United States General Accounting Office GAO Report to the Chairman Committee on Governmental Affairs U.S. Senate July 1999 NATIONAL ARCHIVES Preserving Electronic Records in an Era of Rapidly Changing Technology GAO/GGD-99-94 United States General Accounting Office General Government Division Washington, D.C. 20548 B-281101 July 19, 1999 The Honorable Fred Thompson Chairman, Committee on Governmental Affairs United States Senate Dear Mr. Chairman: Under the Federal Records Act, the National Archives and Records Administration (NARA) is responsible for providing guidance and assistance to federal agencies on the creation, maintenance, use, and 1 disposition of government records. Federal agencies are responsible for ensuring that their records are created and preserved in accordance with the act. Records generated electronically, such as electronic mail (E-mail) messages, word processing documents, CD ROMs, and World Wide Web site pages, present an archival challenge for NARA and agencies because these technologies are new and changing very rapidly. Also, the sheer volume of these records is mushrooming. At your request, we undertook an effort to identify issues that relate to electronic records management (ERM), focusing specifically on the preservation of electronic records. On February 4, 1999, we provided your office with a briefing on our work. As your office agreed, this report documents our oral briefing and provides additional information on (1) the challenges that confront NARA and federal agencies as a result of their increased reliance on electronic media; (2) the status of selected agencies’ and NARA’s implementation of ERM; and (3) the ERM policies and procedures of selected other governments (state and foreign). We conducted our work between August 1998 and June 1999 in accordance with generally accepted government auditing standards. Appendix I contains a discussion of our scope and methodology. On June 7, 1999, we provided a draft of this report to the Archivist, who heads NARA, for review and comment. The Archivist’s comments are discussed at the end of this letter and reprinted in appendix II. NARA and federal agencies are faced with the substantial challenge of Results in Brief preserving electronic records in an era of rapidly changing technology. In addition to handling the burgeoning volume of electronic records, NARA 1 44 U.S.C. 2904. Page 1 B-281101 and the agencies must address several hardware and software issues to ensure that electronic records are properly created, permanently maintained, secured, and retrievable in the future. Also, NARA’s and the agencies’ ERM efforts are competing with other information technology priorities, particularly the need to ensure that their computers are Year 2000 compliant. NARA is responsible for providing guidance and assistance to agencies on how to maintain their official government records and for archiving those records once they are transferred to NARA. The agencies are responsible for ensuring that records are created and preserved in accordance with the Federal Records Act. No centralized source of information exists to document the extent to which agencies are fulfilling their ERM responsibilities under the act. On the basis of our discussions with officials 2 from NARA and four judgmentally selected agencies, we found that plans and capabilities for ERM vary greatly across agencies. Some agencies are waiting for more specific guidance from NARA, while others are moving forward on their own to implement ERM programs. NARA has recently postponed a planned baseline survey that was intended to obtain governmentwide information on agencies’ ERM programs because NARA believes that it should first complete a business process reengineering (BPR) effort. This BPR effort, which is intended to assess and potentially alter NARA’s guidance to and interaction with agencies, is expected to take 18 to 24 months. We believe that the baseline survey information is critical to ensuring that the BPR results are relevant to the current ERM situations at agencies and the survey should not be postponed. Further, these baseline data are needed to meet one of NARA’s stated strategic planning goals to “stay abreast of technologies in the agencies.” We are making a recommendation in this report regarding the baseline survey. Even while planning its BPR effort, NARA is taking some immediate action to address the agencies’ needs for ERM guidance and direction. NARA is now revising its ERM guidance to address personal computers and the resulting desktop management of electronic records. NARA’s efforts to improve ERM include revising bulletins and other guidance as well as forming a new group to help answer agencies’ immediate questions on ERM issues. NARA has taken many of its actions as a result of a court 2 We made limited contacts at the Environmental Protection Agency, the General Services Administration, the National Aeronautics and Space Administration, and the Department of the Treasury’s Office of Thrift Supervision. Page 2 B-281101 3 decision, which held that NARA’s guidance for the deletion of electronic records exceeded its statutory authority. The federal government is not alone in its quest to properly preserve and maintain electronic records. State and foreign governments