The Freedom of Information Act establishes a legal right of access to government information on the basis of the principles of openness and accountability in government. Before FOIA’s enactment in 1966, an individual seeking access to federal records faced the burden of establishing a “need to know” before being granted the right to examine a federal record. FOIA established a “right to know” standard, under which an organization or person could receive access to information held by a federal agency without demonstrating a need or reason. The “right to know” standard shifted the burden of proof from the individual to a government agency and required the agency to provide proper justification when denying a request for access to a record. Any person, defined broadly to include attorneys filing on behalf of an individual, corporations, or organizations, can file a FOIA request. For example, an attorney can request labor-related workers’ compensation files on behalf of his or her client, and a commercial requester, such as a data broker who files a request on behalf of another person, may request a copy of a government contract. In response, an agency is required to provide the relevant record(s) in any readily producible form or format specified by the requester, unless the record falls within a permitted exemption that provides limitations on the disclosure of information. Appendix II includes a table describing the nine specific exemptions that can be applied to withhold information that, for example, is classified, confidential commercial, privileged, privacy, or falls into one or several law enforcement categories. Various amendments have been enacted and guidance issued to help improve agencies’ processing of FOIA requests, including: The Electronic Freedom of Information Act Amendments of 1996 (e- FOIA amendments) strengthened the requirement that federal agencies respond to a request in a timely manner and reduce their backlogged requests. The amendments, among other things, made a number of procedural changes, including allowing a requester to limit the scope of a request so that it could be processed more quickly and requiring agencies to determine within 20 working days whether a request would be fulfilled. This was an increase from the previously established time frame of 10 business days. The amendments also authorized agencies to multi-track requests— that is, to process simple and complex requests concurrently on separate tracks to facilitate responding to a relatively simple request more quickly. In addition, the amendment encouraged online, public access to government information by requiring agencies to make specific types of records available in electronic form. Executive Order 13392, issued by the President in 2005, directed each agency to designate a senior official as its chief FOIA officer. This official was to be responsible for ensuring agency-wide compliance with the act by monitoring implementation throughout the agency and recommending changes in policies, practices, staffing, and funding, as needed. The chief FOIA officer was directed to review and report on the agency’s performance in implementing FOIA to agency heads and to Justice in such times and formats established by the Attorney General. (These are referred to as chief FOIA officer reports.) The OPEN Government Act, which was enacted in 2007, made the 2005 executive order’s requirement for agencies to have a chief FOIA officer a statutory requirement. It also required agencies to include additional statistics in their annual FOIA reports, such as more details on processing times and the agency’s 10 oldest pending requests, appeals, and consultations. The FOIA Improvement Act of 2016 addressed procedural issues, including requiring that agencies: (1) make records available in an electronic format if they have been requested three or more times; (2) notify requesters that they have a maximum of 90 days to file an administrative appeal, and (3) provide dispute resolution services at various times throughout the FOIA process. This act also created more duties for chief FOIA officers, including requiring them to offer training to agency staff regarding FOIA responsibilities. The act also revised and added new obligations for OGIS, and created the Chief FOIA Officers Council to assist in compliance and efficiency. Further, the act required OMB, in consultation with Justice, to create a consolidated online FOIA request portal that allows the public to submit a request to any agency through a single website. In responding to requests, FOIA authorizes agencies to utilize one of nine exemptions to withhold portions of records, or the entire record. Agencies may use an exemption when it has been determined that disclosure of the requested information would harm an interest related to certain protected areas. These nine exemptions (described in appendix II) can be applied by agencies to withhold various types of information, such as information concerning foreign relations, trade secrets, and matters of personal privacy. One such exemption, the statutory (b)(3) exemption, specifically authorizes withholding information under FOIA on the basis of a law which: requires that matters be withheld from the public in such a manner as to leave no discretion on the issue; or establishes particular criteria for withholding or refers to particular types of matters to be withheld; and if enacted after October 28, 2009, specifically refers to section 552(b)(3) of title 5, United States Code. To account for agencies use of the statutory (b)(3) exemptions, FOIA requires each agency to submit, in its annual report to Justice, a complete listing of all statutes that the agency relied on to withhold information under exemption (b)(3). The act also requires that the agency describe for each statute identified in its report (1) the number of occasions on which each statute was relied upon; (2) a description of whether a court has upheld the decision of the agency to withhold information under each such statute; and (3) a concise description of any information withheld. Further, to provide an overall summary of the statutory (b)(3) exemptions used by agencies in a fiscal year, Justice produces consolidated annual reports that list the statutes used by agencies in conjunction with (b)(3). As previously noted, agencies are generally required by the e-FOIA amendments of 1996 to respond to a FOIA request within 20 working days. Once received, the request is to be processed through multiple phases, which include assigning a tracking number, searching for responsive records, and releasing the records response to the requester. Also, FOIA allows a requester to challenge an agency’s final decision on a request through an administrative appeal or a lawsuit. Agencies generally have 20 working days to respond to an administrative appeal. Figure 1 provides a simplified overview of the FOIA request and appeals process. In a typical agency, as indicated, during the intake phase, a request is logged into the agency’s FOIA tracking system, and a tracking number is assigned. The request is then reviewed by FOIA staff to determine its scope and level of complexity. The agency then sends a letter or email to the requester acknowledging receipt of the request, with a unique tracking number that the requester can use to check the status of the request. Next, FOIA staff (noncustodian) begin the search to retrieve the responsive records. They conduct a search if the agency’s records are centralized or route the request to the appropriate program office(s), or do both, as warranted. This step may include requesting that the custodian (owner) of the record search and review paper and electronic records from multiple locations and program offices. Agency staff then process the responsive records, which includes determining whether a portion or all of any record should be withheld based on FOIA’s exemptions. If a portion or all of any record is the responsibility of another agency, FOIA staff may consult with the other agency or may send (“refer”) the document(s) to that other agency for processing. After processing and redaction, a request is reviewed for errors and to ensure quality. The documents are then released to the requester, either electronically or by regular mail. Responsibility for the oversight of FOIA implementation is spread across several federal offices and other entities. These include Justice’s OIP, NARA’s OGIS, and the Chief FOIA Officers Council. These oversight offices and the council have taken steps to assist agencies to address the FOIA provisions. Justice’s OIP is responsible for encouraging agencies’ compliance with FOIA and overseeing their implementation of the act. In this regard, the office, among other things, provides guidance, compiles information on FOIA compliance, provides FOIA training, and prepares annual summary reports on agencies’ FOIA processing and litigation activities. The office also offers FOIA counseling services to government staff and the public. Issuing guidance. OIP has developed guidance, available on its website, to assist federal agencies by instructing them in how to ensure timely determinations on requests, expedite the processing of requests, and reduce backlogs. The guidance also informs agencies on what should be contained in their annual FOIA reports to Justice’s Attorney General. The office also has documented ways for federal agencies to address backlog requests. In March 2009 the Attorney General issued guidance and related policies to encourage agencies to reduce their backlogs of FOIA requests. In addition, in December 2009, OMB issued a memorandum on the OPEN Government Act, which called for a reduction in backlogs and the publishing of plans to reduce backlogs. Further, in August 2014 and December 2015, OIP held best practices workshops and issued guidance to agencies on reducing FOIA backlogs and improving timeliness of agencies’ responses to FOIA requests. The OIP guidance instructed agencies to obtain leadership support, routinely review FOIA processing metrics, and set up staff training on FOIA. Overseeing agencies’ compliance. OIP collects information on compliance with the act by reviewing agencies’ annual FOIA reports and chief FOIA officer reports. These reports describe the number of FOIA requests received and processed in a fiscal year, as well as the total costs associated with processing and litigating requests. Providing training. OIP provides a full suite of FOIA training for agency FOIA professionals. This training gives instruction on all aspects of FOIA and is designed for all levels of professionals. For example, the office offers an annual training class that provides a basic overview of the act, as well as hands-on courses about the procedural requirements involved in processing a request from start to finish. In addition, it offers a seminar outlining successful litigation strategies for attorneys who handle FOIA cases. OIP also provides agencies customized training upon request. Preparing annual reports. Every year, OIP prepares three major reports for the public, the President, and/or Congress. The first report, Summary of Annual FOIA Reports, is a summary of the information contained in the annual FOIA reports that are prepared by each of the federal agencies subject to the FOIA. The report also provide a statistical breakdown of the government’s overall FOIA administration. The second report, Summary of Agency Chief FOIA Officer Reports, is a summary of the annual chief FOIA officer reports and an assessment of agencies’ progress in administering FOIA. This report summarizes government-wide efforts