Federal Records: Agencies Face Challenges in Managing E-Mail
Published: 2008-04-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal agencies are increasingly using electronic mail (e-mail) for essential communication. In doing so, they are potentially creating messages that have the status of federal records, which must be managed and preserved in accordance with the Federal Records Act. To carry out the records management responsibilities established in the act, agencies are to follow implementing regulations that include specific requirements for e-mail records. In view of the importance that e-mail plays in documenting government activities, GAO was asked to testify on issues relating to the preservation of electronic records, including e-mail. As agreed, GAO's statement discusses challenges facing agencies when managing their e-mail records, as well as current policies and practices for managing e-mail messages that qualify as federal records. This testimony is primarily based on preliminary results of ongoing work, in which GAO is examining, among other things, e-mail policies at four agencies of contrasting sizes and structures (the Department of Homeland Security, the Environmental Protection Agency, the Federal Trade Commission, and the Department of Housing and Urban Development), as well as the practices of selected senior officials.
section_title: What GAO Found
paragraphs: E-mail, because of its nature, presents challenges to records management. First, the information contained in e-mail records is not uniform: it may concern any subject or function and document various types of transactions. As a result, in many cases, decisions on which e-mail messages are records must be made individually. Second, the transmission data associated with an e-mail record--including information about the senders and receivers of messages, the date and time the message was sent, and any attachments to the messages--may be crucial to understanding the context of the record. Third, a given message may be part of an exchange of messages between two or more people within or outside an agency, or even of a string (sometimes branching) of many messages sent and received on a given topic. In such cases, agency staff need to decide which message or messages should be considered records and who is responsible for storing them in a recordkeeping system. Finally, the large number of federal e-mail users and high volume of e-mails increase the management challenge. Preliminary results of GAO's ongoing review of e-mail records management at four agencies show that not all are meeting the challenges posed by e-mail records. Although the four agencies' e-mail records management policies addressed, with a few exceptions, the regulatory requirements, these requirements were not always met for the senior officials whose e-mail practices were reviewed. Each of the four agencies generally followed a print and file process to preserve e-mail records in paper-based recordkeeping systems, but for about half of the senior officials, e-mail records were not being appropriately identified and preserved in such systems. Instead, e-mail messages were being retained in e-mail systems that lacked recordkeeping capabilities. (Among other things, a recordkeeping system allows related records to be grouped into classifications according to their business purposes.) Unless they have recordkeeping capabilities, e-mail systems may not permit easy and timely retrieval of groupings of related records or individual records. Further, keeping large numbers of record and nonrecord messages in e-mail systems potentially increases the time and effort needed to search for information in response to a business need or an outside inquiry, such as a Freedom of Information Act request. Factors contributing to this practice were the lack of adequate staff support and the volume of e-mail received. In addition, agencies had not ensured that officials and their responsible staff received training in recordkeeping requirements for e-mail. If recordkeeping requirements are not followed, agencies cannot be assured that records, including information essential to protecting the rights of individuals and the federal government, is being adequately identified and preserved.

section_title: Letter
paragraphs: I appreciate the opportunity to discuss critical issues surrounding  the federal government’s management of electronic mail messages.  As you are aware, federal agencies are increasingly using electronic  mail (e-mail) for essential communication, and in doing so, they are  potentially creating messages that have the status of federal records.  According to the Federal Records Act, federal records are  information in whatever form that documents government  functions, activities, decisions, and other important transactions,  and such records must be managed and preserved in accordance  with the act. As the volume of federal e-mail grows, so does the  challenge of managing electronic records.
Under the act, the National Archives and Records Administration  (NARA) has responsibilities for oversight and guidance of federal  records management, which includes management of e-mail  records. Agencies also have records management responsibilities,  which as specified by NARA include the responsibility to develop e- mail management policies and practices that include specific  requirements, such as defining staff responsibilities for determining  whether an e-mail (including any associated attachments) is a  federal record and, further, requiring preservation of record e-mail.
As requested, my statement will focus on current practices used in  managing e-mail messages that qualify as federal records. After a  brief discussion of federal requirements, I will outline some of the  challenges facing agencies when managing their e-mail records and  then discuss e-mail records management policies and practices that  we are reviewing at four agencies. Finally, I will offer brief  comments on recently drafted legislation in this area.
