Social Media: Federal Agencies Need Policies and Procedures for Managing and Protecting Information They Access and Disseminate
Released: 2011-07-28T00:00:00

Letter

Background

Internet-based services using Web 2.0 technology have become increasingly popular. Web 2.0 technologies are a second generation of the World Wide Web as an enabling platform for Web-based communities of interest, collaboration, and interactive services. These technologies include Web logs (known as “blogs”), which allow individuals to respond online to agency notices and other postings; “wikis,” which allow individual users to directly collaborate on the content of Web pages; “podcasting,” which allows users to download audio content; and “mashups,” which are Web sites that combine content from multiple sources. Web 2.0 technologies also include social media services, which allow individuals or groups of individuals to create, organize, edit, comment on, and share content. These include social networking sites (such as Facebook and Twitter) and video-sharing Web sites (such as YouTube).

While in the past Internet usage concentrated on sites that provide online shopping opportunities and other services, according to the Nielsen Company, social media-related sites have moved to the forefront. In June 2010, it reported that Internet users worldwide accessed social media sites one out of every 4 1/2 minutes they spent online on average. The use of social networking services now reportedly exceeds Web-based e-mail usage, and the number of American users frequenting online video sites has more than tripled since 2003. The Nielsen Company reported that during the month of April 2010, the average user spent nearly 6 hours on social media-related sites.

Facebook is a social networking site that lets users create personal profiles describing themselves and then locate and connect with friends, co-workers, and others who share similar interests or who have common backgrounds. Individual profiles may contain—at the user’s discretion— detailed personal information, including birth date, home address, telephone number, employment history, educational background, and religious beliefs. Facebook also allows any user to establish a “page” to represent an organization (including federal agencies), business, or public figure in order to disseminate information to users who choose to connect with them. These users can leave comments in response to information posted on such a page. Profile information for these users may be made available to the administrators of these pages, depending on settings controlled by the user. According to the Facebook site, Facebook has over 500 million active users who spend more than 700 billion minutes per month on Facebook.

Twitter is a social networking site that allows users to share and receive information through short messages that are also known as “tweets.” These messages are no longer than 140 characters in length. Twitter users can establish accounts by providing a limited amount of PII but may elect to provide additional PII if they wish. Users can post messages to their profile pages and reply to other Twitter users’ tweets. Users can “follow” other users as well—i.e., subscribe to their tweets. In March 2011, Twitter reported adding an average of 460,000 new accounts and facilitating the delivery of 140 million tweets every day.

YouTube is a video-sharing site that allows users to discover, watch, upload, comment on, and share originally created videos. Similar to Twitter, users can establish accounts on YouTube with only limited amounts of PII, although they may choose to provide more detailed information on their profile page. Users can comment on videos posted on a page either in written responses or by uploading their own videos. According to YouTube, during 2010 more than 13 million hours of video were uploaded.

Federal agencies are increasingly using these social media tools to enhance services and interactions with the public. As of April 2011, 23 of 24 major federal agencies had established accounts on Facebook, Twitter, and YouTube. Furthermore, the public increasingly follows the information provided by federal agencies on these services. For example, as of April 2011, the U.S. Department of State had over 72,000 users following its Facebook page; the National Aeronautics and Space Administration (NASA) had over 992,000 Twitter followers; and a video uploaded by NASA on YouTube in December 2010 had over 360,000 views as of April 2011.

Federal Agencies Are Responsible for Managing Records, Protecting Privacy, and Ensuring Adequate Security

The Federal Records Act establishes requirements for records management programs in federal agencies. Each federal agency is required to make and preserve records that (1) document the organization, functions, policies, decisions, procedures, and essential transactions of the agency and (2) provide the information necessary to protect the legal and financial rights of the government and of persons directly affected by the agency’s activities. The Federal Records Act defines a federal record without respect to format. Records include all books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the government under federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the government or because of the informational value of data in them.

The agency responsible for providing guidance for adhering to the Federal Records Act is the National Archives and Records Administration (NARA). NARA is responsible for issuing records management guidance; working with agencies to implement effective controls over the creation, maintenance, and use of records in the conduct of agency business; providing oversight of agencies’ records management programs; approving the disposition (destruction or preservation) of records; and providing storage facilities for agency records.

In October 2010, NARA issued a bulletin to provide guidance to federal agencies in managing records produced when federal agencies use social media platforms for federal business. The bulletin highlighted the requirement for agencies to decide how they will manage records created in social media environments in accordance with applicable federal laws and regulations. As part of this effort, the guidance emphasized the need for active participation of agency records management staff, Web managers, social media managers, information technology staff, privacy and information security staff, and other relevant stakeholders at each federal agency.

Privacy Laws and Guidance Set Requirements to Ensure the Protection of Personal Information

The primary laws that provide privacy protections for personal information accessed or held by the federal government are the Privacy Act of 1974 and E-Government Act of 2002. These laws describe, among other things, agency responsibilities with regard to protecting PII. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. A system of records is a collection of information about individuals under control of an agency from which information is retrieved by the name of an individual or other identifier. The E-Government Act of 2002 requires agencies to assess the impact of federal information systems on individuals’ privacy. Specifically, the E-Government Act strives to enhance the protection of personal information in government information systems and information collections by requiring agencies to conduct privacy impact assessments (PIA).

A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. Specifically, according to Office of Management and Budget (OMB) guidance, the purpose of a PIA is to (1) ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.

In June 2010, OMB issued guidance to federal agencies for protecting privacy when using Web-based technologies (such as social media). The guidance built upon the protections and requirements outlined in the Privacy Act and E-Government Act and called for agencies to develop transparent privacy policies and notices to ensure that agencies provide adequate notice of their use of social media services to the public, and to analyze privacy implications whenever federal agencies choose to use such technologies to engage with the public.

