The Freedom of Information Act establishes a legal right of access to government information on the basis of the principles of openness and accountability in government. Before FOIA’s enactment in 1966, an individual seeking access to federal records faced the burden of establishing a “need to know” before being granted the right to examine a federal record. FOIA established a “right to know” standard, under which an organization or person could receive access to information held by a federal agency without demonstrating a need or reason. The “right to know” standard shifted the burden of proof from the individual to a government agency and required the agency to provide proper justification when denying a request for access to a record. Any person, defined broadly to include attorneys filing on behalf of an individual, corporations, or organizations, can file a FOIA request. For example, an attorney can request labor-related workers’ compensation files on behalf of his or her client, and a commercial requester, such as a data broker who files a request on behalf of another person, may request a copy of a government contract. In response, an agency is required to provide the relevant record(s) in any readily producible form or format specified by the requester, unless the record falls within a permitted exemption that provides limitations on the disclosure of information. Various amendments have been enacted and guidance issued to help improve agencies’ processing of FOIA requests, including: The Electronic Freedom of Information Act Amendments of 1996 (e- FOIA amendments) strengthened the requirement that federal agencies respond to a request in a timely manner and reduce their backlogged requests. The amendments, among other things, made a number of procedural changes, including allowing a requester to limit the scope of a request so that it could be processed more quickly and requiring agencies to determine within 20 working days whether a request would be fulfilled. This was an increase from the previously established time frame of 10 business days. The amendments also authorized agencies to multi-track requests— that is, to process simple and complex requests concurrently on separate tracks to facilitate responding to a relatively simple request more quickly. In addition, the amendment encouraged online, public access to government information by requiring agencies to make specific types of records available in electronic form. Executive Order 13392, issued by the President in 2005, directed each agency to designate a senior official as its chief FOIA officer. This official was to be responsible for ensuring agency-wide compliance with the act by monitoring implementation throughout the agency and recommending changes in policies, practices, staffing, and funding, as needed. The chief FOIA officer was directed to review and report on the agency’s performance in implementing FOIA to agency heads and to Justice on an annual basis. (These are referred to as chief FOIA officer reports.) The OPEN Government Act, which was enacted in 2007, made the 2005 executive order’s requirement for agencies to have a chief FOIA officer a statutory requirement. It also required agencies to submit an annual report to Justice outlining their administration of FOIA, including additional statistics on timeliness. Specifically, the act called for agencies to adequately track their agency’s FOIA request processing information throughout the reporting year and then produce reports on that topic to comply with FOIA reporting requirements and Justice guidance for reporting. The FOIA Improvement Act of 2016 addressed procedural issues, including requiring that agencies: (1) make records available in an electronic format if they have been requested three or more times; (2) notify requesters that they have a minimum of 90 days to file an administrative appeal, and (3) provide dispute resolution services at various times throughout the FOIA process. This act also created more duties for chief FOIA officers, including requiring them to offer training to agency staff regarding FOIA responsibilities. The act also revised and added new obligations for OGIS, and created the Chief FOIA Officers Council to assist in compliance and efficiency. Further, the act required OMB, in consultation with Justice, to create a consolidated online FOIA request portal that allows the public to submit a request to any agency through a single website. In responding to requests, FOIA authorizes agencies to utilize one of nine exemptions to withhold portions of records, or the entire record. Agencies may use an exemption when it has been determined that disclosure of the requested information would harm an interest related to certain protected areas. These nine exemptions can be applied by agencies to withhold various types of information, such as information concerning foreign relations, trade secrets, and matters of personal privacy. One such exemption, the statutory (b)(3) exemption, specifically authorizes withholding information under FOIA on the basis of a law which: requires that matters be withheld from the public in such a manner as to leave no discretion on the issue; or establishes particular criteria for withholding or refers to particular types of matters to be withheld; and if enacted after October 28, 2009, specifically refers to section 552(b)(3) of title 5, United States Code. To account for agencies use of the statutory (b)(3) exemptions, FOIA requires each agency to submit, in its annual report to Justice, a complete listing of all statutes that the agency relied on to withhold information under exemption (b)(3). The act also requires that the agency describe for each statute identified in its report (1) the number of occasions on which each statute was relied upon; (2) a description of whether a court has upheld the decision of the agency to withhold information under each such statute; and (3) a concise description of any information withheld. Further, to provide an overall summary of the statutory (b)(3) exemptions used by agencies in a fiscal year, Justice produces consolidated annual reports that list the statutes used by agencies in conjunction with (b)(3). As previously noted, agencies are generally required by the e-FOIA amendments of 1996 to respond to a FOIA request within 20 working days. Once received, the request is to be processed through multiple phases, which include assigning a tracking number, searching for responsive records, and releasing the records response to the requester. Also, as relevant, FOIA allows a requester to challenge an agency’s final decision on a request through an administrative appeal or a lawsuit. Specifically, a requester has the right to file an administrative appeal if he or she disagrees with the agency’s decision on their request. Agencies have 20 working days to respond to an administrative appeal. Figure 1 provides a simplified overview of the FOIA request and appeals process. In a typical agency, as indicated, during the intake phase, a request is logged into the agency’s FOIA tracking system, and a tracking number is assigned. The request is then reviewed by FOIA staff to determine its scope and level of complexity. The agency then typically sends a letter or email to the requester acknowledging receipt of the request, with a unique tracking number that the requester can use to check the status of the request. Next, FOIA staff (non-custodian) begin the search to retrieve the responsive records by routing the request to the appropriate program office(s).This step may include requesting that the custodian (owner) of the record search and review paper and