In my statement today, my discussion of e-mail records management  challenges, policies, and practices is based on the preliminary  results of work we are doing at your and the full committee’s  request, which we expect to publish later this year. For this  engagement, we selected four federal agencies based on contrasting  sizes and structures and on the significance of their records to  protecting rights and documenting accountability: the Department  of Homeland Security (DHS), the Environmental Protection Agency  (EPA), the Federal Trade Commission (FTC), and the Department of  Housing and Urban Development (HUD). For each agency, we are  reviewing the e-mail management practices of four senior officials  (including the agency head), using responses to a series of data  collection instruments, interviews with agency officials, and  inspection of a limited number of sample e-mail records identified  by the agencies to corroborate their statements. Also, to develop  comments on the legislation, we analyzed the provisions of the bill  related to our ongoing work.
The ongoing performance audit on which my comments today are  based, which began in April 2007, is being conducted in accordance  with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for  our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Advances in information technology and the explosion in computer  interconnectivity have had far-reaching effects, including the  transformation from a paper-based to an electronic business  environment and the capability for rapid communication through e- mail. Although these developments have led to improvements in  speed and productivity, they also require the development of ways  to manage information that is increasingly in electronic rather than  paper form. For federal agencies, such information includes e-mail  messages that may have the status of federal records.
subsections: section_title: NARA and Federal Agencies Have Responsibilities for Federal Records Management
paragraphs: Under the Federal Records Act, each federal agency is required to  make and preserve records that (1) document the organization,  functions, policies, decisions, procedures, and essential transactions  of the agency and (2) provide the information necessary to protect  the legal and financial rights of the government and of persons  directly affected by the agency’s activities. These records, which  include e-mail records, must be effectively managed. If they are not,  individuals might lose access to benefits for which they are entitled,  the government could be exposed to unwarranted legal liabilities,  and historical records of vital interest could be lost forever. In  addition, agencies with poorly managed records risk increased costs  when attempting to search their records in response to Freedom of  Information Act requests or litigation-related discovery actions.
Accordingly, agencies are required to develop records management  programs to ensure that they have appropriate recordkeeping  systems with which to manage and preserve their records. Among  the activities of a records management program are identifying  records and sources of records and providing records management  guidance, including agency-specific recordkeeping practices that  establish what records need to be created in order to conduct  agency business. Agencies are also required to schedule their  records: that is, to identify and inventory records, appraise their  value, determine whether they are temporary or permanent, and  determine how long the temporary records should be kept.
The act also gives the National Archives and Records Administration  (NARA) responsibilities for oversight and guidance of federal  records management, which includes management of e-mail  records. NARA works with agencies to schedule records, and it  must approve all records schedules. Records schedules may be  specific to an agency, or they may be general, covering records  common to several or all agencies. According to NARA, records  covered by general records schedules make up about a third of all  federal records. For the other two thirds, NARA and the agencies  must agree upon specific records schedules.
No record may be destroyed unless it has been scheduled. For  temporary records, the schedule is of critical importance, because it  provides the authority to dispose of the record after a specified time  period. (For example, General Records Schedule 1, Civilian  Personnel Records, provides instructions on retaining case files for  merit promotions; agencies may destroy these records 2 years after  the personnel action is completed, or after an audit by the Office of  Personnel Management, whichever is sooner.) Once a schedule has  been approved, the agency must issue it as a management directive,  train employees in its use, and apply its provisions to temporary and  permanent records.
NARA has issued regulations that specifically address the  management of e-mail records. As with other records, agencies are  required to establish policies and procedures that provide for  appropriate retention and disposition of e-mail records. NARA  further specified that for each e-mail record, agencies must preserve  certain transmission data—names of sender and addressees and  message date. Further, except for a limited category of “transitory”  e-mail records, agencies are not permitted to store the  recordkeeping copy of e-mail records in the e-mail system, unless  that system has certain features, such as the ability to group records  into classifications according to their business purposes and to  permit easy and timely retrieval of both individual records and  groupings of related records. These recordkeeping features are  important to ensure that e-mail records remain both accessible and  usable during their useful lives. For example, it is essential to be  able to classify records according to their business purpose so that  they can be retrieved in case of mission need. Further, if records  cannot be retrieved easily and quickly, or they are not retained in a  usable format, they do not serve the mission or historical purpose  that led to their being preserved. If agencies do not keep their e-mail  records in systems with the required capabilities, records may also  be at increased risk of loss from inadvertent or automatic deletion.
