prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: To varying extents, Internet content providers—also called “edge providers”—and Internet service providers collect, use, and share information from their customers to enable their services, support advertising, and for other purposes  Many companies describe these and other privacy-related practices in privacy policies, to which consumers may be required to consent in order to use the service  Consumers access such services through a variety of devices, including mobile phones and tablets, computers, and other devices connected to the Internet by wired or wireless means  A nationwide survey that the U S  Census Bureau conducted for NTIA in 2017 found that 78 percent of Americans ages 3 and older used the Internet  Another nationwide survey that the Pew Research Center conducted in 2018 found that 69 percent of American adults reported that they use some kind of social media platform such as Facebook  No comprehensive federal privacy law governs the collection, use, and sale or other disclosure of personal information by private-sector companies in the United States  Rather, the federal privacy framework for private-sector companies is comprised partly of a set of tailored laws that govern the use and protection of personal information for specific purposes, in certain situations, or by certain sectors or types of entities  These laws include the Fair Credit Reporting Act, which protects the security and confidentiality of personal information collected or used to help make decisions about individuals’ eligibility for such products as credit or for insurance or employment; the Gramm-Leach-Bliley Act, which protects nonpublic personal information that individuals provide to financial institutions or that such institutions maintain; and the Health Insurance Portability and Accountability Act which establishes a set of national standards for the protection of certain health information  In addition, as detailed in this report, FTC addresses consumer concerns about Internet privacy using its broad authority to protect consumers from unfair and deceptive trade practices  We have reported on a variety of Internet privacy concerns in recent years that include the collection and use of data such as people’s Internet browsing histories, purchases, locations, and travel routes, including: Internet of things: In 2017, we found that as new and more devices become connected, they increase not only the opportunities for security and privacy breaches, but also the scale and scope of any resulting consequences  Vehicle data privacy: We found in 2017 that most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices  Information resellers: In a 2013 report on companies that collect and resell information on individuals, we found that no overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers  We found that gaps exist in the federal privacy framework, which does not fully address changes in technology and the marketplace  Among the issues we noted were the potential need for changes to privacy controls for web tracking, mobile devices, and other technologies  We recommended that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace  Such legislation has not been enacted to date  Mobile device location data: In 2012, we found that, according to privacy advocates, consumers are generally unaware of how their location data are shared with and used by third parties  We recommended that FTC consider issuing guidance establishing FTC’s views regarding mobile companies’ appropriate actions to protect location data privacy  FTC implemented that recommendation in 2013  To guide their privacy practices, many organizations and governments have used the Fair Information Practice Principles  As noted above, these principles—which are not limited to Internet privacy—address the collection and use of personal information, data quality and security, and transparency, among other things, and have served as the basis for many of the privacy recommendations federal agencies have made  The Organisation for Economic Co-Operation and Development developed a version of these principles in 1980 that has been widely adopted and was updated in 2013  In 2000, FTC recommended that Congress enact a consumer Internet privacy statute that would require companies to comply with broad and flexible definitions of the principles, and an FTC commissioner said in a 2014 speech that they are a solid framework and are flexible and effective  While they are principles, not legal requirements, they provide a possible approach for balancing the need for privacy with other interests  Table 1 provides more detailed information about the principles  FTC is primarily a law enforcement agency that, among other responsibilities, currently has the lead in overseeing Internet privacy at the federal level  Specifically, it addresses consumer concerns about Internet privacy, both for Internet service providers and content providers, using its general authority under section 5 of the FTC Act  Section 5, as amended in 1938, prohibits “unfair or deceptive acts or practices in or affecting commerce ” Although the FTC Act generally empowers FTC to take enforcement action, it prohibits FTC from taking action against common carriers such as telecommunication services, airlines, and railroads under certain circumstances  FTC also does not have jurisdiction over banks, credit unions, or savings and loans institutions  Even though the FTC Act does not speak in explicit terms about protecting consumer privacy, the Act authorizes such protection to the extent it involves practices FTC defines as unfair or deceptive  According to FTC, an act or practice is “unfair” if it causes, or is likely to cause, substantial injury not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition as a result of the practice  FTC has used this “unfairness” authority to address situations where a company has allegedly failed to properly protect consumers’ data  According to FTC, a representation or omission is “deceptive” if it is material and is likely to mislead consumers acting reasonably under the circumstances  For example, the omission of terms in an advertisement would need to be material and likely to mislead consumers in order to be deceptive  FTC applies this “deceptive” authority to address deceptions or violations of written privacy policies and representations concerning data security  FTC’s Bureau of Consumer Protection investigates Internet privacy complaints from various sources, including consumers, other agencies, Congress, and industry, and also initiates investigations on its own  If the bureau has reason to believe that an entity is engaging in an unfair or deceptive practice, it may forward an enforcement recommendation to the commission  The commission then determines whether to pursue an enforcement action, which can include the following: litigating commission-filed administrative complaints before an FTC administrative law judge; filing and litigating complaints in federal district court seeking preliminary and permanent injunctions, monetary redress for consumers or other equitable relief; or referring complaints seeking civil penalties for violations of rules authorizing such penalties or for violations of administrative orders to the Department of Justice (DOJ) and assisting DOJ in litigating those cases (if DOJ does not take action, FTC can pursue the action on its own)  FTC’s Internet privacy enforcement cases may be settled without the imposition of civil penalties  Instead, FTC typically enters into settlement agreements requiring companies to take actions such as: implementing reasonable privacy and security programs; being subject to long-term monitoring of compliance with the settlements by outside entities; providing monetary redress to consumers; forfeiting any money gained from the unfair or deceptive conduct; deleting illegally obtained consumer information; and providing transparency and choice mechanisms to consumers  If a company violates an FTC final consent order, the agency can then request civil monetary penalties in court for the violations  In addition, as discussed below, FTC can seek to impose civil monetary penalties directly for violations of certain privacy statutes and regulations such as the statute pertaining to the Internet privacy of children and its implementing regulations  Although FTC can levy civil penalties up to $41,484 per violation, per day, against an entity that violates a trade regulation rule under the FTC Act, it has not promulgated trade regulation rules under section 5 specific to privacy  Although FTC has not implemented its section 5 authority by issuing regulations regarding Internet privacy, it has issued regulations to implement other statutory authorities  Likewise, other federal agencies use regulations to implement the statutes they are charged with administering  The process by which federal agencies typically develop and issue regulations is spelled out in the Administrative Procedure Act (APA)  Section 553 of the APA establishes procedures and requirements for what is known as “informal” rulemaking, also known as notice-and- comment rulemaking  Among other things, section 553 generally requires agencies to publish a notice of proposed rulemaking in the Federal Register  After giving interested persons an opportunity to comment on the proposal by providing “data, views, or arguments,” the statute then requires the agency to publish the final rule in the Federal Register  Regulations may be enforced in various ways, for example, by seeking civil penalties for non-compliance  FTC has authority to seek civil penalties, for example, when a company knowingly violates a regulation or, as discussed below, a final consent order  In contrast to the APA section 553 rulemaking process, the rulemaking process that FTC generally must follow to issue rules under the FTC Act is spelled out in the Magnuson-Moss Warranty Act amendments to the FTC Act (Magnuson-Moss)  The Magnuson-Moss amendments— enacted in 1975 partly in response to industry opposition to FTC’s trade regulations, and amended in 1980—require additional rulemaking steps beyond APA section 553  For example, Magnuson-Moss requires FTC to publish an advance notice of proposed rulemaking in addition to the notice of proposed rulemaking required by the APA, and to offer interested parties the opportunity for an informal hearing involving oral testimony  FTC has not promulgated any regulations using the Magnuson-Moss procedures since 1980; according to FTC staff, the additional steps required under Magnuson-Moss add time and complexity to the rulemaking process  The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, governs the online collection of personal information from children under the age of 13 by operators of websites or online services, including mobile applications  COPPA required FTC to issue and enforce regulations concerning children’s online privacy and directed FTC to promulgate these regulations using the APA section 553 notice-and- comment rulemaking process  COPPA contained a number of specific requirements that FTC was directed to implement by regulation, such as requiring websites to post a complete privacy policy, to notify parents directly about their information collection practices, and to obtain verifiable parental consent before collecting personal information from their children or sharing it with others  The commission’s original COPPA regulations became effective on April 21, 2000, and amended COPPA regulations took effect on July 1, 2013  According to an FTC staff member, COPPA and FTC’s implementing regulations reflect various principles that are similar to the Fair Information Practice Principles  FCC regulates the telecommunications industry pursuant to the Communications Act of 1934, as amended (Communications Act)  FCC follows the APA section 553 notice-and-comment rulemaking process to promulgate regulations implementing the Communications Act  FCC also has an enforcement bureau that pursues violations of its regulations and the Communications Act  The Communications Act establishes separate definitions for “information services” and “telecommunications services” and treats these two types of services differently  Specifically, information services are subject to less regulation by FCC than telecommunications services under the Communications Act  However, FTC is prohibited from regulating telecommunications carriers (a provider of telecommunications services) under the common carrier exemption  Prior to 2015, Internet services were considered information services under the Communications Act, and thus FTC was not prohibited from considering the privacy practices of Internet service providers under its FTC Act authority to protect consumers from unfair and deceptive practices  This changed in 2015 when FCC classified broadband as a telecommunications service, which meant that broadband Internet service providers were considered telecommunications carriers and FCC asserted primary oversight over them  As a result of the reclassification, FTC no longer had jurisdiction over Internet service providers  Once FCC had asserted primary oversight over Internet service providers, FCC promulgated privacy regulations specific to them  However, before the privacy regulations went into effect, Congress repealed them under the Congressional Review Act  In December 2017, FCC reclassified broadband as an information service—reverting Internet service providers’ classification to what it had been prior to 2015  When that reclassification became effective in June 2018, jurisdiction of Internet privacy for Internet service providers was effectively transferred from FCC back to FTC  As a result, FCC currently has limited Internet privacy oversight responsibilities, as shown in figure 