The Copyright Office was established in 1897, and is currently one of seven service units within the Library of Congress. To carry out its mission, the Copyright Office has several functions set out in law, including (1) administering the nation’s copyright registration and recordation processes, (2) developing regulations related to copyright policies and procedures, (3) advising Congress on copyright issues, and (4) administering statutory licenses for cable and satellite retransmissions and digital audio recording technology. Importantly, the Copyright Office is also a driver in adding materials to the Library’s collections, as about 20 percent of these works are received in accordance with the legal requirement that copies of certain copyrighted works be deposited with the office for the Library. The Copyright Office is charged with administering the nation’s copyright law. As part of that responsibility, it performs a number of key functions, including copyright registration, recordation, and statutory licensing. Registration. The Copyright Office examines applications for registering copyrights, along with any accompanying copies of the work (called the deposit), to determine whether they satisfy statutory requirements. Copyright registration is a legal formality intended to make a public record of the basic facts of a particular copyright, but is not required by law or as a condition of copyright protection. According to the Copyright Office, in fiscal year 2014, the Copyright Office registered about 476,000 creative works for copyright, including about 219,000 literary works and 65,000 sound recordings. Recordation. Authors, heirs, and other parties submit a variety of documents to the Copyright Office for public recordation, including copyright assignments, licenses, security interests, and termination of transfers. Like registration, a copyright owner is not required to record such changes to ownership, but there are certain incentives in the law for those who do. The Copyright Office recorded about 7,600 copyright records in fiscal year 2014. Statutory Licenses. The Copyright Office administers several statutory licenses set forth in the Copyright Act that manage and disperse royalty payments, including those pertaining to copyright owners’ rights related to television programming that is retransmitted by cable operators and satellite carriers. The disposition of these private funds is determined by a board of copyright royalty judges, called the Copyright Royalty Board. The work of the board is reviewable by the Register, but the board reports to the Librarian as head of the agency. According to the Copyright Office, in fiscal year 2014, it collected approximately $315 million in royalties and made disbursements in accordance with the decisions of the Copyright Royalty Board. In addition to registration, recordation, and statutory licensing, the office also performs other functions. For example, the Register is charged with advising Congress on national and international issues relating to copyright and provides assistance to federal departments, the judiciary, and the public on such topics. The office also requests published works on behalf of the Library of Congress to meet the mandatory deposit provisions of the Copyright Act. The Copyright Office, by law, is part of the Library of Congress. The Register of Copyrights, who heads the office, and all other employees of the office are appointed by the Librarian of Congress and act under the Librarian’s general direction and supervision. While the Register is responsible for all administrative functions and duties under the Copyright Act (except as otherwise specified), all regulations established by the Register are subject to the approval of the Librarian, who is also directed by law to make rules and regulations for the government of the Library. The Register relies on about 380 staff across seven program areas to carry out the office’s mission. A simplified view of the office’s organization is provided in figure 1. The seven program areas have various responsibilities related to meeting the Copyright Office’s statutory mission. A description of the key responsibilities of each program area is found in table 1. The Copyright Office also receives support from the Library’s administrative offices. For example: The Library’s Office of Human Resources Services develops policies and procedures for and supports hiring, pay, and benefits. The Library’s Office of the Chief Financial Officer is responsible for providing policy direction, review, and coordination of all budgetary and financial activities of the Library, including the development of the budget and tracking of expenditures. The Library’s Office of Integrated Support Services provides assistance with procurement, physical space utilization, and management of mail. The Library’s Office of Information Technology Services (ITS) has primary responsibility for the planning, analysis, design, development, and maintenance of software systems, hardware, telecommunications, and networks. The Copyright Office is funded both by direct appropriations and fees paid by external customers. Congress generally limits the amount of fees that the office may obligate in a given year. The office’s budget for fiscal year 2014 was about $45 million, with about 62 percent ($27.9 million) coming from fees. The Copyright Office uses its IT systems to meet important mission requirements that have been established in law. For example, the Copyright Act requires the office to receive and examine copyright registration applications. To meet these mission requirements, the office relies on several mission-related systems, as well as servers, networks, and the data center managed by the Library’s central IT office—ITS. However, we and others have identified challenges with this environment. For example, external users have described limitations in the performance and usability of the office’s registration system, and the Copyright Office has expressed concerns about the integrity of the files stored in the Library’s servers. Organizationally, responsibility for managing the office’s IT environment is shared between the Copyright Office’s Office of the CIO and ITS. However, as we recently reported, the Library has serious weaknesses in its IT management, which have also hindered the ability of the Library and the Copyright Office to meet mission requirements. For example, the Library has not had a permanent CIO in over 2 years and instead has had a series of temporary CIOs; according to the Register of Copyrights, this has caused a breakdown in communication between Library management and the Copyright Office related to IT. The Copyright Office’s use of IT is driven by legal requirements that establish its responsibilities and corresponding business needs. The office’s IT environment reflects more than a decade of efforts to increase the use of automated IT to fulfill this legally established mission. For example, by law, the office must be able to receive and examine copyright registration applications, collect and maintain deposited copies of copyrighted works as necessary to support the production of “facsimile reproductions” and retention of works up to 120 years, produce certificates of registration and certified copies of applications, maintain records of the transfer of copyright ownership. In addition, the Copyright Office also administers the mandatory deposit provisions of the Copyright Act, which require copyright owners to deposit certain published works with the Library of Congress for its collections. In this role, the office may facilitate, demand, negotiate, or exempt the provision of these copies. Absent an exemption, the law requires that one or two copies of the best