U.S. Postal Service: Update on E-Commerce Activities and Privacy Protections
Released: 2001-12-21T00:00:00

Letter

Background

Congress and other stakeholders have raised questions about USPS’ participation in the e-commerce area. Some stakeholders have expressed concerns that USPS is establishing e-commerce products and services in competition with those already existing in the private sector, a role they regard as not appropriate for a government entity. For example, USPS has established an electronic bill payment and presentment service when many private-sector companies in the financial services industry, such as banks, already provide such services. In August 2000, USPS stated that it had a valid and appropriate role to play in the e-commerce area: “our long history as a trusted provider of universal communications services for the American people and the unquestioned value of our presence in and service to every community make it logical and, we think, imperative that we continue to develop the e-commerce products and services that our customers will need and demand both now and in the future for their business and personal lives.”

USPS has stated that the pace of the e-commerce revolution is highly uncertain and that the evolution of market and customer requirements will increase the need for a more flexible, innovative, and responsive Postal Service. According to USPS, many of its direct competitors have taken their business online, and many new competitors are threatening other parts of its business. Further, competition is evolving through electronic diversion and alternatives in the areas of electronic bill payment and presentment, and payment options; secure messaging services; and digital security services, such as digital certificate authorities. Intense competition from online shipping services exists from two major competitors—FedEx and United Parcel Service (UPS). The key players each have unique approaches to new electronic business opportunities. According to USPS, it also faces competition from foreign postal administrations, many of which have developed a formal strategy for e- commerce development, in some cases, supported by a dedicated business unit.

USPS offers a variety of e-commerce and Internet-related products and services that deal with the delivery of money, messages, and merchandise. Over the past year, USPS has added specific goals and strategies for its e- commerce program. In September 2000, USPS stated that the e-commerce goal for fiscal year 2001 was to “Use the Internet channel to offer new and enhanced products and services that provide the U.S. Postal Service with revenue such as license fees and user charges.” More specific e-commerce fiscal year 2001 goals included (1) generating $104 million in revenue from e-commerce initiatives, (2) increasing customer traffic to USPS’ Web channel (USPS.com), and (3) improving customer overall satisfaction with USPS’ channel/service offerings. In February 2001, USPS’ three primary goals for USPS.com, from which many e-commerce and Internet-related offerings are accessed, were to (1) increase USPS revenue, (2) maximize customer satisfaction, and (3) reduce costs for USPS. In June 2001, USPS said that its goals were to use the best available and emerging technologies, including the Internet, to enhance the value, availability, and affordability of postal products and services for all customers and to expand universal access to the delivery of messages, merchandise, and money by providing customers with choices when doing business with USPS. Recently, USPS appears to be narrowing its focus in the e- commerce area. In September 2001, the Postmaster General stated that “I will take a close look at our e-commerce activities and we will retain those that support growth of our core products and others that are profitable.”

Significant changes have affected the marketplace in the past year, particularly in the e-commerce sector, with many dot.com companies going out of business. Due to this market volatility, some e-commerce providers, such as USPS, have experienced slower rates of adoption and lower revenue than anticipated. Yet e-commerce plays an ever-growing role in the national economy. According to a recent report, the number of American adults with Internet access grew by 16 million in the second half of 2000. More than half of those surveyed for the report who had Internet access had bought a product online at one time or another. The Census Bureau of the Department of Commerce estimated that total e-commerce sales for 2000 were $25.8 billion, about 0.8 percent of total retail sales, and for the second quarter of 2001, about 0.9 percent.

Privacy concerns are widely regarded as one of the main issues delaying greater use of the Internet and e-commerce. In particular, consumers appear concerned about the extent to which some Web site operators collect personal information and share that information with third parties without the consumer’s knowledge. Surveys have also shown that some potential e-commerce customers avoid using these products and services because of fear that their personal information will be misused.

USPS Has Made Limited Progress in Responding to Our Recommendations

Since we issued our report in September 2000, USPS has taken actions to respond to our recommendations, but it has only made limited progress in resolving the problems that our recommendations were aimed to correct. Over the past year, USPS has continued to struggle with the management and performance of its e-commerce program. Implementation of USPS’ e- commerce initiatives has continued in a fragmented and inconsistent manner. We recommended that the Postmaster General (1) take appropriate actions to help ensure that e-commerce and related initiatives are appropriately identified and maintain accurate and complete information related to the status of these initiatives, (2) follow processes and controls that have been established for developing and approving e- commerce initiatives, and (3) provide complete and accurate information on costs and revenues for the financial data on e-commerce initiatives. USPS continues to have difficulty defining, identifying, and classifying its Internet-related initiatives, including e-commerce initiatives; and inconsistency remains in the implementation of its processes and controls for developing, approving, and monitoring the performance of e-commerce initiatives. Finally, financial information related to USPS’ e-commerce and Internet-related activities is still not complete, accurate, and consistent. We discussed USPS’ difficulties with its e-commerce program with the Deputy Postmaster General. He acknowledged the difficulties and described USPS’ planned actions for addressing the problems. He stated that USPS intends to be able to provide complete financial reporting on all of its e-commerce initiatives by the end of calendar year 2001.

USPS Has Difficulty Determining What Initiatives Are E-Commerce

USPS continues to have difficulty defining and determining which of its Internet-related initiatives are e-commerce initiatives. In our previous report, we recommended that USPS take actions to appropriately identify e-commerce and related initiatives and maintain complete information on their status. At the time we issued our previous report, USPS defined its e- commerce activities as those products and services that required the Internet to do business and generated revenue to USPS through user charges or licensing fees. Throughout our review, USPS was in the process of revising this definition. According to the Deputy Postmaster General, USPS was refining the definition to deal with what it says were anomalies that have surfaced that made this definition confusing and inappropriate. In October 2001, he stated that USPS’ difficulty in reaching agreement among its various business units on which initiatives were e-commerce was faced by many companies where there was an overlap between e- commerce and core product activities and infrastructure development to reduce costs.

Differing internal views about the definition and classification of Internet- related initiatives, including e-commerce initiatives, made it difficult for USPS to provide us with a complete list of e-commerce initiatives. Over the past few months, USPS officials explained the difficulties they had experienced due to differing opinions as to how e-commerce initiatives should be defined and what initiatives should be considered e-commerce versus those that support or enhance existing core products and services. E-commerce initiatives are just one subset of USPS’ new products and services, which may include other Internet-related initiatives as well as retail and advertising initiatives. How an initiative is defined and classified also affects how its costs, particularly indirect costs, and revenues are reported. Without a clear understanding of which initiatives are e- commerce, USPS cannot provide complete, accurate, and consistent information on its e-commerce program.

USPS’ criteria for different categories of e-commerce and other Internet- related initiatives have changed several times over the past few months. In a letter dated December 4, 2001, commenting on a draft of this report, the Deputy Postmaster General stated that USPS now defines as e-commerce “those products or services that require the Internet for the customer to do business with us and whose primary objective is to directly generate new revenue.” Further, he stated that USPS also said that it recognized that some of its new products and services might either use the Internet or generate new revenue, but only those that met both tests would be defined as e-commerce. However, USPS noted that initiatives defined as “non-e- commerce” would not receive any less management scrutiny. Applying this definition, USPS stated that it currently has 5 e-commerce initiatives: ePayments, PosteCS, NetPost Certified, NetPost Mailing Online/NetPost Cardstore, and Secure Electronic Delivery Services/Electronic Postmark.

USPS officials explained that the difficulty they have encountered in attempting to define and classify e-commerce and Internet-related initiatives is due to differences in the purposes for various initiatives. They further explained that these different purposes could be grouped into three major categories of Internet-related initiatives. First, some initiatives are intended to directly generate revenue as stand-alone products. Second, other initiatives may indirectly generate revenue by supporting existing core products and services. Third, still other initiatives may or may not generate revenue, but are primarily intended to provide customers with easier access to other products and services. Examples of these different categories follow.