to improve FOIA in five key areas of FOIA administration, and it individually scores each agency on several milestones tied to these efforts. The third report, the Justice FOIA Litigation and Compliance Report, which is directed to Congress and the President, describes Justice’s efforts to oversee and encourage government-wide compliance with FOIA, and includes a list of, and information about, FOIA matters in litigation. NARA’s OGIS was established by the OPEN Government Act of 2007 as the federal FOIA ombudsman tasked with resolving federal FOIA disputes through mediation as a nonexclusive alternative to litigation. OGIS’s responsibilities include reviewing agencies’ policies, procedures, and compliance with the statute; identifying methods to improve compliance; and educating its stakeholders about the FOIA process. The 2016 FOIA amendments required agencies to update response letters to FOIA requesters to include information concerning the roles of OGIS and agency’s FOIA public liaisons. As such, OGIS and Justice worked together to develop a response letter template that includes the required language for agency letters. In addition, OGIS, charged with reviewing agency’s compliance with FOIA, launched a FOIA compliance program in 2014. OGIS also developed a FOIA compliance self- assessment program, which is intended to help OGIS look for potential compliance issues across federal agencies. The Chief FOIA Officers Council is co-chaired by the Director of OIP and the Director of OGIS. Council members include senior representatives from OMB, OIP, and OGIS, together with the chief FOIA officers of each agency, among others. The council’s FOIA-related responsibilities include: developing recommendations for increasing FOIA compliance and disseminating information about agency experiences, ideas, best practices, and innovative approaches; identifying, developing, and coordinating initiatives to increase transparency and compliance; and promoting the development and use of common performance measures for agency compliance. The 18 agencies selected for our review are charged with a variety of operations that affect many aspects of federal service to the public. Thus, by the nature of their missions and operations, the agencies have responsibility for vast and varied amounts of information that can be subject to a FOIA request. For example, the Department of Homeland Security’s (DHS) mission is to protect the American people and the United States homeland. As such, the department maintains information covering, among other things, immigration, border crossings, and law enforcement. As another example, the Department of the Interior’s (DOI) mission includes protecting and managing the nation’s natural resources and, thus, providing scientific information about those resources. Table 2 provides details on each of the 18 selected agencies’ missions and the types of information they maintain. The 18 selected agencies reported that they received and processed more than 2 million FOIA requests from fiscal years 2012 through 2016. Over this 5-year period, the number of reported requests received fluctuated among the agencies. In this regard, some agencies saw a continual rise in the number of requests, while other agencies experienced an increase or decrease from year to year. For example, from fiscal years 2012 through 2014, DHS saw an increase in the number of requests received (from 190,589 to 291,242), but in fiscal year 2015, saw the number of requests received decrease to 281,138. Subsequently, in fiscal year 2016, the department experienced an increase to 325,780 requests received. In addition, from fiscal years 2012 through 2015, the reported numbers of requests processed by the selected agencies showed a relatively steady increase. However, in fiscal year 2016, the reported number of requests processed by these agencies declined. Further, figure 2 provides a comparison of the total number of requests received and processed in this 5-year period. Among other things, the FOIA Improvement Act of 2016 and the OPEN Government Act of 2007 call for agencies to (1) update response letters, (2) implement tracking systems, (3) provide FOIA training, (4), provide records online, (5) designate chief FOIA officers, and (6) update and publish timely and comprehensive regulations. The 18 agencies that we included in our review had implemented the majority of the 6 selected FOIA requirements. Specifically, 18 agencies updated response letters, 16 agencies implemented tracking that was compliant with requirements for people with disabilities 18 agencies provided FOIA training for agency staff 15 agencies provided records online, 13 agencies designated chief FOIA officers, and 5 agencies published their updated FOIA regulations by the required due date, and 8 agencies did so after the due date. Figure 3 summarizes the extent to which the 18 agencies implemented the selected FOIA requirements. Beyond these selected agencies, Justice’s OIP and OMB also had taken steps to develop a government-wide FOIA request portal that is intended to allow the public to submit a request to any agency from a single website. The 2016 amendments to FOIA required agencies to include specific information in their responses when making their determinations on requests. If part of a request is denied, for example, agencies must inform requesters that they may seek assistance from the FOIA public liaison of the agency or OGIS, file an appeal to an adverse determination within a period of time that is not less than 90 days after the date of such adverse determination; and seek dispute resolution services from the FOIA public liaison of the agency or OGIS. Among the 18 selected agencies, all had updated their FOIA response letters to include this required information. Various FOIA amendments and guidance call for agencies to use automated systems to improve the processing and management of requests. In particular, the OPEN Government Act of 2007 amended FOIA to require that federal agencies establish a system to provide individualized tracking numbers for requests that will take longer than 10 days to process and establish telephone or Internet service to allow requesters to track the status of their requests. Further, the President’s January 2009 Freedom of Information Act memorandum instructed agencies to use modern technology to inform citizens about what is known and done by their government. In addition, FOIA processing systems, like all automated information technology systems, are to comply with the requirements of Section 508 of the Rehabilitation Act of 1973 (Rehabilitation act (as amended)). This act requires federal agencies to make their electronic information accessible to people with disabilities. Each of the 18 selected agencies had implemented a system that provides capabilities for tracking requests received and processed, including an individualized number for tracking the status of a request. Specifically, Ten agencies used commercial automated systems, (DHS, EEOC, FDIC, FTC, Justice, NARA, NASA, NTSB, Pension Benefit Guaranty Corporation, and USAID). Three agencies developed their own agency systems (State, DOI, and TVA). Five agencies used Microsoft Excel or Word to track requests (Administrative Conference of the United States, American Battle Monuments Commission, Broadcasting Board of Governors, OMB, and U.S. African Development Foundation). Further, all of the agencies had established telephone or Internet services to assist requesters in tracking the status of requests; and they used modern technology (e.g., mobile applications) to inform citizens about FOIA. For example, the commercial systems allow requesters to submit a request and track the status of that request online. In addition, DHS developed a mobile application that allows FOIA requesters to submit requests and check the status of existing requests. However, while 16 agencies FOIA tracking systems were compliant with requirements of Section 508 of the Rehabilitation Act (as amended), two agencies—TVA and DOI—had systems that were not compliant. According to TVA officials, the agency does not have a 508 compliance certification. DOI officials stated that its FOIA system will undergo 508 compliance testing but did provide a date for completion of the testing. Having systems that are compliant with Section 508 of the Rehabilitation Act (as amended) is essential to ensure that the department’s electronic information is accessible to all individuals, including those with disabilities. The 2016 FOIA amendments require agencies’ chief FOIA officers to offer training to agency staff regarding their responsibilities under FOIA. In addition, Justice’s OIP has advised every agency to make such training available to all of their FOIA staff at least once each year. The office has also encouraged agencies to take advantage of FOIA training opportunities available throughout the government. The 18 selected agencies’ chief FOIA officers offered FOIA training opportunities to staff in fiscal years 2016 and 2017. For example: Twelve agencies provided training that gave an introduction and overview of FOIA (the American Battle Monuments Commission, Broadcasting Board of Governors, EEOC, Justice, FDIC, FTC, NARA, Pension Benefit Guaranty Corporation, State, TVA, U.S. African Development Foundation, and USAID). Four agencies offered training for their agencies’ online FOIA tracking and processing systems (DOI, EEOC, NTSB, and Pension Benefit Guaranty Corporation). Five agencies provided training on responding to, handling, and processing FOIA requests (DHS, DOI, EEOC, Justice, and State). Seven agencies offered training on understanding and applying the exemptions under FOIA (the Broadcasting Board of Governors, EEOC, FDIC, FTC, Justice, State, and U.S. African Development Foundation). Four agencies offered training on the processing of costs and fees (EEOC, Justice, NASA and TVA). Memorandums from both the President and the Attorney General in 2009 highlighted the importance of online disclosure of information and further directed agencies to make information available without a specific FOIA request. Further, FOIA required online access to government information and required agencies to make information available to the public in electronic form for four categories: agency final opinions and orders, administrative staff manuals and staff instructions that affect the frequently requested records. While all 18 agencies that we reviewed posted records online, only 15 of them had posted all categories of information, as required by the FOIA. Specifically, 7 agencies—the American Battle Monuments Commission, the Pension Benefit Guaranty Corporation, and EEOC, FDIC, FTC, Justice, and State—had, as required, made records in all four categories publicly available online. In addition, 5 agencies that were only required to publish online records in 3 categories—the Administrative Conference of the United States, Broadcasting Board of Governors, DHS, OMB, and USAID— had done so. Further, 3 agencies that were only required to publish online records in two of the categories—U.S. African Development Foundation, NARA, and TVA—had done so. The remaining 3 agencies—DOI, NASA, and NTSB—had posted records online for three of four required categories. Regarding why the three agencies did not post all of their four required categories of online records, DOI officials stated that the agency does not make publicly available all FOIA records that have been requested three or more times, as it does not have the time to post all such records that have been requested. NASA officials explained that, while the agency issues