You are given two reports by the government agency.  

Report 1:
As reported by the United Nations, the International Criminal Police Organization, and other organizations, wildlife trafficking networks span the globe. These organizations have attempted to measure the value of illegally traded wildlife, but available estimates are subject to uncertainty. In 2016, for example, the United Nations Environment Programme (UNEP) reported that various sources estimated the global scale of illegal wildlife trade to be from $7 billion to $23 billion annually. UNEP also estimated that the scale of wildlife crime has increased in recent years in part based on a rise in environmental crime. U.S. trade in wildlife and related products includes a variety of species, such as live reptiles, birds, and mammals, as well as elephant ivory, according to law enforcement reports and government and nongovernmental officials. FWS and NOAA data on wildlife products seized at U.S. ports provide examples of the diversity of illegally traded plants, fish, and wildlife imported into or exported from the United States. For example, from 2007 to 2016, the top 10 plant, fish, and wildlife shipments seized nationally by FWS were coral, crocodiles, conchs, deer, pythons, sea turtles, mollusks, ginseng, clams, and seahorses. During that time, FWS reported that more than one-third of the wildlife shipments it seized were confiscated while being imported from or exported to Mexico (14 percent), China (13 percent), or Canada (9 percent). FWS and NOAA law enforcement offices are responsible for enforcing certain laws and treaties prohibiting wildlife trafficking. FWS Office of Law Enforcement. This office enforces certain U.S. laws and regulations as well as treaties prohibiting the trafficking of terrestrial wildlife, freshwater species, and birds. Among other things, the office aims to prevent the unlawful import, export, and interstate commerce of foreign fish and wildlife, as well as to protect U.S. plants, fish, and wildlife from unlawful exploitation. As of fiscal year 2016, the office had a budget of $74.7 million and employed 205 special agents to investigate wildlife crime, including international and domestic wildlife trafficking rings. Most of these special agents report to one of eight regional offices, which receive national oversight, support, training, and policy guidance from the FWS Office of Law Enforcement headquarters. The office’s headquarters houses a special investigative unit focused on conducting complex, large- scale criminal investigations of wildlife traffickers. In addition, the FWS Office of Law Enforcement has deployed special agents to serve as international attachés at seven U.S. embassies. These attachés provide countertrafficking expertise to embassy staff, work with host government officials to build law enforcement capacity, and contribute directly to casework or criminal investigations of wildlife traffickers. According to FWS data, the FWS Office of Law Enforcement opened more than 7,000 investigations on wildlife trafficking and other illegal activities in fiscal year 2016, including nearly 5,000 cases involving Endangered Species Act violations and nearly 1,500 cases involving Lacey Act violations. FWS Office of Law Enforcement investigations have disrupted wildlife trafficking operations. For example, Operation Crash—an ongoing rhino horn and elephant ivory-trafficking investigation launched in 2011—has led to over 30 convictions and more than $2 million in fines. NOAA Office of Law Enforcement. This office enforces certain U.S. laws and regulations as well as treaties prohibiting the trafficking of marine wildlife, including fish, as well as anadromous fish. Among other things, the office aims to prevent the illegal, unregulated, and unreported harvesting and trade of fish as well as the trafficking of protected marine wildlife. As of fiscal year 2016, the office had a budget of $68.6 million and employed 77 special agents to investigate wildlife crimes within its jurisdiction. These agents report to one of five regional offices, and those offices receive national oversight, support, and policy guidance from the NOAA Office of Law Enforcement headquarters. According to NOAA data, the NOAA Office of Law Enforcement initiated more than 5,000 investigations in fiscal year 2016. About half of those investigations involved violations of the Magnuson-Stevens Fishery Conservation and Management Act, as amended, and some of the 5,000 investigations involved violations of the Endangered Species Act or the Lacey Act. NOAA Office of Law Enforcement investigations have disrupted wildlife trafficking operations. For example, in fiscal year 2016, a NOAA Office of Law Enforcement investigation led to the conviction of a company and five individuals for illegally trafficking whale bone carvings, walrus ivory carvings, black coral carvings, and other products derived from protected species into the United States. The FWS and NOAA law enforcement offices collaborate with other government agencies and organizations to combat wildlife trafficking. Both agencies work with other federal, state, and tribal law enforcement officers as well as their international counterparts as needed during wildlife trafficking investigations. For example, FWS and NOAA work with U.S. Customs and Border Protection, U.S. Immigration and Customs Enforcement, and the U.S. Department of Agriculture to maintain import and export controls and interdict smuggled wildlife and related products at U.S. ports of entry. In addition, FWS and NOAA collaborate with Department of Justice prosecutors on criminal cases that result from agency investigations. Both agencies also collaborate with nongovernmental organizations to combat wildlife trafficking. For example, FWS and NOAA officials said that nongovernmental organizations have, in some cases, offered financial rewards (in addition to rewards offered by FWS and NOAA) for information on a wildlife crime. In addition, some nongovernmental organizations proactively provide information to FWS and NOAA on wildlife trafficking activities in the United States or foreign countries that violate U.S. laws. For example, in 2017, a nongovernmental organization created a website to collect tips on wildlife crime and to connect the sources of those tips with relevant U.S. authorities for potential financial rewards. FWS may pay financial rewards from moneys in two accounts. Law Enforcement Reward Account. FWS may pay rewards under the Endangered Species Act, the Lacey Act, and the Rhinoceros and Tiger Conservation Act from moneys in the agency’s Law Enforcement Reward Account. The moneys in this account come from fines, penalties, and proceeds from forfeited property for violations of these three laws. According to FWS officials, these moneys are available until expended. These moneys can be used to (1) pay financial rewards to those who provide information that leads to an arrest, criminal conviction, civil penalty assessment, or forfeiture of property for any violation of the Endangered Species Act, the Lacey Act, or the Rhinoceros and Tiger Conservation Act or (2) provide temporary care for plants, fish, or wildlife that are the subject of a civil or criminal proceeding under the Endangered Species Act, Lacey Act, or the Rhinoceros and Tiger Conservation Act. As of the beginning of fiscal year 2017, the balance of the Law Enforcement Reward Account was about $7 million. Law Enforcement Special Funds Account. FWS may also pay rewards from moneys in its law enforcement office’s Special Funds Account. The moneys in this account come from an annual line item appropriation and are available until expended. Since fiscal year 1988, this appropriation has provided FWS up to $400,000 each year to pay for information, rewards, or evidence concerning violations of laws FWS administers, as well as miscellaneous and emergency expenses of enforcement activity that the Secretary of the Interior authorized or approved. NOAA generally pays rewards from moneys available in the Fisheries Enforcement Asset Forfeiture Fund. The moneys in this account come from fines, penalties, and proceeds from forfeited property for violations of marine resource laws that NOAA enforces, including the Magnuson- Stevens Fishery Conservation and Management Act, the Endangered Species Act, and the Lacey Act. According to NOAA officials, moneys are available until expended and can be used to pay certain enforcement- related expenses, including travel expenses, equipment purchases, and the payment of financial rewards. As of the beginning of fiscal year 2017, the Fisheries Enforcement Asset Forfeiture Fund had a balance of about $18 million. Academic literature on the use of financial rewards to combat illegal activities and stakeholders we interviewed identified several advantages and disadvantages of using financial rewards to obtain information on wildlife trafficking. Potential advantages of using financial rewards include the following: Providing incentives. The potential for a financial reward can motivate people with information to come forward when they otherwise might not do so. Increasing public awareness. Financial rewards may bring greater public attention to the problem of wildlife trafficking, including federal efforts to combat wildlife trafficking. Saving resources. Using financial rewards may save agency resources by enabling agents to get information sooner and at a lower cost than they could have through their own efforts. Potential disadvantages of using financial rewards include the following: Eliciting false or unproductive leads. Financial rewards may generate false or unproductive leads. Affecting witness credibility. Financial rewards may lead to a source’s credibility being challenged at trial by defense attorneys since sources receive compensation for the information they provide. Consuming resources. The potential for a financial reward may create a flood of tips that take agency time and resources to follow up on or corroborate. Outside of wildlife trafficking, multiple federal agencies and federal courts are authorized to pay financial rewards for information on illegal activities under certain circumstances. For example, U.S. Customs and Border Protection—which controls, regulates, and facilitates the import and export of goods through U.S. ports of entry—is authorized, under certain circumstances, to pay rewards for original information about violations of any laws that it enforces. The Department of State may also pay rewards under certain circumstances, including for information leading to the disruption of financial mechanisms of a transnational criminal group. Similarly, the U.S. Securities and Exchange Commission (SEC) and Internal Revenue Service (IRS) may pay rewards for information about violations of federal securities laws and the underpayment of taxes, respectively, if certain conditions are met. Federal judges may award money to persons who give information leading to convictions for violating treaties, laws, and regulations that prohibit certain pollution from ships, including oil and garbage discharges. FWS and NOAA officials identified multiple laws, such as the Endangered Species Act and the Lacey Act, that authorize the payment of financial rewards to people who provide information on wildlife trafficking. FWS and NOAA reported paying few financial rewards under these laws from fiscal years 2007 through 2017. However, agency officials could not provide sufficient assurance that the reward information they provided to us represented all of their reward payments for this period. FWS and NOAA officials identified over 10 laws prohibiting wildlife trafficking—including the Endangered Species Act, Lacey Act, and Bald and Golden Eagle Protection Act—that specifically authorize the payment of financial rewards in certain circumstances to people who provide information on violations of the law (see app. II for a complete list of the laws). These laws provide discretion to the agencies to choose whether to pay rewards but have varying requirements for who is eligible to receive a reward and the payment amounts. For example, the Bald and Golden Eagle Protection Act caps rewards at $2,500 for information that leads to a conviction. In contrast, the Endangered Species Act does not cap reward amounts and authorizes rewards for information that leads to a conviction as well as to an arrest, civil penalty, or forfeiture of property. Table 1 identifies the laws that FWS and NOAA officials indicated they have used to pay financial rewards for information on wildlife trafficking from fiscal years 2007 through 2017, along with information on these laws’ requirements for payment of rewards. FWS and NOAA reported paying few financial rewards for information on wildlife trafficking from fiscal years 2007 through 2017, but agency officials could not provide sufficient assurance that this information was complete. Officials from both agencies said that their agencies have not prioritized the use of rewards, and they believed that the reward information they identified—such as the number, dollar