How Trump, other high earners had their taxes leaked

An IRS consultant who stole former President Donald Trump’s and other wealthy people’s private tax information took a series of steps to avoid detection, new court filings show.

Instead of searching the IRS’s tax return database directly for Trump’s documents — something that would have tripped agency alarms — Charles Littlejohn used “more generalized parameters that would nevertheless” yield the filings, the government says.

Littlejohn uploaded the data to a private website, rather than using a flash drive or a conventional remote-storage website, “to avoid IRS protocols designed to detect and prevent large downloads or uploads from IRS devices or systems.”

He then downloaded the documents from the private website onto a personal computer. Littlejohn stored the data in various places, including his iPod.

Littlejohn gave Trump’s returns to the New York Times. He later anonymously mailed a personal data storage device containing thousands of other wealthy people’s information to ProPublica.

The filings shed new light on the question of how Littlejohn, who has pled guilty to stealing and disclosing the data, was able to pull off one of the biggest security breaches in IRS history.

It is exceedingly rare for tax returns to leak, and the sheer size of the disclosures had astonished agency veterans.

The department has elaborate safeguards as well as a deeply ingrained culture of protecting taxpayer privacy. It is illegal for IRS employees to even browse people’s returns, and workers have been fired for peeking at ex-spouses’ filings.

Initially, many IRS veterans suspected computer hackers were behind the leak.

But the court documents indicate Littlejohn was able to repeatedly steal tax data over the course of more than a year without particularly elaborate trickery.

The government does not describe a motive or indicate how Littlejohn was discovered. He faces up to five years in prison, though his plea agreement suggests he will likely get between eight and 14 months in prison and face a fine of up to $40,000.

Sentencing is slated for January.

Littlejohn is getting a "slap on the wrist," House Ways and Means Committee Chairman Jason Smith (R-Mo.) complained Monday.

"To restore trust in the justice system and the IRS — and to deter future thefts — there needs to be significant consequences for this type of illegal, politically motivated activity," Smith said in a statement.

Littlejohn worked at an unnamed consulting firm where he had access to “vast amounts” of taxpayer data thanks to its contract with the IRS.

Prosecutors say Littlejohn first began uploading Trump’s returns sometime around late November 2018. He appears to have sat on the documents for a time, with the government saying he did not contact the New York Times until May 2019.

He gave the newspaper the filings sometime between August 2019 and October 2019. Littlejohn later went back in early 2020 and stole additional tax information about Trump, which he also turned over to the Times.

In late September 2020, shortly before the presidential election, the newspaper published a blockbuster report showing Trump frequently paid little or nothing in taxes.

That summer, Littlejohn also began collecting thousands of returns of other wealthy people going back 15 years that he would give to ProPublica.

“In uploading the taxpayer returns and return information to a private website, Defendant used two virtual machines (essentially simulated versions of physical computers),” prosecutors say. “In order to conceal his activities, Defendant promptly destroyed these machines after he used them to steal the data from IRS.”

Sometime around September 2020, Littlejohn contacted ProPublica “to discuss the possibility of giving them a copy of the data.” Soon thereafter, he anonymously mailed it a password-protected personal storage device containing the information.

Around November 2020, he provided a reporter there with the password to the device.

In June 2021, ProPublica published the first in a series of stories on the tax filings of Jeff Bezos, Elon Musk, Michael Bloomberg and a string of other wealthy people. Many paid little or nothing in tax.

Meantime, the government says Littlejohn took other steps to evade detection.

“Almost all of the files in Defendant’s user profile on his assigned IRS laptop computer were deleted just prior to the laptop being returns to the IRS” when Littlejohn stopped working on the contact in 2021.

“In addition, after uploading the taxpayer returns and return information to the private website he had recently created, Defendant prompted contacted the domain registration service to cancel the private website’s domain registration.”