final opinions, it does not post them online. NTSB officials said they try to post information that is frequently requested, but they do not post the information on a consistent basis. Making the four required categories of information available in electronic form is an important step in allowing the public to easily access to government documents. Until these agencies make all required categories of information available in electronic form, they cannot ensure that they are providing the required openness in government. In 2005, the President issued an executive order that established the role of a chief FOIA officer. In 2007, amendments to FOIA required each agency to designate a chief FOIA officer who shall be a senior official at the assistant secretary or equivalent level. Of the 18 selected agencies, 13 agencies have chief FOIA officers who are senior officials at the assistant secretary or equivalent level. The assistant secretary level is comparable to senior executive level positions at levels III, IV, and V. Specifically, State has designated its Assistant Secretary of Administration, Bureau DOI and NTSB had designated their Chief Information Officers; Administrative Conference of the United States, Broadcasting Board of Governors, FDIC, NARA, and U.S. African Development Foundation have designated their general counsels; Justice, NASA, TVA, and USAID designated their Associate Attorney General, Associate Administrator for Communications, the Vice President for Communications, and the Assistant Administrator for the Bureau of Management, respectively; and DHS designated its Chief Privacy Officer. However, 5 agencies—American Battle Monuments Commission, EEOC, Pension Benefit Guaranty Corporation, FTC, and OMB—do not have chief FOIA officers who are senior officials at the assistant secretary or equivalent level. According to officials from 4 of these agencies, the agencies all have chief FOIA officers and officials believed they had designated the appropriate officials. Officials at FTC acknowledged that the chief FOIA officer position is not designated at a level equivalent to an assistant secretary but a senior position within the agency. However, while there are chief FOIA officers at these agencies, until the chief FOIA officers are designated at the Assistant Secretary or equivalent level, they will lack assurance regarding the necessary authority to make decisions about agency practices, personnel, and funding. FOIA requires federal agencies to publish regulations in the Federal Register that inform the public of their FOIA operations. Specifically, in 2016, FOIA was amended to require agencies to update their regulations regarding their FOIA operations. To assist agencies in meeting this requirement, OIP created a FOIA regulation template. Among other things, OIP’s guidance encouraged agencies to: describe their dispute resolution process, describe their administrative appeals process for response letters of denied requests, notify requesters that they have a minimum of 90 days to file an include a description of what happens when there are unusual circumstances, as well as restriction on agencies’ abilities to charge certain fees when FOIA's times limits are not met; and update the regulations in a timely manner (i.e., update regulations by 180 days after the enactment of the 2016 FOIA amendment). Five agencies in our review—DHS, DOI, FDIC, FTC, and USAID— addressed all five requirements in updating their regulations. In addition, seven agencies addressed four of the five requirements: the Administrative Conference of the United States, EEOC, Justice, NARA, NTSB, Pension Benefit Guaranty Corporation, and TVA did not update their regulations in a timely manner. Further, four agencies addressed three or fewer requirements (U.S. African Development Foundation, State, NASA, and Broadcasting Board of Governors) and two agencies (American Battle Monuments Commission and OMB) did not address any of the requirements. Figure 4 indicates the extent to which the 18 agencies had addressed the five selected requirements. Agencies that did not address all five requirements provided several explanations as to why their regulations were not updated as required: American Battle Monuments Commission officials stated that while they updated their draft regulation in August 2017, it is currently unpublished due to internal reviews with the commission’s General Counsel in preparation for submission to the Federal Register. No new posting date has been established. American Battle Monuments Commission last updated its regulation in February 26, 2003. State officials noted that their regulation was updated 2 months prior to the new regulation requirements but did not provide a specific reason for not reissuing their regulation. As such, they explained that they have a working group reviewing their regulation for updates, with no timeline identified. State last updated its regulation on April 6, 2016. NASA officials did not provide a reason for not updating their regulation as required. Officials did, however, state that their draft regulation is with NASA’s Office of General Counsel for review. NASA last updated its regulations on August 11, 2017. Broadcasting Board of Governors officials did not provide a reason for not updating their regulation as required. Officials did, however, note that the agency is in the process of updating its regulation and anticipates it will complete this update by the end of 2018. The Broadcasting Board of Governors last updated its regulation on February 2, 2002. OMB officials did not provide a reason for not updating the agency’s regulation as required. Officials did, however, state that due to a change in leadership they do not have a time frame for updating their regulation. OMB last updated its regulation on May 27, 1998. The chief FOIA officer at the U.S. African Development Foundation stated that, while the agency had updated and submitted its regulation to be published in December 2016, the regulation was unpublished due to an error that occurred with the acknowledgement needed to publish the regulation in the Federal Register. The regulation was subsequently published on February 3, 2017. The official further noted that when the agency responds to FOIA requests, it has not charged a fee for unusual circumstances, and, therefore, agency officials did not believe they had to disclose information regarding fees in their regulation. Until these six agencies publish updated regulations that address the necessary requirements, as called for in FOIA and OIP guidance, they likely will be unable to provide the public with required regulatory and procedural information to ensure transparency and accountability in the government. The 2016 FOIA amendments required OMB to work with Justice to build a consolidated online FOIA request portal. This portal is intended to allow the public to submit a request to any agency from a single website and include other tools to improve the public’s access to the benefits of FOIA. Further, the act required OMB to establish standards for interoperability between the consolidated portal and agency FOIA systems. The 2016 FOIA amendments did not provide a time frame to develop the portal and standards. With OMB's support, Justice has developed an online portal. In this regard, Justice’s OIP officials stated that the National FOIA Portal provides the functionality required by FOIA, including the ability to make a request to any agency and the technical framework for interoperability. According to OIP officials, in partnership with OMB, OIP was able to identify a dedicated funding source to operate and maintain the portal to ensure its success in the long term, with major agencies sharing in the costs to operate, maintain, and fund any future enhancements designed to improve FOIA processes. The first iteration of the National FOIA Portal launched on Justice’s FOIA.gov website on March 8, 2018. The 18 selected agencies in our review had FOIA request backlogs of varying sizes, ranging from no backlogged requests at some agencies to 45,000 or more of requests at other agencies. Generally, the agencies with the largest backlogs had received the most requests. In an effort to aid agencies in reducing their backlogs, Justice’s OIP identified key practices that agencies can use. However, while the agencies reported using these practices and other methods, few of them managed to reduce their backlogs during the period from fiscal year 2012 through 2016. In particular, of the four agencies with the largest backlogs, only one— NARA—reduced its backlog. Agencies attributed their inability to decrease backlogs to the increased number and complexity of requests, among other factors. However, agencies also lack comprehensive plans to implement practices on an ongoing basis. The selected agencies in our review varied considerably in the size of their FOIA request backlogs. Specifically, from fiscal year 2012 through 2016, of the 18 selected agencies 10 reported a backlog of 60 or fewer requests, and of these 10 agencies, 6 reported having no backlog in at least 1 year. 4 agencies had backlog numbers between 61 and 1,000 per year; and 4 agencies had backlogs of over 1,000 requests per year. The four agencies with backlogs of more than 1,000 requests for each year we examined were Justice, NARA, State and DHS. Table 3 shows the number of requests and the number of backlogged request for the 18 selected agencies during the 5-year period. Over the 5-year period, 14 of the 18 selected agencies experienced an increase in their backlogs in at least 1 year. By contrast, 2 agencies (Administrative Conference of the United States and the U.S. African Development Foundation) reported no backlogs, and 3 agencies (American Battle Monument Commission, NASA and NARA) reported reducing their backlogs. Further, of the 4 agencies with the largest backlogs (DHS, State, Justice, and NARA) only NARA reported a backlog lower in fiscal year 2016 than in fiscal year 2012. Figure 5 shows the trends for the 4 agencies with the largest backlogs, compared with the rest of the 18 agencies. In most cases, agencies with small or no backlogs (60 or fewer) also received relatively few requests. For example, the Administrative Conference of the United States and the U.S. African Development Foundation reported no backlogged requests during any year but also received fewer than 30 FOIA requests a year. The American Battle Monuments Commission also received fewer than 30 requests a year and only reported 1 backlogged request per year in 2 of the 5 years examined. However, the Pension Benefit Guaranty Corporation and FDIC received thousands of requests over the 5-year period, but maintained zero backlogs in a majority of the years examined. PBGC received a total of 19,120 requests during the 5-year period and only reported a backlog of 8 requests during 1 year, fiscal year 2013. FDIC received a total of 3,405 requests during the 5-year period and reported a backlog of 13 requests in fiscal year 2015 and 4 in fiscal year 2016. The four agencies with backlogs of 1,000 or more (Justice, NARA, State, and DHS) received significantly more requests each year. For example, NARA received between about 12,000 and 50,000 requests each year, while DHS received from about 190,000 to 325,000 requests. In addition, the number of requests NARA received in fiscal year 2016 was more than double the number received in fiscal year 2012. DHS received the most requests of any agency—a total of 1,320,283 FOIA requests over the 5- year period. The Attorney General’s March 2009 memorandum called on agency chief FOIA officers to review all aspects