amount, and year that rewards were paid—appropriately captured the few reward payments they made during this time frame. Based on the agencies’ reviews of their records, FWS reported paying 25 rewards for a total of $184,500 from fiscal years 2007 through 2017, and NOAA reported paying 2 rewards for a total of $21,000 during that same period (see table 2). See appendix III for additional details on the cases where financial rewards were paid. FWS reported paying rewards in trafficking cases involving a variety of wildlife species, such as eagles, bears, reptiles, and mollusks, across the 11-year period. FWS officials said they generally paid rewards to thank sources who proactively provided information. For example, based on our review of a reward case, FWS paid a reward in 2010 because the source provided information that was crucial in uncovering an attempt to illegally traffic leopards into the United States from South Africa. FWS would not have known about this illegal activity if the source had not come forward with the information. In several cases we reviewed, FWS officials said that the sources did not know about the possibility of receiving a reward when they contacted the agency with information. The two rewards NOAA reported paying from fiscal years 2007 through 2017 involved the illegal trafficking of sea scallops and a green sea turtle. NOAA officials said that in both cases they paid a reward to thank the source who proactively provided information to law enforcement agents. For example, the agent who investigated the sea scallop case reported requesting the reward because the information the source proactively provided was timely, credible, and led to the criminal conviction of several individuals. FWS and NOAA officials could not provide sufficient assurance that the reward information they reported to us represented all of the rewards their agencies had paid from fiscal years 2007 through 2017, but they said the information was complete to the best of their knowledge. Specifically, FWS and NOAA officials said they track all their expenditures, including reward payments, in their financial databases. However, they are not able to readily identify reward payments because their financial systems do not include a unique identifier for such payments and their reward information is located in multiple databases and formats. As a result, FWS and NOAA officials said they identified the rewards they reported to us by manually reviewing their financial and law enforcement records. In particular, FWS officials said they reviewed their paper records to identify instances when the agency paid rewards and then retrieved additional information from their financial and law enforcement databases, such as final payment amounts. NOAA officials said they identified instances when the agency paid rewards by using a combination of paper and electronic records located at NOAA’s headquarters office. NOAA officials also contacted their regions to obtain additional information located at the regional offices to confirm information about the rewards NOAA had paid. Seventeen stakeholders we interviewed who had experience investigating wildlife trafficking or expertise in using financial rewards as a law enforcement tool said that it would be useful for FWS and NOAA to maintain comprehensive information on the rewards they paid. For example, two stakeholders said that maintaining comprehensive information and making that information available to law enforcement agents could motivate agents to make greater use of rewards as a law enforcement tool. Two other stakeholders said that maintaining information on and monitoring reward use would allow the agencies to make ongoing adjustments, such as adjusting payment amounts, to make the most effective use of rewards in combating wildlife trafficking. Federal internal control standards say that management should clearly document internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. Control activities can be implemented in either an automated or a manual manner, but automated control activities tend to be more reliable because they are less susceptible to human error and are typically more efficient. FWS and NOAA officials agreed that maintaining reward information so that complete information is easily retrievable may be beneficial. FWS officials said having clearly documented and readily available reward information could improve how they manage rewards and enable them to monitor and examine their use of rewards more holistically. The officials said they may analyze options for creating a single repository for reward information but did not commit to doing so. They said that creating a single repository for reward information may involve some drawbacks, such as duplicating some data entry in separate databases. Similarly, NOAA officials said having clearly documented and readily available reward information would provide agency management with easier and more consistent access to that information. As a result, they said that they are exploring modifications to their financial and law enforcement databases to better identify and track rewards. For example, NOAA officials said they may be able to create a unique identifier to flag payments that are for rewards in their financial system to enable them to identify payment amounts more easily. NOAA officials did not provide a time frame for completing modifications to their financial system. By tracking reward information so that it is clearly documented and readily available for examination, FWS and NOAA can better ensure that they have complete information on the rewards they have paid to help manage their use of rewards as a law enforcement tool. FWS and NOAA have policies to guide their law enforcement agents on the process for preparing and submitting a request to pay a financial reward. Specifically, both agencies’ policies call for agents to include a description of the case, the nature of the information that the source provided, a justification for providing a reward, and an explanation of how a proposed reward amount was developed. These policies also outline the general review and approval process, how payments are to be made upon approval of a request, and eligibility criteria to receive a reward. For example, FWS and NOAA policies prohibit paying rewards to foreign government officials as well as paying rewards to any person whose receipt of a reward would create a conflict of interest or the appearance of impropriety. NOAA’s policy explicitly states that the NOAA Office of Law Enforcement is to use statutorily authorized rewards as a tool to obtain information from the public on resource violations and that rewards can help promote compliance with marine resource laws. NOAA’s policy suggests that agents consider advertising reward offers to assist investigations, encourages press releases, and describes the process agents should follow to do so. Moreover, NOAA’s policy specifies factors that agents might include in their reward requests to support the proposed reward, such as (1) the benefit to the marine resources that was furthered by the information provided; (2) the risk, if any, the individual took in collecting and providing the information; (3) the probability that the investigation would have been successfully concluded without the information provided; and (4) the relationship between any fines or other collections and the information provided. FWS’s policy specifies that rewards may be provided in situations in which an individual furnishes essential information leading to an arrest, conviction, civil penalty, or forfeiture of property. However, it does not discuss the usefulness of financial rewards as a law enforcement tool or the types of circumstances when rewards should be used or advertised to the public. Further, FWS’s policy does not communicate necessary quality information internally that agents may need when deciding to request the payment of rewards. In particular, it does not specify factors for agents to consider when developing proposed reward amounts. Instead, the policy leaves it to the discretion of field and regional agents to develop proposed reward amounts within any limitations specified in law. Some FWS agents we interviewed said that they developed proposed reward amounts on a case-by-case basis and did not know whether their proposed amounts were enough, too little, or too much. In addition, some agents said that because FWS’s policy does not specify factors for agents to consider, the reward approval process is subjective and unclear and this has made it challenging for the agents to develop proposed reward amounts. For example, one agent we interviewed said he submitted a request to his supervisor to pay a $10,000 reward to a source who provided information on a major wildlife trafficker. But, for reasons unknown to the agent, his supervisor reduced the amount to $1,000. FWS headquarters officials said field agents submit reward requests to headquarters for approval, and these officials were not aware of instances of proposed reward amounts being changed or denied during the review process. Seven of the 20 stakeholders we interviewed suggested that FWS augment its reward policy to specify factors for agents to consider when developing proposed reward amounts. For example, helpful factors to consider when developing a proposed reward amount may include (1) the number of hours the source dedicated to the case, (2) the risk the source took in providing the information, (3) the significance of the information provided by the source, and (4) the amount of fines or other penalties collected as a result of the information. Two stakeholders expressed concern that some of FWS’s reward payments were insufficient, especially when comparing the amount of time and effort or the risk a source faced in providing the information. A couple of stakeholders also said that without a policy that specifies factors for agents to consider, reward amounts may be subjective and could vary depending on which agent develops the reward proposal. Another stakeholder said that it was important to specify factors for agents to consider when developing proposed reward amounts so that the agency has a reasonable and defensible basis for the reward amounts it pays across cases. According to federal standards for internal control, management should internally communicate the necessary quality information to achieve an agency’s objectives. For example, management communicates quality information down and across reporting lines to enable personnel to make key decisions. FWS officials said they believe that their reward policy is sound, indicating they believe that law enforcement agents have the information they need to develop proposals for reward amounts in cases where rewards are warranted. However, they also agreed that it may be helpful to review their policy but did not commit to doing so. By augmenting its policy to specify factors for agents to consider when developing proposed reward amounts, FWS can better ensure that its agents have the necessary quality information to prepare defensible reward proposals. Based on our review of the agencies’ websites and other communications, we found that FWS and NOAA communicate little information to the public on financial rewards for reporting information on wildlife trafficking, such as the potential availability of rewards and eligibility criteria. Specifically, some FWS and NOAA law enforcement websites provided information to the public on ways to report violations of the laws that the agencies are responsible for enforcing, such as via tip lines. Some of the websites also provided examples of the types of information the public can report, such as photos or other documentation of illegal activities. However, most of the agencies’ websites did not indicate that providing information on illegal activities could result in a reward. In contrast, the FWS Alaska regional office’s website provided information on the potential availability of rewards and ways the public may submit information for a potential reward. For example, this website provided phone numbers and an e-mail address for the public to use when submitting information. Figure 1 shows the information available on FWS’s and NOAA’s national and regional websites relevant to reporting violations of the laws the agencies enforce in general and on receiving rewards in particular. In addition, FWS and NOAA headquarters officials said their field agents have used other means to communicate the potential availability of rewards in specific cases when the agents had no other information that could help solve those cases. For example, a FWS field official said that the agency advertised a reward offer for information on a case of bald eagle killings by distributing reward posters and posting news releases in the vicinity where the killings occurred. Similarly, NOAA officials said they have advertised reward offers through various means, including circulating reward posters in specific geographic areas after an illegal activity has occurred. Figure 2 shows a reward poster that NOAA distributed in Guam in 2017 advertising a $1,000 reward for information leading to the arrest and conviction of sea turtle poachers. Instead of having a plan for communicating general information to the public on rewards, FWS and NOAA grant discretion to their regional offices and law enforcement agents to determine the type and level of communication to provide, according to FWS and NOAA policies. FWS officials explained that because they typically use financial rewards to thank individuals who come forward on their own accord—rather than using rewards to incentivize individuals with information to come forward—they have not seen the need to communicate more information to the public on the potential availability of rewards. NOAA officials said they have targeted their communications on rewards by publicizing reward offers for specific cases where they do not have leads. They added that they want to receive quality information and already receive a substantial amount of information from sources who reach out to them proactively, so NOAA has not seen the need to communicate more information to the public on the potential availability of rewards. Sixteen of the 20 stakeholders we interviewed said that it would be useful for FWS and NOAA to advertise the potential availability of financial rewards. Several stakeholders said that if the public does not know about the possibility for rewards, then some people with information may not be incentivized to come forward. Two stakeholders added that agencies should carefully consider how and which reward information to communicate to the public so that people who are most likely to have information on illegal wildlife trafficking learn about the potential for rewards. For example, one stakeholder suggested advertising rewards at ports where international shipments are offloaded or placing advertisements at wildlife trafficking nodes, such as entrances to African wildlife refuges. This stakeholder suggested advertising rewards along with wildlife trafficking awareness-raising posters that nongovernment organizations place in some airports. In addition, 14 stakeholders suggested that it would be useful for FWS and NOAA to provide information to the public on the process for submitting information to potentially receive rewards. Several other stakeholders said that it is important for the public to understand whether they may be eligible for a reward, how to submit information, and whether or to what extent their confidentiality will be protected. Another stakeholder provided examples of how other agencies provide information about their reward programs on their websites. SEC and IRS, for instance, use their websites to communicate information to the public on the process for reporting illegal activity for financial rewards. This information includes the types of information to report, confidentiality rules, eligibility criteria, and the process for submitting information to obtain a reward. In addition, the Department of State posts instructions on its websites on how to submit information on an illegal activity and potentially receive a reward. Federal internal control standards say that management should externally communicate the necessary quality information to achieve an agency’s objectives. For example, using appropriate methods to communicate, management communicates quality information so that external parties, such as the public, can help the agency achieve its objectives. This could include communicating information to the public on the types of information and eligibility requirements for potentially receiving rewards for reporting information on wildlife trafficking. FWS officials said that making more reward information available could lead to a significant increase in the amount of information the agency receives, which, in turn, could strain FWS’s resources in following up on that information. However, FWS officials also agreed that it was reasonable to consider making more reward information available to relevant members of the public, particularly in targeted circumstances, but did not commit to doing so. Similarly, NOAA officials said they had some concerns about the additional resources it might take to investigate potentially unreliable or false tips that may result if they make reward information broadly available to the public, but they agreed that it would be reasonable for the agency to consider doing so. NOAA officials also said they may consider making more reward information publicly available at the conclusion of our audit but provided no plans for doing so. By determining the types of additional information to communicate to the public on rewards—such as providing information on the agency’s website on the potential availability of rewards—and then developing and implementing plans to do so, FWS and NOAA can improve their chances of obtaining information on wildlife trafficking activities that they otherwise might not receive. FWS and NOAA have not reviewed the effectiveness of their use of financial rewards or considered whether any changes might improve the usefulness of rewards as a tool for combating wildlife trafficking. FWS officials said their agency has not reviewed or considered changes to its use of rewards because the agency has not prioritized the use of rewards. NOAA officials said their agency has not focused on using rewards or identified the need to review its use of this tool, particularly in light of other, higher mission priorities. Nine of the 20 stakeholders we interviewed said that FWS and NOAA should review the effectiveness of their use of rewards and consider potential improvements. Several stakeholders said that it would be useful for FWS and NOAA to compare their respective approaches to those of federal agencies that use rewards in contexts outside of wildlife trafficking to identify best practices or lessons learned that might be applicable in the context of combating wildlife trafficking. For example, one stakeholder said that SEC has an effective whistleblower program and may have lessons learned that are relevant for FWS and NOAA to consider. Another stakeholder we interviewed separately indicated that in 2010, before SEC had a whistleblower program that publicized rewards and provided detailed instructions on how members of the public could report information on illegal activities, SEC received few tips. Once SEC implemented a whistleblower program that publicized rewards and provided detailed instructions on its public website, the agency’s use of the program grew substantially, according to the stakeholder. Other stakeholders said it would be useful for the agencies to consider potential improvements to their use of rewards, such as making a standing reward offer for information on wildlife trafficking targeted at high-priority endangered species or particular criminal networks. Two of these stakeholders said such an offer might improve FWS’s and NOAA’s use of rewards by generating more tips than reward offers focused on individual cases. At the same time, they said such an offer would likely filter out some of the false or unproductive tips that the agencies might receive if they made an untargeted standing reward offer. Federal internal control standards state that management should design control activities to achieve objectives and respond to risks by, for example, conducting reviews at the functional or activity level by comparing actual performance to planned or expected results and analyzing significant differences. Further, under the standards, management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness in achieving an agency’s objectives or addressing related risks. FWS and NOAA officials agreed that reviewing the effectiveness of their use of rewards would be worthwhile. Specifically, FWS officials said that it would be useful to compare their approach to those of other federal agencies that use rewards in investigating crimes that involve interstate and foreign smuggling of goods. Similarly, NOAA officials said that reviewing the agency’s use of financial rewards would be worthwhile but cautioned that such a review would need to be balanced against the agency’s constrained resources and many mission requirements. FWS and NOAA officials said they may consider conducting such a review at the conclusion of our audit but provided no plans for doing so. By reviewing the effectiveness of their use of rewards, FWS and NOAA can identify opportunities to improve the usefulness of rewards as a tool for combating wildlife trafficking. Wildlife trafficking is a large and growing transnational criminal activity, with global environmental, security, and economic consequences. The federal government has emphasized strengthening law enforcement efforts to combat wildlife trafficking, and using financial rewards to obtain information on illegal activities is one tool that some federal agencies have used. However, to date, FWS and NOAA have not prioritized the use of rewards and were unable to provide sufficient assurance that the 27 rewards they paid during fiscal years 2007 through 2017 represented all of the rewards they provided during that period. By tracking reward information so that it is clearly documented and readily available for examination, FWS and NOAA can better ensure that they have complete information on the rewards they have paid to help manage their use of rewards as a law enforcement tool. Additionally, FWS and NOAA have policies outlining the processes their law enforcement agents are to use in making reward payments, and NOAA’s policy specifies factors for its agents to consider in developing proposed reward amounts, such as the risk the individual took in collecting the information. FWS’s policy does not specify such factors that could inform agents in achieving the agency’s objectives, which is not consistent with federal internal control standards. By augmenting its policy to specify factors for its agents to consider when developing proposed reward amounts, FWS can better ensure that its agents have the necessary quality information to prepare defensible reward proposals. Both agencies have also advertised the potential for rewards in specific cases when agents had no other information, but FWS and NOAA have otherwise communicated little information to the public on the potential availability of rewards. If the public does not know about the possibility of rewards, then some people with information may not be incentivized to come forward. By determining the types of additional information to communicate to the public on rewards—such as providing information on the agency’s website about the potential availability of rewards—and then developing and implementing plans to do so, FWS and NOAA can improve their chances of obtaining information on wildlife trafficking activities that they otherwise might not receive. Finally, FWS and NOAA have not reviewed the effectiveness of their use of financial rewards or considered whether any changes might improve the usefulness of rewards as a law enforcement tool. By undertaking such reviews, the agencies can identify opportunities to improve the usefulness of rewards as a tool for combating wildlife trafficking. We are making a total of seven recommendations, including four to FWS and three to NOAA. Specifically: The Assistant Director of the FWS Office of Law Enforcement should track financial reward information so that it is clearly documented and readily available for examination. (Recommendation 1) The Director of the NOAA Office of Law Enforcement should track financial reward information so that it is clearly documented and readily available for examination. (Recommendation 2) The Assistant Director of the FWS Office of Law Enforcement should augment FWS’s financial reward policy to specify factors law enforcement agents are to consider when developing proposed reward amounts. (Recommendation 3) The Assistant Director of the FWS Office of Law Enforcement should determine the types of additional information to communicate to the public on financial rewards and then develop and implement a plan for communicating that information. (Recommendation 4) The Director of the NOAA Office of Law Enforcement should determine the types of additional information to communicate to the public on financial rewards and then develop and implement a plan for communicating that information. (Recommendation 5) The Assistant Director of the FWS Office of Law Enforcement should review the effectiveness of the agency’s use of financial rewards and implement any changes that the agency determines would improve the usefulness of financial rewards as a law enforcement tool. (Recommendation 6) The Director of the NOAA Office of Law Enforcement should review the effectiveness of the agency’s use of financial rewards and implement any changes that the agency determines would improve the usefulness of financial rewards as a law enforcement tool. (Recommendation 7) We provided a draft of this report for review and comment to the Departments of Commerce and the Interior. The departments transmitted written comments, which are