oversight

National Archives: Preserving Electronic Records in an Era of Rapidly Changing Technology

Published by the Government Accountability Office on 1999-07-19.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                United States General Accounting Office

GAO             Report to the Chairman
                Committee on Governmental Affairs
                U.S. Senate


July 1999
                NATIONAL
                ARCHIVES
                Preserving Electronic
                Records in an Era of
                Rapidly Changing
                Technology




GAO/GGD-99-94
United States General Accounting Office                                          General Government Division
Washington, D.C. 20548




                                    B-281101
                                    July 19, 1999

                                    The Honorable Fred Thompson
                                    Chairman, Committee on Governmental Affairs
                                    United States Senate

                                    Dear Mr. Chairman:

                                    Under the Federal Records Act, the National Archives and Records
                                    Administration (NARA) is responsible for providing guidance and
                                    assistance to federal agencies on the creation, maintenance, use, and
                                                                        1
                                    disposition of government records. Federal agencies are responsible for
                                    ensuring that their records are created and preserved in accordance with
                                    the act. Records generated electronically, such as electronic mail (E-mail)
                                    messages, word processing documents, CD ROMs, and World Wide Web
                                    site pages, present an archival challenge for NARA and agencies because
                                    these technologies are new and changing very rapidly. Also, the sheer
                                    volume of these records is mushrooming.

                                    At your request, we undertook an effort to identify issues that relate to
                                    electronic records management (ERM), focusing specifically on the
                                    preservation of electronic records. On February 4, 1999, we provided your
                                    office with a briefing on our work. As your office agreed, this report
                                    documents our oral briefing and provides additional information on (1) the
                                    challenges that confront NARA and federal agencies as a result of their
                                    increased reliance on electronic media; (2) the status of selected agencies’
                                    and NARA’s implementation of ERM; and (3) the ERM policies and
                                    procedures of selected other governments (state and foreign).

                                    We conducted our work between August 1998 and June 1999 in
                                    accordance with generally accepted government auditing standards.
                                    Appendix I contains a discussion of our scope and methodology. On June
                                    7, 1999, we provided a draft of this report to the Archivist, who heads
                                    NARA, for review and comment. The Archivist’s comments are discussed
                                    at the end of this letter and reprinted in appendix II.

                                    NARA and federal agencies are faced with the substantial challenge of
Results in Brief                    preserving electronic records in an era of rapidly changing technology. In
                                    addition to handling the burgeoning volume of electronic records, NARA

                                    1
                                        44 U.S.C. 2904.




                                    Page 1
B-281101




and the agencies must address several hardware and software issues to
ensure that electronic records are properly created, permanently
maintained, secured, and retrievable in the future. Also, NARA’s and the
agencies’ ERM efforts are competing with other information technology
priorities, particularly the need to ensure that their computers are Year
2000 compliant.

NARA is responsible for providing guidance and assistance to agencies on
how to maintain their official government records and for archiving those
records once they are transferred to NARA. The agencies are responsible
for ensuring that records are created and preserved in accordance with the
Federal Records Act. No centralized source of information exists to
document the extent to which agencies are fulfilling their ERM
responsibilities under the act. On the basis of our discussions with officials
                                                       2
from NARA and four judgmentally selected agencies, we found that plans
and capabilities for ERM vary greatly across agencies. Some agencies are
waiting for more specific guidance from NARA, while others are moving
forward on their own to implement ERM programs.

NARA has recently postponed a planned baseline survey that was intended
to obtain governmentwide information on agencies’ ERM programs
because NARA believes that it should first complete a business process
reengineering (BPR) effort. This BPR effort, which is intended to assess
and potentially alter NARA’s guidance to and interaction with agencies, is
expected to take 18 to 24 months. We believe that the baseline survey
information is critical to ensuring that the BPR results are relevant to the
current ERM situations at agencies and the survey should not be
postponed. Further, these baseline data are needed to meet one of NARA’s
stated strategic planning goals to “stay abreast of technologies in the
agencies.” We are making a recommendation in this report regarding the
baseline survey.

Even while planning its BPR effort, NARA is taking some immediate action
to address the agencies’ needs for ERM guidance and direction. NARA is
now revising its ERM guidance to address personal computers and the
resulting desktop management of electronic records. NARA’s efforts to
improve ERM include revising bulletins and other guidance as well as
forming a new group to help answer agencies’ immediate questions on
ERM issues. NARA has taken many of its actions as a result of a court

2
We made limited contacts at the Environmental Protection Agency, the General Services
Administration, the National Aeronautics and Space Administration, and the Department of the
Treasury’s Office of Thrift Supervision.




Page 2
             B-281101




                             3
             decision, which held that NARA’s guidance for the deletion of electronic
             records exceeded its statutory authority.

             The federal government is not alone in its quest to properly preserve and
             maintain electronic records. State and foreign governments are addressing
                                4
             similar challenges. From our limited judgmental sample of state and
             foreign governments, it is clear that these governments and the federal
             government often differ in (1) the organization of their archival activities,
             (2) their philosophies on centralization versus decentralization of
             recordkeeping responsibilities, and (3) their computer hardware and
             software capabilities.

             NARA’s mission is to ensure “ready access to essential evidence” for the
Background   public, the President, Congress, and the courts. NARA is to make the
             permanently valuable records of the government—in all media—available
             for reference and research. In addition to the best known documents, such
             as the Declaration of Independence, the Constitution, and the Bill of
             Rights, NARA preserves billions of pages of textual documents and
             numerous maps, photographs, videos, and computer records.