If agency e-mail systems do not have the required recordkeeping  features, either agencies must copy e-mail records to a separate  electronic recordkeeping system, or they must print e-mail messages  (including associated transmission information that is needed for  purposes of context) and file the copies in traditional paper  recordkeeping files. NARA’s regulations allow agencies to use either  paper or electronic recordkeeping systems for record copies of e- mail messages, depending on the agencies’ business needs.
The advantages of using a paper-based system for record copies of  e-mails are that it takes advantage of the recordkeeping system  already in place for the agency’s paper files and requires little or no  technological investment. The disadvantages are that a paper-based  approach depends on manual processes and requires electronic  material to be converted to paper, potentially losing some features  of the electronic original; such manual processes may be especially  burdensome if the volume of e-mail records is large.
The advantage of using an electronic recordkeeping system, besides  avoiding the need to manage paper, is that it can be designed to  capture certain required data (such as transmission data)  automatically. Electronic recordkeeping systems also make searches  for records on particular topics much more efficient. In addition,  electronic systems that are integrated with other applications may  have features that make it easier for the user to identify records, and  potentially could provide automatic or partially automatic  classification functions. However, as with other information  technology investments, acquiring an electronic recordkeeping  system requires careful planning and analysis of agency  requirements and business processes; in addition, electronic  recordkeeping raises the issue of maintaining electronic information  in an accessible form throughout its useful life.
section_title: Management of E-Mail Records Poses Challenges
paragraphs: Because of its nature, e-mail can present particular challenges to  records management. First, the information contained in e-mail  records is not uniform: it may concern any subject or function and  document various types of transactions. As a result, in many cases,  decisions on which e-mail messages are records must be made  individually. Second, the transmission data associated with an e- mail record—including information about the senders and receivers  of messages, the date and time the message was sent, and any  attachments to the messages—may be crucial to understanding the  context of the record. Third, a given message may be part of an  exchange of messages between two or more people within or  outside an agency, or even of a string (sometimes branching) of  many messages sent and received on a given topic. In such cases,  agency staff need to decide which message or messages should be  considered records and who is responsible for storing them in a  recordkeeping system. Finally, the large number of federal e-mail  users and high volume of e-mails increase the management  challenge. According to NARA, the use of e-mail results in more  records being created than in the past, as it often replaces phone  conversations and face-to-face meetings that might not have been  otherwise recorded.
These challenges have been recognized by NARA and the records  management community in numerous studies and articles. A 2001  survey of federal recordkeeping practices conducted by a contractor  for NARA concluded, among other things, that managing e-mail was  a major records management problem and that the quality of  recordkeeping varied considerably across agencies. In addition, the  study concluded that for many federal employees, the concept of a  “record” and what should be scheduled and preserved was not clear.
A 2005 NARA-sponsored survey of federal agencies’ policy and  practices for electronic records management concluded that  procedures for managing e-mail were underdeveloped. The study,  performed by the University of Maryland Center for Information  Policy, stated that most of the surveyed offices had not developed  electronic recordkeeping systems, but were instead maintaining  recordkeeping copies of e-mail and other electronic documents in  paper format. However, all of the offices also maintained electronic  records (frequently electronic duplicates of paper records).  According to the study team, the agencies did not establish  electronic recordkeeping systems due to financial constraints, and  implementing such systems was a considerable challenge that  increased with the size of the agency. As a result, organizations were  maintaining unsynchronized parallel paper and electronic systems,  resulting in extra work, confusion regarding which is the  recordkeeping copy, and retention of many records beyond their  disposition date.
