(I read about this earlier and then went back to tax work; thankfully, Matt Metras brought it up, and it reminded me, "Oh yeah.. I want to write about this!”

If you have a website, a client portal, an online intake form, or a WordPress blog, today’s security news may involve you, even if you’ve never written a line of code in your life.

On October 21, the team behind a piece of software called PHP released emergency fixes for two critical security vulnerabilities. Security researchers have nicknamed the problem “PHP2Shell.” Researchers at Wiz have described it as one of the most significant software security discoveries in years.

The vulnerabilities could allow an attacker to take control of an affected web server or access sensitive information, potentially without needing a username or password.

That sounds alarming. And it is serious. But for most business owners, the first step is surprisingly simple.

Let’s dig into what happened, why it matters, and what you should do about it today.

First, What Is PHP?

You may never have heard of PHP, and that’s perfectly normal.

Think of a website as a restaurant. The pretty part you see (the menu, the décor, the photos) is the dining room. But when you place an order, something in the back has to take it, prepare it, and send it out. On a website, that work is often handled by a programming language running on the server.

PHP is one of the most widely used languages for that job.

According to W3Techs, PHP powers roughly seven out of ten websites whose server-side programming language can be identified.

WordPress runs on it. Many online stores, contact forms, booking systems, and client portals rely on it. When someone fills out a form on a business website and clicks “Submit,” there’s a good chance PHP is involved somewhere behind the scenes.

If you don’t know what your website runs on, this is a good time to ask.

So What Went Wrong?

Here’s the simplest way I can explain it.

Whenever someone visits a website, the software running behind the scenes uses the server’s memory to process the request. It creates information, works with it, and eventually cleans up after itself.

Normally, that’s all very orderly.

But researchers discovered two serious problems with how PHP handles memory under certain circumstances.

In one case, something can go wrong before PHP has finished preparing the information it needs. When PHP tries to clean up, it may end up working with information that was never properly initialized.

In the other case, PHP can retain references to memory that has already been released. In effect, the software can end up trusting information that no longer belongs where it thinks it does.

Think of a hotel where housekeeping accidentally leaves one guest’s paperwork behind for the next guest. Except the problem here is worse: under the right conditions, someone can deliberately manipulate what gets left behind and how the hotel responds to it.

In computer security, that can have serious consequences.

Researchers demonstrated that these flaws can potentially be exploited to make a vulnerable server execute commands chosen by an attacker. In some circumstances, attackers may also be able to access information stored in the server’s memory, including sensitive data such as passwords, authentication tokens, or other private information.

On a vulnerable setup, an attacker may be able to exploit these problems without a password, an account, or any action from the website owner.

Not every website running PHP is necessarily exploitable. The actual risk depends on the software version, server configuration, and other technical conditions.

But the potential consequences are serious enough that anyone responsible for a PHP-based website should take notice.

Why This One Is Different

Software gets security updates all the time. Keeping those updates installed should be part of ordinary website maintenance.

These two vulnerabilities deserve particular attention for several reasons.

• The problem is in PHP itself. This isn’t a vulnerability limited to one WordPress plugin or one website application. It’s in the underlying software that many of those applications depend on.

• The vulnerabilities go back years. Researchers report that affected PHP releases date back more than a decade. A website doesn’t have to be running the newest software to be affected.

• Information emerged before the coordinated public release. Details about the vulnerabilities circulated early, and the official release was moved forward.

• Attackers are already trying. Cloudflare reports observing attempts to exploit the vulnerabilities. That doesn’t mean every attempt succeeded, but it tells us the threat is more than theoretical.

• Both vulnerabilities carry a severity score of 9.2 out of 10. That’s a critical rating.

  Share

The two vulnerabilities are officially identified as CVE-2026-109618 and CVE-2026-109619.

Those long numbers are simply identifiers used by security professionals and software vendors to track specific security problems.

You don’t need to remember them. You just need to know what to ask your website provider.

What You Should Do Today

Here’s the good news: you probably don’t need to fix the software yourself.

Your job is to make sure someone does.

1. Email your web host or website person today.

You don’t need to understand PHP or how a server works. Send something like this:

I’m checking on the PHP2Shell vulnerabilities disclosed October 21 (CVE-2026-109618 and CVE-2026-109619).

Does my website use an affected PHP version? If so, have both security fixes been installed and confirmed active on the server?

Please let me know which PHP version or vendor security update is running, when the fixes were completed, and whether anything else needs to be done.

If the updates are still pending, please let me know when they are expected to be completed.

The PHP project released fixes in the following versions:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

If your website is running one of those versions, or a later patched release, that’s what you want to hear.

Some hosting providers may apply security fixes to older versions without changing the main version number. These are called backported fixes, and they’re legitimate. In those cases, ask for confirmation that the vendor’s security update specifically addresses both vulnerabilities.

Don’t assume that seeing a newer version number somewhere in your website’s administration screen means the issue is resolved. You want confirmation that the patched PHP software is actually running on the server.

2. If you use WordPress, understand an important distinction.

Updating WordPress, your themes, or your plugins does not install the PHP security fix.

PHP is separate software, generally maintained by your hosting provider or server administrator.

If you manage your own WordPress website, you can check its PHP version by logging into WordPress and going to:

Tools → Site Health → Info → Server

Look for the PHP version listed there.

That tells you what PHP version your site reports, but your hosting provider still needs to confirm the relevant security fixes are in place.

3. If you’re running an older version, ask about upgrading.

If your website uses PHP 8.1 or older, it’s running a version that no longer receives regular security updates directly from the PHP project.

Some vendors continue providing security fixes for older releases, but that isn’t a substitute for having a plan to move to supported software.

Use this incident as an opportunity to ask whether your website should be upgraded.

4. Remember your forgotten websites.

This is the one I especially want business owners to think about.

Remember that landing page somebody created in 2019? The separate website for your side business? The old contact form that still works even though nobody remembers who installed it?

Those websites still exist. And if they’re publicly accessible, they can still be targeted.

You can’t protect a system you’ve forgotten about.

Take a few minutes to think about every website or online application your business owns or manages.

5. Don’t forget your client portal or intake software.

Your primary website and your client portal may be managed by entirely different companies.

If you use a third-party client portal, document-upload system, or online intake platform, ask that provider whether its systems are affected and what protections are in place.

Not every portal uses PHP, and not every PHP-based system is vulnerable. The point is to confirm rather than guess.

6. Get the answer in writing, and keep it.

Don’t just send the email and consider the problem handled.

Follow up until you’ve received a clear answer about whether your systems were affected and, if necessary, whether the fixes have been applied.

Save that response.

There’s a reason I keep coming back to documentation.

Subscribe now

A Note for My Fellow Tax Professionals

For those of us in the tax world, this isn’t just an IT issue. It’s potentially a compliance issue, too.

The FTC Safeguards Rule requires covered tax preparation firms to maintain an information security program designed to protect customer information. That includes managing security risks and appropriately overseeing service providers that handle customer information.

Your Written Information Security Plan, or WISP, shouldn’t be a document that gets created once and forgotten.

It needs to reflect what your firm actually does to protect information.

If your website, client portal, or online intake system handles client information, the security of those systems deserves attention. The service providers who maintain them may also be part of your firm’s oversight responsibilities under the Safeguards Rule.

This incident gives you a straightforward opportunity to demonstrate that you’re paying attention.

Send the email. Follow up. Document the response.

Keep a simple record showing:

• Which websites or services you reviewed.

• Which providers you contacted.

• Whether the systems were affected.

• When the security fixes were confirmed, if applicable.

• Any outstanding work requiring follow-up.

That documentation doesn’t automatically establish compliance with the Safeguards Rule. There’s considerably more to a proper information security program.

But it does provide a record of how your firm identified and responded to a specific security risk.

And that matters.

The Bigger Lesson

I spent more than twenty years in IT and cybersecurity before I ever prepared a tax return.

One lesson from those years has stayed with me: some of the most preventable security incidents happen because a vulnerability is known, a fix is available, and nobody gets around to making sure it’s installed.

It’s easy to think cybersecurity is about sophisticated hackers, complicated technology, and expensive software.

Sometimes it is.

But a lot of good security comes down to something much less glamorous: knowing what systems you have, knowing who’s responsible for them, and making sure someone follows through.

The researchers who discovered PHP2Shell put considerable effort into finding and understanding these vulnerabilities. Software maintainers and hosting companies have been working to get fixes into place.

You don’t need to understand every technical detail of that work.

You do need to know whether the systems your business relies on are protected.

The first step takes one email.

Send it today. Follow up until you have confirmation. Keep the reply with your security records.

Then get back to running your business, knowing you’ve taken an important step toward protecting it.

Sources and Further Reading

• PHP Project — Official Security Releases

• Wiz Research — PHP2Shell: Critical PHP Vulnerabilities

• Cloudflare — PHP Vulnerabilities and WAF Protection

• Qualys — PHP Critical Security Release

• GoDaddy — Important PHP Security Update

• W3Techs — PHP Usage Statistics

• FTC — Safeguards Rule Guidance

• IRS Publication 5708 — Creating a Written Information Security Plan

Published October 21, 2026. Security developments and hosting-provider patch status may change as additional updates become available.

Leave a comment

What’s scarier: a haunted hotel, a room full of TikTok tax advice, or a client asking what you need to get started four days before the deadline?

Josh and Shannon are hanging on until October 15 with hotel grievances, ghost stories, and a haunted house designed specifically to terrify tax professionals. Think last-minute W-2s, questionable S corporation advice, and BOI tombstones.

Shannon shares how she negotiated a peaceful night with a hotel ghost—and why haunted houses now qualify as relaxation. Josh questions hotel Wi-Fi, bathroom design, and whether every tax topic he teaches is destined to disappear.

They also discuss morning pages, AI’s unintentionally hilarious approach to literature, and preparing for the U.S. Tax Court nonattorney exam: why structured preparation and study partners mattered to them, where AI helped, and why it cannot do the learning for you.

Plus: upcoming classes, plans for Saratoga Springs, and the reminder that you can’t care more than the client does.

CLASSES AND EVENTS

• Tax Court Exam Preparation Class — USTC Practitioner’s Services
The program Josh and Shannon attended:
https://taxcourtexam.com/

• Ethics in the Real World — Brass Tax
Josh’s ethics class. Available on demand, with live replays October 20 and 27:
https://brasstax.com/products/ethics-in-the-real-world/

• The IRS’s First AI Rules: Circular 230 Exposure After OPR Alert 2026-19 — myLawCLE
Sharyn Fisk and Josh Youngblood | October 14, 2026 | 2:30–4:40 p.m. Eastern:
https://mylawcle.com/products/the-irss-first-ai-rules-circular-230-exposure-after-opr-alert-2026-19/

• NYSSEA 39th Annual Conference
October 25–27, 2026 | Saratoga Springs, New York:
https://nyssea.starchapter.com/meetinginfo.php?id=54&ts=1783363088

More episodes and full show notes:
https://wellactually.tax/

You’ve seen this email. Two lines confirming lunch. Under the signature, a full paragraph announcing that any U.S. federal tax advice in the communication was not intended or written to be used, and could not be used, to avoid penalties under the Internal Revenue Code.

There was no tax advice. Just a lunch confirmation.

I see this email signature all the time: scheduling emails, questions, “thanks, got it.” I understand why it’s there. It looks careful. It looks official.

But Circular 230 never required that paragraph on every email. And in 2014, Treasury eliminated the covered-opinion rules that prompted its widespread use. T.D. 9165, T.D. 9668.

Here’s why the disclaimer existed, why its regulatory purpose disappeared, and what belongs in your communications instead.

How the disclaimer took over

In December 2004, Treasury issued T.D. 9165, adding the covered-opinion rules at former §10.35 of Circular 230. They applied to written advice rendered after June 20, 2005.

The rules covered certain written advice—including electronic communications—concerning federal tax issues arising from listed transactions, arrangements with a principal purpose of tax avoidance or evasion, and certain arrangements with a significant tax-avoidance or evasion purpose.

Advice in that last category could qualify as a covered opinion if it was a reliance opinion, a marketed opinion, or subject to confidentiality conditions or contractual protection. A reliance opinion generally concluded that at least one significant federal tax issue was more likely than not to be resolved in the taxpayer’s favor. T.D. 9165, former §10.35(b)(2)–(7) and (g).

If your advice qualified, detailed requirements followed for factual and legal analysis, conclusions, and disclosures.

Then came the escape hatch.

Former §10.35(b)(4)(ii) allowed certain advice to avoid reliance-opinion classification through a prominent penalty disclaimer. Former §10.35(b)(5)(ii) provided a similar exception for marketed opinions, with additional disclosures about promotion and independent advice. Neither exception applied to listed transactions or principal-purpose arrangements. Other routes to covered-opinion status remained. T.D. 9165, former §10.35(b)–(e).

The familiar legend became a way to manage a burdensome classification problem. Firms attached it broadly, and it spread far beyond the tax advice that prompted it.

There’s a quiet irony here. After T.D. 9201 revised the prominence standard in May 2005, a disclosure had to be readily apparent to the reader. At a minimum, it had to appear in a separate section, outside a footnote, in type at least as large as the discussion of facts or law. T.D. 9201, former §10.35(b)(8).

Eight-point gray text below your phone number was hard to square with that requirement. Some footers may not have accomplished their intended purpose even while the rules were in effect.

Treasury removed the reason for it

On June 12, 2014, Treasury published T.D. 9668. It removed the covered-opinion rules, replaced former §10.35 with a competence standard, and revised §10.37 to provide one framework for written federal tax advice. T.D. 9668.

The preamble addressed disclaimers directly: Treasury and the IRS expected the amendments to end their routine use in emails and other writings.

Officials said it out loud, too. At a June 20, 2014, NYU tax conference, then-Director of the IRS Office of Professional Responsibility Karen Hawkins told practitioners to remove the disclaimer because it was no longer necessary. Then-Chief Counsel William Wilkins pronounced the legend “really most sincerely dead.” BNA Daily Tax Report, June 24, 2014, reprinted on IRS.gov.

On a June 17, 2014, Tax Talk Today webcast, Hawkins said her office would send letters asking practitioners to stop using disclaimers claiming that the IRS or Circular 230 required them. Her concern was misleading taxpayers about the requirements. Tax Notes Today, June 18, 2014, reprinted on IRS.gov.

Those are contemporaneous press accounts of the officials’ remarks, not regulations. They reinforce the formal explanation in the preamble.

Retaining an obsolete legend is different from claiming the IRS requires it. The amendments created no standalone prohibition on leftover boilerplate, but attributing a blanket requirement to Circular 230 misstates the rules.

Why it survives

So why is it still everywhere more than twelve years later? Circular 230 no longer supplies a reason to keep it. Habit does plenty of the work.

Templates never die. Somebody set up the firm signature in 2006. New hires inherit it on day one.

Risk theater. A paragraph of legalese feels protective. But language tied to rules removed in 2014 makes the firm’s templates look outdated.