edition of every copyrightable work published in the United States be sent to the office within 3 months of publication, regardless of whether the creator registers the work. This mandatory deposit requirement is designed, in part, to serve the Library. Specifically, according to the Copyright Office, copyright deposit (whether through registration or mandatory deposit) is a means by which the Library obtains about 20 percent of its collections. While the Copyright Office resides within the Library of Congress, it also has responsibilities that distinguish it from the Library. For example, all actions taken by the Register to implement the Copyright Act are subject to the provisions of the Administrative Procedure Act. Among other things, this means that all actions of the office that would constitute a rule generally must be published for public notice and comment and are subject to review. It also means that copyright-related records are governed by the Freedom of Information Act and the Privacy Act, which are included in the Administrative Procedure Act. These legal requirements necessitate actions by the Copyright Office that differ from otherwise-standard Library processes. The Copyright Office relies extensively on IT to carry out its legal responsibilities. Specifically, the office uses multiple systems to, among other things, allow the public to electronically register works with the office, assist it in examining copyright registrations for such submissions, and allow the office to record documentation related to copyright transfers and provide that information to the public. The office manages mission- related systems and, in some cases, procures its own equipment, which is hosted within the Library’s infrastructure (i.e., networks, telecommunications, and data center). Table 2 describes selected systems used by the office to support its registration, recordation, and licensing functions. The office uses these systems to meet its major statutory responsibilities, as described below: Registration. The primary system used in the registration process is eCO. To register a copyright, a creator generally submits a completed application, the relevant fee, and the deposit copies to the Copyright Office. This can be done in one of three ways: (1) by submitting all three of these items in physical form (e.g., paper); (2) by submitting all three items online (through eCO); or (3) by submitting the application and fee online and providing the deposit in physical form. Copyright Office staff process these materials based on the method of submission. For example, for applications received in physical form, Copyright Office staff must scan the application, enter the application information and fee payment (check, cash, or deposit account) into eCO, manually process the related fees, and affix a barcode to the deposit copy. Regardless of how the materials are submitted, a registration specialist uses the eCO system to validate the accuracy of the information entered into eCO and review the application and materials to ensure that they meet the criteria for copyright protection. Printed registration certificates are generated and mailed to the recipient designated on the application, and an image of the certificate is stored in the Copyright Imaging System. If the deposit was provided in physical form and is not selected for the Library’s collections, it is stored in a warehouse and tracked using either eCO or the Box Number Control System. Digital deposits are stored in servers within the Library of Congress’s data center. Information about the copyright registration (for example, author names and titles of work) is also made available online to the public through the Copyright Voyager system. Figure 2 below depicts the copyright registration process. Recordation. Copyright Office staff currently use several systems to record documents related to changes in copyright. The public, however, must submit the documentation to be recorded in physical form since there is currently no online means for doing so. Specifically, to record a document, an individual must submit the related documentation (with an original signature) and the relevant fee. Once received by the Copyright Office, the documents must be scanned and the information must be entered into either eCO or several legacy systems. Copyright Office officials stated that they are incorporating the functionality of most of the registration and recordation systems into eCO. During the transition, however, Copyright Office staff must use one of two parallel business processes to record copyright changes. Specifically, if the Copyright Office received a document during or prior to January 2013, Copyright staff must type the information into the Copyright Office Documents System, and the documentation must be scanned twice—once into eCO and once into the Copyright Imaging System. Then the specialist must manually number the document and assemble the recordation package (including certificate, cover sheet, and numbered document) to be sent back to the submitter. If the office received the document after January 2013, all data entry and scanning is completed in eCO, and the recordation package is electronically bundled, printed, and sent back to the submitter. Similar to the registration process, once the change is processed, the information is available to the public using the Copyright Voyager system, which is available online (see fig. 3). Licensing. Licensing Division staff members examine statements of account and process royalty payments. Since 1992, licensing staff have used the Licensing Division System to examine and process statements of account. In 2010, the Copyright Office began an initiative to reengineer its licensing business processes and develop a new system (called the Electronic Licensing Information System) to replace the Licensing Division System. The office launched a pilot of the new system in October 2014 and plans to use information gathered during that pilot to improve the new system before its deployment. According to Copyright Office staff, the office has recently taken steps to incorporate the functionality from all registration and recordation systems into eCO. Specifically, according to Copyright Office officials, most of the systems supporting the registration and recordation processes were developed in the 1990s, have far exceeded their shelf-life, are running on obsolete technology, and do not meet current security standards required by Library policy. Because of these limitations, as already noted, the Copyright Office plans to incorporate the functionality of these legacy systems into eCO and ultimately retire them, with the changes expected to be completed by January 2016. According to the Director of the Office of Public Records and Repositories at the Copyright Office, moving the recordation functionality to eCO is an interim step to address immediate needs. In addition, the Copyright Office CIO stated that supporting the transition of legacy system functions has required the office to divert resources otherwise intended to make updates to eCO. Our work, Copyright Office employees, and external users have all identified challenges with the Copyright Office’s current IT environment, including eCO and the infrastructure supporting that system that is managed by the Library’s central IT office (ITS), as described below: Both internal and external users have described challenges with eCO related to performance, stability, and usability. For example, internal registration staff said that eCO sometimes freezes multiple times a day, requiring the staff to restart the system or their computers, which ultimately decreases productivity. ITS officials noted that they plan to move eCO onto its own data