An example in the first category would include eBillPay. According to USPS, eBillPay, part of USPS’ ePayments initiative, was developed primarily for the purpose of directly generating revenue from retail customers and has not generated revenue toward any existing core postal product, such as stamps. Thus, USPS considers ePayments a stand-alone e-commerce initiative. Other examples of stand-alone initiatives include NetPost Certified and PosteCS (see app. II for more details on the initiatives). An example of the second category of initiatives is the Postal Store (an enhancement of its previous initiative, Stamps Online), which was intended primarily to provide an electronic alternative for customers desiring to purchase stamps via the Internet. Thus, according to USPS officials, it indirectly generates revenue toward an existing USPS core product, that is, postage stamps, and is not considered an e-commerce initiative. The third category of initiatives includes Delivery Confirmation, which is a special feature added to other products and services that is intended to provide customer ease of use as well as generate direct revenue. USPS also does not consider Delivery Confirmation to be an e- commerce initiative.

USPS officials have noted that it has become increasingly difficult to separate e-commerce initiatives from core products because in the future many new products and services will involve some form of Internet component. Since our previous report was issued in September 2000, USPS has implemented four e-commerce-related initiatives or enhancements to initiatives that were mentioned in that report, with the exception of Net Post Cardstore: NetPost Mailing Online was implemented in September 2000, NetPost Cardstore in December 2000, and NetPost Certified in January 2001. In addition, USPS implemented enhancements to its ePayments initiative in September 2001. Two other e-commerce initiatives—the Postal Store and MoversNet (MoversGuide.com)—also mentioned in our previous report were implemented, but as of December 2001, USPS no longer considers these to be e-commerce initiatives.

USPS Is Revising Its Management Structure and Processes for Developing and Overseeing Its E-Commerce Initiatives

Overall management of USPS’ e-commerce program has been fragmented and inconsistent across the nine business units involved in developing and managing e-commerce and Internet-related initiatives. There has been no clear accountability or consistency in the development, approval, implementation, performance and day-to-day monitoring of initiatives. Since our September 2000 report recommending that USPS follow its processes and controls for developing and approving e-commerce initiatives, USPS has made several revisions to its processes for approving and implementing e-commerce and other new Internet-related products and services. However, over the past year inconsistencies remain in the implementation of USPS’ processes for its e-commerce activities. In September 2001, the Postmaster General announced a sweeping management restructuring, changing both the reporting structure and managers responsible for its e-commerce program.

Management of USPS’ e-commerce program has been fragmented because of various factors. The internal processes and requirements for developing and approving e-commerce initiatives have been revised twice in just over 1 year. As noted in our previous report, USPS recognized that its New Products Development process for reviewing and approving new products that it established in 1996 was not suited to e-commerce initiatives. Consequently, in May 2000, it set up the eBusiness Opportunity Board (eBOB) review and approval process. The eBOB process was intended to result in quicker approval of initiatives than had occurred using its previous review and approval process for new products and services. However, over the past year, the eBOB process was not consistently followed for business development and planning for e-commerce initiatives. Since we issued our previous report, some business plans for the e-commerce initiatives were not regularly updated to reflect changing market conditions and required approvals were not always obtained consistently under the eBOB process. Implementation of initiatives has been inconsistent, with some initiatives being implemented either before business plans were prepared or without business plan approval, such as NetPost Cardstore.

In July 2001, about a year after setting up the eBOB process, USPS revised its review and approval process, creating both another process—BizDev— and a new management group—Corporate Business Development (CBD). BizDev was intended to be a process through which all new business development ideas would be channeled. In July 2001, CBD officials told us that they intended to update business plans every 6 months. They also told us that business plans were not only to contain new elements but were to be prepared following more strict guidelines. For example, a USPS official noted that a tool kit would be used to specify how business plans were to be written.

In September 2001, USPS announced a reorganization and shifted responsibility for e-commerce initiatives to new management and to a new group called Product Development. Although it is not yet clear what processes will be used for approving and reviewing e-commerce initiatives, and it is too soon to determine whether the fragmentation and inconsistency across units has been addressed, recent actions to clarify management responsibility appear to be a step in the right direction.

Efforts to Improve Financial Reporting Are Continuing, but Information Is Not Yet Accurate, Complete, and Consistent

In our previous report, we found deficiencies in the financial information that USPS provided on its e-commerce initiatives and reported that the steps USPS took in this area were important and needed to be effectively implemented. We recommended that USPS provide complete and accurate financial information on costs and revenues for its e-commerce initiatives. Without reliable financial information, USPS will not be in a position to assess its progress toward meeting its overall financial performance goals. USPS’ ability to report accurate and complete financial data for its Internet-related initiatives, including e-commerce, is important to the budget process, ratepayers, and congressional oversight. USPS agreed with this recommendation, and at the beginning of fiscal year 2001 began instituting a standard financial reporting procedure for the seven e- commerce initiatives that were planned or implemented at that time, which USPS continues to refine. The Deputy Postmaster General stated in USPS’ comments on our draft report dated December 2001 that USPS intends to be able to provide complete financial reporting on its five current e-commerce initiatives by the end of calendar year 2001.

Although some improvements have been made to the financial statements provided to us during this review, these statements, which have been prepared on a quarterly basis, still are not complete, accurate, and consistent. In September 2000, we reported that because of the data deficiencies, we lacked confidence that the financial information was sufficiently reliable. USPS officials have since told us that USPS has made progress in tracking and reporting e-commerce financial data, including creating a detailed statement of revenues and expenses for each e- commerce initiative; providing a more complete set of costs, such as tracking direct costs on an initiative-specific basis; and providing training to help managers report costs on a consistent basis. We agree that the financial statements provided to us for fiscal year 2001, quarters 1 through 3, were improved. They included more detailed information on expenses, such as developmental and operational expenses; planned revenue and net income; and actual net income (loss); as well as program information, such as volume, number of accounts; and identification of opportunities for improvement. However, these financial statements do not currently capture all of the revenues and costs associated with the e-commerce initiatives, and it is not clear how USPS plans to report the necessary financial information that is not included in the current financial statements.

Financial Data Continue to Be Deficient

Numerous deficiencies remain in USPS’ financial information for its e- commerce initiatives. USPS has not reported aggregate data on its e- commerce activities as a whole, which would be necessary to track its progress toward USPS’ financial goals for its e-commerce activities. In July 2000, USPS stated that “. . . infrastructure and other costs associated with eCommerce . . . will be calculated as part of our ongoing obligation to appropriately report those incurred costs.” However, in August 2001, USPS officials told us that USPS did not yet have a system to attribute costs for infrastructure that supports e-commerce products and services (e.g., the “Web site infrastructure” initiative). Additionally, in order to compile aggregate costs on USPS e-commerce activities as a whole, the following information would also need to be included: Any common costs to the e-commerce area that could not be allocated to specific e-commerce initiatives.

Operating costs and revenues for any e-commerce products and services discontinued during the fiscal year, or whose development is discontinued during the fiscal year, for the fiscal year that aggregate costs are to be reported.

Depreciation costs for capital assets acquired for discontinued e- commerce products and services that have not been written off or fully depreciated.

USPS stated last year that it would “require that complete and accurate cost, revenue, and performance data be tracked and periodically reported to senior management” for each e-commerce initiative. We are concerned that USPS may only be preparing quarterly financial statements for its current five e-commerce initiatives. Other Internet-related initiatives, that are not considered e-commerce, have generated revenues and expenses in fiscal year 2001 but are not tracked through quarterly financial statements. For example, USPS data for the Delivery Confirmation initiative, which is not considered e-commerce, showed revenues of over $278 million and expenses of over $35 million through the first 3 quarters of fiscal year 2001. Given USPS’ difficulties in determining e-commerce versus other Internet-related initiatives and the probability that many, if not most, future new products and services that generate revenues will have some Internet-related component, it is not clear why quarterly financial statements are required only for e-commerce initiatives at this time. The Deputy Postmaster General stated in USPS comments on our draft report dated December 4, 2001, that “This does not mean, however, that initiatives defined as ‘non-e-commerce” will receive any less management scrutiny.”

