Information Technology: Copyright Office Needs To Develop Plans that Address Technical and Organizational Challenges
Published: 2015-03-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The mission of the Copyright Office, a service unit within the Library of Congress, is to promote creativity by administering and sustaining a national copyright system. As part of this mission, the Copyright Office registers about 500,000 creative works a year for copyright and records documentation related to copyright transfer and sale. In recent years, the Register of Copyrights has discussed the need for a modernized Copyright Office, to include upgrades to the current IT environment.
The Senate Appropriations Committee report accompanying the 2015 legislative branch appropriations bill required GAO to review the Copyright Office's current IT environment and plans for the future. This report (1) describes the legal, technical, and organizational aspects of the Copyright Office's current IT environment, and (2) describes and evaluates the Copyright Office's plans for modernization. To carry out its work, GAO reviewed Library policies and related best practices, comments by stakeholders, IT funding requests, and other relevant documentation, and interviewed key Library and Copyright Office officials.
section_title: What GAO Found
paragraphs: The Copyright Office has a legal mission supporting the creative industries that significantly contribute to the United States economy and relies heavily on information technology (IT) to carry out this mission. For example, by law, the office must be able to receive and examine copyright registration applications, collect and maintain deposited copies of copyrighted works, and maintain records of the transfer of copyright ownership. To meet these mission requirements, the office relies on several IT systems, as well as the infrastructure managed by the Library of Congress's central IT office. However, GAO and others have identified challenges with this environment. For example, comments solicited by the Copyright Office from external users have described limitations in the performance and usability of the office's electronic copyright registration system, and the Copyright Office has expressed concerns about the integrity of the files stored in the Library's servers. Organizationally, responsibility for managing the office's IT environment is shared between the Copyright Office's Office of the Chief Information Officer (CIO) and the Library's central IT office. The Library has serious weaknesses in its IT management, which have hindered the ability of the Library and the Copyright Office to meet mission requirements. For example, the Library has not had a permanent CIO in over 2 years.
The Copyright Office requested over $7 million in fiscal years 2015 and 2016 to address four key challenges: (1) reengineer recordation—one of the office's key business processes—to include developing an online filing capability; (2) develop a secure digital repository for its electronic materials (e.g., books and music); (3) develop a software application development environment; and (4) establish a data management team, to include developing data standards. The office has also published a report that summarizes stakeholder comments on the current IT environment and makes several recommendations to improve this environment.
However, the office has not adequately justified these proposed investments. Specifically, it has not identified the business needs they are intended to meet, expected costs, or how they align with the agency's strategic plan, as called for by Library IT investment management policy. The office also did not present the investments to the Library's IT investment review board, which was established to select investments for funding that meet defined criteria and ensure that such investments are not duplicative of existing investments or activities performed within the Library. Copyright officials stated that these initiatives were in early stages and the office was not yet in a position to develop this information. However, without identifying key costs and benefits of proposed initiatives and presenting this information to the Library-wide investment review board, decision makers at the Library and the Copyright Office do not have the assurance that the selected investments support the organization's goals and do not duplicate existing activities. In addition, the office does not have an IT strategic plan, and officials described difficulties in developing such a plan given that the Library has not yet developed one. As noted in a recent GAO review of the Library's IT management, the Library has recently committed to developing an updated IT strategic plan, and it will be important for the Copyright Office's own strategic planning to be aligned with this effort.
section_title: What GAO Recommends
paragraphs: GAO recommends that the Copyright Office (1) develop key information to support proposed initiatives for improving its IT environment and submit them to the Library's IT investment review board for review, and (2) develop an IT strategic plan that is aligned with the Library's strategic planning efforts. The office neither agreed nor disagreed. GAO continues to believe its recommendations are warranted.

section_title: Letter
paragraphs: The mission of the U.S. Copyright Office, a service unit within the Library  of Congress, is to promote creativity by administering and sustaining a  national copyright system. As part of this mission, the Copyright Office  registers about 500,000 creative works a year for copyright, records  documentation related to copyright transfer and sale, acts as an  intermediary for licensing agreements, and provides advice to both  Congress and the public about copyright-related issues. In recent years,  the Register of Copyrights has discussed the need for a modernized  Copyright Office, to include upgrades to its current information technology  (IT) environment.
The Senate Committee report that accompanied the fiscal year 2015  legislative branch appropriations bill stated that the Committee wanted to  ensure that taxpayer investments in modernizing the Copyright Office will  be used efficiently and effectively, and mandated that GAO review the  Copyright Office’s current IT environment and provide an evaluation of  the Copyright Office’s plans for modernization. Our specific objectives  were to (1) describe the legal, technical, and organizational aspects of the  Copyright Office’s current IT environment and (2) describe and evaluate  the Copyright Office’s plans for modernization.
To describe aspects of the current IT environment, we reviewed  documentation related to the responsibilities for IT management set out in  the Library’s policies and related legal requirements. We reviewed  comments by internal and external stakeholders on the Copyright Office’s  systems, as well as system documentation. To describe and evaluate the  office’s plans for modernization, we reviewed related federal laws and  guidance, best practices, and Library policies and procedures. We  compared the Copyright Office’s planning efforts against these criteria.  We also interviewed Library of Congress and Copyright Office officials.  More details about our objectives, scope, and methodology are located in  appendix I.
We conducted this performance audit from June 2014 to March 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The Copyright Office was established in 1897, and is currently one of  seven service units within the Library of Congress. To carry out its  mission, the Copyright Office has several functions set out in law,  including (1) administering the nation’s copyright registration and  recordation processes, (2) developing regulations related to copyright  policies and procedures, (3) advising Congress on copyright issues, and  (4) administering statutory licenses for cable and satellite retransmissions  and digital audio recording technology. Importantly, the Copyright Office  is also a driver in adding materials to the Library’s collections, as about 20  percent of these works are received in accordance with the legal  requirement that copies of certain copyrighted works be deposited with  the office for the Library.
subsections: section_title: Mission of the Copyright Office
paragraphs: The Copyright Office is charged with administering the nation’s copyright  law. As part of that responsibility, it performs a number of key functions,  including copyright registration, recordation, and statutory licensing.
Registration. The Copyright Office examines applications for  registering copyrights, along with any accompanying copies of the  work (called the deposit), to determine whether they satisfy statutory  requirements. Copyright registration is a legal formality intended to  make a public record of the basic facts of a particular copyright, but is  not required by law or as a condition of copyright protection.  According to the Copyright Office, in fiscal year 2014, the Copyright  Office registered about 476,000 creative works for copyright, including  about 219,000 literary works and 65,000 sound recordings.
Recordation. Authors, heirs, and other parties submit a variety of  documents to the Copyright Office for public recordation, including  copyright assignments, licenses, security interests, and termination of  transfers. Like registration, a copyright owner is not required to record  such changes to ownership, but there are certain incentives in the law  for those who do. The Copyright Office recorded about 7,600  copyright records in fiscal year 2014.
Statutory Licenses. The Copyright Office administers several  statutory licenses set forth in the Copyright Act that manage and  disperse royalty payments, including those pertaining to copyright  owners’ rights related to television programming that is retransmitted  by cable operators and satellite carriers. The disposition of these  private funds is determined by a board of copyright royalty judges,  called the Copyright Royalty Board. The work of the board is  reviewable by the Register, but the board reports to the Librarian as  head of the agency. According to the Copyright Office, in fiscal year  2014, it collected approximately $315 million in royalties and made  disbursements in accordance with the decisions of the Copyright  Royalty Board.
In addition to registration, recordation, and statutory licensing, the office  also performs other functions. For example, the Register is charged with  advising Congress on national and international issues relating to  copyright and provides assistance to federal departments, the judiciary,  and the public on such topics. The office also requests published works  on behalf of the Library of Congress to meet the mandatory deposit  provisions of the Copyright Act.
section_title: Organization of the Copyright Office
paragraphs: The Copyright Office, by law, is part of the Library of Congress. The  Register of Copyrights, who heads the office, and all other employees of  the office are appointed by the Librarian of Congress and act under the  Librarian’s general direction and supervision. While the Register is  responsible for all administrative functions and duties under the Copyright  Act (except as otherwise specified), all regulations established by the  Register are subject to the approval of the Librarian, who is also directed  by law to make rules and regulations for the government of the Library.
The Register relies on about 380 staff across seven program areas to  carry out the office’s mission. A simplified view of the office’s organization  is provided in figure 1.
The seven program areas have various responsibilities related to meeting  the Copyright Office’s statutory mission. A description of the key  responsibilities of each program area is found in table 1.
The Copyright Office also receives support from the Library’s  administrative offices. For example:
The Library’s Office of Human Resources Services develops policies  and procedures for and supports hiring, pay, and benefits.
The Library’s Office of the Chief Financial Officer is responsible for  providing policy direction, review, and coordination of all budgetary  and financial activities of the Library, including the development of the  budget and tracking of expenditures.
The Library’s Office of Integrated Support Services provides  assistance with procurement, physical space utilization, and  management of mail.
The Library’s Office of Information Technology Services (ITS) has  primary responsibility for the planning, analysis, design, development,  and maintenance of software systems, hardware,  telecommunications, and networks.
The Copyright Office is funded both by direct appropriations and fees paid  by external customers. Congress generally limits the amount of fees that  the office may obligate in a given year. The office’s budget for fiscal year  2014 was about $45 million, with about 62 percent ($27.9 million) coming  from fees.
section_title: The Copyright Office’s Use of IT Is Driven by Its Legal Mission, but It Is Hindered by Technical and Organizational Challenges
paragraphs: The Copyright Office uses its IT systems to meet important mission  requirements that have been established in law. For example, the  Copyright Act requires the office to receive and examine copyright  registration applications. To meet these mission requirements, the office  relies on several mission-related systems, as well as servers, networks,  and the data center managed by the Library’s central IT office—ITS.  However, we and others have identified challenges with this environment.  For example, external users have described limitations in the  performance and usability of the office’s registration system, and the  Copyright Office has expressed concerns about the integrity of the files  stored in the Library’s servers. Organizationally, responsibility for  managing the office’s IT environment is shared between the Copyright  Office’s Office of the CIO and ITS. However, as we recently reported, the  Library has serious weaknesses in its IT management, which have also  hindered the ability of the Library and the Copyright Office to meet  mission requirements. For example, the Library has not had a permanent  CIO in over 2 years and instead has had a series of temporary CIOs;  according to the Register of Copyrights, this has caused a breakdown in  communication between Library management and the Copyright Office  related to IT.
subsections: section_title: The Copyright Office’s Mission Requirements Are Codified in Law
paragraphs: The Copyright Office’s use of IT is driven by legal requirements that  establish its responsibilities and corresponding business needs. The  office’s IT environment reflects more than a decade of efforts to increase  the use of automated IT to fulfill this legally established mission. For  example, by law, the office must be able to  receive and examine copyright registration applications,  collect and maintain deposited copies of copyrighted works as  necessary to support the production of “facsimile reproductions” and  retention of works up to 120 years, produce certificates of registration and certified copies of applications, maintain records of the transfer of copyright ownership.
In addition, the Copyright Office also administers the mandatory deposit  provisions of the Copyright Act, which require copyright owners to deposit  certain published works with the Library of Congress for its collections. In  this role, the office may facilitate, demand, negotiate, or exempt the  provision of these copies. Absent an exemption, the law requires that one  or two copies of the best edition of every copyrightable work published  in the United States be sent to the office within 3 months of publication,  regardless of whether the creator registers the work. This mandatory  deposit requirement is designed, in part, to serve the Library. Specifically,  according to the Copyright Office, copyright deposit (whether through  registration or mandatory deposit) is a means by which the Library  obtains about 20 percent of its collections.