are addressing 4 similar challenges. From our limited judgmental sample of state and foreign governments, it is clear that these governments and the federal government often differ in (1) the organization of their archival activities, (2) their philosophies on centralization versus decentralization of recordkeeping responsibilities, and (3) their computer hardware and software capabilities. NARA’s mission is to ensure “ready access to essential evidence” for the Background public, the President, Congress, and the courts. NARA is to make the permanently valuable records of the government—in all media—available for reference and research. In addition to the best known documents, such as the Declaration of Independence, the Constitution, and the Bill of Rights, NARA preserves billions of pages of textual documents and numerous maps, photographs, videos, and computer records. Each citizen has a right to access the official records of the government. During fiscal year 1998, 2.6 million people (including genealogists, historians, librarians, and veterans) visited NARA’s facilities to browse and do research, and NARA received over 56 million “hits” on its Web site from scholars, students, and other inquirers. Records management is a statutory responsibility of the Archivist and heads of the federal agencies. The Federal Records Act, comprising the Records Disposal Act and other statutes, defines a record as “all books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency…under federal law or in connection with the transaction of public business and preserved or appropriate for preservation…as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of data in them.”5 3 Public Citizen v. Carlin, 2 F. Supp. 2d 1 (D.D.C. 1997). 4 We interviewed officials from Florida, Oklahoma, Oregon, and Texas and reviewed public documents from Australia, Canada, and the United Kingdom. 5 44 U.S.C. 3301. Page 3 B-281101 NARA and agency staff work together to identify and inventory an agency’s records to appraise the value of the records and determine how long they should be kept and under what conditions. The formal approval of this work is called scheduling. Agency records must be scheduled through either records schedules specific to each agency or a general records schedule (GRS), which is issued by the Archivist and authorizes disposal, after a specified period of time, of records of a specified form or character common to several or all federal agencies. Records of permanent value (such as final budget submissions and calendars of senior staff) must be preserved and eventually transferred to NARA for archival and research purposes. Other records deemed of insufficient value to warrant their preservation, such as payroll or travel, are considered temporary records and must be preserved by the agency for only a specified length of time. In addition to the Federal Records Act, several other laws, such as the Paperwork Reduction Act, Privacy Act, Freedom of Information Act, Electronic Freedom of Information Act, and Government Paperwork Elimination Act, also address records management requirements for both paper and electronic records. Also, the General Services Administration, the Office of Management and Budget, and individual agencies issue records management regulations. NARA and federal agencies are confronted with many ERM challenges, NARA and Federal particularly technological issues. NARA must be able to receive electronic Agencies Face ERM records from agencies, store them, and retrieve them when needed. Challenges Agencies must be able to create electronic records, store them, properly dispose of them when appropriate, and send permanently valuable electronic records to NARA for archival storage. All of this must be done within the context of the rapidly changing technological environment. NARA’s Challenges As stated in NARA’s 10-year strategic plan covering the period of 1997 to 2007, NARA’s goals are to determine how to (1) preserve electronic records that the nation will need, (2) manage change, (3) stay abreast of technologies in federal agencies, and (4) use technologies to safeguard valuable information and make it more readily accessible. NARA’s plan also points out that it must meet the public’s need for “on-line” access to information and work in partnership with other entities that are struggling with the same problems. According to our research and discussions with NARA officials and other records management professionals, NARA is faced with a number of challenges to ensure that federal records in electronic format are preserved. NARA officials told us that NARA needs to expand its capacity Page 4 B-281101 to accept the increasing volume of electronic records from the agencies. Over the past quarter century, NARA has taken in approximately 90,000 electronic data files. NARA has estimated that federal agencies, such as the Department of State and the Department of the Treasury, are individually generating 10 times that many electronic records annually just in E-mail, many of which may need to be preserved by NARA. One of the items in NARA’s fiscal year 2000 budget request would allow NARA to begin development of a system to save large volumes of E-mail messages and other small data files that agencies are increasingly creating. Some