FOIA establishes a legal right of access to government records and information on the basis of the principles of openness and accountability in government. Before the act (originally enacted in 1966), an individual seeking access to federal records had faced the burden of establishing a right to examine them. FOIA established a “right to know” standard for access, instead of a “need to know” standard, and shifted the burden of proof from the individual to the government agency seeking to deny access. FOIA provides the public with access to government information either through “affirmative agency disclosure”—publishing information in the Federal Register or on the Internet or making it available in reading rooms—or in response to public requests for disclosure. Public requests for disclosure of records are the best known type of FOIA disclosure. Any member of the public may request access to information held by federal agencies without showing a need or reason for seeking the information. Not all information held by the government is subject to FOIA. The act prescribes nine specific categories of information that are exempt from disclosure: for example, trade secrets and certain privileged commercial or financial information, certain personnel and medical files, and certain law enforcement records or information (see app. II for a complete list). In denying access to material, agencies may cite these exemptions. The act requires agencies to notify requesters of the reasons for any adverse determination (that is, a determination not to provide records) and grants requesters the right to appeal agency decisions to deny access. In addition, agencies are required to meet certain time frames for making key determinations: whether to comply with requests (20 business days from receipt of the request); responses to appeals of adverse determinations (20 business days from filing of the appeal); and whether to provide expedited processing of requests (10 calendar days from receipt of the request). The Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. Although the specific details of processes for handling FOIA requests vary among agencies, the major steps in handling a request are similar across the government. Agencies receive requests, usually in writing (although they may accept requests by telephone or electronically), which can come from any organization or member of the public. Once received, the request goes through several phases, which include initial processing, searching for and retrieving responsive records, preparing responsive records for release, approving the release of the records, and releasing the records to the requester. Figure 1 is an overview of the process, from the receipt of a request to the release of records. During the initial processing phase, a request is logged into the agency’s FOIA system, and a case file is started. The request is then reviewed to determine its scope, estimate fees, and provide an initial response to the requester (in general, this simply acknowledges receipt of the request). After this point, the FOIA staff begins its search to retrieve responsive records. This step may include searching for records from multiple locations and program offices. After potentially responsive records are located, the documents are reviewed to ensure that they are within the scope of the request. During the next two phases, the agency ensures that appropriate information is to be released under the provisions of the act. First, the agency reviews the responsive records to make any redactions based on the statutory exemptions. Once the exemption review is complete, the final set of responsive records is turned over to the FOIA office, which calculates appropriate fees, if applicable. Before release, the redacted responsive records are given a final review, possibly by the agency’s general counsel, and then a response letter is generated, summarizing the agency’s actions regarding the request. Finally, the responsive records are released to the requester. Some requests are relatively simple to process, such as requests for specific pieces of information that the requester sends directly to the appropriate office. Other requests may require more extensive processing, depending on their complexity, the volume of information involved, the requirement for the agency FOIA office to work with offices that have relevant subject-matter expertise to find and obtain information, the requirement for a FOIA officer to review and redact information in the responsive material, the requirement to communicate with the requester about the scope of the request, and the requirement to communicate with the requester about the fees that will be charged for fulfilling the request (or whether fees will be waived). Specific details of agency processes for handling requests vary, depending on the agency’s organizational structure and the complexity of the requests received. While some agencies centralize processing in one main office, other agencies have separate FOIA offices for each agency component and field office. Agencies also vary in how they allow requests to be made. Depending on the agency, requesters can submit requests by telephone, fax, letter, or e-mail or through the Internet. In addition, agencies may process requests in two ways, known as “multitrack” and “single track.” Multitrack processing involves dividing requests into two groups: (1) simple requests requiring relatively minimal review, which are placed in one processing track, and (2) more voluminous and complex requests, which are placed in another track. In contrast, single-track processing does not distinguish between simple and complex requests. With single-track processing, agencies process all requests on a “first-in, first-out” basis. Agencies can also process FOIA requests on an expedited basis when a requester has shown a compelling need for the information. As agencies process FOIA requests, they generally place them in one of four possible disposition categories: grants, partial grants, denials, and “not disclosed for other reasons.” These categories are defined as follows: Grants: Agency decisions to disclose all requested records in full. Partial grants: Agency decisions to withhold some records, in whole or in part, because such information was determined to fall within one or more exemptions. Denials: Agency decisions not to release any part of the requested records because all information in the records is determined to be exempt under one or more statutory exemptions. Not disclosed for other reasons: Agency decisions not to release requested information for any of a variety of reasons other than statutory exemptions. The categories and definitions of these “other” reasons for nondisclosure are shown in table 1. When a FOIA request is denied in full or in part or the requested records are not disclosed for other reasons, the requester is entitled to be told the reason for the denial, to appeal the denial, and to challenge it in court. In addition to FOIA, the Privacy Act of 1974 includes provisions granting individuals the right to gain access to and correct information about themselves held by federal agencies. Thus, the Privacy Act serves as a second major legal basis, in addition to FOIA, for the public to use in obtaining government information. The Privacy Act also places limitations on agencies’ collection, disclosure, and use of personal information. Although the two laws differ in scope, procedures in both FOIA and the Privacy Act permit individuals to seek access to records about themselves—known as “first-party” access. Depending on the individual circumstances, one law may allow broader access or more extensive procedural rights than the other, or access may be denied under one act and allowed under the other. Consequently, Justice’s Office of Information and Privacy issued guidance that it is “good policy for agencies to treat all first-party access requests as FOIA requests (as well as possibly Privacy Act requests), regardless of whether the FOIA is cited in a requester’s letter.” This guidance was intended to help ensure that requesters receive the fullest possible response to their inquiries, regardless of which law they cite. In addition, Justice guidance for the annual FOIA report directs agencies to include Privacy Act requests (that is, first-party requests) in the statistics reported. According to the guidance, “A Privacy Act request is a request for records concerning oneself; such requests are also treated as FOIA requests. (All requests for access to records, regardless of which law is cited by the requester, are included in this report.)” Although both FOIA and the Privacy Act can apply to first-party requests, these may not always be processed in the same way as described earlier for FOIA requests. In some cases, little review and redaction (see fig. 1) is required: for example, for a request for one’s own Social Security benefits records. In contrast, various degrees of review and redaction could be required for other types of first-party requests: for example, files on security background checks would require review and redaction before being provided to the person who was the subject of the investigation. Both OMB and the Department of Justice have roles in the implementation of FOIA. Under various statutes, including the Paperwork Reduction Act, OMB exercises broad authority for coordinating and administering various aspects of governmentwide information policy. FOIA specifically requires OMB to issue guidelines to “provide for a uniform schedule of fees for all agencies.” OMB issued this guidance in April 1987. The Department of Justice oversees agencies’ compliance with FOIA and is the primary source of policy guidance for agencies. Specifically, Justice’s requirements under the act are to make agencies’ annual FOIA reports available through a single electronic access point and notify the Congress as to their availability; in consultation with OMB, develop guidelines for the required annual agency reports; and submit an annual report on FOIA litigation and the efforts undertaken by Justice to encourage agency compliance. Within the Department of Justice, the Office of Information and Privacy has lead responsibility for providing guidance and support to federal agencies on FOIA issues. This office first issued guidelines for agency preparation and submission of annual reports in the spring of 1997. It also periodically issues additional guidance on annual reports and on compliance, provides training, and maintains a counselor service to provide expert, one-on-one assistance to agency FOIA staff. Further, the Office of Information and Privacy makes a variety of FOIA and Privacy Act resources available to agencies and the public via the Justice Web site and online bulletins (available at www.usdoj.gov/oip/index.html). In 1996, the Congress amended FOIA to provide for public access to information in an electronic format (among other purposes). These amendments, referred to as e-FOIA, also required that agencies submit a report to the Attorney General on or before February 1 of each year that covers the preceding fiscal year and includes information about agencies’ FOIA operations. The following are examples of information that is to be included in these reports: number of requests received, processed, and pending at the end of the median number of days taken by the agency to process different types of number of determinations made by the agency not to disclose information and the reasons for not disclosing the information; disposition of administrative appeals by requesters; information on the costs associated with handling of FOIA requests; and full-time-equivalent staffing information. In addition to providing their annual reports to the Attorney General, agencies are to make them available to the public in electronic form. The Attorney General is required to make all agency reports available online at a single electronic access point and report to the Congress no later than April 1 of each year that these reports are available in electronic form. (This electronic access point is www.usdoj.gov/oip/04_6.html.) On December 14, 2005, the President issued Executive Order 13392, setting forth a policy of citizen-centered and results-oriented FOIA administration. Briefly, according to this policy, FOIA requesters are to receive courteous and appropriate services, including