             Each citizen has a right to access the official records of the government.
             During fiscal year 1998, 2.6 million people (including genealogists,
             historians, librarians, and veterans) visited NARA’s facilities to browse and
             do research, and NARA received over 56 million “hits” on its Web site from
             scholars, students, and other inquirers.

             Records management is a statutory responsibility of the Archivist and
             heads of the federal agencies. The Federal Records Act, comprising the
             Records Disposal Act and other statutes, defines a record as

             “all books, papers, maps, photographs, machine readable materials, or other documentary
             materials, regardless of physical form or characteristics, made or received by an
             agency…under federal law or in connection with the transaction of public business and
             preserved or appropriate for preservation…as evidence of the organization, functions,
             policies, decisions, procedures, operations, or other activities of the Government or
             because of the informational value of data in them.”5




             3
                 Public Citizen v. Carlin, 2 F. Supp. 2d 1 (D.D.C. 1997).
             4
              We interviewed officials from Florida, Oklahoma, Oregon, and Texas and reviewed public documents
             from Australia, Canada, and the United Kingdom.
             5
                 44 U.S.C. 3301.




             Page 3
                    B-281101




                    NARA and agency staff work together to identify and inventory an agency’s
                    records to appraise the value of the records and determine how long they
                    should be kept and under what conditions. The formal approval of this
                    work is called scheduling. Agency records must be scheduled through
                    either records schedules specific to each agency or a general records
                    schedule (GRS), which is issued by the Archivist and authorizes disposal,
                    after a specified period of time, of records of a specified form or character
                    common to several or all federal agencies. Records of permanent value
                    (such as final budget submissions and calendars of senior staff) must be
                    preserved and eventually transferred to NARA for archival and research
                    purposes. Other records deemed of insufficient value to warrant their
                    preservation, such as payroll or travel, are considered temporary records
                    and must be preserved by the agency for only a specified length of time.

                    In addition to the Federal Records Act, several other laws, such as the
                    Paperwork Reduction Act, Privacy Act, Freedom of Information Act,
                    Electronic Freedom of Information Act, and Government Paperwork
                    Elimination Act, also address records management requirements for both
                    paper and electronic records. Also, the General Services Administration,
                    the Office of Management and Budget, and individual agencies issue
                    records management regulations.

                    NARA and federal agencies are confronted with many ERM challenges,
NARA and Federal    particularly technological issues. NARA must be able to receive electronic
Agencies Face ERM   records from agencies, store them, and retrieve them when needed.
Challenges          Agencies must be able to create electronic records, store them, properly
                    dispose of them when appropriate, and send permanently valuable
                    electronic records to NARA for archival storage. All of this must be done
                    within the context of the rapidly changing technological environment.

NARA’s Challenges   As stated in NARA’s 10-year strategic plan covering the period of 1997 to
                    2007, NARA’s goals are to determine how to (1) preserve electronic
                    records that the nation will need, (2) manage change, (3) stay abreast of
                    technologies in federal agencies, and (4) use technologies to safeguard
                    valuable information and make it more readily accessible. NARA’s plan
                    also points out that it must meet the public’s need for “on-line” access to
                    information and work in partnership with other entities that are struggling
                    with the same problems.

                    According to our research and discussions with NARA officials and other
                    records management professionals, NARA is faced with a number of
                    challenges to ensure that federal records in electronic format are
                    preserved. NARA officials told us that NARA needs to expand its capacity



                    Page 4
B-281101




to accept the increasing volume of electronic records from the agencies.
Over the past quarter century, NARA has taken in approximately 90,000
electronic data files. NARA has estimated that federal agencies, such as the
Department of State and the Department of the Treasury, are individually
generating 10 times that many electronic records annually just in E-mail,
many of which may need to be preserved by NARA. One of the items in
NARA’s fiscal year 2000 budget request would allow NARA to begin
development of a system to save large volumes of E-mail messages and
other small data files that agencies are increasingly creating. Some of the
initial research and development for this system is being done in fiscal
year 1999.

In addition to the increasing volume, the increasing variety of electronic
records (e.g., word processing documents, E-mail messages, databases,
digital images, and Web site pages) complicate NARA’s mission to preserve
these records. NARA must address some definitional problems, such as
what is an electronic record, when is an E-mail message a record, or when
are Web site “virtual records” considered records. Also, electronic records
are generated as files that require compatible hardware playback devices
and the correct software for retrieving, viewing, and transmitting. Because
agencies follow no uniform hardware standards, NARA must be capable of
accepting various formats (hardware and software) from the agencies and
maintaining a continued capability to read those records.

The long-term preservation and retention of those electronic records is
also a challenge since providing continued access to archived records over
many generations of systems is difficult. The average life of a typical
software product is 2 to 5 years. There are currently only three alternatives
for maintaining accessibility over time, as follows: (1) maintain records in
a software-independent format, (2) reformat and migrate records to new
software systems, or (3) maintain the records in the original format and
maintain the necessary hardware and software to make them accessible.
Another concern is the deterioration of the storage media over time, and
NARA must consider the permanency of the formats used by agencies
(such as floppy disks and CD ROMs). These and other media that are used
now and that are being developed must remain readable over a long period
of time or be changed to a different media.