Key Laws and Guidance Set Agencies’ Responsibilities for Securing Government Information

The Federal Information Security Management Act of 2002 (FISMA) established a framework designed to ensure the effectiveness of security controls over information resources that support federal operations and assets. According to FISMA, each agency is responsible for, among other things, providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency and information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.

Consistent with its statutory responsibilities under FISMA, in August 2009 the National Institute of Standards and Technology (NIST) issued an update to its guidance on recommended security controls for federal information systems and organizations. The NIST guidance directs agencies to select and specify security controls for information systems based on an assessment of the risk to organizational operations and assets, individuals, other organizations, and the nation associated with operation of those systems. According to the guidance, the use of a risk-based approach is applicable not just to the operation of the agency’s internal systems but is also important when an agency is using technology for which its ability to establish security controls may be limited, such as when using a third-party social media service.

GAO Has Identified Challenges in Agencies’ Use of Social Media

In July 2010, we testified that while the use of Web 2.0 technologies, including social media technologies, can transform how federal agencies engage the public by allowing citizens to be more involved in the governing process, agency use of such technologies can also present challenges related to records management, privacy, and security.

Records Management: We reported that Web 2.0 technologies raised issues concerning the government’s ability to identify and preserve federal records. Agencies may face challenges in assessing whether the information they generate and receive by means of these technologies constitutes federal records. Furthermore, once the need to preserve information as federal records has been established, mechanisms need to be put in place to capture such records and preserve them properly. We stated that proper records retention management needs to take into account NARA record scheduling requirements and federal law, which require that the disposition of all federal records be planned according to an agency schedule or a general records schedule approved by NARA.

We highlighted that these requirements may be challenging for agencies because the types of records involved when information is collected via Web 2.0 technologies may not be clear. As previously mentioned, in October 2010, NARA issued further guidance that clarified agency responsibilities in making records determinations.

Privacy: We noted, among other things, that agencies faced challenges in ensuring that they are taking appropriate steps to limit the collection and use of personal information made available through social media. We stated that privacy could be compromised if clear limits were not set on how the government uses personal information to which it has access in social networking environments. Social networking sites, such as Facebook, encourage people to provide personal information that they intend to be used only for social purposes. Government agencies that participate in such sites may have access to this information and may need rules on how such information can be used. While such agencies cannot control what information may be captured by social networking sites, they can make determinations about what information they will collect and what to disclose. However, unless rules to guide their decisions are clear, agencies could handle information inconsistently. OMB’s subsequent release of guidance, as previously discussed, clarified agency requirements for such privacy protections.

Security: We highlighted that federal government information systems have been targeted by persistent, pervasive, and aggressive threats and that, as a result, personal and agency information needs to be safeguarded from security threats, and that guidance may be needed for employees on how to use social media Web sites properly and how to handle information in the context of social media.

Cyber attacks continue to pose a potentially devastating threat to the systems and operations of the federal government. In February 2011, the Director of National Intelligence testified that, in the previous year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, including a more than tripling of the volume of malicious software since 2009.

Further, in March 2011, the Federal Trade Commission (FTC) reached an agreement with Twitter to resolve charges that the company deceived consumers and put their privacy at risk by failing to safeguard their personal information. The FTC alleged that serious lapses in the company’s security allowed hackers to obtain unauthorized administrative control of Twitter and send unauthorized tweets from user accounts, including one tweet, purportedly from President Obama, that offered his more than 150,000 “followers” a chance to win $500 in free gasoline, in exchange for filling out a survey. To resolve the charges, Twitter agreed to establish and maintain a comprehensive information security program that would be assessed by an independent auditor every other year for 10 years.

According to a Chief Information Officers (CIO) Council report released in September 2009, as the federal government begins to utilize public social media Web sites, advanced persistent threats may be targeted against these Web sites. In addition, attackers may use social media to collect information and launch attacks against federal information systems. Table 1 summarizes three types of security threats identified by the CIO Council that agencies may face when using commercially provided social media services.

The rapid development of social media technologies makes it challenging to keep up with the constantly evolving threats deployed against them and raises the risks associated with government participation in such technologies.

Federal Agencies Have Used Social Media Services for a Variety of Purposes

Federal agencies have been using social media services to support their individual missions. While Facebook, Twitter, and YouTube offer unique ways for agencies to interact with the public, we identified several distinct ways that federal agencies are using the three social media services. Despite varying features of the three platforms, agency interactions can be broadly categorized by the manner in which information is exchanged with the public, including reposting information already available on an agency Web site, posting original content not available on agency Web sites, soliciting feedback from the public, responding to comments, and linking to non-government Web sites. Figure 1 shows how the 23 agencies use each of these functions.

Reposting Information Available on Agency Web sites

All 23 agencies used social media to re-post information that is also available on an official agency Web site. This information typically included press releases that agencies issue on mission-related topics or posts to an agency’s blog. Each of the three services was used for reposting information by the agencies.

Facebook was used to repost information and direct the public to an agency’s official Web site. For example, the Social Security Administration (SSA) posted a notice on its Facebook page that briefly discussed Social Security benefits and provided a link to SSA’s Web site. The same information was also posted on the SSA Web page.

Twitter was used to repost information in an abbreviated format, accompanied by a link to an official agency Web page where the full content was available. For example, the Department of the Interior posted a message (or “tweet”) about an order that the Secretary of the Interior had issued and provided a link to the agency’s Web site where the full order was available.

YouTube was generally used to provide an alternate means of accessing videos that were available on the agencies’ Web sites. For example, the Department of Defense (DOD) uploaded a video to its YouTube channel— the Pentagon Channel—that described what was going on at the Pentagon during a particular week. The video was also posted on a DOD Web site dedicated to broadcasting military news and information for members of the armed forces.

Posting Content Not Available on Agency Web sites

In addition to reposting information, agencies also used social media to post original content that is not available on their Web sites. All 23 agencies used social media to post content not available on the agency’s Web site. Twitter was used most often for this purpose.

