Internet-based services using Web 2.0 technology have become increasingly popular. Web 2.0 technologies refer to a second generation of the World Wide Web as an enabling platform for Web- based communities of interest, collaboration, and interactive services. These technologies include Web logs (known as “blogs”), which allow individuals to respond online to agency notices and other postings; social-networking sites (such as Facebook and Twitter), which also facilitate informal sharing of information among agencies and individuals; video-sharing Web sites (such as YouTube), which allow users to discover, watch, and share originally created videos; “wikis,” which allow individual users to directly collaborate on the content of Web pages; “podcasting,” which allows users to download audio content; and “mashups,” which are Web sites that combine content from multiple sources. While in the past Internet usage concentrated on sites that provide online shopping opportunities and other services, according to the Nielsen Company, today video and social networking sites have moved to the forefront, becoming the two fastest growing types of Web sites in 2009, with 87 percent more users than in 2003. Furthermore, in February 2009, usage of social networking services reportedly exceeded Web-based e-mail usage for the first time. Similarly, the number of American users frequenting online video sites has more than tripled since 2003. Some of the most popular Web 2.0 technologies in use today are social networking services, such as Facebook and Twitter. Facebook is a social networking site that lets users create personal profiles describing themselves and then locate and connect with friends, co-workers, and others who share similar interests or who have common backgrounds. According to the Nielsen Company, Facebook was the number one global social networking site in December 2009 with 206.9 million unique visitors. Twitter is a social networking and blogging site that allows users to share and receive information through short messages. According to the Nielsen Company, Twitter has been the fastest-growing social networking Web site in terms of unique visitors, increasing over 500 percent, from 2.7 million visitors in December 2008 to 18.1 million in December 2009. Federal agencies are increasingly using Web 2.0 technologies to enhance services and interactions with the public. Federal Web managers use these applications to connect to people in new ways. As of July 2010, we identified that 22 of 24 major federal agencies had a presence on Facebook, Twitter, and YouTube. Use of such technologies was endorsed in President Obama’s January 2009 memorandum promoting transparency and open government. The memorandum encouraged executive departments and agencies to harness new technologies to put information about their operations and decisions online so that it would be readily available to the public. It also encouraged the solicitation of public feedback to identify information of the greatest use to the public, assess and improve levels of collaboration, and identify new opportunities for cooperation in government. Table 1 presents examples of Web 2.0 technologies and their current uses in the federal government. Federal agencies have been adapting Web 2.0 technologies to support their individual missions. For example: ● The U.S. Agency for International Development (USAID) uses Facebook to inform the public about the developmental and humanitarian assistance that it is providing to different countries in the world. It also posts links to other USAID resources, including blogs, videos, and relevant news articles. ● The National Aeronautics and Space Administration (NASA) uses Twitter to notify the public about the status of its missions as well as to respond to questions regarding space exploration. For example, NASA recently posted entries about its Mars Phoenix Lander mission on Twitter, which included answers to questions by individuals who followed its updates on the site. ● The State Department uses YouTube and other video technology in supporting its public diplomacy efforts. The department posts YouTube videos of remarks by Secretary Clinton, daily press briefings, interviews of U.S. diplomats, and testimonies by ambassadors. It also conducted a global video contest that encouraged public participation. The department then posted the videos submitted to it on its America.gov Web site to prompt further online discussion and participation. ● The Transportation Security Administration (TSA) developed a blog to facilitate an ongoing dialogue on security enhancements to the passenger screening process. The blog provides a forum for TSA to provide explanations about issues that can arise during the passenger screening process and describe the rationale for the agency’s policies and practices. TSA also uses Twitter to alert subscribers to new blog posts. A program analyst in TSA’s Office of Strategic Communications and Public Affairs stated that blogging encourages conversation, and provides direct and timely clarification regarding issues of public concern. While the use of Web 2.0 technologies can transform how federal agencies engage the public by allowing citizens to be more involved in the governing process, agency use of such technologies can also present challenges related to privacy, security, records management, and freedom of information. Determining how the Privacy Act of 1974 applies to government use of social media. The Privacy Act of 1974 places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. However, because of the nature of Web 2.0 technologies, identifying how the act applies to the information exchanged is difficult. Some cases may be more clear-cut than others. For example, as noted by a participant discussing Web 2.0 challenges at a recent conference sponsored by DHS, the Privacy Act clearly applies to systems owned and operated by the government that make use of Web 2.0 technologies. Government agencies may also take advantage of commercial Web 2.0 offerings, in which case they are likely to have much