reproduced in appendixes IV and V of this report. The Department of Commerce concurred with the three recommendations directed to NOAA and stated that NOAA is developing procedures to ensure that its rewards are closely tracked, clearly documented, and better communicated. In written comments from NOAA, NOAA stated the report fairly and thoroughly reviews NOAA’s use of financial rewards. NOAA outlined the steps it plans to take in response to our recommendations, including developing a procedure to track financial reward information, reviewing information currently disseminated to the public and evaluating whether additional information may be useful, and reviewing the agency’s reward policy to determine whether changes are needed to enhance reward effectiveness. In its written comments, the Department of the Interior concurred with the four recommendations directed to FWS. Interior stated that it appreciated our review of the challenges faced by FWS’s Office of Law Enforcement in combating wildlife trafficking and identifying areas where FWS and NOAA can improve the use of financial rewards as a tool for combating wildlife trafficking. Interior also provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretaries of Commerce and the Interior, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3841 or fennella@gao.gov. Contact points for our Offices of Congressional Relations and of Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI. The objectives of our review were to (1) identify laws that authorize the U.S. Fish and Wildlife Service (FWS) and the National Oceanic and Atmospheric Administration (NOAA) to pay financial rewards for information on wildlife trafficking and the extent to which these agencies paid such rewards from fiscal years 2007 through 2017, (2) evaluate FWS’s and NOAA’s policies on financial rewards, (3) evaluate the information available to the public on financial rewards, and (4) determine the extent to which FWS and NOAA reviewed the effectiveness of their use of financial rewards in combating wildlife trafficking. To address these objectives, we reviewed academic literature on the use of financial rewards to combat illegal activities and United Nations Environment Programme reports on the scope and scale of wildlife trafficking. We also interviewed officials from federal agencies that play a role in combating wildlife trafficking or manage programs that pay financial rewards for information on illegal activities. Specifically, we interviewed officials from the Departments of Agriculture, Commerce, Homeland Security, the Interior, Justice, and State, as well as officials from the Internal Revenue Service, the U.S. Securities and Exchange Commission, and the U.S. Agency for International Development. In addition, we reviewed documentation that the Department of the Treasury provided on its role in paying financial rewards. We did not compare FWS’s and NOAA’s use of financial rewards in combating wildlife trafficking to federal agencies’ use of financial rewards in other contexts because the different contexts are not directly comparable. However, we reviewed information on other federal agencies’ use of financial rewards as examples of how financial rewards are used in contexts outside of wildlife trafficking. In addition, we interviewed representatives of six nongovernmental organizations that we selected based on those organizations’ knowledge or experience in combating wildlife trafficking. Specifically, we interviewed representatives from the Elephant Action League, the Environmental Investigation Agency, the National Association of Conservation Law Enforcement Chiefs, the National Whistleblower Center, TRAFFIC, and the World Wildlife Fund. To identify laws that authorize FWS and NOAA to pay financial rewards for information on wildlife trafficking, we asked FWS and NOAA attorneys to compile a list of laws that each of their agencies implements or enforces that prohibit wildlife trafficking and authorize the agency to pay rewards for providing information about trafficking. We then compared that list to the results of our search of the United States Code for such laws. We also reviewed FWS and NOAA documentation for accounts where the fines, penalties, and proceeds from forfeited property that are used to pay rewards are deposited as well as the accounts where appropriations available to pay rewards were deposited. To identify the extent to which FWS and NOAA have paid financial rewards for information on wildlife trafficking, we analyzed FWS and NOAA data on financial rewards the agencies reported paying from fiscal years 2007 through 2017. The data included information on, among other things, the fiscal years in which rewards were paid, laws under which rewards were paid, types of wildlife involved in those cases, the amounts of civil penalties or criminal fines imposed in those cases, the numbers of arrests and convictions as a result of those cases, and whether reward recipients were individuals or groups and U.S. or foreign citizens. To assess the reliability of the data FWS and NOAA provided on financial rewards, we interviewed agency officials knowledgeable about the data and compared the data to case records the agencies provided. Specifically, FWS and NOAA officials said they track all expenditures, including reward payments, in their financial databases, but they are not able to readily identify reward payments because their financial systems do not include a unique identifier for such payments and their reward information is located in multiple databases and formats. As a result, FWS and NOAA officials said they identified the rewards that they reported to us by manually reviewing their financial and law enforcement records, and officials said the information was complete to the best of their knowledge. Based on these steps, we found the data that the agencies provided to us to be sufficiently reliable for reporting information on the rewards the agencies reported paying. However, as we discuss in the report, FWS and NOAA officials could not provide sufficient assurance that the data included all the financial rewards that they had paid from fiscal years 2007 through 2017. To obtain additional detail about cases where financial rewards were paid, we reviewed a nongeneralizable sample of 10 wildlife trafficking cases. We selected these cases based on the agency that investigated the case (to include both FWS and NOAA cases), the amount of the reward paid in the case (to reflect both low and high amounts), the year in which the reward was paid (to include rewards paid more recently), and the type of wildlife trafficked in the case (to include both fish and wildlife cases—there were no plant trafficking cases to select). While the findings from our review cannot be generalized to cases we did not select and review, they illustrate how FWS and NOAA have used financial rewards in wildlife trafficking cases. To evaluate FWS and NOAA policies on financial rewards, we reviewed relevant FWS and NOAA policies and compared them to each other; interviewed FWS and NOAA officials about those policies; and compared the information in the policies with federal internal control standards on information and communication. To evaluate information available to the public on rewards, we reviewed relevant FWS and NOAA publications and examples of communications to the public on the availability of rewards in specific cases and interviewed FWS and NOAA officials. We also reviewed information available on FWS’s and NOAA’s national and regional websites as of December 2017 and January 2018, respectively, relevant to reporting violations of the laws that the agencies enforce in general and on receiving rewards in particular. We compared the agencies’ public communications on rewards with federal internal control standards on information and communication. To evaluate the extent to which FWS and NOAA reviewed the effectiveness of their use of financial rewards in combating wildlife trafficking, we interviewed FWS and NOAA officials and requested any reviews the agencies had conducted regarding their use of financial rewards to compare with federal internal control standards on control activities. FWS and NOAA did not have any such reviews to provide. In addition, for all four objectives, we interviewed a nongeneralizable sample of 20 stakeholders who had experience investigating wildlife trafficking or expertise in the use of financial rewards as a law enforcement tool. To select stakeholders to interview, we first identified a list of stakeholders by reviewing (1) FWS and NOAA data on law enforcement agents with at least 5 years of experience who had investigated wildlife trafficking cases and used financial rewards, (2) Department of Justice data on federal prosecutors who had prosecuted wildlife trafficking cases since fiscal year 2014, (3) literature search results identifying academics with expertise in the use of financial rewards as a law enforcement tool and federal programs that use financial rewards to combat illegal activities in contexts outside of wildlife trafficking, (4) the biographies of members of the federal Advisory Council on Wildlife Trafficking, and (5) recommendations from stakeholders we interviewed. From this list, we then used a multistep process to select the 20 stakeholders to interview. To ensure coverage and a range of perspectives, we selected stakeholders from the following groups: FWS and NOAA law enforcement agents, including field and federal prosecutors responsible for prosecuting wildlife trafficking cases; federal officials responsible for programs that use financial rewards to combat illegal activities in contexts outside of wildlife trafficking; academics with expertise in the use of financial rewards as a law members of the federal Advisory Council on Wildlife Trafficking; and representatives of nongovernmental organizations that investigate wildlife trafficking. We conducted semistructured interviews with the 20 selected stakeholders using a standard set of questions. We asked questions about stakeholder views on the usefulness of financial rewards in combating wildlife trafficking; the strength and weaknesses of the statutory provisions that authorize federal agencies to pay financial rewards for information on wildlife trafficking; FWS’s and NOAA’s use of financial rewards to combat wildlife trafficking; and how, if at all, the two agencies could improve their use of financial rewards to combat wildlife trafficking. We analyzed the stakeholders’ responses to our questions, grouping the responses into overall themes. We summarized the results of our analysis and then shared the summary with relevant FWS and NOAA officials to obtain their views. Views from these stakeholders cannot be generalized to those whom we did not select and interview. We conducted this performance audit from February 2017 to April 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Department of the Interior’s U.S. Fish and Wildlife Service (FWS) and the Department of Commerce’s National Oceanic and Atmospheric Administration (NOAA) implement or enforce multiple laws that specifically authorize the payment, under specified circumstances, of financial rewards to persons for information about violations of laws that prohibit wildlife trafficking. The laws that FWS officials identified are listed and summarized in table 3, and the laws that NOAA officials identified are listed and summarized in table 4. In addition, as noted above, the reward provisions in the Magnuson- Stevens Fishery Conservation and Management Act as amended and the Fish and Wildlife Improvement Act as amended authorize the payment of rewards for information about violations of multiple laws. Specifically, the Magnuson-Stevens Fishery Conservation and Management Act as amended authorizes the payment of rewards for information about violations of the act as well as any other marine resource law that the Secretary of Commerce enforces. Further, the Fish and Wildlife Improvement Act as amended authorizes the payment of rewards for information about violations of any law administered by NOAA’s National Marine Fisheries Service relating to plants, fish, or wildlife. NOAA officials identified 14 such laws that prohibit wildlife trafficking (see table 5). If a violation of the laws listed in table 5 occurs, NOAA officials said they could use the Magnuson-Stevens Fishery Conservation and Management Act or Fish and Wildlife Improvement Act reward provision to pay a reward for information on the violation. None of the laws listed in table 5 specifically authorize the payment of financial rewards. Table 6 provides information on U.S. Fish and Wildlife Service and National Oceanic and Atmospheric Administration cases where these agencies reported paying rewards for information on wildlife trafficking from fiscal years 2007 through 2017. In addition to the contact named above, Alyssa M. Hundrup (Assistant Director), David Marroni (Analyst-in-Charge), Cindy Gilbert, Keesha Luebke, Jeanette Soares, Sheryl Stein, Sara Sullivan, and Judith Williams made key contributions to this report.

