Scott Pruitt could be in tax trouble on top of his ethical and political problems.

The embattled administrator of the Environmental Protection Agency has reportedly spent nearly $3 million on security and travel since taking office in February 2017. That sum apparently includes the cost of a security detail that accompanied Pruitt and his family on a vacation to Disneyland and the Rose Bowl this winter.

Pruitt might owe federal and local taxes on a large chunk of that money.

Government officials, like private-sector employees, must pay tax on “all income from whatever source derived.” That includes “fringe benefits” from an employer unless the fringe benefit falls within the scope of a specific exclusion.

Section 132 of the Internal Revenue Code provides an exclusion for “working condition fringes.” The Treasury Department and the Internal Revenue Service have promulgated detailed regulations that address when an employer-provided security detail can be counted as a “working condition fringe.”

The general rule is that when an employer provides bodyguards who transport and accompany an employee on personal travel, the value of the bodyguards’ services can be excluded as a “working condition fringe” only if a “bona fide business-oriented security concern” exists. To meet that requirement, the employer must conduct an independent security study and implement an “overall security program.” The overall security program must protect the employee on a 24-hour basis. If the employer provides the employee with transportation in a chauffeured vehicle, the chauffeur must be trained in “evasive driving techniques.”

These rules apply similarly to government and private-sector employers and employees. A 1992 amendment to the regulations expressly addresses the independent study requirement for government agencies: An agency satisfies the requirement if a person designated by the agency conducts a study in accordance with written internal procedures, and if the agency then applies the study’s specific recommendations on a consistent basis.

It’s doubtful that Pruitt’s security detail satisfies the criteria for exclusion as a working condition fringe. In a February 2018 threat assessment, an intelligence team in the EPA’s Office of Homeland Security said that it “has not identified any specific credible direct threat” to Pruitt. The intelligence team said it saw no indication that Pruitt “would be at any greater risk on a commercial airline than any other passenger.” That suggests that Pruitt has not obtained the independent study required under IRS rules. Thus, the value of services provided by the security detail to Pruitt’s family on non-business trips would appear to be income on which the EPA administrator owes tax.

This doesn’t mean that Pruitt must pay tax on all of his travel-related expenses. Business travel — even chauffeured business travel — will generally count as a working condition fringe regardless of whether the security study requirements are met. But Pruitt presumably was not going to the Disney theme park on business (even though some of his statements on climate change might suggest that he is running the EPA from Fantasyland). And he and his family did not attend the Rose Bowl for environmental protection purposes — they were there to root for the Oklahoma Sooners, the top college football team in Pruitt’s home state. Trips that mix business with pleasure pose more difficult line-drawing questions, but at least some of Pruitt’s travel with his security detail appears to fall far on the personal side of the business/personal divide.

To be sure, Pruitt might not be a top target for the IRS under the Trump administration. But the agency has, to its credit, fought hard to maintain its independence from party politics, and Pruitt stands some risk of a random audit just like everyone else who has been rushing to meet Tuesday’s tax filing deadline. The Internal Revenue Code explicitly prohibits the president and other top administration officials from intervening in audits of taxpayers. Also, the general statute of limitations for an omission from gross income is three years from the date that a return is filed, so Pruitt could face federal tax consequences even after the end of Trump’s first term.

Pruitt has been renting a condo on Capitol Hill from the wife of an energy lobbyist. But he may be exempt from D.C. income taxes, even if he lived there for 183 days in a single year, because he is a presidential appointee who serves “at the pleasure of the president.” He should, however, have declared his fringe-benefit income on his Oklahoma tax return.

Publicly traded corporations are generally more forthcoming than federal agencies about the security costs they pay with respect to their leaders. Amazon, for example, acknowledged in its 2017 proxy statement that it paid $1.6 million the prior year for chief executive Jeffrey P. Bezos’s personal security. (Bezos also owns The Washington Post.) We don’t know how much of that, if any, Bezos reports as income to the IRS. It’s a safe bet, though, that Amazon’s and Bezos’s tax advisers have carefully reviewed the rules to determine whether their independent study and overall security program satisfy the agency’s requirements.

Our unsolicited advice to Pruitt is that he should take a hard look, too. If, indeed, he has been charging purely personal expenses to taxpayers, it’s time that he gave some of that money back.

CORRECTION: An earlier version of this story incorrectly stated that Pruitt would likely be liable for D.C. income taxes on his fringe benefits. In fact, D.C. law exempts some presidential appointees from local income taxes.

Read more: