Social Media: Federal Agencies Need Policies and Procedures for Managing and Protecting Information They Access and Disseminate
Published: 2011-06-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal agencies increasingly use recently developed Internet technologies that allow individuals or groups to create, organize, comment on, and share online content. The use of these social media services-- including popular Web sites like Facebook, Twitter, and YouTube-- has been endorsed by President Obama and provides opportunities for agencies to more readily share information with and solicit feedback from the public. However, these services may also pose risks to the adequate protection of both personal and government information. GAO was asked to (1) describe how federal agencies are currently using commercially provided social media services and (2) determine the extent to which agencies have developed and implemented policies and procedures for managing and protecting information associated with this use. To do this, GAO examined the headquarters-level Facebook pages, Twitter accounts, and YouTube channels of 24 major federal agencies; reviewed pertinent policies, procedures, and guidance; and interviewed officials involved in agency use of social media..
section_title: What GAO Found
paragraphs: Federal agencies have been adapting commercially provided social media technologies to support their missions. Specifically, GAO identified several distinct ways that 23 of 24 major agencies are using Facebook, Twitter, and YouTube. These include reposting information available on official agency Web sites, posting information not otherwise available on agency Web sites, soliciting comments from the public, responding to comments on posted content, and providing links to non-government sites. For example, agencies used Facebook to post pictures or descriptions of the activities of agency officials and to interact with the public. Agencies used Twitter to provide information in an abbreviated format and to direct the public back to official agency sites. YouTube was used to provide alternate means of accessing videos available on official agency sites, share videos of agency officials discussing topics of interest, or to solicit feedback from the public. The use of these services can pose challenges in managing and identifying records, protecting personal information, and ensuring the security of federal information and systems. However, the 23 major agencies that GAO identified as using social media have made mixed progress in developing and implementing policies and procedures to address these challenges: (1) Records management: 12 of the 23 agencies have developed and issued guidance that outlines processes and policies for identifying and managing records generated by their use of social media and record-keeping roles and responsibilities. (2) Privacy: 12 agencies have updated their privacy policies to describe whether they use personal information made available through social media, and 8 conducted and documented privacy impact assessments to identify potential privacy risks that may exist in using social media given the likelihood that personal information will be made available to the agency by the public. (3) Security: 7 agencies identified and documented security risks (such as the potential for an attacker to use social media to collect information and launch attacks against federal information systems) and mitigating controls associated with their use of social media. In several cases, agencies reported having policies in development to address these issues. In other cases, agencies reported that there was no need to have policies or procedures that specifically address the use of social media, since these are addressed in existing policies. However, social media technologies present unique challenges and risks, and without establishing guidance and assessing risks specific to social media, agencies cannot be assured that they are adequately meeting their responsibilities to manage and preserve federal records, protect the privacy of personal information, and secure federal systems and information against threats.
section_title: What GAO Recommends
paragraphs: GAO recommends that agencies ensure that appropriate records management, privacy, and security measures are in place. Most of the agencies agreed with GAO's recommendations. Three agencies did not agree with recommendations made to them; GAO maintains that the actions are necessary.

section_title: Letter
paragraphs: Federal agencies are increasingly using recently developed Internet  technologies (commonly referred to as “Web 2.0” technologies) that offer  flexible, sophisticated capabilities for interaction with individuals,  allowing participants to publish comments, photos, and videos directly on  agency-sponsored Web pages. These technologies include services offered  by social networking sites (such as Facebook and Twitter) and video- sharing Web sites (such as YouTube), which allow individuals or groups of  individuals to create, organize, edit, comment on, and share content.
The use of these services by federal agencies was endorsed in a January  2009 memorandum by President Obama promoting transparency and open  government. The memorandum encouraged executive departments and  agencies to harness new technologies to put information about their  operations and decisions online so that it would be readily available to the  public. It also encouraged the solicitation of public feedback to identify  information of the greatest use to the public, assess and improve levels of  collaboration, and identify new opportunities for cooperation in  government. However, while such use of social media offers the potential  to better include people in the governing process and further agency  missions, use of these services may also pose risks that government  records and sensitive information, including personally identifiable  information (PII), is not properly managed or protected.
You asked us to review federal agencies’ use of commercially provided  social media services. Specifically, as agreed with your offices, our  objectives were to (1) describe how federal agencies are currently using  commercially provided social media services, and (2) determine the extent  to which federal agencies have developed and implemented policies and  procedures for managing and protecting information associated with this  use.
To address our first objective, we examined department-level Facebook  pages, Twitter accounts, and YouTube channels associated with each of  the 24 major federal agencies covered by the Chief Financial Officers Act  to describe the types of information agencies disseminated via the services  and the nature of their interactions with the public. We categorized  agency use based on types of information found on their social media  pages. In addition, we interviewed agency officials to discuss the extent to  which they collect and use personally identifiable information provided by  the public on their social media pages.
To address our second objective, we reviewed pertinent records  management, privacy, and security policies, procedures, guidance, and  risk assessments in place at each of the 23 major agencies and compared  them to relevant federal regulations and guidance on records  management, privacy, and security. We also reviewed relevant reports and  studies to identify records management, privacy, and security risks  associated with social media use by federal agencies. Finally, in  coordination with the National Academy of Public Administration, we  conducted a roundtable discussion to solicit views on these issues from  federal officials involved in agency use of social media.
We conducted this performance audit from July 2010 to June 2011 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. Our objectives, scope, and methodology are  discussed in more detail in appendix I.
subsections: section_title: Background
paragraphs: Internet-based services using Web 2.0 technology have become  increasingly popular. Web 2.0 technologies are a second generation of the  World Wide Web as an enabling platform for Web-based communities of  interest, collaboration, and interactive services. These technologies  include Web logs (known as “blogs”), which allow individuals to respond  online to agency notices and other postings; “wikis,” which allow  individual users to directly collaborate on the content of Web pages;  “podcasting,” which allows users to download audio content; and  “mashups,” which are Web sites that combine content from multiple  sources. Web 2.0 technologies also include social media services, which  allow individuals or groups of individuals to create, organize, edit,  comment on, and share content. These include social networking sites  (such as Facebook and Twitter) and video-sharing Web sites (such as  YouTube).
While in the past Internet usage concentrated on sites that provide online  shopping opportunities and other services, according to the Nielsen  Company, social media-related sites have moved to the forefront. In June  2010, it reported that Internet users worldwide accessed social media sites  one out of every 4 1/2 minutes they spent online on average. The use of  social networking services now reportedly exceeds Web-based e-mail  usage, and the number of American users frequenting online video sites  has more than tripled since 2003. The Nielsen Company reported that  during the month of April 2010, the average user spent nearly 6 hours on  social media-related sites.
Facebook is a social networking site that lets users create personal  profiles describing themselves and then locate and connect with friends,  co-workers, and others who share similar interests or who have common  backgrounds. Individual profiles may contain—at the user’s discretion— detailed personal information, including birth date, home address,  telephone number, employment history, educational background, and  religious beliefs. Facebook also allows any user to establish a “page” to  represent an organization (including federal agencies), business, or public  figure in order to disseminate information to users who choose to connect  with them. These users can leave comments in response to information  posted on such a page. Profile information for these users may be made  available to the administrators of these pages, depending on settings  controlled by the user. According to the Facebook site, Facebook has over  500 million active users who spend more than 700 billion minutes per  month on Facebook.