Facebook was used to post content such as pictures and descriptions of officials on tours or inspections. For example, the Facebook page for the Department of Housing and Urban Development (HUD) featured a picture of the HUD Secretary with President Obama and others while visiting a renovated public housing development during a trip to New Orleans to observe efforts to rebuild the city following Hurricane Katrina. This picture and explanation were not posted to any of HUD’s Web sites.

Twitter was often used by agencies to post ephemeral or time-sensitive information. For example, DOD used its Twitter account to encourage its subscribers to sign up to be extras in a movie filming in Washington, D.C. This information and encouragement were not posted on the department’s Web site.

YouTube was often used to publish videos of officials discussing topics of interest to the public. An example of this is a video posted to the Department of Energy’s (DOE) YouTube channel on August 2, 2010, in which an official discussed a project for a battery-based energy storage system. Neither this video nor a transcript of the video was found on a DOE Web site.

Soliciting Comments

Agencies also used Facebook, Twitter, and YouTube to request comments from the public. This feedback may be received either through the social media service itself or through an agency Web site. Twenty-two of 23 agencies used social media to solicit comments from the public. Of the 22 agencies soliciting feedback, most used Twitter for this purpose.

Facebook was generally used for feedback solicitation both when the agency wanted the public to provide comments directly via the social media site and when the agency wanted the public to provide comments through an agency Web site. For example, the Department of Veterans Affairs asked on its Facebook page if the readers liked the redesign of the agency’s main Web site. The post received over 50 comments.

Twitter was generally used for feedback solicitation when the agency wanted the public to provide comments through an agency Web site. For example, the Department of Education posted a tweet that requested both teachers and parents to comment on their views of what an effective parent-teacher partnership looks like. The post included a link to the department’s blog on its Web site, where individuals could leave comments.

YouTube was also used for feedback solicitation. For example, the Department of Transportation uploaded a video to its YouTube channel asking the public to create and upload videos describing how distracted driving has affected their lives. The video received multiple comments from the public expressing their views on driving and using their cell phones at the same time.

Responding to Comments on Posted Content

Agencies also used social media to respond to comments from the public that were posted on the agencies social media sites to address both administrative and mission-related topics. In these instances, agency responses to public comments were posted to the same social media Web pages where the original comments appeared. Seventeen of the 23 agencies posted responses to public comments on their social media sites. These agencies generally used Facebook or Twitter the most for this activity, with few agencies responding to comments received on their YouTube channels.

Agencies used Facebook to respond to comments received on their Facebook pages. For example, HUD posted information on its Facebook page regarding the department’s allocation of funding for rental assistance for non-elderly persons with disabilities with a link to additional information located on the department’s Web site. In response, individuals posted questions and comments, and HUD responded.

Twitter was also used by agencies to respond to comments. For example, a tweet posted by the Small Business Administration (SBA) in response to a comment received from a Twitter user stated that the agency was still tweaking the functionality of a system and as a means to provide better customer service asked what e-mail address the individual used.

Providing Links to Non- Government Web sites

The agencies we reviewed also used social media sites to post links to non-government Web sites (i.e., a Web site whose address does not end in .gov or is not an agency initiative). For example, agencies often provided links to relevant articles located on news media Web sites. All 23 agencies used social media to post links to non-government Web sites. Of the three social media services, Twitter was used the most, while few agencies used YouTube for this purpose.

Twitter was often used by agencies to post links to Web sites, as many of the tweets that Twitter subscribers receive contain links to Web sites providing further information. For example, the Secretary of Transportation posted a Twitter message about a non-government organization’s Web site, along with a link to the site.

Federal Agencies Have Made Mixed Progress in Developing Policies and Procedures for Managing and Protecting Information Associated with Social Media Use

Federal agencies have made mixed progress in developing records management guidance and assessing privacy and security risks associated with their use of commercially provided social media services. Specifically, 12 of the 23 major federal agencies that use Facebook, Twitter, and YouTube have developed and issued guidance to agency officials that outlines (1) processes and policies for how social media records are identified and managed and (2) record-keeping roles and responsibilities. Further, 12 agencies have updated their privacy policies to describe whether they use personal information made available through social media. In addition, eight agencies conducted privacy impact assessments to identify potential risks associated with agency use of the three services. Finally, seven agencies assessed and documented security risks associated with use of the three services and identified mitigating controls to address those risks. Table 2 outlines the extent to which each of the 23 major federal agencies have developed policies and procedures for use of social media.

Agencies Have Made Progress in Establishing Guidance for Managing Social Media Records

We previously reported that agencies faced challenges in assessing whether the information they generate and receive by means of these services constitutes federal records and establishing mechanisms for capturing and preserving such records. NARA’s October 2010 bulletin on managing social media records highlighted, among other things, the need to ensure that social media policies and procedures articulate clear records management processes and policies and recordkeeping roles and responsibilities. Establishing such guidance can provide a basis for consistently and appropriately categorizing and preserving social media content as records.

Twelve of the 23 major federal agencies have taken steps to include records management guidance in their social media policies and procedures. The scope and breadth of the guidance provided varied with each agency. Specifically, eight of the agencies included general statements directing officials responsible for social media content to conform to agency records management policies in identifying records and how to manage them. For example, the Department of Health and Human Services’ social media policy stated that “records management requirements for social media technologies are similar to any other information system and shall be in conformance with existing policy” and provided a Web link to the department’s records management policies. Four agencies provided more specific guidance to officials on what social media content constitutes a federal record at their respective agencies. For example, the Department of Justice issued a policy in August 2009 that included a set of questions department officials are to answer in determining the record status of content posted on agency social media pages. Officials were asked to assess, among other things, (a) whether the agency content was original and not published on other agency Web sites, (b) the duration of time the content would need to be retained, and (c) what agency entity would be responsible for preserving and monitoring the information posted on the social media site.

Officials from 10 of the 11 agencies that have not yet documented social media guidance for records management reported taking actions to develop such guidance. Officials from 1 other agency (the National Science Foundation) stated that they intended to prepare guidance but did not report taking any actions to do so.