While the Copyright Office resides within the Library of Congress, it also  has responsibilities that distinguish it from the Library. For example, all  actions taken by the Register to implement the Copyright Act are subject  to the provisions of the Administrative Procedure Act. Among other  things, this means that all actions of the office that would constitute a rule  generally must be published for public notice and comment and are  subject to review. It also means that copyright-related records are  governed by the Freedom of Information Act and the Privacy Act, which  are included in the Administrative Procedure Act. These legal  requirements necessitate actions by the Copyright Office that differ from  otherwise-standard Library processes.
section_title: The Copyright Office Relies on IT, but Its Technical Environment Faces Challenges
paragraphs: The Copyright Office relies extensively on IT to carry out its legal  responsibilities. Specifically, the office uses multiple systems to, among  other things, allow the public to electronically register works with the  office, assist it in examining copyright registrations for such submissions,  and allow the office to record documentation related to copyright transfers  and provide that information to the public. The office manages mission- related systems and, in some cases, procures its own equipment, which  is hosted within the Library’s infrastructure (i.e., networks,  telecommunications, and data center). Table 2 describes selected  systems used by the office to support its registration, recordation, and  licensing functions.
The office uses these systems to meet its major statutory responsibilities,  as described below:
Registration. The primary system used in the registration process is  eCO. To register a copyright, a creator generally submits a completed  application, the relevant fee, and the deposit copies to the Copyright  Office. This can be done in one of three ways: (1) by submitting all  three of these items in physical form (e.g., paper); (2) by submitting all  three items online (through eCO); or (3) by submitting the application  and fee online and providing the deposit in physical form.
Copyright Office staff process these materials based on the method of  submission. For example, for applications received in physical form,  Copyright Office staff must scan the application, enter the application  information and fee payment (check, cash, or deposit account) into  eCO, manually process the related fees, and affix a barcode to the  deposit copy. Regardless of how the materials are submitted, a  registration specialist uses the eCO system to validate the accuracy of  the information entered into eCO and review the application and  materials to ensure that they meet the criteria for copyright  protection. Printed registration certificates are generated and mailed  to the recipient designated on the application, and an image of the  certificate is stored in the Copyright Imaging System.
If the deposit was provided in physical form and is not selected for the  Library’s collections, it is stored in a warehouse and tracked using  either eCO or the Box Number Control System. Digital deposits are  stored in servers within the Library of Congress’s data center.  Information about the copyright registration (for example, author  names and titles of work) is also made available online to the public  through the Copyright Voyager system. Figure 2 below depicts the  copyright registration process.
Recordation. Copyright Office staff currently use several systems to  record documents related to changes in copyright. The public,  however, must submit the documentation to be recorded in physical  form since there is currently no online means for doing so.  Specifically, to record a document, an individual must submit the  related documentation (with an original signature) and the relevant  fee.
Once received by the Copyright Office, the documents must be  scanned and the information must be entered into either eCO or  several legacy systems. Copyright Office officials stated that they are  incorporating the functionality of most of the registration and  recordation systems into eCO. During the transition, however,  Copyright Office staff must use one of two parallel business  processes to record copyright changes. Specifically, if the Copyright  Office received a document during or prior to January 2013, Copyright  staff must type the information into the Copyright Office Documents  System, and the documentation must be scanned twice—once into  eCO and once into the Copyright Imaging System. Then the specialist  must manually number the document and assemble the recordation  package (including certificate, cover sheet, and numbered document)  to be sent back to the submitter. If the office received the document  after January 2013, all data entry and scanning is completed in eCO,  and the recordation package is electronically bundled, printed, and  sent back to the submitter. Similar to the registration process, once  the change is processed, the information is available to the public  using the Copyright Voyager system, which is available online (see  fig. 3).
Licensing. Licensing Division staff members examine statements of  account and process royalty payments. Since 1992, licensing staff  have used the Licensing Division System to examine and process  statements of account. In 2010, the Copyright Office began an  initiative to reengineer its licensing business processes and develop a  new system (called the Electronic Licensing Information System) to  replace the Licensing Division System. The office launched a pilot of  the new system in October 2014 and plans to use information  gathered during that pilot to improve the new system before its  deployment.
According to Copyright Office staff, the office has recently taken steps to  incorporate the functionality from all registration and recordation systems  into eCO. Specifically, according to Copyright Office officials, most of the  systems supporting the registration and recordation processes were  developed in the 1990s, have far exceeded their shelf-life, are running on  obsolete technology, and do not meet current security standards required  by Library policy. Because of these limitations, as already noted, the  Copyright Office plans to incorporate the functionality of these legacy  systems into eCO and ultimately retire them, with the changes expected  to be completed by January 2016. According to the Director of the Office  of Public Records and Repositories at the Copyright Office, moving the  recordation functionality to eCO is an interim step to address immediate  needs. In addition, the Copyright Office CIO stated that supporting the  transition of legacy system functions has required the office to divert  resources otherwise intended to make updates to eCO.
subsections: section_title: The Office’s Current Technical Environment Has Challenges
paragraphs: Our work, Copyright Office employees, and external users have all  identified challenges with the Copyright Office’s current IT environment,  including eCO and the infrastructure supporting that system that is  managed by the Library’s central IT office (ITS), as described below:  Both internal and external users have described challenges with eCO  related to performance, stability, and usability. For example, internal  registration staff said that eCO sometimes freezes multiple times a day,  requiring the staff to restart the system or their computers, which  ultimately decreases productivity. ITS officials noted that they plan to  move eCO onto its own data storage server in an attempt to temporarily  address these issues. However, there is disagreement about whether this  will fix the problem, since the underlying cause was never identified. ITS  officials stated that the suspected underlying cause of the issue is within  the eCO system, which is managed by the Copyright Office, and that this  is just a temporary solution. However, the Copyright Office CIO  disagrees, and believes that eCO having its own server will fix this  problem.
Other users of eCO internal to the Copyright Office have also  experienced issues with the system. For example, according to one of the  office’s registration specialists, eCO’s interface requires them to input the  same information multiple times on multiple screens. He noted that this  type of re-work takes additional time and increases the chance of errors.  External users have also described challenges with eCO. For example, in  an online survey by the Copyright Office, 35 percent of eCO users were  dissatisfied with the ease of use of eCO. One respondent stated that “this  is, hands down, the worst site I have ever had to navigate” and noted that  it took the individual 4 hours to submit the registration application.