Twitter is a social networking site that allows users to share and receive  information through short messages that are also known as “tweets.”  These messages are no longer than 140 characters in length. Twitter users  can establish accounts by providing a limited amount of PII but may elect  to provide additional PII if they wish. Users can post messages to their  profile pages and reply to other Twitter users’ tweets. Users can “follow”  other users as well—i.e., subscribe to their tweets. In March 2011, Twitter  reported adding an average of 460,000 new accounts and facilitating the  delivery of 140 million tweets every day.
YouTube is a video-sharing site that allows users to discover, watch,  upload, comment on, and share originally created videos. Similar to  Twitter, users can establish accounts on YouTube with only limited  amounts of PII, although they may choose to provide more detailed  information on their profile page. Users can comment on videos posted on  a page either in written responses or by uploading their own videos.  According to YouTube, during 2010 more than 13 million hours of video  were uploaded.
Federal agencies are increasingly using these social media tools to  enhance services and interactions with the public. As of April 2011, 23 of  24 major federal agencies had established accounts on Facebook, Twitter,  and YouTube. Furthermore, the public increasingly follows the  information provided by federal agencies on these services. For example,  as of April 2011, the U.S. Department of State had over 72,000 users  following its Facebook page; the National Aeronautics and Space  Administration (NASA) had over 992,000 Twitter followers; and a video  uploaded by NASA on YouTube in December 2010 had over 360,000 views  as of April 2011.
subsections: section_title: Federal Agencies Are Responsible for Managing Records, Protecting Privacy, and Ensuring Adequate Security
paragraphs: The Federal Records Act establishes requirements for records  management programs in federal agencies. Each federal agency is required  to make and preserve records that (1) document the organization,  functions, policies, decisions, procedures, and essential transactions of the  agency and (2) provide the information necessary to protect the legal and  financial rights of the government and of persons directly affected by the  agency’s activities. The Federal Records Act defines a federal record  without respect to format. Records include all books, papers, maps,  photographs, machine readable materials, or other documentary materials,  regardless of physical form or characteristics, made or received by an  agency of the government under federal law or in connection with the  transaction of public business and preserved or appropriate for  preservation by that agency as evidence of the organization, functions,  policies, decisions, procedures, operations, or other activities of the  government or because of the informational value of data in them.
The agency responsible for providing guidance for adhering to the Federal  Records Act is the National Archives and Records Administration (NARA).  NARA is responsible for issuing records management guidance; working  with agencies to implement effective controls over the creation,  maintenance, and use of records in the conduct of agency business;  providing oversight of agencies’ records management programs; approving  the disposition (destruction or preservation) of records; and providing  storage facilities for agency records.
In October 2010, NARA issued a bulletin to provide guidance to federal  agencies in managing records produced when federal agencies use social  media platforms for federal business. The bulletin highlighted the  requirement for agencies to decide how they will manage records created  in social media environments in accordance with applicable federal laws  and regulations. As part of this effort, the guidance emphasized the need  for active participation of agency records management staff, Web  managers, social media managers, information technology staff, privacy  and information security staff, and other relevant stakeholders at each  federal agency.
subsections: section_title: Privacy Laws and Guidance Set Requirements to Ensure the Protection of Personal Information
paragraphs: The primary laws that provide privacy protections for personal  information accessed or held by the federal government are the Privacy  Act of 1974 and E-Government Act of 2002. These laws describe, among  other things, agency responsibilities with regard to protecting PII. The  Privacy Act places limitations on agencies’ collection, disclosure, and use  of personal information maintained in systems of records. A system of  records is a collection of information about individuals under control of an  agency from which information is retrieved by the name of an individual  or other identifier. The E-Government Act of 2002 requires agencies to  assess the impact of federal information systems on individuals’ privacy.  Specifically, the E-Government Act strives to enhance the protection of  personal information in government information systems and information  collections by requiring agencies to conduct privacy impact assessments  (PIA).
A PIA is an analysis of how personal information is collected, stored,  shared, and managed in a federal system. Specifically, according to Office  of Management and Budget (OMB) guidance, the purpose of a PIA is to (1)  ensure handling conforms to applicable legal, regulatory, and policy  requirements regarding privacy; (2) determine the risks and effects of  collecting, maintaining, and disseminating information in identifiable form  in an electronic information system; and (3) examine and evaluate  protections and alternative processes for handling information to mitigate  potential privacy risks.
In June 2010, OMB issued guidance to federal agencies for protecting  privacy when using Web-based technologies (such as social media). The  guidance built upon the protections and requirements outlined in the  Privacy Act and E-Government Act and called for agencies to develop  transparent privacy policies and notices to ensure that agencies provide  adequate notice of their use of social media services to the public, and to  analyze privacy implications whenever federal agencies choose to use  such technologies to engage with the public.
section_title: Key Laws and Guidance Set Agencies’ Responsibilities for Securing Government Information
paragraphs: The Federal Information Security Management Act of 2002 (FISMA)  established a framework designed to ensure the effectiveness of security  controls over information resources that support federal operations and  assets. According to FISMA, each agency is responsible for, among other  things, providing information security protections commensurate with the  risk and magnitude of the harm resulting from unauthorized access, use,  disclosure, disruption, modification, or destruction of information  collected or maintained by or on behalf of the agency and information  systems used or operated by an agency or by a contractor of an agency or  other organization on behalf of an agency.
Consistent with its statutory responsibilities under FISMA, in August 2009  the National Institute of Standards and Technology (NIST) issued an  update to its guidance on recommended security controls for federal  information systems and organizations. The NIST guidance directs  agencies to select and specify security controls for information systems  based on an assessment of the risk to organizational operations and assets,  individuals, other organizations, and the nation associated with operation  of those systems. According to the guidance, the use of a risk-based  approach is applicable not just to the operation of the agency’s internal  systems but is also important when an agency is using technology for  which its ability to establish security controls may be limited, such as  when using a third-party social media service.
section_title: GAO Has Identified Challenges in Agencies’ Use of Social Media
paragraphs: In July 2010, we testified that while the use of Web 2.0 technologies,  including social media technologies, can transform how federal agencies  engage the public by allowing citizens to be more involved in the  governing process, agency use of such technologies can also present  challenges related to records management, privacy, and security.
Records Management: We reported that Web 2.0 technologies raised  issues concerning the government’s ability to identify and preserve federal  records. Agencies may face challenges in assessing whether the  information they generate and receive by means of these technologies  constitutes federal records. Furthermore, once the need to preserve  information as federal records has been established, mechanisms need to  be put in place to capture such records and preserve them properly. We  stated that proper records retention management needs to take into  account NARA record scheduling requirements and federal law, which  require that the disposition of all federal records be planned according to  an agency schedule or a general records schedule approved by NARA.
We highlighted that these requirements may be challenging for agencies  because the types of records involved when information is collected via  Web 2.0 technologies may not be clear. As previously mentioned, in  October 2010, NARA issued further guidance that clarified agency  responsibilities in making records determinations.
Privacy: We noted, among other things, that agencies faced challenges in  ensuring that they are taking appropriate steps to limit the collection and  use of personal information made available through social media. We  stated that privacy could be compromised if clear limits were not set on  how the government uses personal information to which it has access in  social networking environments. Social networking sites, such as  Facebook, encourage people to provide personal information that they  intend to be used only for social purposes. Government agencies that  participate in such sites may have access to this information and may need  rules on how such information can be used. While such agencies cannot  control what information may be captured by social networking sites, they  can make determinations about what information they will collect and  what to disclose. However, unless rules to guide their decisions are clear,  agencies could handle information inconsistently. OMB’s subsequent  release of guidance, as previously discussed, clarified agency requirements  for such privacy protections.
Security: We highlighted that federal government information systems  have been targeted by persistent, pervasive, and aggressive threats and  that, as a result, personal and agency information needs to be safeguarded  from security threats, and that guidance may be needed for employees on  how to use social media Web sites properly and how to handle information  in the context of social media.
Cyber attacks continue to pose a potentially devastating threat to the  systems and operations of the federal government. In February 2011, the  Director of National Intelligence testified that, in the previous year, there  had been a dramatic increase in malicious cyber activity targeting U.S.  computers and networks, including a more than tripling of the volume of  malicious software since 2009.
Further, in March 2011, the Federal Trade Commission (FTC) reached an  agreement with Twitter to resolve charges that the company deceived  consumers and put their privacy at risk by failing to safeguard their  personal information. The FTC alleged that serious lapses in the  company’s security allowed hackers to obtain unauthorized administrative  control of Twitter and send unauthorized tweets from user accounts,  including one tweet, purportedly from President Obama, that offered his  more than 150,000 “followers” a chance to win $500 in free gasoline, in  exchange for filling out a survey. To resolve the charges, Twitter agreed to  establish and maintain a comprehensive information security program that  would be assessed by an independent auditor every other year for 10  years.
According to a Chief Information Officers (CIO) Council report released in  September 2009, as the federal government begins to utilize public social  media Web sites, advanced persistent threats may be targeted against  these Web sites. In addition, attackers may use social media to collect  information and launch attacks against federal information systems. Table  1 summarizes three types of security threats identified by the CIO Council  that agencies may face when using commercially provided social media  services.
The rapid development of social media technologies makes it challenging to  keep up with the constantly evolving threats deployed against them and  raises the risks associated with government participation in such  technologies.
section_title: Federal Agencies Have Used Social Media Services for a Variety of Purposes
paragraphs: Federal agencies have been using social media services to support their  individual missions. While Facebook, Twitter, and YouTube offer unique  ways for agencies to interact with the public, we identified several distinct  ways that federal agencies are using the three social media services.  Despite varying features of the three platforms, agency interactions can be  broadly categorized by the manner in which information is exchanged  with the public, including reposting information already available on an  agency Web site, posting original content not available on agency Web  sites, soliciting feedback from the public, responding to comments, and  linking to non-government Web sites. Figure 1 shows how the 23 agencies  use each of these functions.
subsections: section_title: Reposting Information Available on Agency Web sites
paragraphs: All 23 agencies used social media to re-post information that is also  available on an official agency Web site. This information typically  included press releases that agencies issue on mission-related topics or  posts to an agency’s blog. Each of the three services was used for  reposting information by the agencies.
Facebook was used to repost information and direct the public to an  agency’s official Web site. For example, the Social Security Administration  (SSA) posted a notice on its Facebook page that briefly discussed Social  Security benefits and provided a link to SSA’s Web site. The same  information was also posted on the SSA Web page.
Twitter was used to repost information in an abbreviated format,  accompanied by a link to an official agency Web page where the full  content was available. For example, the Department of the Interior posted  a message (or “tweet”) about an order that the Secretary of the Interior  had issued and provided a link to the agency’s Web site where the full  order was available.
YouTube was generally used to provide an alternate means of accessing  videos that were available on the agencies’ Web sites. For example, the  Department of Defense (DOD) uploaded a video to its YouTube channel— the Pentagon Channel—that described what was going on at the Pentagon  during a particular week. The video was also posted on a DOD Web site  dedicated to broadcasting military news and information for members of  the armed forces.
section_title: Posting Content Not Available on Agency Web sites
paragraphs: In addition to reposting information, agencies also used social media to  post original content that is not available on their Web sites. All 23  agencies used social media to post content not available on the agency’s  Web site. Twitter was used most often for this purpose.
Facebook was used to post content such as pictures and descriptions of  officials on tours or inspections. For example, the Facebook page for the  Department of Housing and Urban Development (HUD) featured a picture  of the HUD Secretary with President Obama and others while visiting a  renovated public housing development during a trip to New Orleans to  observe efforts to rebuild the city following Hurricane Katrina. This  picture and explanation were not posted to any of HUD’s Web sites.
Twitter was often used by agencies to post ephemeral or time-sensitive  information. For example, DOD used its Twitter account to encourage its  subscribers to sign up to be extras in a movie filming in Washington, D.C.  This information and encouragement were not posted on the department’s  Web site.
YouTube was often used to publish videos of officials discussing topics of  interest to the public. An example of this is a video posted to the  Department of Energy’s (DOE) YouTube channel on August 2, 2010, in  which an official discussed a project for a battery-based energy storage  system. Neither this video nor a transcript of the video was found on a  DOE Web site.
section_title: Soliciting Comments
paragraphs: Agencies also used Facebook, Twitter, and YouTube to request comments  from the public. This feedback may be received either through the social  media service itself or through an agency Web site. Twenty-two of 23  agencies used social media to solicit comments from the public. Of the 22  agencies soliciting feedback, most used Twitter for this purpose.
Facebook was generally used for feedback solicitation both when the  agency wanted the public to provide comments directly via the social  media site and when the agency wanted the public to provide comments  through an agency Web site. For example, the Department of Veterans  Affairs asked on its Facebook page if the readers liked the redesign of the  agency’s main Web site. The post received over 50 comments.
Twitter was generally used for feedback solicitation when the agency  wanted the public to provide comments through an agency Web site. For  example, the Department of Education posted a tweet that requested both  teachers and parents to comment on their views of what an effective  parent-teacher partnership looks like. The post included a link to the  department’s blog on its Web site, where individuals could leave  comments.
YouTube was also used for feedback solicitation. For example, the  Department of Transportation uploaded a video to its YouTube channel  asking the public to create and upload videos describing how distracted  driving has affected their lives. The video received multiple comments  from the public expressing their views on driving and using their cell  phones at the same time.
section_title: Responding to Comments on Posted Content
paragraphs: Agencies also used social media to respond to comments from the public  that were posted on the agencies social media sites to address both  administrative and mission-related topics. In these instances, agency  responses to public comments were posted to the same social media Web  pages where the original comments appeared. Seventeen of the 23  agencies posted responses to public comments on their social media sites.  These agencies generally used Facebook or Twitter the most for this  activity, with few agencies responding to comments received on their  YouTube channels.