 

 Report 2:
Cross-border data flows underlie today's globally connected world and are essential to conducting international trade and commerce. Data flows enable companies to transmit information for online communication, track global supply chains, share research, and provide cross-border services. One study estimates that digital commerce relying on data flows drives 22% of global economic output, and that global GDP will increase by another $2 trillion by 2020 due to advances in emerging technologies. However, while cross-border data flows increase productivity and enable innovation, they also raise concerns around the security and privacy of the information being transmitted. Cross-border data flows are central to trade and trade negotiations as organizations rely on the transmission of information to use cloud services, and to send nonpersonal corporate data as well as personal data to partners, subsidiaries, and customers. U.S. policymakers are considering various policy options to address online privacy, some of which could affect cross-border data flows. For example, new consumer rights to control their personal data may impact how companies can use such data. To enable international data flows and trade, the United States has aimed to eliminate trade barriers and establish enforceable international rules and best practices that allow policymakers to achieve public policy objectives, including promoting online security and privacy. Building consensus for international rules and norms on data flows and privacy has become increasingly important as recent incidents have heightened the public's awareness of the risk of personal data stored online. For example, the 2018 Cambridge Analytica scandal drew attention because the firm reportedly acquired and used data on more than 87 million Facebook accounts in an effort to influence voters in the 2016 U.S. presidential election and the UK referendum on continued European Union (EU) membership ("Brexit"). In addition, security concerns have been raised about data breaches, such as those that exposed the personal data of half a million Google users or 500 million Marriot hotel customers. Organizations value consumers' personal online data for a variety of reasons. For example, companies may seek to facilitate business transactions, analyze marketing information, detect disease patterns from medical histories, discover fraudulent payments, improve proprietary algorithms, or develop competitive innovations. Some analysts compare data to oil or gold, but unlike those valuable substances, data can be reused, analyzed, shared, and combined with other information; it is not a scarce resource. However, personal data is considered personal private property. Individuals often want to control who accesses their data and how it is used. Experts suggest that data may therefore be considered both a benefit and a liability that organizations hold. Data has value, but an organization takes on risk by collecting personal data; they become responsible for protecting users' privacy and not misusing the information. Data privacy concerns may become more urgent as the amount of online information organizations access and collect, and the level of global data flows, continue to expand. Countries vary in their policies and laws on these issues. The United States has traditionally supported open data flows and has regulated privacy at a sectoral level to cover data, such as health records, rather than create a comprehensive policy. U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce, including eliminating trade barriers and opening markets. Other countries are developing data privacy policies that affect international trade as some governments or groups seek to limit data flows outside of an organization or across national borders for a number of reasons. Blocking international data flows may impede the ability of a firm to do business or of an individual to conduct a transaction, creating a form of trade protectionism. Research demonstrates not only the economic gains from digital trade and international data flows, but also the real economic costs of restrictions on such flows. For many policymakers, the crux of the issue is: How can governments protect individual privacy in the least trade-restrictive way possible? The question is similar to concerns raised about ensuring cybersecurity while allowing the free flow of data. In recent years, Congress has examined multiple issues related to cross-border data flows and online privacy. In the 115 th Congress, congressional committees held hearings on these topics, introduced multiple bills, and conducted oversight over federal laws on related issues such as data breach notification. Members are introducing new bills and holding hearings in the 116 th Congress. Congress may consider the proposed U.S.-Mexico-Canada Agreement (USMCA) and examine the digital trade chapter as an example of how to address the issues through trade agreements. In most circumstances, a consumer expects both privacy and security when conducting an online transaction. However, users' expectations and values may vary and there is no globally accepted standard or definition of data privacy in the online world. In addressing online privacy, Congress may need to define personal data and differentiate between sensitive and nonsensitive personal data. In general, data privacy can be defined by an individual's ability to prevent access to personally identifiable information (PII). According to the U.S. Office of Management and Budget (OMB) guidance to federal agencies, PII refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Since electronic data can be readily shared and combined, some data not traditionally considered PII may have become more sensitive. For example, the OMB definition does not specifically mention data on location tracking, purchase history, o r preferences, but these digital data points can be tracked by a device such as a mobile phone or laptop that an individual carries or logs into. The EU definition of PII attempts to capture the breadth of data available in the online world: "personal data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Policymakers may consider differentiating between sensitive and nonsensitive personal data. For example, sensitive personal data could include ethnic origin, political or religious affiliation, biometric data, health data, sexual orientation, precise geolocation data, etc. "Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. Cross-border data flows are part of, and integral to, digital trade and facilitate the movement of goods, services, people, and finance. A 2017 analysis estimated that global flows of goods, services, finance, and people increased world gross domestic product (GDP) by at least 10% in the past decade, adding $8 trillion between 2005 and 2015. Effective and sustainable digital trade relies on data flows that permit commerce and communication but that also ensure privacy and security, protect intellectual property, and build trust and confidence. Impeding cross-border data flows, including through some privacy regulations, may decrease efficiency and reduce other benefits of digital trade, resulting in the fracturing, or so-called balkanization, of the internet. In addressing online privacy, some policymakers focus on limiting access to online information by restricting the flow of data beyond a country's borders. Such limits may also act as protectionist measures. Online privacy policies may create barriers to digital trade, or damage trust in the underlying digital economy. For example, measures to limit cross-border data flows could block companies from using cloud computing to aggregate and analyze global data, or from gaining economies of scale, constrain e-commerce by limiting international online payments, hinder global supply chains seeking to use blockchain to track products or manage supply chains, customs documentation, or electronic payments, impede the trading of crypto-currency, or limit the use of advanced technology like artificial intelligence. According to the World Trade Organization (WTO), one of the most significant overall impacts of the growth of digital technologies is in transforming international trade. Technology can lower the costs of trade, change the types of goods and services that are traded, and may even change the factors defining a country's comparative advantage. The extent of the impact of digital technologies on trade, however, depends in large part on open cross-border data flows. One study of U.S. companies found that data localization rules (i.e., requiring organizations to store data on local servers) were the most-cited digital trade barrier. Some governments advocate privacy or security policies that require data localization and limit cross-border data flows. However, many industry stakeholders argue that blocking cross-border data flows and storing data domestically does not make such data more secure or private. Many experts argue that policymakers should limit cross-border data flows in the least trade-restrictive manner possible and also ensure security and privacy. These objectives are not easily reconciled. Moreover, although an overlap exists between data protection and privacy, the two are not equivalent. Cybersecurity measures are essential to protect data (e.g., against intrusions or theft by hackers). However, they may not be sufficient to protect privacy. For example, if an organization shares user data with a third party, it may be doing so securely, but not in a way that protects users' privacy or aligns with consumer expectations. Similarly, breach notification requirements are not the same as proactive privacy protection measures. At the same time, policies that protect a consumer's privacy can align with security policies. Laws can limit law enforcement's access to information except in certain circumstances. Keeping user information anonymous may enable firms to analyze data while protecting individuals' identities. Some see an inherent conflict between online security, privacy, and trade; others believe that policies protecting all three can be coherent and consistent. The U.S. government has traditionally sought to balance these objectives. Some stakeholders note, however, that current U.S. policy has been inadequate in protecting online privacy and that change is needed. In some cases in the past, Congress has acted to address privacy concerns in particular sectors; for example, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 led to health privacy standards regulations. The Trump Administration has begun an effort to devise an overarching data privacy policy (see " Defining the U.S. Approach ") and many Members of Congress are also considering possible approaches. There are no comprehensive multilateral rules specifically about privacy or cross-border data flows. However, the United States and other countries have begun to address these issues in negotiating new and updated trade agreements, and through international economic forums and organizations such as the Asia-Pacific Economic Cooperation (APEC) forum and the Organisation for Economic Co-operation and Development (OECD). The World Trade Organization (WTO) General Agreement on Trade in Services (GATS) entered into force in January 1995, predating the current reach of the internet and the explosive growth of global data flows. Many digital products and services that did not exist when the agreements were negotiated are not covered. On the other hand, privacy is explicitly addressed within GATS as an exception to allow countries to take measures that do not conform with the agreement in order to protect "the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts," as long as those measures are not arbitrary or a disguised trade restriction. Efforts to update the multilateral agreement and discussions for new digital trade rules under the WTO Electronic Commerce Work Program stalled in 2017. Given the lack of progress on multilateral rules, some have suggested that the WTO should identify best practices or guidelines for digital trade rules that could lay the foundation for a future multilateral WTO agreement. In December 2017, a group of more than 70 WTO members, including the United States, agreed to "initiate exploratory work together toward future WTO negotiations on trade-related aspects of electronic commerce." Overall U.S. objectives include allowing the free flow of information for international trade and cross-border data flows, "subject to reasonable safeguards like the protection of consumer data when it is exported," but