FEDERAL ELECTION COMMISSION 

OFFICE OF INSPECTOR GENERAL 

FINAL REPORT 

INSPECTION OF THE COMMISSION’S 

WEB SITE PRIVACY PRACTICES 

MAY 2001

ASSIGNMENT 01-02
TABLE OF CONTENTS

DESCRIPTION PAGE 

Background..........................................................................................................................1

Objectives, Scope, and Methodology............................................................................3

Inspection Results.............................................................................................................4

Conclusions.................................................................................................9

Appendix I: FEC Web Site Home Page.............................................................10

Appendix II: FEC Web Site Privacy Statement....................................................11

Appendix III: FEC Conference Registration Web Form...................................................12
Background 

The Office of Inspector General (OIG) conducted this inspection as a result of Federal legislation 

enacted in December 2000. This legislation required each Federal Inspector General to 

determine whether the agency or any third parties, including other governmental agencies, are 

obtaining personal information relating to any individual’s access of an agency’s Internet sites. 

Dialogue between Congressional staff and the OIG community was held in January 2000 which 

resulted in an agreed upon deadline of May 2001 for the completion of the Inspectors General 

reviews. The legislation, titled the Treasury and General Government Appropriations Act of 

2001, section 646, contained the following language: 

“SEC. 646. Not later than 60 days after the date of enactment of this Act, the Inspector General of

each department or agency shall submit to Congress a report that discloses any activity of the

applicable department or agency relating to­

(1) the collection or review of singular data, or the creation of aggregate lists that include personally

identifiable information, about individuals who access any Internet site of the department or agency;

and

(2) entering into agreements with third parties, including other government agencies, to collect,

review, or obtain aggregate lists or singular data containing personally identifiable information

relating to any individual's access or viewing habits for governmental and nongovernmental Internet

sites.”

The Internet, i.e. World Wide Web (Web), enables the Federal government to convey information 

to the public on a wide variety of issues in a quick and effective manner. The Federal Election 

Commission’s (FEC) Web site provides the public with access to information on the mission of 

the Commission, such as the FEC’s enforcement of the Federal Election Campaign Act (FECA) 

and the disclosure of campaign finance information. The Web site includes Web forms enabling 

users to provide information to the FEC. A Web form permits political committees required to 

file electronically with the FEC the capability to download electronic filing software. Another Web 

form enables interested parties the option to register on-line for FEC sponsored conferences 

held to discuss various topics related to the FECA. Several e-mail addresses for FEC 

employees are also available on the Web site to allow the public to communicate with the 

Commission. 

To instill confidence in the technology and encourage the use of Federal Web sites, appropriate 

privacy policies and practices must be in place to ensure that users’ right to privacy is protected. 
An appropriate Internet privacy policy helps ensure that individuals have notice and choice about, 

and thus confidence in, how their personal information is handled when they use the Internet.1 

The Federal Election Commission (FEC), established in 1975, is an independent regulatory 

agency that enforces and administers the Federal Election Campaign Act (FECA). Enforcement 

of FECA includes the following: facilitating public disclosure of finance activity; providing 

information and policy guidance to the public and elected officials; encouraging voluntary 

compliance with the disclosure and other requirements of the Act; and enforcing the statute 

through audits, investigations, and civil litigation. In addition, the Commission manages the 

public funding programs for Presidential campaigns and conventions. The FEC is located in 

Washington, D.C., and has approximately 338 permanent and temporary employees. 

The FEC Data Systems Development Division (DSDD) is responsible for providing computer 

support for the Commission. DSDD’s responsibilities are divided into two main areas: (1) the 

Commission’s disclosure of campaign finance information and (2) the internal computer support 

for Commission staff. DSDD, with the assistance of contractors, is generally responsible for 

the installation, maintenance, training, and on-going technical assistance for the Commission’s 

computer system and the agency’s Web sites. 

The FEC contracts with two companies to provide Internet, or Web, related services. One 

contractor provides Web services, including computer hardware, software and communications 

support for the FEC’s Web connection and primary Web site (http://www.fec.gov) (Appendix I). 

A second contractor supports the FEC’s electronic filing and disclosure system, which enables 

political committees to electronically submit reports to the FEC. In addition, the contractor 

supports Web computer servers, which allows the public to electronically access disclosure 

reports filed by U.S. House of Representatives and Senate campaigns, Presidential campaigns, 

party committees, and political action committees. The disclosure reports are accessible either 

from the www.fec.gov Web site or directly at the Web servers maintained by the contractor for 

the FEC (http://herndon1.sdrdc.com/), (http://herndon2.sdrdc.com/). 

1

 Office of Management and Budget (OMB), Memorandum 99-18, Privacy Policies on Federal Web Sites, 

June 2, 1999, page 1. 

2
Objectives, Scope, and Methodology 

The objective of the Inspection was to evaluate the Commission’s Web site privacy practices. 

Specific objectives included the following:

(1) Determine whether the Commission utilizes Internet cookies or Web bugs, technologies

used to monitor, and/or collect personal information about Web users; and whether 

applicable Federal guidelines are followed; and 

(2) Evaluate the Commission’s Web site privacy policy in accordance with Federal guidelines. 

The OIG reviewed the following documentation in order to obtain background information and 

criteria to evaluate the Commission’s Web site privacy practices: 

• Treasury and General Government Appropriations Act, 2001, section 646. 

• U.S. Office of Management and Budget (OMB), M-00-13, Privacy Policies and Data 

Collection on Federal Web Sites, June 22, 2000. 

• OMB, M-99-18, Privacy Policies on Federal Web Sites, June 2, 1999. 

• U.S. General Accounting Office (GAO), Internet Privacy: Federal Agency Use of Cookies, 

(GAO-01-147R), October 20, 2000. 

• GAO, Internet Privacy: Agencies’ Efforts to Implement OMB’s Privacy Policy, (GAO/GGD00-191) September 5, 2000. 

• GAO, Internet Privacy: Comparison of Federal Agency Practices with FTC’s Fair Information 

Principles, September 11, 2000. 

• U.S. Department of Energy, Computer Incident Advisory Capability (CIAC), Information 

Bulletin I-034: Internet Cookies, March 12, 1998. 

• FAQ: Web Bugs, Privacy Foundation, URL: 

http://www.privacyfoundation.org/education/webbug.html, (March 20, 2001). 

The OIG communicated with several FEC divisions to conduct the Inspection. The OIG

interviewed the following FEC staff in order to complete the inspection:

(1) Webmaster;

(2) Data Systems Development Division (DSDD) Director;

(3) Freedom of Information Act (FOIA) Officer and Assistant Press Officer; and

(4) Office of General Counsel’s Legal Review and Administrative Law staff. 

The OIG also obtained technical and contract information from the two contractors that provide

Web related services to the Commission. 

The OIG used specialized computer software to determine whether the Commission’s Web site

uses Internet cookies or Web bugs. The OIG tested the entire www.fec.gov Web site for the use

of cookies. Testing of the FEC’s other Web servers used for campaign finance disclosure was

performed on a limited basis. Testing for Web bugs was also conducted on the www.fec.gov

3
Web site on a limited basis. The OIG relied on OMB guidance to evaluate the Commission’s 

Web site privacy policy and general Web privacy practices, including the use of Internet cookies 

and Web bugs. 

The OIG inspection was conducted in accordance with the President’s Council on Integrity and 

Efficiency’s Quality Standards for Inspections. 

Inspection Results 

Cookie and Web Bug Review 

The OIG’s Inspection included a review to determine whether the FEC’s Web site utilizes 

Internet cookies or Web bugs. The FEC’s Web site privacy policy specifically states the FEC 

does not enable cookies on the agency Web site (Appendix II). 

An Internet cookie is a computer file containing a short string of text that may be sent from a 

Web server (i.e. Web site) to a Web browser (the user’s personal computer hard drive) when 

the user accesses a particular Web site. Cookies allow Web sites to recognize returning users, 

customize user settings on a Web site, and can collect information about a Web user. For 

example, a retailer on the Web may use cookies to keep track of items selected by a Web user 

to be purchased on-line. 

There are two forms of Internet cookies: persistent cookies and session cookies. Persistent 

cookies track information over time, and across different Web sites, and remain stored on a 

user’s computer hard drive until the specified expiration date. Session cookies are used only 

during a single Web browser session, and do not raise privacy concerns according to the OMB. 

Web bugs are similar to Internet cookies, and are capable of monitoring who is viewing a Web 

page or e-mail message. Web bugs are very small graphic images on a Web page, or in an email message and are often invisible due to their size. Web bugs are used by some Web sites 

to track Web usage for advertising purposes, and to provide an independent accounting of how 

many users visited a particular Web site. 

The OMB issued on June 22, 2000, memorandum 00-13, and a follow-up memorandum on 

September 5, 2000, addressed to the Chief Information Officers. Both touched on privacy 

policies and data collection on Federal Web sites. 

4
The OMB guidance stated Federal Web sites should not use persistent cookies unless four

conditions are met:

(1) The site gives clear and conspicuous notice;

(2) There is a compelling need to gather the data on the site;

(3) Appropriate and publicly disclosed privacy safeguards exist for handling any information

derived from the cookies; and 

(4) The agency head gives personal approval for the use. 