storage server in an attempt to temporarily address these issues. However, there is disagreement about whether this will fix the problem, since the underlying cause was never identified. ITS officials stated that the suspected underlying cause of the issue is within the eCO system, which is managed by the Copyright Office, and that this is just a temporary solution. However, the Copyright Office CIO disagrees, and believes that eCO having its own server will fix this problem. Other users of eCO internal to the Copyright Office have also experienced issues with the system. For example, according to one of the office’s registration specialists, eCO’s interface requires them to input the same information multiple times on multiple screens. He noted that this type of re-work takes additional time and increases the chance of errors. External users have also described challenges with eCO. For example, in an online survey by the Copyright Office, 35 percent of eCO users were dissatisfied with the ease of use of eCO. One respondent stated that “this is, hands down, the worst site I have ever had to navigate” and noted that it took the individual 4 hours to submit the registration application. In our March 2015 report on the Library of Congress’s IT management, we determined that while the Library had established a security and privacy program that covers service units, including the Copyright Office, it had not fully implemented management controls to ensure the protection of its systems and information, including both the front-end eCO system and the infrastructure that stores copyright deposits. For example, as of February 2015 the Copyright Office did not have necessary security documentation for eCO, including (1) complete security testing, (2) a current authorization to operate, and (3) a privacy impact assessment. More generally, the Library did not always require two-factor authentication for access to sensitive Library resources, establish and implement a process for documenting approvals for permissions to access systems, or ensure that sensitive information transmitted across its network was being adequately encrypted. These limitations increase the risk that Library systems—including those used by the Copyright Office—will not limit access appropriately and that an individual could gain unauthorized access to system data. To address these issues, we made a number of recommendations to better protect the Library’s IT systems and reduce the risk that the information they contain will be compromised. Both the Copyright Office and ITS recently identified data integrity issues when performing analyses of the eCO system. For example, one analysis found that eCO was not properly saving registration certificates, although the root cause was not identified. In addition, the Copyright Office’s General Counsel stated that the Library has used settings and controls that do not provide a sufficient level of integrity for the office’s digital records, and that the Copyright Office does not have means of verifying the integrity of files maintained in those systems. The Copyright Office has a legal responsibility to retain unpublished works (including digital works) for the length of the copyright, which could be as long as 120 years. A report developed by a contractor for ITS noted that no current technology exists that would allow for digital deposits to be stored for the required length of time. According to the report, maintaining access to the deposits in the future requires migration to new storage solutions as technology evolves. Although the Copyright Office has communicated this requirement to ITS, a service-level agreement for this requirement has not been established between ITS and the Copyright Office. These technical challenges and the need for improvements have been acknowledged both by the current Register of Copyrights and by the office’s external stakeholders. For example, in October 2011, the Register released a document identifying a series of priorities and special projects intended to improve the quality and efficiency of the office’s services. The special projects included, among others, the need for technical upgrades to the eCO registration system and reengineering of the recordation process. Further, in March 2013, the Copyright Office solicited public comments on the electronic registration and recordation functions. The comments received, which the Copyright Office made publicly available on its website, ranged from basic frustrations with eCO, such as the need to make the workflow viewable throughout the registration process, to requests for new features, such as instant message, video communication, webinars, and customer support during West Coast hours. In November 2013, the Register reiterated the need for technical improvements. Specifically, she stated that the Copyright Office’s technical capacities, such as its bandwidth, networking equipment, electronic storage capacity, hardware, and software, do not fully accommodate services such as registration that require short-term and long-term solutions. In a September 2014 hearing before the House Judiciary Committee, the Register further discussed the need to modernize the Copyright Office, because of issues with the registration user interface, the quality of public records, security concerns, interoperability, and overall customer service. The Register also discussed backlogs in processing registration and recordation documents, specifically stating that such issues relating to recordation are systemic and cannot be improved until the recordation system is redesigned and brought online. Finally, in December 2014, the Copyright Office developed a report that described the need to reengineer the recordation process, including potentially making changes to the law. This report was informed by, among other things, public comments provided in response to a Federal Register notice and roundtable meetings. This report also discussed shortcomings in the current recordation process described by the public, including the time it takes for the office to process these documents, the difficulties in submitting the documents in physical form, and inaccuracies caused by recordation specialists transcribing the physical documents. As noted previously, responsibilities for managing IT at the Copyright Office are shared between Copyright Office staff and organizations at the broader Library level. For example, the Copyright Office manages many of its systems, while ITS manages and controls the infrastructure (e.g., networks, servers, and data center) on which the systems and applications reside. Within the Copyright Office, the Office of the CIO is responsible for advising the Register on the development and implementation of technology policy, providing strategic direction for the office’s IT initiatives, and serving as a liaison with ITS. The CIO office has 21 staff that manage several of the Copyright Office’s IT systems, most notably eCO, and assume overall responsibility for operating the systems at an acceptable level of risk for the office. Importantly, Copyright Office staff are in charge of ensuring that systems they are responsible for are developed in accordance with, and comply with, the Library’s information security policies. In addition, the Copyright CIO office manages a help desk specifically for the eCO system, which fields technical help requests from both internal Copyright Office staff and public users of the system. The Copyright CIO office also has an internal review board that selects and manages proposed modifications to any Copyright Office systems and an eCO steering committee, which meets monthly to discuss changes to that system. According to the Copyright Office CIO, in fiscal year 2015, the