of the initial research and development for this system is being done in fiscal year 1999. In addition to the increasing volume, the increasing variety of electronic records (e.g., word processing documents, E-mail messages, databases, digital images, and Web site pages) complicate NARA’s mission to preserve these records. NARA must address some definitional problems, such as what is an electronic record, when is an E-mail message a record, or when are Web site “virtual records” considered records. Also, electronic records are generated as files that require compatible hardware playback devices and the correct software for retrieving, viewing, and transmitting. Because agencies follow no uniform hardware standards, NARA must be capable of accepting various formats (hardware and software) from the agencies and maintaining a continued capability to read those records. The long-term preservation and retention of those electronic records is also a challenge since providing continued access to archived records over many generations of systems is difficult. The average life of a typical software product is 2 to 5 years. There are currently only three alternatives for maintaining accessibility over time, as follows: (1) maintain records in a software-independent format, (2) reformat and migrate records to new software systems, or (3) maintain the records in the original format and maintain the necessary hardware and software to make them accessible. Another concern is the deterioration of the storage media over time, and NARA must consider the permanency of the formats used by agencies (such as floppy disks and CD ROMs). These and other media that are used now and that are being developed must remain readable over a long period of time or be changed to a different media. Finally, another challenge is NARA’s ability to offer guidance to the agencies regarding the orderly management of electronic records, especially relating to the authenticity and reliability of electronic records that eventually will be transferred into NARA’s custody. Current electronic security measures, encryption, and authentication techniques could Page 5 B-281101 increase the reliability and authenticity of electronic records; however, there has been little analysis of the risk or the costs and benefits of implementing those measures for agencywide systems. It is important to note that a properly maintained electronic recordkeeping system provides more security and accountability than a comparable paper-based system because the electronic system can record details on access, revision, and deletion. Agencies’ Challenges Records management is initially the responsibility of the agency staff member who creates a record, whether the record is paper or electronic. Preservation of and access to that record then also becomes the responsibility of agency managers and agency records officers. Electronic records are now frequently created on a personal computer. Electronic recordkeeping responsibilities are often overlooked by the staff member who creates the record. The staff member should be made aware of what constitutes an electronic record, how to save it, and how to archive it for future use. Decentralized control over electronic documents is changing the face of records management because records can easily be deleted without records managers even being aware that the record existed. The agencies are challenged with informing employees what is required of them and how to accomplish their records management responsibilities. Agencies receive guidance from NARA, but they must put their own recordkeeping systems in place. Some agencies continue to experience confusion over what constitutes an electronic record and who has responsibility for preserving the record. Questions also arise regarding how to handle multiple copies or versions of documents and whether drafts are official records. Agencies’ employees send and receive huge volumes of E-mail in performing their official duties and responsibilities. Agencies must determine which of these E-mail messages are records. When E-mail messages are determined to be official records, agencies must assign records management responsibility, control multiple versions, and archive the messages. Also, because much internal business deliberation is conducted via E-mail, for privacy reasons, these messages must be reviewed before being released to the public. Agencies’ ERM efforts are competing for attention and resources with other information technology priorities, particularly in those agencies dealing with the Year 2000 problem. NARA officials believe that ERM Page 6 B-281101 activities may be slowed by agencies’ concentration on other priorities, such as systems’ upgrades and Year 2000 compliance. Regarding Year 2000 compliance, the old technology that created some electronic records might not be Year 2000 compliant, and this noncompliance could cause future retrieval difficulties for the agencies and NARA. On the basis of our discussions with NARA officials and officials of the Agencies’ and NARA’s four previously mentioned selected agencies and discussions at Actions to Implement governmentwide conferences on the subject of records management, we ERM learned that agencies vary in their records management programs