do not specifically address privacy. The group formally launched the e-commerce initiative in January 2019. The official joint statement lists the United States and EU as participants, and also several developing countries such as China and Brazil. India stated it will not join, preferring to maintain its flexibility to favor domestic firms, limit foreign market access, and raise revenue in the future. The statement did not define the scope of any potential agreement. After the meeting, the EU noted data localization measures among the potential new rules to be discussed when negotiations officially launch in March 2019. The U.S. Trade Representative's (USTR's) statement emphasized the need for a high-standard agreement that includes enforceable obligations. Although some experts note that harmonization or mutual recognition is unlikely given divergent legal systems, privacy regimes, and norms of the parties, a common system of rules to allow for cross-border data flows while ensuring privacy protection is reportedly under discussion. Personal privacy has received increasing focus with the growth of digital trade encouraging global cooperation. The United States has contributed to developing international guidelines or principles related to privacy and cross-border data flows, although none are legally binding. The OECD 1980 Privacy Guidelines established the first international set of privacy principles emphasizing data protection as a condition for the free flow of personal data across borders. These OECD guidelines were intended to assist countries with drawing up national data privacy policies. The guidelines were updated in 2013, focusing on national level implementation based on a risk management approach and improving interoperability between national privacy strategies. The updated guidelines identify specific principles for countries to take into account in establishing national policies. The guidelines are to be reviewed and updated again in 2019. Building on the OECD principles and prior G-20 work, the 2018 G-20 Digital Economy Ministerial Declaration identified principles to "facilitate an inclusive and whole-of-government approach to the use of information and communication technology (ICT) and assist governments in reshaping their capacities and strategies, while respecting the applicable frameworks of different countries, including with regards to privacy and data protection." Japan is to host the 2019 G-20 and plans to focus on data governance, offering a forum to address potential global standards on privacy and cross-border data flows. APEC is a regional forum for economic cooperation whose initiatives on privacy and cross-border data flows have influenced members' domestic policies. APEC's 21 members, including the United States, agreed to the 2005 APEC Privacy Framework , based on the OECD guidelines. The framework identifies a set of principles and implementation guidelines to provide members with a flexible approach to regulate privacy at a national level. Once the OECD publishes updated guidelines in 2019, APEC members may revise the framework and principles to reflect the updated guidelines. The APEC Cross-Border Privacy Rules (CBPR), endorsed by APEC Leaders in 2011, is a privacy code of conduct, based on the framework. The CBPR system establishes a set of principles for governments and businesses to follow to protect personal data and allow for cross-border data flows between CBPR members. They aim to balance information privacy with business needs and commercial interests, and facilitate digital trade to spur economic growth in the region. Rather than creating a new set of international regulations, the APEC framework and CBPR system identify best practices that each APEC member can tailor to its domestic legal system and allow for interoperability between countries. The scope and implementation mechanisms under CBPR can vary according to each member country's laws and regulations, providing flexibility for governments to design national privacy approaches. To become a member of the CBPR, a government must 1. Be a member of APEC; 2. Establish a regulator with authority to sign the Cross-Border Privacy Enforcement Arrangement (CPEA); 3. Map national laws to the published APEC guidelines, which set baseline standards; and 4. Establish an accountability agent empowered to audit and review a company's practices, and enforce privacy rules and laws. If a government joins the CBPR system, every domestic organization is not required to also join; however, becoming a member of CBPR may benefit an organization engaged in international trade by indicating to customers and partners that the organization values and protects data privacy. With certified enrollment in CBPR, organizations can transfer personal information between participating economies (e.g., Mexico to Singapore) and be assured of compliance with the legal regimes in both places. To become a CBPR member, an individual organization must develop and implement data privacy policies consistent with the APEC Privacy Framework and complete a questionnaire. The third party accountability agent is responsible for assessing an organization's application, ongoing monitoring of compliance, investigating any complaints, and taking enforcement actions as necessary. Domestic enforcement authorities in each member country serve as a backstop for dispute resolution if an accountability agent cannot resolve a particular issue. All CBPR member governments must join the CPEA to ensure cooperation and collaboration between the designated national enforcement authorities. In the United States, the Federal Trade Commission (FTC) is the regulator and enforcement authority. TrustArc is the only accountability agent, but many expect the U.S. Department of Commerce to recognize additional agents soon. As of this writing, TrustArc lists about 20 U.S. firms that are APEC CBPR certified. The CBPR grows in significance as the number of participating economies and organizations increases. The U.S. ambassador to APEC aims to have "as many APEC economies as possible as soon as possible to join the system." Currently, the United States, Japan, Mexico, Canada, South Korea, Singapore, Taiwan, and Australia are CBPR members; the Philippines is in the process of joining. Russia, on the other hand, stated it has no plans to join. Although APEC initiatives are regionally focused, they can provide a basis to scale up to larger global efforts because they reflect economies at different stages of development and include industry participation. Due to its voluntary nature, APEC has served as a testbed for identifying best practices, standards, and principles and for creating frameworks that can lead to binding commitments in plurilateral or larger multilateral agreements (see " Data Flows and Privacy in U.S. Trade Agreements "). Expanding CBPR beyond APEC could represent the next step toward consistent international rules and disciplines on data flows and privacy. Countries vary in their privacy policies and laws, reflecting differing priorities, cultures, and legal structures. According to one index, China is the most restrictive digital trade country among 64 countries surveyed, followed by Russia, India, Indonesia, and Vietnam (see Figure 1 ). The United States ranks 22 in the index, less restrictive than Brazil or France but more restrictive than Canada or Australia. The relatively high U.S. score largely reflects financial sector restrictions. The "restrictions on data" category covers data policies such as privacy and security measures; this category is included in the composite index. Looking specifically at the 64 countries' data policies, Russia is the most restrictive country, followed by Turkey and China. Russia's policies include data localization, retention, and transfer requirements, among others. Turkey's comprehensive Data Protection Law also establishes requirements in these areas. In contrast, the United States ranks 50 for data policy restrictions. Two of the top U.S. trading partners (the EU and China) have established their data policies from different perspectives. The EU's policies are driven by privacy concerns; China's policies are based on security justifications. Both are setting examples that other countries, especially those with (or seeking) closer trading ties to China or the EU, are emulating; thus, these policies have affected U.S. firms seeking to do business in those other countries as well. The EU considers the privacy of communications and the protection of personal data to be fundamental human rights, which are codified in EU law. Differences between the United States and EU in their approaches to data protection and data privacy laws have long been sticking points in U.S.-EU economic and security relations. The EU and United States negotiated the U.S.-EU Privacy Shield to allow for the transatlantic transfer of personal data by certified organizations. The bilateral agreement established a voluntary program with commitments and obligations for companies, limitations on law enforcement access, and transparency requirements. U.S. companies that participate in the program must still comply with all of the obligations under EU law (see below) if they process personal data of EU persons. The Privacy Shield is overseen and enforced by EU federal and U.S. agencies, including the Department of Commerce and the FTC, and is reviewed by both parties annually. The EU's General Data Protection Regulation (GDPR), effective May 2018, establishes rules for EU members, with extraterritorial implications. The GDPR is a comprehensive privacy regime that builds on previous EU data protection rules. It grants new rights to individuals to control personal data and creates specific new data protection requirements. The GDPR applies to (1) all businesses and organizations with an EU establishment that process (i.e., perform operations on) personal data of individuals in the EU, regardless of where the actual processing of the data takes place; and (2) entities outside the EU that offer goods or services (for payment or for free) to individuals in the EU or monitor the behavior of individuals in the EU. While the GDPR is directly applicable at the EU member state level, individual countries are responsible for establishing some national-level rules and policies as well as enforcement authorities, and some are still in the process of doing so. As a result, some U.S. stakeholders have voiced concerns about a lack of clarity and inadequate country compliance guidelines. Many U.S. firms doing business in the EU have made and are making changes to comply with the GDPR, such as revising and clarifying user terms of agreement and asking for explicit consent. For some U.S. companies, it may be easier and cheaper to apply GDPR protections to all users worldwide rather than to maintain different policies for different users. Large firms may have the resources to hire consultants and lawyers to guide implementation and compliance; it may be harder and costlier for small and mid-sized enterprises to comply, possibly deterring them from entering the EU market and creating a de facto trade barrier. Since the GDPR went into effect on May 25, 2018, some U.S. businesses, including some newspaper websites and digital advertising firms, have opted to exit the EU market given the complexities of complying with the GDPR and the threat of potential enforcement actions. European Data Protection Authorities (DPAs) have received a range of GDPR complaints and initiated several GDPR enforcement actions in the fall of 2018. In January 2019, the French DPA issued the largest penalty to date for a data privacy breach. The agency imposed a €50 million (approximately $57 million) fine on Google for the "lack of transparency" regarding how the search engine processes user data. Analysts contend that the high fine may set a benchmark and signal for future enforcement, raising concerns among some firms doing business in the EU. Under the GDPR, a few options exist to transfer personal data in or out of the EU and ensure that privacy is maintained. 1. An organization may use specific Binding Corporate Rules (BCRs) or Model Contracts approved by the EU; 2. An organization may comply with domestic privacy regimes of a country that has obtained a mutual adequacy decision from the EU, which means that the EU has deemed that a country's laws and regulations provide an adequate level of data protection; currently, fewer than 15 jurisdictions are deemed adequate by the EU; or 3. A U.S.-based organization may enroll in the bilateral U.S.