Most recently, a NARA study team examined in 2007 the  experiences of five federal agencies (including itself) with electronic  records management applications, with a particular emphasis on  how these organizations used these applications to manage e-mail.  The purpose of the study was to gather information on the strategies  that organizations are using that may be useful to others. Among the  major conclusions from the survey was that implementing an  electronic records management application requires considerable  effort in planning, testing, and implementation, and that although  the functionality of the software product itself is important, other  factors are also crucial, including agency culture, training provided,  and management and information technology support. With regard  to e-mail in particular, the survey concluded that e-mail messages  can constitute the most voluminous type of record that is filed into  records management applications.
section_title: Agency Policies on Preserving E-Mail Records Are Not Followed Consistently
paragraphs: Our work on e-mail records management demonstrates that  agencies continue to face challenges similar to those identified by  the prior studies. While our results are preliminary and we are not  able to project them beyond the agencies we reviewed, I believe  they help illustrate the difficulties agencies can face when applying  NARA’s requirements to today’s operating environment.
subsections: section_title: Most Agency Policies Generally Complied with NARA Guidance
paragraphs: Three of the four agencies we reviewed—FTC, DHS, and EPA—had  policies in place that generally complied with NARA’s guidance on  how to identify and preserve e-mail records, but each was missing  one applicable requirement. Specifically, the policies at EPA and  FTC did not instruct staff on the management and preservation of e- mail records sent or received from nongovernmental e-mail systems  (such as commercial Web-based systems). Both EPA and FTC  officials told us that these instructions were not provided because  the staff were informed that use of outside e-mail systems for  official business was prohibited. However, whenever access to such  external systems is available at an agency, providing these  instructions is still required. DHS’s policy did not specify that draft  documents circulated via e-mail may be federal records. DHS  officials recognized that their policies did not specifically address  the need to assess the records status of draft documents, and said  they planned to address the omission during an ongoing effort to  revise the policies.
The policy at one of the four agencies, HUD, was missing three of  eight applicable requirements. One element of the policy was  inconsistent with NARA’s regulation: it required only the sender of  an e-mail message to review it for potential records status, but the  regulation states that e-mail records could include both messages  sent or received. HUD officials acknowledged that its policy omits  the recipient’s responsibility for determining the record status of e- mail messages and stated that its e-mail policy fell short of fully  implementing NARA regulations in this regard because the  department’s practice is not to use e-mail for business matters in  which official records would need to be created. However, this  practice does not remove the requirement for agency employees to  assess e-mail received for its record status, because the agency  cannot know that employees will not receive e-mail with record  status; the determination of record status depends on the content of  the information, not its medium.
In addition, two other requirements were missing from HUD’s  policy: it did not state, as required, that recordkeeping copies of e- mail should not be stored in e-mail systems and that backup tapes  should not be used for recordkeeping purposes. HUD officials stated  that they considered that these requirements were met by a  reference in their policy to the NARA regulations in which these  requirements appear. However, this reference is not sufficient to  make clear to staff that e-mail systems and backup tapes are not to  be used for recordkeeping.
section_title: E-Mail Records of Senior Officials Were Not Consistently Preserved
paragraphs: While agency policies were generally compliant with recordkeeping  regulations, these policies were not applied consistently.  Specifically, for 8 of the 15 senior officials we reviewed, e-mail  messages that qualified as records were not being appropriately  identified and preserved. Instead, the officials generally kept every  message within their e-mail systems. Each of the four agencies  generally followed a print and file process to preserve e-mail  records in paper-based recordkeeping systems because their e-mail  systems did not have required record-keeping capabilities. Factors  contributing to this lack of compliance with recordkeeping  requirements were the lack of adequate staff support and the  volume of e-mail received—several of these officials had thousands  or even tens of thousands of messages in their e-mail system  accounts. Another reason was that keeping every e-mail ensured  that no information was lost, which was seen as safe from a legal  standpoint. However, by keeping every message, they were  potentially increasing the time and effort that would be needed to  search through and review all the saved messages in response to an  outside inquiry, such as a Freedom of Information Act request. In  addition, by not keeping the e-mail in an appropriate recordkeeping  system, these officials were making it more difficult for their  agencies to find information by subject. Appropriately identifying  and saving record material also allows agencies to avoid expending  resources on unnecessarily preserving nonrecord material and on  keeping record material beyond its usefulness (that is, beyond the  date when it can be disposed of according to the records schedule).