Finally, another challenge is NARA’s ability to offer guidance to the
agencies regarding the orderly management of electronic records,
especially relating to the authenticity and reliability of electronic records
that eventually will be transferred into NARA’s custody. Current electronic
security measures, encryption, and authentication techniques could



Page 5
                       B-281101




                       increase the reliability and authenticity of electronic records; however,
                       there has been little analysis of the risk or the costs and benefits of
                       implementing those measures for agencywide systems. It is important to
                       note that a properly maintained electronic recordkeeping system provides
                       more security and accountability than a comparable paper-based system
                       because the electronic system can record details on access, revision, and
                       deletion.

Agencies’ Challenges   Records management is initially the responsibility of the agency staff
                       member who creates a record, whether the record is paper or electronic.
                       Preservation of and access to that record then also becomes the
                       responsibility of agency managers and agency records officers.

                       Electronic records are now frequently created on a personal computer.
                       Electronic recordkeeping responsibilities are often overlooked by the staff
                       member who creates the record. The staff member should be made aware
                       of what constitutes an electronic record, how to save it, and how to
                       archive it for future use. Decentralized control over electronic documents
                       is changing the face of records management because records can easily be
                       deleted without records managers even being aware that the record
                       existed. The agencies are challenged with informing employees what is
                       required of them and how to accomplish their records management
                       responsibilities.

                       Agencies receive guidance from NARA, but they must put their own
                       recordkeeping systems in place. Some agencies continue to experience
                       confusion over what constitutes an electronic record and who has
                       responsibility for preserving the record. Questions also arise regarding
                       how to handle multiple copies or versions of documents and whether
                       drafts are official records.

                       Agencies’ employees send and receive huge volumes of E-mail in
                       performing their official duties and responsibilities. Agencies must
                       determine which of these E-mail messages are records. When E-mail
                       messages are determined to be official records, agencies must assign
                       records management responsibility, control multiple versions, and archive
                       the messages. Also, because much internal business deliberation is
                       conducted via E-mail, for privacy reasons, these messages must be
                       reviewed before being released to the public.

                       Agencies’ ERM efforts are competing for attention and resources with
                       other information technology priorities, particularly in those agencies
                       dealing with the Year 2000 problem. NARA officials believe that ERM



                       Page 6
                         B-281101




                         activities may be slowed by agencies’ concentration on other priorities,
                         such as systems’ upgrades and Year 2000 compliance. Regarding Year 2000
                         compliance, the old technology that created some electronic records might
                         not be Year 2000 compliant, and this noncompliance could cause future
                         retrieval difficulties for the agencies and NARA.

                         On the basis of our discussions with NARA officials and officials of the
Agencies’ and NARA’s     four previously mentioned selected agencies and discussions at
Actions to Implement     governmentwide conferences on the subject of records management, we
ERM                      learned that agencies vary in their records management programs and in
                         their capabilities to implement ERM. Some agencies are waiting for more
                         specific guidance from NARA, while others are moving forward by looking
                         for ways to better manage their electronic records.

                         However, there has been no recent governmentwide survey of agencies’
                         compliance with the archival provisions of the Federal Records Act or
                         agencies’ ERM activities. NARA is planning a BPR effort that will collect
                         limited information from some agencies but will not include a complete
                         governmentwide baseline survey. In the interim, NARA has begun to revise
                         its ERM guidance to provide some immediate guidance and direction for
                         the agencies.

Agencies Vary in Their   Our discussions with NARA officials and officials from the four
                         judgmentally selected agencies indicated that agencies vary in how they
Implementation of ERM    are implementing their ERM programs. NARA officials directed us to the
                         Department of Defense (DOD) as one of the agencies that is most
                         advanced in its ERM efforts. NARA has been working with DOD for several
                                                                         6
                         years to develop DOD’s ERM software standard, which is intended to help
                         DOD employees determine what are records and how to properly preserve
                         them.

                         NARA endorsed the DOD standard in November 1998 as a tool that other
                         agencies could use as a model until a final policy is issued by NARA. The
                         endorsement does not mandate that agencies use the DOD standard;
                         instead, NARA said that the standard conforms to the requirements of the
                         Federal Records Act and establishes baseline requirements for managing
                         electronic records. NARA also said that while the DOD standard is an
                         appropriate basis for records management, there might be other equally
                         valid ways to address ERM. The DOD standard is intended as a starting

                         6
                         The DOD standard, Design Criteria Standard for Electronic Records Management Software
                         Applications, November 1997, was issued under the authority of DOD Directive 5015.2, Department of
                         Defense Records Management Program, April 11, 1997.




                         Page 7
  B-281101




  point that must be tailored to a specific agency’s needs. NARA said that
  each agency must still address ERM within the context of its own
  computer and policy environments. The DOD standard is a tool that is
  intended to help agencies develop automated systems to file, track, and
  preserve or destroy its electronic records.

  DOD’s standard has a series of requirements that are measurable and
  testable and based on various laws and NARA regulations. The standard,
  which is mandatory for all DOD components, provides implementation and
  procedural guidance on the management of records in DOD. ERM
  information systems that were in place before the approval of this
  standard must comply with the standard by November 1999.

  The DOD standard (1) sets forth baseline functional requirements for
  records management application software that is used by DOD
  components in the implementation of their records management programs;
  (2) defines required system interfaces and search criteria to be supported
  by records management application software; and (3) describes the
  minimum records management requirements that must be met, based on
  current NARA regulations. The DOD standard also requires that records
  management software perform several functions, including the following:

• Assign each record a unique, computer-generated code that identifies the
  document.
• Treat filed E-mail messages, including attachments, as records.
• Allow records to be searched, screened, and viewed on the basis of record
  profiles.
• Identify records that can be sent to NARA for storage.
• Notify users when a document is eligible for destruction or transfer, and
  destroy or transfer it after approval.

