The Freedom of Information Act establishes a legal right of access to government information on the basis of the principles of openness and accountability in government. Before FOIA’s enactment in 1966, an individual seeking access to federal records faced the burden of establishing a “need to know” before being granted the right to examine a federal record. FOIA established a “right to know” standard, under which an organization or person could receive access to information held by a federal agency without demonstrating a need or reason. The “right to know” standard shifted the burden of proof from the individual to a government agency and required the agency to provide proper justification when denying a request for access to a record. Any person, defined broadly to include attorneys filing on behalf of an individual, corporations, or organizations, can file a FOIA request. For example, an attorney can request labor-related workers’ compensation files on behalf of his or her client, and a commercial requester, such as a data broker who files a request on behalf of another person, may request a copy of a government contract. In response, an agency is required to provide the relevant record(s) in any readily producible form or format specified by the requester, unless the record falls within a permitted exemption that provides limitations on the disclosure of information. Various amendments have been enacted and guidance issued to help improve agencies’ processing of FOIA requests. For example: The Electronic Freedom of Information Act Amendments of 1996 (1996 FOIA amendment) strengthened the requirement that federal agencies respond to a request in a timely manner and reduce their backlogged requests. Executive Order 13392, issued by the President in 2005, directed each agency to designate a senior official as its chief FOIA officer. This official was to be responsible for ensuring agency-wide compliance with the act. The chief FOIA officer was directed to review and report on the agency’s performance in chief FOIA officer reports. The OPEN Government Act, which was enacted in 2007 (2007 FOIA amendment), made the 2005 executive order’s requirement for agencies to have a chief FOIA officer a statutory requirement. It also required agencies to include additional statistics, such as more details on processing times, in their annual FOIA reports. The FOIA Improvement Act of 2016 (2016 FOIA amendment) addressed procedural issues, including requiring that agencies (1) make records available in an electronic format if they have been requested three or more times; (2) notify requesters that they have not less than 90 days to file an administrative appeal, and (3) provide dispute resolution services at various times throughout the FOIA process. Further, the act required OMB, in consultation with the Department of Justice, to create a consolidated online FOIA request portal that allows the public to submit a request to any agency through a single website. The 1996 FOIA amendment required agencies, including DHS, to generally respond to a FOIA request within 20 working days. Once received, the request is to be processed through multiple phases, which include assigning a tracking number, searching for responsive records, and releasing the records to the requester. In responding to requests, FOIA authorizes agencies to use nine exemptions to withhold portions of records, or the entire record. These nine exemptions can be applied by agencies to withhold various types of information, such as information concerning foreign relations, trade secrets, and matters of personal privacy. FOIA allows a requester to challenge an agency’s final decision on a request through an administrative appeal or a lawsuit. Agencies generally have 20 working days to respond to an administrative appeal. Created in 2003, DHS assumed control of about 209,000 civilian and military positions from 22 agencies and offices that specialize in one or more aspects of homeland security. By the nature of its mission and operations, the department creates and has responsibility for vast and varied amounts of information covering, for example, immigration, border crossings, law enforcement, natural disasters, maritime accidents, and agency management. According to its 2018 Chief FOIA Officer Report, DHS’s organizational structure consists of 24 offices, directorates, and components. FOIA requests are split between the department’s Privacy Office, which acts as its central FOIA office, and FOIA offices in the department’s component agencies. Three of the major operational components of DHS are: U.S. Citizenship and Immigration Services (USCIS) promotes an awareness and understanding of citizenship, and ensures the integrity of the nation’s immigration system. Its records include asylum application files and other immigration-related documents. Customs and Border Protection (CBP) secures the border against transnational threats and facilitates trade and travel through the enforcement of federal laws and regulations relating to immigration, drug enforcement, and other matters. The agency maintains records related to agency operations, activities, and interactions. Immigration and Customs Enforcement (ICE) promotes homeland security and public safety through the criminal and civil enforcement of federal laws governing border control, customs, trade, and immigration. It maintains information related to the law enforcement records of immigrants and detainees, as well as information pertaining to human trafficking/smuggling, gangs, and arrest reports. According to its 2018 Chief FOIA Officer Report, DHS and its component agencies reported that they processed 374,945 FOIA requests in fiscal year 2018—the most of any federal government agency. As of its 2018 report, the department had a backlog of 53,971 unprocessed requests— the largest backlog of any federal agency. Amendments and guidance relating