electronic records from multiple locations and program offices. Agency staff then process the responsive records, which includes determining whether a portion or all of any record should be withheld based on FOIA’s exemptions. If a portion or all of any record is the responsibility of another agency, FOIA staff may consult with the other agency or may send (“refer”) the document(s) to that other agency for processing. After processing and redaction, a request is reviewed for errors and to ensure quality. The documents are then released to the requester, either electronically or by regular mail. In addition, FOIA allows requesters to sue an agency in federal court if the agency does not respond to a request for information within the statutory time frames or if the requesters believe they are entitled to information that is being withheld by the agency. Further, the act requires the Office of Special Counsel (OSC) to initiate a proceeding to determine whether disciplinary action is warranted against agency personnel in cases involving lawsuits where a court has found, among other things that agency personnel may have acted arbitrarily or capriciously in responding to a FOIA request. The act requires Justice to notify OSC when a lawsuit meets this requirement. Responsibility for the oversight of FOIA implementation is spread across several federal offices and other entities. These include Justice’s OIP, NARA’s OGIS, and the Chief FOIA Officers Council. These oversight agencies and the council have taken steps to assist agencies to address the provisions of FOIA. Justice’s OIP is responsible for encouraging agencies’ compliance with FOIA and overseeing their implementation of the act. In this regard, the office, among other things, provides guidance, compiles information on FOIA compliance, provides FOIA training, and prepares annual summary reports on agencies’ FOIA processing and litigation activities. The office also offers FOIA counseling services to government staff and the public. Issuing guidance. OIP has developed guidance, available on its website, to assist federal agencies by instructing them in how to ensure timely determinations on requests, expedite the processing of requests, and reduce backlogs. The guidance also informs agencies on what should be contained in their annual FOIA reports to Justice’s Attorney General. The office also has documented ways for federal agencies to address backlog requests. In March 2009 the Attorney General issued guidance and related policies to encourage agencies to reduce their backlogs of FOIA requests. In addition, in December 2009, OMB issued a memorandum on the OPEN Government Act, which called for a reduction in backlogs and the publishing of plans to reduce backlogs. Further, in August 2014, OIP held a best practices workshop and issued guidance to agencies on reducing FOIA backlogs and improving timeliness of agencies’ responses to FOIA requests. The OIP guidance instructed agencies to obtain leadership support, routinely review FOIA processing metrics, and set up staff training on FOIA. Overseeing agencies’ compliance. OIP collects information on compliance with the act by reviewing agencies’ annual FOIA reports and chief FOIA officer reports. These reports describe the number of FOIA requests received and processed in a fiscal year, as well as the total costs associated with processing and litigating requests. Providing training. The office offers an annual training class that provides a basic overview of the act, as well as hands-on courses about the procedural requirements involved in processing a request from start to finish. In addition, it offers a seminar outlining successful litigation strategies for attorneys who handle FOIA cases. Preparing administrative and legal annual reports. OIP prepares two major reports yearly—one related to agencies’ annual FOIA processing and one related to agencies’ FOIA litigation and compliance. The first report, compiled from agencies’ annual FOIA reports, contains statistics on the number of requests received and processed by each agency, the time taken to respond, and the outcome of each request, as well as other statistics on FOIA administration such as number of backlogs, and the use of exemptions to withhold information from a requestor. The second report describes Justice’s efforts to encourage compliance with the act and provides a listing of all FOIA lawsuits filed or determined in that year, the exemptions and/or dispositions involved in each case, and any court-assessed costs, fees, and penalties. NARA’s OGIS was established by the OPEN Government Act of 2007 to oversee and assist agencies in implementing FOIA. OGIS’s responsibilities include reviewing agency policies and procedures, reviewing agency compliance, recommending policy changes, and offering mediation services. The 2016 FOIA amendments required agencies to update response letters to FOIA requesters to include information concerning the roles of OGIS and agency’s FOIA public liaisons. As such, OGIS and Justice worked together to develop a response letter template that includes the required language for agency letters. In addition, OGIS, charged with reviewing agency’s compliance with FOIA, launched in 2014 a FOIA compliance program. OGIS also developed a FOIA compliance self- assessment program, which is intended to help OGIS look for potential compliance issues across federal agencies. The Chief FOIA Officers Council is co-chaired by the Director of OIP and the Director of OGIS. Council members include senior representatives from OMB, OIP, and OGIS, together with the chief FOIA officers of each agency, among others. The council’s FOIA-related responsibilities include: developing recommendations for increasing compliance and disseminating information about agency experiences, ideas, best practices, and innovative approaches; identifying, developing, and coordinating initiatives to increase transparency and compliance; and promoting the development and use of common performance measures for agency compliance. Selected Agencies Collect and Maintain Records That Can Be Subject to FOIA Requests. The 18 agencies selected for our review are charged with a variety of operations that affect many aspects of federal service to the public. Thus, by the nature of their missions and operations, the agencies have responsibility for vast and varied amounts of information that can be subject to a FOIA request. For example, the Department of Homeland Security’s (DHS) mission is to protect the American people and the United States homeland. As such, the department maintains information covering, among other things, immigration, border crossings, and law enforcement. As another example, the Department of the Interior’s (DOI) mission includes protecting and managing the Nation’s natural resources and, thus, providing scientific information about those resources. Table 1 provides details on each of the 18 selected agencies’ mission and the types of information they maintain. The 18 selected agencies reported that they received and processed more than 2 million FOIA requests from fiscal years 2012 through 2016. Over this 5-year period, the number of reported requests received fluctuated among the agencies. In this regard, some agencies saw a continual rise in the number of requests, while other agencies experienced an increase or decrease from year to year. For example, from fiscal years 2012 through 2014, DHS saw an increase in the number of requests received (from 190,589 to 291,242), but in fiscal year 2015, saw the number of requests received decrease to 281,138. Subsequently, in fiscal year 2016, the department experienced an