Freedom of Information Act: DHS Should Take Steps to Improve Cost Reporting and Eliminate Duplicate Processing
Published: 2014-11-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: FOIA requires federal agencies to provide the public with access to government information. In fiscal year 2013, DHS and its component agencies reported processing more than 200,000 FOIA requests, the most of any federal agency. At the end of fiscal year 2013, about half of all reported backlogged federal FOIA requests (about 50,000 of 95,000) belonged to DHS.
GAO was asked to review DHS's processing of FOIA requests. GAO's objectives were to determine (1) the responsibilities of and total costs incurred by DHS and selected components in managing and processing FOIA requests, and whether duplication exists; (2) actions DHS and selected components have taken to reduce FOIA backlogs and the results; and (3) the status of DHS's and selected components' efforts to acquire and implement automated systems for processing requests. GAO evaluated DHS's and five selected components' FOIA-related procedures, fiscal year 2013 cost data, and other documentation. The five components together received more than 90 percent of DHS's FOIA requests during fiscal year 2013. GAO also interviewed department and component agency officials.
section_title: What GAO Found
paragraphs: The Department of Homeland Security's (DHS) Freedom of Information Act (FOIA) processing responsibilities are split between the department's Privacy Office, which acts as its central FOIA office, and FOIA offices in its component agencies. The Privacy Office has a number of oversight and coordination functions, including developing policies to implement FOIA initiatives, providing training, and preparing annual reports. Meanwhile, components' FOIA offices are responsible for processing the vast majority of the requests received by the department, subject to regulations and policies issued by the Privacy Office. While components report FOIA processing costs to the Privacy Office, which then aggregates and reports them to the Department of Justice, reported costs are incomplete (for example, the costs do not reflect employee benefits or the salaries of staff outside the components' FOIA offices who retrieve requested documents), thus hindering accountability for total costs. Regarding duplication, GAO determined that certain immigration-related requests are processed twice by two different DHS components. The duplicate processing of such requests by the two components contributes to an increase in the time needed to respond to the requests.
In 2011, DHS established a goal of reducing backlogged FOIA requests by 15 percent each year, and its component agencies have taken actions toward this goal, including increasing staff, reporting and monitoring backlog information, providing training, and offering incentives to staff for increased productivity. Although there was initial progress by the end of fiscal year 2012, backlog numbers do not account for an estimated 11,000 improperly closed requests, and the number of backlogged requests increased in fiscal year 2013 to a level higher than 2011 (see figure).
DHS and its components have implemented or are planning to implement various technology capabilities to support FOIA processing based on best practices and federal requirements. However, not all of these systems possess all capabilities recommended by federal guidance, such as online tracking and electronic redaction, or the required capabilities to accommodate individuals with disabilities. Adopting such system capabilities departmentwide could help DHS increase the efficiency of its FOIA processing.
section_title: What GAO Recommends
paragraphs: GAO is recommending, among other things, that DHS improve the reporting of FOIA costs, eliminate duplicative processing, and direct components to implement recommended and required FOIA system capabilities. In written comments on a draft of the report, DHS agreed with the recommendations.

section_title: Letter
paragraphs: The Freedom of Information Actprovide the public with access to government information on the basis of  the principles of openness and accountability in government. Each year,  federal agencies release information in response to hundreds of  thousands of FOIA requests that contribute to the understanding of  government actions, including the disclosure of waste, fraud, and abuse.  The Department of Homeland Security (DHS) is one of the many  agencies that respond to these requests. The department receives and  processes requests for information related to immigration, border  crossings, law enforcement, natural disasters, maritime accidents, and  agency management, among other topics. This information is compiled  and maintained throughout the department and its seven component  agencies.   (FOIA) requires federal agencies to  DHS has reported processing approximately 200,000 FOIA requests in  fiscal year 2013—the most of any federal government agency. Moreover,  requests have more than doubled since 2009, and it also has reported the  largest backlog of unprocessed requests of any federal agency. At the  end of fiscal year 2013, approximately half of all reported backlogged  federal FOIA requests (about 50,000 of 95,000) belonged to DHS.
At your request, we conducted a study of DHS’s processing of FOIA  requests. Our objectives were to determine: (1) the responsibilities of, and  total costs incurred by, DHS and selected components in managing and  processing FOIA requests, and whether any duplication exists; (2) actions  DHS and the selected components have taken to reduce FOIA backlogs  and the results of their actions; and (3) the status of DHS’s and the  selected components’ efforts to acquire and implement automated  systems for processing FOIA requests.
To address the study objectives, we reviewed the FOIA activities of the  DHS Privacy Office (which serves as the department’s central FOIA  office); we also purposefully selected and reviewed the five DHS  component agencies that, together, received more than 95 percent of all  of the department’s FOIA requests during fiscal year 2013. These  selected component agencies are the U.S. Citizenship and Immigration  Services (USCIS), U.S. Customs and Border Protection (CBP), U.S.  Immigration and Customs Enforcement (ICE), Federal Emergency  Management Agency (FEMA), and U.S. Coast Guard (Coast Guard).
To determine the responsibilities of and costs incurred by DHS and the  selected components in managing and processing FOIA requests, we  evaluated the department’s and components’ FOIA policies, procedures,  reports, and other documentation describing their responsibilities and  management practices, and interviewed officials about their  responsibilities. We also examined overall FOIA processing costs for  fiscal year 2013, as reported by DHS annually to the Department of  Justice (Justice), and we reviewed detailed cost breakdowns used by the  Privacy Office and the selected components to calculate total reported  FOIA processing costs. We determined the categories of costs reported  and compared them to the cost categories required by Justice and federal  management cost accounting standards to determine if all required cost  elements were being reported. We examined steps taken by DHS and the  selected components to assure their cost figures were reliable. We  concluded that the cost data provided were not sufficiently reliable to  determine DHS’s total FOIA costs.
To determine whether duplication exists in the department’s and selected  components’ processing of FOIA requests, we examined policies and  procedures, viewed demonstrations of how requests are processed, and  interviewed Privacy Office and component agency officials regarding their  processes for responding to a FOIA request. We evaluated the processes  against recommended practices discussed in our previously issued  reports that addressed duplication in federal government programs.
To assess actions DHS and the selected components have taken to  reduce their backlogged FOIA requests and the results of their actions,  we reviewed backlog reduction goals and statistics. We also examined  other relevant documents and interviewed agency officials to identify any  specific actions being taken to reduce backlogged requests, identify  outcomes associated with those actions, and ascertain any plans for  addressing the backlogged requests.