and in their capabilities to implement ERM. Some agencies are waiting for more specific guidance from NARA, while others are moving forward by looking for ways to better manage their electronic records. However, there has been no recent governmentwide survey of agencies’ compliance with the archival provisions of the Federal Records Act or agencies’ ERM activities. NARA is planning a BPR effort that will collect limited information from some agencies but will not include a complete governmentwide baseline survey. In the interim, NARA has begun to revise its ERM guidance to provide some immediate guidance and direction for the agencies. Agencies Vary in Their Our discussions with NARA officials and officials from the four judgmentally selected agencies indicated that agencies vary in how they Implementation of ERM are implementing their ERM programs. NARA officials directed us to the Department of Defense (DOD) as one of the agencies that is most advanced in its ERM efforts. NARA has been working with DOD for several 6 years to develop DOD’s ERM software standard, which is intended to help DOD employees determine what are records and how to properly preserve them. NARA endorsed the DOD standard in November 1998 as a tool that other agencies could use as a model until a final policy is issued by NARA. The endorsement does not mandate that agencies use the DOD standard; instead, NARA said that the standard conforms to the requirements of the Federal Records Act and establishes baseline requirements for managing electronic records. NARA also said that while the DOD standard is an appropriate basis for records management, there might be other equally valid ways to address ERM. The DOD standard is intended as a starting 6 The DOD standard, Design Criteria Standard for Electronic Records Management Software Applications, November 1997, was issued under the authority of DOD Directive 5015.2, Department of Defense Records Management Program, April 11, 1997. Page 7 B-281101 point that must be tailored to a specific agency’s needs. NARA said that each agency must still address ERM within the context of its own computer and policy environments. The DOD standard is a tool that is intended to help agencies develop automated systems to file, track, and preserve or destroy its electronic records. DOD’s standard has a series of requirements that are measurable and testable and based on various laws and NARA regulations. The standard, which is mandatory for all DOD components, provides implementation and procedural guidance on the management of records in DOD. ERM information systems that were in place before the approval of this standard must comply with the standard by November 1999. The DOD standard (1) sets forth baseline functional requirements for records management application software that is used by DOD components in the implementation of their records management programs; (2) defines required system interfaces and search criteria to be supported by records management application software; and (3) describes the minimum records management requirements that must be met, based on current NARA regulations. The DOD standard also requires that records management software perform several functions, including the following: • Assign each record a unique, computer-generated code that identifies the document. • Treat filed E-mail messages, including attachments, as records. • Allow records to be searched, screened, and viewed on the basis of record profiles. • Identify records that can be sent to NARA for storage. • Notify users when a document is eligible for destruction or transfer, and destroy or transfer it after approval. As of June 2, 1999, nine companies had records management application products that were certified by DOD as meeting its standard. Some products are ERM software, while others integrate their document management or workflow products with ERM software from another vendor. Two agencies that are testing ERM software that meet the DOD standard are the National Aeronautics and Space Administration (NASA) and the Department of the Treasury’s Office of Thrift Supervision (OTS). NASA did a limited test of an early version of one ERM product and found it difficult to use and time-consuming to install. The software did not perform well with NASA’s varying hardware and software platforms. According to an Page 8 B-281101 agency official, the NASA test did, however, give NASA a better understanding of its requirements, including its records management program in particular. NASA plans to evaluate a newer version of this software later in fiscal year 1999. OTS is testing ERM software that differs from the one NASA used. OTS’ test is meant primarily to organize its electronic files. According to OTS’ manager of its records branch, it is important that ERM software requires users to make no more than two or three extra keystrokes, and that users realize there is a benefit to this additional “burden.” NARA Does Not Have Even though NARA is aware of the efforts of DOD, NASA, OTS, and various other agencies, it does not now have governmentwide data on the Governmentwide Data on records management capabilities and programs of all federal agencies. Agencies’ ERM Efforts NARA had planned to do a baseline assessment survey to collect such data