“We’ve always done it.” Removing the warning label feels riskier than leaving it, even after its regulatory purpose has disappeared. Doing something one way because you have always done it that way is never a good reason.

It’s also worth reading the legend literally. It tells your client that the advice cannot be used to avoid penalties.

The old exception concerned classification under Circular 230. It did not itself decide whether a taxpayer could establish reasonable cause and good faith.

Today, reasonable reliance under IRC §6664(c) and Treas. Reg. §1.6664-4 depends on the facts and circumstances. A boilerplate footer does not automatically defeat a client’s reliance-on-advice defense. Treas. Reg. §1.6664-4(b)–(c).

Still, it creates an unnecessary mixed message: you are giving advice while telling the client not to rely on it for penalty protection. Why attach that message to every email?

What the rules require now

Current §10.37(a)(2) requires practitioners giving written federal tax advice, including electronically, to:

Share

• Use reasonable factual and legal assumptions.

• Consider facts they know or reasonably should know.

• Make reasonable efforts to identify relevant facts.

• Avoid unreasonable reliance on others’ representations.

• Apply law and authorities to the facts. (You know, you the professional. Not AI)

• Disregard the chance of escaping audit or scrutiny.

Section 10.37 also governs reliance on another adviser and evaluates compliance under a reasonable practitioner standard. That assessment considers the engagement and requested advice; certain marketed opinions receive particular attention to risks from unfamiliar taxpayer circumstances. 31 C.F.R. §10.37(a)–(c).

Together, §§10.35 and 10.37 establish the core competence and written-advice standards. Diligence, penalty-advice duties, and firm compliance procedures also remain relevant. Circular 230, §§10.22, 10.34–10.36.

There is no prescribed blanket footer. A signature disclaimer cannot cure deficient advice; omitting it does not itself violate the standard.

Treasury’s December 2024 proposal, REG-116610-20, would retain the principles-based approach, amend wording and definitions, and remove the separate provision in §10.37(c)(2). It would not restore the legend. 2024 proposed amendments.

As of October 7, 2026, there is no published final rule implementing that proposal. The eCFR, updated through October 5, still contains the existing provisions. Current Circular 230. I look forward to getting an update to Circular 230, but I am not holding my breath that it will be anytime soon.

What to write instead

So what belongs at the bottom of your email? Usually, nothing about Circular 230.

The 2014 preamble permits reasonable, accurate statements limiting particular advice. T.D. 9668.

If you give a preliminary answer based on limited facts, explain that in the body, where the client will see it:

“This is based on what you’ve told me so far. If any of these facts are different, my answer may change.”

Better still, identify the particular assumption or unanswered question that matters. That helps the client understand the advice and when to come back to you.

What you should not do is blame the IRS. Don’t introduce the old blanket disclaimer with “Circular 230 requires” or “IRS rules require us to inform you.”

Other footer language deserves its own assessment. Confidentiality notices, attorney privilege legends, and marketing disclosures should be evaluated separately. Keep language that serves a real purpose, and consider what protection it actually provides.

A quick cleanup

Subscribe now

Start with your email signature:

1. Remove the obsolete Circular 230 paragraph, including from your phone’s signature.

2. Check firm templates, letterhead, and engagement-letter boilerplate for the same language.

3. If signatures are managed centrally, have the firm update the shared template.

4. When particular advice needs a scope limitation, explain that limitation accurately and in plain English in the advice itself.

That footer was a workaround for rules that have been gone longer than many of our client relationships have existed.

What protects you and your clients now is the care in the advice: the facts you gathered, the law you applied, and the limits you explained honestly.

That is worth more than a paragraph (that few will read) under your phone number.

How often do you still see this disclaimer? Are you updating your email signature right now?

Leave a comment

Honest question: when was the last time you actually opened your WISP? Not renamed it. Not moved it into a new folder. Opened it, read it, and changed something.

If your answer includes the words “when I first wrote it,” you are in very good company. For a lot of practices, the Written Information Security Plan lives the same life as a January gym membership (paid for, sincerely intended, quietly untouched).

Fall is the best time of year to fix that. Once October 15 is in the rearview mirror, there is a short, calm window before filing season, and the news cycle has handed us a stack of fresh reasons to care. Let’s dig into why now, what the latest breaches teach a small practice, and how to give your plan a real checkup before January.

Why This Fall, Specifically

Three things line up right now, and together they make the case better than I could.

1. PTIN renewal is coming, and it asks you about your plan

Every 2026 PTIN expires December 31. Renewal season for 2027 should open in the next few weeks (last year it opened at the end of October). When you renew, line 11 of Form W-12 asks you to check Yes or No: are you aware that paid preparers are required by law to create and maintain a written information security plan? The form points you to Publications 5708 and 4557, and the whole application is signed under penalties of perjury. If you are renewing online which most of us are, you receive the same question.

Translation: the IRS is not asking whether your plan is perfect. It is making sure nobody can later say they didn’t know. That checkbox is a lot more comfortable to click when the plan it refers to reflects the practice you actually run today.

2. The IRS just finished its annual reminder tour

The Security Summit ran its five-week “Protect Your Clients; Protect Yourself” series this summer, now in its 11th year. Week three was devoted entirely to WISPs. In IR-2026-92 (Aug. 18, 2026), the IRS repeated that federal law requires tax and accounting professionals to create and maintain a WISP. It also said firms should review, test, and update the plan regularly, adjusting it for changes in operations or the results of security testing.

A WISP is not a document you write once. It is a document you keep writing.

3. Filing season is when you’ll have the least time and the most risk

The series wrapped up with IR-2026-111 on Sept. 16. It lists the schemes still landing in practitioner inboxes: fake “new client” emails carrying malicious attachments, phishing aimed at your EFIN, PTIN, and CAF number, and IRS impersonation by email, text, and phone. Those peak when inboxes are fullest and patience is thinnest. Update the plan in October, and your team trains on it before the flood instead of during it.

The News Is Doing the Teaching for Us

Two stories from the last few months deserve a closer look. Not because your practice looks like the Pentagon or a Big Four firm, but because the failures behind them are painfully ordinary.

The Pentagon’s unencrypted file share

The Department of Defense confirmed a breach of a Defense Manpower Data Center system affecting 2.76 million living people and roughly 294,000 deceased people (Cyber Security News). Unauthorized users got in through a vulnerability in a file-sharing system and had access from October 2025 until the flaw was found on July 16, 2026. The files held unencrypted names, Social Security numbers, and dates of birth. Notice letters were dated September 18.

Let’s dig into what that means for a practice our size:

• Roughly nine months of access before anyone noticed. If someone had been quietly reading your client folders since last October, what in your setup would have told you?

• The data was not encrypted at rest. That is the difference between “someone reached a server” and “someone walked off with Social Security numbers.”

• The entry point was a file share. Not an exotic, movie-plot attack. A place documents were kept because it was convenient.

(If the Department of Defense can leave a folder unencrypted, the rest of us can stop feeling quite so embarrassed about our own to-do lists. Then we should go do them.)

EY’s help desk turned into a filing cabinet

In July, Ernst & Young began notifying clients that an unauthorized party had gotten into a third-party IT support ticket platform used by its IT staff (BleepingComputer). The intruder downloaded documents between March 28 and April 12, 2026. EY spotted the anomalous activity on April 23. The files contained personal and financial data in, or used to prepare, client tax filings.

Why was tax data sitting in a help desk system at all? Because support tickets carried attachments, and nobody’s plan said they shouldn’t.

Translation for the rest of us: your data lives wherever your people put it, not wherever your WISP says it lives. That includes the screenshot you sent your IT person, the client PDF attached to a software support case, and the return you uploaded to a vendor’s portal to troubleshoot a rejection.

Your WISP describes where client data is supposed to be. A breach finds out where it actually is.

Why I Don’t Lead With the Fines

I love teaching this topic, mostly because of what happens afterward. My inbox fills up with questions from tax pros who genuinely want to get it right. Nobody writes to say they’re terrified. They write to say, “I want to do the right thing, and I’m not sure where to start.”

That tells me something important. People want to protect their clients. They don’t need to be scared into it.

So I don’t open with penalties. Yes, the FTC can fine you. But let’s dig into where the FTC actually spends its time:

• The FTC says it has brought more than 90 data security enforcement actions to date, across every industry it oversees (FTC, Feb. 2026). Recent examples it highlights include GoDaddy and an education technology company.

• Compare that with the more than 800,000 paid tax preparers who renew a PTIN every year (Ohio Society of CPAs).

• The FTC’s best-known tax prep case, TaxSlayer in 2017, involved an online tax platform where hackers took over nearly 9,000 customer accounts.

Translation: the FTC generally goes after large platforms with large numbers of affected consumers. That could shift (FTC Chairman Andrew Ferguson told MLex in June that he expects a surge of privacy cases in the second half of 2026), but the odds that a three-person office is next on the list are small.

What actually happens to small practices

The consequences that reach small firms tend to come from somewhere else: clients, plaintiffs’ lawyers, and your own reputation.

• This spring, a small tax and accounting firm in Washington state reported that data for 18 clients had been stolen and used to file fraudulent returns. By September, a class action law firm was publicly inviting affected clients to come forward (Claim Depot). Eighteen clients.

• In February, a New Jersey accounting firm was hit with a proposed class action alleging it failed to safeguard client information and was slow to send breach notices (Law360).

• Plaintiffs’ firms now open “investigations” whenever a small accounting practice turns up in a state breach filing or on a ransomware leak site. September alone brought several (ClassAction.org).

The deeper cost is trust. Clients forgive a lot. It is much harder to forgive a phone call that starts with “someone filed a return in my name, and they got my information from your office.”

The FTC may never learn your name. Your clients, their families, and everyone they would have referred to you will.

That’s why I teach this from the client’s side of the desk. A WISP isn’t paperwork you do for Washington. It’s how you keep a promise to people who trusted you with everything.

What Changed Since You Wrote It?

Subscribe now

Most WISPs I look at aren’t wrong. They just describe a practice that no longer exists. Here is what has probably changed in your office since the plan was last touched:

• AI tools. If anyone on your team pastes client facts into a chatbot, uses an AI notetaker on client calls, or runs returns through an AI review tool, those are new places client data flows. Your plan should name them, say what is allowed, and address the §7216 questions before a client asks you about them.

• New vendors. A new client portal, e-signature service, practice management platform, or outsourced bookkeeper. The FTC expects you to choose service providers that can protect the data and to require that in their contracts (IR-2026-92).

• New devices. Laptops, phones, tablets, and yes, the smart TV in the conference room. (I wrote a whole piece on that last one: “Your Television Is a Computer. You Just Never Treated It Like One.”)

• New people and new places. Seasonal staff, a remote hire, a temporary home office that quietly became permanent. Each one changes who has access and from where.

• Authentication. The IRS spent a full week of the summer series on multifactor authentication and IP PINs (IR-2026-106). If a system touching client data offers MFA and you haven’t turned it on, that belongs in this year’s update.

If any of those made you wince a little, good. That wince is your risk assessment getting started.

Your One-Hour WISP Checkup

You don’t need a weekend for this. Block one hour, get a coffee, and walk through these ten steps with your current plan open beside you.

1. Confirm your Qualified Individual. The Safeguards Rule requires a designated person to coordinate the program. Is it still the right person, and do they know it’s them? (Solo practitioners: congratulations, it’s you.)

2. Redraw your data map. List every place client data lives or passes through: tax software, document storage, email, portal, e-signature, backups, AI tools, and the support tickets you send vendors. Compare that list to what your plan says.

3. Check encryption. Laptops, external drives, backups, and file shares, both at rest and in transit. The Pentagon lesson applies at every size.

4. Verify MFA on everything that touches client data. Tax software, email, cloud storage, remote access, and your IRS online accounts.

5. Review your vendor list. For each service provider, confirm how they protect data and that your agreement requires it.

6. Clean up access. Remove former and seasonal staff. Make sure current staff can reach only what their role needs.

7. Refresh your incident response plan. Add your IRS Stakeholder Liaison, the Federation of Tax Administrators’ Report a Data Breach page, and your state’s notice rules. Note the FTC requirement to report a security event affecting 500 or more people, generally within 30 days of discovery.

8. Schedule staff training before January. Use the warning signs in IR-2026-111 as your syllabus: fake new clients, EFIN, PTIN, and CAF phishing, and IRS impersonation.

9. Test one thing. Restore a file from backup, or run a quick phishing drill. A plan you’ve never tested is a plan you are hoping works.

10. Date it and log the changes. Record what changed and why. Future you (and any insurer, examiner, or eventual buyer of your practice) will want that history.

If you are starting from scratch, Publication 5708 is the IRS template built for smaller practices. And if your firm maintains information on fewer than 5,000 consumers, the Safeguards Rule (16 CFR 314.6) excuses you from a few formal items, including the written incident response plan. The IRS still recommends a data theft response plan anyway, and so do I.

The goal isn’t a perfect document. It’s an honest one that matches the practice you run today.

Something I’ve Been Building

A small confession. Every time I teach this topic, the same thing happens. People leave motivated, open a blank template, and stall somewhere around page two.

So I’ve been building a WISP builder made for real tax practices.

It isn’t ready to share yet, but it’s close. It is currently in testing and will launch in November. Subscribers will be the first to hear about it. In the meantime, if there is a part of your WISP that has always stumped you, reply and tell me. I’m building for exactly those moments.

Where You Can Find Me

• Tue., Oct. 6, 2026, 10:00 a.m. to 12:00 p.m. PT

  Brass Tax Ethics webinar, “Ethics in the Real World.” Circular 230, due diligence, and the decisions that get preparers in trouble. 2 hours of CE/CPE (CPA, EA, and CRTP eligible), no assessment test required for the live session, $89.

• Wed., Oct. 14, 2026, 2:30 to 4:40 p.m. ET
  myLawCLE: The IRS’s First AI Rules: Circular 230 Exposure After OPR Alert 2026-19.

  I’m excited to be co-presenting with Sharyn M. Fisk, former director of the IRS Office of Professional Responsibility. We’ll cover how AI-assisted tax work falls under existing Circular 230 authority, and the documentation, billing, and supervision safeguards firms can apply now.

• Oct. 25 to 27, 2026: NYSSEA 39th Annual Conference. Gideon Putnam Resort, Saratoga Springs, NY. I will present a class on penalty abatement and co-present with Matt Metras, EA, USTCP, on Tax Practice Automation & Tech Hacks to Save Your Sanity.

• Tue., Nov. 10, 2026, 9:00 a.m. to 12:30 p.m. CT
  NATP webinar workshop, Real-World Digital Asset Reporting. 4 CPE. Form 1099-DA, reconciliation, and basis documentation.

• Dec. 1 to 3, 2026: NATP TaxCon. NATP’s online conference on AI, IRS technology, and responsible technology use in tax practice. I’m on the “Voices from the Profession” panel (Dec. 1), presenting on Section 7216 and protecting taxpayer information in technology-assisted workflows (Dec. 2), and joining a panel on building service lines beyond the tax return (Dec. 2). More details to come.