In our March 2015 report on the Library of Congress’s IT management,  we determined that while the Library had established a security and  privacy program that covers service units, including the Copyright Office,  it had not fully implemented management controls to ensure the  protection of its systems and information, including both the front-end  eCO system and the infrastructure that stores copyright deposits. For  example, as of February 2015 the Copyright Office did not have  necessary security documentation for eCO, including (1) complete  security testing, (2) a current authorization to operate, and (3) a privacy  impact assessment. More generally, the Library did not always require  two-factor authentication for access to sensitive Library resources,  establish and implement a process for documenting approvals for  permissions to access systems, or ensure that sensitive information  transmitted across its network was being adequately encrypted. These  limitations increase the risk that Library systems—including those used by  the Copyright Office—will not limit access appropriately and that an  individual could gain unauthorized access to system data. To address  these issues, we made a number of recommendations to better protect  the Library’s IT systems and reduce the risk that the information they  contain will be compromised.
Both the Copyright Office and ITS recently identified data integrity issues  when performing analyses of the eCO system. For example, one analysis  found that eCO was not properly saving registration certificates, although  the root cause was not identified. In addition, the Copyright Office’s  General Counsel stated that the Library has used settings and controls  that do not provide a sufficient level of integrity for the office’s digital  records, and that the Copyright Office does not have means of verifying  the integrity of files maintained in those systems.
The Copyright Office has a legal responsibility to retain unpublished  works (including digital works) for the length of the copyright, which could  be as long as 120 years. A report developed by a contractor for ITS noted  that no current technology exists that would allow for digital deposits to be  stored for the required length of time. According to the report, maintaining  access to the deposits in the future requires migration to new storage  solutions as technology evolves. Although the Copyright Office has  communicated this requirement to ITS, a service-level agreement for this  requirement has not been established between ITS and the Copyright  Office.
These technical challenges and the need for improvements have been  acknowledged both by the current Register of Copyrights and by the  office’s external stakeholders. For example, in October 2011, the Register  released a document identifying a series of priorities and special projects  intended to improve the quality and efficiency of the office’s services. The  special projects included, among others, the need for technical upgrades  to the eCO registration system and reengineering of the recordation  process. Further, in March 2013, the Copyright Office solicited public  comments on the electronic registration and recordation functions. The  comments received, which the Copyright Office made publicly available  on its website, ranged from basic frustrations with eCO, such as the need  to make the workflow viewable throughout the registration process, to  requests for new features, such as instant message, video  communication, webinars, and customer support during West Coast  hours.
In November 2013, the Register reiterated the need for technical  improvements. Specifically, she stated that the Copyright Office’s  technical capacities, such as its bandwidth, networking equipment,  electronic storage capacity, hardware, and software, do not fully  accommodate services such as registration that require short-term and  long-term solutions.
In a September 2014 hearing before the House Judiciary Committee, the  Register further discussed the need to modernize the Copyright Office,  because of issues with the registration user interface, the quality of public  records, security concerns, interoperability, and overall customer service.  The Register also discussed backlogs in processing registration and  recordation documents, specifically stating that such issues relating to  recordation are systemic and cannot be improved until the recordation  system is redesigned and brought online.
Finally, in December 2014, the Copyright Office developed a report that  described the need to reengineer the recordation process, including  potentially making changes to the law. This report was informed by,  among other things, public comments provided in response to a Federal  Register notice and roundtable meetings. This report also discussed  shortcomings in the current recordation process described by the public,  including the time it takes for the office to process these documents, the  difficulties in submitting the documents in physical form, and inaccuracies  caused by recordation specialists transcribing the physical documents.
section_title: The Copyright Office Shares Responsibility for IT Management with the Library of Congress, but Organizational Weaknesses Hinder Its Effectiveness
paragraphs: As noted previously, responsibilities for managing IT at the Copyright  Office are shared between Copyright Office staff and organizations at the  broader Library level. For example, the Copyright Office manages many  of its systems, while ITS manages and controls the infrastructure (e.g.,  networks, servers, and data center) on which the systems and  applications reside. Within the Copyright Office, the Office of the CIO is  responsible for advising the Register on the development and  implementation of technology policy, providing strategic direction for the  office’s IT initiatives, and serving as a liaison with ITS. The CIO office has  21 staff that manage several of the Copyright Office’s IT systems, most  notably eCO, and assume overall responsibility for operating the systems  at an acceptable level of risk for the office. Importantly, Copyright Office  staff are in charge of ensuring that systems they are responsible for are  developed in accordance with, and comply with, the Library’s information  security policies. In addition, the Copyright CIO office manages a help  desk specifically for the eCO system, which fields technical help requests  from both internal Copyright Office staff and public users of the system.
The Copyright CIO office also has an internal review board that selects  and manages proposed modifications to any Copyright Office systems  and an eCO steering committee, which meets monthly to discuss  changes to that system. According to the Copyright Office CIO, in fiscal  year 2015, the office will establish a Copyright IT steering committee,  which will review proposed new technology initiatives for the Copyright  Office and oversee them from planning to retirement.
The Copyright Office, as a service unit within the Library of Congress, is  subject to the organization’s IT policies and procedures. For example:
The Library has developed Library-wide policies and procedures for IT  management that cover service units, including the Copyright Office.  Specifically, the Library’s IT Steering Committee is responsible for  overseeing an IT investment management process to provide  structure for the selection and management of all major Library IT  investments and oversight of their performance.
The Library has developed an information security program, assigned  responsibility for ensuring that the security program is being  implemented to the Librarian, and assigned specific responsibilities to  various individuals within the Library. For example, the Library’s CIO  is responsible for overseeing the program, and the Library’s Chief  Information Security Officer is to act as a single point of contact for all  information security activities.