Agencies used Facebook to respond to comments received on their  Facebook pages. For example, HUD posted information on its Facebook  page regarding the department’s allocation of funding for rental assistance  for non-elderly persons with disabilities with a link to additional  information located on the department’s Web site. In response, individuals  posted questions and comments, and HUD responded.
Twitter was also used by agencies to respond to comments. For example,  a tweet posted by the Small Business Administration (SBA) in response to  a comment received from a Twitter user stated that the agency was still  tweaking the functionality of a system and as a means to provide better  customer service asked what e-mail address the individual used.
section_title: Providing Links to Non- Government Web sites
paragraphs: The agencies we reviewed also used social media sites to post links to  non-government Web sites (i.e., a Web site whose address does not end in  .gov or is not an agency initiative). For example, agencies often provided  links to relevant articles located on news media Web sites. All 23 agencies  used social media to post links to non-government Web sites. Of the three  social media services, Twitter was used the most, while few agencies used  YouTube for this purpose.
Twitter was often used by agencies to post links to Web sites, as many of  the tweets that Twitter subscribers receive contain links to Web sites  providing further information. For example, the Secretary of  Transportation posted a Twitter message about a non-government  organization’s Web site, along with a link to the site.
section_title: Federal Agencies Have Made Mixed Progress in Developing Policies and Procedures for Managing and Protecting Information Associated with Social Media Use
paragraphs: Federal agencies have made mixed progress in developing records  management guidance and assessing privacy and security risks associated  with their use of commercially provided social media services.  Specifically, 12 of the 23 major federal agencies that use Facebook,  Twitter, and YouTube have developed and issued guidance to agency  officials that outlines (1) processes and policies for how social media  records are identified and managed and (2) record-keeping roles and  responsibilities. Further, 12 agencies have updated their privacy policies to  describe whether they use personal information made available through  social media. In addition, eight agencies conducted privacy impact  assessments to identify potential risks associated with agency use of the  three services. Finally, seven agencies assessed and documented security  risks associated with use of the three services and identified mitigating  controls to address those risks. Table 2 outlines the extent to which each  of the 23 major federal agencies have developed policies and procedures  for use of social media.
subsections: section_title: Agencies Have Made Progress in Establishing Guidance for Managing Social Media Records
paragraphs: We previously reported that agencies faced challenges in assessing  whether the information they generate and receive by means of these  services constitutes federal records and establishing mechanisms for  capturing and preserving such records. NARA’s October 2010 bulletin on  managing social media records highlighted, among other things, the need  to ensure that social media policies and procedures articulate clear  records management processes and policies and recordkeeping roles and  responsibilities. Establishing such guidance can provide a basis for  consistently and appropriately categorizing and preserving social media  content as records.
Twelve of the 23 major federal agencies have taken steps to include  records management guidance in their social media policies and  procedures. The scope and breadth of the guidance provided varied with  each agency. Specifically, eight of the agencies included general  statements directing officials responsible for social media content to  conform to agency records management policies in identifying records and  how to manage them. For example, the Department of Health and Human  Services’ social media policy stated that “records management  requirements for social media technologies are similar to any other  information system and shall be in conformance with existing policy” and  provided a Web link to the department’s records management policies.  Four agencies provided more specific guidance to officials on what social  media content constitutes a federal record at their respective agencies.  For example, the Department of Justice issued a policy in August 2009 that  included a set of questions department officials are to answer in  determining the record status of content posted on agency social media  pages. Officials were asked to assess, among other things, (a) whether the  agency content was original and not published on other agency Web sites,  (b) the duration of time the content would need to be retained, and (c)  what agency entity would be responsible for preserving and monitoring  the information posted on the social media site.
Officials from 10 of the 11 agencies that have not yet documented social  media guidance for records management reported taking actions to  develop such guidance. Officials from 1 other agency (the National  Science Foundation) stated that they intended to prepare guidance but did  not report taking any actions to do so.
However, agency officials are still likely to need clear direction on how to  assess social media records when using new technology. NARA noted in a  September 2010 study that records management staff in agencies have  been overwhelmed by the speed at which agency employees are adopting  new social media technologies and that social media adopters have  sometimes ignored records management concerns. Until agencies ensure  that records management processes and policies and recordkeeping roles  and responsibilities are articulated within social media policies, officials  responsible for creating and administering content on agency social media  sites may not be making appropriate determinations about social media  records.
subsections: section_title: Agencies Continue to Face Challenges in Establishing Mechanisms for Capturing and Preserving Social Media Records
paragraphs: Once the need to preserve information as federal records has been  established, mechanisms need to be put in place to capture such records  and preserve them properly. We previously testified that establishing such  mechanisms may be challenging for agencies because the types of records  involved when information is collected via technologies like social media  services may not be clear. Officials at agencies that issued records  management guidance for social media generally agreed that determining  how to preserve social media content as records remains an issue. For  example, officials at the Department of the Interior stated that having  information with federal record value on non-government systems—such  as those of commercial providers of social media—can create challenges  in determining who has control over the information and how and when  content should be captured for record-keeping. Participants at a  roundtable discussion hosted by the National Academy of Public  Administration on our behalf also confirmed capturing records as a  challenge. One participant suggested that further guidance from NARA to  include specific “use cases” as examples would benefit agencies in  understanding what approaches can be taken to properly capture and  preserve social media records.
NARA recently identified the need for further study of potential  mechanisms for capturing social media content as records. In its  September 2010 study, NARA noted that an agency may not have sufficient  control over its content to apply records management principles due to the  nature of a third-party site. Furthermore, social media technology can  change quickly with functionality being added or changed that could have  an impact on records management. As a result, NARA concluded that it  should continue to work with other federal agencies to identify best  practices for capturing and managing these records. Within its October  2010 bulletin, NARA presented a list of options for how to preserve social  media records, such as Web capture tools to create local versions of sites  and convert content to other formats. NARA officials stated that activities  are underway to provide further assistance to agencies in determining  appropriate methods for capturing social media content as federal  records. Specifically, in January 2011 NARA initiated a working group in  partnership with the Federal Records Council to evaluate Web 2.0 issues  regarding records management and develop strategies for capturing social  media content as federal records. However, NARA has yet to establish a  time frame for issuing new guidance as a result of these efforts. Until  guidance is developed that identifies potential mechanisms for capturing  social media content as records, potentially important records of  government activity may not be appropriately preserved.
section_title: Agencies Have Made Mixed Progress in Updating Privacy Policies and Assessing Privacy Risks Associated with Use of Social Media Services
paragraphs: Social media services often encourage people to provide extensive  personal information that may be accessible to other users of those  services. Government agencies that participate in such sites may have  access to this information and may need to establish controls on how such  information can be used. We previously reported that, while such agencies  cannot control what information may be captured by social networking  sites, they can make determinations about what information they will  collect and how it will be used. In June 2010, OMB issued memorandum  M-10-23, which specified a variety of actions agencies should take to  protect individual privacy whenever they use third-party Web sites and  applications to engage with the public. Two key requirements established  by OMB were the need for each agency to (1) update its privacy policy in  order to provide the public with information on whether the agency uses  PII made available through its use of third-party Web sites for any purpose,  and (2) conduct privacy impact assessments (PIA) whenever an agency’s  use of a third-party Web site makes PII available to the agency.