1  Perspectives on the benefits of and concerns about the collection and use of consumers’ data from the Internet varied somewhat across stakeholder groups  Various stakeholders we interviewed—including those from academia, industry, and government—said that there should be a balance between the freedom of companies to collect and use consumers’ data needed to provide services and the necessity to protect consumers’ privacy  In general, industry stakeholders highlighted the benefits of data collection and use, such as facilitating innovation, while consumer advocacy groups and other stakeholders emphasized concerns about consumers’ loss of control over their data and their lack of understanding of how companies collect and use their information  Additionally, surveys and other literature that we reviewed on Internet privacy highlighted concerns among consumers  The key benefits of information collection were identified as: Enables certain services  According to two industry stakeholders, the collection and use of consumer data from the Internet enable content providers to provide services  These stakeholders said that sometimes a content provider must collect and use information from consumers to provide the service  For example, a mapping service must collect and use consumers’ current location to provide them with up-to-date directions  Provides low-cost or free services  A representative from a content provider said that revenue from targeted advertising helps allow some content providers’ services to be offered to consumers at little or no charge  Instead of charging a subscription fee, a social media company may be able to provide free service because it uses information that it collects from consumers to target advertisements to users on a customized, user-by-user basis  These ads are targeted to users based on interests they express through their use of social media, among other things  According to a representative from an Internet search engine, using consumer data for targeted advertising may be relatively less important for some kinds of content providers, such as search engines  This company representative said that search engines may use keywords entered for a particular Internet search to provide advertisements relevant to the search  For example, a search for “car insurance” can offer the consumer advertisements from car insurance companies without any additional data from the consumer other than the search’s keywords  Supports innovation and customization  According to some stakeholders, the collection and use of data also benefit consumers through other means such as providing innovative products or customized services  According to a representative from a content provider, the collection of personal information, with consent, for commercial purposes can at times have benefits  The representative said, for example, that collection of images containing identifiable information, like faces, can help in the development of new technologies such as object and facial recognition  According to two content providers, consumers may also benefit from customized services and content  For example, according to a representative from a travel-related company, that company can collect information about a consumer to suggest travel itineraries and suggestions for activities  Additionally, representatives from a consumer advocacy group and a content provider stated that direct-marketing approaches are enabled through data collection  Such marketing approaches allow consumers to receive advertisements that are uniquely tailored to their interests  For example, a consumer that a content provider has identified as being a hiker may receive advertisements for hiking boots  Despite these benefits, public opinion surveys have shown concerns about the collection and use of consumers’ information on the Internet  For instance, recent analyses based on surveys by the Pew Research Center and NTIA showed that the public lacks trust in Internet privacy, a concern that may limit economic activities  NTIA’s survey results show that privacy concerns may lead to lower levels of economic productivity as people decline to make financial transactions on the Internet  According to the NTIA analysis, in 2017, 24 percent of American households surveyed avoided making financial transactions on the Internet due to privacy or security concerns  Consumers NTIA surveyed indicated that their specific concerns were identity theft, credit card or banking fraud, data collection by online services, loss of control over personal information, data collection by government, and threats to personal safety  Stakeholders we interviewed elaborated on some of these concerns: Public disclosure and data breaches  Some stakeholders, including representatives from content providers, said that personal information from the Internet can be publicly disclosed, including through data breaches  An academic and a former FCC commissioner told us that such disclosures are becoming more frequent  Various consumer advocacy groups and state governments continue to report data breaches  This personal information can include financial information such as credit card information, the disclosure of which can result in financial harm to the consumer  It can also include other kinds of sensitive information such as political views or medical conditions, the disclosure of which can cause non-financial harms such as embarrassment or harassment  According to public reports, the 2017 breach of consumer information from Equifax, a credit-reporting agency, resulted in the disclosure of 143 million American consumers’ sensitive information  According to NTIA’s 2017 survey, 45 percent of households surveyed reported major concerns about credit card fraud  Regarding non-financial information, in a recent case FTC alleged that an Internet-based company publicly disclosed patients’ sensitive medical information without their knowledge after patients submitted what they thought were confidential reviews of physicians  According to FTC, these reviews were then publicly posted on the company’s website  Financial and other harms  Stakeholders identified both potential financial and non-financial harms associated with misuse of personal information from the Internet  A former FTC acting chair has said that privacy and data-security incidents can cause injuries that do not only involve financial loss and that it may be difficult to measure this type of non-financial injury  In a February 2018 speech, this former acting FTC chair cited a case that the agency filed involving the misuse of personal information from the Internet that resulted in people losing jobs or job opportunities or being threatened, stalked, and harassed  The acting chair said that in another case, there was evidence that several people committed suicide after their names and other data were disclosed  The commission can, by bringing suit in district court, obtain an order compelling content providers to provide monetary relief to consumers if a data disclosure results in financial harm to a consumer  However, an academic noted that many data disclosures of sensitive information cannot be financially redressed; information can indefinitely persist on the Internet once it is disclosed  Consumers’ lack of understanding  A range of stakeholders we interviewed, including those from industry, said that consumers lack an understanding of how their data are collected and used  Some stakeholders said content providers are insufficiently transparent about how they collect and use data  For instance, content providers’ privacy policies, according to various stakeholders, may contain technical language that is difficult for typical consumers to understand, may be located in a difficult-to-access or inconspicuous part of the content provider’s website, or may be lengthy to the point where it becomes prohibitively difficult for a consumer to set aside enough time to read  Furthermore, according to an academic, companies may have an incentive to intentionally obscure their privacy practices, since clarity could put the companies at a competitive disadvantage  The academic also stated that different privacy policies may apply to different parts of a consumer’s experience on a single website  For example, the academic described how a website may have contracts with third-party vendors for specific services included on the website that consumers use, such as an online shopping cart’s features  The privacy policy for the website and the third-party shopping cart can be separate and unrelated to each other, and consumers may not be aware of this since these policies may never appear to consumers or be hard to obtain  A representative from a consumer advocacy group also mentioned that consumers may be unaware that companies track consumers’ Internet activity in order to target those consumers with customized prices  An academic said that these practices may disproportionately affect people with low computer literacy, as they may not be aware of tracking or know of ways to counteract it  In 2015, we found that the lack of computer and Internet skills is one of the primary barriers people face in using the Internet and that this is a particular problem for certain demographic segments who may lack exposure to or knowledge about computers, such as those of age 65 and older and those with low levels of income and education  Consumer lack of control  Some academics and consumer advocacy groups also identified a lack of control as a concern with respect to Internet privacy—consumers have little or no control over how their information is collected, used, and shared  In a 2015 survey conducted by Pew Research Center, 65 percent of respondents said it is very important to be in control of what information is collected about them  However, according to an academic and a consumer advocacy group we interviewed, privacy policies offer consumers little or no bargaining power, and consumers may be forced to either accept the terms of the policy as written or not use the application or service at all  Furthermore, we recently reported that sometimes consumers’ information is used for purposes that are altogether separate from what those consumers originally anticipated  For example, FTC alleged in an enforcement action that in 2009 and 2010, a company told consumers that it would track the websites they visited in order to provide them with personalized offers, when in fact the company was also transmitting credit card information it collected through such tracking to third parties  The company settled with FTC  We also recently reported on how devices that comprise the Internet of Things pose privacy concerns for consumers, including that information collected by such Internet-connected devices can be used in ways to which the consumer was not given the option to opt out  As discussed above, stakeholders described various types of harm that could result from Internet privacy violations  Regardless of whether violations involve financial or other types of harm, a challenging factor in providing Internet privacy oversight is identifying the responsible parties  A former federal government official with experience in privacy issues said that it frequently is difficult to identify which Internet entity in the chain is ultimately responsible for a privacy-related harm  For example, if a consumer is harmed by the theft of his or her Social Security number, it can be difficult to determine which entity is responsible if multiple entities have suffered data breaches of information systems that contained the Social Security number  In addition to the challenges in identifying responsible parties, the federal government has faced challenges in providing Internet privacy oversight  Our prior work has found that such efforts lack clearly defined roles, goals and performance measures, and that gaps exist in the current privacy framework  We found that during the last decade, FTC filed 101 Internet privacy enforcement actions for practices that the agency alleged were unfair, deceptive, a violation of COPPA, a violation of a settlement agreement, or a combination of those reasons  Most of these actions pertained to first-time violations of the FTC Act for which FTC does not have the authority to levy civil penalties  In those cases where a party violated an FTC regulation or settlement agreement, however, FTC does have the authority to impose civil penalties  The 101 cases—filed between July 1, 2008 and June 30, 2018—involved a variety of products, services, and industries that collect and use personal information from the Internet  During the years for which we examined full-year data, the number of enforcement actions taken per year ranged from 5 in 2010 and 2016 to 23 in 2015  For example, in recent years, FTC took enforcement action against the following entities for alleged conduct that the agency contended violated section 5 or COPPA: a toy manufacturer for collecting personal information from children online without providing direct notice and obtaining their parents’ consent; a computer manufacturer for pre-loading laptops with software that compromised security protections in order to deliver ads to consumers; a mobile ride-hailing business for misrepresenting the extent to which it monitored its employees’ access to personal information about users; a television manufacturer for installing software on its televisions to collect viewing data on 11 million consumers without their knowledge or consent and providing the viewing data to third parties; and a mobile advertising network for deceptively tracking the locations of hundreds of millions of consumers, including children, without their knowledge or consent, to serve them geographically targeted advertising  Of the 101 actions filed during the 10-year period, 51 involved Internet