less control over the systems that maintain and exchange information. For example, a government agency that chooses to establish a presence on a third party provider’s service, such as Facebook, could have limited control over what is done with its information once posted on the electronic venue. Given this limited control, key officials we interviewed said they are unsure about the extent to which personal information that is exchanged in such forums is protected by the provisions of the Privacy Act. Ensuring that agencies are taking appropriate steps to limit the collection and use of personal information through social media. Privacy could be compromised if clear limits are not set on how the government uses personal information to which it has access in social networking environments. Social networking sites, such as Facebook, encourage people to provide personal information that they intend to be used only for social purposes. Government agencies that participate in such sites may have access to this information and may need rules on how such information can be used. While such agencies cannot control what information may be captured by social networking sites, they can make determinations about what information they will collect and what to disclose. However, unless rules to guide their decisions are clear, agencies could handle information inconsistently. Individual privacy could be affected, depending upon whether and how government agencies collect or use personal information disclosed by individuals in interactive settings. Extending privacy protections to the collection and use of personal information by third party providers. Individuals interacting with the government via Web 2.0 media may provide personal information for specific government purposes and may not understand that the information may be collected and stored by third-party commercial providers. It also may not be clear as to whose privacy policy applies when a third party manages content on a government agency Web site. Accordingly, agencies may need to be clear about the extent to which they make use of commercial providers and the providers’ specific roles. Uncertainty about who has access to personal information provided through agency social networking sites could diminish individuals’ willingness to express their views and otherwise interact with the government. Safeguarding personal information from security threats that target Web 2.0 technologies. Federal government information systems have been targeted by persistent, pervasive, aggressive threats. In addition, as the popularity of social media has grown, they have increasingly been targeted as well. Thus as agencies make use of Web 2.0 technologies, they face persistent, sophisticated threats targeting their own information as well as the personal information of individuals interacting with them. The rapid development of Web 2.0 technologies makes it challenging to keep up with the constantly evolving threats deployed against them and raises the risks associated with government participation in such technologies. Further, the Federal Information Security Management Act states that agencies are responsible for the security of information collected or maintained on their behalf and for information systems used or operated on their behalf. The extent to which FISMA makes federal agencies responsible for the security of third-party social media Web sites may depend on whether such sites are operating their systems or collecting information on behalf of the federal government, which may not be clear. Training government participants on the proper use of social networking tools. Use of Web 2.0 technologies can result in a blending of professional and personal use by government employees, which can pose risks to their agencies. When an individual identifies him- or herself on a social media site as a federal employee, he or she provides information that may be exploited in a cyber attack on the agency. However, federal guidance may be needed for employees on how to use social media Web sites properly and how to handle personal information in the context of social media. In addition, training may be needed to ensure that employees are aware of agency policies and accountable for adhering to them. Determining requirements for preserving Web 2.0 information as federal records. A challenge associated with government use of Web 2.0 technologies, including government blogs and wikis and Web pages hosted by commercial providers, is the question of whether information exchanged through these technologies constitute federal records pursuant to the Federal Records Act. The National Archives and Records Administration (NARA) has issued guidance to help agencies make decisions on what records generated by these technologies should be considered agency records. According to the guidance, records generated when a user interacts with an agency Web site may form part of a set of official agency records. NARA guidance also indicates that content created with interactive software on government Web sites is owned by the government, not the individuals who created it, and is likely to constitute agency records and should be managed as such. Given these complex considerations, it may be challenging for federal agencies engaging the public via Web 2.0 technologies to assess the information they generate and receive via these technologies to determine its status as federal records. Establishing mechanisms for preserving Web 2.0 information as records. Once the need to preserve information as federal records has been established, mechanisms need to be put in place to capture such records and preserve them properly. Proper records retention management needs to take into account NARA record scheduling requirements and federal law, which requires that the disposition of all federal records be planned according to an agency schedule or a general records schedule approved by NARA. The records schedule identifies records as being either temporary or permanent and sets times for their disposal. These requirements may