Assessing privacy risks is an important element of conducting a PIA  because it helps agency officials determine appropriate privacy protection  policies and techniques to implement those policies. A privacy risk  analysis should be performed to determine the nature of privacy risks and  the resulting impact if corrective actions are not implemented to mitigate  those risks. Such analysis can be especially helpful in connection with the  use of social media because there is a high likelihood that PII will be made  available to the agency.
Twelve out of 23 agencies updated their privacy policies to include  discussion on the use of personal information made available through  social media services. In general, agencies stated that while PII was made  available to them through their use of social media services, they did not  collect or use the PII. For example, HUD updated the privacy policy on its  main Web site, www.hud.gov, to state that “no personally identifiable  information (PII) may be requested or collected from  social  media sites.” As another example, the Department of Energy included a  discussion of its policy of removing PII that may be posted on its social  media page, noting that officials reserved the right to moderate or remove  comments that include PII.
Officials from 5 of the 11 agencies that have not updated their privacy  policies reported taking actions to do so. Officials from 6 additional  agencies (the Departments of Commerce, Health and Human Services,  Labor, and Transportation; the National Aeronautics and Space  Administration, and the Social Security Administration) stated that they  intended to update their privacy policies but did not report taking any  actions to do so.
Eight agencies conducted PIAs to assess the privacy risks associated with  their use of the three services. For example, the Department of Homeland  Security (DHS) published a PIA that assessed the risks of the agency’s use  of social networking tools, including the potential for agency access to the  personal information of individuals interacting with the department on  such sites. To mitigate this risk, the department established a policy of  prohibiting the collection of personal information by DHS officials using  social media sites. Likewise, the Department of Transportation completed  a PIA for the use of third-party Web sites and applications, including  Facebook, Twitter, and YouTube. The PIA outlined, among other things,  what types of PII may potentially be made available to the agency through  its use of social media, including the name, current residence, and age of  users who may friend, follow, subscribe to or otherwise interact with an  official department page on a third-party site. In these instances, the  department’s PIA directed officials to avoid capturing and using the PII  and to redact any PII contained in screenshots that may be saved for  recordkeeping purposes.
Officials from 13 agencies had not completed PIAs for their use of any of  the social media services, while an additional 2 agencies performed  assessments that only evaluated risks associated with using Facebook.  Officials from 10 of these agencies reported taking actions to conduct the  assessments. Officials from 2 other agencies (the Department of State  and the Small Business Administration) stated that they intended to  conduct assessments but did not report taking any actions to do so.  Officials from the other 3 agencies (the Departments of Agriculture and  the Treasury; and the General Services Administration) stated that they  did not plan to conduct PIAs because they were not planning to collect  personal information provided on their social media sites and, therefore,  an assessment was unnecessary.
However, OMB’s guidance states that when an agency takes action that  causes PII to become accessible to agency officials—such as posting  information on a Facebook page that allows the public to comment—PIAs  are required. Given that agency officials have access to comments that  may contain PII and could collect and use the information for another  purpose, it is important that an assessment be conducted, even if there are  no plans to save the information to an agency system.
Without updating privacy policies and performing and publishing PIAs,  agency officials and the public lack assurance that all potential privacy  risks have been evaluated and that protections have been identified to  mitigate them.
section_title: Agencies Have Made Mixed Progress in Assessing Security Risks Associated with Use of Commercially Provided Social Media Services
paragraphs: Pervasive and sustained cyber attacks continue to pose a potentially  devastating threat to the systems and operations of the federal  government. As part of managing an effective agencywide information  security program to mitigate such threats, FISMA requires that federal  agencies conduct periodic assessments of the risk and magnitude of harm  that could result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of agency information and information  systems. To help agencies implement such statutory requirements, NIST  developed a risk management framework for agencies to follow in  developing information security programs. As part of this framework,  federal agencies are to assess security risks associated with information  systems that process federal agency information and identify security  controls that can be used to mitigate the identified risks. In associated  guidance, NIST highlighted that using such a risk-based approach is also  important in circumstances where an organization is employing  information technology beyond its ability to adequately protect essential  missions and business functions, such as when using commercially  provided social media services. By identifying the potential security  threats associated with use of such third-party systems, agencies can  establish proper controls and restrictions on agency use.
Seven out of 23 agencies performed and documented security risk  assessments concerning their use of the three social media services. For  example, the Department of Labor outlined the agency’s use of the three  tools within one risk assessment, evaluating potential threats and  vulnerabilities, and recommended controls to mitigate risks associated  with those threats and vulnerabilities. The department identified, among  other things, the potential risk of having unauthorized information posted  to its social media page by agency officials with social media  responsibilities and identified the need for such individuals to receive  training on proper use of social media sites. Additionally, a Department of  Health and Human Services security document stated that, due to risks  associated with use of social media, including the potential for social  media sites to be used as a vehicle for transmitting malicious software, the  department would block use of social media sites—including Facebook,  Twitter, and YouTube—by employees, with specific allowances made for  those with documented business needs.
According to officials, 16 agencies had not completed and documented  assessments for their use of any of the social media services. Officials  from 12 of these agencies reported that they were taking actions to  conduct security risk assessments but had not yet completed them.  Officials from 2 additional agencies (the Department of Commerce and the  National Science Foundation) stated that they intended to conduct  assessments but did not report taking any actions to do so. Officials at 1  other agency (the Department of State) reported that they did not plan to  conduct assessments because their internal policies and procedures did  not require them to perform risk assessments. As we previously stated,  however, NIST guidance requires the application of the risk management  process to social networking uses to establish proper controls and  restrictions on agency use. Officials from 1 other agency (the Department  of Transportation) reported that they had conducted a security risk  assessment but did not document the results. Without such  documentation, the agency may lack evidence of the justification and  rationale for decisions made based on the risk assessment and,  consequently, the assurance that security controls have been implemented  to properly address identified security threats.
Without conducting and documenting a risk assessment, agency officials  cannot ensure that appropriate controls and mitigation measures are in  place to address potentially heightened threats associated with social  media, including spear phishing and social engineering.
section_title: Conclusions
paragraphs: Federal agencies are increasingly making use of social media technologies,  including Facebook, Twitter, and YouTube, to provide information about  agency activities and interact with the public. While the purposes for  which agencies use these tools vary, they have the potential to improve the  government’s ability to disseminate information, interact with the public,  and improve services to citizens.