content providers, 21 involved software developers, 12 involved the sale of information or its use in advertising, 5 involved manufacturers, 1 involved an Internet service provider, and 11 involved a variety of different products, such as those provided by rent-to-own companies or certification services  In nearly all 101 cases, companies settled with FTC, which required the companies to make changes in their policies or practices as part of the settlement  FTC levied civil penalties against two of those companies for violating their settlement agreements  Also during this 10-year period, FTC levied civil penalties against 15 companies (a total of $12 7 million) for alleged violations of the COPPA regulations  The COPPA civil penalties ranged from $50,000 to $4 million and the average amount was $847,333  FTC can also seek to compel companies to provide monetary relief to those they have harmed  During this time period, FTC levied civil penalties against companies for violations of consent decrees or ordered monetary relief to consumers from companies for a total of $136 1 million  These payment orders ranged from $200,000 to $104 5 million and the average amount was $17 million  In the majority of these 101 enforcement actions that FTC settled, FTC alleged that companies engaged in practices that were deceptive  Examples of the charges FTC brought include: “Deceptive practices” cases (61 cases): In 2016, FTC alleged that Turn, Inc , an Internet advertising company, continued to track the Internet activities of consumers for targeted advertising purposes after the company had made representations that it would stop doing so  According to FTC, the company led consumers to believe they could turn off such tracking when in fact they were unable to do so  “Unfair practices” cases (4 cases): In 2014, FTC alleged that LeapLab, a data broker, knowingly provided scammers with hundreds of thousands of consumers’ sensitive personal information, including Social Security and bank account numbers  “Unfair and deceptive” practices cases (19 cases): In 2015, FTC alleged that Equiliv Investments, a software developer, lured consumers into downloading its “rewards” application, saying it would be free of malware, when the application’s main purpose was actually to load the consumers’ mobile phones with malicious software to mine virtual currencies for the developer  COPPA and COPPA regulations cases (6 cases): In 2011, FTC alleged that Broken Thumbs Apps, a software developer, had collected information from Internet applications that the developer specifically targeted toward children under the age of 13  FTC’s complaint stated that the company had, among other things, failed to provide notice of what information it collected and how it was used and also had failed to inform parents of these practices and receive their consent as COPPA required  Violation of settlement agreement cases (2 cases): In 2012, Google agreed to pay a $22 5 million civil penalty to settle FTC charges that it misrepresented to users of Apple’s Safari Internet browser that Google would not place tracking cookies or provide targeted ads to those users, violating an earlier settlement agreement between the company and FTC  In 14 of the 101 cases, FTC required companies to be audited by outside entities to monitor compliance with the terms of the settlement  The audit period ranged from 5 years to 20 years, with an average of 17 5 years  As noted above, 2 of the 101 cases involved a violation of FTC settlement agreements  In addition, in March 2018, FTC announced that it is investigating whether Facebook’s privacy practices violate a 2012 Facebook settlement agreement with FTC  In the case that resulted in the 2012 settlement, FTC charged Facebook with deceiving consumers by telling them they could keep their information private, but then allowing it to be shared and made public  Appendix II contains more detailed information about the 101 cases  As stated earlier, in 2015, FCC classified broadband Internet service as a telecommunications service, placing primary oversight of broadband Internet service providers’ privacy practices under FCC’s jurisdiction instead of FTC’s jurisdiction  In 2016, FCC filed a privacy enforcement action against a mobile Internet service provider, alleging, in part, violation of section 222 of the Communications Act and FCC’s Open Internet Transparency Rule  Section 222 requires telecommunications carriers to protect the confidentiality of customers’ proprietary information  In that case, FCC fined Verizon Wireless $1 4 million for failing to disclose that it was inserting “unique identifier headers,” also called “perma- cookies” or “super cookies” (mobile web tracking cookies that users cannot remove), into customers’ Internet traffic over its wireless network  Although the settlement was finalized during the 2015-2017 period when FCC had asserted jurisdiction over the privacy practices of Internet providers, the Verizon Wireless practices occurred prior to the classification of Internet service providers as telecommunications carriers  The investigation therefore did not rely upon FCC’s subsequent assertion of authority over Internet service providers’ privacy practices  In October 2016, after FCC had reclassified broadband as a telecommunications service, the commission issued Internet service provider privacy regulations, asserting its authority under section 222 of the Communications Act  In April 2017, however, Congress repealed these regulations under the Congressional Review Act before they took effect  In December 2017, FCC then reversed its 2015 classification of broadband, and oversight of broadband Internet service providers’ privacy practices reverted to FTC once the decision took effect in June 2018  In explaining the December 2017 decision, FCC’s new chair said that FTC’s privacy oversight approach regarding Internet service providers—using its authority to protect consumers against unfair, deceptive, and anti- competitive practices—had worked well in the past and that this action would “put the nation’s most experienced privacy cop back on the beat ” Under FCC’s new legal approach, it no longer asserts jurisdiction to take enforcement action against Internet service providers for privacy-related matters, including mobile Internet service providers
Report 2:  These guidelines inform the payload’s electrical power and mechanical designs  The principal guideline—echoed by the successful CHIRP demonstration in 2011—is that the hosted payload must “do no harm” to the mission performance of its host  Also, satellite interfaces can vary from company to company  Some commercial companies had experience with the task—and business opportunity—of integrating multiple customers’ payloads onto satellites since at least the 1990s  Air Force, HPO, and industry officials told us that, ideally, the payload should use the same spectrum allocation as the commercial host  They said that this is due in part to the lengthy satellite registration process that takes place in the United States and through the ITU that must be undertaken prior to placing a satellite on orbit  Some DOD officials added that the process for all new satellites from initial filing to ITU approval takes around 7 years  If a satellite owner registers for one frequency band of spectrum and later requires a different band, the owner has to begin the registration process from the beginning—restarting the 7-year timeline  This can be problematic for DOD payload owners seeking to match their military communications payload with an already-registered host satellite—particularly if the host satellite’s spectrum allocation is incompatible with the DOD payload  HPO and other DOD officials said that very different spectrum needs between payload and host would therefore preclude the match  Moreover, a need for military—as opposed to commercial—spectrum for communications payloads can introduce additional complications  Although a process exists for a commercial satellite owner to license military spectrum for use by a hosted payload, representatives from DOD’s Chief Information Officer’s (CIO) office could cite only one instance where this has happened  One possible explanation stems from a 2012 memorandum from DOD’s CIO that outlines various preferred processes for a commercial host satellite to host military communications payloads  Several industry officials we spoke to said that the various processes outlined in the 2012 memorandum would add to the already-lengthy process of spectrum registration  Further, the memorandum instructs that contractual terms between the payload and host satellite owners should restrict all military spectrum use exclusively to the U S  military  However, one industry official told us that international entities do not necessarily recognize U S  military spectrum, and commercial companies that obtain licenses through other countries are permitted to use those frequencies  For example, a senior official of one commercial company we met with stated that the company licensed U S  military spectrum through another North Atlantic Treaty Organization government after failing to successfully coordinate an FCC request with DOD and NTIA  DOD and industry representatives told us that from a business perspective, it makes little sense for a commercial company to seek hosting opportunities for DOD payloads that require U S  military spectrum  Government and industry officials we spoke with said that aligning the development and acquisition timelines of a government payload and commercial host satellite is a challenge  The timeline associated with developing government sensors is generally much longer than that of commercial satellites, potentially creating difficulties in scheduling and funding commercially hosted payload arrangements  For example, DOD satellite systems take, on average, over 7 years to develop and launch a first vehicle, while commercial satellite programs typically take between 2 and 3 years  DOD payload owners may find it challenging to accelerate development and acquisition schedules to match those of the commercial satellite host  Additionally, DOD officials we spoke with said that their budget and planning processes require funding commitments up to 2 years in advance of actually receiving those funds  This can further complicate alignment with commercial timelines because the development of a government sensor would need to be underway well in advance of a decision to fund a commercially hosted payload approach  Furthermore, federal law generally prohibits agencies from paying in advance for a future service or from obligating future appropriations  However, several DOD and other government agency officials we spoke with said that it is possible to align government and commercial timelines  For example, MDA adopted the commercial host’s schedule to ensure its Spacebased Kill Assessment payload was ready for integration and launch without delaying the host satellite or worse—missing its own ride to space  DARPA officials told us they were also able to align DARPA acquisition and development schedules with the commercial host  The Air Force’s Enhanced Polar System (EPS) Recapitalization program officials were able to leverage existing documents such as requirements documents and acquisition strategies from the predecessor program to speed up the acquisition process  According to Air Force officials, the EPS Recapitalization program had a unique opportunity to take advantage of the availability of a commercial host and had the support of a high ranking Air Force official that enabled the program to move forward using a commercially hosted payload approach  Some officials cited concerns with combining government and commercial space missions  For example, officials across DOD told us they were wary of losing control over a hosted payload should a commercial company’s needs change  They said that theoretically, a commercial provider could decide to turn off power to the government’s payload if the host satellite needed extra power to perform a certain function  Additionally, DOD space program officials expressed concern that commercial practices for ensuring the mission success of the payload may not be up to government standards—that commercial testing and integration standards may be less robust than those used by traditional government programs to ensure success, adding risk to the government payload  Furthermore, officials in one DOD program office expressed a distrust of commercial host motives in offering to support a government payload on their satellite, suggesting that a company could be intending to steal government technologies  However, industry officials we spoke with said that DOD can generally issue a solicitation that includes necessary stipulations  For example, including a condition to preserve the payload’s priority of mission and other terms to protect the government’s investment may provide some assurance to those officials that perceive security risks  Additionally, some officials we spoke to cited cybersecurity concerns  They cited loss of control over data security as a challenge to using hosted payloads  Officials told us the data could be vulnerable to eavesdropping or manipulation as it travels between government ground systems and the commercially hosted government payload  However, according to HPO officials, the Air Force overcame this challenge on the CHIRP mission by procuring a secure interface that provided a data link between the payload and dedicated transponder and ground terminal  As mentioned previously, the Hosted Payload Office is developing a hosted payload data interface unit to mitigate this challenge by securing payload data communications from the host satellite  DOD, at the department-wide level, has limited information on commercially hosted payloads—mostly due to a lack