We also found that USPS reported inaccurate and/or inconsistent cost and revenue data on some e-commerce initiatives. For example, although some postage revenues for Mailing Online were reported as e-commerce revenue, the corresponding processing and delivery costs associated with this mail volume were not reported as e-commerce costs. Further, as the following examples show, revenue and cost data were calculated and reported inconsistently in the quarterly financial statements provided to us: Revenues were reported differently across e-commerce initiatives. For Mailing Online, 38 percent of the postage revenues were estimated as “new postage” generated by this e-commerce initiative—that is, additional postage generated because Mailing Online gave customers an additional way to mail material to consumers. In contrast, no revenues generated by the Postal Store were reported as e-commerce revenues—that is, according to the Postal Store financial statement, the revenues generated via the sale of postal merchandise (e.g., Postal Service bicycling merchandise, stamps, and philatelic products) through the Internet-based Postal Store initiative were not considered e-commerce revenues. Although no revenues for the Postal Store initiative were reported as e- commerce revenues, all costs for this initiative were reported as e- commerce costs. Thus, the net income reported for this initiative factored in only the costs, but not the corresponding revenues.

Although most financial statements covered only one e-commerce initiative, others covered multiple initiatives. For example, a single statement for the ePayments initiative covered both eBillPay and other ePayment enhancements that had not yet been implemented. In this statement, eBillPay costs were not reported separately from other ePayment initiatives that were under development. Thus, the net income that was reported was the consolidated net income for the eBillPay initiative as well as the ePayment initiatives.

No Postal Store costs were reported in fiscal year 2001 for 8 of 10 cost categories that generated direct costs in prior years, including supplies and services, equipment rent and repair, communications, and travel. USPS stated that costs reported for these eight categories prior to fiscal year 2001 were “start-up costs.” However, according to the Postal Store financial statement provided to us, the total direct costs for these eight categories prior to fiscal year 2001 were $1.4 million, while the “Developmental/Start-up Expenses” were only $800,000. Further, USPS said that to the extent that such costs were incurred in fiscal year 2001 for these eight categories, they were included under “Other Allocated Expenses” or “rolled into a separate administrative budget for a wider function that includes the Postal Store.” However, for other initiatives after their start-up periods, costs for these eight categories continued to be itemized, rather than being included as other allocated expenses.

According to a USPS official, the e-commerce financial statements are provided to top USPS officials, including the Board of Governors and the Postmaster General, so that they can have summary information on the performance of the e-commerce initiatives. Complete, accurate, and consistent information would assist these top USPS officials in tracking, evaluating, and making decisions about the e-commerce initiatives. In this regard, we have additional concerns that the financial statements for USPS’ e-commerce products and services were not as useful as they could have been. These concerns include the following: Although the financial statements included quarterly revenue goals and planned costs for the e-commerce initiatives, based on what had been approved during the budgeting process, the statements did not include revised revenue and cost expectations—that is, goals that have changed during the fiscal year from the original budget goals—to clearly indicate what goals e-commerce program managers are working to achieve. Specifically, the financial statements did not disclose substantial downward revisions made during fiscal year 2001 to planned revenues and costs.

The financial statements reported total planned revenues for each e- commerce initiative for the full fiscal year, but did not report total planned costs for the full year. For example, planned advertising and program staff costs were not included in the planned full-year costs reported in the financial statements. In certain cases (i.e., ePayments and NetPost Certified) these expenses have made up a significant portion of total expenses.

During this review, we identified several issues concerning the e- commerce financial data that remain unresolved, which include (1) whether some or all of the revenues and the corresponding costs of e- commerce products and services are being included with other postal product revenues for budgeting and reporting purposes, including reporting to the PRC; (2) how capital outlays and related depreciation costs for each e-commerce initiative and discontinued initiatives are to be reported; and (3) how costs for e-commerce products and services that are under development (e.g., in a pilot or testing phase) are to be reported. Currently, USPS does not have clear and comprehensive policies and procedures that would address how all of the direct and indirect revenues and costs, including those mentioned above, associated with its e- commerce and other new products and services are to be reported. Without comprehensive policies and procedures in this area, inconsistencies in reporting are likely to continue.

USPS is attempting to resolve the problems we have identified. The Deputy Postmaster General discussed with us the difficulties USPS has encountered in trying to refine its financial reporting. He stated that USPS intends to be able to provide complete financial reporting on all e- commerce initiatives by the end of calendar year 2001. We also discussed with the Deputy Postmaster General the difficulties involved in developing a consistent approach to attributing all of the appropriate costs, both direct and indirect, to its e-commerce initiatives. According to USPS, its e- commerce products have some particular characteristics that must be addressed when attributing costs, such as when a new product makes use of already existing infrastructure (e.g., computer system). Other challenges include determining how research and development costs should be attributed.

Information Needed to Address Cross- Subsidization Concerns

Concerns continue to be raised as to whether USPS’ e-commerce initiatives in the aggregate are being cross-subsidized by other postal products and services. Without complete, accurate, and consistent information, USPS will not be in a position to assess progress toward meeting its overall financial performance goal that e-commerce products and services in the aggregate are to cover their incremental costs and thus not be cross-subsidized. Although USPS intends to provide complete financial reporting on its e-commerce activities by the end of calendar year 2001, we remain concerned that USPS may not meet this goal because of recent changes under way in USPS’ management structure and uncertainty about when USPS’ e-commerce program will stabilize. Given the difficulties USPS has had in distinguishing between e-commerce, Internet- related, and its core products and services and, according to USPS officials, the probability that most new products and services are likely to have some Internet-related component, in our opinion, the need for improved financial information extends not just to e-commerce initiatives but to all of its new products and services. For example, revenues and costs for some ongoing Internet-related activities that have been implemented do not have a financial statement (such as revenues and costs relating to Web affiliates with banner ads/links on USPS.com, and other new revenues and corresponding costs generated by USPS.com). Thus, we believe that financial reporting requirements should apply to all new products and services.

Many stakeholders are interested in the performance of USPS’ new products and services initiatives. Congress has also repeatedly expressed interest in more information about USPS’ activities aside from its traditional mail products and services. In the Conference Report accompanying the Fiscal Year 1998 Treasury, Postal Service, and General Government Appropriations Act, USPS was requested to report on its nonpostal activities, including an estimate of the net revenue generated. In the Senate Report accompanying the Fiscal Year 1999 Treasury, Postal Service, and General Government Appropriations Act, USPS was requested to report on its commercial activities, including their revenues and costs. More recently, in the Conference Report accompanying the Fiscal Year 2002 Treasury, Postal Service, and General Government Appropriations Act, USPS was requested to provide a report detailing and supporting USPS’ position as to the scope of its existing authority under current law to introduce and provide new products and services. The report also requested information on USPS’ use of such authority to provide new products and services.

In view of USPS’ problems in distinguishing between e-commerce, Internet-related, and its core products and services, and USPS’ difficulty in providing complete, accurate, and consistent financial information in this area, Congress could take further action to help ensure better transparency and more reliable information on all of USPS’ new products and services. As we mentioned previously, to develop complete and consistent financial information, USPS needs to have clear and comprehensive policies and procedures for reporting. We also believe that a regular review of USPS’ financial reports in this area is needed to ensure that the information is reliable and complete. The review could include annual USPS information on volume, revenue, and cost information related to its new products and services. Such a review could be conducted by an independent entity, such as an independent auditor or the PRC, in a manner similar to that required for international mail. The results of the review could be reported on an annual basis to Congress. USPS officials told us that they would prefer a review by an independent auditor. We would agree that such a review could ensure that USPS is adhering to its policies and procedures and that information was reported in accordance with generally accepted accounting principles. If an audit by an independent auditor does not result in acceptable financial information on USPS’ new products and services, then PRC may be another alternative for reviewing USPS’ financial information in this area.

Reported Performance for E-Commerce Initiatives Has Not Met Expectations

To date, performance of the e-commerce initiatives has reportedly fallen short of USPS’ expectations. USPS officials said that this was because the initiatives were relatively new, with most being less than a year old, and that the business plans were overly aggressive. In September 2000 we reported that, in some cases, business plans had been presented for approval after e-commerce initiatives had been implemented. In addition, we found that business plans had not been updated regularly to reflect changing market conditions, thereby resulting in unrealistic performance expectations. Without more timely and complete business planning, USPS management will not be able to create a more realistic baseline against which to measure and monitor the performance of each e-commerce initiative and thus be able to determine whether a specific initiative should be modified or discontinued. USPS has recognized that it needs to improve in this area. USPS has begun updating and revising business plans and developing mechanisms to more regularly monitor and report on the performance of e-commerce initiatives. Further, in September 2001, the Postmaster General said that he would be taking a close look at USPS’ e- commerce activities and that USPS will retain those that support growth of its core products, as well as others that are profitable. Although USPS does not yet have complete revenue and cost information on its original e- commerce initiatives, none of the e-commerce initiatives for which financial information was provided to us in seven financial statements for the 3rd quarter of fiscal year 2001 were profitable.