office will establish a Copyright IT steering committee, which will review proposed new technology initiatives for the Copyright Office and oversee them from planning to retirement. The Copyright Office, as a service unit within the Library of Congress, is subject to the organization’s IT policies and procedures. For example: The Library has developed Library-wide policies and procedures for IT management that cover service units, including the Copyright Office. Specifically, the Library’s IT Steering Committee is responsible for overseeing an IT investment management process to provide structure for the selection and management of all major Library IT investments and oversight of their performance. The Library has developed an information security program, assigned responsibility for ensuring that the security program is being implemented to the Librarian, and assigned specific responsibilities to various individuals within the Library. For example, the Library’s CIO is responsible for overseeing the program, and the Library’s Chief Information Security Officer is to act as a single point of contact for all information security activities. In addition, the Copyright Office relies on ITS for IT support. Specifically, ITS has responsibility for maintaining certain systems within the service units. For example, ITS has developed several of the Copyright Office’s mission-related IT systems and is also responsible for maintaining some of them (with the Copyright Office maintaining others). In addition, ITS is responsible for maintaining the hosting environment (including the data center, networks, and telecommunications) that supports the Copyright Office’s systems. For example, although the Copyright Office is responsible for maintaining the eCO system and making necessary changes to the interface, ITS is responsible for the underlying servers that store copyright deposits. Finally, ITS provides other services to support Copyright Office staff, including e-mail and help desk support. In our recent evaluation of the Library’s IT management, we identified challenges with the level of IT governance that adversely affected the Library’s ability to efficiently and effectively manage its IT resources, including its ability to support the IT needs of its service units. These issues have in turn affected the Copyright Office’s ability to carry out its responsibilities. Specifically, our report identified the following challenges: The Library does not have the leadership needed to address IT management weakness. For example, the Library CIO does not have responsibility for all of the Library’s commodity IT or the ability to adequately oversee mission-specific system investments made by the service units. Also, the Library has not had a permanent CIO in over 2 years. Since the departure of the most recent permanent CIO in 2012, four individuals have served as acting CIO, and another was recently appointed to serve in an interim capacity until a permanent CIO is found. According to the Register, the absence of a permanent CIO has resulted in a lack of routine communication between senior Library and Copyright leadership about IT. In addition, the Library has not clearly defined the responsibilities and authorities governing the relationship of the Library CIO and component organizations. Of particular concern is the lack of clearly defined relationships between the Library CIO and the two service unit CIO positions at the Library, one of which is the Copyright CIO. From the Copyright Office’s perspective, the lack of clearly defined roles and responsibilities at the Library has impeded its ability to carry out its mission. According to the Register, because the Copyright Office has unique statutory requirements and business needs, IT issues should not be decided solely by Library staff outside of the Copyright Office or simply according to an internal Library regulation. For example, the Library’s requirement that the Copyright Office provide “best editions” for deposits that are to be added to the Library’s collection has been interpreted to mean that these deposits should be provided in hard copy. However, according to the General Counsel of the Copyright Office, this requirement is a chief cause of delays in processing registration applications and hampers the ability of the office to modernize the copyright registration system and move to a fully electronic process. In addition, according to the Copyright Office’s General Counsel, as a result of its subordinate status within the Library of Congress, the Copyright Office lacks adequate control over mission-critical IT resources and decisions, thus frustrating its basic statutory purpose of creating, maintaining, and making available to the public an authoritative record of copyright ownership and transactions. For example, Copyright Office staff expressed concerns regarding ITS’s control of servers containing its deposit files. Specifically, the Copyright CIO noted that ITS employees recently moved Copyright Office deposits from the existing storage server without the permission of the office, raising concerns about the integrity and security of these files. We also reported that the Library lacks a strategic plan to guide its IT investments. An IT strategic plan has been drafted, but it does not identify strategies for achieving defined goals and interdependencies among projects. According to the Librarian of Congress, the draft IT plan was merely a starting point for the Library’s IT strategic planning efforts, and in January 2015, the Librarian’s Chief of Staff stated that the Library plans to draft a new strategic plan within 90 days. The Register has noted that it has been difficult for the Copyright Office to develop any long-term plans for improving the office’s IT environment because the Library does not have overarching long-term IT plans. In addition, our report found that the Library’s central IT office—ITS—had not ensured that its services support the business needs of the Library, and had not established complete service-level agreements with its customers (i.e., the service units). For example, ITS had one service- level agreement with the Copyright Office for the eCO system; however, that agreement was incomplete. Specifically, the service-level agreement did not include all of the services that ITS provides to the Copyright Office. As a result, services that ITS provides to the Copyright Office may not be meeting the office’s business needs. For example, according to the Copyright CIO, ITS controls when eCO is to be shut down for maintenance and outages had, at times, been scheduled during periods of heavy traffic from the office’s external users. Finally, our report found that inconsistent satisfaction with the services provided by ITS had likely contributed to duplicative or overlapping efforts across the Library. Specifically, service units across the Library performed many of the same functions as ITS; for example, the Copyright Office provides Internet management and desktop support services, which overlap similar services by ITS. In addition, service units within the Library had purchased their own commodity IT in the past 3 years. For example, the Copyright Office had purchased laptops, mobile devices, servers, and workstation software, even though these may be duplicative of those that the Library has procured. Our report also raised questions about recent budget requests made by the Copyright Office, and whether those proposed requests may create additional services that overlap those already provided by ITS. In our report on the Library’s IT management, we made a number of recommendations to address the weaknesses we identified. These included, among others, appointing a senior executive for IT (i.e., a CIO) who