In addition, OMB memorandum 99-18, Privacy Policies on Federal Web Sites, provides 

guidance to Federal agencies on appropriate disclosure in Web site privacy policies for both 

session and persistent cookies. 

To determine whether the FEC utilizes cookies or Web bugs, the OIG used specialized 

computer software programs designed to detect the presence of cookies or Web bugs on a 

Web site. The OIG also received assurance from the Webmaster that the FEC does not utilize 

cookies or Web bugs on the FEC Web sites. In addition, the OIG contacted the two contractors 

who maintain Web servers for the FEC, and received written assurance that the contractors 

would not modify the FEC Web site to enable cookies or Web bugs, or disclose information to 

third parties, unless specifically authorized by the FEC. 

Results 

The OIG found no evidence that Internet cookies or Web bugs are used on the FEC Web sites, 

which is consistent with the FEC’s privacy policy. 

During the Inspection testing, the OIG found on the FEC Web site (www.fec.gov) several links to 

non-FEC Web sites. The FEC Web site provides links to other non-FEC Web sites containing 

information that is related to the FEC mission. For example, the FEC Web site provides links to 

several state government Web sites, and to a software company that provides software 

necessary to view certain files available on the FEC Web site. However, privacy policies of nonFEC Web sites may differ from the FEC, as we found during our testing. A by-product of our 

testing of the FEC Web site revealed several of the non-FEC Web sites utilized both persistent 

and session cookies. 

The FEC’s practice of linking to other Web sites, some of which utilize cookies, is not a violation 

of any known Federal policy or regulation and does not violate the FEC’s privacy policy. 

However, it is possible users of the FEC Web site may click with their computer mouse on nonFEC links without realizing the link is associated with another organization. This latter 

organization may use persistent cookies or Web bugs. Therefore, the OIG suggested that the 

FEC provide a notice to users that the FEC Web site contains links to non-FEC Web sites that 

may have different Internet privacy policies than does the FEC, such as the use of cookies and 

Web bugs. 

5
The OIG discussed the issue with management and received agreement that appropriate 

language would be incorporated into the FEC Web site privacy policy. 

Privacy Policy Review 

The FEC Web site privacy policy was reviewed to determine (1) whether the policy is adequate

based on guidance provided by the Office of Management and Budget and (2) to ensure

statements included in the privacy policy are followed.

OMB Guidance

On June 2, 1999, the OMB issued Memorandum 99-18, Privacy Policies on Federal Web Sites. 

The memorandum directed agencies to post the following:

(1) A privacy policy on the agency’s principal Web site by September 1, 1999;

(2) Privacy policies to any other known, major entry points to their Web sites by December 1,

1999, as well as any Web page where they collect substantial personal information from the 

public; 

(3) Policies that clearly and concisely inform visitors to the Web sites what information the 

agency collects about individuals, why the agency collects it, and how the agency will use it; 

and 

(4) Policies that are clearly labeled and easily accessed when someone visits a Web site. 

Posting of Privacy Policy 

OMB memorandum 99-18 directed agencies to post privacy policies on major entry points to 

their Web sites; also on any Web page where agencies collect substantial personal information 

from the public. The FEC’s major Web site entry point is www.fec.gov. The FEC Web site 

contains a privacy policy as required by OMB. The FEC also has a separate Web presence that 

supports the FEC’s electronic filing and disclosure system enabling political committees to 

electronically submit reports to the FEC. FEC.gov provides a link to the separate Web servers 

hosting the disclosure system, however, the Web servers can be reached independent of the 

FEC.gov Web site at http://herndon1.sdrdc.com/ and http://herndon2.sdrdc.com/. 

Data was not readily available to the OIG to provide an indication of the number of users who 

directly visit the disclosure system without first accessing the www.fec.gov, the site containing 

the FEC’s privacy policy. Although a definitive determination could not be made as to whether 

the disclosure system Web servers should be classified as major Web site entry points in 

accordance with OMB guidance, the OIG suggested, and management agreed to provide 

appropriate privacy notice on the disclosure system Web server(s). 

FEC.gov also provides a link to an FEC contractor’s Web site where interested parties are able 

to register electronically for FEC sponsored conferences (Appendix III). Individuals may register 

6
on-line for FEC conferences by providing personal contact information, including name, address, 

phone number, etc. The contractor provides the FEC with support for conference planning, 

including the on-line registration Web form. OMB guidance directs agencies to post a privacy 

policy on any Web page where substantial personal information is collected from the public. The 

OIG suggested management provide a link to the FEC privacy policy on the Web page where the 

personal information is collected to register for the FEC conferences. 