In developing its fiscal year 2001 performance expectation for the overall e-commerce program, USPS management used available business plans, including one that had been prepared in 1996. According to USPS officials, the goal for expected e-commerce revenue in fiscal year 2001 was $104 million. At the end of the first three-quarters of the fiscal year, according to the financial statements provided to us, e-commerce initiatives had generated less than 1 percent in actual revenues toward the planned annual revenue goal of $104 million.

During our review, we noted that information in USPS’ e-commerce business plans had not been regularly updated to reflect changing market conditions. For example, although acknowledging in the 1996 business plan that NetPost Mailing Online’s use of new technology made it difficult to estimate its market share and size, USPS did not update that plan until March 2001, after it was implemented in September 2000, over 5 years later. Expected performance in the updated plan had been revised to reflect anticipated changes in the adoption rates and revised implementation dates for this initiative, information that should have been provided in a more timely manner to USPS management so that decisions could have been based on more meaningful data. Some of the updated business plans provided to us included revised forecasts of expected performance, based in part on USPS’ actual experience with its e- commerce initiatives. Business planning is very important because, as we recently testified, electronic government initiatives should be supported by a well-developed business case that evaluates the expected returns against the costs. The business case provides the forum for the evaluation of the project’s costs, benefits, and integration with the agency performance and results strategy.

Conditions affecting performance goals can change significantly during the course of a year. For example, the March 2000 ePayments business plan, which includes eBillPay, was updated a year later in February 2001. The February business plan reflected substantially revised performance expectations based on lowered forecasts by market analysts of consumer adoption of electronic bill payment as well as USPS’ actual experience in offering this initiative. Revenue, cost, and operating contribution expectations for fiscal year 2001 had been decreased by about 96 percent, 66 percent, and 33 percent, respectively, when compared to the expectations in the March 2000 business plan. Without more regular updating, management may not be able to gauge an initiative’s progress toward performance goals and thus determine whether set goals are realistic.

USPS officials also told us that they recognize the need to more regularly monitor the performance of e-commerce and Internet-related initiatives. In addition to updating business plans every 6 months, USPS officials told us in July 2001 that USPS was developing a performance report to track all new products and services, including e-commerce initiatives, which it reportedly implemented in September 2001. The performance indicators in the performance report are to be taken from the business plans for each initiative, according to USPS officials. USPS management would then be able to use these reports, or scorecards, to assess a particular product’s viability or as a factor in their decisionmaking. In addition to monitoring an initiative’s performance, it may be necessary to discontinue an initiative should it continue to perform below expectations. USPS also reportedly implemented a reporting tool in September 2001 that includes information on its new revenue-generating business activities. Among other things, the report is to identify those initiatives whose contribution, after a specified implementation period, falls below their expected contribution. After being given a certain amount of time for corrective actions, such initiatives may be discontinued.

In May 2000, after the initiatives had been in place about a year, a USPS official noted that the “bubble burst and there was a market downturn” referring to the recent economic slowdown. Business plans prepared in fiscal years 2000 and 2001 that were provided to us projected that the Postal Store and NetPost Cardstore would be profitable by the end of fiscal year 2001, while the remainder of the initiatives would become profitable between fiscal year 2002 and fiscal year 2005. In our 1998 report on new products and services, we acknowledged that it might not be reasonable to expect all new products to become profitable in their early years because new products generally take several years to become established and recover their start-up costs. However, throughout this time, management needs to be provided with timely and accurate information on each initiative’s performance so that decisions can be made concerning whether the initiative is progressing as planned or needs to be either modified or discontinued.

Federal Laws, Regulations, and Policies and Self- Regulatory Practices Provide Privacy Protection for E- Commerce Customer Information

With respect to privacy protections provided to customers of e-commerce and other Internet-related activities, USPS has stated that its customers are afforded greater protection than those of private-sector providers, chiefly because of the requirements in the combination of three laws—the Privacy Act of 1974, the Electronic Communications Privacy Act (ECPA), and the Postal Reorganization Act. Also, USPS recently stated that its voluntary compliance with other federal privacy laws and guidance to which USPS is not subject provides additional protection. Selected private-sector e-commerce providers we contacted generally disagreed with USPS’ contention that its customers are afforded greater privacy protection, stating that private-sector e-commerce providers, while not subject to the Privacy Act and the Postal Reorganization Act, are subject to ECPA and several other federal privacy-related laws and regulations, as well as applicable state laws that do not apply to USPS.

In comparing the privacy protections USPS reports to offer its customers with those privacy protections private-sector providers report to offer to their customers of e-commerce products and services, we noted that different federal privacy laws apply to USPS than apply to private-sector providers. For example, the Privacy Act and the Postal Reorganization Act do not apply to the private sector, but other federal laws, such as the FTC Act, may apply to the private sector but not to USPS. In addition to the requirements in federal privacy laws, and in response to privacy concerns, both USPS and private-sector providers told us that they were voluntarily engaging in additional self-regulatory privacy practices to safeguard customers’ personal information. We did not review actual privacy practices of USPS or selected private-sector providers; therefore, we could not assess either their voluntary privacy practices or whether they were complying with all applicable privacy laws.

Federal Laws and Regulations Apply to USPS and Private-Sector Providers of E-Commerce Products and Services

In comparing the privacy protections that USPS reports that it provides to its e-commerce customers with those that private-sector providers report that they provide to their customers, we noted that different federal privacy laws apply to USPS than to private-sector providers. Although the Privacy Act and the Postal Reorganization Act do not apply to private- sector providers, the ECPA and other applicable federal privacy laws do.

The Privacy Act is a comprehensive privacy statute that provides certain safeguards to protect individuals’ personal privacy. The Privacy Act limits the collection, maintenance, use, and dissemination of personal information by federal agencies, including USPS, and grants individuals access to information about themselves. Under the Privacy Act, USPS, its contractors, and other federal agencies are generally prohibited from disclosing to third parties personal information maintained on individuals (not businesses) without their consent. In addition, while under the Privacy Act, USPS may be authorized to disclose personal information to other government agencies under certain circumstances, the ECPA further restricts any such disclosure. Under the ECPA, USPS may only disclose stored electronic communications to a governmental entity possessing a search warrant, or certain subpoenas. In addition, while the Privacy Act generally prohibits the sale or rental of an individual’s name and address by a federal agency, the Postal Reorganization Act restriction on USPS goes further. It provides that no officer or employee of USPS shall make available to the public by any means or for any purpose any mailing or other list of names or addresses of postal patrons or other persons, except for census purposes or as otherwise specifically provided by law.

The Privacy Act allows individuals the right to sue federal agencies for violations of the statute and provides for damages. In addition, the Privacy Act provides criminal penalties and fines for willful, wrongful disclosure of information and willful failure to meet the notice requirements of the act. Depending upon the particular e-commerce initiative, information collected by USPS from customers may include the following: name and address, fax and telephone numbers, e-mail address, social security number, and credit card information.

On September 26, 2001, USPS implemented MoversGuide.com, an e- commerce initiative that allows electronic change of address for postal patrons via the Internet. Customer change-of-address information provided through MoversGuide.com will be incorporated into USPS’ National Change of Address Program (NCOA). Through NCOA, USPS collects and disseminates change-of-address information reported by postal customers to qualified private firms licensed by USPS to provide address correction services. In July 1999 we reported that, in our view, the use of NCOA-linked data to create or maintain new movers lists by USPS licensees, who are viewed under the Privacy Act as if they were USPS employees, would not be consistent with limitations imposed by the Privacy Act. USPS disagreed and told us that the Privacy Act does not restrict USPS licensees or their customers’ use of NCOA-linked data to create or maintain new movers lists. We also reported that USPS restricts its licensees from using NCOA-linked data to create or maintain new movers lists through its licensing agreements as a “good business practice” not because USPS considers it to be required by law.