has responsibility for commodity IT throughout the Library and clarifying the relationship between that official and IT leadership at the service unit level; fully establishing and implementing a Library-wide approach to service-level agreements; and conducting a review of the Library’s IT portfolio to identify potential areas of duplicative activities and spending. Although the Copyright Office has acknowledged many of the reported organizational and technical challenges we have identified previously, the office has not yet developed plans to improve its IT environment. Specifically, while the office has identified several proposed IT initiatives for improving its IT environment and requested over $7 million to fund these initiatives, it has not yet developed plans and proposals to justify these investments, including identifying the business need they will meet and their expected costs and benefits. The office also did not present the initiatives to the Library’s IT Steering Committee for review as required by Library policy. By identifying mission needs and plans in investment proposals and charters, decision makers at the Library and the Copyright Office would have greater assurance that the selected investments meet these mission needs. In addition, the office has not yet developed an IT strategic plan to help ensure that its IT goals are aligned with the agency’s strategic goals, stating that it is difficult to do so when the Library does not yet have an IT strategic plan. We agree that the Copyright Office’s IT strategic planning should be aligned with the Library’s own efforts in this regard. Developing a strategic plan that is aligned with the Library’s forthcoming efforts will help the Copyright Office ensure that current and future investments aimed at improving its IT will support its mission needs, as well as avoiding duplication with existing activities within the Library. According to Copyright Office officials, the office requested funding for four initiatives to address immediate technical challenges: (1) reengineering the recordation function, (2) developing a secure digital repository for digital deposits, (3) developing a software application development environment, and (4) developing a data management team. In total, the office requested over $7 million in funding for both fiscal years 2015 and 2016 in support of these four IT initiatives. The office developed brief summaries supporting these requests, which described the initiatives as follows: Reengineering the recordation function. This investment involves reengineering the business process from an IT, legal, and administrative perspective, and ultimately developing an online filing system. To inform this effort, the office solicited public comments on the current recordation process through a Federal Register notice and through roundtable discussions in 2014. This information was used to develop a report regarding limitations in the current process and high- level requirements for an electronic recordation system. The office requested $1.5 million to conduct business analysis for recordation reengineering in fiscal year 2015, and received that amount in its appropriations. The Library requested an additional $676,000 for this effort in its fiscal year 2016 budget justification. Developing a secure digital repository for digital deposits. This investment focuses on the secure transfer and storage of digital works that are registered and electronically deposited with the Copyright Office for protection. The office noted that the analysis stage would determine whether the appropriate solution includes using cloud- based providers or investing in additional hardware. The office requested $3.07 million in fiscal year 2015, but did not receive funding for this investment. The office submitted a new request in fiscal year 2016 for $2.64 million, but did not receive approval for including this initiative in the Library’s proposed budget to Congress. Developing a software application development environment. This investment would create a development environment for all future copyright-specific applications (e.g., an online system for the recordation process). According to the office, this requires an investment in hardware, software, and personnel. The office requested $2.43 million in fiscal year 2015, but did not receive funding for this investment. The office submitted a new request in fiscal year 2016 for $2.22 million, but did not receive approval for including this initiative in the Library’s proposed budget to Congress. Developing a data management team. This investment includes the development of a data strategy for the Copyright Office’s public records, a data management plan, a data governance plan, a data model, data standards, and data exchanges. The office estimates that additional IT infrastructure may be required, but has not determined whether the cloud is the appropriate solution. The office requested $2.80 million in fiscal year 2016 for this investment, but did not receive approval for including this initiative in the Library’s proposed budget to Congress. In addition, since being appointed to the position in 2011, the Register of Copyrights has acknowledged the technical challenges facing the office and described the need for improvements in its technology. For example, in October 2011 the Register announced a series of special projects, including performing research on technical upgrades to electronic registration. As part of this technical upgrades research project, in March 2013 the office requested public comments on the current registration process through a Federal Register notice. In February 2015, the office published the results of its research that, according to the CIO, either directly or indirectly address concerns voiced by copyright stakeholders. According to the report developed by the CIO, the research identified four IT areas in greatest need of improvement: (1) challenges with the current user experience, (2) challenges with access to and the usability of copyright records, (3) inefficiencies with current copyright data, and (4) poor performance of outdated IT architecture and infrastructure. The report also identified a number of proposed recommendations to improve in these areas, including, among other things, improving eCO’s user interface; ensuring that the office’s public record databases show accurate, complete, and up-to-date information; establishing effective data standards; and developing a secure repository for digital deposits. Best practices we have identified for IT investment management note that mature organizations analyze and prioritize IT investments before selection. For example, before committing significant funds to any project, organizations should select IT projects based on quantitative and qualitative criteria, such as expected costs, benefits, schedule, risks, and contribution to mission goals. Importantly, we have also reported that high-performing organizations manage investments in a portfolio approach through an investment review board. In this way, selection decisions can be made in the context of all other investments, thus minimizing duplication across investments. Consistent with these best practices, the Library has an established policy and process for service units to propose IT investments for selection through the Library’s IT Steering Committee, which acts as the agency’s investment review board. Specifically, before an investment is selected for funding, service units are to prepare (1) an investment proposal, which includes identifying the business problem, a proposed solution, the expected benefits, how the solution aligns with the Library’s strategic plan, initial 3-year cost estimate, and expected funding sources, and (2) an investment charter, which includes a budget plan and a cost-benefit analysis. The service units are also required to present this information to the Library’s IT Steering Committee, which makes recommendations for investments to be selected for funding. The Library’s central IT office— ITS—has also developed guidance for requirements development and analysis, which is to take place after the project has gone through the initiation and planning phases and the investment owner has already prepared the investment proposal and charter. However, in developing the funding requests for the four initiatives aimed at improving its IT environment, the Copyright Office did not follow the Library’s IT investment management policies for selecting investments. While the funding requests contained background information on the proposals, 1-year expected costs and, in some cases, expected benefits and categories of tasks to be completed within the first year (e.g., program management, analysis, and requirements development), they did not include all the key information required by Library policy for investment proposals and charters. For example, they did not include 3- year cost estimates, the business needs that drive the investments, details on how the investments aligned with the agency’s strategic plan, or the expected funding sources. Further, the office did not present any of these IT investments to the Library’s IT Steering Committee to be approved for funding, as required by Library policy. Both the Register and the Copyright CIO stated that the office is not yet in a position to prepare planning documentation for each of its proposed initiatives and that the Copyright Office planned to use the first year of funding to develop requirements. However, according to best practices and Library policy, the Copyright Office should identify the mission needs, cost estimates, and other information prior to selecting the investments and requesting funding, and should use this planning information as input into its requirements development and analysis. In addition, in the absence of critical information such as specific needs, costs, and benefits, it is unclear whether the office’s request to allocate about $7 million to these IT-related investments constitutes an effective and efficient use of Copyright Office and Library resources. Further, because the investments have not been reviewed by the Library’s IT investment review board and compared to the entire portfolio of IT systems, there is a risk that they may duplicate existing efforts within the agency. In this regard, our March 2015 report on the Library’s IT management noted that, for example, ITS has a software application development environment, and currently works with the Copyright Office to maintain digital deposits—efforts which appear to duplicate two of the Copyright Office’s budget requests. By identifying mission needs and plans in investment proposals and charters, and by presenting the requests to the IT Steering Committee as part of the Library’s investment selection process, decision makers at the Library and the Copyright Office would have greater assurance that the selected investments meet mission needs and do not duplicate existing efforts. Our experience with IT modernization efforts has shown that having sound management for planning, oversight, and reporting progress is essential to achieving successful outcomes. Requirements for executive branch agencies from law and Office of Management and Budget guidance reflect best practices and note that effective planning involves creating an IT strategic plan that includes goals, measures, and timelines in order to help the organization align its information resources with its business strategies and investment decisions. The Copyright Office has not yet developed an IT strategic plan that can be used to guide its IT improvement efforts and monitor progress in meeting its goals. According to the Register, the Copyright Office is currently drafting an overall strategic plan to be completed by the end of September 2015. However, the Register stated that it will not include plans about improving the Copyright Office’s IT environment. The Register further stated that it is difficult for the Copyright Office to develop full IT strategic planning documents because the Library of Congress has not yet developed such strategic plans for the entire organization. Finally, the Register stated that the IT goals of the Copyright Office will depend upon the duties it must carry out in coming years, many of which may change because of recent efforts in Congress to review federal copyright law. The Register added that the office’s general goal is to achieve greater control of its IT infrastructure and environment, helping the office to meet its statutory responsibilities. According to the Register, the Copyright Office needs dramatic improvements in the ways in which it registers works, collects copyright deposits, records licenses and other documents, presents the chain of title, administers statutory licenses, and otherwise administers the law. She stated that these changes will require statutory and regulatory changes as well as new models for IT governance and funding. We agree that the Copyright Office’s IT strategic planning should be aligned with the Library’s own ongoing efforts to develop an IT strategic plan for the entire organization. In our review of the Library’s IT management, we noted that the Library does not have an IT strategic plan and that efforts to develop such a plan have just recently begun. We also recognize that future legislation may have an impact on the office’s responsibilities in administering the law and, therefore, may affect the office’s future technology needs. Nonetheless, developing a strategic plan that is aligned with the Library’s forthcoming efforts will help to ensure that the Copyright Office’s current and future investments aimed at improving its IT will support its mission needs, as well as avoid duplication with existing activities within the Library. The Copyright Office has an important legal mission supporting the creative industries that significantly contribute to the United States economy, and the office relies heavily on IT to carry out this mission. However, its IT environment faces many technical and organizational challenges, which ultimately may affect the office’s ability to meet its legal mission. Copyright’s primary system—eCO—has had significant technical issues, both with the system itself—managed by the Copyright Office— and with its underlying infrastructure, managed by the Library’s central IT office. Even with all of the identified challenges, however, the office is adding significant new functionality onto this already-burdened system, by transferring legacy system functionality onto it. Significant IT management weaknesses of the Library exacerbate the technical issues, making it difficult for the Library and the Copyright Office to address the technical challenges. As we have already recommended, strong IT leadership within the Library and effective coordination with its service units is needed; otherwise, the Copyright Office will continue to face challenges in making the needed changes to its IT environment. Although the Copyright Office’s current IT environment is hampered by these challenges, the office has yet to develop plans to address the problems. The office has taken the first steps toward developing plans, by identifying a list of proposed technical upgrades and performing further research on one of the initiatives (recordation reengineering). However, it has been about 3 years since the Register of Copyrights identified the need for technical upgrades, and little documented planning has been carried