More classes and a few open slots

I’m looking forward to teaching more on this subject in the months ahead and will post updates to my schedule.

And because so many of you email me after these classes, I’ve opened my booking system for a few slots for tax pros who want to talk through their WISP or other questions one-on-one. They’re limited, so if you’ve been sitting on a question, this is the time to ask it. You can book here.

The Plan You Actually Follow

Here is what I keep coming back to. Neither breach above started with a brilliant hacker. Each started with an ordinary shortcut nobody revisited: a file left unencrypted because it was convenient, an attachment dropped into a ticket because it was quicker. A WISP exists to catch those shortcuts before they turn into headlines, and it can only do that if it describes the practice you actually run.

So before you check that box on your PTIN renewal this fall, give yourself the hour. Open the plan. Fix one thing that is no longer true. Then put next year’s review on the calendar. Our clients hand us their most sensitive information, and keeping this document honest is one of the quietest ways we keep faith with that trust.

Share

Leave a comment

Tom Gorczynski, EA, USTCP, joins Josh and Shannon for a candid conversation about building a career in tax and speaking up when the profession can do better.

They discuss professional organizations, why Tom left NAEA, sponsored education, conflicts of interest, and choosing instructors who know their material. They also get into AI, preparing for the U.S. Tax Court practitioner exam, and Tom’s advice for new enrolled agents.

Plus: the value of meeting people in person, airport lounges, and one unforgettable dinner in Las Vegas.

Guest: Tom Gorczynski, EA, USTCP
Hosts: Josh Youngblood, EA, USTCP · Shannon Hall, EA, USTCP

Full show notes and links: https://wellactually.tax
Tom’s work: https://www.tomg.tax
Tax Court exam preparation: https://taxcourtexam.com

Lately, I have noticed quite a few tax professionals using AOL, Hotmail, Yahoo, Gmail, or internet service provider (ISP) specific email addresses for their practices. These email addresses appear on websites, business cards, and professional listings, sometimes right next to an impressive list of credentials.

I always wonder why someone who has invested so much in becoming a professional has skipped such a simple part of presenting themselves as one.

I realize that may sound a little judgmental. But when I see an AOL, Gmail, Hotmail, or other generic address attached to a tax practice, it looks dated and unprofessional to me. But it is an easy problem to fix.

An email address does not tell me whether the person is good at their work. I am sure there are excellent practitioners who have used the same email address for decades. It does, however, suggest that something very visible about the business has not received much attention.

Think about the difference between besttaxpro1987@gmail.com and jane@smithtax.com.

The first requires someone to remember a username and perhaps a few numbers. The second tells them who you are and immediately connects you to the business they intended to contact.

For example, my firm’s domain is youngbloodgroupllc.com. I use josh@youngbloodgroupllc.com, along with team@youngbloodgroupllc.com and other addresses for specific purposes, such as accounting@ and legal@. Each address has an obvious function, and they all clearly belong to the same practice.

You also do not necessarily need a separate paid mailbox for every address. A solo practitioner might use aliases so that messages sent to a legal or billing address arrive in the same inbox as messages addressed directly to them. Google Workspace and Microsoft 365, for example, allow multiple aliases for a user at no additional cost. An alias is simply another address attached to an existing mailbox. It does not create a separate account or separate access permissions. You can even set up rules or filters to move emails from these aliases to specific folders.

This is a small improvement, but small details contribute to the impression people form of your practice.

Subscribe now

A prospective client usually cannot evaluate your technical ability before hiring you. They can evaluate whether your communications are clear, whether your process makes sense, and whether the business appears organized. An email address that matches the firm helps make that first impression consistent.

We ask clients to value our expertise and pay appropriately for our services. It is reasonable for them to expect us to invest in the basic tools of our own businesses.

And this is not an expensive branding exercise.

For a standard, available .com domain, I would generally budget somewhere around $10 to $25 per year. Some names and extensions cost considerably more, so pay attention to the renewal price, not just the first-year promotion.

Business email can also be relatively inexpensive. Google Workspace Business Starter and Microsoft 365 Business Basic are both entry-level options worth comparing, particularly if you already prefer Gmail or Outlook

.

Using a $20 domain and a $7 monthly mailbox as a simple example, the recurring cost comes to $104 per year before tax.

That is not nothing, but in the context of running a professional tax practice, it is a relatively small investment. In my opinion, if it makes your firm appear more professional and lands you one additional engagement, then it certainly pays for itself.

One thing that may keep people from making the change is confusion about what it actually requires.

Your domain is the name you register. Your email provider is the service that hosts your mailbox. They do not have to come from the same company, and you do not need a completed website to use your domain for email.

If you already own a domain for your website, you may already have half of what you need.

You also do not necessarily have to change the way you read and send email. If you like Gmail, Google Workspace lets you continue using the Gmail interface while sending and receiving mail through your own domain. If you prefer Outlook, Microsoft 365 gives you the same interface.

You can keep using familiar software while giving clients an address that actually identifies your business.

But there is another reason I think firms should make this change, and it may be more important than appearance:

Your firm’s email should belong to your firm.

Consider a seasonal employee who handles client correspondence.

If that work happens through the employee’s personal email account, the firm does not administer the account or control its security settings. When the employee leaves, client conversations may remain in a mailbox the firm cannot access, and the business has limited ability to control continued use of that account.

With a firm-managed account, the firm can disable access, reset credentials, and retain control of the mailbox when someone leaves.

That does not undo anything an employee has already downloaded or copied, but it gives the business meaningful control over the account itself.

The same distinction matters with multifactor authentication.

You can ask everyone to turn on multifactor authentication (MFA), or you can use a business email system that lets an administrator require it. Google Workspace and Microsoft 365 both provide administrative security controls that consumer accounts generally do not place under the firm’s control.

Account recovery is another practical example.

Suppose an employee loses access to a mailbox during tax season. With a managed business account, an authorized administrator has tools to reset credentials and help restore access. If the account belongs personally to the employee, the firm may be dependent on that person’s recovery information and the provider’s consumer recovery process.

Neither situation is enjoyable on April 10, but one gives the business a defined way to respond.

Your own domain also lets you configure email authentication for systems authorized to send mail on behalf of your firm.

You will hear three acronyms: SPF, DKIM, and DMARC.

In plain English, these technologies help receiving email systems determine whether a message claiming to come from your domain was actually sent by a system authorized to use it.

That matters because someone could attempt to send a client a fraudulent payment request while pretending to use your firm’s domain. Properly configured authentication can make that kind of direct domain spoofing more difficult and help receiving systems identify unauthorized messages.

It is not magic.

SPF, DKIM, and DMARC will not prevent someone from registering a similar-looking domain. They will not protect a mailbox after someone steals the password. And simply being told that “you have DMARC” does not necessarily mean your domain is configured to reject fraudulent mail.

But properly configured email authentication is one useful layer of protection.

This is also a reasonable place to pay someone who knows what they are doing.

Before tightening those settings, identify all services legitimately sending email using your domain, including practice management, invoicing, scheduling, marketing, or other systems. Otherwise, you may interfere with legitimate messages while trying to block fraudulent ones.

And please continue using a properly secured client portal for sensitive documents.

A custom email address does not turn an ordinary attachment into a secure document exchange.

If a client sends a full tax return to your shiny new professional email address, the domain has not somehow solved the risks associated with handling that information. Your firm should still use a properly secured client portal for sensitive documents. Business-grade email will allow you to reject incoming attachments and respond with a message if desired.

If you decide to make the switch, the basic process is not particularly complicated:

1. Register a domain that makes sense for your business.

2. Choose a business email provider such as Google Workspace or Microsoft 365.

3. Configure your domain to work with that provider.

4. Properly configure SPF, DKIM, and DMARC.

5. Create your primary mailbox and any appropriate aliases or additional accounts.

6. Require MFA.

7. Make sure the business maintains administrative control of both the domain and the email service.

Whichever services you choose, make sure the business controls the domain registration and the email administration. Protect the administrative accounts with MFA, keep recovery information current, and enable automatic domain renewal with a valid payment method.

If someone else handles the setup for you, you should still have the credentials, administrative access, and documentation necessary to control your own systems. This applies to all of your tech services and infrastructure.

There are practitioners running excellent firms from email addresses they created 20+ years ago. Changing the address will not make them better tax professionals.

But that really is not the point.

We ask clients to trust us with extraordinarily sensitive information and to pay professional fees for our expertise. Spending roughly a hundred dollars a year to make sure our email looks like it belongs to an actual business—and is controlled by that business—is a remarkably inexpensive upgrade

.

If you’re still using "besttaxpro1987@gmail.com”, this might be the week to retire it. If you have any questions about doing this, please comment below. If you know someone who is still using a generic email and you think they would benefit from this information, please share it with them.

Leave a comment

Share

In this special edition of Well, Actually…, they look back at the long road to becoming U.S. Tax Court Practitioners: deciding to take the exam, months of preparation, surviving test day, waiting for results, completing the character and fitness process, and finally getting the news they had been waiting for.

They talk about which parts of the four-part exam were the hardest, why the USTCP exam is nothing like the EA exam, the chaos and excitement of finding out they passed, and what the credential actually means now that they have it.

Plus: remote-testing anxiety, tornado sirens, spam folders, study-group trauma, character-and-fitness nerves, and why passing the exam is really just the beginning.

For tax professionals considering the USTCP path, Josh and Shannon also share what helped them prepare and their advice for approaching the process.

Learn more about the exam and sign up for the preparation class:
https://taxcourtexam.com

Connect with us:
Josh Youngblood — josh.tax
Shannon Hall — shannon.tax

Yesterday, I was admitted to practice before the United States Tax Court.

That is a sentence I have wanted to be able to write for a very long time.

It should feel like an arrival.

And it does. Sort of.

I am proud of it. Extremely proud, actually. Becoming a United States Tax Court Practitioner is difficult. It requires a substantial amount of study, a difficult examination, an interview, and significant waiting.

Not easy for an impatient person.

I wanted it.

I worked for it.

I got it.

And almost immediately, my brain started asking what was next.

There is always a next.

Another credential or license. Another class. Another project. Another business idea. Another thing to improve. Another thing I should be doing that I am currently not doing.

I have apparently developed the remarkable ability to turn an accomplishment into a baseline almost immediately.

Yesterday’s dream becomes today’s normal.

Then we go looking for tomorrow’s dream.

I am starting to think this may be a personality defect. I’m not sure that I have always had this, but I do know I have for at least the last several years.

For most of my life, I have had some version of a finish line out in front of me.

Once I get through this tax season.

Once I get that credential.

Once the business reaches this revenue amount.

Once I launch that project.

Then I’ll relax.

Then I’ll feel successful.

Then I’ll have more time.

This has, of course, been nonsense.

The finish line has wheels.

Every time I get close to it, I quietly move it farther down the road.

There was a time when becoming an Enrolled Agent seemed like an enormous accomplishment. Then I became one.

Owning my own firm sounded like success. Then I did that.

Teaching nationally sounded like a pretty good marker.

And now the Tax Court.

Check enough boxes and eventually, surely, some internal voice will say, “Good job. You may stop now.”

Apparently that voice does not exist.

The absurdity of this became particularly clear to me this week.

Yesterday, I was admitted to practice before the United States Tax Court.

This morning, I was reading conference evaluations from classes I had taught.

Most were fine. Some were very good.

One person wrote:

“I was bored.”

And would you like to guess which one my brain decided was important?

Apparently, being admitted to the United States Tax Court is no match for one anonymous conference attendee who was bored.

That is objectively hilarious.

I can see the absurdity. I know some speakers who never read evaluations. I read them all, usually multiple times, make notes, and try to improve.

It is also revealing.

There will always be another person to gain the approval of. Another metric. Another review. Another credential. Another person who thinks you’re wonderful.

And another person who was bored.

Or dislikes you.

If success requires unanimous approval, I have selected a particularly stupid game.

Unanimous approval does not exist.

I would love to blame all of this entirely on my own neuroses. Because we are all flawed, and that would be an easy explanation.

Some of it certainly belongs on me.

But modern life seems to reward the same pathology.

We are supposed to grow. Scale. Optimize. Build. Improve. Network. Learn. Create a personal brand. Monetize the personal brand. Start a newsletter. Start a podcast. Become a thought leader.

Whatever that may mean.

Apparently, thinking is no longer sufficient. One must lead thoughts.

Or, worse yet, influence them.

The dreaded influencer.

Even our hobbies have become suspiciously productive.

If you run, track the pace. If you read, track the books. If you write, publish it. If you make something, perhaps you should sell it.

God forbid we simply enjoy something.

And then we invented “work-life balance,” which sounds healthy until you realize we have somehow turned work-life balance into another thing to be good at.

Now we can fail professionally and fail at relaxing.

Excellent.

I am especially susceptible to this because I genuinely enjoy my work. Tax interests me. Technology interests me. Teaching interests me. Writing interests me.

That makes it very easy to forget one important fact:

Work is not a hobby.

Even interesting work.

There should be parts of life that don’t need to justify themselves through usefulness.

A bookstore does not need to make me smarter.

Coffee does not need to make me more productive.

Sometimes I should be able to drink a cappuccino and have the accomplishment be that I drank a cappuccino.

Preferably a good one. Goldchild in San Diego, for the record.

There is another danger in professional accomplishment.

The more letters you accumulate after your name, the easier it would be to start believing your own press release.

Passing a difficult examination means something. I worked very hard for this one, and I am not going to pretend otherwise in the name of false humility.

But passing an exam does not mean I know everything.

It means I passed a difficult exam on a given day.

A credential demonstrates knowledge and competence.

It does not confer omniscience.

The more I learn about tax, the more obvious it becomes how much there is to know.

I will still have to research things.

I will still need to ask people smarter than me.

Spoiler alert: if you’re the smartest person in the room, find a new room.

I will still be wrong.

And I hope I never lose the ability to say:

I don’t know. Let me look at that.

I would be deeply suspicious of any tax professional who passed a difficult examination and concluded that there was nothing left to learn.

There is also a tendency to turn achievement into a very neat personal story.

I worked hard.

I persevered.

I succeeded.

All true.

But incomplete.

In 2012, President Obama gave a speech that produced one of the more famous out-of-context political lines of the era:

“You didn’t build that.”

It became an argument about whether successful people deserved credit for what they had built. But the larger point was simpler: successful people do not materialize in isolation.

Somebody taught you.

Somebody answered a question.

Somebody opened a door.

Somebody built the road.

Somebody helped.

We like to tell clean stories about individual achievement.

Real life is messier, and more communal, than that.

I passed the exam.

I studied for it. I sat for it. I answered the questions.

Nobody could do those things for me.

But I did not arrive there alone.