While the Privacy Act places restrictions on the collection, maintenance, use, and dissemination of personal information collected by federal agencies, it does have its limitations. For example, the Privacy Act only applies to personal information maintained in an agency’s “system of records.” The Privacy Act defines a system of records as any group of records under the control of an agency from which information is retrieved by (not collected or maintained by) the name of an individual or by some identifying number, symbol, or other identifying particular assigned to the individual. In addition, the Privacy Act only applies to information about individuals, not businesses. Furthermore, the act contains 12 exceptions to its general prohibition on the disclosure of personal information. For example, the act authorizes an agency to disclose a record for a routine use, for law enforcement purposes, pursuant to an order of a court of competent jurisdiction, or to either House of Congress.

Under the Postal Reorganization Act, as previously stated, USPS employees and officers are prohibited from disclosing to the public lists of names or addresses of postal patrons or other persons. In addition, the Postal Reorganization Act exempts USPS from mandatory Freedom of Information Act (FOIA) disclosure for the name or address, past and present, of any postal patron and for information of a commercial nature that would not be disclosed under good business practice. USPS told us that although it is subject to FOIA requests for information, USPS would not release information collected from e-commerce customers. USPS said that FOIA does not compel disclosure that is otherwise prohibited by law. In this regard, USPS told us that “in our opinion, it would not be good business practice to disclose private information obtained in the provision of electronic services.”

No comprehensive law comparable to the Privacy Act regulates the private sector’s collection, maintenance, and dissemination of personal information. Rather, the federal government’s policy, from the onset of the Internet, has been to allow the private sector to regulate itself to the greatest extent possible. However, Congress has regulated the private sector’s collection and dissemination of personal information on a sector- by-sector basis when it has found it necessary to do so. In addition, some private-sector e-commerce providers may also be subject to the enforcement provisions of the FTC Act, which prohibits unfair and deceptive practices in and affecting commerce. FTC has successfully used the FTC Act against private-sector e-commerce providers who misrepresented, in a privacy notice, how they were using personal information collected over the Internet. However, the FTC Act can only be used in this manner if a private-sector company actually posts a privacy notice—which is not always required by law.

Private-sector providers could be subject to the FTC Act and a variety of federal laws that protect the privacy of personal information on a sector- by-sector basis, such as the Gramm-Leach-Bliley Act, the Children’s Online Privacy Protection Act (COPPA), and the ECPA, which prohibits disclosure of stored electronic communications to a governmental entity without a search warrant or certain subpoenas. However, it does not appear that USPS is subject to the FTC Act, the Gramm-Leach-Bliley Act,or COPPA. (See table 1 for a description of these laws.) According to UPS, one of the selected private-sector e-commerce providers we contacted, private-sector providers, while not subject to the Privacy Act, are subject to several other federal privacy-related laws as well as state laws and regulations, in addition to ECPA, that do not apply to USPS. According to UPS, these legal requirements may impose economic consequences for noncompliance, while the Privacy Act and ECPA do not impose such consequences upon USPS, in the absence of intentional violations of these statutes.

Financial institutions, some of which provide electronic bill payment and presentment services in competition with USPS, would be subject to the privacy provisions of the Gramm-Leach-Bliley Act. Among other things, the Gramm-Leach-Bliley Act, enacted in November 1999, generally prohibits financial institutions from disclosing nonpublic personal information to nonaffiliated third parties without providing customers the opportunity to decline such disclosures. It also generally prohibits financial institutions from disclosing account numbers to nonaffiliated third parties for use in marketing, and requires financial institutions to give notice to their customers of their privacy policies, including their policies regarding the sharing of information with affiliates and nonaffiliated third parties. Regulations implementing these privacy protections were promulgated and became effective on November 12, 2000. Authority to enforce these privacy protections is provided to a number of federal financial regulators, state insurance authorities, and FTC, based on already existing jurisdiction over the covered financial institutions. According to the American Bankers Association (ABA), which represents financial institutions, the financial services industry, based on Gramm-Leach-Bliley and other applicable statutes, provides vastly more privacy protection than any other industry or government agency. ABA noted that “the volume of statutes, the examination of compliance with those laws by the banking agencies, and the clear commitment by the industry to assist customers in understanding these standards makes this evident.”

In addition, private-sector providers of e-commerce products and services directed at children are subject to the provisions of COPPA. COPPA requires the operator of a commercial Web site or online service targeted at children under the age of 13 to provide clear notice of information collection and use practices; to obtain verifiable parental consent prior to collecting, using, and disseminating personal information from and about children under age 13; and to provide parents access to their children’s personal information and the option to prevent its further use. On October 20, 1999, FTC issued a final rule to implement COPPA. COPPA authorizes FTC to bring enforcement actions and impose civil penalties for violations of the rule in the same manner as for its other rules.

Table 1 focuses on how selected federal privacy laws may apply to USPS and some private-sector providers of e-commerce products and services. In some cases, USPS business partners may also be subject to these laws. In other cases, the laws may apply to some, but not necessarily all, private- sector e-commerce providers.

When comparing the privacy protections offered by USPS and private sector providers of e-commerce products and services, we found that the legal requirements may vary depending upon the particular type of e- commerce provider, product, or service. These differences are of particular interest with regard to the potential disclosure of personal information to third parties. For example: Regarding personal information collected in connection with eBillPay and competing electronic bill payment programs, both USPS and financial institutions in the private sector are generally required by federal law to provide notice to their customers of the uses to which personal information may be put. The requirements to provide such notice are included in the Privacy Act for USPS, and the Gramm-Leach-Bliley Act for the private-sector providers. In addition, both USPS and private-sector providers of electronic bill payment services are generally required under the Privacy Act and the Gramm-Leach-Bliley Act, respectively, to provide their customers with a choice as to whether personal information will be disclosed to third parties. The laws provide for disclosure under certain circumstances. Exceptions to this general rule concerning the provision of choice exist for both USPS and private sector providers. For example, with respect to USPS, the combined effect of the ECPA and the Privacy Act would authorize disclosure of personal information to third parties without obtaining the prior consent of the individual for (1) a “routine use” of the information, (2) for law enforcement purposes pursuant to a search warrant, (3) pursuant to certain court subpoenas, and (4) to either House of Congress. In addition, under the Postal Reorganization Act, USPS is generally prohibited from disclosing lists of names or addresses to the public. Currently, under the routine uses for its eBillPay service, USPS provides personal information to its business partner, CheckFree, and to the Credit Reporting Agency in the provision of its eBillPay service. Under the Gramm-Leach-Bliley Act, financial institutions in the private sector, some of which provide bill payment and presentment services, are generally prohibited from disclosing account numbers to nonaffiliated third parties for use in marketing. However, financial institutions are authorized to disclose personal information, without providing its customers the opportunity to decline, or “opt out” of the disclosure, to third parties that perform services for or on behalf of the financial institution if confidentiality of the information is provided for by contract.

Regarding personal information collected in connection with the sale of merchandise through an e-commerce program, USPS would still generally be required under the Privacy Act to provide notice to its customers of the uses to which personal information may be put and to provide a choice before it is disclosed. The same exceptions, mentioned in the above example, to this general rule would apply. On the other hand, a private- sector company selling merchandise through an e-commerce program would generally not be required by federal law to provide notice to its customers of the uses to which personal information may be put or to provide a choice before it has disclosed such information. However, if the e-commerce program targeted children under the age of 13, the provider would be subject to the provisions of COPPA. In addition, if certain private-sector companies voluntarily provided notice that disclosure of personal information to third parties would be restricted, FTC could bring an enforcement action against the company for failure to follow those restrictions.