However, agency officials are still likely to need clear direction on how to assess social media records when using new technology. NARA noted in a September 2010 study that records management staff in agencies have been overwhelmed by the speed at which agency employees are adopting new social media technologies and that social media adopters have sometimes ignored records management concerns. Until agencies ensure that records management processes and policies and recordkeeping roles and responsibilities are articulated within social media policies, officials responsible for creating and administering content on agency social media sites may not be making appropriate determinations about social media records.

Agencies Continue to Face Challenges in Establishing Mechanisms for Capturing and Preserving Social Media Records

Once the need to preserve information as federal records has been established, mechanisms need to be put in place to capture such records and preserve them properly. We previously testified that establishing such mechanisms may be challenging for agencies because the types of records involved when information is collected via technologies like social media services may not be clear. Officials at agencies that issued records management guidance for social media generally agreed that determining how to preserve social media content as records remains an issue. For example, officials at the Department of the Interior stated that having information with federal record value on non-government systems—such as those of commercial providers of social media—can create challenges in determining who has control over the information and how and when content should be captured for record-keeping. Participants at a roundtable discussion hosted by the National Academy of Public Administration on our behalf also confirmed capturing records as a challenge. One participant suggested that further guidance from NARA to include specific “use cases” as examples would benefit agencies in understanding what approaches can be taken to properly capture and preserve social media records.

NARA recently identified the need for further study of potential mechanisms for capturing social media content as records. In its September 2010 study, NARA noted that an agency may not have sufficient control over its content to apply records management principles due to the nature of a third-party site. Furthermore, social media technology can change quickly with functionality being added or changed that could have an impact on records management. As a result, NARA concluded that it should continue to work with other federal agencies to identify best practices for capturing and managing these records. Within its October 2010 bulletin, NARA presented a list of options for how to preserve social media records, such as Web capture tools to create local versions of sites and convert content to other formats. NARA officials stated that activities are underway to provide further assistance to agencies in determining appropriate methods for capturing social media content as federal records. Specifically, in January 2011 NARA initiated a working group in partnership with the Federal Records Council to evaluate Web 2.0 issues regarding records management and develop strategies for capturing social media content as federal records. However, NARA has yet to establish a time frame for issuing new guidance as a result of these efforts. Until guidance is developed that identifies potential mechanisms for capturing social media content as records, potentially important records of government activity may not be appropriately preserved.

Agencies Have Made Mixed Progress in Updating Privacy Policies and Assessing Privacy Risks Associated with Use of Social Media Services

Social media services often encourage people to provide extensive personal information that may be accessible to other users of those services. Government agencies that participate in such sites may have access to this information and may need to establish controls on how such information can be used. We previously reported that, while such agencies cannot control what information may be captured by social networking sites, they can make determinations about what information they will collect and how it will be used. In June 2010, OMB issued memorandum M-10-23, which specified a variety of actions agencies should take to protect individual privacy whenever they use third-party Web sites and applications to engage with the public. Two key requirements established by OMB were the need for each agency to (1) update its privacy policy in order to provide the public with information on whether the agency uses PII made available through its use of third-party Web sites for any purpose, and (2) conduct privacy impact assessments (PIA) whenever an agency’s use of a third-party Web site makes PII available to the agency.

Assessing privacy risks is an important element of conducting a PIA because it helps agency officials determine appropriate privacy protection policies and techniques to implement those policies. A privacy risk analysis should be performed to determine the nature of privacy risks and the resulting impact if corrective actions are not implemented to mitigate those risks. Such analysis can be especially helpful in connection with the use of social media because there is a high likelihood that PII will be made available to the agency.

Twelve out of 23 agencies updated their privacy policies to include discussion on the use of personal information made available through social media services. In general, agencies stated that while PII was made available to them through their use of social media services, they did not collect or use the PII. For example, HUD updated the privacy policy on its main Web site, www.hud.gov, to state that “no personally identifiable information (PII) may be requested or collected from social media sites.” As another example, the Department of Energy included a discussion of its policy of removing PII that may be posted on its social media page, noting that officials reserved the right to moderate or remove comments that include PII.

Officials from 5 of the 11 agencies that have not updated their privacy policies reported taking actions to do so. Officials from 6 additional agencies (the Departments of Commerce, Health and Human Services, Labor, and Transportation; the National Aeronautics and Space Administration, and the Social Security Administration) stated that they intended to update their privacy policies but did not report taking any actions to do so.

Eight agencies conducted PIAs to assess the privacy risks associated with their use of the three services. For example, the Department of Homeland Security (DHS) published a PIA that assessed the risks of the agency’s use of social networking tools, including the potential for agency access to the personal information of individuals interacting with the department on such sites. To mitigate this risk, the department established a policy of prohibiting the collection of personal information by DHS officials using social media sites. Likewise, the Department of Transportation completed a PIA for the use of third-party Web sites and applications, including Facebook, Twitter, and YouTube. The PIA outlined, among other things, what types of PII may potentially be made available to the agency through its use of social media, including the name, current residence, and age of users who may friend, follow, subscribe to or otherwise interact with an official department page on a third-party site. In these instances, the department’s PIA directed officials to avoid capturing and using the PII and to redact any PII contained in screenshots that may be saved for recordkeeping purposes.

Officials from 13 agencies had not completed PIAs for their use of any of the social media services, while an additional 2 agencies performed assessments that only evaluated risks associated with using Facebook. Officials from 10 of these agencies reported taking actions to conduct the assessments. Officials from 2 other agencies (the Department of State and the Small Business Administration) stated that they intended to conduct assessments but did not report taking any actions to do so. Officials from the other 3 agencies (the Departments of Agriculture and the Treasury; and the General Services Administration) stated that they did not plan to conduct PIAs because they were not planning to collect personal information provided on their social media sites and, therefore, an assessment was unnecessary.