However, the widespread use of social media technologies also introduces  risks, and agencies have made mixed progress in establishing appropriate  policies and procedures for managing records, protecting the privacy of  personal information, and ensuring the security of federal systems and  information. Specifically, just over half of the major agencies using social  media have established policies and procedures for identifying what  content generated by social media is necessary to preserve in order to  ensure compliance with the Federal Records Act, and they continue to  face challenges in effectively capturing social media content as records.  Without clear policies and procedures for properly identifying and  managing social media records, potentially important records of  government activity may not be appropriately preserved. In addition, most  agencies have not updated their privacy policies or assessed the impact  their use of social media may have on the protection of personal  information from improper collection, disclosure, or use, as called for in  recent OMB guidance. Performing PIAs and updating privacy policies can  provide individuals with better assurance that all potential privacy risks  associated with their personal information have been evaluated and that  protections have been identified to mitigate them. Finally, most agencies  did not have documented assessments of the security risks that social  media can pose to federal information or systems in alignment with FISMA  requirements, which could result in the loss of sensitive information or  unauthorized access to critical systems supporting the operations of the  federal government. Without conducting and documenting a risk  assessment, agency officials cannot ensure that appropriate controls and  mitigation measures are in place to address potentially heightened threats  associated with social media, such as spear phishing and social  engineering.
section_title: Recommendations for Executive Action
paragraphs: To ensure that federal agencies have adequate guidance to determine the  appropriate method for preserving federal records generated by content  presented on agency social media sites, we recommend that the Archivist  of the United States develop guidance on effectively capturing records  from social media sites and that this guidance incorporate best practices.
We are also making 32 recommendations to 21 of the 23 departments and  agencies in our review to improve their development and implementation  of policies and procedures for managing and protecting information  associated with social media use. Appendix II contains these  recommendations.
section_title: Agency Comments and Our Evaluation
paragraphs: We sent draft copies of this report to the 23 agencies covered by our  review, as well as to the National Archives and Records Administration.  We received written or e-mail responses from all the agencies. A summary  of their comments and our responses, where appropriate, are provided  below.
In providing written comments on a draft of this report, the Archivist of  the United States stated that NARA concurred with the recommendation  to develop guidance on effectively capturing records from social media  sites and that the agency would incorporate best practices in this  guidance. NARA’s comments are reprinted in appendix III.
Of the 21 agencies to which we made recommendations, 12 (the  Departments of Defense, Education, Energy, Homeland Security, Housing  and Urban Development, and Veterans Affairs; the Environmental  Protection Agency; the National Aeronautics and Space Administration;  the National Science Foundation; the Office of Personnel Management; the  Social Security Administration; and the U.S. Agency for International  Development) agreed with our recommendations.
Two of the 21 agencies (the Departments of Commerce and Health and  Human Services) generally agreed with our recommendations but  provided qualifying comments:  In written comments on a draft of the report, the Secretary of Commerce  concurred with our two recommendations but provided qualifying  comments about the second. Regarding our recommendation that the  department conduct and document a security risk assessment to assess  security threats associated with agency use of commercially provided  social media services and identify security controls that can be used to  mitigate the identified threats, he stated that the department had a policy  in place that requires risk-based assessments to be conducted of social  media technologies used by the department in order to determine if  mitigating strategies, such as access or usage limitation, are warranted.  However, the department did not provide documentation demonstrating  that it had completed and documented any of the required risk  assessments. The department’s comments are reprinted in appendix IV.
In an e-mail response on a draft of the report, a Department of Health and  Human Services’ Senior Information Security Officer stated that the  department agreed with our recommendation to update its privacy policy.  However, the department disagreed with the perceived finding that it had  not made progress in conducting a PIA and reported recent efforts to do  so. We did not intend to suggest that the department had not taken any  steps to develop a PIA, and we updated our report to clarify that the  department has taken actions to develop PIAs for its social media use.  However, the agency has not yet completed its PIA and thus may lack  assurance that all potential privacy risks have been evaluated and that  protections have been identified to mitigate them.
Three of the 21 agencies (the Departments of Agriculture and State; and  the General Services Administration) did not concur with all of the  recommendations made to them:  In written comments on a draft of the report, the Department of  Agriculture’s CIO disagreed with our recommendation that the department  conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them. Specifically, the CIO stated that  the department had completed a Privacy Threshold Analysis that indicated  that a PIA was not required since the department did not solicit, collect, or  retain PII through its social media sites. However, as indicated in our  report, OMB’s guidance states that when an agency takes action that  causes PII to become accessible to agency officials—such as posting  information on a Facebook page that allows the public to comment—PIAs  are required. Without a PIA, the department may lack assurance that all  potential privacy risks have been evaluated and that protections have been  identified to mitigate them. The Department of Agriculture’s comments are  reprinted in appendix V.
In written comments on a draft of the report, the Department of State’s  Chief Financial Officer concurred with one of our two recommendations,  but not the other. Specifically, regarding our recommendation that the  department conduct and document a security risk assessment to assess  security threats associated with agency use of commercially provided  social media services and identify security controls that can be used to  mitigate the identified threats, he stated that the department shared GAO’s  concern regarding the security of information in commercially provided  social media but that since the department had already determined that its  use of social media sites would be limited to providing the public with  “low-impact” information, no further risk assessment or certification and  accreditation was required. He further stated that the impact on  confidentiality, integrity, and availability of systems with such non- structured data could only be determined by policy, not by risk analysis  and, therefore, a security risk assessment was not warranted. However,  although limiting the type of information that is processed on third-party  systems can be an effective mitigating security control, without  conducting and documenting a risk assessment, agency officials cannot  ensure that policies and mitigation measures effectively address  potentially heightened threats associated with social media, including  spear phishing and social engineering. The Department of State’s  comments are reprinted in appendix VI.
In written comments on a draft of the report, the Administrator of the  General Services Administration partially agreed with our two  recommendations. Regarding our recommendation that the agency update  its privacy policies to describe whether PII made available through its use  of social media services is collected and used, the Administrator noted  that the agency was updating its privacy directive to describe the agency’s  practices for handling PII made available through the use of social media.  Accordingly, we have updated our report to indicate that the agency has  taken actions to update its privacy policies for its use of social media.  Regarding our recommendation that the agency conduct and document a  privacy impact assessment that evaluates potential privacy risks  associated with agency use of social media services and identifies  protections to address them, the Administrator stated that no PII is sought  by or provided to GSA as a result of the agency’s use of Facebook,  YouTube, and Twitter and, therefore, the agency determined that  conducting a PIA was unnecessary. However, as indicated in our report,  OMB’s guidance states that when an agency takes action that causes PII to  become accessible to agency officials—such as posting information on a  Facebook page that allows the public to comment—PIAs are required.  Without a PIA, the department may lack assurance that all potential  privacy risks have been evaluated and that protections have been  identified to mitigate them. The General Services Administration’s  comments are reprinted in appendix VII.
Four of the 21 agencies did not comment on the recommendations  addressed to them. Specifically, the Departments of Labor and  Transportation reported that they did not have any comments and the  Department of the Treasury and Small Business Administration only  provided technical comments, which we addressed in the final report as  appropriate.
In cases where these 21 agencies also provided technical comments, we  have addressed them in the final report as appropriate. Agencies also  provided with their comments information regarding actions completed or  underway to address our findings and recommendations and we updated  our report to recognize those efforts. Additional written comments are  reprinted in appendices VIII through XVII.