The Use of Self-Regulatory Business Practices by USPS and Private-Sector Providers Can Also Protect E-Commerce Customers’ Personal Information

In response to concerns that have been raised by advocacy groups and others about the privacy of customer information collected on the Internet, various providers of e-commerce services in the public and private sectors began to develop and adopt various business practices to protect the privacy of customer information. In particular, consumers appear concerned about the extent to which some Web site operators collect consumer information and share that information with third parties without the consumer’s knowledge. Surveys have shown that some potential e-commerce customers avoid using these products and services because of fear that their personal information will be misused. Both USPS and selected private-sector providers, including associations that represent such providers, have reported that they use many of these voluntary privacy business practices.

A variety of tools and methods have been developed by both the public and private sectors to develop, assess, and monitor their privacy practices. For example, privacy policy generators, offered by such groups as the Direct Marketing Association (DMA), Microsoft, and TRUSTe, have been used to create draft privacy policies for private-sector providers. In addition, privacy risk assessment tools, such as the Internal Revenue Service’s privacy impact assessment, have been used to evaluate the privacy of customer information. Finally, some private-sector providers have used privacy seal programs and independent audits to develop, assess, and monitor their privacy practices. Privacy seal programs, such as those administered by TRUSTe, BBBOnline, and CPA Webtrust are independent, third-party enforcement programs that provide a way to monitor company practices and enforce privacy policies. A number of private-sector providers have also had independent entities, such as accounting firms, conduct independent audits to determine whether they are following their stated privacy policies. USPS notes it is also subject to independent audits by us and the USPS’ Office of Inspector General (OIG).

After discussions with key stakeholders, such as FTC staff and OMB officials and selected private-sector providers, we compiled a list of voluntary privacy business practices that the private and public sectors have developed to protect customers’ information. While we recognize that there are numerous private-sector e-commerce providers, we contacted the providers included in table 2 because they offered e- commerce products and services similar to those offered by USPS. These providers include ABA, whose members include community, regional and money-centered banks and holding companies as well as savings associations, trust companies, and savings banks; DMA, whose members include users and suppliers in the direct, database, and interactive marketing field; and UPS, a leading delivery and logistics company. We recognize that this list is not complete as self-regulatory practices are continually being developed. We sent this list to USPS and the selected private-sector providers and asked whether they used these practices. We did not verify whether USPS or the selected private-sector providers we contacted actually adhered to their privacy policies or followed the privacy practices they said they used. We did not assess these practices to determine their effectiveness, or address the security aspects of the protection of customers’ data.

Table 2 describes some of the privacy business practices that USPS and the selected private-sector providers of e-commerce products and services reported that they used.

As shown in table 2, USPS and all of the selected private-sector providers we contacted reported that they have privacy policies posted on their Web sites that state how customers’ information will be collected, safeguarded, and used. They also reported that they incorporate standard privacy clauses in contracts with e-commerce suppliers, contractors, and affiliates. USPS has reported that its contractors, such as its business partner in offering USPS eBillPay, are bound by contract to the same disclosure requirements that apply to USPS. USPS and the selected private-sector providers stated that they either have a chief privacy officer or an officer who performs the functions of a chief privacy officer. USPS stated that it adhered to all, and some of the selected providers reported that they adhere to most, of the FTC’s fair information principles (notice, choice, access, and security). The selected private-sector providers reported that they provide training to employees regarding the protection of customers’ personal information and the organizations’ privacy policies and practices. USPS officials stated that they plan to implement P3P (a technological solution that is intended to enable individuals to control their personal information and make decisions based on their individual privacy needs) this fiscal year, and initiate a training program in the future. Regarding processes, USPS’ Chief Privacy Officer stated that USPS has established, among other things, an internal cross-functional advisory board, and a privacy assessment tool to ensure privacy compliance and set security requirements in product development.

Regarding voluntary adherence to federal laws and regulations, USPS’ Chief Privacy Officer told us that USPS generally voluntarily follows the requirements of the Gramm-Leach-Bliley Act, COPPA, FTC guidance related to privacy issues, and OMB’s privacy memorandums. Further, the Deputy Postmaster General stated in February 2001 that although USPS does not consider itself subject to OMB guidance, it has decided to voluntarily comply with the following two OMB Memorandums related to privacy matters. First, OMB Memorandum M-99-18, issued in June 1999, requires federal agencies to post clear privacy policies on their principal Web sites; to any other known, major entry points to their Web sites; and to any other entry points to their Web sites where the agency collects substantial personal information from the public. The memorandum also requires such policies to inform Web site visitors what information the agency collects about individuals, why it is collected, and how it is used, and requires the policies to be clearly labeled and easily accessed when someone visits the site.

Second, OMB Memorandum M-00-13, issued on June 22, 2000, details OMB’s requirements related to cookies. It established a new policy concerning cookies by stating that cookies should not be used at federal Web sites, or by contractors when operating Web sites on behalf of agencies, unless clear and conspicuous notice is given and the following conditions are met: (1) there is a compelling need to gather the data on the site, (2) the agency takes appropriate and publicly disclosed privacy safeguards for handling information derived from cookies, and (3) the head of the agency has personally approved the use of cookies. In addition, the memorandum states that it is federal policy that all federal Web sites and contractors when operating on behalf of agencies shall comply with the standards set forth in COPPA with respect to the collection of personal information on-line at Web sites directed at children. In October 2000, we found that USPS used persistent cookies,which USPS fully disclosed in its privacy policy. With respect to private- sector e-commerce providers, some may disclose the extent and purpose of their use of cookies while others may not.

Conclusions

Although USPS has actions under way to respond to the recommendations in our previous report, it has not yet fully addressed them. Over the past year, USPS has continued to struggle with the management and performance of its e-commerce program. Implementation of USPS’ e- commerce initiatives has continued in a fragmented and inconsistent manner. USPS has had difficulty both identifying and classifying its Internet-related initiatives, which include e-commerce initiatives. Further, it does not have reliable financial information for all of its e-commerce and Internet-related initiatives. USPS is attempting to resolve the deficiencies we identified and has recently reorganized its management structure for its e-commerce program. We believe that efforts to establish better transparency and accountability for performance results are steps in the right direction.

USPS has aggressively taken a number of steps to implement a privacy program. Although the selected private-sector providers we contacted and USPS are subject to different privacy-related laws, both have reportedly developed privacy policies and practices that exceed those required by federal law. Given the myriad federal and state privacy laws applicable in this area as well as the numerous private-sector providers with varying privacy practices, we did not attempt to determine which privacy practices might afford customers greater privacy protection.

Concerns continue to be raised in Congress about whether USPS’ e- commerce initiatives in the aggregate are being cross-subsidized by other postal products and services. In responding to our previous report, USPS told us that in providing e-commerce products and services, it would ensure that in the aggregate, the revenues generated by such products and services would cover their direct and indirect costs as well as make a contribution to overhead. To date, although USPS does not yet have complete revenue and cost information on its original e-commerce initiatives, based on the financial information that was provided to us, none of the e-commerce initiatives were profitable. Without complete and reliable financial information on its e-commerce initiatives, USPS is hindered when assessing its progress toward meeting its e-commerce performance goals or determining whether and when those initiatives that are not meeting their goals should be modified or discontinued.

Although USPS intends to provide complete financial reporting on its e- commerce activities by the end of calendar year 2001, we remain concerned about its ability to meet this goal because of recent changes under way in USPS’ management structure and uncertainty about when USPS’ e-commerce program will stabilize. Given the difficulties USPS has had in distinguishing between e-commerce, Internet-related, and its core products and services and, according to USPS officials, the probability that most new products and services are likely to have some Internet- related component, we believe that the need for improved financial information extends not just to e-commerce initiatives but to all new products and services. Further, we are concerned that currently USPS does not have clear and comprehensive policies and procedures that would address how all of the direct and indirect costs associated with its e-commerce and other new products and services are to be reported. Without comprehensive policies and procedures in this area, inconsistencies in reporting are likely to continue.

Accordingly, we believe that the Postmaster General should take steps to develop reliable and consistent financial information for all of its new products and services. If these steps do not result in better transparency of and accountability for USPS’ new products and services, Congress may want to consider requiring USPS to have an annual review by the PRC on the performance of its new products and services, including its e- commerce activities, and PRC to submit a report to Congress annually on the results of this review.