To determine the status of the department’s and the selected  components’ efforts to acquire and implement automated systems to  support FOIA processing, we obtained and analyzed information, such as  user manuals and screen prints, that described existing system  capabilities, and viewed demonstrations of current systems being used to  track and process requests. We compared the stated capabilities of these  systems to relevant laws, guidance, and recommended best practices for   We used this  using technology to improve efficiency in FOIA processing.analysis to assess the extent to which the Privacy Office’s and selected  components’ processing systems included the recommended best  practice capabilities. We also interviewed Privacy Office and component  agency officials regarding current and planned system capabilities and  reviewed documents describing components’ plans to acquire new  automated FOIA processing systems. Additional details on our objectives,  scope, and methodology are included in appendix I.
We conducted this performance audit from November 2013 to November  2014 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: FOIA establishes a legal right of access to government information on the  basis of the principles of openness and accountability in government.  Before its enactment in 1966, an individual seeking access to federal  records faced the burden of establishing a “need to know” before being  granted the right to examine a federal record. FOIA established a “right to  know” standard, under which an organization or person could receive  access to information held by a federal agency without demonstrating a  need or reason. The “right to know” standard shifted the burden of proof  from the individual to a government agency and required the agency to  provide proper justification when denying a request for access to a  record.
Any “person,” defined broadly to include foreign nationals, corporations,  and organizations, can file a FOIA request. For example, a foreign  national or his/her lawyer can request immigration-related files, and a  commercial requester, such as a data broker that files a request on behalf  of another person, may request a copy of a government contract. In  response, an agency is required to provide the relevant record(s) in any  readily producible form or format specified by the requester (unless the  record falls within a permitted exemption).
subsections: section_title: FOIA Amendments and Guidance Called for Improvements in Agencies’ FOIA Processing
paragraphs: The 1996 e-FOIA amendments, among other things, sought to  strengthen the requirement that federal agencies respond to a request in  a timely manner and reduce their backlogged requests. In this regard, the  amendments made a number of procedural changes, including providing  a requester with an opportunity to limit the scope of the request so that it  can be processed more quickly, and requiring agencies to determine  within 20 working days (an increase from the previously established time  frame of 10 days) whether a request would be fulfilled.also authorized agencies to multi-track requests—that is, to process  simple and complex requests concurrently on separate tracks to facilitate  responding to a relatively simple request more quickly. In addition, the e- FOIA amendments encouraged online, public access to government  information by requiring agencies to make specific types of records  available in electronic form.
In a later effort to reduce agencies’ backlogged FOIA requests, the  President issued Executive Order 13392 in December 2005, which set forth a directive for citizen-centered and results-oriented FOIA. In  particular, the order directed agencies to provide a requester with  courteous and appropriate service and ways to learn about the FOIA  process, the status of the request, and the public availability of other  agency records. The order also instructed agencies to process requests  efficiently, achieve measurable process improvements (including a  reduction in the backlog of overdue requests), and reform programs that  were not producing the appropriate results.
Further, the order directed each agency to designate a senior official as  the Chief FOIA Officer. This official is responsible for ensuring agency- wide compliance with the act by monitoring implementation throughout  the agency; recommending changes in policies, practices, staffing, and  funding; and reviewing and reporting on the agency’s performance in  implementing FOIA to agency heads and to Justice. (These are referred  to as Chief FOIA Officer reports.) Justice, which has overall responsibility  for overseeing federal FOIA activities, issued guidance in April 2006 to  assist federal agencies in implementing the Executive Order’s  requirements for reviews and improvement plans. The guidance  suggested several potential areas for agencies to consider when  conducting a review, such as automated tracking of requests; automated  processing and receipt of requests; electronic responses to requests;  forms of communication with requesters; and systems for handling  referrals to other agencies.
The OPEN Government Act,FOIA in several ways. For example, it placed the 2005 Executive Order’s  requirement for agencies to have Chief FOIA Officers in law. It also  required agencies to include additional statistics on timeliness in their  annual reports. In addition, the act called for agencies to establish a  system to track the status of a request. Justice subsequently issued  guidance on responding to the requirements of the act and directed  agencies to omit from their FOIA statistics certain Privacy Act requests  that had previously been included.   which was enacted in 2007, also amended  Additionally, in January 2009, the President issued two memoranda,  “Transparency and Open Government” and “Freedom of Information  Act,” both of which focused on increasing the amount of information  made public by the government. In particular, the latter memorandum  directed agencies to (1) adopt a presumption in favor of disclosure in all  FOIA decisions, (2) take affirmative steps to make information public, and  (3) use modern technology to do so. This echoed Congress’ finding, in  passing the OPEN Government Act, that FOIA established a “strong  presumption in favor of disclosure.”
Agencies, including DHS, are generally required to make a determination  on a FOIA request within 20 working days. A request may be received in  writing or by electronic means. Once received, the request goes through  multiple phases, which include assigning a tracking number, searching for  responsive records, processing records, and releasing records. Figure 1  provides an overview of the process, from the receipt of a request through  the release of records to the requester.
As indicated, during the intake phase, a request is to be logged into the  agency’s FOIA system, and a tracking number is assigned. The request is  then reviewed by FOIA staff to determine its scope and level of  complexity.requester acknowledging receipt of the request, with a unique tracking  number that the requester can use to check the status of the request.
The agency then typically sends a letter or e-mail to the  Next, FOIA staff begin the search to retrieve the responsive records by  routing the request to the appropriate program office(s).This step may  include searching and reviewing paper and electronic records from  multiple locations and program offices.
Agency staff then process the responsive records, which includes  determining whether a portion or all of any record should be withheld  based on statutory exemptions. If a portion or all of any record is the  responsibility of another agency, FOIA staff may consult with the other  agency or may send (“refer”) the document(s) to that other agency for  processing. After processing and redaction, a request is reviewed for  errors and to ensure quality. The documents are then released to the  requester, either electronically or by mail.
section_title: DHS and its Component Agencies Are Stewards of Many Areas of Government Information to Which the Public Seeks Access via FOIA
paragraphs: Created in 2003, DHS assumed control of about 209,000 civilian and  military positions from 22 agencies and offices that specialize in one or  more aspects of homeland security. As such, the department is charged  with a wide expanse of operations affecting many aspects of federal  service to the public. By the nature of its mission and operations, the  department creates and has responsibility for vast and varied amounts of  information covering, for example, immigration, border crossings, law  enforcement, natural disasters, maritime accidents, and agency  management.