However, OMB’s guidance states that when an agency takes action that causes PII to become accessible to agency officials—such as posting information on a Facebook page that allows the public to comment—PIAs are required. Given that agency officials have access to comments that may contain PII and could collect and use the information for another purpose, it is important that an assessment be conducted, even if there are no plans to save the information to an agency system.

Without updating privacy policies and performing and publishing PIAs, agency officials and the public lack assurance that all potential privacy risks have been evaluated and that protections have been identified to mitigate them.

Agencies Have Made Mixed Progress in Assessing Security Risks Associated with Use of Commercially Provided Social Media Services

Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the federal government. As part of managing an effective agencywide information security program to mitigate such threats, FISMA requires that federal agencies conduct periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of agency information and information systems. To help agencies implement such statutory requirements, NIST developed a risk management framework for agencies to follow in developing information security programs. As part of this framework, federal agencies are to assess security risks associated with information systems that process federal agency information and identify security controls that can be used to mitigate the identified risks. In associated guidance, NIST highlighted that using such a risk-based approach is also important in circumstances where an organization is employing information technology beyond its ability to adequately protect essential missions and business functions, such as when using commercially provided social media services. By identifying the potential security threats associated with use of such third-party systems, agencies can establish proper controls and restrictions on agency use.

Seven out of 23 agencies performed and documented security risk assessments concerning their use of the three social media services. For example, the Department of Labor outlined the agency’s use of the three tools within one risk assessment, evaluating potential threats and vulnerabilities, and recommended controls to mitigate risks associated with those threats and vulnerabilities. The department identified, among other things, the potential risk of having unauthorized information posted to its social media page by agency officials with social media responsibilities and identified the need for such individuals to receive training on proper use of social media sites. Additionally, a Department of Health and Human Services security document stated that, due to risks associated with use of social media, including the potential for social media sites to be used as a vehicle for transmitting malicious software, the department would block use of social media sites—including Facebook, Twitter, and YouTube—by employees, with specific allowances made for those with documented business needs.

According to officials, 16 agencies had not completed and documented assessments for their use of any of the social media services. Officials from 12 of these agencies reported that they were taking actions to conduct security risk assessments but had not yet completed them. Officials from 2 additional agencies (the Department of Commerce and the National Science Foundation) stated that they intended to conduct assessments but did not report taking any actions to do so. Officials at 1 other agency (the Department of State) reported that they did not plan to conduct assessments because their internal policies and procedures did not require them to perform risk assessments. As we previously stated, however, NIST guidance requires the application of the risk management process to social networking uses to establish proper controls and restrictions on agency use. Officials from 1 other agency (the Department of Transportation) reported that they had conducted a security risk assessment but did not document the results. Without such documentation, the agency may lack evidence of the justification and rationale for decisions made based on the risk assessment and, consequently, the assurance that security controls have been implemented to properly address identified security threats.

Without conducting and documenting a risk assessment, agency officials cannot ensure that appropriate controls and mitigation measures are in place to address potentially heightened threats associated with social media, including spear phishing and social engineering.

Conclusions

Federal agencies are increasingly making use of social media technologies, including Facebook, Twitter, and YouTube, to provide information about agency activities and interact with the public. While the purposes for which agencies use these tools vary, they have the potential to improve the government’s ability to disseminate information, interact with the public, and improve services to citizens.

However, the widespread use of social media technologies also introduces risks, and agencies have made mixed progress in establishing appropriate policies and procedures for managing records, protecting the privacy of personal information, and ensuring the security of federal systems and information. Specifically, just over half of the major agencies using social media have established policies and procedures for identifying what content generated by social media is necessary to preserve in order to ensure compliance with the Federal Records Act, and they continue to face challenges in effectively capturing social media content as records. Without clear policies and procedures for properly identifying and managing social media records, potentially important records of government activity may not be appropriately preserved. In addition, most agencies have not updated their privacy policies or assessed the impact their use of social media may have on the protection of personal information from improper collection, disclosure, or use, as called for in recent OMB guidance. Performing PIAs and updating privacy policies can provide individuals with better assurance that all potential privacy risks associated with their personal information have been evaluated and that protections have been identified to mitigate them. Finally, most agencies did not have documented assessments of the security risks that social media can pose to federal information or systems in alignment with FISMA requirements, which could result in the loss of sensitive information or unauthorized access to critical systems supporting the operations of the federal government. Without conducting and documenting a risk assessment, agency officials cannot ensure that appropriate controls and mitigation measures are in place to address potentially heightened threats associated with social media, such as spear phishing and social engineering.

Recommendations for Executive Action

To ensure that federal agencies have adequate guidance to determine the appropriate method for preserving federal records generated by content presented on agency social media sites, we recommend that the Archivist of the United States develop guidance on effectively capturing records from social media sites and that this guidance incorporate best practices.

We are also making 32 recommendations to 21 of the 23 departments and agencies in our review to improve their development and implementation of policies and procedures for managing and protecting information associated with social media use. Appendix II contains these recommendations.

Agency Comments and Our Evaluation

We sent draft copies of this report to the 23 agencies covered by our review, as well as to the National Archives and Records Administration. We received written or e-mail responses from all the agencies. A summary of their comments and our responses, where appropriate, are provided below.

In providing written comments on a draft of this report, the Archivist of the United States stated that NARA concurred with the recommendation to develop guidance on effectively capturing records from social media sites and that the agency would incorporate best practices in this guidance. NARA’s comments are reprinted in appendix III.

Of the 21 agencies to which we made recommendations, 12 (the Departments of Defense, Education, Energy, Homeland Security, Housing and Urban Development, and Veterans Affairs; the Environmental Protection Agency; the National Aeronautics and Space Administration; the National Science Foundation; the Office of Personnel Management; the Social Security Administration; and the U.S. Agency for International Development) agreed with our recommendations.