We also received e-mail responses from the 2 agencies to which we did not  make recommendations. Specifically, the Department of the Interior  provided technical comments via e-mail and the Department of Justice  stated that it did not have comments on the draft of this report.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. We will then send copies of this report to other interested  congressional committees, Secretaries of the Departments of Agriculture,  Commerce, Defense, Education, Energy, Health and Human Services,  Homeland Security, Housing and Urban Development, the Interior, Labor,  State, Transportation, the Treasury, and Veterans Affairs; the Attorney  General; the Administrators of the Environmental Protection Agency,  General Services Administration, National Aeronautics and Space  Administration, Small Business Administration, and U.S. Agency for  International Development; the Commissioner of the Social Security  Administration; the Directors of the National Science Foundation and  Office of Personnel Management; and the Archivist of the United States.  The report will also be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions regarding this report, please  contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Key contributors to this report are listed in  appendix XVIII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to:    describe how agencies are currently using commercially provided social    determine the extent to which federal agencies have developed and  implemented policies and procedures for managing and protecting  information associated with the use of commercially provided social  media services.
To address our first objective, we examined the headquarters-level  Facebook pages, Twitter accounts, and YouTube channels associated with  each of the 24 major federal agencies covered by the Chief Financial  Officers Act to describe the types of information agencies disseminated  via the services and the nature of their interactions with the public. We  selected these three services because of their widespread use within the  federal government (23 out of 24 major agencies use each of the services)  as well as their broad popularity with the public. We reviewed content on  the social media pages, including agency posts as well as comments  provided by the public, from July 2010 through January 2011. We  categorized agency use based on types of information found on their social  media pages. These categories were (1) reposting information available on  agency Web sites; (2) posting content not available on agency Web sites;  (3) soliciting comments; (4) responding to comments on posted content;  and (5) providing links to non-government Web sites. Each agency social  media page was reviewed by an analyst to determine whether information  had been posted that fell into one of the five categories. Each identified  example was corroborated by a second analyst. In the event no examples  were identified for an agency in a specific category by the first analyst, the  second analyst conducted an additional independent review of agency  posts to confirm that none existed.
To address our second objective, we reviewed pertinent records  management, privacy, and security policies, procedures, guidance, and  risk assessments in place at each of the 23 federal agencies and compared  them to relevant federal records management, privacy, and security laws,  regulations, and guidance. These included the Federal Records Act, the  Privacy Act of 1974, the E-Government Act of 2002, the Federal  Information Security Management Act of 2002 (FISMA), as well as  guidance from the National Archives and Records Administration (NARA),  Office of Management and Budget (OMB), and National Institute of  Standards and Technology (NIST). We interviewed officials at each of  these agencies to discuss recent efforts to oversee the development of  social media policies and procedures and assess risks. We also reviewed  relevant reports and studies to identify records management, privacy, and  security risks associated with social media use by federal agencies. We  interviewed officials from OMB, NARA, and NIST, and members of the  Chief Information Officer Council to develop further understanding of  federal agency requirements for properly managing and protecting  information associated with social media use. Further, we coordinated  with the National Academy of Public Administration, which hosted a  roundtable discussion on our behalf where views on these issues were  solicited from federal agency officials involved in agency use of social  media. Finally, we interviewed representatives of Facebook, Twitter, and  YouTube to discuss records management, privacy, and security issues and  their current and planned approaches regarding interactions with federal  agencies.
We conducted this performance audit from July 2010 to June 2011 in the  Washington, D.C., area, in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
section_title: Appendix II: Recommendations to Departments and Agencies
subsections: section_title: Department of Agriculture
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Agriculture take the following action:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
section_title: Department of Commerce
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Secretary of Commerce take the following two  actions:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Department of Defense
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Secretary of Defense take the following action:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
section_title: Department of Education
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Education take the following action:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
section_title: Department of Energy
paragraphs: To ensure that appropriate security measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Energy take the following action:    Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Department of Health and Human Services
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Health and Human Services take the following action:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
section_title: Department of Homeland Security
paragraphs: To ensure that appropriate security measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Homeland Security take the following action:    Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Department of Housing and Urban Development
paragraphs: To ensure that appropriate security measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Housing and Urban Development take the following  action:    Conduct and document a security risk assessment to assess security  threats associated with agency use of Twitter and YouTube and identify  security controls that can be used to mitigate the identified threats.
section_title: Department of Labor
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of Labor take the following action:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
section_title: Department of State
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Secretary of State take the following two actions:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of Twitter and YouTube  and identifies protections to address them.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Department of Transportation
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Secretary of Transportation take the following two  actions:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Department of the Treasury
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Secretary of the Treasury take the following action:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
section_title: Department of Veterans Affairs
paragraphs: To ensure that appropriate records management and privacy measures are  in place when commercially provided social media services are used, we  recommend that the Secretary of Veterans Affairs take the following two  actions:    Add records management guidance to agency social media policies that  describes records management processes and policies and recordkeeping  roles and responsibilities.
Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
section_title: Environmental Protection Agency
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Administrator of the Environmental Protection  Agency take the following two actions:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: General Services Administration
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Administrator of the General Services Administration take the  following two actions:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
section_title: National Aeronautics and Space Administration
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Administrator of the National Aeronautics and Space  Administration take the following three actions:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: National Science Foundation
paragraphs: To ensure that appropriate records management and security measures  are in place when commercially provided social media services are used,  we recommend that the Director of the National Science Foundation take  the following two actions:    Add records management guidance to agency social media policies that  describes records management processes and policies and recordkeeping  roles and responsibilities.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Office of Personnel Management
paragraphs: To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Director of the Office of Personnel Management take  the following two actions:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Small Business Administration
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Administrator of the Small Business Administration take the  following action:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
section_title: Social Security Administration
paragraphs: To ensure that appropriate privacy measures are in place when  commercially provided social media services are used, we recommend  that the Commissioner of the Social Security Administration take the  following action:    Update privacy policies to describe whether PII made available through  use of social media services is collected and used.
section_title: U.S. Agency for International Development
paragraphs: To ensure that appropriate records management and security measures  are in place when commercially provided social media services are used,  we recommend that the Administrator of the U.S. Agency for International  Development take the following two actions:    Add records management guidance to agency social media policies that  describes records management processes and policies and recordkeeping  roles and responsibilities.