According to the 2014 Chief FOIA Officer Report,structure consists of 28 offices, directorates, and components. The  departmental offices encompass core management and policy functions.  Among these is the Privacy Office, which is tasked with preserving and  enhancing privacy protections for all individuals and promoting  transparency of the department’s operations. The Privacy Office serves  as the department’s central FOIA office.
DHS also has seven operational components that are responsible for  carrying out various missions. Among these components are the five  selected for our study, as described here.
USCIS grants immigration and citizenship benefits, promotes an  awareness and understanding of citizenship, and ensures the integrity  of the nation’s immigration system. Its records include asylum  application files and other immigration-related documents.
CBP secures the border against transnational threats and facilitates  trade and travel through actions that include enforcing federal laws  and regulations relating to immigration, drug enforcement, and other  matters. The agency maintains records related to agency operations,  activities, and interactions.
ICE promotes homeland security and public safety through the  criminal and civil enforcement of federal laws governing border  control, customs, trade, and immigration. It maintains information  related to the law enforcement records of immigrants and detainees,  as well as information pertaining to human trafficking/smuggling,  gangs, and arrest reports.
FEMA supports citizens and first responders to ensure that they work  together to build, sustain, and improve the capability to prepare for,  protect against, respond to, recover from, and mitigate all hazards.  The agency maintains records such as those pertaining to the  National Flood Insurance Program, grants, and disaster relief, as well  as records related to disaster response.
Coast Guard leads federal agency maritime safety, security, and  stewardship. It safeguards the flow of maritime commerce in and out  of U.S. ports, protects the marine environment, defends U.S. borders  against illicit activity, and rescues those in peril at sea. Its records  include information related to Coast Guard veterans, maritime  disasters, and oil spills such as Deepwater Horizon.
According to its 2014 Chief FOIA Officer Report, DHS and its component  agencies reported that they processed 204,332 FOIA requests in fiscal  year 2013, the most of any federal government agency. The department  has experienced an increase in requests received every year since 2009,  and has also reported the largest backlog of unprocessed requests of any  federal agency. Specifically, as shown in table 1, DHS experienced a 125  percent increase in FOIA requests received from fiscal year 2009 through  fiscal year 2013. It experienced an 81 percent increase in backlogged  requests from fiscal year 2012 to fiscal year 2013. At the end of fiscal  year 2013, approximately half of all reported backlogged federal FOIA  requests (about 50,000 of 95,000) belonged to DHS.
section_title: Our Previous Reports Have Highlighted DHS FOIA Processing Challenges
paragraphs: Since 2008, we have issued a number of reports that highlighted  challenges impacting DHS’s processing of FOIA requests. For example,  in that year, we reported that, government-wide, the numbers of  pending requests carried over from year to year had increased because  of an increase in requests directed at DHS. In particular, we noted  increases in the number of pending requests at USCIS, which accounted  for about 89 percent of DHS’s total pending requests. We identified  several factors that contributed to the requests remaining open and  recommended that Justice provide additional guidance to agencies on  tracking and reporting overdue requests and planning to meet future  backlog goals. As we recommended, Justice subsequently developed  and issued guidance on tracking and reporting backlogged requests.
GAO, Freedom of Information Act: DHS Has Taken Steps to Enhance Its Program, but  Opportunities Exist to Improve Efficiency and Cost-Effectiveness, GAO-09-260  (Washington, D.C.: Mar. 20, 2009). status-checking, and electronic dissemination of records, could facilitate  the processing of information requests at a number of its major  components. Accordingly, we recommended that key practices used by  certain DHS components and other agencies be implemented more  consistently across the department. DHS agreed with our  recommendations and took steps to address them. For example, the  department implemented electronic FOIA processing systems in certain  components. Further, among the components, the Secret Service  provided component-specific training on the processing of information  pertaining to its unique mission.
section_title: DHS’s FOIA Processing Responsibilities Are Decentralized, Its FOIA Regulation Is Not Updated, Its Cost Reporting Is Incomplete, and Processing Duplication Exists
paragraphs: Responsibility for processing FOIA requests is decentralized among  DHS’s Privacy Office and component agencies. In this regard, the Privacy  Office—as the department’s central FOIA office—has agency-wide  responsibility for FOIA compliance and performance, to include  developing policies to implement FOIA initiatives, providing training, and  preparing required annual reports. In addition, each of the selected  components has its own program and procedures for processing,  tracking, and reporting FOIA activities. However, the Privacy Office has  not updated the DHS FOIA regulation—a regulation required by the act— that establishes procedures intended to inform the public of its own and  the components’ FOIA operations. Further, while the selected  components report their FOIA processing costs to the Privacy Office,  which then aggregates this data, these reported costs are incomplete,  thus hindering accountability for the total costs incurred by the  department and the components in managing and processing FOIA  requests. Also, duplication exists in the processing of certain requests for  immigrant files that are handled by two of the selected components.
subsections: section_title: Privacy Office Carries Out DHS-wide FOIA Responsibilities; Selected Component Agencies Have Separate FOIA Program Responsibilities
paragraphs: The DHS Privacy Officer serves as the department’s Chief FOIA Officer,  and the Privacy Office is where programmatic oversight of department- wide FOIA operations is executed. In addition, this office has  responsibility for processing FOIA requests submitted to the Office of the  Secretary and eleven other headquarters offices. In fiscal year 2013, the  Privacy Office reported processing 840 requests for these offices.
As the central office tasked with overseeing the department’s FOIA  activities, the Privacy Office is responsible for coordinating and  overseeing the components’ FOIA operations, providing FOIA-related  training, and preparing the required annual reports on the department’s  FOIA performance.
Toward this end, the office currently performs a number of oversight and  coordination functions:
Requests weekly and monthly reports by all components on their  FOIA processing, including monthly statistics on the number of  requests processed and backlogged. For example, it requires all  components to provide a monthly report to the Privacy Office on  processed and pending FOIA requests, the number of days to  respond to a request, and the component’s ten oldest FOIA requests,  among other reporting requirements.
Takes corrective measures to address components’ actions. For  example, in October 2012, the Privacy Office issued a memorandum  to all components on sending a letter to a FOIA requester when the  passage of time or a change in circumstance raises a question about  whether the requester is still interested in obtaining the requested  records.
Provides FOIA training to new employees. In fiscal year 2013, the  office conducted biweekly training on FOIA for approximately 200 new  employees. Included in the training was a discussion of best practices  for safeguarding personally identifiable information.