increase to 325,780 requests received. In addition, from fiscal years 2012 through 2015, the reported numbers of requests processed by the selected agencies showed a relatively steady increase. However, in fiscal year 2016, the reported number of requests processed by these agencies declined. Figure 2 provides a comparison of the total number of requests received and processed in this 5-year period. Among other things, the FOIA Improvement Act of 2016 and the OPEN Government Act of 2007 calls for agencies to (1) update response letters, (2) implement tracking systems, (3) provide FOIA training, (4), provide required records online, (5) designate chief FOIA officers, and (6) update and publish timely and comprehensive regulations. As part of our ongoing work, we determined that the 18 selected agencies included in our review had implemented the majority of the six FOIA requirements evaluated. Specifically, 18 agencies updated response letters, implemented tracking systems, 15 agencies provided required records online, and 12 agencies designated chief FOIA officers. However, only 5 of the agencies published and updated their FOIA regulations in a timely and comprehensive manner. Figure 3 summarizes the extent to which the 18 agencies implemented the selected FOIA requirements. Beyond these selected agencies, Justice’s OIP and OMB also had taken steps to develop a government-wide FOIA request portal that is intended to allow the public to submit a request to any agency from a single website. The 2016 amendments to FOIA required agencies to include specific information in their responses when making their determinations on requests. Specifically, agencies must inform requesters that they may seek assistance from the FOIA Public Liaison, file an appeal to an adverse determination within a period of time that is not less than 90 days after the date of such adverse determination; and seek dispute resolution services from the FOIA Public Liaison of the agency or OGIS. Among the 18 selected agencies, all had updated their FOIA response letters to include this required information. Various FOIA amendments and guidance call for agencies to use automated systems to improve the processing and management of requests. In particular, the OPEN Government Act of 2007 amended FOIA to require that federal agencies establish a system to provide individualized tracking numbers for requests that will take longer than 10 days to process and establish telephone or Internet service to allow requesters to track the status of their requests. Further, the President’s January 2009 Freedom of Information Act memorandum instructed agencies to use modern technology to inform citizens about what is known and done by their government. In addition, FOIA processing systems, like all automated information technology systems, are to comply with the requirements of Section 508 of the Rehabilitation Act (as amended). This act requires federal agencies to make their electronic information accessible to people with disabilities. Each of the 18 selected agencies had implemented a system that provides capabilities for tracking requests received and processed, including an individualized number for tracking the status of a request. Specifically, Ten agencies used commercial automated systems, (DHS, EEOC, FDIC, FTC, Justice, NTSB, NASA, Pension Benefit Guaranty Corporation, and USAID). Three agencies developed their own agency systems (State, DOI, and TVA). Five agencies used Microsoft Excel or Word to track requests (Administrative Conference of the United States, American Battle Monuments Commission, Broadcasting Board of Governors, OMB, and U.S. African Development Foundation). Further, all of the agencies had established telephone or Internet services to assist requesters in tracking the status of requests; and they used modern technology (e.g., mobile applications) to inform citizens about FOIA. For example, the commercial systems allow requesters to submit a request and track the status of that request online. In addition, DHS developed a mobile application that allows FOIA requesters to submit requests and check the status of existing requests. The 2016 FOIA amendments require agencies’ chief FOIA officers to offer training to agency staff regarding their responsibilities under FOIA. In addition, Justice’s OIP has advised every agency to make such training available to all of their FOIA staff at least once each year. The office has also encouraged agencies to take advantage of FOIA training opportunities available throughout the government. The 18 selected agencies’ chief FOIA officers offered FOIA training opportunities to staff in fiscal years 2016 and 2017. For example: Eleven agencies provided training that gave an introduction and overview of FOIA (the American Battle Monuments Commission, EEOC, Justice, FDIC, FTC, NARA, Pension Benefit Guaranty Corporation, State, TVA, U.S. African Development Foundation, and USAID). Three agencies offered training for their agencies’ new online FOIA tracking and processing systems (DOI, NTSB, and Pension Benefit Guaranty Corporation). Three agencies provided training on responding to, handling, and processing FOIA requests (DHS, DOI, and State). Three agencies offered training on understanding and applying the exemptions under FOIA (FDIC, FTC, and U.S. African Development Foundation). Two agencies offered training on the processing of costs and fees (NASA and TVA). Memorandums from both the President and the Attorney General in 2009 highlight the importance of online disclosure of information and further direct agencies to make information available without a specific FOIA request. Further, the 2016 FOIA amendments require online access to government information and require agencies to make information available to the public in electronic form for up to four categories: agency final opinions and orders, administrative staff manuals of interest to the public, and frequently requested records. While all 18 agencies that we reviewed post records online, only 15 of them had posted all categories of information, as required by the FOIA amendments. Specifically, 7 agencies—the American Battle Monuments Commission, the Pension Benefit Guaranty Corporation, and EEOC, FDIC, FTC, DOJ, and State—had, as required, made records in all four categories publicly available online. In addition, 5 agencies that were only required to publish online records in three of the categories—the Administrative Conference of the United States, Broadcasting Board of Governors, DHS, OMB, and USAID— had done so. Further, 3 agencies that were only required to publish online records in two of the categories—U.S. African Development Foundation, NARA, and TVA— had done so. The remaining 3 agencies—DOI, NASA, and NTSB—had posted records online for three of four required categories. Regarding why the three agencies did not post all of their four required categories of online records, DOI officials stated that the agency does not make publically available all FOIA records that have been requested 3 or more times, as it does not have the time to post all such records that have been requested. NASA officials explained that, while the agency issues final opinions, it does not post them online. As for NTSB, while its officials said they try to post information that is frequently requested, they do not post the information on a consistent basis Making the four required categories of information available in electronic form is an important step in allowing the public to easily access to government documents. Until these agencies make all required categories of information available in electronic form, they cannot