  As of June 2, 1999, nine companies had records management application
  products that were certified by DOD as meeting its standard. Some
  products are ERM software, while others integrate their document
  management or workflow products with ERM software from another
  vendor.

  Two agencies that are testing ERM software that meet the DOD standard
  are the National Aeronautics and Space Administration (NASA) and the
  Department of the Treasury’s Office of Thrift Supervision (OTS). NASA did
  a limited test of an early version of one ERM product and found it difficult
  to use and time-consuming to install. The software did not perform well
  with NASA’s varying hardware and software platforms. According to an



  Page 8
                         B-281101




                         agency official, the NASA test did, however, give NASA a better
                         understanding of its requirements, including its records management
                         program in particular. NASA plans to evaluate a newer version of this
                         software later in fiscal year 1999.

                         OTS is testing ERM software that differs from the one NASA used. OTS’
                         test is meant primarily to organize its electronic files. According to OTS’
                         manager of its records branch, it is important that ERM software requires
                         users to make no more than two or three extra keystrokes, and that users
                         realize there is a benefit to this additional “burden.”

NARA Does Not Have       Even though NARA is aware of the efforts of DOD, NASA, OTS, and
                         various other agencies, it does not now have governmentwide data on the
Governmentwide Data on   records management capabilities and programs of all federal agencies.
Agencies’ ERM Efforts    NARA had planned to do a baseline assessment survey to collect such data
                         on all agencies by the end of fiscal year 2000. According to NARA officials,
                         this survey was needed to identify best practices at agencies and collect
                         data on (1) program management and records management infrastructure,
                         (2) guidance and training, (3) scheduling and implementation, and (4)
                         electronic recordkeeping. NARA had planned to determine how well
                         agencies were complying with requirements for retention, maintenance,
                         disposal, retrieval/accessibility, and inventorying of electronic records. In
                         the early results in the pilot test of the survey at a limited number of
                         agencies, NARA discovered that most of the pilot agencies lacked adequate
                         employee guidance regarding electronic records.

                         The Archivist has decided to put the baseline survey on hold primarily
                         because of what he believes are other higher priority activities, such as
                         NARA’s BPR effort, which could change NARA’s regulations and thereby
                         affect the data that NARA would need to acquire from the agencies.
                         NARA’s BPR effort to address its internal processes, as well as guidance to
                         and interactions with the agencies, is expected to begin before the end of
                         fiscal year 1999. This BPR effort should take 18 to 24 months. However,
                         NARA will now proceed without the rich baseline of information from
                         across the federal government that was originally planned.

                         NARA officials could not give us a time frame regarding when the survey
                         effort would be reinitiated. In the interim, according to a NARA Policy and
                         Communications official, NARA will continue to gather additional
                         information about the status of records management through a targeted
                         assistance program, which will focus on helping agencies that have the
                         most urgent records management needs. This effort, by definition, will not
                         provide a baseline across all agencies.



                         Page 9
                           B-281101




                           Currently, NARA does in-depth studies of two to four agencies a year in
                           which it looks at the agencies’ records management policies and then
                           recommends areas for improvement. Since some individual agencies have
                           not been reviewed for several years, this method of collecting information
                           on agencies has not yielded a current governmentwide look at the
                           situation. Thus, this effort does not achieve NARA’s strategic planning goal
                           to “stay abreast of technologies in the agencies.”

NARA Is Revising Its ERM   Historically, NARA’s ERM guidance has been geared toward mainframes
                           and databases, not personal computers. In addition to NARA’s planned
Guidance                   BPR, NARA is taking some immediate action to revise its guidance to be
                           more appropriate in today’s workplace environment.

                           NARA’s electronic records guidance to agencies is found in the Code of
                                                7
                           Federal Regulations, which establishes the basic requirements for
                           creation, maintenance, use, and disposition of electronic records. In 1972,
                           before the widespread use of personal computers in the government
                           workplace, NARA issued GRS 20 to provide guidance on the preservation
                           of electronic records. However, agency records officers, data processing
                           staff, and even NARA staff had trouble understanding and applying the
                           first version of GRS 20. Subsequently, GRS 20 had several major revisions,
                           culminating with the 1995 revision authorizing, among other things, that
                           after electronic records, which were created in an office automation
                           environment or computer centers, were placed in a recordkeeping
                           system—electronic, paper, or microfilm—the records could be deleted.

                           NARA’s ERM guidance under the 1995 version of GRS 20 was challenged in
                           a December 1996 lawsuit filed in the United States District Court for the
                                                                           8
                           District of Columbia by a public interest group. In an October 1997
                           decision, the court found that the Archivist exceeded the scope of his
                           statutory authority in promulgating GRS 20. First, the court stated that
                           GRS 20 did not differentiate between program records, which are possibly
                           subject to preservation, and administrative “housekeeping” records, which
                           the court found were the only records allowed to be disposed of through
                           GRSs. Second, the court found that electronic records did not lose their
                           status as program records once they were preserved on paper; they are
                           considered to be unique records and distinct from printed versions of the
                           same record.


                           7
                               36 CFR Part 1234.
                           8
                               Public Citizen v. Carlin, 2 F. Supp. 2d 1 (D.D.C. 1997).