of their agencies’ FOIA administration and report to Justice on steps that have been taken to improve FOIA operations and disclosure. Subsequent Justice guidance required agencies to include in their chief FOIA officer reports information on their FOIA request backlogs, including whether the agency experienced a backlog of requests; whether that backlog decreased from the previous year; and, if not, reasons the backlog did not decrease. In addition, agencies that had more than 1,000 backlogged requests in a given year were required to describe their plans to reduce their backlogs. Beginning in calendar year 2015, these agencies were to describe how they implemented their plans from the previous year and whether that resulted in a backlog reduction. In addition, Justice’s OIP identified best practices for reducing FOIA backlogs. The office held a best practices workshop on reducing backlogs and improving timeliness. The office then issued guidance in August 2014 that highlighted key practices to improve the quality of a FOIA program. OIP identified the following methods in its best practices guidance. Utilize resources effectively. Agencies should allocate their resources effectively by using multi-track processing, making use of available technology, and shifting priorities and staff assignments to address needs and effectively manage workloads. Routinely review metrics. Agencies should regularly review their FOIA data and processes to identify challenges or barriers. Additionally, agencies should identify trends to effectively allocate resources, set goals for staff, and ensure needs are addressed. Emphasize staff training. Agencies should ensure FOIA staff are properly trained so they can process requests more effectively and with more autonomy. Training and engagement of staff can also solidify the importance of the FOIA office’s mission. Obtain leadership support. Agencies should ensure that senior management is involved in and supports the FOIA function in order to increase awareness and accountability, as well as make it easier to obtain necessary resources or personnel. Agencies identified a variety of methods that they used to address their backlogs. These included both the practices identified by Justice, as well as additional methods. Ten agencies maintained relatively small backlogs of 60 or fewer requests and were thus not required to develop plans for reducing backlogs. However, 2 of these 10 agencies, who both received significant numbers of requests, described various methods used to maintain a small backlog: PBGC officials credit their success to training, not only for FOIA staff, but all Incoming personnel, while also awarding staff for going above and beyond in facilitating FOIA processing. Pension Benefit Guaranty Corporation has incorporated all the best practices identified by OIP, including senior leadership involvement that supports FOIA initiatives and program goals, routine review of metrics to optimize workflows, effective utilization of resources and staff training. According to FDIC officials, their overall low backlog numbers are attributed to a trained and experienced FOIA staff, senior management involvement, and coordination among FDIC divisions. However, FDIC stated the reason for the increase in backlogs in fiscal year 2015 was due to increased complexity of requests. The 4 agencies with backlogs greater than 60 but fewer than 1,000 (EEOC, DOI, NTSB, and USAID) reported using various methods to reduce their backlogs. However, all 4 showed an increase over the 5-year period. EEOC officials stated that they had adopted practices recommended by OIP, such as multi-track processing, reviewing workloads to ensure sufficient staff, and using temporary assignments to address needs. However, EEOC has seen a large increase in its backlog numbers, going from 131 in fiscal year 2012 to 792 in fiscal year 2016. EEOC attributed the rise in backlogs to an increase in requests received, loss of staff, and the complex and voluminous nature of requests. DOI, according to agency officials, has also tried to incorporate reduction methods and best practices, including proactively releasing information that may be of interest to the public, thus avoiding the need for a FOIA request; enhanced training for its new online FOIA tracking and processing system; improved interoffice collaboration; production of monthly reports on backlogs and of weekly charts on incoming requests, to heighten awareness among leadership; and monitoring trends. Yet DOI has seen an increase in its backlog, from 449 in fiscal year 2012 to 677 in fiscal year 2016, an increase of 51 percent. DOI attributed the increase to the loss of FOIA personnel, an increase in the complexity of requests, an increase in FOIA-related litigation, an increase in incoming requests, and the fact that staff have additional duties. Officials at NTSB stated that the board utilized contractors and temporary staff assignments to augment staffing and address backlogs. Despite the effort, NTSB saw a large increase in backlogs, from 62 in fiscal year 2012 to 602 in fiscal year 2016. Officials stated that the reason for the increase was an increased complexity of requests, including requests for “any and all” documentation related to a specific subject, often involving hundreds to thousands of pages per request. According to USAID officials, the agency conducts and reviews inventories of its backlog and requests to remove duplicates and closed cases; groups and classifies requests by necessary actions and responsive offices; and initiates immediate action. In addition, USAID seeks to identify tools and solutions to streamline records for review and processing. However, its backlog numbers have continually increased, from 201 in fiscal year 2012 to 318 in fiscal year 2016. USAID attributes that increase to an increase in the number of requests, the loss of FOIA staff, an increased complexity and volume of requests, competing priorities, and world events that may drive surges in requests. Of the four agencies with the largest backlogs, all reported taking steps that, in some cases, included best practices identified by OIP; however, only NARA successfully reduced its backlog by the end of the 5-year period. Justice officials noted that the department made efforts to reduce its backlog by incorporating best practices. Specifically, OIP worked with components within Justice through the Component Improvement Initiative to identify causes contributing to a backlog and assist components in finding efficiencies and overcoming challenges. The chief FOIA officer continued to provide top-level support to reduction efforts by convening the department’s FOIA Council to manage overall FOIA administration. In addition, many of the components created their own reduction plans, which included hiring staff, utilizing technology, and providing more training, requester outreach, and multitrack processing. However, despite these efforts, the number of backlogs steadily increased during the 5-year period, from 5,196 in fiscal year 2012 to 10,644 in fiscal year 2016, an overall increase of 105 percent. Justice attributes the increase in backlogs to several challenges, including an increase in incoming requests and an increase in the complexity of those requests. Other challenges that Justice noted were staff shortages and turnover, reorganization of personnel roles, time to train incoming staff, and the ability to fill positions previously held by highly qualified professionals. NARA officials stated that one key step NARA took was to make corrections in its Performance Measurement and Reporting System. They noted that this system previously comingled backlogged requests with the number of pending FOIA requests, skewing the backlog numbers higher. The improvements included better accounting for pending and backlogged cases, distinguishing between simple and complex requests, and no longer counting as “open” cases that were closed within 20 days, but not until the beginning of the following fiscal year. In addition, officials also stated that the FOIA program offices have been successful at working with requesters to narrow the scope of requests. NARA also stated that it was conducting an analysis of FOIA across the agency to identify any barriers in the process. Officials also identified other methods, including using multi-track processing, shifting priorities to address needs, improved communication with agencies, proactive disclosures, and the use of mediation services. NARA has shown significant progress in reducing its backlog. In fiscal year 2012 it had a backlog of 7,610 requests, which spiked to 9,361 in fiscal year 2014. However, by fiscal year 2016, the number of backlogged requests had dropped to 2,932, even though the number of requests received more than doubled for that fiscal year. However, NARA did note challenges to reducing its backlog numbers, namely, the increase in the number of requests received. State developed and implemented a plan to reduce its backlog in fiscal year 2016. The plan incorporated two best practices by focusing on identifying the extent of the backlog problem and developing ways to address the backlog with available resources. According to State officials, the effort was dedicated to improve how FOIA data were organized and reported. Expedited and ligation cases were top priorities, whereas in other cases a “first in, first out” method was employed. Even with these efforts, however, State experienced a 117 percent increase in its backlog over the 5-year period. State’s backlog doubled from 10,045 in fiscal year 2014 to 22,664 in fiscal year 2016. Among the challenges to managing its backlog, State reported an increase in incoming requests, a high number of litigation cases, and competing priorities. Specifically, the number of incoming requests for State increase by 51 percent during the 5-year period. State has also reported that it has allocated 80 percent of its FOIA resources to meet court-ordered productions associated with litigation cases, resulting in fewer staff to work on processing routine requests. This included, among other efforts, a significant allocation of resources in fiscal year 2015 to meet court-imposed deadlines to process emails associated with the former Secretary of State, resulting in a surge of backlogs. In 2017 State began an initiative to actively address its backlogs. The Secretary of State issued an agency-wide memorandum stating the department’s renewed efforts by committing more resources and workforce to backlog reduction. The memo states new processes are to be implemented for both the short- and long-term, and the FOIA office has plans to work with the various bureaus to outline the tasks, resources, and workforce necessary to ensure success and compliance. With renewed leadership support, State has reported significant progress in its backlog reduction efforts. DHS, in its chief FOIA officer reports, reported that it implemented several plans to reduce backlogs. The DHS Privacy Office, which is responsible for oversight of the department’s FOIA program, worked with components to help eliminate the backlog. The Privacy Office sent monthly emails to component FOIA officers on FOIA backlog statistics, convened management meetings, conducted oversight, and reviewed workloads. Leadership met weekly to discuss the oldest pending requests, appeals, and consultations, and determined needed steps to process those requests. In addition, several other DHS components implemented actions to reduce backlogs. Customs and Border Protection hired and trained additional staff, encouraged requesters to file requests