of experience in using hosted payloads and complexities associated with them  For example, acquisition officials in the Office of the Secretary of Defense told us that DOD needs more data and analysis of the potential costs and benefits  However, realistic cost modeling for commercially hosted DOD payloads is unavailable because costs can vary across potential hosts and DOD has minimal experience using commercial hosts  Similarly, the HPO performs market research and cost estimates based on data from commercial companies, but according to one official in the HPO, the costs tend to vary based on the supply and demand in the commercial satellite industry  Additionally, HPO officials said their cost savings analyses are based on only two real-world commercially hosted DOD payloads— CHIRP and REACH  HPO officials told us that with additional government data they could compare the costs of system architectures that include free-flier satellites with those that use commercially hosted payloads  Additionally, some potential benefits of using commercially hosted payloads, such as resilience, may be difficult to measure  In our 2014 report on disaggregation, we recommended that DOD define key measures related to disaggregation, including developing metrics to measure resilience  DOD is in the process of developing standard metrics for resilience  DOD’s knowledge of commercially hosted payloads is also fragmented across the agency  Several DOD offices are independently conducting activities related to commercially hosted payloads, such as pursuing commercially hosted payload arrangements, developing lessons learned, and determining demand for commercial hosts  For example, MDA officials told us they have developed cost and technical data and lessons learned based on MDA’s Spacebased Kill Assessment payload— launched earlier this year—but have not shared it across the agency  On the other hand, the Space Test Program, also housed within the Air Force’s SMC develops lessons learned on its payloads, which are government payloads on government host satellites and officials there told us they provide lessons learned to the HPO  In October 2017, SMC’s Launch Office sent a request for data on hosted payloads to DOD agencies, research laboratories, and universities, but the HPO was not an active participant in this request  Independent efforts within DOD to collect and analyze cost, schedule, and performance results from hosted payloads can create fragmentation in DOD’s knowledge base and can increase the risk of duplicative efforts within DOD  DOD does not collect or consolidate agency-wide knowledge on commercially hosted payloads and has no plans to do so  Agency officials stated that DOD does not require programs outside of SMC to consult the HPO when seeking commercially hosted payload arrangements  The Air Force established the HPO to facilitate commercially hosted payloads, however, the 2011 Program Management Directive that established the HPO states that the HPO will coordinate with SMC directorates for detailed implementation of hosted payloads but does not address coordination with agencies or directorates outside of SMC  According to an HPO official, programs are not required to use HPO expertise or tools as they pursue using hosted payloads  Further, this official stated that programs are not required to provide any data or lessons learned to the HPO, or any other central point within DOD, following the pursuit or completion of a hosted payload arrangement  The 2011 Program Management Directive directs the HPO to provide lessons learned to SMC directorates but does not direct SMC offices to share information— such as costs, technical data and lessons learned on completed commercially hosted payload efforts—with the HPO  An HPO official indicated that the HPO obtains data through informal communication with those programs using hosted payloads that are willing to share data  We found that limitations and fragmentation of data and knowledge are contributing to resistance within DOD to using hosted payloads  Several DOD acquisition and program officials we spoke with who did not have experience with hosted payloads generally stated that the potential risks to using hosted payloads outweighed the benefits, and that there was little evidence-based analysis to prove otherwise  They were not aware of existing tools that could assist them in making decisions even though the HPO has been developing these tools and has made efforts to share them within SMC  DOD acquisition and program officials consistently cited a preference for maintaining the acquisition status quo over introducing any perceived added risk to their programs  At the same time, however, officials who have used hosted payloads were able to overcome logistical and technical challenges and realize cost savings  However, according to an HPO official, there is currently no requirement in place to facilitate sharing their approaches to doing so  We have reported in the past that DOD’s culture has generally been resistant to changes in space acquisition approaches and that fragmented responsibilities for acquisitions have made it very difficult to coordinate and deliver interdependent systems  Moreover, our past studies of commercial strategic sourcing best practices have found that that leading companies centralize procurement decisions by aligning, prioritizing, and integrating procurement functions within the organization  Establishing the Hosted Payload Office is one step in this direction, but the office is organized under the Advanced Systems and Development Directorate—a research and development organization—under SMC  Moreover, the 2011 directive that established the HPO does not address coordination or responsibilities for agencies or directorates beyond SMC  Consolidating knowledge is important because it allows organizations to share information and data upon which to develop consistent procurement tactics, such as ways to overcome challenges in matching a government payload with a commercial host  As we found in our work on commercial strategic sourcing best practices, organizations that struggled with fragmented information in the past overcame this challenge in part by consolidating their data on costs and spending  While hosted payload acquisitions are not a typical service acquisition, successful organizations have found that these techniques work for highly specialized technical services for which few suppliers exist  As DOD considers new architectures and acquisition approaches, commercially hosted payloads have the potential to play a role in delivering needed capabilities on orbit more quickly and at a more affordable cost than traditional DOD space acquisitions  Placing DOD payloads on commercial satellites might also be an effective method by which to increase resiliency  However, DOD’s experience and the data collected so far are limited in informing decisions on the use of these payloads  DOD would benefit from leveraging the knowledge and information gained from each hosted payload experience  Centralized collection and assessment of agency-wide data would help enable DOD to mitigate the logistical challenges inherent in matching payloads to hosts, and better position DOD to make reasoned, evidence-based decisions on whether a hosted payload would be a viable solution to meet warfighter needs  Without such knowledge, and a way for interested programs to leverage it, DOD may not be fully informed about using hosted payloads and may risk missing opportunities to rapidly and affordably address emerging threats in space  The Secretary of Defense should require programs using hosted payloads to provide cost and technical data, and lessons learned to a central office  In implementing this recommendation, DOD should consider whether the Hosted Payload Office is the most appropriate office to centralize agency-wide knowledge  (Recommendation 1) We provided a draft of this report to the Department of Commerce, NASA, and DOD for comment  The Department of Commerce provided technical comments, which we incorporated as appropriate  NASA did not have comments on our draft report  In its written comments, DOD concurred with our recommendation and stated that SMC had initiated a major reorganization since we drafted our report and that under the new organizational construct, the Hosted Payload Office had changed and may not be the appropriate office for centralizing DOD-wide hosted payload knowledge  DOD’s comments are reproduced in appendix II  DOD also provided technical comments which we incorporated as appropriate  We are sending copies of this report to the appropriate congressional committees, the Secretary of Commerce, the Secretary of Defense, the Administrator of NASA, and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-4841 or by email at chaplainc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  As shown in table 4, civil and other government agencies use commercially hosted payloads to enhance navigation systems, monitor environmental pollution, conduct scientific missions, and improve search and rescue systems  Officials from all of the agencies we spoke with cited cost savings and the ability to leverage existing commercial schedules and technologies among the reasons they use commercial host satellites  Cristina T  Chaplain (202) 512-4841 or chaplainc@gao gov  In addition to the contact named above, Rich Horiuchi (Assistant Director), Erin Cohen (Analyst in Charge), Claire Buck, Jon Felbinger, Stephanie Gustafson, Matthew Metz, Sylvia Schatz, and Roxanna Sun made key contributions to this report 

ground_truth: Education provided over $122 billion in grants, loans and work study funds to help students pay for college at about 6,000 schools in fiscal year 2017. Education is responsible for certifying that these schools are eligible for and capable of properly administering federal student aid funds. Schools are required to submit an annual compliance audit that provides information on schools' administrative capability, which Education considers in its school certification decisions. GAO was asked to review Education's process for certifying schools to receive federal student aid. This report examines (1) how Education certifies schools to administer federal student aid and how frequently schools are approved and denied certification; and (2) the role of compliance audits in the certification process and what, if any, steps Education has taken to address the quality of the audit information. GAO analyzed data on school certification outcomes for calendar years 2006-2017 (when GAO determined data were most reliable); reviewed data and reports summarizing Education's reviews of compliance audit quality for fiscal years 2006-2017; reviewed a non-generalizable sample of 21 school certification decisions from fiscal years 2015 and 2016, selected for a mix of decisions, school characteristics, and geographic regions; examined relevant federal laws, regulations, policy manuals and guidance; and interviewed Education officials. The Department of Education (Education) is responsible for evaluating a variety of information to determine whether a postsecondary school should be certified to administer federal student aid programs, and agency data show that it approves most schools that apply. Education procedures instruct regional office staff to review school policies, financial statements, and compliance audits prepared by independent auditors, among other things. Education can certify schools to participate in federal student aid programs for up to 6 years, or it can provisionally certify them for less time if it determines that increased oversight is needed—for example, when a school applies for certification for the first time or when it has met some but not all requirements to be fully certified. In calendar years 2006 through 2017, Education fully or provisionally approved most schools applying for initial or recertification to receive federal student aid (see figure). Note: Schools applying for certification for the first time and approved are placed in provisional certification. In deciding whether to certify schools, Education particularly relies on compliance audits for direct information about how well schools are administering federal student aid, and Education's offices of Federal Student Aid and Inspector General have taken steps to address audit quality. The Inspector General annually selects a sample of compliance audits for quality reviews based on risk factors, such as auditors previously cited for errors. In fiscal years 2006 through 2017, 59 percent of the 739 selected audits received failing scores. Audits that fail must be corrected; if not, the school generally must repay federal student aid covered by the audit. Because higher risk audits are selected for review, Inspector General officials said they cannot assess the overall prevalence of quality problems in compliance audits. These two Education offices have taken steps to improve audit quality. For example, the Inspector General offered additional training to auditors on its revised 2016 audit guide and provided guidance to schools on hiring an auditor, while Federal Student Aid created a working group to strengthen its procedures for addressing poor quality compliance audits. Education's efforts to address audit quality could help ensure that these audits provide reliable information for school certification decisions. GAO is not making recommendations in this report.