                           Page 10
  B-281101




  The court also held that by categorically determining that no electronic
  records have value, the Archivist failed to carry out his statutory duty to
  evaluate the value of records for disposal. Moreover, the court determined
  that GRS 20 violated the Records Disposal Act because it failed to specify a
  period of time for retention of records that are to be disposed of through a
  GRS. The court thus declared GRS 20 “null and void.” The government
  filed an appeal of this ruling in December 1997. In March 1998, NARA
  issued a bulletin informing agencies that NARA had established a working
  group with a specific time frame to propose alternatives to GRS 20.

  The same public interest group that initially challenged GRS 20 went back
  to court when it realized that the Archivist was informing agencies that
  they could continue to rely on GRS 20 even after the court had ruled it
  “null and void.” The court, in a subsequent ruling, found that the Archivist
  had “flagrantly violated” the court’s October 1997 order and ordered,
  among other things, the NARA working group to have an implementation
  plan to the Archivist by September 30, 1998.

  In September 1998, on the basis of recommendations made by the NARA-
  sponsored electronic records working group, the Archivist decided to take
  several steps. Specifically, the Archivist agreed to (1) issue a NARA
  bulletin to give guidance to agencies on how to schedule the retention of
  program and unique administrative records in all formats; (2) modify other
  GRSs to authorize the deletion of electronic source records for
  administrative records after a recordkeeping copy has been produced; (3)
  publish guidance on a new GRS for information technology records in the
  Federal Register by March 15, 1999; and (4) form a follow-on group by
  January 1999 to continue work on electronic recordkeeping guidance
  issues.

  On September 29, 1998, after the Archivist notified the court of NARA’s
  intended actions, the court ordered that the Archivist was authorized to
  state that agencies could continue to follow current disposition practices
  for electronic records until they receive other disposition schedule
  approval from NARA, notification by NARA that the government’s appeal
  has been resolved and NARA has provided further guidance as a result of
  the appellate court’s decision, or further order of the court. In response to
  the court’s ruling, as of May 1999, NARA had taken the following actions:

• Issued NARA Bulletin 99-04 on March 25, 1999, to guide agencies on
  scheduling how long to keep electronic records of their program activities
  and certain administrative functions formerly covered under GRS 20.
  Agencies have until February 1, 2000, to submit to NARA either new



  Page 11
                             B-281101




                             records schedules for their electronic copies or a detailed plan for
                             scheduling the records. Agencies that submit a plan must commit to
                             scheduling their electronic copies within 2 years, unless NARA approves a
                             different time frame. NARA is also offering no-cost training to agency
                             records officers to assist in developing schedules or plans.

                           • Issued a revision in the general records schedules on December 21, 1998,
                             to authorize agencies’ disposal of certain administrative records (such as
                             personnel, travel, and procurement) regardless of physical format, after
                             creating an official recordkeeping copy.

                           • Drafted a new general records schedule for certain administrative records
                             to document the management of information technology. NARA has
                             received comments from agencies on this draft, has made revisions, and
                             will send the draft out for agencies’ comments again. NARA plans to
                             incorporate the agencies’ comments and send the draft to OMB for
                             comment.

                           • Initiated a follow-on study group in January 1999—Fast Track Guidance
                             Development Project (FastTrack)—intended to answer the immediate
                             questions of agencies about ERM. FastTrack is intended to answer
                             agencies’ questions that can be resolved relatively quickly without major
                             research. FastTrack staff consists of NARA staff, agency officials, and
                             consultants. NARA’s plan is to disseminate information to agencies over its
                             Web site and include best practices and frequently asked questions.

                             Our review of the ERM activities in four states and three foreign
ERM Activities of            governments showed that approaches to ERM differ. These entities often
Selected State and           did things differently from each other and/or NARA.
Foreign Governments
Some States Have             Some state governments are making decisions regarding the same ERM
                             challenges that face NARA and federal agencies, while some are waiting to
Centralized Policies but     see what works for other governments. Our interviews with officials from
Decentralized Custody of     four states (Florida, Oklahoma, Oregon, and Texas) revealed that these
Records                      states approach some issues differently than the federal government or
                                         9
                             each other.

                             In general, the four state archiving agencies provide centralized policies
                             and procedures that are described in either state law or administrative

                             9
                              Our descriptions of the requirements imposed by state laws and regulations are primarily based on our
                             interviews with state officials.




                             Page 12
  B-281101




  rules. State archiving agencies that take physical custody of the actual
  records do so when the records are no longer needed by the individual
  agencies but are of archival value. In these cases, the states do not have
  the capability to maintain the records in electronic format but require
  nonelectronic copies. The four states have relied on record-tracking
  systems, which allow them to determine where specific records are
  located.

  Two of the four states that we selected emphasized the use of the Internet
  as a mechanism that allows both the archivist and the general public to
  determine where records may be found. While the state officials indicated
  that state law and the administrative rules that they issue guide their
  records management requirements, they also interact with NARA and
  other states to assist in determining their states’ policies.