online, established productivity goals, updated guidance, and utilized better technology. U.S. Citizenship and Immigration Services, National Protection and Programs Directorate, and Immigration and Customs Enforcement increased staffing or developed methods to better forecast future workloads ensure adequate staffing. Immigration and Customs Enforcement also implemented a commercial off-the-shelf web application, awarded a multimillion-dollar contract for backlog reduction, and detailed employees from various other offices to assist in the backlog reduction effort. Due to efforts by the Privacy Office and other components, the backlog dropped 66 percent in fiscal year 2015, decreasing to 35,374. Yet, despite the continued efforts in fiscal year 2016, the backlog numbers increased again, to 46,788. DHS attributes the increases in backlogs to several factors, including an increase in the number of requests received, increased complexity and volume of responsive records for those requests, loss of staff and active litigation with demanding production schedules. One reason the eight agencies with significant backlogs may be struggling to consistently reduce their backlogs is that they lack documented, comprehensive plans that would provide a more reliable, sustainable approach to addressing backlogs. In particular, they do not have documented plans that describe how they will implement best practices for reducing backlogs over time, including specifying how they will use metrics to assess the effectiveness of their backlog reduction efforts and ensure that senior leadership supports backlog reduction efforts, among other best practices identified by OIP. While agencies with backlogs of 1,000 or more FOIA requests are required to describe backlog reduction efforts in their chief FOIA officer reports, these consist of a high-level narrative and do not include a specific discussion of how the agencies will implement best practices over time to reduce their backlog. In addition, agencies with backlogs of fewer than 1,000 requests are not required to report on backlog reduction efforts; however, the selected agencies in our review with backlogs in the hundreds still experienced an increase over the 5-year period. Without a more consistent approach, agencies will continue to struggle to reduce their backlogs to a manageable level, particularly as the number and complexity of requests increase over time. As a result, their FOIA processing may not respond effectively to the needs of requesters and the public. FOIA requires agencies to report annually to Justice on their use of statutory (b)(3) exemptions. This includes specifying which statutes they relied on to exempt information from disclosure and the number of times they did so. To assist agencies in asserting and accounting for their use of these statutes, Justice instructs agencies to consult a running list of all the statutes that have been found to qualify as proper (b)(3) statutes by the courts. However, agencies may also use a statute not included in the Justice list, because many statutes that appear to meet the requirements of (b)(3) have not been identified by a court as qualifying statutes. If the agency uses a (b)(3) statute that is not identified in the qualifying list, Justice guidance instructs the agency to include information about that statute in its annual report submission. Justice reviews the statute and provides advice to the agency, but does not make a determination on the appropriateness of using that statute under the (b)(3) exemption. Based on data agencies reported to Justice, during fiscal years 2010 to 2016, agencies claimed 237 statutes as the basis for withholding information. Of these statutes, 75 were included on Justice’s list of qualifying statutes under the (b)(3) exemption (see appendix III for a list of these statutes). Further, we identified 140 additional statutes that were not identified in our 237 statutes claimed by agencies during fiscal years 2010 to 2016, but have similar provisions to other (b)(3) statutes authorizing an agency to withhold information from the public (see appendix IV for a list of these additional statutes). We found that the 237 statutes cited as the basis for (b)(3) exemptions during the period from fiscal years 2010 to 2016 fell into 8 general categories of information. These categories were (1) personally identifying information, (2) national security, (3) commercial, (4) law enforcement and investigations, (5) internal agency, (6) financial regulation, (7) international affairs, and (8) environmental. Figure 6 identifies the eight categories and the number of agency-claimed (b)(3) statutes in each of the categories. Of the 237 (b)(3) statutes cited by agencies, the majority—178—fell into 4 of the 8 categories: Forty-nine of these statutes related to withholding personally identifiable information including, for example, a statute related to withholding death certificate information provided to the Social Security Administration. Forty-five statutes related to the national security category. For example, one statute exempted files of foreign intelligence or counterintelligence operations of the National Security Agency. Forty-two statutes were in the law enforcement and investigations category, including a statute that exempts from disclosure information provided to Justice pursuant to civil investigative demands pertaining to antitrust investigations. Forty-two statutes fell into the commercial category. For example, one statute in this category related to withholding trade secrets and other confidential information related to consumer product safety. The remaining 59 statutes were in four categories: internal agency functions and practices, financial regulation, international affairs, and environmental. The environmental category contained the fewest number of statutes and included, for example, a statute related to withholding certain air pollution analysis information. As required by FOIA, agencies also reported the number of times they used each (b)(3) statute. In this regard, 33 FOIA-reporting agencies indicated that they had used 10 of the 237 (b)(3) statutes more than 200,000 times. Of these 10 most-commonly used statutes, the single most-used statute (8 U.S.C § 1202(f)) related to withholding records pertaining to the issuance or refusal of visas to enter the United States. It was used by 4 agencies over 58,000 times. Further, of the 10 most-commonly used statutes, the statute used by the greatest number of agencies (26 U.S.C § 6103) related to the withholding of certain tax return information; it was used by 24 FOIA-reporting agencies about 30,000 times. By contrast, some statutes were only used by a single agency. Specifically, the Department of Veterans Affairs used a statute related to withholding certain confidential veteran medical records (38 U.S.C. § 7332) more than 16,000 times. Similarly, EEOC used a statute related to employment discrimination on the basis of disability (42 U.S.C. § 12117) more than 10,000 times. Table 4 shows the 10 most-used statutes under the (b)(3) exemption, the agency that used each one most frequently, and the number of times they were used by that agency for the period covering fiscal years 2010 through 2016. The OPEN FOIA Act of 2009 amended FOIA to require that any federal statute subsequently enacted must specifically cite paragraph (b)(3) of FOIA to qualify as a (b)(3) exemption statute. Prior to 2009, a federal statute qualified as a statutory (b)(3) exemption if it (1) required that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (2) established particular criteria for withholding or referred to particular types of matters to be withheld. According to statements by the sponsor of the legislation during the Senate debate, (b)(3) statutory exemptions should be clear and unambiguous, and vigorously debated by Congress before they are enacted into law. In response to the amendment, in 2010, Justice released guidance to agencies stating that any statute enacted after 2009 must specifically cite to the (b)(3) exemption to qualify as a withholding statute under FOIA. Further, the guidance encouraged agencies to contact Justice with questions regarding the implementation of the amendment. In our review of the 237 (b)(3) statutes claimed by agencies during fiscal years 2010 through 2016, 21 of these statutes were initially enacted and 82 were amended after 2009. Of the 21 statutes initially enacted after 2009, 9 cited (b)(3). Further, of the 82 statutes amended, 9 cited (b)(3). While reflecting provisions of law authorizing or requiring the withholding of agency information from the public, the number of these statutes not having a reference to the (b)(3) exemption is evidence of the OPEN FOIA Act’s uneven impact on the establishment of statutory FOIA exemptions. As previously noted, FOIA requires federal agencies to provide the public with access to various types of information that can contribute to the understanding of government operations. One of these areas has related to the 2008 financial crisis, in which the Emergency Economic Stabilization Act of 2008 played a significant role in stabilizing the federal financial system. The act initially authorized $700 billion to assist financial institutions and markets, businesses, and homeowners through TARP, although that authorization was later reduced to $475 billion. Treasury, which was given authority under the act, established the Office of Financial Stability to carry out the program’s activities. These activities included injecting capital into key financial institutions, implementing programs to address problems in the securitization markets, providing assistance to the automobile industry, and offering incentives for modifying residential mortgages. In addition, federal financial regulators— FDIC, the Federal Reserve Board, and the Office of the Comptroller of the Currency—each played a key role in regulating and monitoring financial institutions. Following the law’s enactment, in certain periods from 2008 through 2014, three corporations—AIG, GM, and Ally—received federal financial assistance that amounted to 50 percent or more ownership by the federal government. The actions with regard to TARP subsequently led to the Treasury and the three financial regulatory agencies receiving FOIA requests for government records related to the three corporations. Specifically, the Federal Reserve Board, FDIC, the Office of the Comptroller of the Currency, and Treasury received 166 FOIA requests for information about these three corporations from September 2008 through January 2014. The requests asked for various agency records related to the corporations, for example, records related to Treasury’s stewardship and oversight of AIG and its subsidiaries; records related to the Federal Reserve Board and Ally specific to the individual submitting the FOIA request’s review; records concerning GM’s contract with the Stillwater Mining Company; and all communications between the Office of the Comptroller of the Currency and AIG from June 2007 through March 2009. Of the 166 requests, 88 were processed as full grant, partial grant, or full denial; 34 were withdrawn by the requester; 24 were closed because the agency responded that it had no records regarding the requests; and 20 fell into other disposition categories. Table 5 summarizes the disposition/resolution of the FOIA requests that each of the four federal agencies received relating to information on AIG, GM and Ally for certain periods from September 2008 to January 2014 (the time frame for which the government held 50 percent or more of the corporations’ common stock), and the