In addition, the Copyright Office relies on ITS for IT support. Specifically,  ITS has responsibility for maintaining certain systems within the service  units. For example, ITS has developed several of the Copyright Office’s  mission-related IT systems and is also responsible for maintaining some  of them (with the Copyright Office maintaining others). In addition, ITS is  responsible for maintaining the hosting environment (including the data  center, networks, and telecommunications) that supports the Copyright  Office’s systems. For example, although the Copyright Office is  responsible for maintaining the eCO system and making necessary  changes to the interface, ITS is responsible for the underlying servers that  store copyright deposits. Finally, ITS provides other services to support  Copyright Office staff, including e-mail and help desk support.
subsections: section_title: The Copyright Office Is Hindered by Significant Challenges with the Library’s IT Management
paragraphs: In our recent evaluation of the Library’s IT management, we identified  challenges with the level of IT governance that adversely affected the  Library’s ability to efficiently and effectively manage its IT resources,  including its ability to support the IT needs of its service units. These  issues have in turn affected the Copyright Office’s ability to carry out its  responsibilities. Specifically, our report identified the following challenges:  The Library does not have the leadership needed to address IT  management weakness. For example, the Library CIO does not have  responsibility for all of the Library’s commodity IT or the ability to  adequately oversee mission-specific system investments made by the  service units. Also, the Library has not had a permanent CIO in over 2  years. Since the departure of the most recent permanent CIO in 2012,  four individuals have served as acting CIO, and another was recently  appointed to serve in an interim capacity until a permanent CIO is found.  According to the Register, the absence of a permanent CIO has resulted  in a lack of routine communication between senior Library and Copyright  leadership about IT. In addition, the Library has not clearly defined the  responsibilities and authorities governing the relationship of the Library  CIO and component organizations. Of particular concern is the lack of  clearly defined relationships between the Library CIO and the two service  unit CIO positions at the Library, one of which is the Copyright CIO.
From the Copyright Office’s perspective, the lack of clearly defined roles  and responsibilities at the Library has impeded its ability to carry out its  mission. According to the Register, because the Copyright Office has  unique statutory requirements and business needs, IT issues should not  be decided solely by Library staff outside of the Copyright Office or simply  according to an internal Library regulation. For example, the Library’s  requirement that the Copyright Office provide “best editions” for deposits  that are to be added to the Library’s collection has been interpreted to  mean that these deposits should be provided in hard copy. However,  according to the General Counsel of the Copyright Office, this  requirement is a chief cause of delays in processing registration  applications and hampers the ability of the office to modernize the  copyright registration system and move to a fully electronic process.
In addition, according to the Copyright Office’s General Counsel, as a  result of its subordinate status within the Library of Congress, the  Copyright Office lacks adequate control over mission-critical IT resources  and decisions, thus frustrating its basic statutory purpose of creating,  maintaining, and making available to the public an authoritative record of  copyright ownership and transactions. For example, Copyright Office staff  expressed concerns regarding ITS’s control of servers containing its  deposit files. Specifically, the Copyright CIO noted that ITS employees  recently moved Copyright Office deposits from the existing storage server  without the permission of the office, raising concerns about the integrity  and security of these files.
We also reported that the Library lacks a strategic plan to guide its IT  investments. An IT strategic plan has been drafted, but it does not identify  strategies for achieving defined goals and interdependencies among  projects. According to the Librarian of Congress, the draft IT plan was  merely a starting point for the Library’s IT strategic planning efforts, and in  January 2015, the Librarian’s Chief of Staff stated that the Library plans to  draft a new strategic plan within 90 days. The Register has noted that it  has been difficult for the Copyright Office to develop any long-term plans  for improving the office’s IT environment because the Library does not  have overarching long-term IT plans.
In addition, our report found that the Library’s central IT office—ITS—had  not ensured that its services support the business needs of the Library,  and had not established complete service-level agreements with its  customers (i.e., the service units). For example, ITS had one service- level agreement with the Copyright Office for the eCO system; however,  that agreement was incomplete. Specifically, the service-level agreement  did not include all of the services that ITS provides to the Copyright  Office. As a result, services that ITS provides to the Copyright Office may  not be meeting the office’s business needs. For example, according to the  Copyright CIO, ITS controls when eCO is to be shut down for  maintenance and outages had, at times, been scheduled during periods  of heavy traffic from the office’s external users.
Finally, our report found that inconsistent satisfaction with the services  provided by ITS had likely contributed to duplicative or overlapping efforts  across the Library. Specifically, service units across the Library performed  many of the same functions as ITS; for example, the Copyright Office  provides Internet management and desktop support services, which  overlap similar services by ITS. In addition, service units within the Library  had purchased their own commodity IT in the past 3 years. For example,  the Copyright Office had purchased laptops, mobile devices, servers, and  workstation software, even though these may be duplicative of those that  the Library has procured. Our report also raised questions about recent  budget requests made by the Copyright Office, and whether those  proposed requests may create additional services that overlap those  already provided by ITS.
In our report on the Library’s IT management, we made a number of  recommendations to address the weaknesses we identified. These  included, among others, appointing a senior executive for IT (i.e., a CIO)  who has responsibility for commodity IT throughout the Library and  clarifying the relationship between that official and IT leadership at the  service unit level; fully establishing and implementing a Library-wide  approach to service-level agreements; and conducting a review of the  Library’s IT portfolio to identify potential areas of duplicative activities and  spending.
section_title: The Copyright Office Has Yet to Develop Plans for Improving Its IT Environment
paragraphs: Although the Copyright Office has acknowledged many of the reported  organizational and technical challenges we have identified previously, the  office has not yet developed plans to improve its IT environment.  Specifically, while the office has identified several proposed IT initiatives  for improving its IT environment and requested over $7 million to fund  these initiatives, it has not yet developed plans and proposals to justify  these investments, including identifying the business need they will meet  and their expected costs and benefits. The office also did not present the  initiatives to the Library’s IT Steering Committee for review as required by  Library policy. By identifying mission needs and plans in investment  proposals and charters, decision makers at the Library and the Copyright  Office would have greater assurance that the selected investments meet  these mission needs. In addition, the office has not yet developed an IT  strategic plan to help ensure that its IT goals are aligned with the  agency’s strategic goals, stating that it is difficult to do so when the  Library does not yet have an IT strategic plan. We agree that the  Copyright Office’s IT strategic planning should be aligned with the  Library’s own efforts in this regard. Developing a strategic plan that is  aligned with the Library’s forthcoming efforts will help the Copyright Office  ensure that current and future investments aimed at improving its IT will  support its mission needs, as well as avoiding duplication with existing  activities within the Library.
subsections: section_title: The Copyright Office Has Proposed Upgrades to Address Technical Challenges
paragraphs: According to Copyright Office officials, the office requested funding for  four initiatives to address immediate technical challenges: (1)  reengineering the recordation function, (2) developing a secure digital  repository for digital deposits, (3) developing a software application  development environment, and (4) developing a data management team.