ways to learn about the status of their requests and the agency’s response, and agencies are to provide ways for requesters and the public to learn about the FOIA process and publicly available agency records (such as those on Web sites). In addition, agency FOIA operations are to be results-oriented: that is, agencies are to process requests efficiently, achieve measurable improvements in FOIA processing (including reducing backlog of overdue requests), and reform programs that do not produce appropriate results. To carry out this policy, the order required, among other things, that agency heads designate Chief FOIA Officers to oversee their FOIA programs. The Chief FOIA Officers were directed to conduct reviews of the agencies’ FOIA operations and develop improvement plans to ensure that FOIA administration was in accordance with applicable law, as well as with the policy set forth in the order. By June 2006, agencies were to submit reports that included the results of their reviews and copies of their improvement plans. A major focus of the order was for agency plans to include specific activities that the agency would implement to eliminate or reduce any FOIA backlog of overdue requests: that is, requests for records that have not been responded to within the statutory time limit. Note that this backlog of overdue requests is distinct from the pending cases reported in the annual reports (those FOIA cases open at the end of the reporting period). For the annual reports, agencies are required by the statute to provide a count of FOIA requests that are still pending (that is, not yet closed) at the end of the reporting period. In response to this annual report requirement, agency tracking systems and processes have been geared to providing statistics on pending requests. Pending cases totals would generally be larger than backlog, as the term is used in the Executive Order, since they would include any requests received within the last 20 to 30 working days of the reporting period, which would not be overdue. The order also instructed the Attorney General to issue guidance on implementation of the order’s requirements for agencies to conduct reviews and develop plans. In addition, the order instructed agencies to report on their progress in implementing their plans and meeting milestones as part of their annual reports for fiscal years 2006 and 2007; agencies were instructed to account in the annual report for any milestones missed and also to report them to the President’s Management Council. In April 2006, the Department of Justice posted guidance on implementation of the order’s requirements for FOIA reviews and improvement plans. This guidance suggested a number of areas of FOIA administration that agencies might consider when conducting their reviews and developing improvement plans. (Examples of some of these areas are automated tracking capabilities, automated processing, receiving/responding to requests electronically, forms of communication with requesters, and systems for handling referrals to other agencies.) To encourage consistency, the guidance also included a template for agencies to use to structure their plans and to report on their reviews and plans. The order’s emphasis on backlog provided an incentive for agencies to focus on reducing overdue requests. With respect to backlog reduction, the guidance stated that agencies were not limited to time horizons in fiscal years 2006 and 2007 only. According to the guidance, if an agency believed that reform could enable it to process requests in a more efficient manner, thereby reducing its backlog, the agency should consider implementing these measures even though they might result in a short- term increase in backlog, as long as it was confident of a long-term benefit. At the same time, the guidance advised agencies to consider what they might do to counterbalance any anticipated short-term effect through other means of backlog reduction. Also included in this guidance was supplemental information on preparing the annual FOIA reports for fiscal years 2006 and 2007. According to the guidance, the annual reports for fiscal years 2006 and 2007 were to include an additional section on agencies’ progress in implementing their plans to improve their FOIA activities. The guidance provided a template for reporting progress and stated that, for the fiscal year 2006 report (due February 1, 2007), agencies should be able to report on progress for at least 7 months (i.e., from no later than June 14, 2006, to late January 2007). The improvement plans are posted on the Department of Justice Web site at www.usdoj.gov/oip/agency_improvement.html. In June 2007, the Attorney General submitted a report to the President on the progress that agencies made in the first months of implementing their FOIA improvement plans, as reported in the fiscal year 2006 annual reports of all 92 federal departments and agencies. The report provided an overall assessment of progress followed by a more detailed discussion of agency activities. According to this assessment, agencies made measurable progress in implementing the Executive Order during the first reporting period (about 7 months of activity under the FOIA improvement plans), with more than half the agencies (54) reporting successes in achieving all their milestones and goals on time. Discussing 25 key agencies, the report stated that 22 reported meaningful progress in FOIA administration, with 11 achieving all milestones on time; however, 3 reported one or more milestones for which they failed to achieve progress. The report also discussed areas where agencies reported deficiencies in meeting their early milestones or goals, and it made recommendations for improving FOIA implementation. In addition, it presented progress charts for the 25 key agencies showing whether they had achieved their planned goals and milestones. Also in June 2007, the Department of Justice posted guidance on providing updated status reports to the President’s Management Council. These status reports were required by August 1, 2007, from agencies who reported deficiencies in meeting the goals in their fiscal year 2006 annual FOIA reports. According to this guidance, such agencies were to report on their progress toward completing the corrective steps described in their annual reports. In the updated status reports, agencies were instructed to account for any missed milestone by identifying it and outlining the steps taken and to be taken to address the deficiency. In September 2007, the Department of Justice posted guidance to agencies on submitting backlog reduction goals for fiscal years 2008, 2009, and 2010. According to the guidance, any agency that had any request or appeal pending beyond the statutory time period at the end of fiscal year 2007 was to establish backlog reduction goals for fiscal years 2008, 2009, and 2010, and was to publish such goals on the agency’s Web site. Those goals were to be expressed in two ways. First, each agency was required to set a goal for the number of requests and the number of appeals that it planned to process during each fiscal year from 2008 through 2010. Second, each agency was required to set a goal for the number of requests and the number of appeals that the agency estimated would be pending beyond the statutory time period (i.e., backlog of overdue requests) at the end of each fiscal year from 2008 through 2010. In October 2007, Justice issued supplemental guidance on the section of the fiscal year 2007 annual FOIA reports in which agencies were to describe progress on their improvement plans and provide certain additional statistics. Among other things, this guidance required agencies to track their 10 oldest pending requests; to track the number of consultations received, processed, and pending; and to report this information in their fiscal year 2007 annual FOIA reports. It also provided templates for the progress reports and additional statistics. In 2001, in response to a congressional request, we prepared the first in a series of reports on the implementation of the 1996 amendments to FOIA, starting from fiscal year 1999. In these reviews, we examined the contents of the annual reports for 25 major agencies (shown in table 2). They include the 24 major agencies covered by the Chief Financial Officers Act, as well as the Central Intelligence Agency and, until 2003, the Federal Emergency Management Agency (FEMA). In 2003, the creation of DHS, which incorporated FEMA, led to a shift in some FOIA requests from agencies affected by the creation of the new department, but the same major component entities were reflected in the 25 agencies. Our previous reports included descriptions of the status of reported FOIA implementation, including any trends revealed by comparison with earlier years. We noted general increases in requests received and processed, as well as growing numbers of pending requests carried over from year to year. In addition, our 2001 report disclosed that data quality issues limited the usefulness of agencies’ annual FOIA reports and that agencies had not provided online access to all the information required by the act as amended in 1996. We therefore recommended that the Attorney General direct the Department of Justice to improve the reliability of data in the agencies’ annual reports by providing guidance addressing the data quality issues we identified and by reviewing agencies’ report data for completeness and consistency. We further recommended that the Attorney General direct the department to enhance the public’s access to government records and information by encouraging agencies to make all required materials available electronically. In response, the Department of Justice issued supplemental guidance, addressed reporting requirements in its training programs, and continued reviewing agencies’ annual reports for data quality. Justice also worked with agencies to improve the quality of data in FOIA annual reports. Most recently, our March 2007 FOIA report discussed the fiscal year 2005 annual report data, as well as the agency improvement plans submitted in response to the Executive Order. Among other things, we observed that agencies showed great variations in the median times to process requests (less than 10 days for some agency components to more than 100 days at others) but that the ability to determine trends in processing times is limited because these times are reported in medians only, without averages (that is, arithmetical means) or ranges. Although medians have the advantage of providing representative numbers that are not skewed by a few outliers, it is not statistically possible to combine several medians to develop broader generalizations (as can be done with arithmetical means). We suggested that to improve the usefulness of the statistics in agency annual FOIA reports, the Congress consider amending the act to require agencies to report additional statistics on processing time, which at a minimum should include average times and ranges. The Openness Promotes Effectiveness in Our National Government Act (OPEN Government Act) of 2007, enacted December 31, 2007, as Public Law 110- 175, included provisions expanding reporting requirements to include average and range information, along with median processing time statistics. Regarding the improvement plans, we reported in 2007 that the 25 agency plans mostly included goals and timetables addressing the areas of improvement emphasized by the Executive Order. We noted that almost all plans contained measurable goals and timetables for avoiding or reducing backlog. Although details of a few plans could be improved, all the plans focused on making measurable improvements and formed a reasonable basis for carrying out the goals of the Executive Order. The data reported by 21 major agencies in annual FOIA reports from 2002 to 2006 reveal a number of general trends. (Data from four agencies are omitted, as discussed below.) Among these trends are increases in requests received, processed, and pending. Specifically, the public continued to submit more requests for information from the federal government through FOIA, and the numbers of requests processed also increased. In addition, the number of pending requests increased because of increases at DHS, which accounted for about half of all pending requests at the end of fiscal year 2006. However, the rate of increase in pending requests was less