There were people who taught me tax law before I knew enough to understand how little I knew. People who answered questions, challenged me, recommended books, gave me opportunities, encouraged me, and believed I could do something before I was entirely convinced myself.

There were also people who simply tolerated me talking about and obsessing over the Tax Court exam for an unreasonable amount of time.

My spouse, in particular.

Preparing for a challenging exam can create some turbulence.

Especially when you treat passing it as a life-or-death matter.

Those people are part of the accomplishment too.

Acknowledging that does not diminish individual effort.

It makes the story accurate.

I worked very hard for this.

And I did not do it alone.

Both are true.

Maybe this is part of why accomplishment makes me uncomfortable.

I am deeply wary of arrogance.

It makes me recoil.

We have plenty of it. From the highest levels of government to business, media, academia, and nearly every profession, there are people who seem absolutely convinced that success also made them the smartest person in every room.

I find it one of the most unattractive traits a person can have.

Confidence is useful.

Competence matters.

But arrogance is something different.

Arrogance is the inability to imagine that you might still have something to learn.

I never want the letters after my name to become a substitute for curiosity.

I never want to become so invested in appearing knowledgeable that I cannot admit when I don’t know something.

But maybe I have been so concerned about arrogance that I have occasionally forgotten I am allowed to be proud.

Pride says:

I worked hard for this, and I am glad I did it.

Arrogance says:

I accomplished this, therefore I am superior.

Those are not the same thing.

I don’t want to become less ambitious.

I like building things. I like learning. I like tackling something difficult and figuring it out.

But there is a difference between wanting more because life is interesting and needing more because what I already have never feels sufficient.

I am not always sure which one is driving.

One creates possibility.

The other creates a life in which the present is perpetually auditioning for the future.

And that seems like a particularly bad way to spend a limited amount of time.

Because there is one fact that eventually ruins the entire exercise of keeping score.

One day I am going to die.

So are you.

I realize this is not the traditional inspirational ending.

But death does have a remarkable ability to clarify things.

We behave as though we can eventually get time under control. Become more efficient. More organized. More disciplined. Get ahead.

We can’t.

Time wins.

And when mine runs out, I find it very difficult to imagine anyone standing around discussing the letters after my name.

Nobody at my funeral is going to care how many continuing education classes I taught.

They probably will not discuss my revenue.

I certainly hope nobody reads my Twitter/X profile.

What will matter?

Whether I was kind.

Whether I showed up.

Whether I made people laugh.

Whether I helped when helping was inconvenient.

Whether the people around me felt better or worse because I was there.

And, in my case, whether a few animals had better lives because they happened to cross mine.

That may sound like a small ambition from someone who has spent so much of his life pursuing larger ones.

It isn’t.

If, when all of this is over, someone can say that I gave a few animals a better life, good food, ridiculous amounts of affection, veterinary care when they needed it, and the absolute certainty that they were loved, I think I will have done something worthwhile.

They will never know what credentials I had.

They will not know what an Enrolled Agent is.

They definitely will not care that I was admitted to practice before the United States Tax Court.

A dog does not care about your résumé.

A dog has never once asked to see my evaluation scores.

They care that you came home.

Subscribe now

There is something wonderfully humbling about that.

Maybe the word I have been looking for isn’t success.

Maybe it is enough.

Enough is a difficult word for ambitious people because it sounds suspiciously like settling.

And I hate settling.

“Good enough” has never been a philosophy that appeals to me.

But that is not what I mean by enough.

Enough doesn’t mean I stop building or learning or wanting things.

It means wanting something tomorrow does not require me to declare today inadequate.

Maybe I need to learn to hold several truths at once:

I worked hard for this.

I had help.

I am proud.

I still have much to learn.

I want more.

And this is already enough.

Yesterday, I was admitted to the bar of the United States Tax Court.

Today my brain has already produced a list of other things I should accomplish.

I am still me.

I will keep building things. I will keep setting goals. I will probably continue moving the finish line when I am not paying attention.

But I would like to get better at remembering that eventually the finish line stops moving.

There will be a last project.

A last class.

A last email.

A last cappuccino.

A last ordinary Tuesday.

And when that happens, none of the things I spent so much time proving will matter nearly as much as how I spent the time between now and then.

Maybe success is not being remembered as impressive.

Maybe it is being remembered as kind.

We need more of that in the world.

And if, when all of this is over, the world contained a few happier people and a few animals who knew they were loved because I was here, that will be enough.

Leave a comment

Share

They talk about AI as a tool for strategy and research, the risk of outsourcing too much thinking, and why responsibility still belongs to the people building, deploying, and relying on the technology.

Then the conversation turns to accountability in the tax profession: jealousy, scarcity thinking, gatekeeping, toxic behavior, discrimination, sexual harassment, and the importance of speaking up when professional conduct crosses the line.

Also in this episode: Josh’s SpaceX AI meetup in Austin, Cal Newport’s take on AI and agents, work-life balance, and why technology should support professional judgment rather than replace it.

Plus, Josh previews the IRS Tax Forums in San Diego and AskTomG.ai demos, while Shannon shares what’s coming up with Brass Tax.

Explicit: Strong language sometimes and adult topics.

A brief departure from my usual writing about taxes, practice management, and technology.

This is not intended as a partisan political statement, although I recognize parts of it may be read that way. It is simply what I remember, and what I find myself thinking about twenty-five years later.

Today marks twenty-five years since September 11, 2001.

It is also my mom’s birthday.

I remember the uncertainty of September 11 more than anything.

The feeling that no one really knew what was happening. Whether there would be more attacks. Whether another city would be hit. Whether the country was safe. Whether the world had just changed permanently.

And, of course, it had.

I remember the small things, too. The strange details that attach themselves to memory while history is unfolding.

I remember opportunists raising gas prices because they saw fear and uncertainty and decided there might be money in it.

And I remember the outrage that followed.

There was still, at least in that moment, a broadly shared expectation that public crisis was not an invitation to fleece people. Public officials condemned it. Ordinary people condemned it. The behavior itself was understood to be shameful.

It is strange what stands out twenty-five years later.

Not because that was remotely the most important thing that happened that day, but because memory works that way. It preserves flashes.

A television screen.

A phone call.

A crowded gas station.

A feeling in your stomach that something terrible had happened and that nobody yet understood what came next.

I also remember something else from rural East Texas.

I remember Muslim families, Indian and other South Asian families, and people who suddenly had reason to fear that they might be viewed as foreign or suspect quickly putting up American flags.

Some of that, I am sure, was solidarity.

But even then, I understood that some of those flags probably carried another message too:

We are Americans. We are with you. We are not the enemy.

There is something heartbreaking about that memory now.

In a moment when the country had been attacked, some of our neighbors apparently felt the need not only to grieve with us, but to reassure us that they belonged among us.

In a country that had long described itself as a melting pot, some Americans suddenly found themselves feeling as though they needed to prove they belonged.

That, too, is part of what I remember about the days after September 11.

There is a school of thought that says if you did not lose someone that day, if you were not in New York or Washington or Pennsylvania, if the attacks did not alter your life in some direct and personal way, perhaps you should say nothing.

I understand the instinct behind that.

There are people for whom September 11 is not history.

It is the day their husband or wife did not come home.

Their daughter.

Their father.

Their friend.

It is a voicemail saved for decades, an empty chair at the holidays, a child who grew up knowing a parent mostly through photographs and other people’s memories.

Their grief belongs to them.

The rest of us should be careful not to borrow it in order to make ourselves part of the story.

Humans have a tendency to do that.

But I don’t think that means we should be silent.

In fact, twenty-five years later, I think remembering may be more important precisely because fewer of us have a direct connection to what happened.

Memory changes as events move from lived experience into history.

The sharp edges soften.

The images become archival footage.

The names become numbers.

Eventually, a day that once seemed impossible to forget becomes something a generation learns about in a classroom.

That is how time works.

But it is also why remembrance matters.

I remember September 11 not because I believe my experience of that day deserves special attention.

It doesn’t.

I remember because nearly 3,000 individual human beings began an ordinary Tuesday expecting to come home.

They went to work.

They boarded airplanes.

They poured coffee.

They kissed someone goodbye.

They made plans for dinner.

Somewhere else, someone was celebrating a birthday.

And then history arrived without asking anyone’s permission.

There is something almost unbearable about the ordinariness of that morning before everything changed.

But there is another part of that time I find myself thinking about now.

For a moment, the world seemed to pause with us.

People gathered outside American embassies.

Flowers appeared.

Candles were lit.

Strangers thousands of miles away mourned people whose names they would never know.

Our allies stood beside us, but it went beyond governments and treaties.

The day after the attacks, NATO took the unprecedented step of invoking Article 5, its collective-defense provision, for the first time in the alliance’s history.

There was a sense that the attacks in New York and Washington, and the crash of Flight 93 in Pennsylvania, had wounded something larger.

The world grieved with the United States.

I do not want to romanticize that moment.

The years that followed were complicated. Decisions were made in the name of September 11 whose consequences we are still reckoning with.

But I cannot look at America’s place in the world twenty-five years ago and compare it with our place in the world today without feeling a profound sadness.

That is not intended as a partisan statement.

It is not about one president, one election, or one political party.

It is simply an observation about something we once possessed in enormous measure: the sympathy, trust, goodwill, and moral standing of much of the world.

Whatever one believes about how it happened, some of that has been lost.

And loss is part of what September 11 asks us to contemplate.

Not only the enormous, irreplaceable loss of human life that morning, but the things that disappeared in its aftermath.

A certain innocence, perhaps.

A sense of security.

Eventually, some of the goodwill the world extended to us when we were wounded.

Fear changed us.

It shaped our politics, our wars, our airports, our surveillance, our attitudes toward one another, and our understanding of security.

And here again I think about those flags in East Texas.

About people who had done nothing wrong feeling the need to visibly demonstrate that they were on our side.

About how quickly fear can turn neighbors into categories.

About how easy it is, when we are frightened, to decide that belonging has to be proven.

Remembering September 11 honestly requires remembering those things too.

Commemoration should not require mythology.

We can honor the people who died without pretending every decision made afterward was wise.

We can admire the heroism of that day without turning tragedy into a political weapon.

We can remember a moment of extraordinary national unity while acknowledging that unity did not extend equally to everyone.

We can remember a time when exploiting a frightened public was met with outrage rather than admiration for the cleverness of the grift.

And we can remember what it felt like when much of the world looked toward the United States not with suspicion or indifference, but with compassion.

Perhaps that is worth mourning too.

There is a difference between saying, this tragedy belongs to me, and saying, these people should not be forgotten.

I did not lose anyone on September 11.

I will not pretend that I understand the grief of those who did.

But today, I will remember them.

I will remember the office workers and the flight attendants, the firefighters and police officers, the people sitting at their desks and the people running toward danger.

And yes, I will remember the animals who worked alongside their handlers in the aftermath.

I will remember the families who have now lived twenty-five years with an absence that never became historical to them.

I will remember the uncertainty.

I will remember those flags.

I will remember a world that, briefly, stopped and grieved with us.

And I will wish my mother a happy birthday.

Because that is the strange thing about history.

Even on the days that change the world, ordinary life keeps existing alongside it.

Birthdays still happen.

Families still gather.

People still love each other.

And somewhere, someone still assumes there will be another Wednesday.

A quarter-century later, remembering that does not feel like saying too much.

It feels like the least we can do.

Share

Special thanks to Matt Metras, EA, for bringing this to my attention.

A hardware review channel on YouTube spent roughly 500 hours and about $70,000 taking apart televisions, and the result should probably change how you think about every appliance in your house that has a power cord and an opinion.

On September 6, Gamers Nexus published a 135-minute investigation into LG smart TVs, conducted with Wendell Wilson of Level1Techs and independent security researchers MrBruh and uturn. They bought retail sets, including the flagship G5 OLED. They watched the network traffic with Wireshark. They decrypted and decompiled firmware, rooted the televisions, and read the logs.

What they found is not a story about one bad company. It is a story about a bargain most of us accepted without ever being asked.

Let’s dig into what they actually found, because the headlines are compressing three very different problems into one scary sentence.

The television was mapping the house

The researchers found the tested LG sets repeatedly sweeping the local network and identifying other hardware on it. In one test, a single television inventoried at least 38 other devices, including smartphones belonging to staff who had no idea the test was running, plus smartwatches, printers, a 3D printer, thermostats, and HVAC equipment.

Firmware analysis also showed the sets picking up nearby Wi-Fi networks, including names, signal strength, and channel.

None of those devices were ever connected to the television. They were simply nearby.

Now, before anyone with a security background objects: device discovery on a local network is ordinary. Protocols like UPnP exist precisely so your phone can find your printer. Discovery by itself is not an incident.

What is unusual is the scope, the persistence, and the apparent purpose. This is not a television looking for a speaker to pair with.

I bought a display. Apparently I also bought something that keeps a running census of my house.

Automatic Content Recognition does not care which input you use

Automatic Content Recognition, or ACR, is the advertising technology at the center of this. It samples what is on the screen, turns it into a fingerprint, and matches that fingerprint against a reference database to identify the content.

The important part, the part most people get wrong: ACR keeps working when the television is being used as a plain HDMI monitor. Switching inputs does not switch it off. Gamers Nexus estimated one test set exchanged roughly 4GB of ACR-related data per month.

So if you run a laptop into an LG panel, the fingerprinting engine is still sampling. One physician who reviewed the findings reportedly asked the researchers the obvious follow-up question: what does that mean for a hospital display carrying a telemedicine session?

Hold onto that question. We are coming back to it.

The microphone finding, stated carefully

This is where accuracy matters more than outrage.

Researchers demonstrated intelligible microphone audio being captured while the television’s display appeared to be off in standby. They also found that disconnecting the set from the internet did not necessarily stop it. The television kept writing data locally and transmitted it once connectivity returned. Voice interactions were converted to plain text and stored in logs on the device itself.

Separately, they reported security vulnerabilities that would let a compromised television be used as a listening device. Those specifics are being withheld under responsible disclosure, which is exactly how it should be handled.

Here is the nuance that makes this a better story than “your TV is spying on you.” Gamers Nexus did not claim LG ships always-on eavesdropping. Cybernews noted that the findings relate to voice command handling rather than ambient background conversation, and that the researchers’ recommendation was practical rather than apocalyptic: disconnect the television and use an external streaming box.

Note the distinction, because it matters in the next section. “The television is off” and “the display is off” are not the same statement.

Texas had already challenged this

Here is the part I did not expect: Texas had already been litigating this.

On December 15, 2025, Texas Attorney General Ken Paxton sued five television manufacturers (Samsung, LG, Sony, Hisense, and TCL), alleging they used ACR to collect viewing data without consumers’ knowledge or meaningful consent. The complaints sought penalties under the Texas Deceptive Trade Practices Act of up to $10,000 per violation, and potentially up to $250,000 per violation for qualifying violations involving consumers age 65 or older.

Samsung reached an agreement on February 26, 2026. LG’s agreement was announced on May 11, 2026.