to FOIA call for agencies, including DHS, to implement key requirements aimed at improving the processing of requests. Among others, these requirements call for agencies to (1) update response letters, (2) implement tracking systems, (3) provide FOIA training, (4) provide records online, (5) designate chief FOIA officers, and (6) update and publish timely and comprehensive regulations. As we noted in our June 2018 report, DHS had implemented these six FOIA requirements. Update response letters: The FOIA amendments require that certain information be included in agency response letters. For example, if part of a FOIA request is denied, agencies are required to inform requesters that they may seek assistance from the FOIA public liaison of the agency or the National Archives and Records Administration’s Office of Government Information Services (OGIS); file an appeal to an adverse determination within a period of time that is not less than 90 days after the date of such adverse determination; and seek dispute resolution services from the FOIA public liaison of the agency or OGIS. DHS had updated its FOIA response letters to include this specific information, as required per the amendments. Implement tracking systems: DHS used commercial automated systems, as called for by various FOIA amendments and guidance, and had established telephone or internet services to assist requesters in tracking the status of a request. The department used modern technology (e.g., mobile applications) to inform citizens about FOIA. The commercial systems allowed requesters to submit a request and track the status of that request online. In addition, DHS developed a mobile application that allowed FOIA requesters to submit a request and check its status. The department’s FOIA tracking systems were compliant with requirements of Section 508 of the Rehabilitation Act of 1973 (as amended), which required federal agencies to make their electronic information accessible to people with disabilities. Provide FOIA training: DHS’ chief FOIA officer offered FOIA training opportunities to staff in fiscal years 2016 and 2017, as required by the 2016 FOIA amendments. Specifically, the department provided training in responding to, handling, and processing FOIA requests. Provide records online: DHS posted records online for three categories of information, agency final opinions and orders, statements of policy, and frequently requested orders as required by 2009 memorandums from both the President and the Attorney General. Designate chief FOIA officers: DHS designated its Chief Privacy Officer as its Chief FOIA Officer. This position was a senior official at the assistant secretary or equivalent level, as required by a 2005 executive order and the 2007 FOIA amendments. Update and publish timely and comprehensive regulations: Guidance from the Department of Justice Office of Information Policy (OIP) encourages agencies to, among other things, describe their dispute resolution process; describe their administrative appeals process; notify requesters that they have a minimum of 90 days to file an administrative appeal; include a description of unusual circumstances and restrictions on an agency’s ability to charge certain fees when FOIA’s times limits are not met; and update agency regulations in a timely manner (i.e., update regulations by 180 days after the enactment of the 2016 FOIA amendment). DHS had addressed these five requirements in updating its regulations, as called for in the 2016 FOIA amendment and in related OIP guidance. The Attorney General’s March 2009 memorandum called on agency chief FOIA officers to review all aspects of their agencies’ FOIA administration and report to Justice on steps that have been taken to improve FOIA operations and disclosure. Subsequent Justice guidance directed agencies that had more than 1,000 backlogged requests in a given year to describe their plans to reduce their backlogs. Beginning in calendar year 2015, these agencies were to describe how they had implemented their plans from the previous year and whether that had resulted in a backlog reduction. In June 2018, we reported that DHS received about 191,000 to about 326,000 requests per year—the most requests of any agency—for a total of 1,320,283 FOIA requests in fiscal years 2012 through 2016. Further, the department had a backlog ranging from 28,553 in fiscal year 2012 to 53,971 in fiscal year 2018. The total numbers of these requests and backlogs are shown in table 1. We also reported that DHS, in its chief FOIA officer reports from fiscal years 2012 to 2016, stated that it had implemented several methods to reduce backlogs. According to the reports, the DHS Privacy Office, which is responsible for oversight of the department’s FOIA program, worked with components to help address the backlogs. The reports noted that the Privacy Office sent monthly emails to component FOIA officers on FOIA backlog statistics, convened management meetings, conducted oversight, and reviewed workloads. Leadership met weekly to discuss the oldest pending requests, appeals, and consultations, and determined steps needed to process those requests. In addition, in 2018, we noted that several other DHS components reported implementing actions to reduce backlogs. CBP hired and trained additional staff, encouraged requesters to file requests online, established productivity goals, updated guidance, and used better technology. USCIS, the National Protection and Programs Directorate, and ICE increased staffing or developed methods to better forecast future workloads to ensure adequate staffing. ICE also implemented a commercial off-the-shelf web application, awarded a multimillion-dollar contract for backlog reduction, and detailed employees from various other offices to assist in the backlog reduction effort. Due to these efforts by the Privacy Office and other components, the backlog dropped 66 percent