than in the previous year. Our statistical analysis omits data from the General Services Administration (GSA), and the Departments of Agriculture and Housing and Urban Development (HUD), because we did not have reasonable assurance that the data in their fiscal year 2006 FOIA annual reports were accurate and complete. We also omitted the Central Intelligence Agency, which did not provide information in response to our requests, so we could not assess its data reliability. The other three agencies did not provide evidence of internal controls that would provide reasonable assurance that FOIA data were recorded completely and correctly, or they acknowledged material limitations of the data. The accuracy of annual report data is important so that government FOIA operations can be monitored and understood by the Congress and the public. To provide reasonable assurance of accuracy, agencies rely on internal controls to minimize the risk that data are incomplete or incorrect. Specific examples of such controls include supervisory or other reviews of the quality of data entry, spot checks of selected records, software edit checks of data entered (such as prevention of duplicate entries), and other manual or automatic processes to detect data entry errors. We determined that GSA did not have adequate internal controls to provide reasonable assurance that the data in its fiscal year 2006 annual report were accurate and complete. Although about one-third of GSA FOIA requests were handled by FOIA staff at GSA headquarters, mechanisms had not been established to verify that data were entered correctly into the system that tracked FOIA requests. One staff person was responsible for entering data, but the data were not checked periodically to ensure that they were correct. Agency officials told us that errors could be caught if, for example, the GSA program office responding to a request observed a discrepancy when the request letter was transmitted to the program office. However, they acknowledged that for the fiscal year 2006 annual report, the FOIA office did not perform regular reviews or spot checks of the data to check for errors. Since the 2006 annual report was prepared, GSA has increased the staff at the headquarters FOIA office, and it has changed its approach to FOIA tracking by implementing a centralized tracking system for requests handled both by headquarters and by the GSA regional offices. According to officials, the centralized tracking system provides the agency with additional controls, but GSA had not established procedures for checks to ensure that information on requests was entered correctly at all stages. Until the agency establishes checks of data entered or other internal controls, such as periodic reviews, it will have reduced assurance that data are captured completely and accurately. Data from HUD are omitted because HUD officials told us that the fiscal year 2006 annual FOIA report statistics were not accurate. As part of its improvement plan implementation, HUD performed an organizational realignment in which FOIA processing functions were transferred to the Office of the Executive Secretariat. According to the Executive Secretary, after the realignment, the office found that many requests in the department’s FOIA tracking system were incorrectly recorded as open, although they had in fact been closed. According to this official, the department’s regional and field offices had not been consistently closing requests in the system, resulting in inaccuracies. In addition, not all field offices were using the tracking system, but were using spreadsheets and other means of tracking. According to HUD officials, they were taking actions to remedy these problems by working with the field offices to make sure that data were entered correctly and cases closed out properly. Also, in the department’s progress report on its improvement plan, HUD reported that it had selected and was acquiring a new automated FOIA tracking system. According to the department, in December 2007, it began implementing this system and training staff in its use, and all offices (including headquarters) would be required to use it. However, the implementation was not yet complete departmentwide. Further, although the department planned to develop policies and procedures to govern the use of the system, it had not yet done so; if well designed, these policies and procedures could help ensure that all FOIA offices, including regional and field offices, are using the tracking system consistently and that information is entered accurately and promptly. Until the department develops and establishes such policies and procedures, it will be unable to provide annual report data that are accurate and complete. We are also omitting data from the Department of Agriculture. In our March 2007 report on the FOIA annual reports for fiscal year 2005, we omitted data from the department’s annual FOIA report because a major component acknowledged material limitations in its data. Although most Agriculture components expressed confidence in their data, one component did not: the Farm Service Agency, which reportedly processed over 80 percent of the department’s total FOIA requests. According to this agency’s FOIA Officer, portions of the agency’s data in annual reports were not accurate or complete. We recommended that the department revise its FOIA improvement plan to include activities, goals, and milestones to improve data reliability for the Farm Service Agency and to monitor results. Since then, Agriculture has taken actions to improve the reliability of its data, such as issuing guidance and conducting training. The department is also developing an electronic tracking software system that it expects to improve the timeliness, accuracy, depth, and breadth of the department’s FOIA reporting. However, our reliability assessment was performed toward the end of fiscal year 2006, and our recommendation was made in March 2007, which was after the data for the annual report were assembled. Thus the department’s actions were not undertaken in time to affect the statistics for fiscal year 2006. If the department continues its improvement efforts, including establishing internal controls and processes to ensure that data are entered accurately and completely, it should increase its assurance that the FOIA data collected by the Farm Service Agency are complete and accurate. The numbers of FOIA requests received and processed continue to rise, but the rate of increase has flattened in recent years. Figure 2 shows total requests reported for the 21 agencies for fiscal years 2002 through 2006. This figure shows SSA’s share separately because of the large number of requests that the agency reported. As the figure shows, not only do SSA’s results dwarf those for all other agencies, they also reveal a major jump in requests received and processed from 2004 to 2005 (an increase of 92 percent), as well as a continued rise in 2006 (an increase of 8 percent). In 2005, SSA attributed the jump to an improvement in its method of counting requests and stated that, in previous years, these requests were undercounted. Because of the undercount in previous years and the high volume of SSA’s requests, including SSA’s statistics in governmentwide data would obscure year-to-year comparisons. Figure 3 presents statistics omitting SSA on a scale that allows a clearer view of the rate of increase in FOIA requests received and processed in the rest of the government. As this figure shows, when SSA’s numbers are excluded, the rate of increase is modest and has been flattening: For the whole period (fiscal years 2002 to 2006), requests received increased by about 23 percent, and requests processed increased by about 23 percent. Most of this rise occurred from fiscal years 2002 to 2003: about 18 percent, both for requests received and for requests processed. In contrast, in the last two fiscal years, the rise was much less: for requests received, the rise was roughly 3 percent from fiscal year 2004 to 2005 and another 1 percent to 2006; for requests processed, the rise was about 2 percent from fiscal year 2004 to 2005 and another 2 percent from fiscal year 2005 to 2006. Specifically with regard to SSA, in fiscal year 2006, as in the previous year, the vast majority of requests reported fall into a category SSA calls “simple requests handled by non-FOIA staff;” according to SSA, these are typically requests by individuals for access to their own records, as well as requests in which individuals consent for SSA to supply information about themselves to third parties (such as insurance and mortgage companies) so that they can receive housing assistance, mortgages, and disability insurance, among other things. SSA stated that these requests are handled by personnel in about 1,500 locations in SSA, including field and district offices and teleservice centers. Such requests are almost always granted, according to SSA, and most receive immediate responses. According to SSA officials, they report these requests because, as discussed earlier, Justice guidance instructs agencies to treat Privacy Act requests (requests for records concerning oneself) as FOIA requests and report them in the annual reports. SSA attributed the jump that occurred in fiscal year 2005 to an improvement in its method of counting these simple requests, which can be straightforwardly captured by its automated systems. For the past several years, these simple requests have accounted for the major portion of all SSA requests reported (see table 3). In fiscal year 2006, all but about 34,000 of SSA’s over 18 million requests fell into this category. From fiscal years 2002 to 2005, SSA’s FOIA reports attributed the increases in this category largely to better reporting, as well as actual increases in requests. Besides SSA, agencies reporting large numbers of requests received were the Departments of Defense, Health and Human Services, Homeland Security, Justice, the Treasury, and Veterans Affairs, as shown in table 4. The rest of agencies combined account for only about 3 percent of the total requests received (if SSA’s simple requests handled by non-FOIA staff are excluded). Table 4 presents, in descending order of request totals, the numbers of requests received and percentages of the total (calculated with and without SSA’s statistics on simple requests handled by non-FOIA staff). Most FOIA requests in 2006 were granted in full, with relatively few being partially granted, denied, or not disclosed for other reasons (statistics are shown in table 5). This generalization holds with or without SSA’s inclusion. The percentage of requests granted in full was about 87 percent, which is about the same as in previous years. However, if SSA’s numbers are included, the proportion of grants dominates the other categories— raising this number from 87 percent of the total to 98 percent. This is to be expected, since SSA reports that it grants the great majority of its simple requests handled by non-FOIA staff, which make up the bulk of SSA’s statistics. Compared to 2005, there was a slight increase in the percentage of denials: from 0.75 percent to 1.18 percent of total requests received (excluding SSA); this is an increase of 10,860 denials. The percentage of requests not disclosed for other reasons (excluding SSA) decreased from 8.0 percent to 7.9 percent (a decrease of 2,644 requests not disclosed for other reasons). As shown in figure 4, three of the seven agencies that handled the largest numbers of requests (see table 4) also granted the largest percentages of requests in full: the Department of Health and Human Services (HHS), SSA, and the Department of Veterans Affairs (VA). Figure 4 shows, by agency, the disposition of requests processed: that is, whether a request was granted in full, partially granted, denied, or “not disclosed for other reasons” (see table 1 for a list of these reasons). As the figure shows, the numbers of fully granted requests varied widely among agencies in fiscal year 2006. Four agencies made full grants of requested records in over 80 percent of cases they processed—HHS, SSA, VA, and the Small Business Administration (SBA). This is a decrease from last year, when two other agencies—Energy and the Office of Personnel Management (OPM)—also made full grants of requested records in over 80 percent of the cases they processed. This year, Energy provided full grants 75 percent of