-EU Privacy Shield program for transatlantic transfer of personal data. The GDPR legal text seems to envision a fourth way, such as a certification scheme to transfer data, that the EU has yet to elaborate. A certification option(s) could create a less burdensome means of compliance for U.S. and other non-EU organizations to transfer personal data to or from the EU in the future. This could be an opportunity for the United States to work with the EU on creating a common system, perhaps even setting a global standard. Some experts contend that the GDPR may effectively set new global data privacy standards, since many companies and organizations are striving for GDPR compliance to avoid being shut out of the EU market, fined, or otherwise penalized, or in case other countries introduce rules that imitate the GDPR. The EU is actively promoting the GDPR and some countries, such as Argentina, are imitating all or parts of the GDPR in their own privacy regulatory and legislative efforts or as part of broader trade negotiations with the EU. In general, the EU does not include cross-border data flows or privacy in free trade agreements. However, alongside trade negotiations with Japan, the EU and Japan agreed to recognize each other's data protection systems as "equivalent," allowing for the free flow of data between the EU and Japan and serving as a first step in adopting an adequacy decision. Under the agreement, Japan committed to implementing additional measures to address the handling of the personal data of EU persons on top of Japan's own privacy regime. China's trade and internet policies reflect state direction and industrial policy, limiting the free flow of information and individual privacy. For example, the requirement for all internet traffic to pass through a national firewall can impede the cross-border transmission of data. China's 2015 counterterrorism law requires telecommunications operators and internet service providers to provide assistance to the government, which could include sharing individuals' data. Citing national security concerns, China's Internet Sovereignty policies, Cybersecurity Law, and Personal Information Security Specification impose strict requirements on companies, such as storing data domestically; limiting the ability to access, use, or transfer data internationally; and mandating security assessments that provide Chinese authorities access to proprietary information. In 2014, China announced a new social credit system, a centralized big-data-enabled system for monitoring and shaping businesses' and citizens' behavior that serves as a self-enforcing regulatory mechanism. According to the government, China aims to make individuals more "sincere" and "trustworthy," while obtaining reliable data on the creditworthiness of businesses and individuals. An individual's score would determine the level of government services and opportunities he or she could receive. China seeks to have all its citizens subject to the social credit system by 2020, forcing some U.S. businesses who do business in China, such as airlines, to participate. As of 2018, multiple government agencies and financial institutions contribute data to the platform. Pilot projects are underway in some provinces to apply various rewards and punishments in response to data collected. The lack of control an individual may have and the exposure of what some consider private data is controversial among observers in and out of China. Some countries, such as Vietnam, are following China's approach in creating cybersecurity policies that limit data flows and require local data storage and possible access by government authorities. Some U.S. firms and other multinational companies are considering exiting the Vietnamese market rather than complying, while some analysts suggest that Vietnam's law may not be in compliance with its recent commitments in trade agreements (see below). India has also cited security as the rationale for its draft Personal Data Protection Bill, which would establish broad data localization requirements and limit cross-border transfer of some data. Unlike the EU, these countries do not specify mechanisms to allow for cross-border data flows. U.S. officials have raised concerns with both Vietnam's and India's localization requirements. The EU's emphasis on privacy protection and China's focus on national security (and the countries that emulate their policies) have led these countries to create data-focused policies that restrict international trade and commerce. The United States has traditionally sought a balanced approach between trade, privacy, and security. U.S. data flow policy priorities are articulated in USTR's Digital 2 Dozen report, first developed under the Obama Administration, and the White House's 2017 National Security Strategy. Both Administrations emphasize the need for protection of privacy, the free flow of data across borders, and an interoperable internet. These documents establish the U.S. position that the free flow of data is not inconsistent with privacy protection. Recent free trade agreements translate the U.S. position into binding international commitments. The United States has taken a data-specific approach to regulating data privacy, with laws protecting specific information, such as healthcare or financial data. The FTC enforces consumer protection laws and requires that consumers be notified of and consent to how their data will be used, but the FTC does not have the mandate or resources to enforce broad online privacy protections. There is growing interest among some Members of Congress and in the Administration for a more holistic U.S. data privacy policy. The United States has played an important role in international discussions on privacy and data flows, such as in the OECD, G-20, and APEC, and has included provisions on these subjects in recent free trade agreements. Congress noted the importance of digital trade and the internet as a trading platform in setting the current U.S. trade negotiating objectives in the June 2015 Trade Promotion Authority (TPA) legislation ( P.L. 114-26 ). TPA includes a specific principal U.S. trade negotiating objective on "digital trade in goods and services and cross-border data flows." According to TPA, a trade agreement should ensure that governments "refrain from implementing trade-related measures that impede digital trade in goods and services, restrict cross-border data flows, or require local storage or processing of data." However, TPA also recognizes that sometimes measures are necessary to achieve legitimate policy objectives and aims for such regulations to be the least trade restrictive, nondiscriminatory, and transparent. Comprehensive and Progressive Agreement for Trans‐Pacific Partnership (CPTPP /TPP-11 ) . The CPTPP is a recently concluded trade agreement among 11 Asia-Pacific countries. The CPTPP is based on the proposed Trans-Pacific Partnership (TPP) agreement negotiated by the Obama Administration and from which President Trump withdrew the United States in January 2017. The electronic commerce chapter in TPP, left unchanged in CPTPP, contains the strongest binding trade agreement commitments on digital trade in force globally. CPTPP includes provisions on cross-border data flows and personal information protection. The text specifically states that the parties "shall allow the cross-border transfer of information." The agreement allows restrictive measures for legitimate public policy purposes if they are not discriminatory or disguised trade barriers. The agreement also prohibits localization requirements for computing facilities, with similar exceptions. On privacy, the CPTPP requires parties to have a legal framework in place to protect personal information and to have consumer protection laws that cover online commerce. It encourages interoperability between data privacy regimes and encourages cooperation between consumer protection authorities. United States-Mexico-Canada Agreement (USMCA). The released text for the proposed USMCA aims to revise and update the trilateral North American Free Trade Agreement (NAFTA), and illustrates the Trump Administration's approach. The USMCA chapter 19 on digital trade includes articles on consumer protection, personal information protection, cross-border transfer of information by electronic means, and cybersecurity, among other topics. Building on the TPP, the agreement seeks to balance the legitimate objectives by requiring parties to have a legal framework to protect personal information, have consumer protection laws for online commercial activities, and not prohibit or restrict cross-border transfer of information. While the agreement does not prescribe specific rules or measures that a party must take to protect privacy, it goes further than the TPP (or CPTPP) provisions and provides guidance to inform a country's privacy regime. In particular, the USMCA explicitly refers to the APEC Privacy Framework and OECD Guidelines as relevant and identifies key principles. In general, the proposed USMCA requires that parties not restrict cross-border data flows. Governments are allowed to do so to achieve a legitimate public policy objective (e.g., privacy, national security), provided the measure is not arbitrary, discriminatory, a disguised trade barrier, or greater than necessary to achieve the particular objective. In this way, the parties seek to balance the free flow of data for commerce and communication with protecting privacy and security. The agreement specifically states that the parties may take different legal approaches to protect personal data and also recognizes APEC CBPR as a "valid mechanism to facilitate cross-border information transfer while protecting personal information." The agreement aims to increase cooperation between the United States, Mexico, and Canada on a number of digital trade issues, including exchanging information on personal information protection and enforcement experiences; strengthening collaboration on cybersecurity issues; and promoting the APEC CBPR and global interoperability of national privacy regimes. The governments also commit to encourage private-sector self-regulation models and promote cooperation to enforce privacy laws. While the agreement is only between three parties, the provisions are written broadly to encompass global efforts. Some stakeholders look at USMCA as the basis for potential future trade agreements (such as with the UK). Cross-border data flows will likely be a key issue in future U.S.-EU trade negotiations. The United States has articulated a clear position on data privacy in trade agreements; however, there is no single U.S. data privacy policy. Nevertheless, the Trump Administration is seeking to define an overarching U.S. policy on data privacy. The Trump Administration's ongoing three-track process is being managed by the Department of Commerce (Commerce) in consultation with the White House. Different bureaus in Commerce are tasked with different aspects of the process, as follows. 1. The National Institutes of Standards and Technology (NIST) is developing a privacy framework. Similar to its cybersecurity framework, NIST aims to create a voluntary framework as a tool for organizations to adopt to identify, assess, manage, and communicate about privacy risks. By classifying specific privacy outcomes and potential approaches, the framework is intended to enable organizations to create and adapt privacy strategies, innovate, and manage privacy risks within diverse environments. As part of its transparent approach, NIST is currently consulting with public- and private-sector stakeholders through various forms of outreach to collect feedback and aims to have a draft framework before the end of 2019. 2. The National Telecommunications and Information Administration (NTIA) is developing a set of privacy principles to guide a domestic legal and policy approach. The NITA sought public comment on a proposed set of "user-centric privacy outcomes" and a set of high-level goals. 