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: To participate in federal student aid programs, postsecondary schools must be 1) certified by Education as eligible to participate in federal student aid programs, 2) accredited by a recognized accrediting agency— generally nongovernmental, nonprofit entities—and 3) authorized by the state in which the school is physically located  (See table 1 ) FSA is responsible for ensuring that schools with access to federal student aid are eligible and capable of properly administering federal student aid funds, according to standards established by Education and authorized by the Higher Education Act  These standards include requirements for schools related to communication, personnel, policies, procedures and reporting, and adequate checks and balances in a system of internal controls, among others  FSA is also responsible for conducting ongoing financial oversight of schools that receive federal student aid  This includes reviewing annual financial statement audits to assess a school’s financial responsibility and providing additional oversight to schools that do not meet financial responsibility standards outlined in the Higher Education Act  Schools that participate in federal student aid programs generally are required to submit annual compliance audits  The compliance audit provides information that FSA can use to assess the school’s administration of federal student aid programs and to identify schools that require additional oversight because they do not fully comply with federal student aid administrative requirements  The OIG is required to assess the quality of school compliance audits and selects a sample to review each year  The OIG reviews the audit documentation to ensure that it supports the auditor’s opinions and that the audit results are reliable  According to agency guidance, FSA staff should refer compliance audits to the OIG for a quality review if they have any concerns about the quality of the audits  Both FSA and OIG officials stated that the OIG has primary responsibility for issues related to audit quality  When a school first applies to be certified to administer federal student aid, FSA will either approve the school for provisional certification— generally for 1 year—or deny certification (see fig  1)  Once a school is approved for initial certification and applies for recertification, FSA will provisionally or fully recertify the school, or deny certification  According to FSA procedures, FSA uses provisional certification for initial, or first time, applicants, as well as schools that are applying for recertification  Provisional certification is the only approval status available to new schools  In addition, FSA may decide to recertify a school provisionally if it determines that a school has not fully complied with federal student aid requirements  FSA prohibits provisionally certified schools from opening new campus locations or offering new programs without approval from FSA, and provisionally certified schools that are denied recertification have a less substantive appeals process than fully certified schools  Further, recertified schools in provisional status are subject to more FSA oversight than schools that are fully certified  FSA procedures allow for some discretion in determining for how long to certify a school  Provisional recertification generally lasts 1 to 3 years, while full recertification generally lasts 4 to 6 years  Education’s FSA regional staff draw information from a variety of sources during the certification process to assess a school’s capability to administer federal student aid  According to FSA documents, regional staff are to review information collected from schools and third parties, such as annual compliance audits conducted by independent auditors, among other information sources  FSA staff responsible for different functional areas, such as financial and compliance audits, accreditation status, and student loan default rates, compile and review information on schools, according to FSA procedures  FSA officials told us that these staff meet to discuss any potential program eligibility issues and to ensure that all information relevant to a school is considered before making a certification decision  FSA’s certification procedures outline some of the key information that regional staff should assess, some of which is relevant to both initial and recertification decisions, and some of which is specific to each type of certification process (see fig  2)  Documents and policies provided by schools: FSA regional staff are directed to review documents submitted by schools, including school catalogs, and certain school policies—such as admissions and student refund policies—that are relevant to assessing administrative capability  Proof of accreditation: School accreditors are responsible for applying and enforcing standards to help ensure that the education offered by schools is of sufficient quality to achieve program objectives  Accreditation of schools, which generally includes a site visit, takes place on a cycle that may range from every few years to as many as 10 years  Proof of state authorization: States are responsible for authorizing schools to offer postsecondary education and respond to student complaints  The process for approving schools varies from state to state and may include on-site visits  Audited financial statements: FSA regional staff are directed to review information in audited financial statements to assess schools’ financial health  Schools are required to have annual audited financial statements issued by an independent certified public accountant or a government auditor  Self-reported school data: FSA regional staff are instructed to review data on continual student enrollment in eligible academic programs and student withdrawal rates  Pre-certification review and school outreach: FSA staff are responsible for contacting school personnel to verify the school’s application information and discuss relevant policies, procedures, and other materials relevant to administering federal student aid  FSA visits to newly certified schools: After schools first apply and are provisionally certified, Education requires FSA regional staff to contact them within 3 months and schedule an on-site school visit  Schools cannot administer federal student aid until they are certified, so FSA has limited information on how newly certified schools are administering federal student aid programs  School visits provide FSA with an opportunity to collect additional information about a provisionally certified school’s ability to administer federal student aid  Some FSA regional staff we interviewed told us that on-site visits to newly certified schools provide valuable first-hand information about whether these schools are administering federal student aid in accordance with program requirements  If FSA regional staff find that a school is having difficulties administering federal student aid, FSA procedures direct regional staff to assist schools by providing clarification and guidance on federal student aid policies, recommending additional training for school officials, and helping schools develop a plan to track and report on their corrective actions, among other things  Compliance audits: FSA staff are directed to review information in compliance audits to determine if schools are complying with specific federal student aid requirements  Generally, compliance audits are required to be conducted annually by an independent auditor, and submitted with the school’s audited financial statements  Program reviews: FSA regional staff are also responsible for conducting program reviews, usually on site, which evaluate school compliance with federal requirements and can provide more in-depth information on schools than compliance audits, according to some FSA staff we interviewed  Generally, FSA selects schools for program reviews that it considers to be at risk for noncompliance, according to Education documents  FSA conducts approximately 250 to 300 program reviews per year, according to FSA documentation  FSA staff from all four of our selected regional offices told us they consider results from any recent program review in decisions about recertification and noted that such information, when available, is valuable for assessing schools’ administrative capability  Education data: FSA regional office staff are also directed to review data on student loan default rates  From calendar years 2006 through 2017, FSA approved most schools applying for certification to receive federal student aid, according to Education data  From 2006 through 2017, FSA approved 89 percent of schools new to administering federal student aid for provisional certification and denied 11 percent of schools overall (see fig  3)  Denial rates for initial certification were 11 percent for public and for-profit schools and 14 percent for nonprofit schools  For more information on 2006-2017 school certification outcomes by year, see appendix I  FSA regional staff responsible for reviewing school applications told us that schools are denied initial certification for issues such as a lack of accreditation, not offering eligible programs for federal student aid, or not meeting other statutory eligibility requirements  For example, FSA staff said that for-profit and vocational schools that apply for initial certification are required to provide an eligible program continuously for 2 years prior to their initial application  FSA staff may also advise schools that do not meet basic eligibility requirements not to apply, which could result in fewer initial certification denials overall  In addition, FSA staff said they often work with schools to address compliance problems, for example, by providing guidance on revising school policies that do not meet requirements, so that the schools are able to meet FSA’s certification requirements  From 2006 through 2017, 76 percent of schools applying for recertification were fully recertified, 21 percent were provisionally recertified, and 3 percent were denied recertification  Sixty-six percent of for-profit schools were fully recertified, 28 percent were provisionally recertified, and 6 percent were denied  In comparison, 86 percent of public schools were fully recertified, 14 percent were provisionally recertified, and fewer than 1 percent were denied  Nonprofit schools had rates similar to public schools, with 80 percent fully recertified, 18 percent provisionally recertified, and 2 percent denied (see fig 4)  FSA staff from all four of our selected regional offices told us that they typically deny recertification when a school no longer meets eligibility requirements, such as losing accreditation, or when there is significant evidence of serious issues or massive wrongdoing, such as fraud  For example, managers in one regional office told us they denied recertification for a school because they had evidence that the school was accepting students without valid high school diplomas and referring them to diploma mills to boost enrollment  Staff in two FSA regional offices told us that they can also choose to fully recertify a school for shorter periods of time if they uncover issues related to administrative capability  For example, one regional staff member told us that when they found a school’s default rate for one federal student loan program had been high for the prior 3 years, the regional office decided to shorten the school’s full recertification period from 6 to 4 years, to allow FSA staff to review the school again sooner  FSA staff from all four of our selected regional offices told us that they provisionally certify schools for a variety of reasons, including when a school submits a late compliance audit or when a recent compliance audit indicates that a school could potentially have significant problems  Generally, schools in provisional certification status are subject to additional monitoring by FSA compared to schools that have been fully certified  For example, Education officials said that if they have concerns about a provisionally certified school’s student withdrawal rate, they can add provisional conditions requiring the school to submit monthly enrollment rosters for review  Staff in two FSA regional offices told us that in other cases, if they have concerns about how a school is administering federal student aid or suspected fraud, they can put a school on provisional status and conduct a program review to collect more detailed information on compliance with federal requirements  Education data also show that most schools remain in provisional status the first time they are recertified—62 percent from 2006 to 2017  In contrast, FSA staff fully recertified over three-quarters of schools that applied for recertification a second time during the same time period (see table 2)  For more information on first and second recertification outcomes by school sector, see appendix II  We found that FSA generally relies on compliance audits as the only annual on-site review to determine how schools applying for recertification administer federal student aid  The audits provide direct information collected by independent auditors from school visits and file reviews examining how schools administer federal student aid and comply with program requirements  For example, OIG audit guidance directs auditors to check whether schools are distributing federal student aid to eligible students and accurately calculating student loan amounts  FSA officials and staff from all four of our selected regional offices said that compliance audits are a key source of information they use to assess a school’s administrative capability  Officials from Education’s OIG said that the quality of information in compliance audits varies substantially and depends on the auditor  The OIG has found quality problems in some of the compliance audits it selects—based on auditor and school risk factors—for its annual quality control reviews  Because the OIG selects higher risk audits to review, its reviews are more likely to detect problems, and OIG officials said they cannot make any conclusions about the overall prevalence of quality problems in compliance audits  However, our analysis