the time, compared to 82 percent last year, and OPM provided full grants 67 percent of the time, compared to 81 percent last year. In contrast, several agencies tended not to make full grants. Of 21 agencies, 10 made full grants of requested records in less than 40 percent of their cases (compared to 12 in 2005). Four of these 10 agencies—the Agency for International Development (AID), DHS, the National Science Foundation (NSF), and State—made full grants in less than 20 percent of cases processed; in contrast, in 2005, only 2 agencies (NSF and State) fell into this category. This variance among agencies in the disposition of requests has been evident in prior years as well. In many cases, the variance can be accounted for by the types of requests that different agencies process. For example, as discussed earlier, SSA grants a very high proportion of requests because most of its requests are for personal records that are routinely made available to the individuals concerned (or to others with their consent). Similarly, VA routinely makes medical records available to individual veterans, and HHS also handles large numbers of Privacy Act requests. Such requests are generally granted in full. Other agencies, on the other hand, receive numerous requests whose responses must routinely be redacted to prevent disclosure of personal or other exempt information. For example, NSF reported in its fiscal year 2005 annual report that most of its requests (an estimated 90 percent) are for copies of funded grant proposals. The responsive documents are routinely redacted to remove personal information on individual principal investigators (such as salaries, home addresses, and so on), which results in high numbers of “partial grants” compared to “full grants.” For 2006, the reported time required to process requests (by track) varied considerably among agencies. Table 6 presents data on median processing times for fiscal year 2006. For agencies that reported processing times by component rather than for the agency as a whole, the table indicates the range of median times reported by the agency’s components. As the table shows, 10 agencies had components that reported processing simple requests in less than or equal to 10 days: these components are parts of DHS, Energy, the Interior, Justice, Labor, Transportation, Education, HHS, the National Aeronautics and Space Administration (NASA), and the Treasury. For each of these agencies, the lower value of the reported ranges is less than or equal to 10. On the other hand, median time to process simple requests is relatively long at seven organizations— components of DHS, Energy, Interior, Justice, Education, the Environmental Protection Agency (EPA), and NASA—as shown by median ranges whose upper-end values are greater than 100 days. For complex requests, the picture is similarly mixed. Components of six agencies (the Interior, Labor, HHS, NASA, the Treasury, and VA) reported processing complex requests quickly—with a median of less than 10 days. In contrast, other components of several agencies (DHS, Energy, Justice, Transportation, Education, EPA, HHS, the Nuclear Regulatory Commission, State, and the Treasury) reported relatively long median times to process complex requests—with median days greater than 100. Five agencies (AID, HHS, NSF, SBA, and SSA) reported using single-track processing. The median processing times for single-track processing varied from 7 days (at SBA) to 399 days (at an HHS component). The median processing times for requests pending also varied widely among the agencies. In 2006, eight agencies reported median processing times for pending requests greater than 1 year (defined as 251 business days) in length. These eight agencies are AID, DHS, Energy, the Interior, Justice, Education, HHS, and VA. One agency reported a component having a median processing time for its pending cases of 1,200 days, which is nearly 5 years. As we reported in our March 2007 report, our ability to make further generalizations about FOIA processing times is limited by the fact that, as required by the act, agencies report median processing times only and not, for example, arithmetic means (the usual meaning of “average” in everyday language). With only medians, it is not statistically possible to combine results from different agencies to develop broader generalizations, such as a governmentwide statistic based on all agency reports, statistics from sets of comparable agencies, or an agencywide statistic based on separate reports from all components of the agency. This was the basis for the suggestion in our previous report that the Congress consider amending the act to require agencies to report average times and ranges; this requirement is a provision of the OPEN Government Act, enacted December 31, 2007, as Public Law 110-175. In addition to the increase in numbers of requests processed at the 21 agencies, the number of pending cases—requests carried over from one year to the next—has increased. In 2002, pending requests at the 21 agencies were reported to number about 135,000, whereas in 2006, about 218,000—38 percent more—were reported. In fiscal year 2006, as shown in figure 5, the rate of increase flattened: the pending totals rose 12 percent from 2005, compared to a rise of 20 percent from fiscal year 2004 to 2005. These statistics include pending cases reported by SSA, because SSA’s pending cases do not include simple requests handled by non-FOIA staff (for which SSA does not track pending cases). As the figure shows, these pending cases do not change the governmentwide picture significantly. In contrast, since its establishment in 2003, DHS has accounted for a major and increasing portion of pending requests governmentwide, as shown in figure 6. Although 11 other agencies reported that their numbers of pending cases had increased since 2003, these increases were offset by decreases at other agencies, so that, as the figure shows, pending cases for the other 20 agencies combined are relatively stable. Within DHS, about 89 percent of pending cases are from Citizenship and Immigration Services (CIS), which receives the vast majority of all FOIA requests sent to the department—over 100,000 incoming requests annually. According to the department, most of CIS’s FOIA requests come from individuals and their representatives seeking information contained within the so-called Alien Files (A-files); this information may be used in applying for immigration benefits or in immigration proceedings, as well as for genealogy studies. One issue in relation to these files is that about 55 million hard-copy A-files are shared with Immigration and Customs Enforcement (ICE), which can lead to delays in locating, referring, and processing documents. According to the department, CIS and ICE have convened a working group to establish a streamlined approach to processing documents in the A-files, and they are also assessing digitization of the files, which would allow both components to electronically access any file. Table 7 shows the percentage of the total pending requests that each agency accounted for in fiscal year 2006; to provide an idea of the scale of these requests in comparison to the agency’s annual workload, the last column provides the number received. As the table shows, the six agencies that accounted for most requests received also accounted for the most requests pending, although DHS’s rank in the number of pending requests was higher than its rank in the number of received requests. The table also shows the great variation in the relationship between pending and received numbers for individual agencies. Another way to consider progress in reducing pending cases is through individual agency processing rates—that is, the number of requests that an agency processes relative to the number it receives. Agencies that process more requests than they receive will decrease the number of pending cases remaining at the end of a given year. From 2002 to 2006, individual agencies show mixed results in this regard. In figure 7, bars extending above the centerline at 100 percent indicate that an agency reported processing more requests than it received in that year, whereas bars dropping below the centerline indicate that it reported processing fewer than it received. In Justice’s guidance on the annual reports for fiscal year 2006, it directed agencies to include additional statistics as part of the new section on agencies’ progress implementing their improvement plans. These additional statistics included the time ranges of requests pending. Based on these statistics, figure 8 provides a timeline showing the oldest pending requests reported by each of the agencies. As seen in the figure, as of the end of calendar year 2006, the age of the oldest pending requests ranged from less than 1 year to about 18 years. Note that these requests were those reported in the fiscal year 2006 annual reports; they do not necessarily remain open. Agencies are required to meet certain time frames for determining whether to comply with requests: generally 20 business days from receipt of the request, although this time may be extended by 10 days in “unusual circumstances,” such as when requests involve a voluminous amount of records or require consultation with another agency. The Congress did not establish a statutory deadline for making releasable records available, but instead required agencies to make them available promptly. However, it is not uncommon for agencies to spend much more than the statutory 20 or 30 days to determine whether records can be released and to supply the records. According to our examination of selected case files and discussions with agency officials, the factors that contribute to requests remaining open include the following: Requests may involve large volumes of responsive records. Requests may require extensive review and consultations. Agencies may need to notify submitters of information before disclosure. Requests may be delayed until ongoing investigations are completed. Finally, at one agency component, requests more than 6 years old received low priority because the component believed that they could no longer be pursued in litigation. Requests may involve large volumes of responsive records. For requests that involve large volumes of responsive records, it may take significant time to assemble, review and redact, and duplicate records. In addition, processing of such requests may be delayed while requests received earlier are processed. In addressing such requests, agencies report that they contact requesters to determine whether a more limited or targeted selection of records will meet their needs, and that this can lead requesters to narrow their requests. In addition, agencies may use multitrack processing, putting voluminous or complex requests in a separate queue (which allows relatively simple requests to be processed more quickly). The selection of agencies’ oldest case files that we reviewed included several examples of voluminous requests. For example, at Defense, 5 of the 10 oldest cases remained open, in part because the responsive records were voluminous. For one request for records on the 1972 Strategic Arms Limitation Talks (SALT), Defense’s case file indicated that the request involved the review and coordination of 936 pages of top secret documents. A request for 1970 SALT records involved 613 pages of top secret documents. At HHS, 4 of the 10 oldest case files included references to voluminous records. For example, for a media request for background information on a report by the Centers for Medicare and Medicaid Services on an incident involving an error at a hospital, the centers indicated that the responsive documents were bulky, consisting of about 500 to 600 pages of records. At VA, all 10 oldest pending requests, dating from 2003 to 2005, were in the VA Office of the Inspector General. For one of these cases, the responsive records were described as voluminous (about 700 pages) and in need of review by legal staff; the requester was informed that because of this, they would be placed in a queue with other voluminous requests requiring legal review. The request reached the head of the queue about 2 years later (May 2007), and three incremental releases were made from May to June 2007. (According to VA, this request was closed on August 17, 2007.) VA officials also described a more recent voluminous request involving a