ensure that they are providing the required openness in government. In 2005, the President issued an executive order that established the role of a Chief FOIA Officer. In 2007, amendments to FOIA required each agency to designate a chief FOIA officer who shall be a senior official at the Assistant Secretary or equivalent level. Of the 18 selected agencies, 12 agencies have Chief FOIA Officers who are senior officials at the Assistant Secretary or equivalent level. The Assistant Secretary level is comparable to senior executive level positions at levels III, IV, and V. Specifically, State has designated its Assistant Secretary of Administration, Bureau DOI and NTSB had designated its Chief Information Officers; Administrative Conference of the United States, Broadcasting Board of Governors, FDIC, NARA, and U.S. African Development Foundation have designated their general counsels; and Justice, NASA, TVA, and USAID designated their Associate Attorney General, Associate Administrator for Communications, the Vice President for Communications, and the Assistant Administrator for the Bureau of Management, respectively. However, 6 agencies — American Battle Monuments Commission DHS, EEOC, Pension Benefit Guaranty Corporation, FTC, and OMB — do not have chief FOIA officers that are senior officials at the Assistant Secretary or equivalent level. According to officials from 5 of these agencies, the agencies all have chief FOIA officers and officials believed they had designated the appropriate officials. Officials at FTC acknowledged that the chief FOIA officer position is not designated at a level equivalent to an Assistant Secretary but a senior position within the agency. However, while there are chief FOIA officers at these agencies, until the chief FOIA officers are designated at the Assistant Secretary or equivalent level, they will lack assurance regarding the necessary authority to make decisions about agency practices, personnel, and funding. FOIA requires federal agencies to publish regulations in the Federal Register that inform the public of their FOIA operations. Specifically, in 2016, FOIA was amended to require agencies to update their regulations regarding their FOIA operations. To assist agencies in meeting this requirement, OIP created a FOIA regulation template for agencies to use as they update their regulations. Among other things, OIP’s guidance encouraged agencies to: describe their dispute resolution processed, describe their administrative appeals process for response letters of notify requesters that they have a minimum of 90 days to file an inform requesters that the agency may charge fees for requests determined as “unusual” circumstances ; and update the regulations in a timely manner (i.e., update regulations by 180 days after the enactment of the 2016 FOIA amendment.) Five agencies in our review—DHS, DOI, FDIC, FTC, and USAID— addressed all five requirements in updating their regulations. In addition, seven agencies addressed four of the five requirements: the Administrative Conference of the United States, EEOC, Justice, NARA, NTSB, Pension Benefit Guaranty Corporation, and TVA did not update their regulations in a timely manner. Further, four agencies addressed three or less requirements (U.S. African Development Foundation, State, NASA, and Broadcasting Board of Governors) and two agencies (American Battle Monuments Commission and OMB) did not address any of the requirements. Figure 4 indicates the extent to which the 18 agencies had addressed the five selected requirements. Agencies that did not address all five requirements provided several explanations as to why their regulations were not updated as required: American Battle Monuments Commission stated that while they updated their draft regulation in August 2017, it is currently unpublished due to internal reviews with the General Counsel in preparation for submission to the Federal Register. No new posting date has been established. American Battle Monuments Commission last updated its regulation in February 26, 2003. State officials noted that their regulation was updated two months prior to the new regulation requirements but did not provide a specific reason for not reissuing its regulation. As such, they explained that they have a working group reviewing their regulation for updates, with no timeline identified. State last updated its regulation on April 6, 2016. NASA officials did not provide a reason for not updating its regulation as required. Officials did, however, state that its draft regulation is with the Office of General Counsel for review. NASA last updated its regulations on August 11, 2017. Broadcasting Board of Governors officials did not provide a reason for not updating its regulation as required. Officials did, however, note that the agency is in the process of updating its regulation and anticipates it will complete this update by the end of 2018. The Broadcasting Board of Governors last updated its regulation on February 2, 2002. OMB officials did not provide a reason for not updating the agency’s regulation as required. Officials did, however, state that due to a change in leadership they do not have a time frame for updating their regulation. OMB last updated its regulation on May 27, 1998. The chief FOIA officer at the U.S. African Development Foundation stated that, while the agency had updated and submitted their regulation to be published in December 2016, they were unpublished due to an error that occurred with the acknowledgement needed to publish the regulation on the federal register. The regulation was subsequently published on February 3, 2017. The official further noted that when the agency responds to FOIA requests it has not charged a fee for unusual circumstances, and therefore they did not believe they had to disclose information regarding fees in its regulation. Until these six agencies publish updated regulations that address the necessary requirements, as called for in FOIA and OIP guidance, they likely will be unable to provide the public with required regulatory and procedural information to ensure transparency and accountability in the government. The 2016 FOIA amendments required OMB to work with Justice to build a consolidated online FOIA request portal. This portal is intended to allow the public to submit a request to any agency from a single website and include other tools to improve the public’s access to the benefits of FOIA. Further, the act required OMB to establish standards for interoperability between the consolidated portal and agency FOIA systems. The 2016 FOIA amendments did not provide a time to develop the portal and standards. With OMB’s support, Justice developed an initial online portal. Justice’s OIP officials stated that they expect to update the portal to provide basic functionality that aligns with requirements of the act, including the ability to make a FOIA request, and technical processes for interoperability amongst agencies’ various FOIA systems. According to OIP officials, in partnership with OMB, OIP was able to identify dedicated funding source to operate and maintain the portal to ensure its success in the long term, with major agencies sharing in the costs to operate, maintain, and fund any future enhancements designed to improve FOIA processes. The first iteration of the National FOIA portal launched on Justice’s foia.gov website on March 8, 2018. In our draft report, we determined that the 18 selected agencies in our review had FOIA request backlogs of varying sizes, ranging from no backlogged requests at some agencies to 45,000 or more requests at other agencies. Generally, the agencies with the largest backlogs