type of disposition used most often to close the requests. The 18 agencies we reviewed had fully implemented half of the six key FOIA requirements and the vast majority of agencies implemented two additional requirements. However, 5 agencies published and updated their FOIA regulations in a timely and comprehensive manner. Fully implementing FOIA requirements will better position agencies to provide the public with necessary access to government records and ensure openness in government. Selected agencies varied considerably in the size of their backlogs. While 10 reported a backlog of 60 or fewer requests, 4 had backlogs of over 1,000 per year. Agencies identified a variety of methods that they used to address their backlogs, including practices identified by Justice, as well as additional methods. However, the selected agencies varied in the success achieved for reducing their backlogs. This was due, in part, to a lack of plans that describes how the agencies will implement best practices for reducing backlogs over time. Until agencies develop plans to reduce backlogs, they will be limited in their ability to respond effectively to the needs of requesters and the public. We are making a total of 24 recommendations to 16 agencies in our review. Specifically: The Secretary of the American Battle Monuments Commission should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 1) The Secretary of the American Battle Monuments Commission should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 2) The Chief Executive Officer and Director of the Broadcasting Board of Governors should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 3) The Secretary of DHS should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 4) The Secretary of DOI should ensure its FOIA tracking system is compliant with Section 508 requirements. (Recommendation 5) The Secretary of DOI should provide frequently requested records online. (Recommendation 6) The Secretary of DOI should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 7) The Chair of EEOC should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 8) The Chair of EEOC should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 9) The Chairman of the FTC should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 10) The Attorney General of the United States should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 11) The Archivist of the United States should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 12) The Administrator of NASA should update and publish comprehensive FOIA regulations that describe dispute resolution services, and notifies requesters of the 90 days for appeals. (Recommendation 13) The Administrator of NASA should provide agency records of final opinions online. (Recommendation 14) The Chairman of NTSB should provide frequently requested records online. (Recommendation 15) The Chairman of NTSB should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 16) The Director of OMB should update and publish comprehensive FOIA regulations that include requirements established by law and Justice guidance. (Recommendation 17) The Director of OMB should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 18) The Director of Pension Benefit Guaranty Corporation should designate a chief FOIA officer at the assistant secretary level or equivalent. (Recommendation 19) The Secretary of State should update and publish comprehensive FOIA regulations that describe dispute resolution services, and notifies requesters of the 90 days for appeals. (Recommendation 20) The Secretary of State should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 21) The President of TVA should ensure its FOIA tracking system is compliant with section 508 requirements. (Recommendation 22) The Administrator of USAID should take steps to develop and document a plan that fully addresses best practices with regards to reduction of backlogged FOIA requests. (Recommendation 23) The President of the U.S. African Development Foundation should update and publish comprehensive FOIA regulations that inform a requester of limited unusual circumstances fees. (Recommendation 24) We requested comments on a draft of this report from the 21 agencies included in our review. Of the 16 agencies to which we made recommendations, 9 agencies agreed with all of the recommendations directed to them; 1 agency agreed with two and disagreed with one recommendation; 2 agencies disagreed with all of the recommendations; and 4 agencies did not state whether they agreed or disagreed with our recommendations. In addition, 5 agencies to which we did not make recommendations stated that they had no comments on the report. Multiple agencies also provided technical comments, which we have incorporated, as appropriate. The following 9 agencies agreed with our recommendations: In emails received from the American Battle Monuments Commission and the Broadcasting Board of Governors, the two agencies stated that they agreed with the recommendations in our report. In written comments, reprinted in appendix V, DHS stated that it concurred with our recommendations. Regarding the recommendation to designate a chief FOIA Officer, the department stated that it had delegated the full authority and responsibility of DHS’s FOIA operations and programs to the chief privacy officer. The department asserted that its chief privacy officer is the equivalent of an assistant secretary, as required, because the official is appointed by the Secretary under 6 U.S.C § 142 without Senate confirmation in accordance with the Appointments Clause to the U.S. Constitution. Further, the department stated that the chief privacy officer position meets the senior executive service standard under 5 U.S.C § 3132(a)(2) and, accordingly, is comparable to a senior executive level position. Thus, the department believes it is already in compliance with the requirement to designate a chief FOIA officer at the assistant secretary level or equivalent. For the reasons that it cited, DHS requested that GAO consider this recommendation to be resolved and closed. Based on our analysis of the additional information that the department provided to explain the senior executive level position of the chief privacy officer, we are in agreement with DHS regarding the position’s equivalency to an assistant secretary within the department. Accordingly, we have removed this recommendation from our report. Concerning the second recommendation, to develop and document a plan that fully addresses practices with regard to the reduction of backlogged requests, DHS stated that it plans to initiate a department- wide compliance assessment of FOIA operations to identify the components with the most significant backlog problems and the “root causes” for these problems. The department said it then intends to develop a proposed plan for backlog reduction. In written comments, reprinted in appendix VI, Justice stated that it agreed with our recommendation and will develop a plan to address its backlog of FOIA requests to the fullest extent possible. Justice added that, in fiscal year 2017, it was able to improve all of its processing times and close all 10 of the department’s oldest requests, appeals, and consultations, thus, reducing the overall age of its backlog. In written comments, reprinted in appendix VII, NARA stated that it is currently working to develop and document a plan that is intended to fully address best practices to reduce its backlog of FOIA requests, as we recommended. The agency said it expects to complete its plan by the end of December 2018. In written comments, reprinted in appendix VIII, NASA said that it concurred with our two recommendations. With regard to the first recommendation, the agency stated that it is currently working to update its FOIA regulations, and that the revisions are to include the 90-day appeal rights, as well as describe requesters’ rights to obtain dispute resolution services from NASA’s FOIA public liaisons and OGIS. With regard to the second recommendation, the agency stated that it is currently working to identity subject matter areas on which the department can reach final opinions as interpreted under FOIA. The agency added that, upon identification, it will begin posting final opinions online. In written comments, reprinted in appendix IX, State concurred with our two recommendations and, accordingly, noted that it is currently working to update its FOIA regulations and evaluate methods to improve its backlog reduction efforts. In written comments, reprinted in appendix X, USAID stated that it concurred with our recommendation and will develop a formal plan that delineates currently employed best practices to reduce its FOIA backlog. In comments provided via email, the United States African Development Foundation’s General Counsel concurred with our recommendation. The foundation stated that it will take steps to update its FOIA regulations. This is to include, informing requesters about limited unusual circumstances fees, and publishing the updated regulation in the Federal Register. One agency agreed with two recommendations, and disagreed with one other recommendation: In written comments, reprinted in appendix XI, DOI concurred with the recommendation to make its FOIA tracking system Section 508- compliant and stated that it is currently testing its system for compliance. The department also concurred with the recommendation that it provide frequently requested records online. However, the department did not concur with our recommendation to develop and document a plan that fully addresses best practices for the reduction of backlogged FOIA requests. The department stated that, in Justice’s OIP guidance, the creation of a formal backlog reduction plan only applies to agencies with more than 1,000 backlogged requests in a given year. The department said that DOI did not fall into this category and, therefore, was not required to develop such a plan. Although DOI’s existing backlog of FOA requests did not meet the threshold identified in Justice’s guidance, the department, nonetheless, experienced a 51 percent increase in backlogged FOIA requests from fiscal years 2012 to 2016. Thus, having a plan and practices for reducing backlogged requests could help the department ensure that its backlog remains manageable, and that DOI is effectively positioned to respond to the needs of requesters and the public. Accordingly, we believe that our recommendation to develop a plan that addresses best practices to reduce the backlog is still warranted. In addition, 2 agencies disagreed with our recommendations: In written comments, reprinted in appendix XII, the Pension Benefit Guaranty Corporation disagreed with our recommendation that it designate a chief FOIA officer at the assistant secretary level or equivalent. The agency said it does not have assistant secretary positions. The agency added that it believes its current chief FOIA officer’s position is equivalent to the assistant secretary level and that this official is an appropriate designee. We disagree that the current chief FOIA officer’s position is equivalent to the assistant secretary level. However, the Pension Benefit Guaranty Corporation’s General Counsel position is at a level that is equivalent to an assistant secretary. As such, assigning the position to the General Counsel could help ensure that the chief FOIA officer has the necessary authority to make decisions about agency practices, personnel, and funding. As such, we believe our recommendation is still warranted. In written comments, reprinted in appendix XIII, TVA disagreed with our recommendation to ensure that its