out. Importantly, although the office has requested over $7 million for its proposed IT initiatives, it has not yet fully articulated its business needs or expected costs and benefits for these initiatives. Instead, the office has been reacting to current needs—such as retiring legacy systems—rather than developing clear plans for needed IT improvements that take into account such inevitabilities. In addition, because the office has not presented these investments to the Library’s IT investment review board, it is unclear whether these investments will overlap with activities that are already performed by the Library’s central IT office, and are thus a wasteful use of taxpayer funds. In this context, developing an IT strategic plan that is aligned with forthcoming efforts from the Library will better position the office to effectively prioritize, manage, and monitor the progress of its IT improvement efforts. To help ensure that the Copyright Office makes improvements to its current IT environment, we are recommending that the Librarian of Congress direct the Register of Copyrights to take the following two actions: For current and proposed initiatives to improve the IT environment at the Copyright Office, develop plans including investment proposals that identify the business problem, a proposed solution, the expected benefits, how the solution aligns with the Library’s strategic plan, an initial 3-year cost estimate, and expected funding sources, and bring those to the Library’s IT Steering Committee for review, as required by Library policy. Develop an IT strategic plan that includes the office’s prioritized IT goals, measures, and timelines, and is aligned with the Library’s ongoing strategic planning efforts. In response to our request for comments, we received a written response from the Register of Copyrights. According to the Register, the Librarian of Congress deferred to her to comment on our draft report. In her response, the Register did not state whether the office agreed or disagreed with our recommendations, but provided comments on these and other matters. These comments are summarized below, along with our responses. According to the Register, the Copyright Office must evolve from a small department of public record to a digitally savvy administrator of intellectual property rights, remedies, and commercial information, which requires the office to evaluate the needs of the national copyright system objectively and transparently. As described in this report, we agree that the Copyright Office has technical and organizational challenges that hinder its ability to meet its statutory and business needs. We further acknowledged that the office has begun to address these needs in its technical upgrades research. However, making progress in addressing these limitations will require a strategic vision as well as effective planning, and our recommendations are aimed at assisting the office in these areas. The Register further noted that we did not examine the legal relationship between the Copyright Office and the Library and that our recommendations assume that the Copyright Office will continue to route its IT needs through Library processes and managers, similar to other Library units. She added that members of Congress have recently questioned the current governance structure and that it would be prudent for the Library and the Copyright Office to solicit further congressional guidance before implementing GAO’s recommendations. We acknowledge that concerns about the legal relationship between the Copyright Office and the Library have been raised in Congress. In our report we discuss the office’s legal responsibilities, including the relationship between the office and the Library and the Copyright Office’s distinctive mission. Our review of the office’s IT environment was undertaken in light of current law and the existing organizational structure. We recognize that future legislation may change the office’s responsibilities in administering copyright law, which may in turn impact its future technology needs. Whether such changes to the law will alter the office’s placement in the Library is unknown at this time. Regardless of the Copyright Office’s organizational placement, it still needs to support and justify its request for $7 million for IT-related projects in fiscal years 2015 and 2016. In addition, the Register stated that we primarily reviewed management issues and did not examine issues with the Library’s technical infrastructure that, in her view, appear to be insufficient to support a 21st- century Copyright Office. While our report did highlight management challenges, we also noted several technical challenges impeding the office’s ability to carry out its work. Specifically, we noted challenges in the performance and usability of the office’s eCO system; concerns regarding the implementation of security controls; and data integrity, availability, and retention issues. Moreover, our report on IT management Library-wide identified a number of issues, both management-related and technical, and made numerous recommendations aimed at addressing them. Given the current organizational structure, it is important that both the Library and the Copyright Office take actions to address the challenges within their purview and collaborate in ways that best support their respective missions. Finally, the Register stated that our recommendations would require the Copyright Office to absorb more of the burden of preparing investment proposals, cost-benefit analyses, and strategic IT planning, which have not been in the domain of the office. According to the Register, this would require the office to acquire additional IT specialists. However, preparing such planning documentation is required of all service units by Library policy for investments of this nature, and is consistent with best practices for selecting IT investments to pursue for funding. In addition, developing this preliminary planning documentation requires knowledge and expertise of the office’s business processes and mission needs, but not necessarily technical expertise. Once the appropriate investments have been selected, this preliminary information can be used to develop business requirements, which in turn can be used by Copyright Office staff or external vendors with the appropriate expertise to identify technical solutions that will most effectively and efficiently support the Copyright Office’s mission. We are sending copies of this report to the appropriate congressional committees, the Librarian of Congress, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6253 or willemssenj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The Senate Appropriations Committee report accompanying the fiscal year 2015 legislative branch appropriations bill (S. Rep. No. 113-196) required that we review the Copyright Office’s current information technology (IT) environment and its plans for modernizing that infrastructure. Our specific objectives for this review were to (1) describe the legal, technical, and organizational aspects of the Copyright Office’s current IT environment and (2) describe and evaluate the Copyright Office’s plans for modernization. To address our first objective, we reviewed the legal requirements for the Copyright Office found in the Copyright Act and the Administrative Procedure Act, and related legal requirements for the Library of Congress, as well as the Library’s IT management policies and procedures. We also reviewed documentation related to concerns expressed by internal and external users of Copyright’s registration system, including public comments and transcripts of meetings with the public; testimony, hearing transcripts, and speeches by the Register of Copyrights; results