had received the most requests. In an effort to aid agencies in reducing their backlogs, Justice’s OIP identified key practices that agencies can use. However, while the agencies reported using these practices and other methods, few of them managed to reduce their backlogs during the period from fiscal year 2012 through 2016. In particular, of the four agencies with the largest backlogs, only one—NARA—reduced its backlog. Agencies attributed their inability to decrease backlogs to the number and complexity of requests, among other factors. However, agencies also lack comprehensive plans to implement practices on an ongoing basis. The selected agencies in our review varied considerably in the size of their FOIA request backlogs. Specifically, from fiscal year 2012 through 2016, of the 18 selected agencies 10 reported a backlog of 60 or fewer requests, and of these 10 agencies, 6 reported having no backlog in at least 1 year. 4 agencies had backlog numbers between 61 and 1,000 per year; and 4 agencies had backlogs of over 1,000 requests per year. The four agencies with backlogs of more than 1,000 requests for each year we examined were Justice, NARA, State and DHS. Table 2 shows the number requests and the number of backlogged request for the 18 selected agencies during the 5-year period. Over the 5-year period, 14 of the 18 selected agencies experienced an increase in their backlogs in at least 1 year. By contrast, 2 agencies (Administrative Conference of the United States and the U.S. African Development Foundation) reported no backlogs, and 3 agencies (American Battle Monument Commission, NASA and NARA) reported reducing their backlogs. Further, of the four agencies with the largest backlogs (DHS, State, Justice, and NARA) only NARA reported a backlog lower in fiscal year 2016 than in fiscal year 2012. Figure 5 shows the trends for the four agencies with the largest backlogs, compared with the rest of the 18 agencies. In most cases, agencies with small or no backlogs (60 or fewer) also received relatively few requests. For example, the Administrative Conference of the United States and the U.S. African Development Foundation reported no backlogged requests during any year but also received fewer than 30 FOIA requests a year. The American Battle Monuments Commission also received fewer than 30 requests a year and only reported 1 backlogged request per year in 2 of the 5 years examined. However, the Pension Benefit Guaranty Corporation and FDIC received thousands of requests over the 5-year period, but maintained zero backlogs in a majority of the years examined. PBGC received a total of 19,120 requests during the 5-year period and only reported a backlog of 8 requests during one year, fiscal year 2013. FDIC received a total of 3,405 requests during the 5-year period and reported a backlog of 13 requests in fiscal year 2015 and 4 in fiscal year 2016. The four agencies with backlogs of 1,000 or more (Justice, NARA, State, and DHS) received significantly more requests each year. For example, NARA received between about 12,000 and 50,000 requests each year, while DHS received from about 190,000 to 325,000 requests. In addition, the number of requests NARA received in fiscal year 2016 was more than double the number received in fiscal year 2012. DHS received the most requests of any agency—a total of 1,320,283 FOIA requests over the 5- year period. The Attorney General’s March 2009 memorandum called on agency chief FOIA officers to review all aspects of their agencies’ FOIA administration and report to Justice on steps that have been taken to improve FOIA operations and disclosure. Subsequent Justice guidance required agencies are to include in their chief FOIA officer reports information on their FOIA request backlogs, including whether the agency experienced a backlog of requests; whether that backlog decreased from the previous year; and, if not, reasons the backlog did not decrease. In addition, agencies that had more than 1,000 backlogged requests in a given year were required to describe their plans to reduce their backlogs. Beginning in fiscal year 2015, these agencies were to describe how they implemented their plans from the previous year and whether that resulted in a backlog reduction. In addition, Justice’s OIP identified best practices for reducing FOIA backlogs. The office held a best practices workshop on reducing backlogs and improving timeliness. The office then issued guidance in August 2014 which highlighted key practices to improve the quality of a FOIA program. OIP identified the following methods in its best practices guidance. Utilize resources effectively. Agencies should allocate their resources effectively by using multi-track processing, making use of available technology, and shifting priorities and staff assignments to address needs and effectively manage workloads. Routinely review metrics. Agencies should regularly review their FOIA data and processes to identify challenges or barriers. Additionally, agencies should identify trends to effectively allocate resources, set goals for staff, and ensure needs are addressed. Emphasize staff training. Agencies should ensure FOIA staff are properly trained so they can process requests more effectively and with more autonomy. Training and engagement of staff can also solidify the importance of the FOIA office’s mission. Obtain leadership support. Agencies should ensure that senior management is involved in and supports the FOIA function in order to increase awareness and accountability, as well as make it easier to obtain necessary resources or personnel. Agencies identified a variety of methods that they used to address their backlogs. These included both the practices identified by Justice, as well as additional methods. Ten agencies maintained relatively small backlogs of 60 or fewer requests and were thus not required to develop plans for reducing backlogs. However, 2 of these 10 agencies, who both received significant numbers of requests, described various methods used to maintain a small backlog: PBGC officials credits its success to training, not only for FOIA staff, but all Incoming personnel, while also awarding staff for going above and beyond in facilitating FOIA processing. Pension Benefit Guaranty Corporation has incorporated all the best practices identified by OIP, including senior leadership involvement that supports FOIA initiatives and program goals, routine review of metrics to optimize workflows, effective utilization of resources and staff training. According to FDIC officials, its overall low backlog numbers are attributed to a trained and experienced FOIA staff, senior management involvement, and coordination among FDIC divisions. However, FDIC stated the reason for the increase in backlogs in fiscal year 2015 was due to increased complexity of requests. The 4 agencies with backlogs greater than 60 but fewer than 1,000 (EEOC, DOI, NTSB, and USAID) reported using various methods to reduce their backlogs. However, all 4 showed an increase over the 5-year period. EEOC officials stated that it had adopted practices recommended by OIP such as multi-track processing, reviewing workloads to ensure sufficient staff, and using temporary assignments to address needs. However, it has seen a large increase in its backlog numbers, going from 131 in fiscal year 2012 to 792 in fiscal year 2016. EEOC attributed the rise in backlogs to an increase in requests received, loss of staff, and the complex and voluminous nature of requests. DOI, according to agency officials, has also tried to incorporate reduction methods and best practices, including proactively releasing information that may be of