Provides assistance by detailing staff to components as needed. For  example, the Privacy Office temporarily assigned a member of its staff  to ICE to assist with a particularly large request.
Provides technical support to encourage the adoption of automated  FOIA processing capabilities. For example, the office provided copies  of FOIA processing software to various components at no cost in  order to encourage adoption of a single FOIA processing application  across DHS.
Routes FOIA requests addressed generally to DHS to the appropriate  component(s) and coordinates responses to some requests that  involve multiple components.
Coordinates department-level compliance with FOIA by developing  and disseminating policies and guidance to implement the act. For  example, in 2003, the office issued a directive on FOIA roles and  responsibilities throughout the department. In addition, in May 2009,  the DHS Chief FOIA Officer issued a memorandum to all component  agencies and offices discussing presumption of disclosure and  exemptions as set forth by the Attorney General’s guidelines. Further  in 2012, the office issued a memorandum on processing “misdirected”  FOIA requests, emphasizing the importance of routing misdirected  requests to the appropriate component as soon as possible.
Apart from the Privacy Office, each of the selected component agencies  separately administers its own FOIA program—subject to regulations and  policies issued by the Privacy Office/Chief FOIA Officer. Components’  FOIA programs are subject to the same laws, regulations, and Justice  guidance as the department’s program, and typically perform the  functions of any FOIA program—maintaining a FOIA library, making a  determination on a request for a fee waiver, and referring other offices’  documents to the actual owner. However, they may have different  operating procedures due, for example, to the type of documents they  process, or their geographic dispersion. Each selected component has its  own FOIA Officer, who is usually also the FOIA Public Liaison, and most  maintain their own online FOIA library. The components have a few  additional responsibilities as part of a larger organization, such as the  requirement to report information to the Privacy Office, and the need to  exchange electronic data smoothly with other DHS components.
From an operational standpoint, however, the components differ  considerably in how they meet their responsibilities. As shown in table 2,  the selected DHS components’ FOIA offices are responsible for  processing different types of requests depending on their mission. They  also vary considerably with regard to both the number of FOIA requests  received and the number of staff who process them. For example, in  fiscal year 2013, USCIS reported that it received approximately 133,000  FOIA requests, mostly for immigrants’ files, while FEMA reported that it  received about 800 requests, often related to disasters.
section_title: Privacy Office Has Not Updated its FOIA Regulation to Inform the Public of Its Operations
paragraphs: Agencies are required by FOIA to publish regulations that govern and  help inform the public of their FOIA programs. These rules are to provide  guidance on the procedures to be followed in making a FOIA request and  on specific matters such as fees and expedited processing of requests.  Toward this end, in January 2003, DHS issued an interim final regulation  establishing its procedures for implementing FOIA. The regulation  describes steps that individuals are required to follow in making requests,  such as submitting a written request directly to the component that  maintains the record. It also explains the department’s processing of such  requests, including charging fees for the requested records.
However, since the department’s regulation was issued in 2003,  important changes have occurred in how DHS processes FOIA requests;  yet, the regulation has not been updated to reflect those changes. For  example, since the regulation was issued, amendments have been  enacted by the OPEN Government Act of 2007. These amendments  included a requirement for federal agencies to have FOIA public liaisons  and placed a limitation on fees that agencies can charge electronic news  media. In addition, the President’s FOIA memorandum, Transparency  and Open Government, as well as the Attorney General’s FOIA  guidelines of 2009, required that agencies take specific actions to ensure  that the government is more transparent, participatory, and collaborative.  Specifically, agencies were required to rapidly disclose information,  increase opportunities for the public to participate in policymaking, and  use innovative tools, methods, and systems to cooperate amongst  themselves and across all levels of government.
The department has taken actions to implement these FOIA-related  requirements. Specifically, it established a FOIA public liaison officer and  issued a memo directing the department and its components to ensure  transparency by adding categories of records to be posted on  component agencies’ websites and linked to their respective electronic  reading rooms. In addition, the department began accepting FOIA  requests for records via e-mail. Nonetheless, while it has taken these  actions, the department has not revised its regulation to address the role  of the public liaison, the fee limitation for electronic news media requests,  or the fact that the department accepts requests via e-mail.
Officials in the Privacy Office stated that a draft of a new regulation was  due to be released for public comment during the summer of 2014, with a  final updated regulation planned for the end of 2014. However, as of  September 2014, the draft regulation had not been released.
Without an updated regulation reflecting changes in how it processes  FOIA requests, DHS lacks an important mechanism for effectively  facilitating public interaction with the department on the handling of FOIA  requests. Moreover, the Privacy Office lacks current policies to  consistently guide the components’ efforts in effectively responding to  such requests.
section_title: Full FOIA Costs of DHS’s Privacy Office and Selected Components are Unknown
paragraphs: Both Justice and federal cost accounting standards require federal  agencies to report on specific categories of FOIA-related costs.  Specifically, as part of the annual guidance that it has issued on preparing  annual FOIA reports, Justice requires agencies to report processing costs  and litigation-related costs. According to Justice, FOIA processing costs  include the sum of all costs expended by the agency for processing the  initial FOIA request and any administrative appeals, including salaries of  FOIA personnel, overhead, and any other FOIA-related expenses. Justice  also has developed a reporting tool— the DOJ Annual FOIA Report  Tool—that agencies can use to report their FOIA activities.
In addition, the federal management cost accounting standards agencies to report both direct and indirect costs to provide reliable and  timely information on the full cost of federal programs. Direct costs  include:  salaries and other benefits for employees who work directly on the  output, materials and supplies used in the work, various costs associated with office space, equipment, facilities, and  utilities, and  costs of goods or services received from other segments or entities.
Indirect costs are for resources that are jointly or commonly used to  produce two or more types of outputs but are not specifically identifiable  with any of the outputs. Typical examples of indirect costs include: general technical support (e.g., information technology services such  costs of general administrative services,  as telecommunications),  security, and  rent and operating and maintenance costs for buildings, equipment,  and utilities.
Federal Accounting Standards Advisory Board, Statement of Federal Financial  Accounting Standards 4, Managerial Cost Accounting Standards and Concepts (version  13, June 2014).