be challenging for agencies because the types of records involved when information is collected via Web 2.0 technologies may not be clear. For example, part of managing Web records includes determining when and how Web “snapshots” should be taken to capture the content of agency Web pages as they existed at particular points in time. Business needs and the extent to which unique information is at risk of being lost determine whether such snapshots are warranted and their frequency. NARA guidance requires that snapshots be taken each time a Web site changes significantly; thus, agencies may need to assess how frequently the information on their sites changes. Comments by individuals on agency postings may need to be scheduled in addition to agency postings. In the case of a wiki, NARA guidance requires agencies to determine whether the collaborative wiki process should be scheduled along with the resulting final product. In addition, because a wiki depends on a collaborative community to provide content, agencies are required to make determinations about how much content is required to make the wiki significant or “authoritative” from a record perspective. The potential complexity of these decisions and the resulting record-keeping requirements and processes can be daunting to agencies. Ensuring proper adherence to the requirements of FOIA. Federal agencies’ use of Web 2.0 technologies could pose challenges in appropriately responding to FOIA requests. Determining whether Web 2.0 records qualify as “agency records” under FOIA’s definition is a complex question. FOIA’s definition focuses on the extent to which the government controls the information in question. According to the Department of Justice’s FOIA guidance, courts apply a four-part test to determine whether an agency exercises control over a record. They examine: (a) who created the record and the intent of the record creator; (b) whether the agency intended to relinquish control; (c) the agency’s ability to use or dispose of the record; and (d) the extent to which the record is integrated into the agency’s files. Agency “control” is also the predominant consideration in determining whether information generated or maintained by a government contractor is subject to FOIA’s requirements. Given the complexity of these criteria, agencies may be challenged in making appropriate FOIA determinations about information generated or disseminated via Web 2.0 technologies. If not handled properly, such information may become unavailable for public access. As federal agencies have increasingly adopted Web 2.0 technologies, often by making use of commercially provided services, information technology officials have begun to consider the array of privacy, security, records management, and freedom of information issues that such usage poses. Once these issues are understood, measures can then be developed and implemented to address them. Several steps have been taken to identify these issues and to begin developing processes and procedures to address them: In June 2009, DHS hosted a two-day public workshop to discuss ● leading practices for the use of social media technologies to further the President’s Transparency and Open Government Initiative. The workshop consisted of panels of academic, private-sector, and public-sector experts and included discussions on social media activities of federal agencies and the impact of those activities on privacy and security. In November 2009, DHS released a report summarizing the findings of the panels and highlighting potential solutions. According to a DHS official involved in coordinating the workshop, the array of issues raised during the workshop—which are reflected in the challenges I have discussed today—remain critically important to effective agency use of Web 2.0 technologies and have not yet been fully addressed across the government. ● NARA has issued guidance outlining issues related to the management of government information associated with Web 2.0 use. The agency recently released a brief document, Implications of Recent Web Technologies for NARA Web Guidance, as a supplement to its guidance to federal agencies on managing Web-based records. The document discusses Web technologies used by federal agencies—including Web portals, blogs, and wikis—and their impact on records management. NARA officials recognize that the guidance does not fully address more recent Web 2.0 technologies, and they said the agency is currently conducting a study of the impact of those technologies and plans to release additional guidance later this year. ● that it had negotiated terms-of-service agreements with several social networking providers, including Facebook, MySpace, and YouTube. The purpose of these agreements was to provide federal agencies with standardized vehicles for engaging these providers and to resolve legal concerns raised by following the terms and conditions generally used by the providers, which posed problems for federal agencies, including liability, endorsements, advertising, and freedom of information. As a result, other federal agencies can take advantage of these negotiated agreements when determining whether to use the providers’ services. In April 2009, the General Services Administration announced ● The Office of Management and Budget (OMB), in response to President Obama’s January 2009 memorandum promoting transparency and open government, recently issued guidance intended to (1) clarify when and how the Paperwork Reduction Act of 1995 (PRA) applies to federal agency use of social media and Web-based interactive technologies; and (2) help federal agencies protect privacy when using third-party Web sites and applications. Specifically, a memo issued in April 2010 explained that certain uses of social media and web-based interactive technologies would not be treated as “information collections” that would otherwise require review under the PRA. Such uses include many uses of wikis, the posting of comments, the conduct of certain contests, and the rating and ranking of posts or comments by Web site users. It also