interest to the public, thus avoiding the need for a FOIA request; enhanced training for its new online FOIA tracking and processing system; improved inter-office collaboration; monthly reports on backlogs and weekly charts on incoming requests to heighten awareness among leadership; and monitoring trends. Yet, DOI has seen an increase in its backlog, from 449 in fiscal year 2012 to 677 in fiscal year 2016, an increase of 51 percent. DOI attributed the increase to loss of FOIA personnel, increase in the complexity of requests, increase in FOIA-related litigation, increase in incoming requests, and staff having additional duties. Officials at NTSB stated that it utilized contractors and temporary staff assignments to augment staffing and address backlogs. Despite the effort, NTSB saw a large increase in backlogs, from 62 in fiscal year 2012 to 602 in fiscal year 2016. Officials stated that reason for the increase was due to increased complexity of requests, including requests for “any and all” documentation related to a specific subject, often involving hundreds to thousands of pages per request. According to USAID officials, the agency conducts and reviews inventories of its backlog and requests to remove duplicates and closed cases, group and classify requests by necessary actions and responsive offices, and initiate immediate action. In addition, USAID seeks to identify tools and solutions to streamline records for review and processing. However, its backlog numbers have continually increased, from 201 in fiscal year 2012 to 318 in fiscal year 2016. USAID attributes that increase to increase in the number of requests, loss of FOIA staff, increased complexity and volume of requests, competing priorities, and world events that may drive surges in requests. Of the four agencies with the largest backlogs, all reported taking steps that in some cases included best practices identified by OIP; however, only NARA successfully reduced its backlog by the end of the 5-year period. Justice made noted that it efforts to reduce its backlog by incorporating best practices. Specifically, OIP worked with components within Justice through the Component Improvement Initiative to identify causes contributing to a backlog and assist components in finding efficiencies and overcoming challenges. The Chief FOIA Officer continued to provide top-level support to reduction efforts by convening the department’s FOIA Council to manage overall FOIA administration. In addition, many of the components created their own reduction plans, which included hiring staff, utilizing technology, and providing more training, requester outreach, and multitrack processing. However, despite these efforts, the number of backlogs steadily increased during the 5-year period, from 5,196 in fiscal year 2012 to 10,644 in fiscal year 2016, an overall increase of 105 percent. Justice attributes the increase in backlogs to several challenges, including an increase of incoming requests and an increase in the complexity of those requests. Other challenges that Justice noted were staff shortages and turnover, reorganization of personnel, time to train incoming staff, and the ability to fill positions previously held by highly qualified professionals. NARA officials stated that one key step NARA took was to make corrections in its Performance Measurement and Reporting System. They noted that this system previously comingled backlogged requests with the number of pending FOIA requests, skewing the backlog numbers higher. The improvements included better accounting for pending and backlogged cases, distinguishing between simple and complex requests, and no longer counting as open cases that were closed within 20 days, but not until the beginning of the following fiscal year. In addition, officials also stated that the FOIA program offices have been successful at working with requesters to narrow the scope of requests. NARA also stated that it was conducting an analysis of FOIA across the agency to identify any barriers in the process. Officials also identified other methods, including using multi-track processing, shifting priorities to address needs, improved communication with agencies, proactive disclosures, and the use of mediation services. NARA has shown significant progress in reducing its backlog. In fiscal year 2012 it had a backlog of 7,610 requests, which spiked to 9,361 in fiscal year 14. However, by fiscal year 2016 the number of backlogged requests had dropped to 2,932 despite an more than doubling of requests received for that fiscal year. However, NARA did note challenges to reducing its backlog numbers, namely, the increase in the number of requests received. State developed and implemented a plan to reduce its backlog in fiscal year 2016. The plan incorporated two best practices by focused on identifying the extent of the backlog problem and developing ways to address the backlog with available resources. According to State officials, effort was dedicated to improve how FOIA data was organized and reported. Expedited and litigation cases were top priorities, whereas in other cases a first in first out method was employed. Even with these efforts, however, State experienced a 117 percent increase in its backlog over the 5-year period. State’s backlog doubled from 10,045 in fiscal year 2014 to 22,664 in fiscal year 2016. Among the challenges to managing its backlog, State reported an increase in incoming requests, a high number of litigation cases, and competing priorities. Specifically, the number of incoming requests for State increase by 51 percent during the 5-year period. State has also reported that it has allocated 80 percent of its FOIA resources to meet court-ordered productions associated with litigation cases, resulting in fewer staff to work on processing routine requests. This included, among other efforts, a significant allocation of resources in fiscal year 2015 to meet court-imposed deadlines to process emails associated with the former Secretary of State, resulting in a surge of backlogs. In 2017 State began an initiative to actively address its backlogs. The Secretary of State issued an agency-wide memorandum stating the department’s renewed efforts by committing more resources and workforce to backlog reduction. The memo states new processes are to be implemented for both the short and long-term, and the FOIA office has plans to work with the various bureaus to outline the tasks, resources, and workforce necessary to ensure success and compliance. With renewed leadership support, State has reported significant progress in its backlog reduction efforts. DHS, in its chief FOIA officer reports, reported that it implemented several plans to reduce backlogs. The DHS Privacy office, which is responsible for oversight of the department’s FOIA program, worked with components to help eliminate the backlog. The Privacy Office sent monthly emails to component FOIA officers on FOIA backlog statistics, convened management meetings, conducted oversight, and reviewed workloads. Leadership met weekly to discuss the oldest pending requests, appeals, and consultations, and determined needed steps to process those requests. In addition, several other DHS components implemented actions to reduce backlogs. Customs and Border Protection hired and trained additional staff, encouraged requesters to file requests online, established productivity goals, updated guidance, and utilized better technology. U.S. Citizenship and Immigration Services, National Protection and Programs Directorate, and Immigration and Customs Enforcement increased staffing or developed methods to better forecast future workloads ensure adequate