FOIA tracking system is compliant with Section 508 of the Rehabilitation Act. The agency stated that, based on the January 18, 2017, revised Section 508 standards, its current FOIA tracking system meets the standard related to having a user interface, but does not meet the criteria for accessibility of electronic content. The agency added that, the current single user of its system does not require accessibility accommodations; thus, it would be an undue burden for the agency to make the system comply with the Section 508 requirements. While TVA’s current FOIA system does not require accessibility accommodations and, in the agency’s view, would be unduly burdensome to modify, as the agency undertakes further modernization of its IT systems and software, it should ensure that its FOIA system is compliant with Section 508 requirements. Accordingly, we stand by our recommendation to the agency. Further, 4 agencies did not state whether they agreed or disagreed with the report, although 2 of them offered other comments: In emails received from EEOC and NTSB, the agencies did not agree or disagree with the draft report. EEOC offered technical comments, which we incorporated, as appropriate, while NTSB said it had no comment. In written comments, reprinted in appendix XIV, FTC acknowledged that its chief FOIA officer is not at the assistant secretary level. FTC also noted that it is a small agency in which there are no position titles of assistant secretary-level or equivalent. Further, the agency stated that it believes its chief FOIA officer holds a sufficiently senior position (associate general counsel) with the necessary authority to fulfill the functions of the chief FOIA officer. Nevertheless, FTC stated that it would take our recommendation (to designate a chief FOIA officer at the assistant secretary level or equivalent) under advisement. Although FTC is a small agency and does not have positions at the assistant secretary level, we disagree that the current chief FOIA officer’s position is sufficiently senior to fulfill the functions required of this position. However, assigning the chief FOIA officer position to the General Counsel, or an equivalent level position, could help ensure that the chief FOIA officer will have the necessary authority to make decisions about the agency’s practices, personnel, and funding for the implementation of FOIA. As such, we believe our recommendation is still warranted. In comments provided via email from its GAO liaison, OMB stated that it does not have a position in its organization with the specific title of assistant secretary. However, the agency noted that, on March 7, 2018, the OMB Director designated the OMB General Counsel to serve as the agency’s chief FOIA officer. According to OMB, the chief FOIA officer reports to the Director. Based on the documentation received, we are in agreement with OMB that the position of General Counsel is equivalent to an assistant secretary within the department. Accordingly, we consider this recommendation to be closed. The remaining 5 agencies to which we did not make recommendations stated that they did not have any comments on our report. These agencies were: the Administrative Conference of the United States, FDIC, the Federal Reserve Board, OCC, and Treasury. We are sending copies of this report to the Secretaries of the American Battle Monuments Commission, Homeland Security, Interior, State, and the Treasury; the Attorney General of the United States; the Archivist of the United States; the Comptroller of the Currency; Administrators of the National Aeronautics Space Administration and United States Agency for International Development; Board of Governors of the Federal Reserve System; Chairmen of the Administrative Conference of the United States, Equal Employment Opportunity Commission, Federal Deposit Insurance Corporation, and National Transportation Safety Board; Chief Executive Officer and Director of the Broadcasting Board of Governors; Directors of the Office of Management and Budget and Pension Benefit Guaranty Corporation; the Presidents of the Tennessee Valley Authority, and United States African Development Foundation, and the Acting General Counsel for the Federal Trade Commission. In addition, this report is available at no charge on the GAO website at http://www.gao.gov If you or your staff have questions about this report, please contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix XV. Our objectives were to determine (1) determine the extent to which agencies have implemented selected Freedom of Information Act (FOIA) requirements; (2) describe the methods established by agencies to reduce backlogged requests and the effectiveness of those methods; (3) identify any statutory (b)(3) exemptions that have been used by agencies as the basis for withholding (redacting) information; and (4) determine what FOIA requests, if any, agencies received and processed that related to entities that received government assistance during the 2008 financial crisis. To address the first and second objectives, we selected 18 agencies to review based on the number of FOIA requests received, the sizes of FOIA backlogs, and the average time of processing FOIA requests for fiscal years 2012 through 2016. We also chose the agencies to represent a range of sizes (by number of employees)—large (10,000 or more), medium (1,000 to 9,999), and small (999 or fewer). Large agencies selected were the Departments of Homeland Security, Justice, State, and the Interior; the National Aeronautics and Space Administration, and the Tennessee Valley Authority. Medium agencies were the National Archives and Records Administration, the Federal Deposit Insurance Corporation, the Equal Employment Opportunity Commission, the Broadcasting Board of Governors, the U.S. Agency for International Development, and the Federal Trade Commission. Small agencies were the National Transportation Safety Board, the American Battle Monuments Commission, the Pension Benefit Guaranty Corporation, the U.S. African Development Foundation, the Office of Management and Budget, and the Administrative Conference of the United States. For our first objective, to determine the extent to which agencies had implemented FOIA requirements, we examined six FOIA requirements outlined in the FOIA Improvement Act of 2016 and the OPEN Government Act of 2007. These requirements were for agencies to (1) update response letters, (2) implement tracking systems, (3) provide FOIA training, (4), provide records online, (5) designate chief FOIA officers, and (6) update and publish timely and comprehensive regulations. For these six requirements, we reviewed (1) agencies’ FOIA regulations to determine if they included updates from the 2016 FOIA amendments and 2007 OPEN Government Act; and if they were updated by the required deadline; (2) agencies’ FOIA systems to determine if the systems provided individualized tracking numbers for requests that will take longer than 10 days to process, if agencies’ established telephone or Internet service to allow requesters to track the status of their requests; (3) if agencies’ had designated a chief FOIA officer and what position they held within the agency; (4) if agencies chief FOIA officers provided annual FOIA training opportunities to agency staff; (5) if agencies had appropriately updated response letters in compliance with the 2016 FOIA amendments; and (6) if agencies were providing electronic documents publicly available online and posting frequently requested documents as required by the 2016 FOIA amendments. Since we selected a nonprobability sample of FOIA reporting agencies, the results of this analysis are not generalizable to all FOIA reporting agencies. In addition, we also reviewed the requirement for the development of a government-wide FOIA request portal and met with Office of Management and Budget (OMB) officials, and Department of Justice (Justice) officials in the Office of Information Policy (OIP) to the discuss the status of development. Further, we met the Chief FOIA Officers Council, OIP, and National Archives and Records Administration’s (NARA) Office of Government Information Services (OGIS) to determine what, if any, actions they have taken to assist agencies with not violating the provisions of FOIA. For our second objective, to determine the methods established by agencies to reduce backlogged requests and the effect of those methods, we reviewed agency documentation to evaluate if the selected agencies had developed methods for reducing backlogged FOIA requests. We identified requirements for agencies to produce backlog reduction plans and determined if agencies developed such plans as required. We analyzed agencies’ FOIA.gov data to determine if there was a correlation between the presence of a backlog reduction plan and a reduction in backlog numbers. We compared a set of identified best practices for reducing backlogs with agency procedures to determine the extent to which the best practices are used. In addition, we interviewed agency officials to determine the reasons for changes in agency backlog numbers and what actions they are taking to reduce backlogs or implement reduction plans. The results of this analysis are not generalizable to all FOIA reporting agencies. For our third objective, to identify statutory (b)(3) exemptions that have been used by agencies as the basis for withholding information, we developed a catalog of (b)(3) statutes that agencies previously have used to withhold information in FOIA records. To do that, we retrieved all data on agency use of (b)(3) statutes that were readily accessible on Justice’s FOIA.gov website. The data on FOIA.gov are for fiscal years 2008 to 2016; however, Justice acknowledged that data prior to 2010 were not available on FOIA.gov for all agencies. Therefore, we reviewed data for fiscal years 2010 to 2016. In total, there were 117 distinct agencies that provided annual report data for at least 1 fiscal year, and that were represented in fiscal years 2010 through 2016. We developed a catalog by extracting information from the aggregate of agency annual FOIA reports that report, among other things, usage of (b)(3) statute, including the statute’s citation and the number of times the statute was to used withhold information in a fiscal year. To assess the reliability of the data we retrieved from FOIA.gov, we supplemented our analysis with interviews of FOIA officials in Justice’s OIP on steps they have taken to ensure the consistency of data in FOIA.gov on agencies’ use of (b)(3) statutes. Our analysis did not include assessing the reliability of (b)(3) statute data submitted by agencies— Justice guidance states it is the responsibility of each agency to ensure quality data in their reports. We also electronically tested the data by identifying outliers, missing values, and syntactical discrepancies. We found the data to be sufficiently reliable for purposes of our reporting objective. To facilitate our analysis, we refined our catalog listing of agencies’ use of (b)(3) statutes by developing a standardized statute notation assigned to each agency-used statute in our list. Specifically, our standardization of agency-used statutes consisted of removing any typographical errors, ensuring statutes were noted in a consistent U.S. Code format and referred to existing U.S. Code section, and verifying the existence of each statute through legal research, as well as standardizing any current notations of the statute such as those transferred within the U.S. Code by later legislation. If no current notation existed, then that statute was listed as is, such as “15 U.S.C. § 80a-30(c)”, which