3. The International Trade Administration (ITA) engages with foreign governments and international organizations such as APEC. ITA is focusing on the international interoperability aspects of potential U.S. privacy policy. ITA's role is to ensure that the NIST and NTIA approaches are consistent with U.S. international policy objectives, including TPA, and principles, such as the OECD framework and APEC CBPRs. Like the EU and China, Commerce is seeking input through a public- and private-sector consultation process. However, unlike the EU or China, Commerce is expecting to create a voluntary privacy framework. Some observers question whether the Commerce approach is sufficient to result in strong privacy protections if it is not backed up by congressional action and federal legislation. Some suggest that Congress could lead a whole-of-government approach through new federal legislation. In the 115 th Congress, then-House Committee on Energy and Commerce Ranking Member Frank Pallone, Jr. requested that the Government Accountability Office (GAO) examine issues related to federal oversight of internet privacy. The January 2019 GAO report concluded that now is "an appropriate time for Congress to consider comprehensive Internet privacy." GAO stated that "Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority." Recognizing the importance of protecting open data flows amid growing concerns about online privacy, some stakeholders seek to influence U.S. policies on these issues. In addition to submitting comments in response to NTIA and NIST requests and participating in their forums, multiple organizations issued their own sets of principles or guidelines, some referencing the EU GDPR. The U.S. Chamber of Commerce has also published model privacy legislation for Congress to consider. Though they vary in emphasis, these proposals share common themes: transparency on what data is being collected and how it is being used; user control, including the ability to opt out of sharing at least some information and to access and correct personal data collected; data security measures, like data breach notification requirements; and enforcement by the FTC; FTC commissioners also voiced support for the agency as the appropriate federal enforcer for consumer privacy. But these groups also differ in some areas, such as whether, or to what extent, to include certain aspects included in the GDPR, such as the right to deletion (so-called "right to be forgotten"), requirements for data minimization, or extraterritorial reach. There is not consensus on whether the FTC should be given rule-making authority or additional resources, the enforcement role of states, or if an independent data protection commission is needed similar to EU DPAs. Consistent with U.S. trade policy, industry groups generally point out the need to be flexible, encourage private-sector innovation, establish sector- and technology-neutral rules, create international interoperability between privacy regimes, and facilitate cross-border data flows. Private-sector stakeholders generally want to avoid what they regard as overregulation or high compliance burdens. These groups emphasize risk management and a harm-based approach, which they state keeps an organization's costs proportional to the consumer harm prevented. On the other hand, some consumer advocates point to a need for baseline obligations to protect against discrimination, disinformation, or other harm. In general, consumer advocates believe that any comprehensive federal privacy policy should complement, and not supplant, sector-specific privacy legislation or state-level legislation. Finding a global consensus on how to balance open data flows and privacy protection may be key to maintaining trust in the digital environment and advancing international trade. One study found that over 120 countries have laws related to personal data protection. Divergent national privacy approaches raise the costs of doing business and make it harder for governments to collaborate and share data, whether for scientific research, defense, or law enforcement. A system for global interoperability in a least trade-restrictive and nondiscriminatory way between different national systems could help minimize costs and allow entities in different jurisdictions with varying online privacy regimes to share data via cross-border data flows. Such a system could help avoid fragmentation of the internet between European, Chinese, and American spheres, a danger that some analysts have warned against. For example, Figure 2 suggests the potential of an interoperability system that allows data to flow freely between GDPR- and CBPR-certified economies. The OECD guidelines, G-20 principles, APEC CBPR, CPTPP, and USMCA provisions demonstrate an evolving understanding on how to balance cross-border data flows, security, and privacy, to create interoperable policies that can be tailored by countries and avoid fragmentation or the potential exclusion of other countries or regulatory systems. The various trade agreements and initiatives with differing sets of parties may ultimately pave the way for a broader multilateral understanding and eventually lead to more enforceable binding commitments founded on the key WTO principles of nondiscrimination, least trade restrictiveness, and transparency. Congress may consider the trade-related aspects of data flows in trade agreements, including through close examination of these provisions during the congressional debate and consideration of legislation to implement the proposed USMCA. Issues include whether the agreements make progress in meeting TPA's related trade negotiating objectives and if the provisions strike the appropriate balance among public policy objectives. In addition, USTR's specific trade negotiating objectives for future agreements with the EU and Japan include establishing rules to protect cross-border data flows. These future trade negotiations present challenges and provide opportunities for Congress to further engage USTR on the issues and to conduct oversight. Congress may further consider how best to achieve broader consensus on data flows and privacy at the global level. Congress could, for example, conduct additional oversight of current best practice approaches (e.g., OECD, APEC) or ongoing negotiations in the WTO on e-commerce to create rules through plurilateral or multilateral agreements. Congress may consider endorsing certain of these efforts to influence international discussions and the engagement of other countries. Congress may want to examine the potential challenges and implications of building a system of interoperability between APEC, CBPR, and the EU GDPR. Related issues are the extent to which the EU is establishing its system as a potential de facto global approach through its trade agreements and other mechanisms, and how U.S. and other trade agreements may ultimately provide approaches that could be adopted more globally. Congress may seek to better understand the economic impact of data flows and privacy regimes in other countries related to U.S. access to other markets and the extent to which barriers are being put in place that may discriminate against U.S. exporters. Congress may examine the lack of reciprocal treatment and limits on U.S. firms' access to some foreign markets. Congress may consider the implications of not having a comprehensive national data privacy policy. Will the EU GDPR and China cybersecurity policies become the global norms that other countries follow in the absence of a clear U.S. alternative? Congress may enact comprehensive privacy legislation. In considering such action, Congress could investigate and conduct oversight of the Administration's ongoing privacy efforts, including requesting briefings and updates on the NTIA, NIST, and ITA initiatives to provide congressional feedback and direction and ensure they are aligned with U.S. trade objectives. Congress may also seek input from other federal agencies. In deliberating a comprehensive U.S. policy on personal data privacy, Congress may review the GAO report's findings and conclusions. Congress may also weigh several factors, including: How can U.S. trade and domestic policy achieve the appropriate balance to encourage cross-border commerce, economic growth, and innovation, while safeguarding individual privacy and national security? How would a new privacy regime affect U.S. consumers and businesses, including large multinationals who must comply with different national privacy regimes and small- and medium-sized enterprises with limited resources and technology expertise? Do U.S. agencies have the needed tools to accurately assess the size and scope of cross-border data flows to help analyze the economic impact of different privacy policies, or measure the costs of trade barriers? How should an evolving U.S. privacy regime align with U.S. trade policy objectives and evolving international standards, such as the OECD Guidelines for privacy and cybersecurity, and should U.S. policymakers prioritize interoperability with other international privacy frameworks to avoid further fragmentation of global markets and so-called balkanization of the internet? In addition, there are a host of other policy considerations not directly related to trade.

Question: Write a one-page summary of the report 1.

Answer: Wildlife trafficking—the poaching and illegal trade of plants, fish, and wildlife—is a multibillion-dollar, global criminal activity that imperils thousands of species. FWS and NOAA enforce laws prohibiting wildlife trafficking that authorize the agencies to pay financial rewards for information about such illegal activities. GAO was asked to review FWS's and NOAA's use of financial rewards to combat wildlife trafficking. This report examines (1) laws that authorize FWS and NOAA to pay rewards for information on wildlife trafficking and the extent to which the agencies paid such rewards from fiscal years 2007 through 2017, (2) the agencies' reward policies, (3) information available to the public on rewards, and (4) the extent to which the agencies reviewed the effectiveness of their use of rewards. GAO reviewed laws, examined FWS and NOAA policies and public communications on rewards, analyzed agency reward data for fiscal years 2007 through 2017 and assessed their reliability, interviewed FWS and NOAA officials, and compared agency policies and public communications on rewards to federal internal control standards. Multiple laws—such as the Endangered Species Act and Lacey Act—authorize the Departments of the Interior's U.S. Fish and Wildlife Service (FWS) and Commerce's National Oceanic and Atmospheric Administration (NOAA) to pay rewards for information on wildlife trafficking. FWS and NOAA reported paying few rewards from fiscal years 2007 through 2017. Specifically, the agencies collectively reported paying 27 rewards, totaling $205,500. Agency officials said that the information was complete to the best of their knowledge but could not sufficiently assure that this information represented all of their reward payments. FWS and NOAA have reward policies that outline the general process for preparing reward proposals, but FWS's policy does not specify factors for its agents to consider when developing proposed reward amounts. Some FWS agents GAO interviewed said that in developing proposals, they did not know whether their proposed reward amounts were enough, too little, or too much. By augmenting its policy to specify factors for agents to consider, FWS can better ensure that its agents have the necessary quality information to prepare proposed reward amounts, consistent with federal internal control standards. FWS and NOAA communicate little information to the public on rewards. For example, most agency websites did not indicate that providing information on wildlife trafficking could qualify for a reward. This is inconsistent with federal standards that call for management to communicate quality information so that external parties can help achieve agency objectives. FWS and NOAA officials said they have not communicated general reward information because of workload concerns, but they said it may be reasonable to provide more information in some instances. By developing plans to communicate more reward information to the public, the agencies can improve their chances of obtaining information on wildlife trafficking that they otherwise might not receive. FWS and NOAA have not reviewed the effectiveness of their use of rewards. The agencies have not done so because using rewards has generally not been a priority. FWS and NOAA officials agreed that such a review would be worthwhile but provided no plans for doing so. By reviewing the effectiveness of their use of rewards, FWS and NOAA can identify opportunities to improve the usefulness of rewards as a tool for combating wildlife trafficking. GAO is making seven recommendations, including that FWS and NOAA track reward information, FWS augment its reward policy to specify factors for agents to consider when developing proposed reward amounts, FWS and NOAA develop plans to communicate more reward information to the public, and FWS and NOAA review the effectiveness of their reward use. Both agencies concurred with these recommendations.