In total, the office requested over $7 million in funding for both fiscal years  2015 and 2016 in support of these four IT initiatives. The office  developed brief summaries supporting these requests, which described  the initiatives as follows:
Reengineering the recordation function. This investment involves  reengineering the business process from an IT, legal, and  administrative perspective, and ultimately developing an online filing  system. To inform this effort, the office solicited public comments on  the current recordation process through a Federal Register notice and  through roundtable discussions in 2014. This information was used to  develop a report regarding limitations in the current process and high- level requirements for an electronic recordation system. The office  requested $1.5 million to conduct business analysis for recordation  reengineering in fiscal year 2015, and received that amount in its  appropriations. The Library requested an additional $676,000 for this  effort in its fiscal year 2016 budget justification.
Developing a secure digital repository for digital deposits. This  investment focuses on the secure transfer and storage of digital works  that are registered and electronically deposited with the Copyright  Office for protection. The office noted that the analysis stage would  determine whether the appropriate solution includes using cloud- based providers or investing in additional hardware. The office  requested $3.07 million in fiscal year 2015, but did not receive funding  for this investment. The office submitted a new request in fiscal year  2016 for $2.64 million, but did not receive approval for including this  initiative in the Library’s proposed budget to Congress.
Developing a software application development environment.
This investment would create a development environment for all  future copyright-specific applications (e.g., an online system for the  recordation process). According to the office, this requires an  investment in hardware, software, and personnel. The office  requested $2.43 million in fiscal year 2015, but did not receive funding  for this investment. The office submitted a new request in fiscal year  2016 for $2.22 million, but did not receive approval for including this  initiative in the Library’s proposed budget to Congress.
Developing a data management team. This investment includes the  development of a data strategy for the Copyright Office’s public  records, a data management plan, a data governance plan, a data  model, data standards, and data exchanges. The office estimates that  additional IT infrastructure may be required, but has not determined  whether the cloud is the appropriate solution. The office requested  $2.80 million in fiscal year 2016 for this investment, but did not receive  approval for including this initiative in the Library’s proposed budget to  Congress.
In addition, since being appointed to the position in 2011, the Register of  Copyrights has acknowledged the technical challenges facing the office  and described the need for improvements in its technology. For example,  in October 2011 the Register announced a series of special projects,  including performing research on technical upgrades to electronic  registration. As part of this technical upgrades research project, in March  2013 the office requested public comments on the current registration  process through a Federal Register notice.
In February 2015, the office published the results of its research that,  according to the CIO, either directly or indirectly address concerns voiced  by copyright stakeholders. According to the report developed by the CIO,  the research identified four IT areas in greatest need of improvement: (1)  challenges with the current user experience, (2) challenges with access to  and the usability of copyright records, (3) inefficiencies with current  copyright data, and (4) poor performance of outdated IT architecture and  infrastructure. The report also identified a number of proposed  recommendations to improve in these areas, including, among other  things, improving eCO’s user interface; ensuring that the office’s public  record databases show accurate, complete, and up-to-date information;  establishing effective data standards; and developing a secure repository  for digital deposits.
section_title: The Copyright Office Has Not Adequately Justified Proposed Investments to Improve Its IT Environment
paragraphs: Best practices we have identified for IT investment management note that  mature organizations analyze and prioritize IT investments before  selection. For example, before committing significant funds to any  project, organizations should select IT projects based on quantitative and  qualitative criteria, such as expected costs, benefits, schedule, risks, and  contribution to mission goals. Importantly, we have also reported that  high-performing organizations manage investments in a portfolio  approach through an investment review board. In this way, selection  decisions can be made in the context of all other investments, thus  minimizing duplication across investments.
Consistent with these best practices, the Library has an established policy  and process for service units to propose IT investments for selection  through the Library’s IT Steering Committee, which acts as the agency’s  investment review board. Specifically, before an investment is selected  for funding, service units are to prepare (1) an investment proposal, which  includes identifying the business problem, a proposed solution, the  expected benefits, how the solution aligns with the Library’s strategic  plan, initial 3-year cost estimate, and expected funding sources, and (2)  an investment charter, which includes a budget plan and a cost-benefit  analysis. The service units are also required to present this information to  the Library’s IT Steering Committee, which makes recommendations for  investments to be selected for funding. The Library’s central IT office— ITS—has also developed guidance for requirements development and  analysis, which is to take place after the project has gone through the  initiation and planning phases and the investment owner has already  prepared the investment proposal and charter.
However, in developing the funding requests for the four initiatives aimed  at improving its IT environment, the Copyright Office did not follow the  Library’s IT investment management policies for selecting investments.  While the funding requests contained background information on the  proposals, 1-year expected costs and, in some cases, expected benefits  and categories of tasks to be completed within the first year (e.g.,  program management, analysis, and requirements development), they  did not include all the key information required by Library policy for  investment proposals and charters. For example, they did not include 3- year cost estimates, the business needs that drive the investments,  details on how the investments aligned with the agency’s strategic plan,  or the expected funding sources. Further, the office did not present any of  these IT investments to the Library’s IT Steering Committee to be  approved for funding, as required by Library policy.