Conduct and document a security risk assessment to assess security  threats associated with agency use of commercially provided social media  services and identify security controls that can be used to mitigate the  identified threats.
section_title: Appendix III: Comments from the National Archives and Records Administration
section_title: Appendix IV: Comments from the Department of Commerce
paragraphs: The following are GAO’s comments to the U.S. Department of Commerce’s  letter dated May 27, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  The department did not provide documentation demonstrating that it  had completed and documented any of the required risk assessments.
section_title: Appendix V: Comments from the U.S. Department of Agriculture
paragraphs: The following are GAO’s comments to the U.S. Department of  Agriculture’s letter dated May 27, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional documentation and comments provided by  department representatives, we updated our report to indicate that the  department asserted that it is taking actions to develop records  management guidance for social media use, although it has not yet  been completed. We have not evaluated these actions.  2.  After reviewing the updated privacy policy on the Department’s Web  site, we agree that the agency has met the requirement, and we have  modified table 2 in the final report to reflect that the department has  updated its policy.  3.  We believe that a PIA is required. As indicated in our report, OMB’s  guidance states that when an agency takes action that causes PII to  become accessible to agency officials—such as posting information on  a Facebook page that allows the public to comment—PIAs are  required. Without a PIA, the department may lack assurance that all  potential privacy risks have been evaluated and that protections have  been identified to mitigate them.
section_title: Appendix VI: Comments from the Department of State
paragraphs: The following are GAO’s comments to the Department of State’s letter  dated May 31, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional comments provided by department  representatives, we updated our report to indicate that the department  has plans to develop a PIA for its use of YouTube and Twitter.  2.  We believe that conducting and documenting a risk assessment is  necessary. Although limiting the type of information that is processed  on third-party systems can be an effective mitigating security control,  without conducting and documenting a risk assessment, agency  officials cannot ensure that appropriate controls and mitigation  measures are in place to address potentially heightened threats  associated with social media, including spear phishing and social  engineering.
section_title: Appendix VII: Comments from the General Services Administration
paragraphs: The following are GAO’s comments to the General Services  Administration’s letter dated June 3, 2011.
subsections: section_title: GAO Comments
section_title: Appendix VIII: Comments from the Department of Defense
paragraphs: The following are GAO’s comments to the Department of Defense’s letter  dated May 27, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  We updated our report to indicate that the department asserted that it  is taking actions to develop a PIA for its social media use, although it  has not yet been finalized. We have not evaluated these actions.  2.  After reviewing the additional documentation provided, we agree that  the department met the requirement of conducting and documenting a  security risk assessment. We modified the report, as appropriate, and  removed the recommendation.
section_title: Appendix IX: Comments from the Department of Education
paragraphs: The following are GAO’s comments to the Department of Education’s  letter dated May 25, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing the privacy policy on the department’s Web site, we  updated our report to indicate that the department asserted that it is  taking actions to develop privacy policies addressing the agency’s use  of PII made available through social media services. We confirmed  these actions.  2.  After reviewing additional efforts stated by the department, we  updated our report to indicate that the department asserted that it is  taking actions to develop records management guidance for social  media use, although such guidance has not yet been finalized. We have  not evaluated these actions.  3.  After reviewing additional efforts stated by the department, we  updated our report to indicate that the department asserted that it is  taking actions to conduct and document a PIA related to its use of  social media, although it has not yet been finalized. We have not  evaluated these actions.  4.  After reviewing additional efforts stated by the department, we  updated our report to indicate that the department asserted that it is  taking actions to conduct and document a security risk assessment  related to its use of social media, although the assessment has not yet  been finalized. We have not evaluated these actions.
section_title: Appendix X: Comments from the Department of Homeland Security
paragraphs: The following are GAO’s comments to the Department of Homeland  Security’s letter dated June 6, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional efforts stated by the department, we  updated our report to indicate that the department asserted that it is  taking actions to conduct and document a security risk assessment  related to its use of social media, although the assessment has not yet  been finalized. We have not evaluated these actions.
section_title: Appendix XI: Comments from the Department of Housing and Urban Development
paragraphs: The following are GAO’s comments to the Department of Housing and  Urban Development’s letter dated May 27, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing the additional documentation provided, we updated  our report to indicate that the department asserted that it is taking  actions to conduct and document a security risk assessment related to  its use of social media. We confirmed these actions.
section_title: Appendix XII: Comments from the Department of Veterans Affairs
paragraphs: The following are GAO’s comments to the Department of Veterans Affairs’  letter dated May 31, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional comments provided by department  representatives, we updated our report to indicate that the department  asserted that it is taking actions to develop records management  guidance for social media use, although the guidance has not yet been  finalized. We have not evaluated these actions.  2.  After reviewing additional comments provided by department  representatives, we updated our report to indicate that the department  asserted that it is taking actions to develop a PIA for its social media  use, although the PIA has not yet been finalized. We have not evaluated  these actions.
section_title: Appendix XIII: Comments from the Environmental Protection Agency
paragraphs: The following are GAO’s comments to the Environmental Protection  Agency’s letter dated May 25, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional comments provided by agency  representatives, we updated our report to indicate that the agency  asserted that it is taking actions to develop a PIA for its social media  use, although the PIA has not yet been finalized. We have not evaluated  these actions.  2.  After reviewing additional comments provided by agency  representatives, we updated our report to indicate that the agency  asserted taking actions to develop a security risk assessment for social  media use, although the assessment has not yet been finalized. We  have not evaluated these actions.
section_title: Appendix XIV: Comments from the National Aeronautics and Space Administration
paragraphs: The following are GAO’s comments to the National Aeronautics and Space  Administration’s letter dated May 31, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional efforts stated by the agency, we updated our  report to indicate that the agency has plans to develop privacy policies  addressing the agency’s use of PII made available through social media  services.  2.  After reviewing additional comments provided by agency  representatives, we updated our report to indicate that the agency  asserted that it is taking actions to develop a PIA for its social media  use, although the PIA has not yet been finalized. We have not evaluated  these actions.  3.  After reviewing additional comments provided by agency  representatives, we updated our report to indicate that the agency  asserted that it is taking actions to develop a security risk assessment  for social media use, although the assessment has not yet been  finalized. We have not evaluated these actions.
section_title: Appendix XV: Comments from the Office of Personnel Management
paragraphs: The following are GAO’s comments to the Office of Personnel  Management’s letter dated May 24, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional comments and materials provided by  agency representatives, we updated our report to indicate that the  agency asserted that it is taking actions to develop both a PIA and a  security risk assessment for its social media use. We have not  evaluated these actions.
section_title: Appendix XVI: Comments from the Social Security Administration
paragraphs: The following are GAO’s comments to the Social Security Administration’s  letter dated May 26, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional comments stated by the agency, we updated  our report to indicate that the agency has plans to develop privacy  policies addressing the agency’s use of PII made available through  social media services.
section_title: Appendix XVII: Comments from the U.S. Agency for International Development
paragraphs: The following are GAO’s comments to the U.S. Agency for International  Development’s letter received on May 27, 2011.
subsections: section_title: GAO Comments
paragraphs: 1.  After reviewing additional comments provided by agency  representatives, we updated our report to indicate that the agency  asserted that it is taking actions to develop records management  guidance for social media use. We have not evaluated these actions.  2.  After reviewing additional comments provided by agency  representatives, we updated our report to indicate that the agency  asserted that it is taking actions to develop a security risk assessment  for social media use, although the assessment has not yet been  finalized. We have not evaluated these actions.
section_title: Appendix XVIII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact above, John de Ferrari, Assistant Director;  Sher`rie Bacon; Marisol Cruz; Jennifer Franks; Fatima Jahan; Nicole Jarvis;  Nick Marinos; Lee McCracken; Thomas Murphy; Constantine  Papanastasiou; David Plocher; Dana Pon; Matthew Strain; and Jeffrey  Woodward made key contributions to this report.