Two of the 21 agencies (the Departments of Commerce and Health and Human Services) generally agreed with our recommendations but provided qualifying comments: In written comments on a draft of the report, the Secretary of Commerce concurred with our two recommendations but provided qualifying comments about the second. Regarding our recommendation that the department conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats, he stated that the department had a policy in place that requires risk-based assessments to be conducted of social media technologies used by the department in order to determine if mitigating strategies, such as access or usage limitation, are warranted. However, the department did not provide documentation demonstrating that it had completed and documented any of the required risk assessments. The department’s comments are reprinted in appendix IV.

In an e-mail response on a draft of the report, a Department of Health and Human Services’ Senior Information Security Officer stated that the department agreed with our recommendation to update its privacy policy. However, the department disagreed with the perceived finding that it had not made progress in conducting a PIA and reported recent efforts to do so. We did not intend to suggest that the department had not taken any steps to develop a PIA, and we updated our report to clarify that the department has taken actions to develop PIAs for its social media use. However, the agency has not yet completed its PIA and thus may lack assurance that all potential privacy risks have been evaluated and that protections have been identified to mitigate them.

Three of the 21 agencies (the Departments of Agriculture and State; and the General Services Administration) did not concur with all of the recommendations made to them: In written comments on a draft of the report, the Department of Agriculture’s CIO disagreed with our recommendation that the department conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them. Specifically, the CIO stated that the department had completed a Privacy Threshold Analysis that indicated that a PIA was not required since the department did not solicit, collect, or retain PII through its social media sites. However, as indicated in our report, OMB’s guidance states that when an agency takes action that causes PII to become accessible to agency officials—such as posting information on a Facebook page that allows the public to comment—PIAs are required. Without a PIA, the department may lack assurance that all potential privacy risks have been evaluated and that protections have been identified to mitigate them. The Department of Agriculture’s comments are reprinted in appendix V.

In written comments on a draft of the report, the Department of State’s Chief Financial Officer concurred with one of our two recommendations, but not the other. Specifically, regarding our recommendation that the department conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats, he stated that the department shared GAO’s concern regarding the security of information in commercially provided social media but that since the department had already determined that its use of social media sites would be limited to providing the public with “low-impact” information, no further risk assessment or certification and accreditation was required. He further stated that the impact on confidentiality, integrity, and availability of systems with such non- structured data could only be determined by policy, not by risk analysis and, therefore, a security risk assessment was not warranted. However, although limiting the type of information that is processed on third-party systems can be an effective mitigating security control, without conducting and documenting a risk assessment, agency officials cannot ensure that policies and mitigation measures effectively address potentially heightened threats associated with social media, including spear phishing and social engineering. The Department of State’s comments are reprinted in appendix VI.

In written comments on a draft of the report, the Administrator of the General Services Administration partially agreed with our two recommendations. Regarding our recommendation that the agency update its privacy policies to describe whether PII made available through its use of social media services is collected and used, the Administrator noted that the agency was updating its privacy directive to describe the agency’s practices for handling PII made available through the use of social media. Accordingly, we have updated our report to indicate that the agency has taken actions to update its privacy policies for its use of social media. Regarding our recommendation that the agency conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them, the Administrator stated that no PII is sought by or provided to GSA as a result of the agency’s use of Facebook, YouTube, and Twitter and, therefore, the agency determined that conducting a PIA was unnecessary. However, as indicated in our report, OMB’s guidance states that when an agency takes action that causes PII to become accessible to agency officials—such as posting information on a Facebook page that allows the public to comment—PIAs are required. Without a PIA, the department may lack assurance that all potential privacy risks have been evaluated and that protections have been identified to mitigate them. The General Services Administration’s comments are reprinted in appendix VII.

Four of the 21 agencies did not comment on the recommendations addressed to them. Specifically, the Departments of Labor and Transportation reported that they did not have any comments and the Department of the Treasury and Small Business Administration only provided technical comments, which we addressed in the final report as appropriate.

In cases where these 21 agencies also provided technical comments, we have addressed them in the final report as appropriate. Agencies also provided with their comments information regarding actions completed or underway to address our findings and recommendations and we updated our report to recognize those efforts. Additional written comments are reprinted in appendices VIII through XVII.

We also received e-mail responses from the 2 agencies to which we did not make recommendations. Specifically, the Department of the Interior provided technical comments via e-mail and the Department of Justice stated that it did not have comments on the draft of this report.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. We will then send copies of this report to other interested congressional committees, Secretaries of the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, the Interior, Labor, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, Small Business Administration, and U.S. Agency for International Development; the Commissioner of the Social Security Administration; the Directors of the National Science Foundation and Office of Personnel Management; and the Archivist of the United States. The report will also be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix XVIII.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to: describe how agencies are currently using commercially provided social determine the extent to which federal agencies have developed and implemented policies and procedures for managing and protecting information associated with the use of commercially provided social media services.

To address our first objective, we examined the headquarters-level Facebook pages, Twitter accounts, and YouTube channels associated with each of the 24 major federal agencies covered by the Chief Financial Officers Act to describe the types of information agencies disseminated via the services and the nature of their interactions with the public. We selected these three services because of their widespread use within the federal government (23 out of 24 major agencies use each of the services) as well as their broad popularity with the public. We reviewed content on the social media pages, including agency posts as well as comments provided by the public, from July 2010 through January 2011. We categorized agency use based on types of information found on their social media pages. These categories were (1) reposting information available on agency Web sites; (2) posting content not available on agency Web sites; (3) soliciting comments; (4) responding to comments on posted content; and (5) providing links to non-government Web sites. Each agency social media page was reviewed by an analyst to determine whether information had been posted that fell into one of the five categories. Each identified example was corroborated by a second analyst. In the event no examples were identified for an agency in a specific category by the first analyst, the second analyst conducted an additional independent review of agency posts to confirm that none existed.