Under the LG agreement, the company will not use ACR to collect viewing data without informed consent, must display a pop-up disclosure explaining how viewing data may be collected and used, and must give consumers a clear way to opt out. The Attorney General’s announcement describes behavioral requirements rather than a monetary penalty, and LG admitted no liability. Cases against Sony, Hisense, and TCL remained pending.

Four months after that announcement, Gamers Nexus reported that in its testing, the “Do Not Sell My Personal Information” setting was still off by default, before a buyer had connected to the internet or agreed to anything.

A settlement changed what the company must disclose. It did not change what the device is capable of doing.

That gap, between a legal remedy and an engineering reality, is the whole ballgame.

LG’s denial answers a narrower question

Now put LG’s public statement against that backdrop.

In July, responding to earlier controversy, LG said its televisions do not collect, record, or store “ambient conversations,” and described voice recognition as an optional, user-initiated feature.

Read that sentence again and notice what it does not say.

It does not say the microphone is inactive in standby. It does not say the listening window closes the instant a request ends. It does not address local storage, or network scanning, or ACR sampling of an HDMI input. The denial is doing a lot of work, but mostly by answering a narrower question than the one being asked.

That is not a lie. It is a carefully bounded true statement, which is a different thing, and anyone who has read a privacy policy for a living recognizes the technique immediately.

Meanwhile, the same investigation surfaced footage of LG Ad Solutions president Serge Matta telling an audience, “We own the glass. We own the TV.”

Whatever he meant by it, it is a clarifying sentence. LG Ad Solutions puts its footprint at roughly 216 million smart TVs worldwide. At that scale, advertising is not an incidental feature bolted onto the television business. It is part of the business model, and the hardware is how you reach the audience.

Why this is a professional problem, not just a consumer one

Now back to that physician’s question, translated into our wonderful world of tax.

If you are a tax professional, you are a “financial institution” under the Gramm-Leach-Bliley Act, and the FTC Safeguards Rule requires you to maintain a written information security program. IRS Publication 4557 walks through the same expectations for practitioners.

The rule focuses on identifying and assessing risks to client information. A competent risk assessment has to account for the devices and information systems on your network: what is connected, what it can access, and what it can transmit.

Pull up your WISP and look at what you listed. Is the television on it? I know it isn’t. I know you’re rolling your eyes at me.

I am fairly confident yours covers workstations, laptops, phones, the network printer, maybe the router. I am equally confident it does not mention the television in the room where you take client calls.

That television, per this investigation, may be enumerating devices on the same network your practice management system lives on. It has a microphone. Its content-recognition system can keep sampling the display even when the display is being fed by an external computer.

To be clear about where the evidence stops: the investigation did not establish that LG was reading the contents of documents on screen. ACR fingerprints content to match it against a reference database, and your client’s Form 1040 is not in that database. But from a security standpoint, the fact that a content-recognition system tied to advertising can analyze an HDMI-fed screen at all is worth considering in your risk assessment.

And the operating system underneath it is a Linux derivative whose long-term security depends entirely on the manufacturer continuing to support it. LG’s webOS Re:New program promises four webOS upgrades over five years on covered models, with eligibility varying by model and year. That is a real commitment, and it is more than some competitors offer. It is also quite possibly less time than the panel will remain hanging on your wall.

We spend real money on endpoint protection and multi-factor authentication, and then we put an unmanaged, ad-funded, internet-connected computer with a microphone in the room where we discuss collection alternatives with people in the worst month of their financial lives.

What to actually do

Subscribe now

None of this requires paranoia. It requires about twenty minutes.

Turn off ACR. On LG sets, the ACR feature runs under Live Plus: Settings > General > System > Advanced Settings > Live Plus. Turn it off. While you are there, decline personalized advertising and turn off voice features you do not use.

Install firmware updates. Vulnerability findings are only useful if the patch reaches the device.

Take the television off your main network. The cleanest version: do not connect the panel itself to Wi-Fi or Ethernet at all. Use an external streaming box instead. I like Apple TV. That does not eliminate tracking or data collection, but it removes the television’s operating system from your trusted network and lets the panel be a panel.

If you will not disconnect it, segment it. Most modern routers support a guest network or a separate VLAN. Put every IoT device on it. The television can talk to the internet without talking to the machine holding your client files.

Some will argue that you should have an entirely separate internet connection for work and home. That is cleaner, but most people working from home are not going to pay for a second broadband connection. If you’ve ever been in my cybersecurity or WISP class, you know I will say that security is a spectrum.

Then put it in your risk assessment. Not because a regulator will ask about your television. Because the exercise of writing down every device that can hear, see, or enumerate your office is the entire point of having a plan.

The bigger question nobody asked

We have spent twenty years making appliances “smart” without ever stopping to ask whether they needed to be computers.

The refrigerator. The doorbell. The thermostat. The light bulbs. The vacuum. Every one of them arrives with an operating system, network access, cloud services, telemetry, an authentication scheme, and sometimes a microphone or a camera. Which means every one of them also arrives with software vulnerabilities, a privacy policy, an eventual end-of-support date, an advertising incentive, and a company whose economic interests are not identical to yours.

Nobody sat us down and offered that trade. It arrived as a default, and defaults are the most powerful thing in technology precisely because we so rarely examine them. We tolerate an astonishing amount of accumulated complexity, not because we evaluated it and decided it was worth it, but because reconsidering the default never made it to the top of the list.

This one is worth moving up the list. An LG OLED is a genuinely spectacular piece of glass. Let it be glass.

Sometimes the smartest thing you can do with a smart appliance is make it stupid again.

Later this month, I will be teaching a cybersecurity workshop for NATP.

Leave a comment

Sources

• Gamers Nexus, investigation into LG smart TVs, September 6, 2026 (with Level1Techs, MrBruh, and uturn)

• Cybernews, “Are 200 million LG TVs listening in, even when switched off?”

• CyberInsider, “LG Smart TVs found scanning home networks for nearby devices”

• Malwarebytes Labs, “LG TV flaws could let attackers listen in, even in standby mode”

• The Verge, “LG TVs caught spying even when offline or on standby”

• All About Cookies, “LG Smart TVs Caught Listening With the Screen Off”

• TechRadar, LG statement on ambient conversations, July 2026

• Office of the Texas Attorney General, LG settlement announcement, May 2026

• Secure Privacy, “Samsung and LG’s Texas ACR Settlements”

• Fordham Center on Law and Information Policy, “Your Smart TV May Be Watching You Back”

• LG, webOS Re: New Program

• FTC Safeguards Rule, 16 C.F.R. Part 314

• IRS Publication 4557, Safeguarding Taxpayer Data

Share

I have a habit I am not especially proud of, but not entirely ashamed of either. I buy technology to make my life better, and then I use roughly 5% of it.

Not because the tool is bad. Because configuring it fully requires a block of attention I never schedule, and the half-configured version works well enough that I stop noticing. The device gets used the way a smartwatch gets used as a watch. Technically functional. Almost entirely wasted.

Back in March, when I wrote about switching to voice dictation, I made a passing comment I keep coming back to: anytime I feel friction while working, I stop and ask whether there is a better way to operate.

That is an easy sentence to write. It is a harder thing to do at 2 p.m. on a Tuesday when the friction is small, and the deadline is not.

So here is the more useful version of the idea:

Most of the annoyances in your day are not twenty-minute problems waiting to be solved. They are twenty-minute problems you have been solving manually, five seconds at a time, for two years.

This week I finally sat down with two of mine.

I have two high-end Macs, and neither has ever stopped macOS from behaving in ways I didn't ask for. Let’s dig into both fixes, including the parts that did not go smoothly, because the messy version is more useful than the tidy one.

Fix one: the pedal in the drawer

Somebody recommended an Elgato Stream Deck Pedal to me a while back. Three pedals, heavy metal base, swappable springs, $89.99.

I bought it, plugged it in once, and put it in a drawer upstairs.

I do not even remember what I was going to use it for, but I am sure I had some grand vision.

Then I saw someone mention using a foot pedal to trigger Wispr Flow, the dictation tool I now use for most of my writing.

That clicked immediately.

I dictate dozens of times a day, and every one of those starts with a keyboard shortcut, which means my hands leave whatever they are doing so I can talk instead of type. A small, constant tax.

Meanwhile my foot has nothing to do at all.

What I wanted was true push-to-talk:

Pedal down, start listening. Pedal held, keep listening. Pedal up, stop and insert the text.

Three things stood between me and that.

The default shortcut was never going to be the easiest option. Flow’s push-to-talk shortcut on a Mac defaults to the Fn key, and Fn is a special case on the Mac, which is why Flow ships Control + Option as its fallback.

So I rebound push-to-talk to Control + Option. That worked perfectly from the physical keyboard, and it had another advantage: it is modifier-only, so I am not accidentally typing characters into whatever happens to be open. It also leaves Command + Control + Option available for Flow’s Command Mode.

A hotkey is not a hold. Stream Deck’s standard Hotkey action sends a shortcut. Push-to-talk needs a genuine key-down when the pedal goes down and a genuine key-up when it comes back up.

The Key Hold plugin from the Elgato Marketplace does exactly that, so its Hold Key action went on the left pedal.

And then it simply did not work.

Everything looked right on screen. Control + Option started and stopped dictation perfectly from the physical keyboard, which told me the problem lived somewhere on the Stream Deck side.

The temptation at that moment is to rip the plugin out and try another one.

Instead, I opened the plugin’s log.

The actual answer was sitting there:

helper failed to start: .../bin/keyholder EACCES

The plugin ships a small native helper called keyholder that does the real work of holding the keys down. The helper was there, but macOS was refusing to execute it because the executable permission was missing.

One chmod restored the executable bit, I restarted Stream Deck, and it worked exactly as intended.

Holding the pedal while I talk feels nothing like pressing a shortcut. It feels like using a transcription pedal, which is to say it feels like it should have worked this way from the start.

One caution worth writing down: a plugin update could replace that helper and strip the permission again. If the pedal quietly dies after an update, the log and that EACCES line are the first places I will look.

There is probably an attention-span lesson buried in this too.

My first instinct when the plugin failed was not to diagnose it. It was to replace it. I do not think that instinct is unusual. We have gotten very good at trying something once, deciding it does not work, and moving on. I am certainly not immune to that.

In this case, thirty seconds spent reading a log saved me from starting the entire search over again.

Fix two: half a second, over and over

The second fix cost nothing at all.

I run multiple Spaces (Apple’s name for virtual desktops) all day, and I keep Reduce Motion turned on because sweeping animations genuinely make me motion sick.

The same thing happens when I am a passenger in a car, particularly when Luis is driving, although that may be an entirely separate issue.

Think real-life Mario Kart.

With Reduce Motion enabled, switching Spaces produced an ugly side effect for me: a brief black screen before the next desktop appeared.

Call it half a second.

Half a second is nothing.

Half a second every time you switch, all day long, each one punctuated by a black flash, is not nothing.

Nothing I tried suggested this was a hardware bottleneck. It happened on a specced-out MacBook Pro, which is not a machine anyone can reasonably accuse of being slow. Restarting the Dock did not touch it. The pause appeared to be part of macOS’s Space-switching transition rather than a performance problem.

Years ago, a utility called TotalSpaces made desktop switching instantaneous, but its old approach no longer works cleanly on current versions of macOS.

What replaced it in my setup is a small, free, open-source project on GitHub called InstantSpaceSwitcher, installed through its Homebrew tap:

brew install --cask jurplel/tap/instant-space-switcher

Two notes for anyone following along, because this is where people tend to make a bad decision.

The app is not signed through Apple’s developer program, so macOS may block it on first launch. The correct fix is the normal per-app exception under System Settings → Privacy & Security → Open Anyway. (Always make sure you actually trust the software or plugin, or script before you run it, and if you have suspicions, make sure you have verified it is safe.)

There is never a reason to disable Gatekeeper or System Integrity Protection for something like this, and any utility that demands you do is a utility that does not go on a machine holding client data.

InstantSpaceSwitcher also needs Accessibility access because it intercepts the gesture and substitutes a synthetic, extremely fast one that effectively skips the normal transition.

The result is about as simple as software gets:

Swipe, desktop.

No animation. No black pause. The next Space is just there.

My reaction the first time I tried it is not printable in a newsletter.

Total cost: zero dollars and one sitting.

One honest note

It would be fair to say that this was more difficult than it needed to be.

Some of this kind of customization is less fussy on Windows. macOS is particularly protective about software that wants to press keys, control the interface, or intercept gestures on your behalf.

In this case, that is exactly what I was asking two third-party utilities to do.

Much of what I described above is Apple’s protective layer doing exactly what it is designed to do: making it harder for software to simulate input or control parts of the system without permission.

I would still rather have those protections than not, given what sits on these machines. But there is no version of this where I pretend the finagling was necessary. It is part of the price of the platform, and it is worth knowing that going in.

The part where AI actually earned its keep

This is worth naming, since this newsletter spends a lot of time on AI and most of that time is spent on the flashy uses.

I did not solve either of these from scratch.

I opened a conversation with ChatGPT and described what I wanted to accomplish in plain language, as an outcome.

Not: “What is the API for macOS Spaces?”

Just: here is the annoyance, here is what I want instead, what are my options?

Then I worked through the answers, checked the settings myself, and read the log when something failed.

That may be the most useful thing AI changed in this whole exercise.

It did not magically fix either problem.

It changed the economics of whether the problems were worth fixing at all.

Before, a five-second annoyance might have had a twenty-minute solution, but finding that solution could mean an evening of Google results, old forum posts, Reddit threads, abandoned GitHub issues, and experiments that went nowhere.

The uncertainty was enough to make ignoring the problem rational.

Now I can describe the outcome I want in plain language and get to the useful part much faster. I still decide what gets installed, what permissions it gets, and whether the answer makes sense.

It does the digging.

I stay the one deciding what actually changes. But it can take the solution and implement it. You can grant access to another application, and it can change the settings. That is the magical part.

The unglamorous, genuinely useful version of AI: compressing the research phase of a small annoying problem enough that the twenty-minute fix stays a twenty-minute fix instead of quietly becoming a Saturday.

The distinction that matters

Not every annoyance deserves twenty minutes.

This is where advice like this usually goes wrong. It becomes “optimize everything,” which is really just permission to spend Saturday installing apps you will abandon by Thursday.

The line I try to hold is between the twenty minutes that retires a problem and the twenty minutes that adds one more thing to maintain.

Three questions before you spend it:

How often do I actually hit this? A few times a month, let it go. Dozens of times a day, and you have been paying that toll for years without ever counting it.

Does the fix use something I already own? Not always possible, but this is where some of the highest returns hide. The unopened box. The feature never enabled. The setting you did not know existed. You already paid for it. The only remaining cost is attention.

If it breaks in six months, what happens? A good fix degrades back to how you work today, which is exactly what both of mine do. A bad fix becomes a dependency, and then you have a new problem wearing a solution’s clothes.