of OIG quality review data found that of the 739 compliance audits reviewed by the OIG from fiscal years 2006 through 2017, the OIG passed 23 percent (173) and failed 59 percent (436)  An additional 18 percent (130) passed with deficiencies  For example, across the 41 compliance audits it reviewed in fiscal year 2016, the OIG identified 264 quality deficiencies with the auditor’s work, according to our analysis of quality reviews provided by the OIG  The most frequently cited issues in these 41 audits were: reporting (24 audits), such as lack of evidence that the auditor tested whether the school correctly reported student enrollment status; student eligibility (20 audits), such as lack of evidence that the auditor verified student school attendance; and administrative capability (19 audits), such as lack of evidence that the auditor determined whether the accreditor had been notified about a change in school ownership within 10 days  FSA officials also identified quality issues with the compliance audits of some schools  FSA headquarters officials and staff we interviewed in several regional offices said they have seen schools with significant program review findings that had not been identified in annual compliance audits  FSA staff said they have referred some compliance audits to the OIG for quality reviews when they have had questions about the thoroughness of an audit  We also found a couple of examples in our review of school certification documents in which the findings identified in a school’s compliance audit were different from the findings identified by FSA in a program review of the same school covering the same time period  In one case, FSA staff said they probably would have fully recertified the school if they had relied solely on the compliance audit  Instead, they used the program review to determine that the school should be provisionally recertified  Compliance audits and program review findings are based on a sample of student records, and FSA staff said some differences in findings might be explained by differences in the records reviewed  FSA and OIG officials cited several issues that can affect the quality of compliance audits  FSA and OIG officials we interviewed said that some auditors conducting compliance audits have insufficient training in federal student aid, which contributes to audit quality problems  OIG staff also said that even if an auditor meets the general training hour requirements for auditors, the training content may not be relevant for federal student aid audits  In addition, FSA and OIG officials said some schools— particularly smaller schools—tend to hire less experienced auditors in order to save money, often resulting in poor quality audits  FSA officials in most selected regional offices said that additional training on federal student aid for auditors who are new to or unfamiliar with federal student aid could help improve audit quality  FSA and the OIG recently have taken steps to address audit quality and the information available to FSA staff when making certification decisions  These efforts include: Training for auditors: The OIG has taken steps to enhance training offered to auditors of schools’ administration of federal student aid and is exploring opportunities to provide additional training  In December 2017, the OIG and the American Institute of Certified Public Accountants cosponsored training for auditors on the OIG’s 2016 revised guide for audits of for-profit schools, and other topics related to auditing federal student aid  The training included discussion of common audit quality issues and areas of highest risk  According to an OIG official, about 200 auditors attended, and after the event, the American Institute of Certified Public Accountants and the OIG posted a recording of the training to their websites to make it available to additional auditors  In addition, OIG officials said they maintain an email account—listed on the OIG website—through which auditors can ask questions and receive responses  In March 2018, the OIG posted frequently asked questions and answers to the website  Timeliness of OIG quality reviews: Both FSA and OIG officials said that the OIG has recently renewed efforts to issue compliance audit quality reviews more quickly, after several years in which staffing shortages and other issues led to some delayed quality reviews  Guidance to schools on selecting an auditor: OIG officials said that at the 2017 FSA training conference for school financial aid staff, they presented to more than 400 participants about factors schools should consider when hiring an auditor  For example, they suggested that schools verify the licenses of certified public accountants, ask about the types of engagements an auditing firm has conducted, request and check references, check for any actions that may have been taken against a firm, and ask whether the auditor has been subject to a previous review by the OIG or another agency  FSA officials said they expected to invite the OIG to present at future FSA conferences, and OIG officials said they were seeking additional opportunities to share information on auditor selection with schools, including a planned presentation to an association of postsecondary schools  FSA working group: FSA recently established a working group to update its guidance to FSA staff on how to coordinate with the OIG to address compliance audits with quality problems  Among other topics, the working group has consulted with the OIG about how schools are made aware of the OIG’s findings regarding the quality of their audits  FSA officials said that OIG officials have provided input and feedback on FSA’s proposed changes to the guidance  Audit guide revisions: In addition, OIG and FSA staff told us they expected the OIG’s 2016 revisions to the for-profit school audit guide to improve the quality of compliance audits for those schools  They said that because the revised guide clarified some issues that were confusing to auditors in the previous guide issued in 2000, auditors might be better able to implement the guidance  The audit guide revisions include more testing and reporting requirements, clarified procedures, and guidance on issues such as fraud reporting and coordinating financial and compliance audits  The 2016 revisions first applied to audits for fiscal years beginning after June 30, 2016, and FSA began receiving those audits at the end of 2017  In addition, although the OIG’s 2016 revisions only apply to audits of for-profit schools, FSA officials said they planned to establish a working group to consider improvements to audit guidance for public and nonprofit schools  FSA and OIG efforts to address audit quality could help ensure that compliance audits provide accurate and reliable information on school administrative capability for Education’s recertification decisions  We provided a draft of this report to Education for review and comment  Education’s Office of Inspector General provided technical comments, which we considered and incorporated as appropriate  Education did not provide other comments on the report  We are sending copies of this report to the appropriate congressional committees; the Secretary of Education; and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (617) 788-0534 or emreyarrasm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  In addition to the contact named above, Michelle St  Pierre (Assistant Director), Kristy Kennedy (Analyst-in-Charge), Edward Bodine, Marissa Jones, and Mark Ward made significant contributions  Also contributing to this report were Susan Aschoff, Deborah Bland, Nagla’a El-Hodiri, Monika Gomez, Sheila R  McCoy, Jessica Orr, Mimi Nguyen, John Mingus, Rhiannon Patterson, Monica Savoy, Benjamin Sinoff, and Rosemary Torres Lerma 


Report 2:  As part of FTC’s resumption of Internet service provider oversight, FCC and FTC entered into a memorandum of understanding in December 2017 spelling out their roles and responsibilities regarding oversight of these companies  FTC staff said that they regularly communicate with FCC and have an agreement to share Internet privacy complaints  As previously discussed, no federal statute comprehensively and specifically governs Internet privacy across all sectors  FTC oversees some aspects of Internet privacy by using its FTC Act section 5 authority to protect consumers from unfair and deceptive practices  FTC also uses its specific COPPA authority to police the collection and use of personal information from children by online services  Some industry representatives said that FTC’s enforcement has been effective because the agency has expertise and experience in privacy issues and has the flexibility to take enforcement action on a case-by-case basis  In addition, a content provider said that FTC has taken enforcement actions against companies of various sizes in different sectors and has a powerful tool by being able to require companies to be audited by outside entities for up to 20 years  Industry stakeholders we interviewed generally said that “direct enforcement” of a statute is preferable to promulgating and enforcing regulations implementing that statute (which constitutes enforcement of the statute as well)  These stakeholders noted several key concerns they believe exist with regulatory versus statutory enforcement of Internet privacy: Regulations can stifle innovation  Two industry stakeholders said that regulations can hinder companies’ ability to innovate  For example, representatives from an Internet service provider said that innovation can stop during the rulemaking process as the industry waits for the regulation to be finalized  Regulations may create loopholes  Representatives from an Internet industry group and a content provider said that regulations can also contain loopholes that can be legally exploited because imprecise language in a regulation may allow a company to legally engage in an action that was originally unforeseen by the regulator  Regulations can become obsolete  Several industry stakeholders said regulations also may become obsolete quickly because the Internet industry is rapidly changing  An Internet industry representative noted that there can be large shifts in the Internet industry from year to year, while it often takes an agency much longer than a year to adopt a rule  Industry stakeholders said the flexibility of FTC’s approach allows FTC to adapt continuously to changing market conditions  Rulemakings can be lengthy  FCC officials said that in some cases, rulemakings can take a long time, especially when the issues are complex and there is no statutory deadline  Our previous work on rulemaking found that length of time required for the development and issuance of final rules varied both within and among agencies  Additionally, while some stakeholders suggested that regulations can clarify acceptable practices, other stakeholders, including from industry and academia, said that enforcement actions can send a similar message  According to both a representative from a content provider and an academic, enforcement actions such as settlement agreements, for example, establish precedents that companies can follow, similar to the way that case law developed by courts provides guidance for companies  Although some industry representatives we interviewed said that FTC’s use of settlement agreements provides companies with guidance, certain trade associations took a different position in a recent case brought before the U S  Court of Appeals for the Third Circuit, FTC v  Wyndham Worldwide Corp  799 F 3d 236 (3d Cir  2015)  However, the court did not agree with the associations’ arguments  The case involved an enforcement action against Wyndham Worldwide Corporation where FTC alleged that data security failures led to three data breaches at the company in less than 2 years  The court considered whether FTC could bring an enforcement case involving cybersecurity using FTC’s section 5 “unfair practices” authority and, if so, whether Wyndham had “fair notice” that its specific cybersecurity practices could be deemed “unfair ” A group of companies and the U S  Chamber of Commerce wrote a friend- of-the-court brief supporting Wyndham, criticizing FTC’s “regulation- through-settlements” approach  The companies argued this approach subjects businesses to “vague, unknowable, and constantly changing data-security standards” and businesses often are unaware of the standards to which they are held until after they receive a notice of investigation from FTC, at which point they must settle or expend considerable resources fighting the agency  Potential Limits on Federal Trade Commission (FTC) Remedies A recently decided federal appeals court case illustrates potential limits on the remedies that FTC can order in an “unfair practices” enforcement proceeding  In this 2018 case, LabMD, Inc  v  FTC, 891 F 3d 1286 (11th Cir  2018), the U S  Court of Appeals for the Eleventh Circuit found that FTC could not direct a medical laboratory to create and implement wholesale data-security protective measures as a remedy to the laboratory’s alleged unfair practices  FTC had filed a complaint against LabMD under section 5 of the FTC Act for allegedly committing an unfair act or practice by failing to provide reasonable and appropriate security for personal information on its computer networks  The commission found that LabMD’s inadequate security constituted an unfair act or practice and ordered LabMD to take various actions, including establishing and maintaining a reasonable and comprehensive information security program  On appeal, the Eleventh Circuit ruled that FTC’s order exceeded its authority because it did not prohibit a specific act or practice but instead, mandated a complete overhaul of the company’s data-security program  FTC had argued that the FTC Act gives it broad discretion to