was used by an agency, and repealed during our review period. No replacement notation could be found. For some U.S. Code statutes, we standardized statutes to an entire section or subsection to reference nondisclosure provisions that contain a description of the type of information withheld by that statute. Further, for some U.S. Code statutes that agencies used as a range of statutes, such as 7 U.S.C. §§ 7411-7425, we determined whether the range contained a single or multiple (b)(3) statute section(s) and developed a standardized statute for each (b)(3) section to assign the original agency statute. In some cases, where agencies used a smaller ranger of statutes, such as 21 U.S.C. §§ 1903-1905, we retained the notation and assigned a standardized version of the range to the original agency-used statute range. Additionally, for some U.S. Code statutes that agencies used that contained two (b)(3) statutes, such as 26 U.S.C. §§ 6103 and 6105, we developed a standardized statute for each (b)(3) section to assign the original agency statute. For those agency-used statutes that could not be immediately standardized or seemed to be noted in error, we either assigned that statute to a related section (or sections) containing a nondisclosure provision, retained the notation and assigned a standardized version of the statute to the original agency-used statute, or removed that statute from our catalog. For example, an agency claimed 15 U.S.C. § 7301 as a (b)(3) statue; however, the statute was a purpose section and 15 U.S.C. § 7306 was the only related nondisclosure provision in that chapter or subchapter of the Code. Therefore, § 7301 was assigned to the standardized citation § 7306. Each standardized statute was counted as one single statute, regardless of the number of sections it represented, resulting in a total of 237 statutes. Following our standardization exercise, we developed descriptions of each statute’s subject matter. We also compared our standardized statutes list to Justice’s list of qualified statutes to identify those statutes that qualified if a court has approved of the statute as being a (b)(3) statute. Next, we classified these statutes into 10 general categories based on their descriptions. To determine usage of (b)(3) statutes by agencies, we calculated the number of times an agency used original agency-used statutes and assigned those numbers to its associated standardized statute in our catalog. In cases where an agency appeared to cite multiple statutes, such as 26 U.S.C. §§ 6103 and 6105, we counted the statutes separately if we determined they were different. For example, if an agency used 26 U.S.C. §§ 6103 and 6105 500 times during fiscal years 2010 to 2016, we would assign that number to each standardized statute in our catalog to ensure that 26 U.S.C. § 6103 and 26 U.S.C. § 6105 each received 500 as the number of times used. We compiled and sorted these data to obtain information on which agencies were using the statute, which agency used it the most, and the approximate number of times the statute was used by an agency. To identify which statutes qualified as a (b)(3) exemption under the OPEN FOIA Act of 2009, we determined the date of the most recent legislative action for each standardized statute by identifying the dates of enactment and the most recent amendments of the statutes. We then identified those statutes enacted or amended after 2009 and we determined if they cited FOIA’s paragraph (b)(3) by including a citation to 5 U.S.C. 552(b)(3) or “paragraph (b)(3) of section 552 of title 5, United States Code,” or a similar citation that includes a reference to paragraph (b)(3). To identify any additional statutes that the reviewed agencies did not claim during fiscal years 2010 to 2016, we developed another catalog of statutes that have similar provisions as other (b)(3) statutes that authorize an agency to withhold information from the public. Specifically, we utilized various sources to compile our list of statutes, including annual Justice reports on statutes determined by courts to constitute a (b)(3) statute, the National Institute of Standards and Technology’s Guide for Mapping Types of Information and Information Systems to Security Categories, and two external nongovernmental organizations (American University Washington College of Law and ProPublica). In addition, we separately searched the U.S. Code for the keyword “552(b)(3)” using Lexis Nexis, to identify any additional statutes for our catalog. However, this additional catalog does not serve as an definitive or comprehensive list of (b)(3) statutes available for agencies to claim. Specifically, FOIA gives agencies broad discretion in deciding whether they can withhold information on the basis of a statute. For example, FOIA allows for agencies to assert a federal statute under the (b)(3) exemption if that statute establishes particular criteria or refers to particular types of matters to be withheld. Therefore, the statutes we identified may undercount the total number of exemptions available to agencies. For our fourth objective, to determine the number and types of FOIA requests related to private corporations that received funds under the Troubled Assess Relief program (TARP), we reviewed the Department of Treasury’s (Treasury) Monthly Reports to Congress (October 2008 and November 2014) and prior GAO reports relating to TARP. We identified the corporations that received TARP funds and the federal agencies that received FOIA requests related to these corporations by reviewing Treasury’s monthly reports for the time period in which Treasury held 50 percent or more common stock in corporations that were under the TARP agreement. We also reviewed prior GAO reports on TARP to verify the corporations and time period. In addition, we met with Treasury officials to verify the entities and time period. The three corporations that received TARP funds were American International Group, General Motors, and Ally. The agencies that received FOIA requests about these corporations were Treasury, the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, and the Office of the Comptroller of the Currency. We met with these agencies to identify their involvement in providing assistance to companies related to TARP. Next, we reviewed FOIA requests received by these four agencies during the period in which Treasury owned at least 50 percent or more common shares in the corporations. We reviewed the FOIA requests to determine the resolution of the request and the length of time it took the agency to respond. Lastly, we interviewed agency officials to better understand if and how FOIA requests were received and processed. We conducted this performance audit from January 2017 through June 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Freedom of Information Act (FOIA) prescribes nine specific categories of information that are exempt from disclosure. These exemptions are described in the table below. Table 7 describes 237 (b)(3) exemption statutes used by FOIA reporting agencies during fiscal years 2010 through 2016 and indicates whether that statute has been found by a court to qualify as a (b)(3) exemption. Specifically, the Department of Justice, in its oversight role, identified 78 statutes that courts have ruled qualify as a (b)(3) statute. During fiscal years 2010 through 2016, when responding to FOIA requests, agencies used 75 of these statutes as the basis for withholding information. Table 8 identifies 140 additional statutes outside of our agency used catalog that we did not identify as used by agencies during our fiscal year 2010 through 2016 review period. These statutes have similar provisions to other (b)(3) exemption statutes, authorizing an agency to withhold information from the public. In addition to the contact named above, Anjalique Lawrence (assistant director), Lori Martinez (analyst in charge), Gerard Aflague, Melina Asencio, David Blanding, Kami Brown, Christopher Businsky, Caitlin Cusati, Haley Dunn, Elena Epps, Rebecca Eyler, Nancy Glover, James Andrew Howard, Saida Hussain, Robert Letzler, Lee McCracken, Carlo Mozo, Brian Palmer, David Plocher, Di’Mond Spencer, Sukhjoot Singh, Henry Sutanto, and Priscilla Smith made key contributions to this report.

Summary: FOIA requires federal agencies to provide the public with access to government records and information based on the principles of openness and accountability in government. Each year, individuals and entities file hundreds of thousands of FOIA requests. In the last 9 fiscal years, federal agencies subject to FOIA have received about 6 million requests. GAO was asked to review federal agencies' compliance with FOIA requirements. Our objectives, among others, were to (1) determine the extent to which agencies have implemented selected FOIA requirements; (2) describe the methods established by agencies to reduce backlogged requests and the effectiveness of those methods; and (3) identify any statutory exemptions that have been used by agencies as the basis for withholding (redacting) information from requesters. To do so, GAO selected 18 agencies based on their size and other factors and assessed their policies against six FOIA requirements. GAO also reviewed the agencies' backlog reduction plans and developed a catalog of statutes that agencies have used to withhold information. All 18 selected agencies had implemented three of six Freedom of Information Act (FOIA) requirements reviewed. Specifically, all agencies had updated response letters to inform requesters of the right to seek assistance from FOIA public liaisons, implemented request tracking systems, and provided training to FOIA personnel. For the three additional requirements, 15 agencies had provided online access to government information, such as frequently requested records, 12 agencies had designated chief FOIA officers, and 12 agencies had published and updated their FOIA regulations on time to inform the public of their operations. Until these agencies address all of the requirements, they increase the risk that the public will lack information that ensures transparency and accountability in government operations. The 18 selected agencies had backlogs of varying sizes, with 4 agencies having backlogs of 1,000 or more requests during fiscal years 2012 through 2016. These 4 agencies reported using best practices identified by the Department of Justice, such as routinely reviewing metrics, as well as other methods, to help reduce their backlogs. Nevertheless, these agencies' backlogs fluctuated over the 5-year period (see figure). The 4 agencies with the largest backlogs attributed challenges in reducing their backlogs to factors such as increases in the number and complexity of FOIA requests. However, these agencies lacked plans that described how they intend to implement best practices to reduce backlogs. Until agencies develop such plans, they will likely continue to struggle to reduce backlogs to a manageable level. Agencies used various types of statutory exemptions to withhold information when processing FOIA requests during fiscal years 2010 to 2016. The majority of these fell into the following categories: personally identifiable information, national security, law enforcement and investigations, and confidential and commercial business information. GAO is making recommendations to 16 agencies to post records online, designate chief FOIA officers, update regulations, and develop plans to reduce backlogs. Nine agencies agreed with the recommendations, 1 both agreed and disagreed, 2 disagreed, and 4 neither agreed nor disagreed. GAO continues to believe the recommendations are valid.