To address our second objective, we reviewed pertinent records management, privacy, and security policies, procedures, guidance, and risk assessments in place at each of the 23 federal agencies and compared them to relevant federal records management, privacy, and security laws, regulations, and guidance. These included the Federal Records Act, the Privacy Act of 1974, the E-Government Act of 2002, the Federal Information Security Management Act of 2002 (FISMA), as well as guidance from the National Archives and Records Administration (NARA), Office of Management and Budget (OMB), and National Institute of Standards and Technology (NIST). We interviewed officials at each of these agencies to discuss recent efforts to oversee the development of social media policies and procedures and assess risks. We also reviewed relevant reports and studies to identify records management, privacy, and security risks associated with social media use by federal agencies. We interviewed officials from OMB, NARA, and NIST, and members of the Chief Information Officer Council to develop further understanding of federal agency requirements for properly managing and protecting information associated with social media use. Further, we coordinated with the National Academy of Public Administration, which hosted a roundtable discussion on our behalf where views on these issues were solicited from federal agency officials involved in agency use of social media. Finally, we interviewed representatives of Facebook, Twitter, and YouTube to discuss records management, privacy, and security issues and their current and planned approaches regarding interactions with federal agencies.

We conducted this performance audit from July 2010 to June 2011 in the Washington, D.C., area, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Recommendations to Departments and Agencies

Department of Agriculture

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Secretary of Agriculture take the following action: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Department of Commerce

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Secretary of Commerce take the following two actions: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Department of Defense

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Secretary of Defense take the following action: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Department of Education

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Secretary of Education take the following action: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Department of Energy

To ensure that appropriate security measures are in place when commercially provided social media services are used, we recommend that the Secretary of Energy take the following action: Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Department of Health and Human Services

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Secretary of Health and Human Services take the following action: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Department of Homeland Security

To ensure that appropriate security measures are in place when commercially provided social media services are used, we recommend that the Secretary of Homeland Security take the following action: Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Department of Housing and Urban Development

To ensure that appropriate security measures are in place when commercially provided social media services are used, we recommend that the Secretary of Housing and Urban Development take the following action: Conduct and document a security risk assessment to assess security threats associated with agency use of Twitter and YouTube and identify security controls that can be used to mitigate the identified threats.

Department of Labor

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Secretary of Labor take the following action: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Department of State

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Secretary of State take the following two actions: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of Twitter and YouTube and identifies protections to address them.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Department of Transportation

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Secretary of Transportation take the following two actions: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Department of the Treasury

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Secretary of the Treasury take the following action: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Department of Veterans Affairs

To ensure that appropriate records management and privacy measures are in place when commercially provided social media services are used, we recommend that the Secretary of Veterans Affairs take the following two actions: Add records management guidance to agency social media policies that describes records management processes and policies and recordkeeping roles and responsibilities.

Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Environmental Protection Agency

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Administrator of the Environmental Protection Agency take the following two actions: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

General Services Administration

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Administrator of the General Services Administration take the following two actions: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

National Aeronautics and Space Administration

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Administrator of the National Aeronautics and Space Administration take the following three actions: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

National Science Foundation

To ensure that appropriate records management and security measures are in place when commercially provided social media services are used, we recommend that the Director of the National Science Foundation take the following two actions: Add records management guidance to agency social media policies that describes records management processes and policies and recordkeeping roles and responsibilities.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Office of Personnel Management

To ensure that appropriate privacy and security measures are in place when commercially provided social media services are used, we recommend that the Director of the Office of Personnel Management take the following two actions: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Small Business Administration

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Administrator of the Small Business Administration take the following action: Conduct and document a privacy impact assessment that evaluates potential privacy risks associated with agency use of social media services and identifies protections to address them.

Social Security Administration

To ensure that appropriate privacy measures are in place when commercially provided social media services are used, we recommend that the Commissioner of the Social Security Administration take the following action: Update privacy policies to describe whether PII made available through use of social media services is collected and used.

U.S. Agency for International Development

To ensure that appropriate records management and security measures are in place when commercially provided social media services are used, we recommend that the Administrator of the U.S. Agency for International Development take the following two actions: Add records management guidance to agency social media policies that describes records management processes and policies and recordkeeping roles and responsibilities.

Conduct and document a security risk assessment to assess security threats associated with agency use of commercially provided social media services and identify security controls that can be used to mitigate the identified threats.

Appendix III: Comments from the National Archives and Records Administration

Appendix IV: Comments from the Department of Commerce

The following are GAO’s comments to the U.S. Department of Commerce’s letter dated May 27, 2011.

GAO Comments

1. The department did not provide documentation demonstrating that it had completed and documented any of the required risk assessments.

Appendix V: Comments from the U.S. Department of Agriculture

The following are GAO’s comments to the U.S. Department of Agriculture’s letter dated May 27, 2011.

GAO Comments

1. After reviewing additional documentation and comments provided by department representatives, we updated our report to indicate that the department asserted that it is taking actions to develop records management guidance for social media use, although it has not yet been completed. We have not evaluated these actions. 2. After reviewing the updated privacy policy on the Department’s Web site, we agree that the agency has met the requirement, and we have modified table 2 in the final report to reflect that the department has updated its policy. 3. We believe that a PIA is required. As indicated in our report, OMB’s guidance states that when an agency takes action that causes PII to become accessible to agency officials—such as posting information on a Facebook page that allows the public to comment—PIAs are required. Without a PIA, the department may lack assurance that all potential privacy risks have been evaluated and that protections have been identified to mitigate them.

Appendix VI: Comments from the Department of State

The following are GAO’s comments to the Department of State’s letter dated May 31, 2011.

GAO Comments

1. After reviewing additional comments provided by department representatives, we updated our report to indicate that the department has plans to develop a PIA for its use of YouTube and Twitter. 2. We believe that conducting and documenting a risk assessment is necessary. Although limiting the type of information that is processed on third-party systems can be an effective mitigating security control, without conducting and documenting a risk assessment, agency officials cannot ensure that appropriate controls and mitigation measures are in place to address potentially heightened threats associated with social media, including spear phishing and social engineering.