database containing more than 72,000 active files, with 431 data elements and over 4 million PDF files, each of which had to be reviewed for personal data. At Justice, two of the six oldest case files included letters explaining that because of the high volume of responsive records associated with each, the requests had been placed in the pending queue for processing. In one case, a letter indicated that the request had moved from number 91 in the pending queue in October 1990 to number 54 in November 1993; according to the letter, the processing delay was caused by large numbers of requests received, as well as the need to devote part of the office’s resources solely to processing documents in response to legislative requirements (the President John Fitzgerald Kennedy Assassination Records Collection Act of 1992). Requests may require extensive review and consultations. Review of requests may require coordination with many organizational components, or they may require the agency to consult with other agencies. If responsive records are classified, they must be reviewed and redacted by personnel with appropriate clearances. Classified or intelligence issues may involve both internal reviews and external consultation when other agencies must review and approve the release of information gathered before a case can be closed. Agency officials stated that this coordination can be time-consuming, especially when it is not clear which agencies have ownership of the information. In other cases, proper review and redaction may require the involvement of subject-matter experts or others with specialized knowledge. Defense’s oldest case files, as described above, included several involving top secret documents, which required extensive reviews by multiple components before release. All but one of Defense’s 10 oldest cases showed evidence of consultations and coordination, in some cases with multiple organizations (these included Commerce, State, and the Central Intelligence Agency). In one of Justice’s six oldest cases, the responsive documents had been sent to external agencies for review of classified documentation to determine whether the material warranted continued declassification and whether it could be released. Agencies may need to notify submitters of information before disclosure. Before releasing information under FOIA, federal agencies are generally required to provide predisclosure notifications to submitters of confidential commercial information. Officials stated that when agencies receive requests for proprietary, acquisition, or procurement records, the submitter notification process can delay closure of these cases. For example, NSF officials stated that most of their requests are for copies of funded grant proposals, which require FOIA staff to contact grantees for approval of the release. According to NSF, many of these grantees are academics who are not familiar with FOIA processes (including the submitter review process); NSF officials state that locating the submitters and explaining the process can be time-consuming. Requests may be delayed until ongoing investigations are completed. According to our analysis of the 10 oldest case files from selected agencies, several old requests remained open because they sought documents regarding investigations that were still ongoing. At DHS and VA, most of the oldest FOIA requests remain open because the responsive records are relative to ongoing investigations. Some examples of these requests follow: At DHS, 8 of the 10 oldest pending requests (dating from 2000 to 2001) were requests directed to the Coast Guard for documents on vessel incidents (such as collisions between vessels). In these cases, the Coast Guard responded to requesters that, as the incident was still under investigation, material might be protected from release as part of an ongoing law enforcement proceeding; the exemptions cited included 7(A), which exempts records or information compiled for law enforcement purposes to the extent that the production of such records could be expected to interfere with enforcement proceedings. The requesters were offered the choice of receiving any material available at the time or authorizing an extension until the investigation was complete; in these cases, requesters asked that requests remain open, pending completion of the investigation. At VA, 7 of the 10 oldest pending requests (dating from 2003 to 2005) were for documents concerning investigations or reviews by the VA Office of the Inspector General. For example, one request was for records of an investigation of medical research activities at a VA medical center that was opened after employees reported that established research procedures were not being properly followed. Another was for records regarding complaints filed against a health care provider. In these and other cases, requesters were informed that the records were not yet releasable and cited exemptions, including 7(A). For these 7 requests, VA informed requesters that it would keep the requests open until the investigations were complete. The Director of Justice’s Office of Information and Privacy stated that the agencies could have simply closed the requests as denials under exemption 7(A) and any other applicable exemption (see app. II); she also noted that these requests remained open in accordance with the requesters’ wishes. Requests more than 6 years old may receive low priority. At one agency component, a set of old cases remained open because the agency believed they were no longer subject to litigation. In accordance with the general federal statute of limitations, lawsuits against the United States generally are barred after 6 years after the right of action first accrues. At Justice’s Criminal Division, requests over 6 years old were given lower priority than requests for which litigation was deemed likely, and, in some instances, the original request processing files were lost. That is, the Criminal Division was unable to locate the original processing files for 4 requests that it had identified as among its 10 oldest pending requests, dating from around the early 1990s. (Justice officials later informed us that one of these cases was in fact closed and had been incorrectly identified.) In August 2007, the Chief of the division’s FOIA/Privacy Act Unit (now retired) told us that he could not account for the loss, but that the unit had recently undergone a move and personnel changes, which might have been contributing factors. According to this official, the unit was creating replacement files from a tracking database and would then take action to close the requests. According to its former chief, the FOIA/Privacy Act Unit gave priority to avoiding litigation, since lawsuits can generate a significantly increased workload and slow down other FOIA processing. For example, according to this official, the Criminal Division was then processing over 30,000 documents as a result of a lawsuit. Criminal Division officials stated that because of the magnitude of this task, which was subject to supervision by the court and potential sanctions if not timely, it was not practical to divert resources to process older cases. Although the goal of avoiding litigation is reasonable, the lack of priority given to the division’s oldest case files is inconsistent with the department’s expressed emphasis on what it termed “an emerging area of concern”—the longest-pending FOIA requests that agencies have on hand. According to Justice, its Office of Information and Privacy (which has lead responsibility for providing guidance and support to federal agencies on FOIA issues) established as a backlog-related goal the regular closure of the 10 oldest FOIA requests pending at eight senior leadership offices in the department, for which the office performs FOIA processing. According to the department, this served as an example for other agencies, some of which followed suit. (Also, in October 2007, Justice issued new requirements for all agencies to report on their 10 oldest pending requests and 10 oldest pending consultations received from other agencies.) Further, although the statute of limitations may prevent requesters from filing suit after 6 years, following a practice that avoids applying resources to cases older than this has the potential effect of increasing the number of very old open requests having little prospect of being closed. In response to this issue, the Criminal Division’s FOIA/Privacy Act Unit began taking action to close the requests that had missing case files, according to its former chief. Also, in December 2007, the current deputy chief of the Criminal Division told us that an attorney had been detailed to work full time on the oldest cases (those dating from 2000 and before); according to this official, the Criminal Division had decreased its pending list by over 100 cases between September 14 and November 29, 2007. However, the division’s improvement plan did not address closing its oldest cases, and the division had not established time frames for doing so. Although the actions described by the deputy chief, if implemented appropriately, should help to address this issue, establishing goals and time frames would provide further assurance that attention to this issue is sustained appropriately. Without such goals and time frames, the Criminal Division risks perpetuating the tendency for the oldest requests to remain open indefinitely. Following the emphasis on backlog reduction in Executive Order 13392 and agency improvement plans, many agencies have shown progress in decreasing their backlogs of overdue requests as of September 2007. Specifically, of 16 agencies we reviewed that were able to provide statistics, 9 decreased overdue or pending requests, 5 experienced increases, and 2 had no material change. However, the statistics provided by these agencies varied widely, representing a mix of overdue cases and total pending cases, as well as varying time frames. Further, 3 of the 21 agencies were unable to provide statistics supporting their backlog reduction efforts, and 1 provided statistics by component, which could not be aggregated to provide an agencywide result. (The remaining agency reported no backlog before or after implementing its plan.) Tracking and reporting statistics on overdue cases is not a requirement of the annual FOIA reports or of the Executive Order. Although both the Executive Order and Justice’s implementing guidance put a major emphasis on backlog reduction, agencies were given flexibility in developing goals and metrics that they considered most appropriate in light of their current FOIA operations and individual circumstances. As a result, agencies’ goals and metrics vary widely, and progress could not be assessed against a common metric. Justice’s most recent guidance directs agencies to set goals for reducing backlogs of overdue requests in future fiscal years, which could lead to the development of a consistent metric; however, it does not direct agencies to monitor and report overdue requests or to develop plans for meeting the new goals. Table 8 shows statistics provided by 16 agencies in response to our request for numbers of overdue requests before and after the implementation of the improvement plans. “After” statistics were as of September 14, 2007 (except as noted in the table). “Before” (baseline) statistics were generally as of about June 2006. As the table shows, a few agencies provided statistics on pending requests rather than overdue requests. As shown in table 8, since implementing their FOIA improvement plans, eight agencies showed significant decreases in their backlogs of overdue cases (AID, DHS, EPA, Interior, Labor, the Nuclear Regulatory Commission, the Treasury, and VA), and one (Energy) showed decreases in pending requests (Energy does not distinguish overdue requests from pending requests in its reduction efforts). Because of the large numbers of pending and overdue requests that it accounts for governmentwide, DHS’s reduction is particularly notable. According to its statistics, DHS succeeded in reducing backlog by 29 percent since June 2006, reducing its overdue requests by almost 30,000. DHS officials, including the Deputy Chief FOIA Officer, attributed the department’s success to activities performed as part of its improvement plan for both 2006 and 2007. For 2006, DHS’s improvement plan goals related to backlog reduction included hiring