In contrast, many of the officials whose e-mail records were  appropriately managed delegated responsibility for this task to one  or more administrative staff members. These individuals were  responsible for identifying which e-mail messages qualified as  records and ensuring that the message and any attachments were  preserved according to the agency’s records management policies.  Generally, this required that they print the message, including any  attachments and transmission information (who the message was to  and from and when it was sent), and place the paper copy in a file.
Printing and filing copies of e-mail records is acceptable under  NARA’s regulations. However, printing copies of e-mails can lead to  an agency maintaining multiple copies of the message in both paper  and electronic formats, which can lead to agencies’ expending  resources on duplicative storage, as well as confusion over which is  the recordkeeping copy. Further, as with all electronic documents,  conversion to paper entails the risk of losing some features of the  electronic original.
Awareness of federal records requirements is also an ongoing  concern. At one department, training for senior officials on their  records management responsibilities took place only at the  beginning of the current administration. Officials who joined the  department subsequently were not trained on records management.  Similarly, several administrative staff responsible for managing the  e-mail of senior officials told us that they had not been trained to  recognize a record.
section_title: Recently Proposed Legislation on Electronic Records Management
paragraphs: A draft bill, the Electronic Communications Preservation Act, would  mandate agencies to transition to electronic records management by  requiring the Archivist of the United States to promulgate  regulations governing agency preservation of electronic  communications that are federal records. Among other things, the  regulations would   ●  require the electronic capture, management, and preservation of  ●  require that such electronic records are readily accessible for  retrieval through electronic searches; and  ●  require the Archivist to develop mandatory minimum functional  requirements for electronic records management applications to  meet the first two requirements.
The legislation would also require agencies to comply with the new  regulations within 4 years of enactment.
Requiring a governmentwide transition to electronic recordkeeping  systems could help federal agencies improve e-mail management.  For example, storing e-mail records in an electronic repository  could make them easier to search and potentially speed agency  responses to Freedom of Information Act requests. As our review  shows, agencies recognize that devoting significant resources to  creating paper records from electronic sources is not a viable long- term strategy and have accordingly begun to plan or implement such  a system. The 4-year deadline in the draft bill could help expedite  this transition.
In addition, the development of minimum functional requirements  by NARA should reduce the development risk that could have  resulted from multiple agencies concurrently developing similar  systems. By providing time both for standards to be developed and  implemented by agencies, these provisions recognize the need for a  well-planned process. Like any investment in information  technology, the development of electronic recordkeeping systems  will have to be carefully managed to avoid unnecessary cost and  performance risks. However, once implemented, such systems  could potentially provide the efficiencies of automation and avoid  the expenditure of resources on duplicative manual processes and  storage.
In summary, the increasing use of e-mail is resulting in records  management challenges for federal agencies. For example, the large  number of federal e-mail users and the high volume of e-mails  present challenges, particularly in the current paper-based  environment. While agency e-mail policies generally contained  required elements, about half of the senior officials we reviewed  were not following these policies and were instead maintaining their  e-mail messages within their e-mail accounts, where records cannot  be efficiently searched, are not accessible to others who might need  the information in the records, and are at increased risk of loss.  Several agencies are considering developing electronic  recordkeeping systems, but until such systems are implemented,  agencies may have reduced assurance that information that is  essential to protecting the rights of individuals and the federal  government is being adequately identified and preserved.
Mr. Chairman, this concludes my testimony today. I would be happy  to answer any questions you or other members of the subcommittee  may have.
section_title: Contacts and Acknowledgements
paragraphs: If you have any questions concerning this testimony, please contact  Linda Koontz, Director, Information Management Issues, at (202)  512-6240, or koontzl@gao.gov. Other individuals who made key  contributions to this testimony were Timothy Case, Barbara Collier,  Jennifer Stavros-Turner, and James Sweetman.
This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  The  published  product  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary if you wish to reproduce this material separately.