What to do with this

Here is the assignment, and it is deliberately small.

Between now and next week, notice one thing that irritates you more than once a day. Not the big broken process. The small one. The click you always make twice. The file you always go hunting for. The shortcut your hands leave the keyboard to press.

Write it down the moment it happens, because you will not remember it later. That is exactly why these things survive for years: too small to remember, too frequent to matter.

Then give it twenty minutes and whatever you already own.

And if you would rather not troubleshoot it alone, this is something I would like to try for paid subscribers.

Subscribe now

Send me one tech pain point to start.

The click you make twice. The app that will not behave. The thing you bought and never set up.

I will write back with what I would try, and when it is the kind of problem that is easier to show than describe, I will send a short screen recording instead.

I will also periodically write about some of the more interesting pain points readers send in or leave in the comments, along with the fixes that worked.

That is the part worth sitting with.

Neither fix required new hardware, a new subscription, or a rebuilt workflow. One was equipment already sitting in my house. One was a free utility somebody published on GitHub for no reason other than the same thing annoyed them.

The technology was already here.

What was missing was twenty minutes and the willingness to stop treating the annoyance as too small to fix.

Which brings me to what is next on the list.

I own an expensive digital camera that spends most of its life being an expensive object.

It can be used as a webcam.

Twenty minutes, a cable, and the right software would put it on every Zoom call I take, and I have quietly been hoping that looking slightly more cinematic on Zoom might take fifteen years off me.

I will report back.

But I suspect this is where we find the limits of what technology can actually fix.

Share

Gloria Steinem died Wednesday at her home in New York City. She was 92. The announcement came from her own Instagram account and her foundation’s, and it said she kept working for equality until the very end. Secretary Hillary Clinton, paying tribute, put it better than I could: “She pushed open doors not just for herself, but for literally millions of women behind her…..”

What I want to write about is narrower, and it is one thing I know how to do, which is read the law. Because here is what I have come to believe after a few years of representing people in front of the IRS: statutes are a confession. They’re where a society writes down what it assumes and then charges money on that assumption. And the assumptions about women (and others) are still sitting in the Internal Revenue Code, some of them in the past tense, some of them very much not.

First, the personal part

I would not have a tax practice without women.

My Family

My great-grandmother, who always thought I was capable of anything and always wanted me to succeed in business. Sadly, she didn’t live long enough to see that happen.

My grandmother, a retired enrolled agent. That’s how I even knew what an EA was. As a child, I witnessed her tirelessly advocate for her clients and represent them before the IRS. She worked extremely long hours in an era that lacked technology and most certainly didn’t see women as equal.

My mother, who has always been my biggest supporter. From good to bad, she is always there to listen or go to war on behalf of her children if needed.

My sister Hollie, who works alongside me. EA, MBA, amazing mother, and the person who catches the things I may not think about. No version of The Youngblood Group functions without her.

My friends

I wouldn’t stay sane (okay, fine, semi-sane) without the women in my life.

Meg (who is not in tax) and I text a lot, at strange hours, about a wide range of topics. She also does a lot of my editing for writing for publications. It is nice to have a friend outside of the industry so you can get a different perspective.

Natalie taught me so much about real estate but has also, over the years, given me unique perspectives on various world issues I wouldn’t have considered.

Shannon and I host a podcast together, an idea that arose over good vegan food and talking about the troubles of the industry. We also went through the USTCP process together (we’re still waiting on admission). Shared trauma, perhaps?

I met Sherrill a few years ago at a dinner. She convinced me I could do something very hard and always gives her honest opinion. Honest, straightforward feedback is rare these days, and I treasure it.

Amber was perhaps the first tax professional I became friends with. I will never forget my first tax conference, and being the very introverted person that I am, she made sure I talked to people. She has also given advice and referrals, and has been known to vigorously defend her friends in social media “discussions.”

Now, therapists aren’t our friends; they are our therapists. However, I think we should all have one, and Candy has certainly contributed to my success.

“Not that long ago” is doing a lot of work

Here is the thing most people, including most tax professionals, have no feel for: the legal architecture that made women financially dependent was not dismantled in some long-forgotten era. It came down in the lifetime of people who are currently working.

Let’s look at the actual dates.

The Equal Credit Opportunity Act was signed on October 28, 1974, and took effect one year later. It did not give anyone a right to credit; nobody has that. It made it unlawful to discriminate in a credit transaction on the basis of sex or marital status. (Race, color, religion, national origin, age, and additional protections came in the 1976 amendments.) Before that, federal law did not prohibit a lender from denying a woman credit or pricing it higher because she was a woman or because she was unmarried. Banks routinely required a male cosigner, a husband or a father or a brother, on applications for credit cards, loans, and mortgages. Regulation B, which gave it teeth, took effect alongside the statute in 1975.

The federal Fair Housing Act did not prohibit sex discrimination in housing until August 22, 1974, when a provision of the Housing and Community Development Act of 1974 added “sex” to its protected classes. The original 1968 Act covered race, color, religion, and national origin. For six years, a landlord could turn a woman away, or charge her more, on the basis of sex, and the Fair Housing Act had nothing to say about it.

Billie Jean King won Wimbledon six times in singles and holds a record twenty titles there overall. In 1971 she became the first woman athlete to earn more than $100,000 in a single season. And in the early 1970s, by her own account, she still could not get a credit card in her own name. Credit ran through her husband’s income, and her husband was a law student she was supporting.

You will often hear that women could not open a bank account before 1974. That is not entirely accurate. There was not a federal law that barred women from holding a bank account, but the states and bank policy varied significantly.

What was true is arguably worse, because it was structural rather than statutory. Credit was rationed by marital status as an ordinary, lawful business practice. A married woman’s card was issued as “Mrs. Husband’s Name,” and here is the part that matters: the credit history accrued to him. She could pay every bill on time for twenty years and have no file of her own. So when he died, or when the marriage ended, she was not a person with damaged credit. She was a person with no credit, starting from zero at fifty.

Translation: the law did not have to forbid her from participating. It just had to permit a system in which, when she did participate, the record belonged to somebody else.

Now, let’s talk about some tax implications.

Moritz v. Commissioner: Caregiving, Gender, and the Tax Code

Before the innocent spouse cases, one detour, because it may be the oddest feminist tax case in American law, and it is strange because the taxpayer was a bachelor from Denver.

Charles E. Moritz was a never-married man who worked and cared for his elderly invalid mother, who lived with him and whom he supported. He was an editor for a Philadelphia publishing house, running its western division out of his home in Denver and traveling eleven states to visit authors. In 1968, he paid for nursing help so that he could continue going to work, and he claimed a dependent-care deduction under what was then IRC § 214.

At the time, former § 214 did not make the deduction available to every taxpayer who paid dependent-care expenses in order to remain employed. It drew categories. In substance, the deduction was available to a taxpayer who was a woman, a widower, a divorced man, or a husband whose wife was incapacitated or institutionalized, but only where the care was for the purpose of enabling the taxpayer to be gainfully employed.

That meant the statute could reach a working woman. It could reach a widower. It could reach a divorced man. It could reach a married man whose wife was incapacitated or institutionalized. But it did not reach Moritz: a man who had never married and who was paying for care for his dependent mother so he could keep working.

The Code did not expressly ask who was actually doing the caregiving. It sorted taxpayers by assumptions about who needed relief from caregiving duties to work. The premise was gendered: caregiving was treated as women’s work, and the tax benefit was structured around that assumption.

The IRS disallowed Moritz’s deduction. He took the case to the Tax Court himself, without a lawyer, and lost. On appeal, Ruth Bader Ginsburg and Martin Ginsburg took the case and argued it together, she as a constitutional lawyer building a sex-discrimination strategy, he as a tax lawyer who understood the Code’s mechanics.

Subscribe now

On November 22, 1972, the Tenth Circuit reversed. In Moritz v. Commissioner, 469 F.2d 466 (10th Cir. 1972), the court held that former § 214’s classification violated the equal-protection component of the Fifth Amendment’s Due Process Clause. The Supreme Court declined review, leaving the Tenth Circuit’s decision in place.

The strategy matters because it captures the Ginsburg method in miniature. The vehicle for a foundational sex-discrimination argument was not a woman excluded from the workplace, but a man denied a caregiving deduction. A legal regime built on assumptions about women also confined men. And a court that might not yet see the full injury when discrimination ran in one direction could be made to see it when the same stereotype injured someone on the other side of the line.

Here is a detail that makes the case stranger still. By the time the Tenth Circuit ruled, Congress had already rewritten the statute. The Revenue Act of 1971 removed the sex-based classification from § 214, but only for taxable years after 1971. Moritz’s case was about 1968. He was left to fight over the year when the old rule still applied.

The statutory story did not end there. Former § 214 did not survive the decade. The Tax Reform Act of 1976 repealed it and replaced the deduction with a credit, originally codified as IRC § 44A and now reflected in IRC § 21.

Today’s dependent-care credit under IRC § 21 is framed differently. It applies to employment-related expenses paid for qualifying individuals, including certain dependents who are physically or mentally incapable of self-care, where the expenses are incurred to enable the taxpayer to be gainfully employed. Under those rules, care for an elderly parent may qualify when the statutory requirements are met.

The deduction that assumed care was women’s work did not survive. But Moritz remains important because it exposed the deeper flaw: when law writes stereotypes into tax rules, it does not merely burden the group supposedly being “protected.” It organizes everyone’s life around the stereotype.

Innocent spouse, and who actually walks through the door

When two people file a joint return, § 6013(d)(3) makes them jointly and severally liable for the entire tax. Not half each. Each of them, for all of it. The IRS may collect the whole balance from either one, and it does not care which of them earned the income, wrote the checks, or understood the return.

I want to be fair about this before I go further. Innocent spouse relief cuts both ways. I have represented men on these claims. I have seen cases where the requesting spouse was the one running the scheme and the claim was opportunistic.

The statute is written in neutral terms, and it should be.

But you cannot look at the history of this provision, or at a caseload, and pretend the neutrality is the whole story. For most of the twentieth century, the household model the joint return was built on had one person earning, one person managing the money, and one person signing where she was told to sign. And as we just covered, federal law still permitted creditors to discriminate on sex and marital status, while ordinary credit reporting practices could leave a married woman without an independent financial history of her own.

Put the two dates next to each other. The modern joint return, with income splitting, arrived in 1948. Congress did not prohibit sex and marital-status discrimination in credit until 1974. That is twenty-six years in which a wife could be held personally liable for the entire tax on a joint return while a lender could lawfully turn her down because of her sex or her marriage, and while ordinary credit-reporting practice could leave her with no independent record of her own.

Congress noticed slowly. The first innocent spouse provision came in 1971, in Public Law 91-679. The modern framework, IRC § 6015, dates to the 1998 restructuring act, with three doors: traditional relief under 6015(b), allocation of the liability under 6015(c) for spouses who are divorced, legally separated, widowed, or who have not lived in the same household for the preceding twelve months, and equitable relief under 6015(f) when neither of the first two fits. For those of us in community property states, § 66(c) provides separate relief from the operation of community income rules, generally in non-joint-return cases.

A Name to Know

Cathy Lantz. Her husband was a dentist who went to prison for Medicare fraud. They had been married six years. He told her he would take care of the tax problem. He did not. He asked the IRS for the innocent spouse form, called her “the innocent spouse” in his own correspondence with the Service, and died before he filed it.

By the time she sought innocent spouse relief, she was unemployed and broke. In 2006 the IRS took her $3,239 refund and applied it to a joint 1999 liability that had grown past $1.3 million. That is what finally sent her to file. The IRS did not reject her because the equities were weak. It conceded she would have qualified. It rejected her because she missed a deadline, a two-year deadline the Service wrote into its regulations for equitable relief under § 6015(f).

The Tax Court held that deadline invalid, in a divided opinion, with a law school clinic at Valparaiso University handling her case. Congress had put two-year limits directly into §§ 6015(b) and 6015(c), but not into § 6015(f), the catch-all equitable-relief provision. That omission mattered. If Congress had wanted the same deadline there, the Tax Court reasoned, it knew how to say so. Lantz v. Commissioner, 132 T.C. 131 (2009).

The Seventh Circuit reversed. In Judge Posner’s opinion, the agency could impose a filing deadline even where Congress had not written one into the subsection itself. So Lantz lost, not because the case against relief was compelling, but because the court upheld the regulatory time bar. Lantz v. Commissioner, 607 F.3d 479 (7th Cir. 2010).

And the detail I cannot get out of my head is this: in the same opinion that enforced the deadline against her, the court walked through the hardship tools the Service already had. Release of a levy that creates economic hardship under § 6343(a)(1)(D). Currently-not-collectible status. And then the court noted the irony that the Service had already declared the taxes owed by her husband, the crooked dentist, currently not collectible, and that she was entitled to the same relief a fortiori, with no deadline for seeking it. In other words, the system had tools for mercy. It had used one on him.

She lost. But the IRS later abandoned the two-year deadline for equitable relief anyway. In Notice 2011-70, the Service announced that § 6015(f) requests would no longer be barred merely because they were filed more than two years after the first collection activity. Rev. Proc. 2013-34 carried that approach forward. Then in 2019 Congress wrote it into the statute itself. The Taxpayer First Act added § 6015(f)(2): for unpaid liabilities, a request is timely if made within the § 6502 collection period; for amounts already paid, within the refund-claim period. The rule that beat Cathy Lantz no longer controls.

Strangely, its two-year language is still sitting in the 2002 regulations, even though the IRS stopped applying it to § 6015(f) claims in 2011 and Congress superseded it in 2019. (Treasury and the IRS withdrew the long-pending proposed § 6015 regulations in December 2025 rather than finalize them. The core framework today is the statute, the 2002 regulations apart from that obsolete deadline, and Rev. Proc. 2013-34.)

She lost the case and helped win the rule. Which is a very specific kind of unfair.

The arc, laid out:

• 2009: The Tax Court strikes the regulatory deadline.

• 2010: The Seventh Circuit reverses. Lantz loses.

• 2011: Notice 2011-70. The Service abandons the two-year rule on its own.

• 2013: Rev. Proc. 2013-34 rebuilds the equitable framework around abuse and financial control.

• 2019: Congress writes the timing rule into § 6015(f)(2) and generally confines the evidentiary record in Tax Court review through § 6015(e)(7).

• 2025: Treasury and the IRS withdraw the proposed regulations rather than finish them.

Sixteen years. And the woman who started it had $3,239 taken from her.

Rev. Proc. 2013-34. This one is quieter, and I think it is the most important administrative development in this area in twenty years. It changed how the IRS accounts for abuse and financial control by the non-requesting spouse. Under the older framework, knowledge of the item giving rise to the understatement could be a serious obstacle to relief. Under Rev. Proc. 2013-34, actual knowledge is not weighed more heavily than other factors. And if the non-requesting spouse abused the requesting spouse, or controlled the household finances by restricting access to financial information, and that abuse or control kept her from challenging the return for fear of retaliation, the knowledge factor can weigh in her favor even if she knew, or had reason to know, of the item.

