The hunt for Lois Lerner’s emails

140613_lois_lerner_gty_605.jpg

Lois Lerner’s emails and hard drive were all destroyed. Or maybe not.

The case of the former IRS official’s lost emails became more complicated this week after a top agency official said he’s no longer 100 percent sure there are no back-ups. Those comments veered from prior IRS statements on the issue that has revived the tea party targeting controversy.

Atop that, some technology experts are raising questions about a new court-ordered IRS account of what happened to Lerner’s hard drive because it does not include typical documented proof of device destruction.

“Where is the paper trail?” asked Barbara Rembiesa, the head of the International Association of Information Technology Asset Managers, a nonpartisan trade group of IT professionals. “There is a certification of destruction any time a piece of equipment is sent to a disposal company. … Where is that?”

( Also on POLITICO: IRS official: Lerner emails could exist)

The IRS would not comment on whether such documents exist.

It’s in this context that IRS Commissioner John Koskinen returns to Capitol Hill on Wednesday, summoned once again by House Oversight Republicans for an update on the circumstances surrounding the disappearance of two years’ worth of Lerner’s emails.

Lerner’s admission in May 2013 that the agency inappropriately used search terms like “tea party,” to review applications for tax breaks, which led to long delays, set off the furor last year. The former head of the tax-exempt unit in Washington has since stepped down and has been held in contempt of Congress by the House.

The new questions are bubbling up as lawmakers and courts seek to verify IRS accounts that Lerner’s emails were lost in an accidental 2011 computer crash. D.C. District Court Judge Reggie Walton, for instance, called for more details before deciding whether to appoint an independent computer forensics expert to dig up details about the lost emails, a decision that’s yet to be handed down.

The IRS has released emails documenting Lerner contacting the IRS help desk and other tech professionals when her computer crashed.

( Earlier on POLITICO: IRS accounts for lost emails)

Koskinen has said his agency has destroyed no evidence and that the IRS jumped through hoops to try to save her data but that ultimately, Lerner’s emails and the hard drive were lost and are gone for good.

The task before them now is proving it. That’s going to be tricky because Koskinen told lawmakers the IRS can’t release much detailed information until the investigation being conducted by the Treasury Inspector General for Tax Administration is finalized.

But that doesn’t mean skeptics aren’t going to try to get answers.

Oversight Chairman Darrell Issa (R-Calif.) will undoubtedly hit Koskinen with questions about why IRS Deputy Associate Chief Counsel Thomas Kane told the committee he’s now unsure whether all the back-up tapes with Lerner’s lost correspondence were recycled. Koskinen in June Hill testimony “confirmed that back-up tapes from 2011 no longer exist.”

( Earlier on POLITICO: Republicans separate in IRS probe)

And add this to the mix: Ways and Means Committee Republicans on Tuesday afternoon said in a press release that they have learned from interviews that Lerner’s hard drive was merely “scratched,” that it was at one point labeled as recoverable and that “in-house professionals at the IRS recommended the Agency seek outside assistance in recovering the data.”

Republicans also said that unnamed “former federal law enforcement and Department of Defense forensic experts” told them that most of the data on a scratched drive should have been recoverable.

Cleta Mitchell, a lawyer for the conservative group pushing for an outside forensic specialist, has said the IRS court declarations filed on Friday fall short because they’re not the first-person accounts the judge requested. They were written by the heads of the IT and criminal divisions, and the names of the IRS experts who worked on Lerner’s computers were not mentioned.

Some in the tech world are watching closely.

“Without the certificate of destruction, we don’t know if it was officially destroyed or not,” said Tim LaFleur, another IAITAM member with multiple asset management certifications.

Whenever an electronic device is destroyed, he said, IT asset managers are supposed to keep a “certificate of destruction” describing the obliterated item, who authorized the destruction, how it was destroyed and when.

Several tech experts said the IRS should have such documentation confirming the destruction of Lerner’s hard drive, which was sent to an unnamed outside disposal company after being wiped clean, according to the written IRS testimony filed with the D.C. federal court Friday.

“From a purely contractual standpoint, if you send something over to a contractor, you would have to get a statement back saying they actually completed the work to actually pay them … because then you would know that it was destroyed,” said longtime top government tech official Karen Evans, the OMB administrator for e-govenrment and information technology for the Bush administration.

Rembiesa says the courts or lawmakers should subpoena those records if they want to know for sure what happened to Lerner’s computer.

Her trade group said investigators should want proof of destruction because if the hard drive wasn’t completely destroyed, top forensic specialists might trace the device and recover the emails stored on the hard drive.

“The only way [to totally destroy a hard drive] is breaking it into a million pieces — short of that, you can still pull stuff off of it,” LaFleur said, arguing that forensics today can still recover data on hard drives that have been “baked in a fire, burned to a crisp and even dropped in water.”

In its testimony Friday, however, top IRS IT officials said that a forensic expert with 25 years of experience couldn’t get the data back. The declarations also stated that after multiple attempts to recover Lerner’s data, the IRS wiped Lerner’s computer clean — standard government procedure for computers that contain sensitive information — thew it into a pile with other problem devices and sent it to a disposal company that “typically” shreds machines.

“Shredding” often includes physically pulling the device apart, separating the parts and melting the metal down for re-use. It can also mean drilling holes it the object.

But it’s unclear if that was actually done because the documentation hasn’t been released, the professionals say. Some disposal companies, for example, re-use some machines if they’re able to fix them — it all depends what is required in the government contract.

Further complicating matters: Ways and Means on Tuesday said it reviewed “internal IRS IT tracking system documents” and found that Lerner’s computer was actually once described as “recovered” — but it is unclear what the panel is referring to since they have not released the document publicly. If true, however, that contradicts what the IRS has told Congress and a federal judge about the hard drive being recoverable.

The IRS may encounter one roadblock in providing documentation for the hard drive’s destruction: The agency says it did not track the serial number of its employees’ hard drives — something that was surprising to Evans.

“I would think they would keep the serial number,” she said.

But it’s possible that the outside disposal contractor could verify the IRS’s destruction account. The IRS has learned the serial number from Lerner’s hard drive from the contractor in which they purchased the device.

Using that, Evans thinks they should be able to confirm the disposal contractor that finished off the machine for good: “I would think that a contractor that does this kind of stuff would document the serial numbers of the hard drives that came from the IRS, so it is possible that when they then submitted the invoices to the IRS, it could include those serial numbers.”