from customer satisfaction surveys for the office’s systems; e-mails related to IT challenges sent by Copyright Office staff to the Associate Register for Registration Policy and Practice; and help desk tickets provided to both the Copyright Office help desk and the Library of Congress IT help desk. We reviewed feasibility studies and plans for migrating functionality from legacy systems to Copyright’s registration system. We also relied on the results of our recent review of the Library’s IT management. In addition, to test the integrity of the office’s deposit files, we selected a random probability sample of the deposit files stored in the Library of Congress’s storage servers. Specifically, we selected a simple random sample of 60 of the over 6 million deposit files that were stored from 2005 to 2014. We met with staff in the Library’s Office of Information Technology Services to confirm that the selected files existed in the expected locations. Finally, we interviewed Library of Congress officials, including the Library’s former acting Chief Information Officer (CIO) and head of the Library’s Information Technology Services division, and Copyright Office officials, including the Register of Copyrights, the Copyright CIO, and the heads of Copyright Office’s program areas. To describe and evaluate the office’s plans for modernization, we reviewed best practices on IT investment management identified by GAO and Library policies and procedures. We also reviewed requirements for IT strategic planning found in related provisions of the Clinger-Cohen Act of 1996 and guidance from the Office of Management and Budget. We reviewed the Copyright Office’s IT-related funding requests in fiscal years 2015 and 2016, including the underlying cost estimates, and compared them against the IT investment management criteria. We also reviewed testimony, hearing transcripts, and speeches made by the Register about the office’s needs for technical upgrades. Finally, we interviewed Library of Congress officials, including the Library’s former acting CIO, the Register of Copyrights, and the Copyright Office’s CIO, to discuss the office’s efforts to plan for IT improvement initiatives. We conducted this performance audit from June 2014 to March 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Joel C. Willemssen, (202) 512-6253 or willemssenj@gao.gov. In addition to the contact named above, individuals making contributions to this report included Nick Marinos, Lon Chin, and Chris Warweg (assistant directors), James Ashley, Chris Businsky, Sa’ar Dagani, Neil Doherty, Torrey Hardee, Thomas Johnson, Kaelin Kuhn, Lee McCracken, David Plocher, Meredith Raymond, Kate Sharkey, Andrew Stavisky, Tina Torabi, and Charles Youman.

Summary: The mission of the Copyright Office, a service unit within the Library of Congress, is to promote creativity by administering and sustaining a national copyright system. As part of this mission, the Copyright Office registers about 500,000 creative works a year for copyright and records documentation related to copyright transfer and sale. In recent years, the Register of Copyrights has discussed the need for a modernized Copyright Office, to include upgrades to the current IT environment. The Senate Appropriations Committee report accompanying the 2015 legislative branch appropriations bill required GAO to review the Copyright Office's current IT environment and plans for the future. This report (1) describes the legal, technical, and organizational aspects of the Copyright Office's current IT environment, and (2) describes and evaluates the Copyright Office's plans for modernization. To carry out its work, GAO reviewed Library policies and related best practices, comments by stakeholders, IT funding requests, and other relevant documentation, and interviewed key Library and Copyright Office officials. The Copyright Office has a legal mission supporting the creative industries that significantly contribute to the United States economy and relies heavily on information technology (IT) to carry out this mission. For example, by law, the office must be able to receive and examine copyright registration applications, collect and maintain deposited copies of copyrighted works, and maintain records of the transfer of copyright ownership. To meet these mission requirements, the office relies on several IT systems, as well as the infrastructure managed by the Library of Congress's central IT office. However, GAO and others have identified challenges with this environment. For example, comments solicited by the Copyright Office from external users have described limitations in the performance and usability of the office's electronic copyright registration system, and the Copyright Office has expressed concerns about the integrity of the files stored in the Library's servers. Organizationally, responsibility for managing the office's IT environment is shared between the Copyright Office's Office of the Chief Information Officer (CIO) and the Library's central IT office. The Library has serious weaknesses in its IT management, which have hindered the ability of the Library and the Copyright Office to meet mission requirements. For example, the Library has not had a permanent CIO in over 2 years. The Copyright Office requested over $7 million in fiscal years 2015 and 2016 to address four key challenges: (1) reengineer recordation—one of the office's key business processes—to include developing an online filing capability; (2) develop a secure digital repository for its electronic materials (e.g., books and music); (3) develop a software application development environment; and (4) establish a data management team, to include developing data standards. The office has also published a report that summarizes stakeholder comments on the current IT environment and makes several recommendations to improve this environment. However, the office has not adequately justified these proposed investments. Specifically, it has not identified the business needs they are intended to meet, expected costs, or how they align with the agency's strategic plan, as called for by Library IT investment management policy. The office also did not present the investments to the Library's IT investment review board, which was established to select investments for funding that meet defined criteria and ensure that such investments are not duplicative of existing investments or activities performed within the Library. Copyright officials stated that these initiatives were in early stages and the office was not yet in a position to develop this information. However, without identifying key costs and benefits of proposed initiatives and presenting this information to the Library-wide investment review board, decision makers at the Library and the Copyright Office do not have the assurance that the selected investments support the organization's goals and do not duplicate existing activities. In addition, the office does not have an IT strategic plan, and officials described difficulties in developing such a plan given that the Library has not yet developed one. As noted in a recent GAO review of the Library's IT management, the Library has recently committed to developing an updated IT strategic plan, and it will be important for the Copyright Office's own strategic planning to be aligned with this effort. GAO recommends that the Copyright Office (1) develop key information to support proposed initiatives for improving its IT environment and submit them to the Library's IT investment review board for review, and (2) develop an IT strategic plan that is aligned with the Library's strategic planning efforts. The office neither agreed nor disagreed. GAO continues to believe its recommendations are warranted.