in fiscal year 2015, decreasing to 35,374 requests. Yet, despite the continued efforts, the backlog numbers increased again. According the 2018 Chief FOIA Officer’s report, the department ended 2018 with a backlog of 53,971 requests. DHS attributed these increases to several factors, including an increase in the number of requests received, the increased complexity and volume of responsive records for those requests, and the loss of staff needed to process the requests. In June 2018, we reported that one reason DHS was struggling to consistently reduce its backlogs is that it lacked documented, comprehensive plans that would provide a more reliable, sustainable approach to addressing backlogs. In particular, it did not have documented plans that described how it intended to implement best practices for reducing backlogs over time. These best practices, as identified by Justice’s OIP, included specifying how DHS would use metrics to assess the effectiveness of backlog reduction efforts and ensuring that senior leadership supports backlog reduction efforts. In our June 2018 report, we recommended that the department take steps to develop and document a plan that fully addresses best practices with regard to the reduction of backlogged FOIA requests. In response, DHS reported that it had initiated a department-wide compliance assessment and stated that it planned to use the results of the assessment to help guide it in identifying best practices and areas of improvement. As of this month (October 2019), the department stated that the draft plan is currently with the components for review and is pending clearance. Until it has a final plan that fully addresses best practices, DHS will likely continue to struggle to reduce its backlogs to a manageable level. This is particularly important, as the number and complexity of requests will likely increase over time. Among the most frequent FOIA requests made to DHS are those for immigration files. These files usually contain various types of information pertaining to immigrants, including asylum applications, law enforcement records, and border crossing documents. As such, they may contain information and records that are generated by various DHS components or other agencies. In 2014, we reported that within DHS, three components—USCIS, CBP, and ICE—created most of the documents included in immigration files. USCIS was the custodian of the files, and all FOIA requests for such files were either initiated with, or referred to, USCIS for processing. Specifically, to process a FOIA request for an immigration file, the USCIS staff to whom the request was assigned first manually entered the requester’s data, such as a name and address, into USCIS’s FOIA system to establish a record of the request. Next, the staff retrieved and scanned the documents in the requested file and reviewed the documents. If all of the documents were generated by USCIS, the staff made redactions as needed, sent the documents to the requester, and closed out the request. Further, if the FOIA request covered files containing documents generated by CBP, then USCIS was able to process the request on the basis of an agreement to that effect with CBP. By having USCIS process such requests for CBP documents, the two components avoided duplication in their response to a FOIA request. In November 2014, however, we reported that USCIS and ICE did not have such an agreement for documents generated by ICE. Thus, the USCIS staff was to identify any such documents and make them available to ICE’s FOIA staff for their separate processing. In doing so, we noted that USCIS and ICE engaged in duplicative processing of FOIA requests for those immigration files containing documents related to law enforcement activities that were generated by ICE. Specifically, to facilitate ICE’s review of such files, USCIS staff transferred copies of the ICE-generated documents to a temporary electronic storage drive maintained by USCIS. ICE retrieved the documents, and the ICE staff then re-entered the data to create a new FOIA request in ICE’s FOIA processing system. The staff then proceeded with processing the requested documents, and released them to the requester—in essence, undertaking a new, and duplicate, effort to respond to the FOIA request. Figure 1 depicts the duplication that occurred in USCIS’s and ICE’s downloading and re-entering of data to respond to FOIA requests for immigration files. We noted that, up until April 2012, USCIS and ICE had an agreement whereby USCIS processed ICE’s documents contained in an immigration file. However, the components’ officials stated that, since that agreement ended, the components had not made plans to enter into another such agreement. According to ICE’s FOIA Officer, USCIS’s processing of ICE’s documents in immigration files was viewed as being too costly. Nonetheless, while there would be costs associated with USCIS processing ICE’s documents in immigration files, the potential existed for additional costs to be incurred in the continued duplicate processing of such files. Our work has noted that duplication exists when two or more agencies or programs are engaged in the same activities or provide the same services to the same beneficiaries. We concluded that the duplicate processing of a single FOIA request by USCIS and ICE staff contributed to an increase in the time needed to respond to a FOIA request for immigration files. Because USCIS did not send the immigration file to ICE until it had completed its own processing of the relevant documents— which, according to USCIS, took on average 20 working days—ICE usually did not receive the file to begin its own processing until the 20-day time frame for responding to a request had passed. We pointed out that re-establishing an agreement that allows USCIS to process ICE-generated documents included in requests for immigration files, to the extent that the