Both the Register and the Copyright CIO stated that the office is not yet in  a position to prepare planning documentation for each of its proposed  initiatives and that the Copyright Office planned to use the first year of  funding to develop requirements. However, according to best practices  and Library policy, the Copyright Office should identify the mission needs,  cost estimates, and other information prior to selecting the investments  and requesting funding, and should use this planning information as input  into its requirements development and analysis. In addition, in the  absence of critical information such as specific needs, costs, and  benefits, it is unclear whether the office’s request to allocate about $7  million to these IT-related investments constitutes an effective and  efficient use of Copyright Office and Library resources. Further, because  the investments have not been reviewed by the Library’s IT investment  review board and compared to the entire portfolio of IT systems, there is a  risk that they may duplicate existing efforts within the agency. In this  regard, our March 2015 report on the Library’s IT management noted  that, for example, ITS has a software application development  environment, and currently works with the Copyright Office to maintain  digital deposits—efforts which appear to duplicate two of the Copyright  Office’s budget requests. By identifying mission needs and plans in  investment proposals and charters, and by presenting the requests to the  IT Steering Committee as part of the Library’s investment selection  process, decision makers at the Library and the Copyright Office would  have greater assurance that the selected investments meet mission  needs and do not duplicate existing efforts.
section_title: Lack of a Library-Wide Plan Has Impeded the Copyright Office’s IT Strategic Planning Efforts
paragraphs: Our experience with IT modernization efforts has shown that having  sound management for planning, oversight, and reporting progress is  essential to achieving successful outcomes. Requirements for executive  branch agencies from law and Office of Management and Budget  guidance reflect best practices and note that effective planning involves  creating an IT strategic plan that includes goals, measures, and timelines  in order to help the organization align its information resources with its  business strategies and investment decisions.
The Copyright Office has not yet developed an IT strategic plan that can  be used to guide its IT improvement efforts and monitor progress in  meeting its goals. According to the Register, the Copyright Office is  currently drafting an overall strategic plan to be completed by the end of  September 2015. However, the Register stated that it will not include  plans about improving the Copyright Office’s IT environment. The  Register further stated that it is difficult for the Copyright Office to develop  full IT strategic planning documents because the Library of Congress has  not yet developed such strategic plans for the entire organization.
Finally, the Register stated that the IT goals of the Copyright Office will  depend upon the duties it must carry out in coming years, many of which  may change because of recent efforts in Congress to review federal  copyright law. The Register added that the office’s general goal is to  achieve greater control of its IT infrastructure and environment, helping  the office to meet its statutory responsibilities. According to the Register,  the Copyright Office needs dramatic improvements in the ways in which it  registers works, collects copyright deposits, records licenses and other  documents, presents the chain of title, administers statutory licenses, and  otherwise administers the law. She stated that these changes will require  statutory and regulatory changes as well as new models for IT  governance and funding.
We agree that the Copyright Office’s IT strategic planning should be  aligned with the Library’s own ongoing efforts to develop an IT strategic  plan for the entire organization. In our review of the Library’s IT  management, we noted that the Library does not have an IT strategic  plan and that efforts to develop such a plan have just recently begun.  We also recognize that future legislation may have an impact on the  office’s responsibilities in administering the law and, therefore, may affect  the office’s future technology needs. Nonetheless, developing a strategic  plan that is aligned with the Library’s forthcoming efforts will help to  ensure that the Copyright Office’s current and future investments aimed  at improving its IT will support its mission needs, as well as avoid  duplication with existing activities within the Library.
section_title: Conclusions
paragraphs: The Copyright Office has an important legal mission supporting the  creative industries that significantly contribute to the United States  economy, and the office relies heavily on IT to carry out this mission.  However, its IT environment faces many technical and organizational  challenges, which ultimately may affect the office’s ability to meet its legal  mission. Copyright’s primary system—eCO—has had significant technical  issues, both with the system itself—managed by the Copyright Office— and with its underlying infrastructure, managed by the Library’s central IT  office. Even with all of the identified challenges, however, the office is  adding significant new functionality onto this already-burdened system, by  transferring legacy system functionality onto it. Significant IT management  weaknesses of the Library exacerbate the technical issues, making it  difficult for the Library and the Copyright Office to address the technical  challenges. As we have already recommended, strong IT leadership  within the Library and effective coordination with its service units is  needed; otherwise, the Copyright Office will continue to face challenges in  making the needed changes to its IT environment.
Although the Copyright Office’s current IT environment is hampered by  these challenges, the office has yet to develop plans to address the  problems. The office has taken the first steps toward developing plans, by  identifying a list of proposed technical upgrades and performing further  research on one of the initiatives (recordation reengineering). However, it  has been about 3 years since the Register of Copyrights identified the  need for technical upgrades, and little documented planning has been  carried out. Importantly, although the office has requested over $7 million  for its proposed IT initiatives, it has not yet fully articulated its business  needs or expected costs and benefits for these initiatives. Instead, the  office has been reacting to current needs—such as retiring legacy  systems—rather than developing clear plans for needed IT improvements  that take into account such inevitabilities. In addition, because the office  has not presented these investments to the Library’s IT investment review  board, it is unclear whether these investments will overlap with activities  that are already performed by the Library’s central IT office, and are thus  a wasteful use of taxpayer funds. In this context, developing an IT  strategic plan that is aligned with forthcoming efforts from the Library will  better position the office to effectively prioritize, manage, and monitor the  progress of its IT improvement efforts.
section_title: Recommendations
paragraphs: To help ensure that the Copyright Office makes improvements to its  current IT environment, we are recommending that the Librarian of  Congress direct the Register of Copyrights to take the following two  actions:
For current and proposed initiatives to improve the IT environment at  the Copyright Office, develop plans including investment proposals  that identify the business problem, a proposed solution, the expected  benefits, how the solution aligns with the Library’s strategic plan, an  initial 3-year cost estimate, and expected funding sources, and bring  those to the Library’s IT Steering Committee for review, as required by  Library policy.
Develop an IT strategic plan that includes the office’s prioritized IT  goals, measures, and timelines, and is aligned with the Library’s  ongoing strategic planning efforts.
section_title: Agency Comments and Our Evaluation
paragraphs: In response to our request for comments, we received a written response  from the Register of Copyrights. According to the Register, the Librarian  of Congress deferred to her to comment on our draft report. In her  response, the Register did not state whether the office agreed or  disagreed with our recommendations, but provided comments on these  and other matters. These comments are summarized below, along with  our responses.