prevent unfair or deceptive acts or practices that injure the general public and that FTC had spelled out standards for LabMD to craft a reasonable security program  The court ruled, however, that such a general approach would make it difficult for a reviewing court to determine if LabMD had complied with the order, in the event of a future FTC challenge  company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute ” A majority of non-industry stakeholders we interviewed identified limitations in the current Internet privacy oversight approach because they view regulations in conjunction with enforcement as being more effective  These stakeholders include all of the former FTC commissioners we interviewed, three of the four former FCC commissioners we interviewed, and representatives from consumer advocacy groups we interviewed  In addition, a former FCC commissioner said that the current Internet privacy oversight approach is limited in part because he viewed regulations applying equally to all players in the Internet ecosystem in conjunction with enforcement as being more effective  A representative from a consumer advocacy group also said that regulations in conjunction with enforcement are essential for effective privacy protection  Some of these stakeholders noted key ways that they believe Internet privacy regulations can provide clarity to industry and consumers, as well as fairness and flexibility in enforcement: Regulations can provide clarity  An Internet industry group representative said that various companies have favorable views of regulations because they can provide clear expectations about what actions are permissible  Similarly, a former congressional staff member with expertise on privacy issues said that some companies have favorable views of regulations because the regulations often provide clearer expectations about what the companies can do  FCC officials said that with respect to telephone privacy provisions of the Communications Act, the telephone industry wanted rules because it sought greater clarity about what it should be doing, what constituted a violation, how to comply, and what behaviors were acceptable  Regulations may promote fairness  Some other stakeholders discussed the ability of regulations to provide fairness  For example, a former federal enforcement official described regulations as creating a fair and consistent oversight regime across the entire industry in a way that case-by-case enforcement actions do not  Another former federal enforcement official said that regulations give companies fair notice of what actions may be violations and thus help those companies avoid surprising or unexpected enforcement  Regulations can be flexible  An academic said that by targeting behaviors and not specific technologies, regulations can be written in such a way that they do not become obsolete  An academic also said that regulations based on broad performance-standards principles can avoid being overly prescriptive  FCC officials also noted that regulations can be amended to adapt to changes in technology often faster than new laws can be enacted  Furthermore, regulations determined to be obsolete can be repealed  FTC staff told us that the agency systematically reviews all of its regulations every 10 years, even though it is only legally required to review its most significant ones, and that the number of FTC regulations has decreased because the agency determined prior ones were obsolete  The Regulatory Flexibility Act requires federal agencies to analyze the effect of their regulations on small entities  Regulations can be a deterrent  FCC officials said that rules can have a deterrent effect on bad practices in the industry or have a role in mitigating the negative effects of bad practices after they occur  They said, for example, that the practice of pretexting (improperly obtaining people’s telephone records) was greatly curtailed by an FCC regulation prohibiting such practices  They also said that rules can foreclose arguments by companies claiming that because no rule was in place, they had no reasonable notice or awareness that they should behave in a particular way  Consumer advocacy groups and other stakeholders, including some former FTC and FCC commissioners, had concerns about the efficacy of an enforcement approach such as FTC’s approach to Internet privacy oversight, which focuses on enforcing a statute rather than implementing regulations  They said that FTC’s enforcement approach limits the ability of the agency to affect companies’ behavior, and that any enforcement activity occurs after the violation, undesirable behavior, harm, or illegal action has already occurred  A former federal enforcement official also said that regulations can prevent companies from engaging in bad practices in the first instance and thus have a preventive effect  A former FCC commissioner said that by the nature of a direct statutory- enforcement approach (as opposed to rulemaking), an agency would only address a harm after it has occurred  As discussed above, for example, data often cannot be removed from the Internet because copies of the data can exist among many bad actors, and it can be difficult to identify the entity responsible for unwanted disclosures  Therefore, it may be more important to avoid such Internet privacy harms from occurring in the first place  Another former FCC commissioner told us that Internet privacy oversight should be returned to FCC because it has APA section 553 notice-and-comment rulemaking authority and considerable enforcement experience  Representatives from consumer advocacy groups said that FTC’s enforcement action has been insufficient because it investigates only a small portion of actual Internet-privacy violations or takes action regarding only the most egregious or outrageous cases that it can win  FTC has also stated in its strategic plan that it focuses on investigating and litigating cases that cause or are likely to cause substantial injury to consumers and that by focusing on practices that are actually harming or likely to harm consumers, FTC can best use its limited resources  Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms  An FTC staff member from the Division of Privacy and Identity Protection said that the agency has been effective with the limited enforcement resources it has available  Furthermore, the staff member said the agency uses no formal written criteria or template to assess individual cases but considers the size and scale of a company’s effect on consumer privacy when deciding whether to take enforcement action  However, a former FTC commissioner told us that the agency needs more resources to effectively oversee Internet privacy  We asked stakeholders whether it was clear under what circumstances FTC will take Internet privacy enforcement action  In response, some stakeholders said that FTC’s enforcement priorities are reflected in its settlement agreements, which provide information that is similar to a body of case law  Individual commissioners also may issue statements explaining their decisions  Two stakeholders also said that FTC’s closing letters, which the agency sends to companies and posts on its website when it closes an investigation without taking enforcement action, may explain its decisions  Other stakeholders said that more guidance would be helpful to provide additional clarity on how the agency uses its Internet privacy enforcement authority  FTC staff and other stakeholders also said that FTC has provided useful Internet privacy guidance  For example, in 2015, FTC published guidance for businesses on complying with COPPA  Various stakeholders we interviewed said that opportunities exist for enhancing Internet privacy oversight  A key component of FTC’s mission, as specified by the FTC Act, is to protect consumers against unfair and deceptive practices  As discussed earlier, some stakeholders believe that FTC’s reliance on its unfair and deceptive practices authority to address Internet privacy issues has limitations  In addition, although the Fair Information Practice Principles provide internationally recognized principles for protecting the privacy and security of personal information, they are not legal requirements and FTC cannot rely on them to define what constitutes unfair and deceptive practices related to privacy and data security  We stated in our 2013 information resellers report that the current U S  privacy framework is not always aligned with the Fair Information Practice Principles and that these principles provide a framework for balancing the need for privacy with other interests  We found that there are limited privacy protections under federal law for consumer data used for marketing purposes  We said that although the Fair Information Practice Principles call for restraint in the collection and use of personal information, the scope of protections provided under current law has been narrow in relation to: (1) individuals’ ability to access, control, and correct their personal data; (2) collection methods and sources and types of consumer information collected; and (3) new technologies, such as tracking of web activity and the use of mobile devices  Although we recommended in that report that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace, this matter for congressional consideration was not specific to Internet privacy or to the oversight authorities of any particular agency or agencies  As noted above, various stakeholders expressed concern about the ability of consumers to control their data and understand how that data are used  These concerns suggest that companies are not always following the Fair Information Practice Principles, such as that companies’ data practices should be transparent, allow consumers the right to access and edit their data, and limit the collection of data to the extent feasible  Those stakeholders who believe that FTC’s current authority and enforcement approach is unduly limited identified three main actions that could better protect Internet privacy: (1) enactment of an overarching federal privacy statute to establish general requirements governing Internet privacy practices of all sectors; (2) APA section 553 notice-and- comment rulemaking authority; and (3) civil penalty authority for any violation of a statutory or regulatory requirement, rather than allowing penalties only for violations of settlement agreements or consent decrees that themselves seek redress for a statutory or regulatory violation  Stakeholders from a variety of perspectives—including from academia, industry, consumer advocacy groups, and former FTC and FCC commissioners—told us that a privacy statute could enhance Internet privacy oversight by, for example, clearly articulating to consumers, industry, and privacy enforcers what behaviors are prohibited, among other things  In addition, a former FCC commissioner said that a new privacy statute could enhance Internet privacy oversight by creating uniform standards for all players in the Internet ecosystem that is focused on the consumer rather than the regulatory legacy of the companies involved (regulations that apply to specific types of companies based on what they are or used to be, such as telecommunications carriers, cable companies, broadcasters, and mobile wireless providers)  The former FCC commissioner said that as companies, technologies, and markets change, there is a question about whether existing law should be modernized  In 2015, FTC staff recommended that Congress enact broad-based legislation that is flexible and technology-neutral, while also providing clear rules of the road for companies about such issues as how to provide choices to consumers about data collection and use practices  Some stakeholders suggested that such a framework could either designate an existing agency as responsible for privacy oversight (such as FTC) or create a new privacy-oriented agency  A representative from a consumer advocacy group mentioned that the European Union, for example, has established the European Data Protection Supervisor, an independent data protection authority, to monitor and ensure the protection of personal data and privacy  Similarly, in Canada, the Office of the Privacy Commissioner, an independent body that reports directly to the Parliament, was established to protect and promote individuals’ privacy rights  Some stakeholders also stated that the absence of a comprehensive Internet privacy statute affects FTC’s enforcement  For example, a former federal enforcement official said that FTC is limited in how it can use its authority to take action against companies’ unfair and deceptive trade practices for problematic Internet privacy practices  Similarly, another former federal enforcement official said that FTC is limited in how and against whom it can use its unfair and deceptive practices authority noting, for example, that it cannot pursue Internet privacy enforcement over exempted industries such as common carriers  In addition, a former FCC commissioner said that it is more difficult for FTC to take effective action because its enforcement comes only after a complaint and after an often lengthy review process  The former FCC commissioner also said that without “ex ante” rules (rules that define prohibited activity before it has occurred), there inevitably will be delay, confusion, and lack of knowledge about what is and is not acceptable behavior  In addition, some stakeholders—including a representative from a consumer group, a former federal enforcement official, and a former FCC commissioner—said FTC’s section 5 “unfair or deceptive practices” authority may not enable it to fully protect consumers’ Internet privacy because it can be difficult for FTC to establish that Internet privacy practices are legally “unfair ” For example, under section 5, FTC has charged