taxpayer records.

(4) The UNAX Program Office must:

1. Update, administer and maintain the IRS UNAX website containing information, policies, procedures, forms and links that support the UNAX Program .

2. Manage the Servicewide Annual UNAX Awareness Briefing Certification Program to include:

Item	Description
I	Review and update, in partnership with all stakeholders, UNAX briefing materials to keep information current, relevant and effective;
ii	Track the numbers of employees who take the annual UNAX mandatory briefing, and provide relevant statistical data to IRS executive leadership;
iii	Request Senior officials to designate UNAX coordinators for their respective organizations on a yearly basis;
iv	Provide instruction and guidance to business unit UNAX points of contact (POCs) prior to and during the annual Servicewide mandatory briefing cycle to ensure accurate reporting of the numbers of employees who complete the briefing;
v	Prepare and deliver reports to senior officials that track the numbers of employees who take the mandatory briefing , and
vi	Contact business unit POCs who have low rates of compliance, requesting their employees complete the UNAX briefing.

3. Notify taxpayer victims when a person is charged criminally by indictment or information with unauthorized inspection as required by IRC 7431(e). Notification letters will be sent to victims to alert the taxpayer of permissible next steps.

4. .

5. Provide all managers the guidance and tools needed to help them maintain an ongoing dialogue with their employees about UNAX violations and the consequences and penalties for willfully accessing, attempting to access, or inspecting taxpayer records for other than authorized tax administrative duties as officially assigned by management.

6. Respond to inquiries from managers, employees and taxpayers concerning UNAX reporting requirements and other UNAX inquiries or refer them to other UNAX subject matter experts and stakeholders as appropriate.

7. Educate Senior officials and managers that all employees returning to work after UNAX disciplinary actions must complete UNAX mandatory briefing and UNAX recertification before they may access any system with taxpayer information.

8. Develop and distribute comprehensive "just-in-time" Servicewide communications for all employees to assist them in understanding the importance of the mandatory Annual UNAX Awareness Briefing and the rules for certifying that the briefing was completed.

(1) Managers must take an active role to prevent willful and attempted unauthorized access, and inspection of taxpayer information in electronic and paper form. This involves overseeing employees’ work as well as continually stressing the importance of protecting and securing taxpayer records.

(2) IRS Manager’s Guide to Penalty Determinations (Document 11500) states that managers may be subject to written reprimand, suspension or removal for failure to adequately instruct, train, or supervise employees in their responsibilities for record and information protection.

(3) Managers must communicate with employees on a regular basis to ensure they are aware of UNAX prohibitions and the penalties. Communication also ensures employees know how to document and report inadvertent or unintentional access.

(4) Managers are responsible for the timely and thorough review of available system security reports. Managers must report suspected UNAX violations or any unusual activity to TIGTA for investigation.

(5) Managers must monitor and ensure that employees have access to IRS internal or external computer systems containing taxpayer information only when necessary to complete their IRS officially assigned duties.

(6) Managers must ensure employees who are being investigated for UNAX violations are promptly removed from IDRS and any other IRS computer system requiring administrative approval and containing taxpayer information. Managers must also ensure these employees are removed from other tax related duties.

(7) Managers must ensure that employees who do not have access to Integrated Talent Management (ITM) complete and submit Form 11370, Certification of Annual UNAX Awareness Briefing, after manual completion of the UNAX Briefing.

• Managers of IRS employees are required to sign Form 11370 and submit it to their UNAX Point of Contact for processing.

• Managers of contractors are required to sign Form 11370 and submit it to their Contracting Officer’s Representative (COR).

(8) Managers must sign and timely submit Form 11377 or Form 11377-E, Taxpayer Data Access, to the designated head of office designee. Form 11377 or Form 11377-E are used to document accesses to taxpayer information not supported by direct case assignment or which may otherwise appear questionable. A manager’s signature on this form does not imply authorization for documented accesses. The access may still be subjected to further review and investigation.

(9) Managers must make fair and timely reassignments whenever an employee reports having a covered relationship with an individual or organization in an assigned tax matter which may create a conflict of interest. Form 4442, Inquiry Referral, may be used by the employee to request such reassignments, thus avoiding a conflict of interest.

(10) Managers must educate employees to avoid UNAX violations, and ensure employees know the consequences of their actions.

(11) Managers must lead by example.

(12) Managers must ensure their employees’ access of IRS internal or external computer system is:

1. Controlled through Business Entitlement Access Request System (BEARS) approval process.

2. Granted only when required to complete official duties.

3. Removed when no longer required to complete official duties.

(1) All HODs are responsible for protecting the confidentiality and privacy of taxpayer information to which they have access.

(2) The HOD receives Form 11377 or Form 11377-E from managers and prepares them for storage.

(3) The HOD must return all unsigned forms to appropriate manager for employee signature.

(4) The HOD is responsible for uploading signed Forms 11377/11377-E into the Taxpayer Data Access Library where they are maintained for six years.