  The state archiving officials we interviewed were all aware, to varying
  degrees, of the recent federal actions and activities dealing with the
  archiving of electronic records. However, some of the states are moving
  forward independently and have been doing so for several years. For
  example, according to state officials, during the past 10 years, Texas has
  continually revised its records management manual, records management
  statutes, and administrative rules. Further, according to state officials,
  Texas continues to study ways of providing better support to agencies’
  records management programs. In November 1998, the Texas Electronic
  Records Research Committee completed a legislatively directed report
  that made several recommendations to help agencies manage their
  electronic records as required and make state agency documents in
  electronic formats readily available to the public. The committee’s
  recommendations include guidelines to enable better coordination among
  records management, archives, and information systems staff within
  agencies. The recommendations to the Texas State Library and Archives
  Commission and the Department of Information Resources included

• establishing administrative procedures and training to ensure that all staff
  work together to identify and manage electronic records to meet retention
  and archival preservation requirements,
• making library and archives standards applicable to all state records
  maintained in electronic format,
• seeking a legislative change in the Local Government Records Act so that
  the rules for managing electronic records can be amended to make these
  standards applicable to all local government records maintained in
  electronic format,




  Page 13
  B-281101




• jointly establishing and publishing guidelines for using standard functional
  requirements for electronic recordkeeping systems,
• studying the issues of retaining electronic records of enduring value for
  historical and research purposes to identify available options and
  associated costs with the intent of proposing legislative action,
• developing cost models for providing information to the public on-line, and
• working with the Office of the Attorney General to jointly establish rules
  and guidelines for providing and managing access to publicly available
  government information without compromising the privacy of citizens.

  Similarly, according to state officials, Florida’s current records
  management policy is based primarily on 10 to 15 years of legislatively
  directed studies and reports on information management as well as
  experience gained through Florida’s archive and historical records
  program, which it has operated since 1967. In September 1998, a
  consultant’s report on access to state government electronic information
  of long-term or archival value recommended that, among other things, the
  Florida State Archives take custody of electronic records when an agency
  is defunct and has no successor agency or when the records of an ongoing
  agency have archival value. The report also recommended that the Florida
  State Archives (1) serve as a “locator” for information about archived
  electronic records; (2) review the agencies’ annual reports on information
  systems; (3) assist in detailed reviews of the records policies and
  procedures of individual agencies; and (4) contract with an outside party
  to maintain the electronic records, including storing, providing access, and
  regularly migrating data to meet preservation requirements.

  From our interviews with officials in the four states and review of
  documentation, we learned that some states have arrived at decisions on
  how to address ERM issues. For instance:

• Policies and Procedures. According to state officials, the state archives
  agencies in the four states we surveyed generally provide centralized
  policies and procedures, described in either state legislation or
  administrative rules, that are the catalysts for policy development. Other
  considerations mentioned by the state archives officials were federal laws,
  recommendations made by internal and state auditors, observations of
  other states and the federal government, and private business practices.

• Guidance. The records management regulations in Texas, Florida, and
  Oregon provide specific guidance to state agencies. For example, Texas
  provides guidance on (1) standardized definitions for terms related to
  managing electronic records; (2) minimum requirements for the



  Page 14
  B-281101




  maintenance, use, retention, storage, and destruction of electronic records;
  (3) records management program administration that incorporates ERM
  objectives into agency directives, ensures that training is provided, ensures
  the development and maintenance of up-to-date electronic systems
  documentation, and specifies the location and media on which electronic
  records are maintained; (4) security of electronic records; and (5) public
  access to electronic records. Although some differences exist in content or
  approach, state code or administrative rules for Florida and Oregon
  provide equally detailed, and often closely paralleled, guidance to state
  agencies for managing electronic documents.

• Electronic records retention. State agencies in Texas, Florida, and
  Oklahoma retain archiving responsibility and custody of electronic
  records. When paper or microfilm records are no longer needed at the
  agency level, those of archival value are transferred to a central storage
  facility. In Texas, ERM and archiving system design are functions that are
  decentralized to state agencies, while Florida establishes minimum
  electronic recordkeeping requirements for all state agency records
  management and archiving systems. Texas has implemented an automated
  inventory tracking system to facilitate access to nonelectronic records
  maintained by the archives. Florida is considering using a contractor to
  develop and maintain storage and access for electronic archival records,
  including migration and software requirements.

• Development of a governmentwide information locator system. While
  Oregon and Oklahoma use what is basically a manual system to provide
  the public with access to archived records, Texas and Florida have
  developed Internet-accessible government information locator systems.
  The Texas Record and Information Locator Service is an on-line resource
  for accessing government information statewide—the next version will
  identify, describe, and locate individual state government information
  resources as well as print publications, individual documents, and
  databases available to the public on the Internet. The Florida Government
  Information Location System provides public Internet access to the
  location of electronic and nonelectronic public records.

• Training. All four states sponsor organized records management training
  programs or workshops for state employees.

• Enforcement of records management requirements. Authority to enforce
  mandated records management requirements varies among the states. For
  example, according to state officials, Oregon can impound records in
  danger of being lost, and citizens of Florida can request a state attorney



  Page 15
                           B-281101




                           investigation when they think that records may have been prematurely
                           destroyed. Florida is also currently considering a requirement for formal
                           statements of compliance from all state agencies. The Texas State Code
                           establishes requirements for state agencies to transfer archival records to
                           the State Archives or preserve them within the agency.

                           The National Historical Publications and Records Commission (NHPRC),
                           the grantmaking affiliate of NARA, provides funds to state and local
                           archives, colleges and universities, libraries and historical societies, and
                           other nonprofit organizations to help locate, preserve, and provide public
                           access to documents and other historical materials. NHPRC has made
                           several grants to states in recent years to assist them in their ERM efforts.