According to the Register, the Copyright Office must evolve from a small  department of public record to a digitally savvy administrator of  intellectual property rights, remedies, and commercial information, which  requires the office to evaluate the needs of the national copyright system  objectively and transparently. As described in this report, we agree that  the Copyright Office has technical and organizational challenges that  hinder its ability to meet its statutory and business needs. We further  acknowledged that the office has begun to address these needs in its  technical upgrades research. However, making progress in addressing  these limitations will require a strategic vision as well as effective  planning, and our recommendations are aimed at assisting the office in  these areas.
The Register further noted that we did not examine the legal relationship  between the Copyright Office and the Library and that our  recommendations assume that the Copyright Office will continue to route  its IT needs through Library processes and managers, similar to other  Library units. She added that members of Congress have recently  questioned the current governance structure and that it would be prudent  for the Library and the Copyright Office to solicit further congressional  guidance before implementing GAO’s recommendations.
We acknowledge that concerns about the legal relationship between the  Copyright Office and the Library have been raised in Congress. In our  report we discuss the office’s legal responsibilities, including the  relationship between the office and the Library and the Copyright Office’s  distinctive mission. Our review of the office’s IT environment was  undertaken in light of current law and the existing organizational structure.  We recognize that future legislation may change the office’s  responsibilities in administering copyright law, which may in turn impact  its future technology needs. Whether such changes to the law will alter  the office’s placement in the Library is unknown at this time. Regardless  of the Copyright Office’s organizational placement, it still needs to support  and justify its request for $7 million for IT-related projects in fiscal years  2015 and 2016.
In addition, the Register stated that we primarily reviewed management  issues and did not examine issues with the Library’s technical  infrastructure that, in her view, appear to be insufficient to support a 21st- century Copyright Office. While our report did highlight management  challenges, we also noted several technical challenges impeding the  office’s ability to carry out its work. Specifically, we noted challenges in  the performance and usability of the office’s eCO system; concerns  regarding the implementation of security controls; and data integrity,  availability, and retention issues. Moreover, our report on IT management  Library-wide identified a number of issues, both management-related and  technical, and made numerous recommendations aimed at addressing  them.  Given the current organizational structure, it is important that  both the Library and the Copyright Office take actions to address the  challenges within their purview and collaborate in ways that best support  their respective missions.
Finally, the Register stated that our recommendations would require the  Copyright Office to absorb more of the burden of preparing investment  proposals, cost-benefit analyses, and strategic IT planning, which have  not been in the domain of the office. According to the Register, this would  require the office to acquire additional IT specialists. However, preparing  such planning documentation is required of all service units by Library  policy for investments of this nature, and is consistent with best practices  for selecting IT investments to pursue for funding. In addition, developing  this preliminary planning documentation requires knowledge and  expertise of the office’s business processes and mission needs, but not  necessarily technical expertise. Once the appropriate investments have  been selected, this preliminary information can be used to develop  business requirements, which in turn can be used by Copyright Office  staff or external vendors with the appropriate expertise to identify  technical solutions that will most effectively and efficiently support the  Copyright Office’s mission.
We are sending copies of this report to the appropriate congressional  committees, the Librarian of Congress, and other interested parties. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6253 or willemssenj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The Senate Appropriations Committee report accompanying the fiscal  year 2015 legislative branch appropriations bill (S. Rep. No. 113-196)  required that we review the Copyright Office’s current information  technology (IT) environment and its plans for modernizing that  infrastructure. Our specific objectives for this review were to (1) describe  the legal, technical, and organizational aspects of the Copyright Office’s  current IT environment and (2) describe and evaluate the Copyright  Office’s plans for modernization.
To address our first objective, we reviewed the legal requirements for the  Copyright Office found in the Copyright Act and the Administrative  Procedure Act, and related legal requirements for the Library of  Congress, as well as the Library’s IT management policies and  procedures. We also reviewed documentation related to concerns  expressed by internal and external users of Copyright’s registration  system, including public comments and transcripts of meetings with the  public; testimony, hearing transcripts, and speeches by the Register of  Copyrights; results from customer satisfaction surveys for the office’s  systems; e-mails related to IT challenges sent by Copyright Office staff to  the Associate Register for Registration Policy and Practice; and help desk  tickets provided to both the Copyright Office help desk and the Library of  Congress IT help desk. We reviewed feasibility studies and plans for  migrating functionality from legacy systems to Copyright’s registration  system. We also relied on the results of our recent review of the Library’s  IT management.
In addition, to test the integrity of the office’s deposit files, we selected a  random probability sample of the deposit files stored in the Library of  Congress’s storage servers. Specifically, we selected a simple random  sample of 60 of the over 6 million deposit files that were stored from 2005  to 2014. We met with staff in the Library’s Office of Information  Technology Services to confirm that the selected files existed in the  expected locations. Finally, we interviewed Library of Congress officials,  including the Library’s former acting Chief Information Officer (CIO) and  head of the Library’s Information Technology Services division, and  Copyright Office officials, including the Register of Copyrights, the  Copyright CIO, and the heads of Copyright Office’s program areas.
To describe and evaluate the office’s plans for modernization, we  reviewed best practices on IT investment management identified by GAO  and Library policies and procedures. We also reviewed requirements for  IT strategic planning found in related provisions of the Clinger-Cohen Act  of 1996 and guidance from the Office of Management and Budget. We  reviewed the Copyright Office’s IT-related funding requests in fiscal years  2015 and 2016, including the underlying cost estimates, and compared  them against the IT investment management criteria. We also reviewed  testimony, hearing transcripts, and speeches made by the Register about  the office’s needs for technical upgrades. Finally, we interviewed Library  of Congress officials, including the Library’s former acting CIO, the  Register of Copyrights, and the Copyright Office’s CIO, to discuss the  office’s efforts to plan for IT improvement initiatives.
We conducted this performance audit from June 2014 to March 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the U.S. Copyright Office
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Joel C. Willemssen, (202) 512-6253 or willemssenj@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, individuals making contributions  to this report included Nick Marinos, Lon Chin, and Chris Warweg  (assistant directors), James Ashley, Chris Businsky, Sa’ar Dagani, Neil  Doherty, Torrey Hardee, Thomas Johnson, Kaelin Kuhn, Lee McCracken,  David Plocher, Meredith Raymond, Kate Sharkey, Andrew Stavisky, Tina  Torabi, and Charles Youman.