However, neither the selected components, nor the Privacy Office, which  collects and aggregates data on the department’s FOIA costs, report all  categories of costs required by Justice and federal financial accounting  standards. Further, data submitted by the selected components were  often incomplete. Specifically, while the Privacy Office and the selected  components all reported the salaries of FOIA office staff as input to the  department’s FOIA annual report for fiscal year 2013, most did not report  or did not fully report costs for other categories, including employee  benefits, non-personnel direct costs, indirect costs, and salaries of staff  outside the components’ FOIA offices who retrieve requested documents.  Table 3 summarizes the extent to which costs were reported by the  Privacy Office and the selected components in the department’s 2013  FOIA annual report.
As reflected in the table, when submitting data for the 2013 FOIA annual  report, the Privacy Office and all five selected components reported all or  a portion of salary costs incurred. However, two of the six reported all or a  portion of their costs incurred for employee benefits; three reported all or  a portion of their direct non-personnel costs; two reported all or a portion  of their indirect costs; and four reported all or a portion of costs for offices  other than the FOIA office.
Officials in the Privacy Office and components attributed the  underreporting of costs to two factors: a lack of detailed cost guidance  and difficulty in capturing all personnel costs associated with the  processing of FOIA requests. In this regard, officials in the Privacy Office  stated that they do not have specific guidance on determining FOIA costs.  They stated that the Justice guidance is high-level and does not reflect all  areas of cost. Further, the officials stated that DHS does not have a  specific form or template specifying required cost categories to aid the  components in identifying and collecting the relevant cost data.
Privacy Office and component officials stated that, when processing a  FOIA request, substantial costs may be incurred by offices other than the  components’ FOIA offices, and these costs are difficult to capture. In  particular, they stated that, when documents responding to a FOIA  request must be retrieved by an office other than the component’s central  FOIA office, it can be difficult to determine the cost of search and retrieval  activities performed by staff in that other office.
Further, officials at CBP, Coast Guard, FEMA, ICE, and Privacy said that  costs for their FOIA operations are being underreported. They stated that  it is difficult to collect data on costs incurred by other offices that support  their FOIA operations. According to the FOIA Officer at ICE, although a  form exists for that component’s program offices to account for hours  spent on FOIA activities, ICE did not report this information to the Privacy  Office because ICE considers other FOIA activities to be a higher priority.
Until DHS takes steps to improve its reporting of costs for its FOIA  operations, such as by providing components with guidance on reporting  costs, the department will lack critical information for effectively managing  its FOIA operations, and that is needed to inform Congress’ oversight of  the department’s efforts.
section_title: Duplication Exists in Certain Components’ Processing of Immigration Files
paragraphs: Our work has noted that duplication exists when two or more agencies  or programs are engaged in the same activities or provide the same  services to the same beneficiaries. Among the most frequent FOIA  requests made to DHS are those for immigration files. These files usually  contain various types of information pertaining to immigrants, including  asylum applications, law enforcement records, and border crossing  documents. As such, they may contain information and records that are  generated by various DHS components or other agencies.
Within DHS, three components—USCIS, CBP, and ICE—create most of  the documents included in immigration files. USCIS is the custodian of  the files, and all FOIA requests for such files are either initiated with, or  referred to, this component for processing. Specifically, to process a FOIA  request for an immigration file, the USCIS staff to whom the request is  assigned first manually enters the requester’s data, such as a name and  address, into USCIS’s FOIA system to establish a record of the request.  Next, the staff retrieves and scans the documents in the requested file  and reviews the documents. If all of the documents were generated by  USCIS, the staff makes redactions as needed, sends the documents to  the requester, and closes out the request.
Further, if the FOIA request covers files containing documents generated  by CBP, then USCIS is able to process the request on the basis of an  agreement to that effect with CBP. By having USCIS process such  requests for CBP documents, the two components avoid duplication in  their response to a FOIA request.
On the other hand, USCIS and ICE do not have such an agreement for  documents generated by ICE. Thus, the USCIS staff is to identify any  such documents and make them available to ICE’s FOIA staff for their  separate processing. In doing so, USCIS and ICE currently engage in  duplicative processing of FOIA requests for those immigration files  containing documents related to law enforcement activities that were  generated by ICE.USCIS staff transfer copies of the ICE-generated documents to a  temporary electronic storage drive that USCIS maintains. According to  USCIS officials, ICE has been granted access to this electronic storage  drive so that it can retrieve files containing the documents that it  generates. ICE retrieves the documents, and the ICE staff then re-enters   Specifically, to facilitate ICE’s review of such files,  the data to create a new FOIA request in ICE’s FOIA processing system.  The staff then proceeds with processing the requested documents, and  releases them to the requester—in essence, undertaking a new, and  duplicate, effort to respond to the FOIA request.
Figure 2 depicts the duplication that occurs in USCIS’s and ICE’s  downloading and re-entering of data to respond to FOIA requests for  immigration files.
In prior years, up until April 2012, the two components had an agreement  whereby USCIS processed ICE’s documents contained in an immigration  file. However, the components’ officials stated that, since that agreement  ended, the components have not made plans to enter into another such  agreement. According to ICE’s FOIA Officer, USCIS’s processing of ICE’s  documents in immigration files was viewed as being too costly.  Nonetheless, while there would be costs associated with USCIS  processing ICE’s documents in immigration files, the potential exists for  additional costs to be incurred in the continued duplicate processing of  such files.
The absence of an agreement between USCIS and ICE regarding the  handling of FOIA cases contributes to the duplicate processing of the  immigration files. Further, the duplicate processing of a single FOIA  request by USCIS and ICE staff contributes to an increase in the time  needed to respond to a FOIA request for immigration files. Because  USCIS does not send the immigration file to ICE until it has completed its  own processing of the relevant documents—which, according to USCIS,  takes on average 20 working days—ICE usually does not receive the file  to begin its own processing until the 20-day time frame for responding to  a request has passed.
Re-establishing an agreement that allows USCIS to process ICE- generated documents included in requests for immigration files, to the  extent that the benefits of doing so would exceed the cost, could enable  the two components to eliminate duplication in their processes for  responding to such a request. Further, it could help reduce the time  needed by these components in responding to a request.
section_title: DHS and Selected Components Have Taken Actions to Reduce Backlogged Requests, with Varying Success
paragraphs: The 2009 OMB Open Government Directive required all federal agencies  with significant pending backlogs to reduce the number of their  backlogged FOIA requests by at least 10 percent per year. The June  2011 DHS Open Government Plan 2.0 further directed the department  and its components to reduce the FOIA backlog by 15 percent per year.