Some Foreign Governments   NARA is working with Australia, Canada, and the United Kingdom on
                           common ERM challenges. Our review of public documents showed that,
Are More Centralized and   although these countries share common challenges, they each have taken
Provide More Detailed      somewhat different approaches to making ERM decisions.
Guidance Than Others
                           The Australian, Canadian, and United Kingdom governments differ from
                           each other, as well as NARA, in how they archive national records. For
                           example, Australia has strong central authority and decentralized custody.
                           Due to this decentralized custody, Australia must rely on a government-
                           maintained information locator system to determine where the records are
                           located. Since agencies within the governments can have various software
                           systems, decentralized custody places the responsibility on the agencies,
                           not the national archives, to ensure that records are retrievable regardless
                           of any changes in hardware or software technology requirements. Use of
                           the Internet is being integrated into their systems for search, retrieval,
                           and/or requests for information. Australia has somewhat detailed records
                           retention guidance to which its agencies must adhere. Since it does not
                           have direct custody of electronic records, the Australian central archiving
                           agency has compliance audit authority to ensure that individual agencies
                           follow records management and archiving policies and laws.
                           Implementation of an automated records management software system is
                           under way.

                           Canada’s national archives takes a somewhat different approach. Canada
                           established “vision statements,” rather than specific policies, and the
                           individual agencies maintain their own electronic records until they have
                           no more operational need for them. At that point, records of archival value
                           are transferred to the national archives. Also, Canada offers use of the
                           Internet for searching, requesting, and retrieving pertinent records.




                           Page 16
                 B-281101




                 The United Kingdom established broad guidelines, which are put into
                 practice by its individual agencies or departments in a partnership
                 arrangement with its national archives. These guidelines address all types
                 of records, including electronic records. Currently, the Public Record
                 Office has several study groups addressing management of electronic
                 records and overall strategy for E-mail and office desktop systems. Case
                 studies in five different departments are currently in progress to identify
                 alternative practices for electronic recordkeeping.

                 NARA is also part of two ongoing international initiatives that are to study
                 and make recommendations regarding ERM. The first effort—International
                 Research on Preservation of Authentic Records in Electronic Systems
                 (INTER PARES)—is made up of archivists from seven countries (United
                 States, Canada, Ireland, Italy, Netherlands, Sweden, and United Kingdom)
                 and six research teams (United States, Canada, Northern Europe, Italy,
                 Australia, and the Collaborative Electronic Notebook Systems
                 Association). INTER PARES first met in Washington, D.C., in June 1998.
                 The second effort is made up of English-speaking countries (United States,
                 United Kingdom, Australia, and Canada). This group first met in London,
                 England, in July 1998.

                 NARA and federal agencies are being challenged to effectively and
Conclusion       efficiently manage electronic records in an environment of rapidly
                 changing technology and increasing volume of electronic records. On the
                 basis of our discussions with officials from NARA and four judgmentally
                 selected agencies, we determined that ERM programs vary greatly across
                 agencies. NARA had planned to conduct a baseline survey intended to
                 obtain governmentwide information on agencies’ ERM programs, but
                 NARA has now postponed the survey because it believes that it should first
                 complete a BPR effort to improve guidance and assistance to agencies.
                 Considering that the BPR effort would more likely result in changes that
                 are practical and functional for the agencies if it included an assessment of
                 where the agencies are today in terms of ERM, the survey should not be
                 postponed.

                 In order for NARA to have the best information to make decisions during
Recommendation   its BPR effort and, thereby, improve ERM in the federal government, we
                 recommend that the Archivist, National Archives and Records
                 Administration, conduct a baseline assessment survey now and use the
                 information as input into the BPR effort, rather than postpone the survey
                 until after the effort is completed.




                 Page 17
                      B-281101




                      On June 7, 1999, we provided the Archivist with a draft of this report for
Agency Comments and   comment. We received his comments in a letter dated June 22, 1999, which
Our Evaluation        is reprinted in appendix II.

                      In commenting on our draft report, the Archivist said that we have ably
                      outlined significant electronic records challenges faced by NARA and
                      federal agencies. The Archivist also commented, however, that he did not
                      concur with our recommendation to conduct a baseline assessment survey
                      now and use the information as input into the BPR effort. The Archivist
                      stated that the survey has been put “on hold only temporarily,” and that he
                      is “committed to conducting it in a timely fashion, and in a way that
                      provides the greatest benefit to NARA and the agencies in improving
                      Federal records management programs.”

                      While there is general agreement that the baseline survey is needed and
                      should be done, we disagree with the Archivist over the timing of the
                      survey. During our review, we looked for justification for conducting the
                      survey before, during, or after the BPR effort. Conducting the baseline
                      survey now could provide valuable information for the BPR effort, while
                      also accomplishing the survey’s intended purpose of providing baseline
                      data on where agencies are with regard to records management programs.
                      Because agencies vary in their implementation of ERM programs, the
                      baseline survey would provide much richer data than the limited
                      information collection effort outlined by the Archivist in his response
                      letter and would fulfill an agency strategic goal. NARA would also be in a
                      better position in later years to assess the impacts of its BPR effort, as well
                      as to assess progress toward achieving its long-range performance targets
                      as outlined in the Archivist’s letter.

                      Finally, we are concerned about how long it may take to complete the
                      baseline survey if it is put on hold until after the BPR effort. Given that this
                      effort is expected to take 18 to 24 months after it is started and the
                      baseline survey is expected to take about 2 years, the baseline of
                      governmentwide records management programs may not be established
                      until perhaps sometime in calendar year 2003. There is also the possibility
                      that the baseline survey would be further delayed while the BPR initiatives
                      have a chance to gain a foothold throughout the government. For these
                      reasons, we continue to believe that the baseline survey should be done
                      now, as the BPR effort gets under way.