states that items collected by third party Web sites or platforms that are not collecting information on behalf of the federal government are not subject to the PRA. In addition, a memorandum issued by OMB in June 2010 called for agencies to provide transparent privacy policies, individual notice, and a careful analysis of the privacy implications whenever they choose to use third-party technologies to engage with the public. The memo stated—among other things—that prior to using any third-party Web site or application, agencies should examine the third-party’s privacy policy to evaluate the risks and determine whether it is appropriate for agency use. Further, if agencies post links on their Web sites that lead to third-party Web sites, they should notify users that they are being directed to non-government Web sites that may have privacy policies that differ from the agency’s. In addition, the memo required agencies to complete a privacy impact assessment whenever an agency’s use of a third- party Web site or application gives it access to personally identifiable information. In summary, federal agencies are increasingly using Web 2.0 technologies to enhance services and interactions with the public, and such technologies have the potential to transform how federal agencies engage the public by allowing citizens to become more involved in the governing process and thus promoting transparency and collaboration. However, determining the appropriate use of these new technologies presents new potential challenges to the ability of agencies to protect the privacy and security of sensitive information, including personal information, shared by individuals interacting with the government and to the ability of agencies to manage, preserve, and make available official government records. Agencies have taken steps to identify these issues and begun developing processes and procedures for addressing them. Until such procedures are in place, agencies will likely continue to face challenges in appropriately using Web 2.0 technologies. We have ongoing work to assess these actions. Mr. Chairman, this concludes my statement. I would be happy to answer any questions you or other Members of the Subcommittee may have. If you have any questions regarding this testimony, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other individuals who made key contributions include John de Ferrari (Assistant Director), Sher`rie Bacon, Marisol Cruz, Susan Czachor, Fatima Jahan, Nick Marinos, Lee McCracken, David Plocher, and Jeffrey Woodward. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: "Web 2.0" technologies--such as Web logs ("blogs"), social networking Web sites, video- and multimedia-sharing sites, and "wikis"--are increasingly being utilized by federal agencies to communicate with the public. These tools have the potential to, among other things, better include the public in the governing process. However, agency use of these technologies can present risks associated with properly managing and protecting government records and sensitive information, including personally identifiable information. In light of the rapidly increasing popularity of Web 2.0 technologies, GAO was asked to identify and describe current uses of Web 2.0 technologies by federal agencies and key challenges associated with their use. To accomplish this, GAO analyzed federal policies, reports, and guidance related to the use of Web 2.0 technologies and interviewed officials at selected federal agencies, including the Department of Homeland Security, the General Services Administration, and the National Archives and Records Administration. Federal agencies are using Web 2.0 technologies to enhance services and support their individual missions. Federal Web managers use these applications to connect to people in new ways. As of July 2010, we identified that 22 of 24 major federal agencies had a presence on Facebook, Twitter, and YouTube. Several challenges in federal agencies' use of Web 2.0 technologies have been identified: (1) Privacy and security. Agencies are faced with the challenges of determining how the Privacy Act of 1974, which provides certain protections to personally identifiable information, applies to information exchanged in the use of Web 2.0 technologies, such as social networking sites. Further, the federal government may face challenges in determining how to appropriately limit collection and use of personal information as agencies utilize these technologies and how and when to extend privacy protections to information collected and used by third-party providers of Web 2.0 services. In addition, personal information needs to be safeguarded from security threats, and guidance may be needed for employees on how to use social media Web sites properly and how to handle personal information in the context of social media. (2) Records management and freedom of information. Web 2.0 technologies raise issues in the government's ability to identify and preserve federal records. Agencies may face challenges in assessing whether the information they generate and receive by means of these technologies constitutes federal records and establish mechanisms for preserving such records, which involves, among other things, determining the appropriate intervals at which to capture constantly changing Web content. The use of Web 2.0 technologies can also present challenges in appropriately responding to Freedom of Information Act (FOIA) requests because there are significant complexities in determining whether agencies control Web 2.0-generated content, as understood within the context of FOIA. Federal agencies have begun to identify some of the issues associated with Web 2.0 technologies and have taken steps to start addressing them. For example, the Office of Management and Budget recently issued guidance intended to (1) clarify when and how the Paperwork Reduction Act of 1995 applies to federal agency use of social media and Web-based interactive technologies; and (2) help federal agencies protect privacy when using third-party Web sites and applications.