Recommendations for Executive Action

To ensure that USPS develops reliable and consistent financial information for all of its new products and services, we recommend that the Postmaster General develop a comprehensive set of policies and procedures for capturing, attributing, and reporting revenues and expenses associated with its new products and services and that are consistent with PRC’s cost attribution policies; provide an annual report to the Senate Committee on Governmental Affairs, House Committee on Government Reform, and PRC showing its revenues and expenses for new products and services individually and in aggregate that has been audited by an independent entity for the purpose of determining that the report was prepared in accordance with the Service’s policies and procedures and generally accepted accounting principles; and provide the audited report for fiscal year 2001 by May 1, 2002, and by May 1 for each subsequent year.

Matter for Congressional Consideration

In view of congressional interest in USPS’ new products and services and the difficulty USPS has had in providing reliable information on its Internet-related activities, if the steps taken by USPS do not prove effective, Congress may wish to consider requiring USPS to report annually to PRC on the performance of its new products and services, including its e-commerce activities, and having PRC evaluate the quality of the data and submit a report annually to Congress on the results of this review.

The information provided by USPS could correspond to that currently provided to PRC and Congress for the volumes, revenues, and costs of its international mail products and services.

Agency Comments and Our Evaluation

USPS provided comments on a draft of this report in a letter from the Deputy Postmaster General dated December 4, 2001. These comments are summarized below and included as appendix III. We also incorporated technical comments provided by USPS, FTC, and UPS officials into the report where appropriate as well as oral comments provided by PRC’s Director of Rates, Analysis and Planning on the Matter for Congressional Consideration.

USPS said that the draft report pointed out some areas in which it had done a good job and other areas that it said we believed it had considerable work to do. USPS acknowledged that it while it had made progress in responding to our earlier recommendations, it had not made all of the progress we would have liked. With respect to its privacy protections, USPS said that it appreciated our evaluation. It said that in this area of evolving law, regulation, and good business practice, it was confident that it was an industry leader. Through the protections it provides, USPS said, that its customers have strong assurance that their privacy is respected and protected. As we noted in our report, in contrast to its fragmented approach to e-commerce programmatic activities, USPS has created a focused privacy program headed by a Chief Privacy Officer. USPS reportedly has developed privacy policies and practices for its e- commerce customers that exceed those required by federal law, and is also voluntarily engaging in additional self-regulatory privacy practices to safeguard customers’ personal information.

USPS said that it was continuing to implement several organizational and process changes that would result in a better and more sharply focused approach to developing and launching not only e-commerce initiatives but also other new products and services. Further, USPS said that in the restructuring of a number of headquarters functions by the Postmaster General in early September, marketing was one of the areas in which significant changes had been made. All units responsible for developing and rolling out new products and services, including e-commerce, have now been combined into one department to increase management oversight, program discipline, and financial control over the initiatives.

We believe that such steps, if properly implemented, should assist USPS management in resolving the fragmented approach to management that we observed during our review. It appears to us that this fragmented approach was due, in part, to many business units having responsibility for e-commerce initiatives. However, since USPS is still in the process of implementing organizational changes, it may take some time before the results of this reorganization are apparent.

USPS said that it was no longer struggling with a definition for e- commerce. It now defines its e-commerce initiatives as “those products or services that require the use of the Internet for the customer to do business with us and whose primary objective is to generate new revenue.” USPS said that the reason for the emphasis on new revenue was that by expanding its product base, it could develop additional revenue streams to help its “bottom line.” USPS also said that it recognized that some of its new products and services might either use the Internet or generate new revenue, but only those that met both tests would be defined as e-commerce. However, USPS noted that initiatives defined as “non-e- commerce” would not receive any less management scrutiny. Applying this definition, USPS stated that it currently has 5 e-commerce initiatives: ePayments, PosteCS, NetPost Certified, NetPost Mailing Online/NetPost Cardstore, and Secure Electronic Delivery Services/Electronic Postmark.

While we believe that it is important for USPS to have a good definition for e-commerce, it appears to us that USPS faces considerable challenges in consistently applying its revised definition and in categorizing its new products and services that involve use of the Internet in a manner in which its various stakeholders would concur. For example, USPS’ revised list of e-commerce products and services did not include revenue-generating advertisements and links to advertisers placed on USPS’ Web site. It is unclear to us why these advertisements would not fit USPS’ definition since they require use of the Internet and are likely there primarily to raise revenue. Our recommendations that USPS develop policies and procedures for reporting revenues and expenses and provide financial reports on all of its new products and services are aimed in part at addressing the challenge that USPS has faced, and continues to face, in consistently applying an e-commerce definition.

With respect to the recommendations contained in the draft report, USPS agreed with our first recommendation that it provide a comprehensive set of policies and procedures for capturing, attributing, and reporting revenues and expenses associated with its new products and services. It noted that these would be consistent with cost attribution policies as required in the Postal Reorganization Act and sound business practices for new product introduction and costing. We believe that providing such policies and procedures would be a step in the right direction if properly implemented. It is important that such polices and procedures ensure that USPS tracks and reports consistent information on all of its new products and services and that they are consistent with PRC cost attribution policies.

In response to our recommendations concerning annual reporting, USPS said that it would continue its practice of program-specific profit and loss statements, and that these reports would be available to appropriate Senate and House Committees, GAO, and the PRC. USPS noted that these reports would cover those products and services not subject to PRC jurisdiction for pricing, for which a process is already in place to examine their costs and revenues. USPS said that since its financial statements are audited on an annual basis by an independent certified public accounting firm, it planned to have the profit and loss statements reviewed by the accounting firm at the same time for adherence with its reporting policies and generally accepted accounting principles. USPS said that the statements would be submitted by May 1 of each year to the Senate Committee on Governmental Affairs, the House Committee on Government Reform, and to the PRC. In preparing these statements, it is important that USPS be able to track revenues and expenses of all of its new products and services individually as well as in the aggregate so that it can develop complete and consistent program information and ensure that there is no cross-subsidization. Without an aggregate report, USPS and others will have difficulty determining whether USPS is recovering its overall costs. We plan to discuss our views on reporting new products and services financial data with USPS officials as they develop their approach to implementing our recommendations over the next few months.

USPS offered no comments on the Matter for Congressional Consideration in this report. In oral comments, the PRC Director of Rates, Analysis and Planning said that if Congress elects to require USPS to report annually to PRC on the performance of all of its new products and services, then certain aspects of USPS reporting on international products and services would be a good model to follow. He noted that PRC had a formal proceeding with the input of interested parties to establish reporting policies and procedures in the international area. He also said that PRC’s review provides assurance that the data in this area conform to its reporting policies and procedures. PRC has made recommendations for improving the quality of USPS financial data in the international area. In its most recent report, PRC noted that USPS had made improvements that enhanced the reliability of PRC conclusions regarding the potential for cross-subsidization of international mail.

We are sending copies of this report to the Chairman, Subcommittee on International Security, Proliferation, and Federal Services, Senate Committee on Governmental Affairs; the Chairman and Ranking Minority Member, Senate Committee on Governmental Affairs; the Chairman and Ranking Minority Member, House Committee on Government Reform; Mr. John E. Potter, Postmaster General/Chief Executive Officer; Mr. George Omas, Chairman, Postal Rate Commission; and other interested parties. We will also make copies available to others on request. Staff acknowledgments are included in appendix IV. If you have any questions about this report, please contact me on (202) 512-8387 or at ungarb@gao.gov.

Appendix I: Objectives, Scope, and Methodology

For this report, our objectives were to (1) determine what actions USPS has taken to respond to the recommendations in our September report relating to its e-commerce activities; (2) update the status and performance of USPS’ e-commerce initiatives; and (3) compare federal privacy laws, regulations, and policies that apply to USPS in the e- commerce area to those that apply to private-sector providers and discuss voluntary privacy protections provided by USPS and selected private- sector providers.