Toward this end, officials in DHS’s Privacy Office and the selected  components identified various actions that they have taken since 2011 to  reduce the number of their backlogged requests. With these actions,  USCIS reduced its backlog consistently from 2011 through 2013. FEMA  had a lower backlog in 2012, but an overall increase by 2013, and the  Privacy Office and other selected components’ backlogs increased.  Specifically, there was a total of about 41,000 backlogged requests in  fiscal year 2011 and about 47,000 in fiscal year 2013. The number of  requests received had increased from about 170,000 requests in 2011 to  about 210,000 in 2013, and the number processed increased from about  140,000 in 2011 to about 190,000 in 2013. Agency officials reported that  the number of requests received had increased and the increase had  contributed to their backlog.
Privacy Office. According to its officials, the Privacy Office holds  regularly scheduled production meetings, at which the FOIA Production  Manager reviews all pending cases, and weekly staff meetings where  roadblocks to closing backlogged requests are discussed. Further, the  FOIA Production Manager stated that weekly and, in some cases, daily  production reports are received from all processing staff. However,  despite these efforts, the number of backlogged requests grew from 4 in  2011 to 20 in 2013. Privacy Office officials attributed the backlog growth  to an increase in the number of offices for which the Privacy Office  processes FOIA requests. In 2013, the office added 3 additional  headquarters offices to those for which it processes requests and  inherited their backlogs.
USCIS. To reduce the number of backlogged requests, USCIS increased  the number of its full-time FOIA staff from 188 to 201, and the number of  its total full-time equivalent staff from 195 to 227 from 2011 through 2013.  Further, to reduce the backlog, the agency used temporary assignments  of contractor staff; it also conducted a Lean Six Sigma project to  improve processing throughput. The effort was successful, resulting in an  increase in average monthly cases closed from 7,300 to 10,800. Specific  actions taken under this initiative included: offering awards to staff for increased production; establishing minimum page count standards for processors at enhancing communication and team development through monthly  different grade levels;  creating a GS-12 team leader position for high-performing staff; and  development sessions and leadership development.
Lastly, according to USCIS officials, telework was expanded to 2 days a  week, leading to increased productivity among staff who telework. As a  result of these efforts, USCIS reported that it had succeeded in reducing  its backlogged requests from 35,780 in 2011 to 3,394 in 2013.
CBP. To assist with reducing its backlog, CBP developed a management  plan for fiscal years 2013-2014 that included moving the FOIA function  organizationally from its Office of International Trade to the Privacy and  Diversity group; hiring new permanent staff to help process requests;  using temporary staff; and extending the agreement that allows USCIS to  process its documents. According to agency officials, the new  organizational placement has enabled the FOIA office to get more  management attention and better address issues related to its FOIA  operations.
Nonetheless, CBP experienced a large increase in the number of its  backlogged requests from fiscal year 2011 through fiscal year 2013— from 4,356 requests to 37,848 requests. According to CBP officials, two  problems, in particular, contributed to the higher numbers. First,  approximately 11,000 FOIA cases that were improperly closed in 2012  had to be reopened and reprocessed. Second, after its reorganization, a  new manager found a stack of boxes containing 12,000 paper requests  from 2012 that had never been entered into their processing system. The  officials stated that CBP subsequently cleared all of these requests.
ICE. In April 2012, ICE opened a new office in Florida to process referrals  from USCIS. It also trained 20 temporary staff to help process the  backlogged requests. Further, in April 2013, the agency engaged a  contractor to process backlogged requests. Lastly, the agency developed  performance work plans for staff, which specified the number of FOIA  requests or document pages that staff should process weekly.
Even with these steps, however, ICE’s backlog grew from 18 requests in  fiscal year 2011 to 4,714 in 2013. Officials attributed this increase, in part,  to increased public interest due to immigration reform, increases in the  complexity of requests received, and the expiration of its agreement with  USCIS to process ICE documents contained in immigration files.
FEMA. During its “non-disaster season” (February to May 2014), FEMA  used 10 staff redeployed from other areas in the agency to help process  its FOIA backlog. The staff received 2 weeks of training and closed 56  cases. FEMA also received assistance from the Privacy Office to process  one case with more than 4 million pages of documents.
Nonetheless, FEMA had a backlog of 485 requests in 2011 and 496  requests in 2013. These numbers are relatively high compared to the  number of requests—about 800—that the agency received in 2013. In the  2014 Chief FOIA officer report, FEMA officials cited these factors  impacting their ability to address the backlog: a loss of experienced FOIA  professionals, difficulty in replacing these staff, and the need to process  the one particularly voluminous request that it received.
Coast Guard. Officials from the Coast Guard told us that they had  attempted to reduce their backlog by sending reminders to program  offices about open FOIA requests. Specifically, bi-monthly reports are  sent to their field units as a reminder to account for their efforts to reduce  their backlog.
However, Coast Guard’s backlog increased from 527 in fiscal year 2011  to 877 in fiscal year 2013. In the 2014 Chief FOIA officer report, Coast  Guard officials reported that factors impacting their ability to reduce the  backlog included a lack of full-time professional FOIA staff, which results  in reliance on part-time military staff who process FOIA requests as a  collateral duty, may not be trained, and rotate frequently. The  consequence, according to the FOIA office, is confusion, delays,  backlogged requests, and errors. The Coast Guard also attributed  inability to reduce its backlog to an increase in the complexity of the  requests it received.
Figure 3 shows changes in the numbers of backlogged requests for the  Privacy Office and the selected components from fiscal year 2011  through fiscal year 2013.
section_title: DHS and Selected Components Have Implemented Automated Systems to Process FOIA Requests, but Systems Lack Recommended Capabilities
paragraphs: Various FOIA amendments and guidance call for agencies such as DHS  to use electronic systems to improve FOIA processing. In particular, the  OPEN Government Act of 2007 amended FOIA to require that federal  agencies establish a system to provide individualized tracking numbers  for requests that will take longer than 10 days to process and establish  telephone or Internet service to allow requesters to track the status of  their request. Further, the President’s January 2009 “Freedom of  Information Act” memo instructs agencies to use modern technology to  inform citizens about what is known and done by their government.