                      Page 18
B-281101




We are sending copies of this report to the Honorable Joseph Lieberman,
Ranking Minority Member of this Committee, and the Honorable John W.
Carlin, Archivist of the National Archives and Records Administration. We
will make copies available to others upon request.

Major contributors to this report are acknowledged in appendix III. If you
have any questions, please call me on (202) 512-8676.

Sincerely yours,




Laurie E. Ekstrand
Associate Director, Federal Management
 and Workforce Issues




Page 19
Contents



Letter                                                                                                      1


Appendix I                                                                                                 22

Scope and
Methodology
Appendix II                                                                                                24

Comments From the
National Archives and
Records
Administration
Appendix III                                                                                               26

GAO Contacts and
Staff
Acknowledgments



                        Abbreviations

                        BPR              business process reengineering
                        DOD              Department of Defense
                        EPA              Environmental Protection Agency
                        ERM              electronic records management
                        GRS              general records schedule
                        GSA              General Services Administration
                        INTER PARES      International Research on Preservation of Authentic Records in
                        Electronic Systems
                        NARA             National Archives and Records Administration
                        NASA             National Aeronautics and Space Administration
                        NHPRC            National Historical Publications and Records Commission
                        OMB              Office of Management and Budget
                        OTS              Office of Thrift Supervision




                        Page 20                                    GAO/GGD-99-94 Preserving Electronic Records
Page 21   GAO/GGD-99-94 Preserving Electronic Records
Appendix I

Scope and Methodology


             To obtain information on the challenges that confront the National
             Archives and Records Administration (NARA) and federal agencies as a
             result of their increased reliance on electronic media, we interviewed
             NARA and agency officials from four judgmentally selected agencies—the
             Environmental Protection Agency (EPA), the General Services
             Administration (GSA), the National Aeronautics and Space Administration
             (NASA), and the Department of the Treasury’s Office of Thrift Supervision
             (OTS). We also (1) interviewed other electronic records management
             (ERM) professionals from educational institutions and records managers’
             organizations and (2) reviewed documents and papers written on the
             subject by these professionals and others. We also attended ERM
             seminars, conferences, and meetings where NARA and many agencies
             were represented, and these challenges were discussed.

             To obtain information on the status of agencies’ and NARA’s
             implementation of ERM, we made limited contacts at the previously
             mentioned agencies to obtain information on their policies and
             procedures. We interviewed records management officials at these
             agencies and reviewed pertinent documentation. We selected EPA
             because they have an active, progressive records management program;
             we selected GSA because they have oversight records management
             responsibilities in addition to operating their own records management
             program. We chose NASA and OTS because they are piloting ERM
             software to help them manage electronic records. We also obtained and
                                                                                      1
             reviewed the Department of Defense’s (DOD) ERM software standard. In
             addition, we interviewed NARA staff and reviewed NARA’s guidance and
             oversight responsibilities. We also interviewed an official of the Office of
             Management and Budget (OMB) to determine how OMB assists NARA in
             providing guidance to agencies.

             To obtain information on ERM policies and procedures of some other
             governments (state and foreign), we judgmentally selected three states
             (Florida, Oregon, and Texas) on the basis of recommendations from
             records management professionals who said that these states are
             considered leaders in ERM. We also contacted another state near our
             Dallas Field Office that was not mentioned by these professionals
             (Oklahoma). At the four states, we interviewed officials and reviewed
             documentation of their policies and procedures. (See footnote 9 in this
             report.)

             1
              Design Criteria Standard for Electronic Records Management Software Applications, November 1997,
             issued under the authority of DOD Directive 5015.2, Department of Defense Records Management
             Program, April 11, 1997.




             Page 22                                         GAO/GGD-99-94 Preserving Electronic Records
Appendix I
Scope and Methodology




In addition, we obtained policies, procedures, and other public
documentation from the Internet Web sites of three judgmentally selected
foreign countries (Australia, Canada, and the United Kingdom) that
records management professionals identified as being advanced in ERM.
These three countries also work with NARA on various ERM initiatives.




Page 23                            GAO/GGD-99-94 Preserving Electronic Records
Appendix II

Comments From the National Archives and
Records Administration




              Page 24      GAO/GGD-99-94 Preserving Electronic Records
Appendix II
Comments From the National Archives and Records Administration




Page 25                                   GAO/GGD-99-94 Preserving Electronic Records
Appendix III

GAO Contacts and Staff Acknowledgments


                  Michael W. Jarvis, (202) 512-6363
GAO Contacts

                  James H. Burow
Acknowledgments
                  James W. Turkett

                  Warren Smith

                  James L. Rose

                  James M. Rebbe

                  David F. Plocher

                  Carol M. Hillier




                  Page 26                             GAO/GGD-99-94 Preserving Electronic Records
Page 27   GAO/GGD-99-94 Preserving Electronic Records
Page 28   GAO/GGD-99-94 Preserving Electronic Records
Ordering Information

The first copy of each GAO report and testimony is free. Additional
copies are $2 each. Orders should be sent to the following address,
accompanied by a check or money order made out to the
Superintendent of Documents, when necessary. VISA and
MasterCard credit cards are accepted, also. Orders for 100 or more
copies to be mailed to a single address are discounted 25 percent.

Order by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
     th                  th
700 4 St. NW (corner of 4 and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000 or by using fax
number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony.
To receive facsimile copies of the daily list or any list from the past
30 days, please call (202) 512-6000 using a touch-tone phone. A
recorded menu will provide information on how to obtain these
lists.

For information on how to access GAO reports on the INTERNET,
send e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested




410356