To determine actions taken by USPS to respond to our recommendations, we attempted to obtain an updated definition of what USPS considered to be an e-commerce initiative and a listing of e-commerce initiatives, which were also to correspond to USPS’ updated definition. We asked for a description of each initiative, along with available supporting documentation. During our review, USPS was in the process of defining, identifying, and classifying its Internet-related initiatives, which include e- commerce initiatives, as well as updating its definition of e-commerce. E- commerce initiatives are just one subset of USPS’ new products and services, which may include other Internet-related initiatives as well as retail and advertising initiatives. USPS provided us with information on initiatives that were implemented, piloted, or planned as of September 2001, but did not finalize its definition of e-commerce initiatives or its listing of Internet-related initiatives, which were to include e-commerce initiatives, until December 2001. We obtained additional information on USPS e-commerce initiatives from the Postal Rate Commission (PRC) and other public sources, such as the USPS Internet site.

To update the status and performance of USPS e-commerce initiatives, we obtained documentation from USPS on its goals and strategies, expected performance, and results through the third quarter of fiscal year 2001, relating to its e-commerce initiatives. The documentation included, for example, available performance measures, targets, and expected performance and results; documentation of processes applicable to USPS e-commerce initiatives and the approval of specific initiatives under those processes; e-commerce business plans, minutes of the eBusiness Opportunity Board and relevant meetings of the Board of Governors; and available financial data.

We interviewed USPS officials responsible for USPS e-commerce initiatives, including the Deputy Postmaster General, the Vice President for e-Commerce, the Vice President for Corporate Business Development, and other e-commerce program officials. We also interviewed officials responsible for compiling financial data. In all cases, we obtained, when possible, documentation to corroborate oral statements.

To obtain information on financial results for the e-commerce program, we obtained information from USPS on revenues and expenses generated by its e-commerce initiatives through the third quarter of fiscal year 2001, although some did not have reported revenues because they had not been implemented by that time. However, these data were not provided for all of the e-commerce and other Internet-related initiatives included on lists that USPS provided to us in August 2001. We did not review or independently audit the overall integrity of USPS’ data, but we examined it for consistency, clarity, and completeness.

To compare federal privacy laws, regulations, and policies that apply to USPS in the e-commerce area to those that apply to private-sector providers, we built on information already compiled in our previous report on USPS e-commerce activities as well as in other GAO reports on Internet privacy. We interviewed USPS officials, including USPS’ Chief Privacy Officer, as well as OMB officials and FTC staff. We reviewed documents and other information obtained from USPS and selected private-sector providers. We reviewed the material obtained for internal consistency and completeness, but we did not verify the information provided by USPS or the selected private-sector providers. We also reviewed USPS information as well as information on some of its partners and affiliates that was available on their respective Internet sites. We also reviewed reports and studies on Internet privacy prepared by FTC and the Congressional Research Service, among others. We researched and analyzed selected federal privacy laws including the Privacy Act, the Postal Reorganization Act of 1970, the Electronic Communications Privacy Act, the Gramm- Leach-Bliley Act, and the Children’s Online Privacy Protection Act.

To provide information on voluntary privacy policies and protections provided by USPS and private-sector providers of e-commerce products and services, we obtained written information from USPS and selected private-sector providers. While we recognize that there are numerous private-sector e-commerce providers, we selected the United Parcel Service (UPS), the Direct Marketing Association (DMA), and the American Bankers Association (ABA) because they, or their members, offered e- commerce products and services similar to those offered by USPS. For example, they or their members offered or used e-commerce services such as electronic bill payment and presentment services, online shipping services, and direct mail marketing. ABA members include community, regional, and money-center banks and holding companies as well as savings associations, trust companies, and savings banks. According to ABA, most community banks are members and substantially all large banks are members of ABA. The DMA’s members, users and suppliers in the direct, database, and interactive marketing field, may provide similar services to those of USPS or be customers of USPS’ e-commerce services. DMA has more than 4,700 member organizations, commercial as well as not-for-profit, from the United States and over 53 nations on 6 continents. UPS is a leading delivery and logistics company.

We did not review actual privacy practices of USPS or selected private- sector providers; therefore, we did not assess either their voluntary privacy practices or whether they were complying with all applicable privacy laws. Given the myriad federal and state privacy laws applicable in this area, as well as the numerous private-sector providers with varying privacy practices, we did not attempt to determine which privacy practices might afford customers greater privacy protection.

We conducted our review at USPS headquarters in Washington, D.C., between January 2001 and October 2001 in accordance with generally accepted government auditing standards.

Appendix II: USPS E-Commerce Initiatives

Description of initiative Creates a secure electronic time and date stamp for electronic communications and provides evidence of any tampering. EPM has been incorporated with other initiatives, such as PosteCS.

Status Implemented 4/2000.

Provides integrated ePayment solutions: eBillPay allows consumers to pay bills, businesses to send bills, consumers to pay each other, and consumers to receive financial statements. eBillPay was implemented 4/2000, and the other enhancements were implemented 9/2001. MoversNet was implemented summer 1996. MoversGuide.com was implemented 9/2001.

Implemented 12/2000.

Implemented 1/2001.

Implemented 9/2000.

Implemented 5/2000.

MoversNet includes three products and services: the hard copy publications—Movers Guide and Welcome Kit—and the Internet application called MoversNet.com. Currently MoversNet.com allows downloading a form for customers to submit changes of physical addresses and is accessible via the USPS Web site and via direct link. It is offered through a strategic alliance with a private company. MoversGuide.com, an enhanced version of MoversNet, allows change of address orders to be accepted electronically and securely via the Internet, with proper identity validation. Allows customers to send greeting cards via a Web interface. Customers can choose from a menu of existing cards for multiple business and personal occasions. Allows secure electronic exchange of data and documents. The program is supported by digital certificates and electronic postmarks issued by USPS. The service is currently in use with government agencies. Allows mailers to electronically transmit their documents, correspondence, newsletters, and other First-Class Mail and Standard-A mail (primarily advertising mail), along with mailing lists, to USPS. Electronic files would then be securely distributed to printing contractors who print documents, insert them into addressed envelopes, sort the mail pieces, and transport the mailing to post offices for processing and delivery. An electronic courier service, it provides a secure, private, Internet- based document delivery system. USPS has joined with Canada Post and LaPoste of France to provide this service globally. The Postal Store, formerly StampsOnline, allows postal customers to purchase stamps, philatelic products, phone cards, and other USPS merchandise via the Internet.

Postal Store replaced Stamps Online in 11/2000.

These e-commerce initiatives, with the exception of NetPost Cardstore, were included in our September 2000 report. As of December 4, 2001, USPS no longer considered MoversGuide.com or the Postal Store as e-commerce initiatives.

Appendix III: Comments From USPS

Appendix IV: GAO Contacts and Staff Acknowledgments

GAO Contact

Acknowledgments

Teresa Anderson, Hazel J. Bailey, Joshua Bartzen, Kenneth E. John, Jill Sayre, and Albert Schmidt made key contributions to this report.

Related GAO Products

Electronic Government: Challenges Must Be Addressed With Effective Leadership and Management (GAO-01-959T, July 11, 2001)

Internet Privacy: Implementation of Federal Guidance for Agency Use of “Cookies” (GAO-01-424, Apr. 27, 2001)

Bank Regulators’ Evaluation of Electronic Signature Systems (GAO-01- 129R, Nov. 8, 2000)

Internet Privacy: Federal Agencies Use of Cookies (GAO-01-147R, Oct. 20, 2000)

Internet Privacy: Comparison of Federal Agency Practices With FTC’s Fair Information Principles (GAO-01-113T, Oct. 11, 2000)

Internet Privacy: Comparison of Federal Agency Practices With FTC’s Fair Information Principles (GAO/AIMD-00-296R, Sept. 11, 2000)

Internet Privacy: Agencies’ Efforts to Implement OMB’s Privacy Policy (GAO/GGD-00-191, Sept. 5, 2000)

U.S. Postal Service: Postal Activities and Laws Related to Electronic Commerce (GAO/GGD-00-188, Sept. 7, 2000)

U.S. Postal Service: Electronic Commerce Activities and Legal Matters (GAO/T-GGD-00-195, Sept. 7, 2000)

U.S. Postal Service: Status of Efforts to Protect Privacy of Address Changes (GAO/GGD-99-102, July 30, 1999)

U.S. Postal Service: Development and Inventory of New Products (GGD- 99-15, Nov. 24, 1998)

U.S. Postal Service: Unresolved Issues in the International Mail Market (GAO/GGD-96-51, Mar. 11, 1996).