Read that against the credit history point above.

In 2013, the IRS formally acknowledged that financial control and restricted access to information can fundamentally change how a spouse’s knowledge should be judged.

Thirty-nine years after ECOA. The tax system catches up eventually. It just does it at the speed of a revenue procedure.

What this means at my desk

• Consider the implications of every joint balance for § 6015, and in community property states for § 66(c). Not just the ones someone asks about.

• Before you ask who knew, ask whether there was a valid joint return at all. Signature, tacit consent, and duress can decide the matter before § 6015 is ever reached.

• Ask who signed and who knew, separately. They are different questions, and clients answer them differently.

• Develop the financial control facts, not just the abuse facts. Rev. Proc. 2013-34 gives you room here, and practitioners underuse it because control is harder to document than a police report. Who had online banking credentials. Who saw the mail. Who needed permission to spend.

• Build the administrative record like you expect to litigate it. Since the Taxpayer First Act added § 6015(e)(7), Tax Court review generally rests on the administrative record plus newly discovered or previously unavailable evidence. Treat the administrative record as the case, not as a warm-up.

• Explain joint and several liability during the engagement, not after the notice. It is the single most under-explained concept in a divorce, and most people learn it from a levy.

• Be mindful of conflicts of interest, and do not assume a waiver cures one. Under Circular 230 § 10.29, you can represent both spouses only if you reasonably believe you can competently and diligently represent each of them, the representation is not prohibited by law, and each affected client gives informed consent confirmed in writing (within thirty days, retained for thirty-six months). An innocent spouse claim can make the spouses’ interests directly adverse. Some of these conflicts cannot be waived, and the right answer is often that one spouse needs separate representation.

• Many clients assume that if they are married, then they must file together. I have seen this particularly in older clients who feel like there is something “weird” if they don’t file jointly.

The same fear, in a different room

I said Rev. Proc. 2013-34 was the most important administrative development in this area in twenty years. Here is the part of it that reaches past tax.

In 2013 the IRS conceded, in writing, that a person can know something is wrong and still not challenge it, because challenging it would cost her more than staying quiet. Fear of retaliation is now an accepted reason why an innocent spouse did not speak. It took the Service decades to say that out loud.

We should be able to recognize the same thing in our own profession. Circular 230 holds us to standards of competence and diligence. How we treat other professionals should be a standard we hold ourselves to whether or not anything requires it.

For too many years at conferences and various events, I have heard not only rumors but also direct accounts from women who have been sexually harassed or subjected to unwanted sexual advances in this industry. This has probably been allowed to happen far longer than many of us know. It must stop.

Many of the people it happens to do not speak up, for exactly the reason the IRS finally acknowledged: the cost of speaking out falls on the person who was wronged. Anyone who does choose to speak should be taken seriously and supported. But the burden of cleaning up a profession should not sit with the people it harms. Conference organizers, firms, professional associations, and the rest of us in the room have that obligation. This should never be chalked up to “boys being boys.” (I hate that statement.) This is misconduct we, as an industry, should never tolerate. I am always perplexed when women dismiss it, but I am equally perplexed when men dismiss it.

You should not need to imagine that she is your wife, your daughter, or your mother. A colleague deserves safety and professional respect because she is a colleague, and because she is a person. That is enough.

Share

Ninety-two

Steinem was 92. She lived to see § 214 repealed, ECOA signed, the Fair Housing Act amended, and a revenue procedure quietly acknowledge that financial control can change how a spouse’s knowledge should be judged.

Most people who spend their lives in this slow fight do not get to see the statutes change.

The changes she did not live to see are ours to make.

Leave a comment

Josh and Shannon get into what actually separates a business deduction from a personal one.

Shannon reports back from the Brass Tax EA Bootcamp and the first year of at-home EA exam proctoring (the metal detector stories are real). Then: why an unlicensed preparer cannot represent you before the IRS no matter what the Facebook group says, how to tell whether a CE speaker actually knows the material, and §162 versus §262 by way of an influencer who deducted the Grammys, a dancer who depreciated her chest, and two business partners who were very sure the Rolexes were ordinary and necessary.

Plus: why the adversarial posture toward the IRS is mostly bad strategy.

CASES

Sami v. Commissioner, T.C. Memo. 2026-69 (Aug. 18, 2026) — An IT manager/social media influencer deducted roughly $97,000 in celebrity meet-and-greets, Grammys and Emmys tickets, and signed Kobe Bryant shoes. The celebrity expenses went down, but the result wasn't a complete wipeout: the court allowed portions of several business expenses under Cohan and credit-card processing fees in full.

Hess v. Commissioner, T.C. Summary Opinion 1994-79 — Yes, that case. Cynthia Hess, stage name “Chesty Love,” successfully treated her surgical implants as depreciable business property. And much of what tax professionals repeat about this opinion is wrong.

WELL, ACTUALLY…

• Hess is not T.C. Memo. 1994-79. It's a nonprecedential small-tax-case summary opinion.
• “Not precedent” does not mean “not citable.”
• She was 56FF in the tax year before the court; the later 56N implants came afterward.
• Sami was a mixed result, not a complete denial.
• Calling Sami “the first influencer case” may be premature.
• The Dinah Shore gown deduction appears to be tax folklore, not a reported case.
• And Suleiman Sami is one person. Suleiman is his first name.

Code: IRC §§162, 262, 7463(b), 67(h)

MENTIONED

Brass Tax Presentations — brasstax.com
AskTomG — asktomg.ai (Disclosure: Josh has a financial interest.)
Tom Talks Taxes — tomtalkstaxes.com
U.S. Tax Court — ustaxcourt.gov

Full show notes, citations, source documents, links, and corrections: wellactually.tax

This podcast is general commentary on federal tax law and procedure, not tax, legal, or accounting advice. Tax outcomes depend on facts. Views expressed are the hosts’ own.

This started as a conversation about books.

Anytime I travel anywhere, there are two things I seek out: independent bookstores and coffee shops. If those two are in the same location, all the better. There is now a third: record stores, because I have fallen in love with vinyl, and the vibe is really cool . But primarily, bookstores and coffee shops.

Shannon Hall and I were in Cleveland, both speaking at NATP Taxposium, which was a really great event. When we weren’t speaking, instead of going to classes, we decided to find other things to do. Obviously, a bookstore and a coffee shop were on the list, and of course a ghost tour. There’s always a ghost tour with Shannon.

Cleveland deserves credit here. Shannon is vegan (which is something I aspire to), which turns every conference city into a small logistical research project, and Cleveland turned out to be genuinely good at it — one excellent meal after another. The Tofu wings were excellent. One exception: a restaurant that had apparently decided dill belonged in every single item on the menu. Not as an accent. As a governing principle. Dill is one of those things that I do not like. I have never liked it, and I probably never will, and I don’t have to.

Somewhere between a cappuccino, a chocolate chip cookie, and a conversation about books, we thought it would be really fun to have a podcast where we talk about books. Then it grew. Because it turns out you cannot get two Enrolled Agents talking about anything for very long before the conversation finds its way to a Tax Court opinion somebody misread, or a vendor claim that doesn’t survive contact with §7216, or the fact that an IRS publication has never once been primary authority. The books stayed. Everything else moved in around them.

So we recorded it.

Well, Actually… is now live on Apple Podcasts, Spotify, and YouTube, and it will be here on Substack too. Episode 1 is up. It’s called “We Passed, We Traveled, We Have Opinions,” which is an accurate summary and also the entire pitch.

What the show is

Shannon Hall is an Enrolled Agent in Long Beach, California, and the president of CSTC (California Society of Tax Consultants). Earlier this year, we both sat for — and passed — the U.S. Tax Court non-attorney exam. We are currently awaiting admission.

The premise of the show is friendly pedantry. Getting the detail right matters. The difference between a primary source and a persuasive one matters. And “I don’t know” is a perfectly good answer as long as it’s followed by “let’s find out.”

That means no hot takes. It means we cite things. And it means that when something we believed turns out not to survive a look at the source, a rule one of us misremembered, a claim the whole profession repeats because the whole profession repeats it, we say so out loud. That's the well, actually.

It also means the show isn’t only about tax. We both read constantly, both work in a profession being reshaped in real time by software that most of its vendors can’t accurately describe, and both have opinions about coffee, ghost tours, and whether hardbacks are still worth buying if you’re going to read the Kindle edition anyway. All of that is in scope.

Subscribe now

What’s in Episode 1

A debrief of a summer that ran through Reno, Cleveland, and New Orleans:

• The Tax Court exam — what it actually takes, what the pass rate looks like, and why you don’t need a master’s in taxation to sit for it

• The AI vendor hall — the gold rush currently happening in conference exhibit spaces, and the §7216 question that most vendors would prefer you not ask

• WISPs and MFA — the data security obligations that a lot of practitioners are still treating as optional

• A five-hour research spiral in a rented house in the desert, which produced the first official well, actually of the series: an IRS publication is not primary authority. It never has been. It can also, it turns out, simply be wrong.

Runtime is about thirty minutes.

Where this is going

A few things we’re planning, in rough order of how soon you’ll see them.

A regular release cadence. Episode 2 is already in motion. The failure mode for new podcasts is not the launch, it’s the six-week gap after the launch.

Guests. This is the part I’m most looking forward to. The profession is full of people who are extraordinarily good at a narrow, difficult thing and almost never get asked to explain it at length. We’re going to have them on and let them talk. We will also have people we respect and make a difference.

More tech and AI, treated seriously. I’ve spent thirty years in tech, and I’ve watched this industry adopt technology in a way that is by turns admirable and alarming. There’s a real conversation to be had about what these tools can do, what they cannot do, and what your professional obligations are when you point one at client data. We intend to have it, repeatedly, with people who know more than we do. But it will be done in a fun and easy-to-understand way. No complex dissertations.

Books. Fiction, nonfiction, the occasional detour into nuclear brinkmanship. This isn’t a bonus segment at the end of the tax talk. It’s the thing the show was originally going to be, and we’re not giving it up.

More snark. Episode 1 is, by design, mostly a debrief — two people catching up after a summer apart. If you came in expecting sharper elbows, fair. They’re coming. Well-intended snark is one of the load-bearing pleasures of this profession, and we were on our best behavior for the first take. That won’t hold. This industry has some toxicity in it, and we will go there. We will also stay firmly PG-13 (also known as 1 espresso martini instead of 2) while we do.

If there’s someone you want to hear from, or a topic you’d like us to explore, please reach out.

One last thing. I have said, out loud, more than once, that I would never do public speaking. I have also said I would never have a podcast. I now teach continuing education, and I am announcing a podcast in the same paragraph, which suggests my predictive accuracy about my own behavior is somewhere below that of a coin toss.

I started speaking because, as a child, I had a speech impediment, and as an adult I got the idea from a book that if you do hard things you don’t want to do, you’ll eventually enjoy it and be better off for it. Also, thankfully, as a child, I had speech therapy (Ms. Sloan). Thanks, Mom.

So if you get tired of hearing me, blame my mother. :)

How to listen

• Apple Podcasts

• Spotify —

• YouTube — https://www.youtube.com/@wellactuallytax

• RSS (for the Overcast, Pocket Casts, and Castro contingent) — https://api.riverside.com/hosting/lTiHAKvf.rss

• Substack — right here. New episodes will land in your inbox with show notes.

• The website — https://wellactually.tax

If you listen and it lands, the single most useful thing you can do is leave a rating on Apple or Spotify.

Share

Nothing in this podcast constitutes tax, legal, or accounting advice, and no client relationship is formed by listening or by reading. We discuss general principles. Your situation has facts in it. Facts matter.

Leave a comment

Josh and Shannon open the first episode of Well, Actually with the small talk (105 degrees in Texas, an angelic glow in Long Beach) and get to the substance quickly: what they'd change about every tax practice in the country if they had one wish, why "our lawyer says 7216 doesn't apply" is a red flag, how to actually vet an AI vendor, and what OPR's guidance on artificial intelligence does and doesn't say about billing.

Then a detour through ghost tours, continuation school, GEDs, acting degrees, and whether you need a master's in taxation to sit for the USTCP exam. (You don't.)

The episode ends on the first official well, actually of the series, courtesy of a five-hour research spiral in a rented house in the desert: an IRS publication is not primary authority. It has never been primary authority. It can also, it turns out, simply be wrong.

Interested in the USTCP Exam? Check out www.taxcourtexam.com

If you’re old enough to remember 2024 and 2025, you may recall the seemingly endless waiting for courts and FinCEN to decide the fate of beneficial ownership information reporting.

BOI reporting became something of an interest of mine. I still believe the underlying idea made sense. I also hoped the filing requirement might discourage people from forming unnecessary entities, or, at the very least, encourage them to obtain competent advice before doing so.

But for most businesses, BOI reporting is now officially over.

In an August 11 final rule, the Financial Crimes Enforcement Network formally exempted U.S. companies and U.S. persons from BOI reporting. The rule becomes effective upon publication in the Federal Register.

What Happens to Information Already Filed?

FinCEN says it will delete previously submitted information when it reasonably believes the information relates to a U.S. person. This includes information about:

• Beneficial owners;

• Company applicants; and

• Individuals who obtained FinCEN identifiers.

According to FinCEN’s new frequently asked questions, affected individuals do not need to request deletion. FinCEN will identify U.S.-person information using indicators such as a U.S. passport or driver’s license and remove it from the BOI database.

FinCEN ID holders who are U.S. persons also have no obligation to update or correct the information they originally submitted to obtain their identifiers.

Who Still Has to Report?

The Corporate Transparency Act has not disappeared entirely.

An entity may still be a “reporting company” if it:

1. Was formed under the laws of a foreign country;

2. Registered to do business in a U.S. state or Tribal jurisdiction; and

3. Does not qualify for another exemption.

Even then, the foreign reporting company is generally required to report only information about foreign beneficial owners. It does not report U.S. persons as beneficial owners, and U.S. persons are not required to provide their information for the report.

The final rule also eliminates the requirement for foreign reporting companies to identify U.S. persons who acted as company applicants—that is, individuals who assisted the foreign entity in registering to do business in the United States.

FinCEN’s FAQs explain that a foreign entity registered to do business in the United States generally must file its initial BOI report within 30 calendar days after receiving notice that its registration is effective. Foreign reporting companies must continue to evaluate whether another regulatory exemption applies.

What Should Firms Do Now?

For tax and accounting professionals, this ends the issue for domestic clients. They do not need to file.

Firms should consider:

Subscribe now

• Removing BOI filing reminders for domestic companies;

• Disabling automated BOI follow-up emails;

• Updating client organizers, engagement letters, checklists, and website guidance;

• Advising prior filers that they do not need to update or correct their reports; and

• Preserving a separate review process for foreign entities registered to do business in the United States.