Management agreed to provide a link to the FEC’s privacy policy on the Web page to ensure 

conference registrants are aware of the privacy policies. 

Privacy Policy Language 

Memorandum M-99-18 also includes guidance to Federal agencies on issues to address in their

policies, such as the type of information that is automatically collected when a user visits the

agency’s Web site, and whether the agency utilizes “cookies.” The guidance is intended to be

either model language to be used verbatim, or as a starting point for agencies to tailor to their

own needs and requirements.

The FEC’s Web site privacy statement was generally consistent with the suggested language

provided by OMB. However, the FEC privacy policy lacked information related to the receipt of

information by the FEC through e-mails and Web forms. The OMB guidance suggests a

statement be included in privacy policies regarding how the information received will be used,

and then handled by the agency once the purpose of the communication has been fulfilled.

The OIG suggested that the FEC state in the Web site privacy policy how information submitted

through e-mail and Web based forms will be handled by the Commission. The OIG discussed

the issue with management, and received agreement that appropriate language would be

incorporated into the FEC Web site privacy policy.

Actual Web Site Privacy Practices

The OIG also reviewed the FEC’s Web site privacy policy to determine whether the statements

were followed in practice. Overall, the OIG found the FEC’s actual Web site privacy practices

are conducted in accordance with the stated privacy policy.

Personally Identifiable Information 

The FEC Web site privacy policy states the following: 

“We do not give, sell or transfer any personal information to a third party.” 

The FEC Web site allows visitors to communicate and voluntarily provide information to the 

FEC. The Web site includes several e-mail addresses of FEC employees, to include the 

Webmaster responsible for the Web site, and also e-mail addresses for each of the 

7
Commissioners of the FEC. In addition, the OIG Web site contains two Web based forms. The 

Web forms allow interested parties to register on-line for FEC sponsored conferences, and there 

is also a Web form for political committees required to file with the FEC the capability to 

download electronic filing software. 

Although we found no evidence the FEC has given, sold, or transferred personal information to 

third parties, which would be inconsistent with Federal regulations or law, the OIG concluded the 

privacy policy should be revised to take into consideration instances that would require the 

release of information obtained by the FEC through e-mail or the Web site. In limited cases, 

Federal law enforcement actions, and the Freedom of Information Act would compel the 

disclosure of certain information. 

The OIG suggested management revise the privacy statement to take into consideration 

instances that would require the release of information obtained through e-mail or Web based 

forms. 

Management agreed to revise the privacy statement to address the exceptions requiring 

disclosure of information. 

Web server logs 

In the course of operating a Web server to host a Web site, it is customary for certain 

information about Web users to be automatically recorded, or logged. Web server logs generally 

record non-personal data regarding a user’s visit to a Web site, such as the date and time the 

user accessed a Web page. The data contained in the Web server logs can provide useful 

information on the extent to which the Web site is used by the public, and it is also a means to 

detect and identify attempts by users to perform improper actions on the Web site. 

The FEC privacy policy includes a list of items that are automatically logged by the FEC Web 

servers. The OIG contacted the two FEC contractors who maintain the Web servers to verify 

that the information logged about visitors to the FEC Web sites is consistent with the FEC 

privacy policy. The OIG found the FEC’s statements materially accurate, with the exception of 

two items that are automatically logged by one of the FEC contractor’s Web servers, and not 

disclosed in the FEC privacy policy. One of the Web servers maintained by a contractor logs 

the type of Web browser software used by the visitor to the Web site, and also the visitor’s 

referring Web page, which is the Web site the user linked from to arrive at the FEC Web site. 

The OIG suggested management include the two additional types of information logged by the 

FEC Web server to the list already in the Web site privacy policy. Management agreed. 

8
Conclusions 

The OIG found the FEC to be materially in compliance with applicable Office of Management and 

Budget guidelines on Web site privacy. In addition, the OIG found the FEC to be adhering to their 

stated Web site privacy policy. 

The OIG found no evidence as a result of the Inspection to indicate that the FEC has: 

(1) Engaged in the inappropriate collection or review of singular data, or the creation of 

aggregate lists that include personally identifiable information about individuals who 

access any Internet site of the Commission; or 

(2) Inappropriately entered into agreements with third parties, including other government 

agencies, to collect, review, or obtain aggregate lists or singular data containing 

personally identifiable information relating to any individual's access, or viewing habits, of 

the Commission’s Internet sites. 

The OIG identified and conveyed several issues related to the FEC’s privacy policy that should 

be improved and received agreement by management that all of the issues would be addressed 

in an appropriate manner. 

9
Appendix I: FEC Web Site Home Page 

10
Appendix II: FEC Web Site Privacy Statement 

11
Appendix III: FEC Conference Registration Web Form 

12