Beyond these requirements, a select group of federal agencies have  collectively identified capabilities that they consider to be best practices  for FOIA processing. Specifically, in conjunction with the Department of  Commerce and the Environmental Protection Agency, the National  Archives and Records Administration’s Office of Government Information  Services identified 13 electronic system capabilities that can enhance  FOIA processing: using a single, component-wide system for tracking requests; accepting the request online, either through e-mail or an online assigning the request tracking number and tracking the status of the multi-tracking a request electronically; allowing supervisors to review the case file to approve redactions and  routing a request to the responsible office electronically;  storing and routing responsive records to the appropriate office  electronically;  redacting responsive records with appropriate exemptions applied  electronically;  calculating and recording processing fees electronically;  fee calculations for processing electronically; generating system correspondence, such as an e-mail or letter, with a allowing a requester the ability to track the status of the request  electronically;  tracking an appeal electronically; and generating periodic reporting statistics electronically, such as monthly  backlog and annual report data used to develop reports.
Additionally, in identifying the requirements for a multiagency FOIA portal,  Justice and the Environmental Protection Agency determined that the  ability to search for responsive records online is a high-level requirement  for FOIA processing systems.
Lastly, FOIA processing systems, like all federal electronic information  technology systems, are to comply with the requirements of Section 508  of the Rehabilitation Act (as amended). This act requires federal agencies  to make their electronic information accessible to people with  disabilities.
In order to facilitate the implementation of these capabilities and  requirements, DHS and its component agencies have acquired and are  using various automated systems to assist with tracking and processing  FOIA requests. For example, the Privacy Office and two of the selected  components are using FOIAXpress, a commercial off-the-shelf FOIA case  processing system, while one component is using workflow processing  software that it developed in-house, called the FOIA/Privacy Act  Information Processing System. The automated systems being used by  the Privacy Office and the selected component agencies are described in  table 4.
The systems being used by the DHS Privacy Office and selected  components vary in the extent to which they include the capabilities  recommended by the Department of Commerce, the Environmental  Protection Agency, and the National Archives and Records Administration  to enhance FOIA processing and address Section 508 requirements.  Specifically, the Privacy Office and three selected components (CBP,  FEMA, and ICE) have acquired systems that encompass all the  recommended and required capabilities. One component, USCIS, has  acquired a system that meets 13 of the capabilities, partially meets 1  capability, and does not meet 1 capability. The remaining agency, the  Coast Guard, has not implemented most of the capabilities (12 of 15).  Table 5 shows the extent to which the Privacy Office’s and selected  components’ processing systems include the recommended and required  capabilities.
According to Privacy Office officials, DHS has not required the use of a  standardized FOIA processing system, although 3 of the 5 selected  components currently use the same system. They stated that the  component agencies have acquired specific systems based on their  individual needs. USCIS officials stated, for example, that their current  system—the FOIA/Privacy Act Information Processing System—has been  developed to meet that component’s specific needs. The officials added  that they have no plans to convert to another FOIA processing system or  make enhancements to the current system to fully address all required  and recommended capabilities. As shown in table 5, the current system  does not have the capability to e-mail correspondence to a requester. In  addition, USCIS has not ensured that its system includes capabilities that  make it compliant with requirements of Section 508 of the Rehabilitation  Act (as amended).
Coast Guard officials stated, as of September 2014, that they were on  schedule to convert to FOIAXpress in October 2014, which would  incorporate all of the recommended best practice capabilities and be  compliant with Section 508 requirements. However, we were not provided  any documentation to demonstrate that the transition will take place as  planned.
USCIS and Coast Guard have an opportunity to improve the efficiency  with which they process FOIA requests by acquiring processing systems  that incorporate all recommended best practice capabilities. Moreover,  having systems with capabilities that are compliant with Section 508 of  the Rehabilitation Act (as amended) is essential to ensure that the  components’ electronic information is accessible to people with  disabilities.
section_title: Conclusions
paragraphs: Responsibility for FOIA processing is shared between DHS’s Privacy  Office and component FOIA offices, with the components processing the  majority of FOIA requests made to the department. The Privacy Office  conducts oversight and policy-making functions, but the lack of an up-to- date FOIA regulation leaves gaps in the department’s FOIA procedures  and limits public visibility into its processing of requests. Further,  inconsistent reporting of the costs of FOIA processing across the  department has resulted in incomplete cost data, which, in turn, hinders  management oversight. In addition, the lack of an agreement between  USCIS and ICE has led to duplication of effort in processing FOIA  requests for immigration files, as well as delays in the department’s ability  to provide the requested information. Re-establishing an agreement, to  the extent that the benefits of doing so would exceed the costs, could  help eliminate such duplication.
The DHS Privacy Office and the agency components selected for our  study have taken a variety of actions aimed at reducing the number of  their backlogged requests. Nonetheless, with the exception of one  selected component, USCIS, reported that its backlog increased from  fiscal year 2011 to fiscal year 2013, falling short of the department’s  reduction goals.
Most of the agency components in our study have implemented  automated systems that include capabilities recommended to improve  FOIA processing. However, USCIS has only partially implemented  capabilities for providing system-generated correspondence to  requesters. Full implementation could help improve the efficiency with  which it processes FOIA requests. In addition, the Coast Guard has not  implemented the majority of the recommended capabilities for improving  its FOIA processing. Further, absent capabilities consistent with Section  508 of the Rehabilitation Act (as amended), the two components are not  implementing the federal requirement to make their electronic information  accessible to people with disabilities.
section_title: Recommendations for Executive Action
paragraphs: To improve the management of DHS FOIA requests, we recommend that  the Secretary of DHS direct the Chief FOIA Officer to take the following  four actions:
Finalize and issue an updated DHS FOIA regulation.
Improve reporting of FOIA costs by including salaries, employee  benefits, non-personnel direct costs, indirect costs, and costs for other  offices.
Determine the viability of re-establishing the service-level agreement  between USCIS and ICE to eliminate duplication in the processing of  immigration files. If the benefits of doing so would exceed the costs,  re-establish the agreement.
Direct USCIS and Coast Guard to fully implement the recommended  FOIA processing system capabilities and the section 508 requirement.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Director  of DHS’s Departmental GAO-OIG Liaison Office.  In the comments, which  are reproduced in appendix II, the department concurred with all four of  our recommendations and identified actions taken or planned to address  them.  Specifically, DHS stated that its Privacy Office is drafting a  comprehensive FOIA regulation and also plans to draft and disseminate  policy to ensure that all components are capturing the full cost of FOIA.   Further, according to the department, a working group will be formed to  determine the viability of re-establishing the service level agreement on  FOIA processing between USCIS and ICE. Lastly, the department stated  that it will draft guidance for components to fully implement the  recommended FOIA processing system capabilities and Section 508  requirement. The department estimated that it will complete all actions by  April 30, 2015. In addition, DHS also provided technical comments, which  we incorporated as appropriate.