Clients who previously filed do not need to submit another report to withdraw their information or claim the new exemption.

A Predictable Ending to a Very Loud Debate

None of this should be particularly surprising. The current administration had already made clear that BOI enforcement against U.S. companies and U.S. persons was not a priority.

Before that, however, BOI reporting became a hotly debated subject on social media. Some viewed it as government overreach. Others argued that helping clients prepare BOI reports constituted the unauthorized practice of law.

In the vast majority of cases, it did not. I thought I would say that again, because I know I said it 1,000 times in 2024 and 2025.

Helping a client gather information and submit a government filing does not automatically become the practice of law merely because the filing concerns a legal entity. As with many professional-services questions, the answer depended on what assistance was being provided, not simply on who clicked the submit button.

The Bottom Line

BOI reporting is over for U.S. companies and U.S. persons. Domestic entities have no filing obligation, prior filers have no continuing update obligation, and FinCEN says it will delete the U.S.-person information it previously collected.

The remaining reporting population consists primarily of certain foreign entities registered to do business in the United States, and even those entities generally report only their foreign beneficial owners.

Share

Leave a comment

Lately I have become interested in a word that we do not use nearly enough.

Not kindness.

Not diplomacy.

Not competency. (Hello Circular 230 §10.35)

Sycophancy.

The trading of truth for approval.

I always thought sycophants were easy to identify. Caricatures in books, like the courtier who is all too eager to laugh at the king’s jokes or the employee who agrees with every idea from their boss.

I have begun to wonder if the modern version is far more subtle and is becoming more accepted, to the point of being rewarded.

Think about the incentives around us.

Social media rewards agreeing with your audience. The algorithm wants engagement above all. Influencers learn that certain opinions and ideas will gain followers, thereby increasing their popularity and putting more money in their pockets.

Professional organizations aren't immune either. Every organization eventually develops gravity. Certain personalities become indispensable. Certain speakers become untouchable. Certain donors become too valuable to challenge. Before long, people begin protecting reputations instead of principles. And once that happens, institutions stop correcting themselves.

The corporate world tends to reward those who tell leadership exactly what they want to hear rather than what they actually need to hear.

Politics? Need I really say much? I could write volumes about my thoughts, but then I might lose some subscribers. Perhaps I am proving my own point.

Friendships aren’t immune, because we often surround ourselves with people who reassure us and tell us what we want to hear rather than tell us the unvarnished truth.

None of this requires someone to lie.

It makes honesty more costly.

Subscribe now

This is how a culture of sycophancy takes hold.

It is not through one dramatic act of cowardice but through thousands of small calculations.

“Should I really say something?”

“This is wrong, but it isn’t my battle.”

“This will cost me access.”

“I’ll look the other way this time. Next time, though…”

I have seen this play out before. Someone reports serious misconduct, and somehow the institution’s attention shifts from the alleged conduct to the character, motives, or behavior of the person who reported it. The complainant becomes the problem.

Comedian Ricky Gervais has a quote that resonates with me:

“Just because you’re offended doesn’t mean you’re right.”

I like the quote because discomfort is not evidence that something is false. Nor is offense evidence that something is true. The question is whether we are willing to examine a claim honestly when doing so is uncomfortable.

Can we tell the truth when there is something to lose?

Perhaps the most fascinating example is artificial intelligence (AI).

One of the problems AI companies now openly discuss is “sycophancy.” Left unchecked, AI becomes too eager to agree with the user. It flatters. It validates. It mirrors beliefs instead of examining them.

Think about that for a moment.

We built machines using human conversations.

One of the first human habits these systems learned to reproduce was our desire to be liked.

Isn’t it ironic?

Perhaps AI is not showing us something foreign. Perhaps it is holding up a mirror.

It may tell you your reasoning is correct.

That your position is well supported.

That there is a case directly on point.

When there isn’t.

I’ve always admired impressive people.

The successful.

The wealthy.

The expert.

But as I slowly drag closer to being forty-five, I’ve had an epiphany.

I have become much more interested in intellectually independent people.

The person who can respectfully disagree with the CEO.

The board member willing to say, “This is wrong.”

The friend who says, “That wasn’t your best. Here’s what worked and what didn’t.”

The colleague who stands up for what is right even if it isn’t popular.

Lately, I have been reading Marcus Aurelius. He wrote something that feels increasingly rare today:

"If anyone can refute me, show me I'm making a mistake or looking at things from the wrong perspective. I'll gladly change. It's the truth I'm after."

Today, changing your mind is often seen as a weakness. Questioning your own side can be treated as betrayal or disloyalty. Certainty is rewarded. Humility rarely is.

Agreement is rewarded, but honest dissent often carries a cost.

Maybe this is why true independence has become so valuable.

I’m becoming less interested in people who are always right.

I’m much more interested in people who are willing to be wrong.

People who can say:

“I changed my mind.”

“I don’t know.”

Or perhaps the hardest sentence of all:

“I think you’re wrong.”

Said respectfully and honestly, without calculating what it might cost.

I don't believe I'm immune to this. Every one of us enjoys approval. Every one of us hesitates before saying something that could cost us professionally or socially. The question isn't whether we're tempted by sycophancy. The question is whether we recognize the temptation before it becomes our character.

Stoicism has reminded me that courage is not measured by how loudly we speak, but by what we are willing to risk in service of what is true.

Every generation has had its sycophants.

What has changed, I think, is what we reward.

Algorithms, organizations, politics, media, and yes, even AI increasingly reward the same instinct:

Tell people what they want to hear.

Avoid discomfort.

Protect the powerful.

Preserve access.

Perhaps history won’t remember us for the opinions we held.

Maybe it will remember whether we possessed the courage to tell the truth when agreement was easier.

Because, in the end, integrity is not measured by what we profess, but by what we are willing to risk for the truth.

Share

Leave a comment

A few things:

1. If you haven’t checked it out yet, be sure to check out AskTomG.AI. This is one of those projects I wake up excited to work on. We have spent a ton of time and brainpower on this, and it will only get better. If you have questions, please reach out to me.

2. I am excited to be speaking at the annual NYSSEA conference in October. It is one of my favorite conferences.

3. Well, actually - a podcast venture with Shannon Hall, EA, is launching later this month. Check out the website for more details!

4. I will be at the IRS Forums in San Diego, CA, in September.

5. I have several webinars and workshops coming up for NATP. You can check those out here.

Tom Gorczynski and I already covered the rules. We wrote about the Section 7216 disclosure and use framework, and we covered OPR’s guidance on AI in federal tax practice over on Tom Talks Taxes. If you have not read those, start there. I am not going to repeat them.

Tom Talks Taxes

OPR Issues Guidance on Practitioner Use of AI

The IRS Office of Professional Responsibility quietly sent an email to practitioners about the ethical issues of using artificial intelligence (AI) tools in tax practice…

Read more

4 months ago · 13 likes · 5 comments · Thomas A. Gorczynski and Josh Youngblood, EA, CRETS

This article is the other half of the conversation. You know the rules apply. Now what do you actually do? Here is what I do, with examples you can use or adapt as needed.

1. Sanitize Before You Type

The single highest-value habit. Before anything goes into an AI tool, strip it of identifying information. Not just the name and Social Security number. Anything that could reasonably identify the client when combined.

Here is what that looks like in practice. Say you are researching a potential filing requirement.

Do not type this:

“My client Kirby Rockefeller, who lives in La Jolla, California, SSN ending 4821, received an inheritance of $700,000 from his uncle in Portgual. His uncle was not a US citizen, Kirby is. Does he have filing requirments? He also has $450,000 of real estate investment income.”

Type this instead:

“Client received an inheritance from a foreign relative. Are there any filing requirments?”

Same useful output. Zero client data disclosed. Notice what got removed: name, SSN, exact dollar amount, city, and occupation. For example, A dental hygienist in Dallas married to a TI employee who sold RSUs in 2023 is not anonymous. It is a person with a name that takes one LinkedIn search to find.

My rule: if the prompt could survive being read aloud at a conference without anyone identifying the client, it is clean. If you hesitate, it is not.

Share

2. Build a Verification Step You Cannot Skip

Every citation gets verified before it leaves your office. Not spot-checked. Verified. Here is my actual workflow for anything AI-assisted that contains authority:

Pull the cited case, code section, or revenue procedure from the actual source. Tax Notes, the Tax Court’s DAWSON system, uscode.house.gov, or eCFR. Confirm it exists. Confirm it says what the output claims it says. Confirm it supports the argument I am making, not just the topic I am discussing.

That third check is the one practitioners skip. A real case cited for the wrong proposition is as bad as a fake case.

Make this physical if you have to. I know practitioners who print AI-assisted drafts and initial next to each citation as they verify it. That sounds tedious. It takes ten minutes.

You could also use an AI tool that gives you that information. Not to self-promote, but AskTomG.AI does exactly. You get the citations, the links to the citations, and you can build your research memo. You make the judgment call. It also now has a research library if you’re looking for a specific code cite, or just want a more traditional search.

3. Interrogate Your Vendors Like They Work for You

Because they do. Before any AI tool touches practice work, I want written answers to five questions:

Is my input used to train the model, and can I turn that off? Where is the data stored and for how long? Who at the vendor can see my prompts? Is there a business tier with a data processing agreement?

Here is the example that makes this concrete. The consumer version of most AI chatbots uses your conversations for model training by default or buries the opt-out in settings. The business and enterprise tiers typically exclude your data from training contractually. Same model. Same interface. Completely different risk profile. The price difference is usually the cost of one client lunch per month.

If you cannot get answers, that is an answer. Under the FTC Safeguards Rule (16 C.F.R. Part 314), you are required to assess your service providers, and an AI vendor holding your prompts is a service provider. Document what you asked, what they answered, and when. Put it in your files. A reasonableness standard rewards people who can show their work.

4. Write the AI Section of Your WISP

I know, you are probably sick of the word WISP. But, your Written Information Security Plan should answer four questions about AI: which tools are approved, who may use them, what data may be entered, and what happens when someone breaks the rule. Here is sample language you can adapt:

“The firm has approved the following AI tools for practice use: [tool, tier, and account type]. All other AI tools are prohibited for any work involving client information. No client-identifying information may be entered into any AI tool without a documented exception approved by [name]. Identifying information includes names, taxpayer identification numbers, addresses, exact dollar amounts, employer names, and any combination of details that could reasonably identify a client. All AI-assisted work product containing citations or calculations must be independently verified before delivery to a client or submission to any taxing authority. Violations must be reported to [name] within 24 hours and will be treated as a potential security incident.”

Five sentences. That is genuinely most of it. The firms that get hurt will not be the ones with imperfect policies. They will be the ones with no policy, because no policy means no training, no accountability, and no evidence of reasonable safeguards when someone asks.

5. Train Your People With Scenarios, Not Slides

A policy nobody understands is decoration. Skip the hour of slides and run fifteen minutes of scenarios at a staff meeting. Here are three I would use:

A staff member wants to paste a client’s bookkeeping export into a chatbot to categorize transactions. Allowed? (No. Bank data is loaded with identifying detail: payee names, locations, amounts. Sanitizing a full export is impractical, so this needs an approved tool with a data agreement, or it does not happen.)

A staff member uses AI to draft a penalty abatement letter with no client details, then adds the specifics in Word afterward. Allowed? (Yes. This is the pattern you want. Generic in, specific out, on your own machine.)

A staff member asks AI to summarize a Tax Court case and includes the summary in a client memo without reading the case. Allowed? (No. The drafting was fine. Skipping verification was not.)

Subscribe now

If your team can sort those three correctly, your training worked. Get a signed acknowledgment and calendar it annually.

6. Keep the Data You Feed AI Behind the Same Locks

An overlooked one. AI tools are accounts, and accounts get compromised. If your chatbot history contains months of practice prompts, that history is now sensitive data sitting behind a password. Treat the account accordingly: a unique password from your password manager, multi-factor authentication turned on, and a passkey if the vendor supports it. Review the connected devices and active sessions occasionally, the same way you should with email. And periodically delete conversation history you no longer need. Data you do not retain is data nobody can steal.

7. Let AI Inform. You Decide.

The habit that holds the rest together. AI is excellent at surfacing authority, organizing facts, drafting language, and pressure-testing an argument. It does not exercise professional judgment, and nothing about your obligations lets it. This is exactly how we built AskTomG.AI: the tool informs, and the practitioner retains every decision under Circular 230.

The practical example: when AI gives me an answer on a representation question, I do not ask “is this right?” I ask “where would this break?” Then I go verify the load-bearing authority myself. The tool sharpens my thinking. It does not replace it. The day you catch yourself forwarding an AI answer to a client without that step is the day to reread everything above.

Pick the two that close your biggest gaps. If I had to choose for you: sanitize your prompts starting with the very next one, and send your primary AI vendor the five questions from item three. Both cost nothing. Both are documentable. Both move you from “I use AI” to “I use AI responsibly,” and that distinction is the whole game.

The tools are worth it. I would not run my practice without them at this point. But the trust your clients place in you predates the technology, and it will outlast whatever tool you are using this year. Protect it accordingly.

Have questions? I know tech questions can sometimes be sensitive and you may not want to publicly post them, so send me a message.

I am going to try something this week that I have been meaning to do for a while.

For Paid Subscribers: (If you aren’t a paid subscriber, you can upgrade below)

Subscribe now

Drop your questions in the comments, and I will answer as many as possible.

Ask me about anything in these lanes:

• IRS representation. Keep it general, not specific to your client’s facts. I cannot give advice on a case I am not engaged in. But how a process works, how I would think about an approach, what I wish I had known earlier, all fair game.

• Practice management. Pricing, engagement letters, workflow, saying no, the stuff nobody teaches you.

• Technology and security. The tools I actually use, what is worth the money, how I think about the FTC Safeguards Rule, and keeping client data safe.

• Building a practice. How I got here, what I would do differently, what the first few years actually looked like.

  Leave a comment

Where to find me this summer

Right now I’m at NATP Taxposium in Cleveland, Ohio. So far, Cleveland has been a fun city. Taxposium has been great. Yesterday I talked about what to do when you make mistakes in your practice. Today we will discuss digital asset crimes, and tomorrow we will discuss cybersecurity. Last night I went on a ghost tour and learned about the city's history.

Thursday, it is back home for a while. The next conference for me is NYSSEA in Saratoga Springs, NY. I will be discussing IRS penalty abatement and co-teaching a class on tech practice automation with Matt Metras, EA, which I am very excited about. The speaker lineup is really great!

You can watch this video below for more info:

NYSSEA Invite

I hope to see you there!

One more thing

If you have not seen it yet, Tom Gorczynski (Check out his Substack, Tom Talks Taxes) and I built AskTomG.AI. It gives tax professionals fast access to solid information without rendering judgment. It informs. You decide. That was the whole point. The practitioner keeps the call, which is exactly where Circular 230 says it belongs.

Take a look at AskTomG.AI. We love getting user feedback and are always improving the product.

Share