Appendix VII: Comments from the General Services Administration

The following are GAO’s comments to the General Services Administration’s letter dated June 3, 2011.

GAO Comments

Appendix VIII: Comments from the Department of Defense

The following are GAO’s comments to the Department of Defense’s letter dated May 27, 2011.

GAO Comments

1. We updated our report to indicate that the department asserted that it is taking actions to develop a PIA for its social media use, although it has not yet been finalized. We have not evaluated these actions. 2. After reviewing the additional documentation provided, we agree that the department met the requirement of conducting and documenting a security risk assessment. We modified the report, as appropriate, and removed the recommendation.

Appendix IX: Comments from the Department of Education

The following are GAO’s comments to the Department of Education’s letter dated May 25, 2011.

GAO Comments

1. After reviewing the privacy policy on the department’s Web site, we updated our report to indicate that the department asserted that it is taking actions to develop privacy policies addressing the agency’s use of PII made available through social media services. We confirmed these actions. 2. After reviewing additional efforts stated by the department, we updated our report to indicate that the department asserted that it is taking actions to develop records management guidance for social media use, although such guidance has not yet been finalized. We have not evaluated these actions. 3. After reviewing additional efforts stated by the department, we updated our report to indicate that the department asserted that it is taking actions to conduct and document a PIA related to its use of social media, although it has not yet been finalized. We have not evaluated these actions. 4. After reviewing additional efforts stated by the department, we updated our report to indicate that the department asserted that it is taking actions to conduct and document a security risk assessment related to its use of social media, although the assessment has not yet been finalized. We have not evaluated these actions.

Appendix X: Comments from the Department of Homeland Security

The following are GAO’s comments to the Department of Homeland Security’s letter dated June 6, 2011.

GAO Comments

1. After reviewing additional efforts stated by the department, we updated our report to indicate that the department asserted that it is taking actions to conduct and document a security risk assessment related to its use of social media, although the assessment has not yet been finalized. We have not evaluated these actions.

Appendix XI: Comments from the Department of Housing and Urban Development

The following are GAO’s comments to the Department of Housing and Urban Development’s letter dated May 27, 2011.

GAO Comments

1. After reviewing the additional documentation provided, we updated our report to indicate that the department asserted that it is taking actions to conduct and document a security risk assessment related to its use of social media. We confirmed these actions.

Appendix XII: Comments from the Department of Veterans Affairs

The following are GAO’s comments to the Department of Veterans Affairs’ letter dated May 31, 2011.

GAO Comments

1. After reviewing additional comments provided by department representatives, we updated our report to indicate that the department asserted that it is taking actions to develop records management guidance for social media use, although the guidance has not yet been finalized. We have not evaluated these actions. 2. After reviewing additional comments provided by department representatives, we updated our report to indicate that the department asserted that it is taking actions to develop a PIA for its social media use, although the PIA has not yet been finalized. We have not evaluated these actions.

Appendix XIII: Comments from the Environmental Protection Agency

The following are GAO’s comments to the Environmental Protection Agency’s letter dated May 25, 2011.

GAO Comments

1. After reviewing additional comments provided by agency representatives, we updated our report to indicate that the agency asserted that it is taking actions to develop a PIA for its social media use, although the PIA has not yet been finalized. We have not evaluated these actions. 2. After reviewing additional comments provided by agency representatives, we updated our report to indicate that the agency asserted taking actions to develop a security risk assessment for social media use, although the assessment has not yet been finalized. We have not evaluated these actions.

Appendix XIV: Comments from the National Aeronautics and Space Administration

The following are GAO’s comments to the National Aeronautics and Space Administration’s letter dated May 31, 2011.

GAO Comments

1. After reviewing additional efforts stated by the agency, we updated our report to indicate that the agency has plans to develop privacy policies addressing the agency’s use of PII made available through social media services. 2. After reviewing additional comments provided by agency representatives, we updated our report to indicate that the agency asserted that it is taking actions to develop a PIA for its social media use, although the PIA has not yet been finalized. We have not evaluated these actions. 3. After reviewing additional comments provided by agency representatives, we updated our report to indicate that the agency asserted that it is taking actions to develop a security risk assessment for social media use, although the assessment has not yet been finalized. We have not evaluated these actions.

Appendix XV: Comments from the Office of Personnel Management

The following are GAO’s comments to the Office of Personnel Management’s letter dated May 24, 2011.

GAO Comments

1. After reviewing additional comments and materials provided by agency representatives, we updated our report to indicate that the agency asserted that it is taking actions to develop both a PIA and a security risk assessment for its social media use. We have not evaluated these actions.

Appendix XVI: Comments from the Social Security Administration

The following are GAO’s comments to the Social Security Administration’s letter dated May 26, 2011.

GAO Comments

1. After reviewing additional comments stated by the agency, we updated our report to indicate that the agency has plans to develop privacy policies addressing the agency’s use of PII made available through social media services.

Appendix XVII: Comments from the U.S. Agency for International Development

The following are GAO’s comments to the U.S. Agency for International Development’s letter received on May 27, 2011.

GAO Comments

1. After reviewing additional comments provided by agency representatives, we updated our report to indicate that the agency asserted that it is taking actions to develop records management guidance for social media use. We have not evaluated these actions. 2. After reviewing additional comments provided by agency representatives, we updated our report to indicate that the agency asserted that it is taking actions to develop a security risk assessment for social media use, although the assessment has not yet been finalized. We have not evaluated these actions.

Appendix XVIII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact above, John de Ferrari, Assistant Director; Sher`rie Bacon; Marisol Cruz; Jennifer Franks; Fatima Jahan; Nicole Jarvis; Nick Marinos; Lee McCracken; Thomas Murphy; Constantine Papanastasiou; David Plocher; Dana Pon; Matthew Strain; and Jeffrey Woodward made key contributions to this report.