staffing. Immigration and Customs Enforcement also implemented a commercial off-the-shelf web application, awarded a multi-million dollar contract for backlog reduction, and detailed employees from various other offices to assist in the backlog reduction effort. Due to efforts by the Privacy Office and other components, the backlog dropped 66 percent in fiscal year 2015, decreasing to 35,374. Yet, despite the continued efforts in fiscal year 2016, the backlog numbers increased again, to 46,788. DHS attributes the increases in backlogs to several factors, including an increase in the number of requests received, increased complexity and volume of responsive records for those requests, loss of staff and active litigation with demanding production schedules. One reason the eight agencies with significant backlogs may be struggling to consistently reduce their backlogs is that they lack documented, comprehensive plans that would provide a more reliable, sustainable approach to addressing backlogs. In particular, they do not have documented plans that describe how they will implement best practices for reducing backlogs over time, including specifying how they will use metrics to assess the effectiveness of their backlog reduction efforts and ensure that senior leadership supports backlog reduction efforts, among other best practices identified by OIP. While agencies with backlogs of 1,000 or more are required to describe backlog reduction efforts in their chief FOIA officer reports, these consist of a high-level narrative and do not include a specific discussion of how the agencies will implement best practices over time to reduce their backlog. In addition, agencies with backlogs of fewer than 1,000 requests are not required to report on backlog reduction efforts; however, the selected agencies in our review with backlogs in the hundreds still experienced an increase over the 5-year period. Without a more consistent approach, agencies will continue to struggle to reduce their backlogs to a manageable level, particularly as the number and complexity of requests increase over time. As a result, their FOIA processing may not respond effectively to the needs of requesters and the public. FOIA requires agencies report annually to Justice on their use of statutory (b)(3) exemptions. This includes specifying which statutes they relied on to exempt information from disclosure and the number of times they did so. To assist agencies in asserting and accounting for their use of these statutes, Justice instructs agencies to consult a running list of all the statutes that have been found to qualify as proper (b)(3) statutes by the courts. However, agencies may also use a statute not included in the Justice list, because many statutes that appear to meet the requirements of (b)(3) have not been identified by a court as qualifying statutes. If the agency uses a (b)(3) statute that is not identified in the qualifying list, Justice guidance instructs the agency to include information about that statute in its annual report submission. Justice reviews the statute and provides advice to the agency, but does not make a determination on the appropriateness of using that statute under the (b)(3) exemption. Based on data agencies reported to Justice, during fiscal years 2010 to 2016, agencies claimed 237 statutes as the basis for withholding information. Of these statutes, 75 were included on Justice’s list of qualifying statutes under the (b)(3) exemption. Further, we identified 140 additional statutes that were not identified in our 237 statutes claimed by agencies during fiscal years 2010 to 2016, but have similar provisions to other (b)(3) statutes authorizing an agency to withhold information from the public. We found that the 237 statutes cited as the basis for (b)(3) exemptions during the period from fiscal year 2010 to 2016 to fell into eight general categories of information. These categories were (1) personally identifying information, (2) national security, (3) commercial, (4) law enforcement and investigations, (5) internal agency, (6) financial regulation, (7) international affairs, and (8) environmental. Figure 6 identifies the eight categories and the number of agency-claimed (b)(3) statutes in each of the categories. Of the 237 (b)(3) statutes cited by agencies, the majority—178—fell into four of the eight categories: Forty-nine of these statutes related to withholding personally identifiable information including, for example, a statute related to withholding death certificate information provided to the Social Security Administration. Forty-five statutes related to the national security category. For example, one statute exempted files of foreign intelligence or counterintelligence operations of the National Security Agency. Forty-two statutes were in the law enforcement and investigations category, including a statute that exempts from disclosure information provided to Justice pursuant to civil investigative demands pertaining to antitrust investigations. Forty-two statutes fell into the commercial category. For example, one statute in this category related to withholding trade secrets and other confidential information related to consumer product safety. The remaining 59 statutes were in four categories: internal agency functions and practices, financial regulation, international affairs, and environmental. The environmental category contained the fewest number of statutes and included, for example, a statute related to withholding certain air pollution analysis information. As required by FOIA, agencies also reported the number of times they used each (b)(3) statute. In this regard, 33 FOIA-reporting agencies indicated that they had used 10 of the 237 (b)(3) statutes more than 200,000 times. Of these 10 most-commonly used statutes, the single most-used statute (8 U.S.C § 1202(f)) related to withholding records pertaining to the issuance or refusal of visas to enter the United States. It was used by 4 agencies over 58,000 times. Further, of the 10 most-commonly used statutes, the statute used by the greatest number of agencies (26 U.S.C § 6103) related to the withholding of certain tax return information; it was used by 24 FOIA-reporting agencies about 30,000 times. By contrast, some statutes were only used by a single agency. Specifically, the Department of Veterans Affairs used a statute related to withholding certain confidential veteran medical records (38 U.S.C. § 7332) more than 16,000 times. Similarly, EEOC used a statute related to employment discrimination on the basis of disability (42 U.S.C. § 12117) more than 10,000 times. Table 4 shows the 10 most-used statutes under the (b)(3) exemption, the agency that used each one most frequently, and the number of times they were used by that agency for the period covering fiscal years 2010 through 2016. The OPEN FOIA Act of 2009 amended FOIA to require that any federal statute enacted subsequently must specifically cite paragraph (b)(3) of FOIA to qualify as a (b)(3) exemption statute. Prior to 2009, a federal statute qualified as a statutory (b)(3) exemption if it (1) required that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (2) established particular criteria for withholding or refers to particular types of matters to be withheld. In response to the amendment, in 2010, Justice released guidance to agencies stating that any statute enacted after 2009 must specifically cite to the (b)(3) exemption to qualify as a withholding statute. Further, the guidance encouraged agencies to contact Justice with questions regarding the implementation of the amendment. Even with this guidance, we found that a majority of agency-claimed