additional personnel, implementing operational improvements at CIS, meeting with an important requester group (the American Immigration Lawyers Association) to discuss file processing and customer service enhancements, and establishing a monitoring program under which all DHS components submitted weekly and monthly data to DHS’s Chief FOIA Officer. Officials also cited improvements to the department’s Web site to assist requesters in properly drafting and directing their requests; increased outreach and assistance by the central FOIA office to components; formalized employee training programs; and the launch of an Internet-based FOIA correspondence tracking and case management system for FOIA offices at DHS headquarters, which is to streamline the tracking of requests. In addition, DHS’s Deputy Chief FOIA Officer told us that she attributes the department’s progress to an increased focus on customer service and communication with requesters, as well as efforts to streamline FOIA processing using available technologies. Also notable is VA’s performance: it reported achieving a backlog reduction of over 80 percent from August 2006 to September 2007—a reduction of 9,550 requests. This is also significant to the overall backlog picture, as VA accounts for significant portions of governmentwide requests received and pending (table 7 provides numbers for fiscal year 2006). VA attributed its backlog reduction to the improvements resulting from meeting the milestones that it had set in its improvement plan and the increased management emphasis on backlog reduction. VA’s 2006 improvement goals were to implement quarterly backlog snapshot reporting for all components; analyze these snapshots to identify offices with significant backlogs; identify the department’s 10 oldest FOIA requests and estimated completion dates; and conduct FOIA site visits. In its annual report, VA reported meeting these goals, as well as a number of goals for 2007, including analysis of backlog and solutions. Other agencies did not reduce their backlog of overdue or pending cases: two agencies with minor backlog saw no material change, but five agencies saw significant increases: Commerce saw a minor increase in its backlog of 7 overdue requests, for a total of 188 (Commerce generally receives about 2,000 FOIA requests a year). According to Commerce’s Departmental FOIA Officer, the department received a large number of voluminous requests in the period before September 14, which she said was because of the election year, and many of these requests were requests for congressional correspondence and correspondence logs. According to this official, because such logs and correspondence involve other agencies, such requests require external consultation, which can be time-consuming. She also stated that the department’s backlog of overdue requests varies from day to day, and that by September 30, 2007, it had fallen to 159. For agencies such as Commerce, whose processing rates have fluctuated closely around 100 percent (see fig. 7), such variations are not surprising. NSF’s pending requests rose from 5 to 7 from its fiscal year 2006 report to September 14, 2007; NSF processes around 250 to 350 requests per year. As these numbers show, NSF does not face major backlog issues. Further, when dealing with small numbers that can vary daily, a difference of 2 between snapshot dates does not provide a meaningful indication of a trend. SSA, State, and Defense saw rises in overdue requests, and NASA and Education saw rises in pending requests: Although SSA stated in its fiscal year 2006 annual report that it had reduced its backlog by 5 percent, it experienced a rise in its backlog of overdue requests by September 2007. SSA officials, including the Principal Public FOIA Liaison, attribute this rise to difficulties in migration to a new electronic FOIA tracking system, recent loss of experienced staff, and an increase in complex requests in 2007. According to these officials, this increase in requests occurred because of events that led to heightened public interest, such as SSA field office closures. Although SSA is expecting to lose more senior staff in 2007, officials hope to reduce backlog by streamlining operations and careful management. For example, according to agency FOIA officials, SSA is tasking junior-level personnel, including administrative and office automation staff, with the responsibility of responding to requests from frequent requesters seeking routine statistical data, thus allowing senior analysts to work on more complex requests. According to FOIA officials at State’s Office of Information Programs and Services, the department’s backlog of overdue requests increased because of conflicting demands on the staff that coordinate and process FOIA requests. For example, staff resources were redirected in response to a department priority placed on passport processing. State also reported that it experienced an increase in the number of congressional requests for documents, the expedited processing of which often competes for the same staff. According to the department, it plans to address its backlog challenges by efforts to better track and control the FOIA workload. Defense attributes most of the rise in its backlog of overdue requests to an unforeseen influx of requests received by the Defense Security Service (DSS). According to the chief of Defense’s Freedom of Information Policy Office, DSS accounts for over 10,000 of Defense’s 23,255 backlogged requests. This official told us that these requests are primarily Privacy Act requests for background investigation files from individuals who were investigated by DSS for security clearances over the past 15 years. According to this official, the DSS backlog increased because, among other things, personnel security investigation resources were transferred from DSS to OPM when OPM assumed the personnel security investigation mission in 2005; the increased security awareness within the country since the events of September 11, 2001, caused more employers of former Defense personnel to ask for security clearance information; and the war in Iraq caused a significant increase in the use of cleared contractors for critical positions. The chief of Defense’s Freedom of Information Policy Office stated that the department plans to modify its FOIA improvement plan to address this new backlog. NASA saw an increase of more than 100 percent in pending requests from February 2006 to September 14, 2007. According to NASA’s Chief FOIA Public Liaison Officer, during this past fiscal year, it experienced an unexpectedly large increase in FOIA workload because of high-visibility incidents that led the public and media to increase their FOIA requests, such as an incident involving an astronaut accused of attempted murder, foam-related issues with the shuttle tanks, and contracts with NASA’s new exploration vehicle. Most of these requests involve information that is being considered under civil and criminal proceedings, operational safety reviews, and internal controls; as a result, according to this official, they required extensive legal reviews concerning the initial release determinations. Education experienced a 44 percent increase in pending requests from June 2006 to September 14, 2007. Education’s improvement plan goals included closing its 10 oldest requests by January 2007, as well as 10 percent of 480 requests that it identified as pending as of June 2006. In its annual report, the department stated that it exceeded its 10 percent goal, but that it did not close its 10 oldest requests because resources had been reallocated to address other unplanned FOIA priorities and workload. In addition, the Director of Regulatory Information Management Services in the department’s Office of Management told us that the department has experienced an increase in pending/backlog FOIA requests because of the growing number of FOIA requests seeking responsive documents of a cross-cutting nature, which require substantial time and attention from senior personnel. Although the statistics provided by the 16 agencies indicate that many agencies have made reductions, the governmentwide picture is not clear because the types of statistics varied widely, representing both overdue and pending cases and varying time frames. Further, 3 of the 21 agencies were unable to provide statistics supporting their backlog reduction efforts, and 1 provided statistics by component, which could not be aggregated to provide an agencywide result. Table 9 shows the variations in the dates of the baseline statistics for the agencies. For agencies that provided the number of their overdue cases, the dates generally depended on when the agencies first began to collect such statistics. Some agencies had collected preimplementation backlog numbers as a baseline for their improvement plans, and others planned to determine backlog of overdue cases as part of the implementation of their plans. For agencies that provided pending statistics, the dates generally depended on the systems and processes used to develop the statistics. Some agencies provided statistics on backlog of overdue requests, some provided numbers of pending requests, and some provided a combination. For the four agencies providing only pending statistics, the actual backlogs of overdue requests would probably be lower, since overdue cases are a subset of pending cases. Those providing pending statistics did so either because their systems were not set up to track overdue requests, because they chose not to distinguish them, or both. For example, according to NASA, its current in-house FOIA database is designed to report statistics only on open requests and does not distinguish those that are over the statutory limit (20 or, in some cases, 30 days). Therefore, NASA provided us numbers pertaining to all open requests. On the other hand, Education and Energy chose not to distinguish between pending cases and those over the statutory limit. Energy explained this decision on the grounds that it ensured that all cases were given the same priority and that new cases would receive just as efficient a response as old ones. Two agencies (Justice and Defense) provided a mix of pending and overdue statistics: Justice reported by components, which provided a mix of pending and overdue statistics, as well as baselines associated with dates ranging from September 2005 to October 2006. Because of this mix, the statistics could not be aggregated and directly compared to give a meaningful departmentwide result. However, of 28 components, 13 reported decreases in overdue or pending cases, 6 reported increases, 7 reported no overdue requests, 1 was a new component that had no preimplementation history, and 1 component did not provide statistics for the time frames requested. According to Defense, it had not previously tracked backlog in the sense of the Executive Order (that is, overdue requests), and it planned to use the September 2007 statistics collected for us as a baseline for future tracking. Similarly, the Department of the Interior could not provide us with a preimplementation baseline because it did not track its backlog of overdue requests at that time. Interior told us that it has now modified its tracking system to allow it to monitor overdue cases in real time. Table 10 shows the four agencies for which information was not provided or was not sufficient for a clear conclusion. (The remaining agency, SBA, did not report a backlog for either June 2006 or September 2007.) Three agencies did not provide any statistics. Transportation and HHS, both of which have decentralized FOIA programs, told us that collecting and providing such statistics was not feasible. Transportation stated that it would have been extremely burdensome to do so because its operating administrations are set up to capture open requests and not overdue requests. Similarly, HHS officials told us that the decentralized nature of the department’s FOIA operations and the manual processes that are used to compile statistics made it impractical to compile the requested data. One agency, OPM, did not provide a baseline statistic. It reported 152 overdue requests as of September 2007, but without a baseline, no conclusion on its progress is possible. According to OPM, because it did not establish a numerical goal for backlog reduction (its goal was to eliminate its backlog of overdue requests), it did not record