Leadership1 publisher3 min readPublished
OPM's five-bullet email ultimatum sent the IRS privacy chief into damage control
IRS privacy chief Kathleen Walters had to contain the risk of 100,000 staff answering OPM's February 2025 email asking what they did last week. In the Guardian's account, the all-staff order landed first on the office built to stop disclosure.
The Board Room · Leadership desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction

What happened
- The email, sent from hr@opm.gov, asked for about five bullets of last week's work, copied to a manager, with a deadline of 11:59 pm on the Monday.
- Walters ran a 650-person privacy staff charged with keeping IRS employees from leaking or improperly viewing any of 266m tax returns.
- When DOGE's Gavin Kliger turned up unannounced nine days earlier, Treasury, which cleared new political appointees, had no record of him.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- exposure Staff who read the email as a test of their jobs had two options: a vague answer that might count against them, or a full one that could break the law.
- constraint With about 154 employees per privacy staffer and a two-day deadline, the office had little room to reach everyone before replies went out.
- exposure When entry skips both Treasury clearance and OPM's knowledge, an agency's own HR chief becomes the working check on who gets IRS phones, laptops and system access.
- decision Any leader planning an all-staff work census now has a documented case for routing it past disclosure and privacy officers before it goes out.
The email went to everyone at once, and it assumed every job could be described in five bullets. At the IRS, many could not. Walters's office existed to stop any of the agency's 100,000 employees from losing, leaking or even peeking at a return without authority [3]. It was a crime for an IRS employee even to acknowledge whether a specific person had or had not filed a tax return [5]. Her staff of 650 came to about one person for every 154 employees [1].
Walters described the risk in terms of scale. "One hundred thousand people is a big-sized town," she said. "In any big-sized town, you have some crazy people. I could easily see someone writing, 'This weekend I audited Beyoncé.'" [4] The Guardian reports that her concern was staff who believed a detailed answer was the price of keeping their jobs [7]. Her phone was already filling with questions from subordinates, and some said their replies were bouncing back with a "mailbox is full" notice [6]. "People don't understand what the IRS does," Walters said [14].
A single central instruction is fast and gets every answer in the same format. What it loses is the local knowledge of which jobs cannot legally be described in an email. Walters answered in general terms. She replied quickly and vaguely, sure that no one would ever read what she wrote [2]. That protected taxpayers. It also meant the exercise got the least information from the people whose work carries the most legal weight. In my view, a census that is thinnest where the work is most sensitive cannot tell anyone who to keep.
The same bypass shows up in how DOGE arrived. On 13 February, nine days before the email, Gavin Kliger turned up unannounced in the IRS lobby, and security called Traci DiMartini, who ran the agency's human capital department [8]. Treasury, which always cleared new political appointees, had no record of him [9]. Tim Curry at the Office of Personnel Management had no idea what was going on [10]. Kliger carried badges for a large number of government buildings and a backpack holding government phones and at least four laptops. He demanded an IRS phone, a laptop, an email address and access to the agency's computer systems [11]. He told DiMartini he had come to root out fraud [12]. The Guardian's account holds that the IRS's weakness was its technology, that its ethical infrastructure was sound, and that fraud was not likely one of its problems [13].
In both episodes the first burden fell on the offices whose job is to check access and disclosure. The excerpt does not include a savings figure or a count of departures, so it cannot show that the damage outran the savings. The cost fell first on control staff. The choice an operator makes this quarter is whether a workforce review goes through the people who know which answers are illegal. The consequence arrives next quarter, when the review either rests on usable replies or on answers like Walters's, written by someone who assumed no one would read them [2].
What to watch
- Whether later records show any IRS reply to the email disclosed protected taxpayer information, and what the agency did with the replies.
- Any published savings figure for IRS staffing cuts set against departures from control offices such as privacy and human capital.
- What level of IRS system access Gavin Kliger was eventually granted, and who signed off on it.