(1) The Manager of Record (MOR) or Contracting Officer’s Representative (COR) is responsible for ensuring contractors with staff-like access meet the mandatory briefing requirements. Upon on-boarding, all contractors with staff-like access must complete PGLD mandatory briefings which include Unauthorized Access (UNAX), Privacy, Information Protection and Disclosure (PIPD), and Records Management (RM) within 5 business days of being granted staff-like access and then repeat the training annually thereafter. For a definition of staff-like access see IRM 10.5.5.1.6(3).

(2) If the contractor does not have access to ITM, CORs must enter the training information into ITM so the contractor receives credit for completing the training. All CORs are responsible for collecting, signing, and retaining Forms 11370, Certification of Annual UNAX Awareness Briefing, received from contractors. Certification forms must be stored in a locked container, security container or a secure room, wherever the location. For more information, please see IRM IRM 10.2.18, Physical Access Control, and Internal Revenue Service Acquisition Policy 1052.

(1) All IRS employees (including managers, executives and contractors who have staff-like access) are responsible for protecting the confidentiality and privacy of taxpayer information to which they have access. Employees are responsible for understanding what UNAX means and what the potential consequences are for the willful unauthorized access, attempted access, or inspection of paper or electronic taxpayer records. If they are uncertain whether access or inspection is appropriate, they should first consult with a manager, TIGTA, or send questions via email to *UNAX. Employees are only allowed to access tax return information when it is needed to carry out their assigned tax administrative duties and there is no covered relationship.

(2) Employees are prohibited from browsing or inspecting a celebrity or politician’s return or return information without authorization constitutes a UNAX violation with potential for fines, imprisonment, and dismissal. Employees have no legitimate tax-related reason to access the account of a celebrity or politician unless they receive the matter through official channels or in the normal course of business. Celebrities (such as a person who is famous, widely known, or frequently in the media/of media interest, e.g., music industry, sports, entertainment, etc) when the information is not needed to carry out tax related duties.

(3) The IRS relies on the ethics and integrity of its employees and enlists their support in eliminating "all" cases of UNAX.

(4) Employees are encouraged to fill out and sign Form 11377 or Form 11377-E by close of business on the day of the inadvertent or questionable access (electronic and paper) and forward the signed copy to their manager to document certain inadvertent or questionable accesses that could include one of the following:

• Accessed electronic or paper tax return information in error (such as accidentally entering an incorrect taxpayer identification number).

• Accessed electronic or paper tax return or tax information of another IRS employee on an assigned case before recognizing the individual as someone known to the employee.

• Accessed electronic or paper tax return or tax information on an assigned case of an individual or organization before recognizing it as belonging to a person or business with whom the employee has a personal or business relationship.

• Researched another taxpayer's information because it was related to an assigned case.

• Received requests from management to access taxpayer information on cases not assigned to the employee.

(5) Employees must:

• Review and apply the guidance within this IRM, the Employee's Guide to Safeguarding Taxpayer Records - Renewing Our CommitmentDocument 10281 and other UNAX directives.

• Take the Annual UNAX Awareness Briefing and complete the certification documentation either online or by filling out Form 11370, Certification of Annual UNAX Awareness Briefing, if the briefing was not completed online.

  Note: When employees complete the annual UNAX Awareness Briefing outside of the Integrated Talent Management (ITM) system, they must submit Form 11370 to their managers for signature and processing.

• Timely refer cases to management when the employee's personal or business relationship can raise questions concerning a lack of impartiality in handling a tax matter. (Please see covered relationships in IRM 10.5.5.5 for additional information). Employees should use Form 4442, Inquiry Referral for this purpose.

• Inform their managers when approved access to an IRS internal or external computer system is no longer required to complete IRS officially assigned duties.

• Report any suspected UNAX violation to their local TIGTA office or to the TIGTA toll free hotline at: 1-800-366-4484. TIGTA is responsible for investigating all UNAX allegations. IRS employees are protected by law from reprisals when they have reasonable cause to report suspected UNAX violations to TIGTA;.

(6) Employee must refrain from:

• Accessing returns and return information of other employees known to them unless approved in writing by management.

• Accessing or asking other IRS employees to access information of individuals with whom they have a covered relationship. See IRM 10.5.5.5, Covered Relationships.

• Accessing tax returns or tax return information in any IRS internal or external computer system (e.g., IDRS, AMS, TDS, RUP, EUP, etc.) unless the access is necessary to complete their official IRS duties as assigned by management.

• Accessing tax returns or tax return information on a personal computer if they are not authorized to access the information on their work computer. For example: An IRS employee had formerly held a position as an accountant prior to becoming employed by IRS. He kept his access to the IRS Registered Users Portal (RUP). The employee then accessed tax return information on the RUP of a former client using his personal computer when performing his IRS official duties. This is an unauthorized access of the taxpayer record and a UNAX violation. IRS employees can only access those accounts assigned to them by IRS management as part of their official IRS tax duties.