the number of overdue requests as a baseline before implementing its improvement plan. A major reason for this variation in statistics is that agencies did not necessarily have systems or processes to record backlog in the sense of the Executive Order (requests for records that have not been responded to within the statutory time limit); instead, their systems or processes were based on recording statistics required for the annual reports, which include a count of open requests pending at the end of the reporting period but do not include backlog of overdue requests. This challenge is compounded for agencies with highly decentralized programs or manual processes, for which assembling the statistics, even if they were available, is a significant task. In addition, the goals that agencies set regarding backlog reduction varied widely. In our March 2007 report, we noted that almost all plans contained measurable goals and timetables for avoiding or reducing backlog. However, the goals concentrated on a wide variety of targets and metrics. For example, some goals and milestones were focused on activities that could be expected to reduce backlog by contributing to efficiency, such as conducting reviews, setting up monitoring mechanisms, hiring staff, conducting training, and making other process improvements. Others were numerical goals aimed at particular metrics, such as reducing processing time; completing a certain percentage of requests within 20 days; reducing the number of some subset of requests (such as the 10 oldest cases, those over a year old, cases opened before a particular date, or cases at particular components); or reducing the number of pending or overdue requests by a certain percentage, to a certain number, or to a certain proportion of requests received per year. The goals also covered a variety of time frames, so that not all agencies set numerical goals for the first reporting period (which ended about 7 months after they began implementing their improvement plans), but instead set only process goals. The reason for this variety of goals and milestones is that Justice’s guidance on implementing the Executive Order gave agencies broad flexibility in designing their plans. This guidance emphasized that identifying ways to eliminate or reduce backlog should be a major underpinning of the implementation plans of all agencies that had backlogs. However, the guidance allowed agencies to develop goals that they considered most appropriate in light of their current FOIA operations; it did not prescribe any particular metric for all agencies to use. According to the Director of Justice’s Office of Information and Privacy, the guidance was intended to provide flexibility to agencies in developing appropriate measurements that best fit their individual circumstances. As a result, the goals and milestones set by agencies included a wide variety of different aims and measures. In recent guidance issued to implement the Attorney General’s recommendations for improving FOIA implementation, Justice directed agencies to develop backlog reduction goals for fiscal years 2008 to 2010. The guidance directs agencies to estimate the number of requests they expect to receive during each fiscal year and to set goals both for the number of requests they intend to process and for the number of requests pending beyond the statutory limit (backlog) at the end of each fiscal year. According to the Director of Justice’s Office of Information and Privacy, this guidance was aimed at ensuring the continuation of the improvement process begun by the Executive Order. This guidance continues the flexible approach set in earlier guidance, in that it gives agencies freedom to set goals that they consider appropriate and realistic to their own circumstances. The Director of the Office of Information and Privacy also stated that by directing agencies to establish these goals, the office intended to establish a core definition for what is being tracked and to encourage agencies to begin focusing on this metric. However, the guidance does not direct agencies to modify their existing improvement plans or to otherwise develop strategies, plans, or milestones to achieve these new goals, which are in addition to the specific goals set in their improvement plans. The guidance also does not direct agencies to track and report the actual number of requests pending beyond the statutory limit. Without such planning and tracking, agencies may face challenges in achieving the reductions envisioned. Neither the public nor the agencies could effectively monitor progress unless agencies put in place processes and systems that allow them to track and report their backlogs of overdue requests. The annual FOIA reports continue to provide valuable information about the public’s use of this important tool to obtain information about the operations and decisions of the federal government. However, the value of this information depends on its accuracy. In some cases, agencies were not able to provide assurance that their information was accurate and complete. It is important for agencies to ensure that they have appropriate procedures and internal controls, so that agencies and the public have reasonable assurance that FOIA data are reliable. Some of the challenges that agencies face in processing FOIA requests include the need to review and redact sometimes large volumes of responsive records, to consult with other agencies or confer with multiple organizations, and to provide predisclosure notifications to information submitters. These practical challenges provide some insight into the reasons why backlogs can develop and grow, as well as an appreciation of the need for sustained attention to ensure that backlogs do not become unmanageable. For example, in one agency component, the pressure to avoid litigation, while ensuring that some newer requests were responded to promptly, led to a situation in which very old cases may remain open indefinitely. Establishing goals and time frames to close such cases could help avoid this result. The challenge to agency management is to determine how to apply finite resources to respond to the multiple and sometimes competing demands placed on their FOIA programs. The progress that many agencies have made in reducing backlog suggests that the development and implementation of the FOIA improvement plans have had a positive effect. However, in the absence of consistent statistics on overdue cases, it is not possible to make a full assessment of governmentwide progress in this area. Justice’s latest guidance on setting backlog reduction goals is a step toward developing such statistics, although it does not explicitly ask agencies to track and report them. However, on the principle that “what gets measured gets managed,” the chances of agency success in achieving reductions could be increased if they monitor and report statistics on their backlog of overdue requests, as well as develop plans for achieving their goals. Such reporting would further the aim of the statute and the Executive Order to inform citizens about the operations of their government and the FOIA program in particular. To help ensure that FOIA data in the annual reports are reliable, we are recommending that the Administrator of General Services ensure that appropriate internal controls are put in place to improve the accuracy and reliability of FOIA data, including processes, such as checks and reviews, to verify that required data are entered correctly. To help ensure that FOIA data are reliable, we are recommending that the Secretary of Housing and Urban Development ensure that appropriate policies and procedures are put in place to improve the accuracy and reliability of FOIA data, including procedures to ensure that all FOIA offices use tracking systems consistently and that information is entered accurately and promptly. We previously made a recommendation to the Department of Agriculture regarding the reliability of FOIA data at the Farm Service Agency; we are making no further recommendations at this time because the department has improvement efforts ongoing that, if implemented effectively, should help ensure that required data are entered correctly. We are also recommending that the Attorney General take the following actions: To help ensure that its oldest requests receive appropriate attention, direct the Criminal Division to establish goals and time frames for closing its oldest requests, including those over 6 years old. To help agencies achieve the backlog reduction goals planned for fiscal years 2008, 2009, and 2010 and to ensure that comparable statistics on backlog are available governmentwide, direct the Office of Information and Privacy to provide additional guidance to agencies on (1) developing plans or modifying existing plans to achieve these goals and (2) tracking and reporting backlog. We provided a draft of this report to OMB and the 24 agencies included in our analysis for review and comment. All generally agreed with our assessment and recommendations or had no comment. Seven agencies provided written comments: AID, Energy, EPA, GSA, Homeland Security, Justice, and OPM (printed in apps. III through IX). The Department of Veterans Affairs provided comments by e-mail. In addition, the Departments of Commerce, Defense, the Interior, Justice, and State provided technical comments by e-mail or letter, which we incorporated as appropriate. In written comments from the Department of Justice, the Director of Justice’s Office of Information and Privacy provided additional information on its planned actions related to our recommendations (see app. VIII), and in later contacts, the department confirmed that it generally agreed with our findings and recommendations. The Director described actions that the department has taken to help agencies achieve the backlog reduction goals planned for fiscal years 2008, 2009, and 2010. The Director also stated that Justice intends to issue further guidance to agencies, which will encourage agencies both to ensure appropriate planning to meet their backlog reduction goals and to reduce the age of their oldest requests, as well as provide additional requirements for reporting on backlogged requests. In addition, the Director provided information on actions that the Criminal Division has taken to ensure that the oldest requests receive appropriate attention. She stated that her office has been advised by the FOIA Office of the Criminal Division that it has established goals and time frames for closing its oldest requests and that the likelihood of litigation is no longer a consideration for prioritizing requests older than 6 years (see app. VIII). The Administrator of General Services concurred with our findings and recommendations and stated that the administration has developed and implemented an automated tracking system, providing it with internal control of the data. In addition, the Administrator stated that GSA had increased the FOIA staff, resulting in more checks and reviews to verify that data are entered correctly (see app. VI). Three agencies provided written comments describing additional actions taken in regard to overdue requests: The Director of the Department of Homeland Security’s GAO/OIG Liaison Office concurred with our findings and recommendations and described actions taken by the department to continue to decrease the number of overdue requests, actions taken by CIS to expedite FOIA processing, and the priority given to departmentwide guidance (see app. VII). The Assistant Administrator and Chief Information Officer of the Environmental Protection Agency described actions that the department has taken to ensure that it continues to decrease the number of its overdue requests (see app. V). The Director of the Office of Personnel Management stated that the office did not dispute our statement that it had not established a backlog baseline, and added that since the audit was completed it has established backlog reduction goals and determined a baseline for overdue requests (see app. IX). Two agencies provided written comments agreeing with the information presented on their FOIA programs: For the Department of Energy, the Director of the Office of Management/Chief Freedom of Information Officer provided comments (see app. IV). For the Agency for International Development, the Assistant Administrator of the Bureau for Management provided comments (see app. III). Finally, the GAO Liaison of the Department of Veterans Affairs provided e- mail comments agreeing with the information presented on the department’s FOIA program. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of this report until 30 days from the date of this report. At that time, we will send copies of this report to the Attorney General, the Director of the Office of Management and Budget, and the heads of departments and agencies we reviewed. Copies will be made available to others on request. In addition, this report will be available at no charge on our Web site at www.gao.gov. If you or your staff have questions about this report, please contact me at (202) 512-6240 or koontzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix X. Our objectives were to (1) determine the status of agencies’ processing of Freedom of Information Act (FOIA) requests and any trends that can be seen, (2) describe factors that contribute to FOIA requests remaining open beyond the statutory limits, and (3) determine to what extent agencies have made progress in addressing their backlogs of overdue FOIA requests since implementing their improvement plans. To determine the status of agencies’ processing of FOIA requests and any trends, we analyzed annual report data for fiscal years 2002 through 2006. Our intended scope was the 24 agencies covered by the Chief Financial Officers Act, plus the Central Intelligence Agency (herein we refer to this scope as governmentwide). To gauge agencies’ progress in processing requests, we analyzed the workload data (from fiscal year 2002 through 2006) included in the 25 agencies’ annual FOIA reports to assess trends in volume of requests received and processed, median processing times, and the number of pending cases. All agency workload data were self-reported in annual reports submitted to the Attorney General. To provide assurance that the data reported in the annual reports were reliable, we interviewed officials from selected agencies and assessed the internal controls that agencies had in place for ensuring that their data were complete and accurate. Our strategy for assessing data reliability was to assess agencies on a 3-year rotational basis. In both fiscal year 2006 and fiscal year 2007, we selected the Social Security Administration and the Department of Veterans Affairs for assessment because they processed a majority of the requests governmentwide, as well as eight additional agencies. To ensure that we selected agencies of varying size, we ordered the remaining agencies according to the number of requests they received (from smallest to largest) and divided the resulting list into sets of three; we assessed the first member of each set last year and the second of each set this year. This year, in addition to the Social Security Administration and the Department of Veterans Affairs, the following agencies were selected for assessment: the Departments of Homeland Security, Housing and Urban Development, Justice, and Transportation, as well as the Agency for International Development, the Central Intelligence Agency, the Environmental Protection Agency, and the General Services Administration. We also chose to revisit the Department of Agriculture, which we assessed last year, because we had determined that we could not be assured that data from a component, the Farm Service Agency, were accurate and complete. Thus, we planned to assess a total of 11 agencies in fiscal year 2006. We performed assessments at 10 of these agencies; we did not assess the Central Intelligence Agency because it did not provide information in response to our requests. As a result of these assessment efforts, we omitted 4 of the 25 agencies from our analysis: the Central Intelligence Agency, the General Services Administration, and the Departments of Agriculture and Housing and Urban Development. We eliminated the Central Intelligence Agency, because without its participation, we were unable to determine whether it had internal controls ensuring that its data were accurate and complete. We eliminated the General Services Administration and the Departments of Agriculture and Housing and Urban Development because they did not provide evidence of internal controls that would provide reasonable assurance that FOIA data were recorded completely and accurately, or they acknowledged material limitations of the data. As a result, our statistical analysis for this report was based on data from a total of 21 agencies’ annual reports. Table 11 shows the 25 agencies and their reliability assessment status. To describe factors that contribute to FOIA requests remaining open beyond the statutory limits, we analyzed case files for the 10 oldest pending requests at selected agencies and discussed these cases and the reasons they remained open with agency officials. We also interviewed agency officials regarding the factors they considered most relevant for their agencies. To determine to what extent agencies made progress in addressing backlogged FOIA requests since implementing their improvement plans, we analyzed the improvement plan progress reports included in the fiscal year 2006 annual reports of the 21 major agencies whose internal controls we evaluated as sufficient in order to determine whether the agencies met their 2006 backlog reduction milestones. In order to determine whether agencies made a reduction or an increase in backlogged cases, we analyzed statistics provided by the agencies on their backlogs at different points in time. We discussed the information in the progress reports and backlog statistics with agency officials to determine their views on the reasons for backlog increases or decreases, as well as their progress on their improvement plans. In addition, we reviewed the requirements for reporting progress contained in the Executive Order, implementation guidance from the Office of Management and Budget and the Department of Justice, other FOIA guidance issued by Justice, and our past work in this area. We conducted this performance audit from May 2007 to March 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The act prescribes nine specific categories of information that are exempt from disclosure. Matters that are exempt from FOIA (A) Specifically authorized under criteria established by an Executive Order to be kept secret in the interest of national defense or foreign policy and (B) are in fact properly classified pursuant to such Executive Order. Related solely to the internal personnel rules and practices of an agency. Specifically exempted from disclosure by statute (other than section 552b of this title), provided that such statute (A) requires that matters be withheld from the public in such a manner as to leave no discretion on the issue or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld. Trade secrets and commercial or financial information obtained from a person and privileged or confidential. Interagency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency. Personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy. Records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information could reasonably be expected to interfere with enforcement proceedings; would deprive a person of a right to a fair trial or impartial adjudication; could reasonably be expected to constitute an unwarranted invasion of personal privacy; could reasonably be expected to disclose the identity of a confidential source, including a state, local, or foreign agency or authority or any private institution which furnished information on a confidential basis, and, in the case of a record or information compiled by a criminal law enforcement authority in the course of a criminal investigation or by an agency conducting a lawful national security intelligence investigation, information furnished by confidential source; would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law; or could reasonably be expected to endanger the life or physical safety of an individual. Contained in or related to examination, operating, or condition of reports prepared by, on behalf of, or for the use of an agency responsible for the regulation of supervision of financial institutions. Geological and geophysical information and data, including maps, concerning wells. In addition to the contact named above, key contributions to this report were made by Ashley Brooks, Barbara Collier, Eric Costello, Marisol Cruz, Wilfred Holloway, David Plocher, Kelly Shaw, and Elizabeth Zhao.

Summary: Under the Freedom of Information Act (FOIA), federal agencies must generally provide access to their information, enabling the public to learn about government operations and decisions. To help ensure proper implementation, the act requires that agencies report annually to the Attorney General on their processing of FOIA requests. For fiscal year 2006, agencies were also to report on their progress in implementing plans to improve FOIA operations, as directed by a December 2005 Executive Order. A major goal of the order was reducing backlogs of overdue FOIA requests (the statute requires an agency to respond to requests within 20 or, in some cases, 30 working days with a determination on whether it will provide records). For this study, GAO was asked, among other things, to determine trends in FOIA processing and agencies' progress in addressing backlogs of overdue FOIA requests since implementing their improvement plans. To do so, GAO analyzed 21 agencies' annual reports and additional statistics. Based on data reported by major agencies in annual FOIA reports from fiscal years 2002 to 2006, the numbers of FOIA requests received and processed continue to rise, but the rate of increase has flattened in recent years. The number of pending requests carried over from year to year has also increased, although the rate of increase has declined. The increase in pending requests is primarily due to increases in requests directed to the Department of Homeland Security (DHS). In particular, increases have occurred at DHS's Citizenship and Immigration Services, which accounted for about 89 percent of DHS's total pending requests. However, the rate of increase is slightly less than it was in fiscal year 2005. Following the emphasis on backlog reduction in Executive Order 13392 and agency improvement plans, many agencies have shown progress in decreasing their backlogs of overdue requests as of September 2007. In response to GAO's request, 16 agencies provided information on their recent progress in addressing backlogs; results showed that 9 achieved decreases, 5 experienced increases, and 2 had no material change. Notably, according to this information, DHS was able to decrease its backlog of overdue requests by 29,972, or about 29 percent. However, the statistics provided by the 16 agencies varied widely, representing both overdue cases and all pending cases, as well as varying time frames. Further, 3 of 21 agencies reviewed were unable to provide statistics supporting their backlog reduction efforts, and 1 provided statistics by component, which could not be aggregated to provide an agencywide result. (The remaining agency reported no backlog before or after implementing its plan.) Tracking and reporting numbers of overdue cases is not a requirement of the annual FOIA reports or of the Executive Order. Although both the Executive Order and Justice's implementing guidance put a major emphasis on backlog reduction, agencies were given flexibility in developing goals and metrics that they considered most appropriate in light of their current FOIA operations and individual circumstances. As a result, agencies' goals and metrics vary widely, and progress could not be assessed against a common metric. The progress that many agencies made in reducing backlog suggests that the development and implementation of the FOIA improvement plans have had a positive effect. However, in the absence of consistent statistics on overdue cases, it is not possible to make a full assessment of governmentwide progress in this area. Justice's most recent guidance directs agencies to set goals for reducing backlogs of overdue requests in future fiscal years, which could lead to the development of a consistent metric; however, it does not direct agencies to monitor and report overdue requests or to develop plans for meeting the new goals. Without such planning and tracking, agencies may be challenged to achieve the reductions envisioned.