We are sending copies of this report to the Secretary of Homeland  Security. In addition, this report is available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have questions about this report, please contact me at  (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to determine: (1) the responsibilities of, and total  costs incurred by, the Department of Homeland Security (DHS) and  selected components in managing and processing FOIA requests, and  whether any duplication exists; (2) actions DHS and the selected  components have taken to reduce FOIA backlogs and the results of their  actions; and (3) the status of DHS’s and the selected components’ efforts  to acquire and implement automated systems for processing FOIA  requests.
To address the study objectives, we collected and analyzed published  statistics and other documentation, and conducted interviews with  responsible officials at the DHS Privacy Office and five selected DHS  components. We purposefully selected the components by analyzing the  department’s fiscal year 2012 data on FOIA requests received, backlogs,  and reported costs. We then selected U.S. Customs and Border  Protection (CBP), the U.S. Citizenship and Immigration Services (USCIS),  and Immigration and Customs Enforcement (ICE) because they were  highest in all three categories—requests, backlogs, and reported costs.  Next, we selected the U.S. Coast Guard (Coast Guard) because it is the  component with the fifth highest volume of requests and backlogged  requests and currently uses a manual process to track and process its  FOIA requests. We purposefully selected the Federal Emergency  Management Agency (FEMA) because it was the fourth highest in  reported total costs and had unusually high reported costs for the number  of requests it processed as compared to USCIS, CBP, and ICE. We  included the DHS Privacy Office because it has overall responsibility for  FOIA at the department level. Collectively, our selections account for  about 95 percent of total reported DHS requests received, 87 percent of  reported backlogged requests, and 76 percent of reported costs.
To determine the responsibilities of DHS and the selected components in  managing and processing FOIA requests, we reviewed organization  charts; the department’s and components’ policies and procedures;  service level agreements; and published materials, such as DHS FOIA  annual reports and DHS Chief FOIA Officer reports. We interviewed DHS  and component officials about their responsibilities and management  practices.
To determine the total costs incurred by DHS and its selected  components in managing and processing FOIA requests, we examined  overall costs as reported in the 2013 annual FOIA report, as well as  detailed cost breakdowns used by the Privacy Office and the selected  components to calculate their reported costs. To determine if all required  cost categories were being reported, we analyzed the categories of costs  reported and compared them to the cost categories required by the  Department of Justice (Justice) and federal management cost accounting  standards to determine the extent to which required cost elements were  being reported. Further, we analyzed cost documentation provided, and  interviewed agency officials to determine how costs were collected and  what steps were taken to assure that cost figures were reliable. In  assessing whether DHS and the selected components reported cost  categories, we applied the following criteria: “yes” if reporting of costs was  complete and was deemed reliable, “partial” if reported costs were  incomplete or were judged not completely reliable, and “no” if they were  not reported. Due to the non-reporting of particular cost categories and  concerns about the accuracy of certain reported cost data, including data  with obvious errors and inconsistent accounts of how data were collected,  we concluded that, overall, the cost data provided were not sufficiently  reliable, based on federal management cost accounting standards, to  determine DHS’s total FOIA costs, but that our analysis allowed us to  conclude that overall costs were underreported.
To determine if duplication exists in managing and processing FOIA  requests, we examined policies and procedures, viewed demonstrations  of how automated systems are used to manage and process requests,  and interviewed agency officials to clarify workflow. We evaluated the  processes against recommended practices discussed in our previously  issued reports that addressed duplication in federal government  programs.
To determine what actions DHS and the selected components have taken  to reduce their FOIA request backlogs and what have been the results of  those actions, we examined backlog reduction goals published by the  Office of Management and Budget, DHS, and the selected components.  We examined DHS annual FOIA reports and Chief FOIA Officer reports,  analyzed published statistics, and reviewed monthly backlog reports by  the components to determine whether reduction goals were met. We  interviewed agency officials and collected documents to determine what  specific actions have been taken to reduce backlogs, identify actions that  had been successful in reducing backlogs, and determine the underlying  causes for the backlogged requests.
To determine the status of DHS’s and selected components’ efforts to  acquire and implement automated systems, we assessed the capabilities  of automated systems in use by the Privacy Office and the selected  components. Specifically, we viewed demonstrations of systems used for  tracking and processing requests and obtained documentation, such as  user manuals and screen prints. We compared the capabilities of these  systems to relevant statutory requirements, such as the OPEN  Government Act requirement to assign tracking numbers to FOIA  requests, and 13 systems capabilities considered to be best practices for  FOIA processing compiled by the National Archives and Records  Administration’s Office of Government Information Services in conjunction  with the Department of Commerce and the Environmental Protection  Agency. In assessing DHS’s and the components’ actions to implement  these capabilities, we applied the following criteria: “yes” means the  capability had been implemented; “partially” means the capability was not  implemented in its entirety, and “no” means the capability was not  implemented. We also interviewed Privacy Office and selected  component officials and collected documents describing one component’s  plans to implement a new tracking system.
In examining reported data on the volumes of FOIA requests made to  DHS, we found two data reliability issues of concern. First, we found that  a FOIA request may be recorded and counted more than once. For  example, USCIS may receive a request for an immigration file, which it  counts. It may then refer to ICE for processing certain documents in the  file that were created by that component. ICE then enters this referral in  its FOIA processing system as a new request. Thus, even though the  department may have received one request for one immigration file, it  may be reported as two requests received and closed by both USCIS and  ICE. Similarly, a request sent to more than one component may be  entered separately by each component that responds. Nonetheless, while  this double counting may result in an inaccurate number of total requests  received by DHS, it did not affect our findings, since we have no findings  related to the overall volume of requests handled by DHS.
The second issue involved a group of FOIA requests that were improperly  closed by CBP in fiscal year 2012. CBP counted the requests as closed,  although they should have remained open and been counted as part of  the component’s backlog of requests. As a result, the component  reported a lower number of backlogged requests for 2012 than actually  existed. CBP officials did not know exactly how many requests were  involved, but estimated that there were about 11,000. The underreporting  of the backlog of requests does not, however, affect our observation that  CBP’s backlog increased over the time period from 2011 through 2013  because CBP processed all of these requests during this time frame.
We conducted our work from November 2013 to November 2014 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgements
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Anjalique Lawrence (assistant  director), Chris G. Businsky, Nancy Glover, Lisa Hardman, Alina J.  Johnson, Lee McCracken, Freda Paintsil, Glenn Spiegel, and Walter  Vance made key contributions to this report.