benefits of doing so would exceed the cost, could enable the two components to eliminate duplication in their processes for responding to such a request. Further, it could help reduce the time needed by these components in responding to a request. Therefore, in November 2014, we recommended that DHS direct the Chief FOIA Officer to determine the viability of re-establishing the service- level agreement between USCIS and ICE to eliminate duplication in the processing of immigration files. We stressed that, if the benefits of doing so would exceed the costs, DHS should re-establish the agreement. We also reported on our finding and recommendation regarding duplicate processing in our reports and updates on fragmentation, overlap, and duplication, issued in 2015 through 2019. In response, DHS indicated that it was working on a system intended to address the duplication. Specifically, in August 2018, DHS’s Privacy Office Director of Correspondence/Executive Secretary stated that the Privacy Office was leading a working group in collaboration with the Office of the Chief Information Officer to develop requirements for a single information technology solution for processing incoming FOIA requests. The director added that DHS used three disparate systems to track, manage, and process FOIA requests and that moving USCIS and ICE to one processing solution should result in processing benefits and lower overall administrative costs. We continue to track DHS’s progress in implementing this recommendation. However, as of October 2019, DHS’s Privacy Office stated that these actions were still in progress. In conclusion, DHS has implemented a number of key FOIA practices. However, it does not have a comprehensive plan to address its FOIA backlog, nor has it yet addressed duplication in its FOIA process. Addressing both of these issues is important, as the number and complexity of requests will likely increase over time and DHS may be challenged in effectively responding to the needs of requesters and the public. Chairwoman Torres Small, Ranking Member Crenshaw, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have. If you or your staffs have any questions about this testimony, please contact Vijay A. D’Souza, Director, Information Technology and Cybersecurity, at (202) 512-6240 or dsouzav@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony statement. GAO staff who made key contributions to this testimony include Neela Lakhmani and Anjalique Lawrence (assistant directors), Kara Epperson, Christopher Businsky, Nancy Glover, and Scott Pettis. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: FOIA requires federal agencies to provide the public with access to government records and information based on the principles of openness and accountability in government. Each year, individuals and entities file hundreds of thousands of FOIA requests. DHS continues to receive and process the largest number of FOIA requests of any federal department or agency. For fiscal year 2018, over 40 percent of federal FOIA requests (about 396,000) belonged to DHS. GAO was asked to summarize its November 2014 and June 2018 reports which addressed, among other things, (1) DHS's methods to reduce backlogged FOIA requests and (2) duplication in DHS's processing of FOIA requests. In conducting this prior work, GAO evaluated the department's and components' FOIA policies, procedures, reports, and other documentation; and interviewed agency officials. GAO also followed up on its recommendations to determine their implementation status. The Department of Homeland Security's (DHS) responsibilities for processing Freedom of Information Act (FOIA) requests are split between the department's Privacy Office, which acts as its central FOIA office, and FOIA offices in the department's component agencies, such as U.S. Citizenship and Immigration Services and Immigration and Customs Enforcement. In 2018, GAO reported that DHS had implemented several methods to reduce backlogged FOIA requests, including sending monthly emails to its components on backlog statistics and conducting oversight. In addition, several DHS components, implemented actions to reduce their backlogs. Due to efforts by the department, the backlog dropped 66 percent in fiscal year 2015, decreasing to 35,374 requests. Although there was initial progress by the end of fiscal year 2015, the number of backlogged requests increased in fiscal years 2016 and 2018 (see figure). One reason DHS was struggling to consistently reduce its backlogs is that it lacked documented, comprehensive plans that would provide a more reliable, sustainable approach to addressing backlogs and describe how it will implement best practices for reducing backlogs over time. DHS attributed the increase in its FOIA backlogs to several factors, including the increased numbers and complexity of requests received and the volume of responsive records for those requests. Until it develops a plan to implement best practices to reduce its backlogs, DHS will likely continue to struggle to reduce the backlogs to a manageable level. In addition, in 2014 GAO reported that certain immigration-related requests were processed twice by two different DHS components. The duplicate processing of such requests by the two components contributed to an increase in the time needed to respond to the requests. GAO continued to report this issue in its 2019 annual product on opportunities to reduce fragmentation, overlap, and duplication. In its prior reports, GAO made five recommendations to DHS. These included, among other things, that DHS (1) take steps to develop and document a plan that fully addressed best practices with regard to reducing the number of backlogged FOIA requests and (2) eliminate duplicative processing of immigration-related requests. The department agreed with the recommendations. However, as of October 2019, DHS had not fully implemented all of them.