statutes during fiscal years 2010 through 2016 did not specifically cite the (b)(3) exemption. Specifically, of the 237 (b)(3) statutes claimed by agencies, 103 were enacted or amended after 2009 and, thus, were subject to the requirement of the OPEN FOIA Act. Of those 103 statutes, 86 lacked the required statutory text that cited exemption (b)(3) of FOIA. Figure 7 shows the number of agency-claimed statutes subject to the OPEN FOIA Act of 2009 requirement that did not cite the (b)(3) exemption. Agencies are using these statutes as the basis for withholding information when responding to a FOIA request. This is despite these statutes not having a reference to the (b)(3) exemption as required by the 2009 FOIA amendments. In our report, being issued today, we found that, according to the available information and Justice and OSC officials, since fiscal year 2008, no court orders have been issued that have required OSC to initiate a proceeding to determine whether disciplinary action should be taken against agency FOIA personnel. Specifically, officials in Justice’s Office of Information Policy stated that there have been no lawsuits filed by a FOIA requester that have led the courts to conduct all three requisite actions needed for Justice to refer a court case to OSC. Justice’s litigation and compliance reports identified six court cases (between calendar years 2013 and 2016) in which the requesters sought a referral from the courts in an attempt to have OSC initiate an investigation. However, in all six cases, the courts denied those requests, finding that each case did not result in the courts taking the three actions necessary to involve OSC. Thus, given these circumstances, Justice has not referred any court orders to OSC to initiate a proceeding to determine whether disciplinary action should be taken against agency FOIA personnel. For its part, OSC officials confirmed that the office has neither received, nor acted on, any such referrals from Justice. As such, OSC has not had cause to initiate disciplinary actions for the improper withholding of FOIA records. In summary, the 18 agencies we selected for review fully implemented half of the six FOIA requirements reviewed and the vast majority of agencies implemented two additional requirements. However, 5 agencies published and updated their FOIA regulations in a timely and comprehensive manner. Fully implementing FOIA requirements will better position agencies to provide the public with necessary access to government records and ensure openness in government. The selected agencies in our review varied considerably in the size of their backlogs. While 10 reported a backlog of 60 or fewer requests, 4 had backlogs of over 1,000 per year. Agencies identified a variety of methods that they used to address their backlogs, including practices identified by Justice, as well as additional methods. However, the selected agencies varied in the success achieved for reducing their backlogs. This was due, in part, to a lack of plan that describes how the agencies will implement best practices for reducing backlogs over time. Until agencies develop plans to reduce backlogs, they will be limited in their ability to respond effectively to the needs of requesters and the public. Accordingly, our draft report contains 23 planned recommendations to selected agencies. These recommendations address posting records online, designating chief FOIA officers, updating regulations consistent with requirements, and developing plans to reduce backlogs. Implementation of our recommendations should better position these agencies to address FOIA requirements and ensure the public is provided with access to government information. Chairman Grassley, Ranking Member Feinstein, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you have any questions on matters discussed in this testimony, please contact David A. Powner at (202) 512-9286 or at pownerd@gao.gov. Individuals who made key contributions to this testimony are Anjalique Lawrence (assistant director), Lori Martinez (analyst in charge), Gerard Aflague, David Blanding, Christopher Businsky, Rebecca Eyler, James Andrew Howard, Carlo Mozo, David Plocher, and Sukhjoot Singh. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: FOIA requires federal agencies to provide the public with access to government records and information based on the principles of openness and accountability in government. Each year, individuals and entities file hundreds of thousands of FOIA requests for information on numerous topics that contribute to the understanding of government actions. In the last 9 fiscal years, federal agencies subject to FOIA have received about 6 million requests. GAO was asked to summarize its draft report on federal agencies' compliance with FOIA requirements. GAO's objectives, among others, were to (1) determine the extent to which agencies have implemented selected FOIA requirements; (2) describe the methods established by agencies to reduce backlogged requests and the effectiveness of those methods; and (3) identify any statutory exemptions that have been used by agencies as the basis for withholding (redacting) information from requesters. To do so, GAO selected 18 agencies based on their size and other factors and assessed their policies against six FOIA requirements. GAO also reviewed the agencies' backlog reduction plans and developed a catalog of statutes that agencies have used to withhold information. In its draft report, GAO determined that all 18 selected agencies had implemented three of six Freedom of Information Act (FOIA) requirements reviewed. Specifically, all agencies had updated response letters to inform requesters of the right to seek assistance from FOIA public liaisons, implemented request tracking systems, and provided training to FOIA personnel. For the three additional requirements, 15 agencies had provided online access to government information, such as frequently requested records, 12 agencies had designated chief FOIA officers, and 5 agencies had published and updated their FOIA regulations to inform the public of their operations. Until these agencies address all of the requirements, they increase the risk that the public will lack information that ensures transparency and accountability in government operations. The 18 selected agencies had backlogs of varying sizes, with 4 agencies having backlogs of 1,000 or more requests during fiscal years 2012 through 2016. These 4 agencies reported using best practices identified by the Department of Justice, such as routinely reviewing metrics, as well as other methods, to help reduce their backlogs. Nevertheless, these agencies' backlogs fluctuated over the 5-year period (see figure). The 4 agencies with the largest backlogs attributed challenges in reducing their backlogs to factors such as increases in the number and complexity of FOIA requests. However, these agencies lacked plans that described how they intend to implement best practices to reduce backlogs. Until agencies develop such plans, they will likely continue to struggle to reduce backlogs to a manageable level. Agencies used various types of statutory exemptions to withhold information when processing FOIA requests during fiscal years 2010 to 2016. The majority of these fell into the following categories: personally identifiable information, national security, law enforcement and investigations, and confidential and commercial business information. GAO's draft report contains recommendations to selected agencies to post records online, designate chief FOIA officers, update regulations consistent with requirements, and develop plans to reduce backlogs.