companies with committing a “deceptive” practice if their privacy policies said they would not collect or use consumers’ personal information but then did so  However, a former congressional staff member said that companies often write broad and vague policy statements, making it difficult for FTC to charge companies with committing deceptive practices  Instead, according to a representative from a consumer advocacy group, FTC would have to show the companies’ actions were “unfair,” which, according to the representative, is legally difficult to establish  We found in our 2017 report on vehicle data privacy that most automakers’ written privacy notices used vague language  Similarly, we found in our 2012 report on mobile device location data that although companies’ policies stated that they shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data  Some stakeholders said that FTC relies more heavily on its authority to take enforcement action against deceptive trade practices compared with the agency’s unfair trade practices authority  This was confirmed in our analysis of FTC’s Internet privacy enforcement actions discussed previously  However, a representative from a consumer advocacy group said that FTC’s ability to take such action is limited practically to instances where a company violates its own privacy policy—companies generally can collect and use data in any way they want if they include language in their policies asserting their intent to do so  According to a former FCC commissioner, a privacy statute could clarify the situations in which FTC could take enforcement action  Various stakeholders said that there are advantages to overseeing Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority  As discussed above, that provision lays out the basic process by which so-called informal agency rulemaking shall be conducted, namely, publication of proposed regulations in the Federal Register; an opportunity for public comment (written and possibly oral submission of data and views); and publication of final regulations in the Federal Register with an explanation of the rules’ basis and purpose  Also as noted above, Congress imposed additional rulemaking steps on FTC in the Magnuson-Moss Act when FTC is promulgating rules under section 5 of the FTC Act  These additional steps include providing the public and certain congressional committees with advance notice of proposed rulemaking (in addition to notice of proposed rulemaking)  FTC’s rulemaking under Magnuson-Moss also calls for, among other things, oral hearings, if requested, presided over by an independent hearing officer, and preparation of a staff report after the conclusion of public hearings, giving the public the opportunity to comment on the report  Finally, Congress made it easier for the public to appeal FTC’s Magnuson-Moss rules by making the agency meet a higher standard when the rules are challenged in court  FTC staff said that these additional steps add time and complexity to the rulemaking process  In congressional testimony in 2010, the then-Director of FTC’s Bureau of Consumer Protection said that “if Congress enacts privacy legislation, the commission agrees that such legislation should provide APA rulemaking authority to the commission ” According to FTC, this testimony was voted on and approved by the commissioners and, therefore, constituted the commission’s official position at the time  Moreover, according to stakeholders, in many cases regulations can be used to implement statutes  Officials from other consumer and worker protection agencies we interviewed described their enforcement authorities and approaches  For example, officials from the CFPB and the FDA, both of which use APA section 553 notice-and-comment rulemaking, said that their rulemaking authority assists in their oversight approaches and works together with enforcement actions  OSHA officials said that the standards that the agency promulgates under its authority specify what employers are required to do to reduce safety and health risks to workers  Such standards lay out the workplace conditions that must be maintained by employers and require that employers implement certain practices, operations, or processes that ensure worker protections  EEOC officials said that regulations are used to guide investigations that establish whether enforcement action is appropriate  CPSC officials said that the agency conducts consumer protection not only by establishing and enforcing mandatory regulations, but also through collaborative actions such as educating industry, developing consensus voluntary safety standards, removing defective products from the marketplace through voluntary corrective actions, and litigating when necessary  In addition, in contrast to FTC’s approach, FCC has APA section 553 notice-and-comment rulemaking authority and has issued regulations implementing section 222 of the Communications Act using that rulemaking authority to protect the privacy of telephone users  Some stakeholders suggested that FTC’s current ability to levy civil penalties could also be enhanced  Currently, FTC can levy civil penalties against companies for violating certain regulations, such as COPPA regulations, or if the company violates the terms of a settlement agreement already in place  According to most former FTC commissioners and some other stakeholders we interviewed, FTC should be able to levy fines for initial violations of section 5 of the FTC Act  An academic told us that the power of an agency to levy a fine is a tangible way to hold industries accountable  Another academic noted, however, that fines may be relatively less effective in industries where there is limited competition because the costs of those fines may be more effectively passed on to consumers in the form of higher prices for services  In addition, some stakeholders said that payments required by FTC orders are not large enough to act as a deterrent and that companies may consider them to be a cost of doing business  There is a growing debate about the federal government’s role in overseeing Internet privacy  In a July 2018 congressional hearing, FTC’s new chair testified that the FTC Act cannot address all privacy and data- security concerns in the marketplace  The chair said, for example, that FTC’s lack of civil penalty authority for violations of the FTC Act reduces its deterrent capability  He also noted the agency lacks authority over non-profits and over common carrier activity, even though those entities and activities often have serious implications for consumer privacy and data security  In November 2018, FTC’s chair testified before Congress and urged Congress to consider enacting privacy legislation that would be enforced by FTC  A majority of the commission has indicated support for APA rulemaking and civil penalty authority for privacy  FTC also held hearings in September, November, and December 2018 to advance the discussion around privacy issues, among other topics, and FTC plans to hold an additional hearing on data security and consumer privacy in February 2019  In a Federal Register notice, FTC announced that it is interested in the benefits and costs of various state, federal and international privacy laws and regulations, including the potential conflicts among those standards  FTC also indicated that it is particularly interested in the efficacy of the commission’s use of its current authority and the identification of any additional tools or authorities the commission may need to adequately deter unfair and deceptive conduct related to privacy and data security  Also in July 2018, an NTIA official announced that NTIA, in coordination with the Commerce Department’s International Trade Administration and National Institute of Standards and Technology, had recently started holding stakeholder meetings to identify common ground and formulate core, high-level principles on data privacy  Regarding the development of the Administration’s approach to consumer privacy, in September 2018, NTIA requested comments on ways to advance consumer privacy while protecting prosperity and innovation  Our 2009 report on a framework for assessing proposals for modernizing the financial regulatory system similarly found that regulators should have the authority to carry out and enforce their statutory missions  We further said that a regulatory system should be flexible and forward looking, allowing regulators to readily adapt to market innovations and changes, including identifying and acting on emerging risks in a timely way without hindering innovation  These factors are useful considerations as the federal government explores how it can better oversee privacy and data security  Having sufficient and appropriate authorities and providing flexibility to address a rapidly evolving Internet environment could better ensure that the federal government can protect consumers’ privacy  Recent developments regarding Internet privacy suggest that this is an appropriate time for Congress to consider comprehensive Internet privacy legislation  Although FTC has been addressing Internet privacy through its unfair and deceptive practices authority, among other statutes, and other agencies have been addressing this issue using industry-specific statutes, there is no comprehensive federal privacy statute with specific standards  Debate over such a statute could provide a vehicle for consideration of the Fair Information Practice Principles, which are intended to balance privacy concerns with the need for using consumers’ data  Such a law could also empower a specific agency or agencies to provide oversight through means such as APA section 553 rulemaking, civil penalties for first time violations of a statute, and other enforcement tools  Comprehensive legislation addressing Internet privacy that establishes specific standards and includes APA notice-and-comment rulemaking and first-time violation civil penalty authorities could help enhance the federal government’s ability to protect consumer privacy, provide more certainty in the marketplace as companies innovate and develop new products using consumer data, and provide better assurance to consumers that their privacy will be protected  Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment  Issues that should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee Internet privacy, including notice-and-comment rulemaking authority and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s ability to provide services and innovate  We provided a draft of this report to FTC, FCC, and the Department of Commerce for their review and comment  FTC and FCC provided technical comments, which we incorporated as appropriate  The Department of Commerce indicated that it did not have comments  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the FTC chair, the FCC chair, the Secretary of Commerce, and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or members of your staff have any questions about this report, please contact Alicia Puente Cackley at (202) 512-8678 or cackleya@gao gov or Mark Goldstein at (202) 512-2834 or goldsteinm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  For this review, we interviewed staff from agencies with roles in Internet privacy; officials from other consumer- and worker-protection agencies; stakeholders from consumer advocacy groups, industry groups, Internet service providers, and Internet content providers; academics; and former government officials  To obtain a variety of perspectives, we selected Internet service providers that represented different industry sectors and Internet content providers that provide a variety of information and social media services  Academic stakeholders were selected because of their expertise in privacy, consumer protection, and regulatory issues  We also interviewed former Federal Trade Commission (FTC) and Federal Communications Commission (FCC) commissioners who served during the Barack Obama and George W  Bush administrations and are from different political parties  Consumer Financial Protection Bureau (CFPB) Consumer Product Safety Commission (CPSC) Department of Commerce, National Telecommunications and Information Administration (NTIA) Equal Employment Opportunity Commission (EEOC) Federal Communications Commission (FCC) Federal Trade Commission (FTC) Food and Drug Administration (FDA) Occupational Safety and Health Administration (OSHA) The following table identifies 101 Federal Trade Commission (FTC) Internet privacy enforcement actions filed between July 1, 2008 and June 30, 2018 in which the agency alleged a violation of either the Federal Trade Commission Act (FTC Act) or the Children’s Online Privacy Protection Act (COPPA) and implementing COPPA regulations and subsequently entered into a settlement agreement with the target entity  Although some of these cases may involve both Internet data privacy and security issues, this table does not include cases that involved data security issues only  In addition to the contact names above, Andrew Huddleston, Assistant Director; Kay Kuhlman, Assistant Director; Bob Homan, Analyst-in- Charge; Melissa Bodeau; John de Ferrari; Camilo Flores; Erica Miles; Josh Ormond; and Sean Standley made significant contributions to this report 

ground_truth: In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced. GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues. The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity. In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018. Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced: Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited. Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions. Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act. Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy. Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.