on all agencies by the end of fiscal year 2000. According to NARA officials, this survey was needed to identify best practices at agencies and collect data on (1) program management and records management infrastructure, (2) guidance and training, (3) scheduling and implementation, and (4) electronic recordkeeping. NARA had planned to determine how well agencies were complying with requirements for retention, maintenance, disposal, retrieval/accessibility, and inventorying of electronic records. In the early results in the pilot test of the survey at a limited number of agencies, NARA discovered that most of the pilot agencies lacked adequate employee guidance regarding electronic records. The Archivist has decided to put the baseline survey on hold primarily because of what he believes are other higher priority activities, such as NARA’s BPR effort, which could change NARA’s regulations and thereby affect the data that NARA would need to acquire from the agencies. NARA’s BPR effort to address its internal processes, as well as guidance to and interactions with the agencies, is expected to begin before the end of fiscal year 1999. This BPR effort should take 18 to 24 months. However, NARA will now proceed without the rich baseline of information from across the federal government that was originally planned. NARA officials could not give us a time frame regarding when the survey effort would be reinitiated. In the interim, according to a NARA Policy and Communications official, NARA will continue to gather additional information about the status of records management through a targeted assistance program, which will focus on helping agencies that have the most urgent records management needs. This effort, by definition, will not provide a baseline across all agencies. Page 9 B-281101 Currently, NARA does in-depth studies of two to four agencies a year in which it looks at the agencies’ records management policies and then recommends areas for improvement. Since some individual agencies have not been reviewed for several years, this method of collecting information on agencies has not yielded a current governmentwide look at the situation. Thus, this effort does not achieve NARA’s strategic planning goal to “stay abreast of technologies in the agencies.” NARA Is Revising Its ERM Historically, NARA’s ERM guidance has been geared toward mainframes and databases, not personal computers. In addition to NARA’s planned Guidance BPR, NARA is taking some immediate action to revise its guidance to be more appropriate in today’s workplace environment. NARA’s electronic records guidance to agencies is found in the Code of 7 Federal Regulations, which establishes the basic requirements for creation, maintenance, use, and disposition of electronic records. In 1972, before the widespread use of personal computers in the government workplace, NARA issued GRS 20 to provide guidance on the preservation of electronic records. However, agency records officers, data processing staff, and even NARA staff had trouble understanding and applying the first version of GRS 20. Subsequently, GRS 20 had several major revisions, culminating with the 1995 revision authorizing, among other things, that after electronic records, which were created in an office automation environment or computer centers, were placed in a recordkeeping system—electronic, paper, or microfilm—the records could be deleted. NARA’s ERM guidance under the 1995 version of GRS 20 was challenged in a December 1996 lawsuit filed in the United States District Court for the 8 District of Columbia by a public interest group. In an October 1997 decision, the court found that the Archivist exceeded the scope of his statutory authority in promulgating GRS 20. First, the court stated that GRS 20 did not differentiate between program records, which are possibly subject to preservation, and administrative “housekeeping” records, which the court found were the only records allowed to be disposed of through GRSs. Second, the court found that electronic records did not lose their status as program records once they were preserved on paper; they are considered to be unique records and distinct from printed versions of the same record. 7 36 CFR Part 1234. 8 Public Citizen v. Carlin, 2 F. Supp. 2d 1 (D.D.C. 1997). Page 10 B-281101 The court also held that by categorically determining that no electronic records have value, the Archivist failed to carry out his statutory duty to evaluate the value of records for disposal. Moreover, the court determined that GRS 20 violated the Records Disposal Act because it failed to specify a period of time for retention of records that are to be disposed of through a GRS. The court thus declared GRS 20 “null and void.” The government filed an appeal of this ruling in December 1997. In March 1998, NARA issued a bulletin informing agencies that NARA had established a working group with a specific time frame to propose alternatives to GRS 20. The same public interest group that initially challenged GRS 20 went back to court when it realized that the Archivist was informing agencies that they could continue to rely on GRS 20 even after the court had ruled it “null and void.” The court, in a subsequent ruling, found that the Archivist had “flagrantly violated” the court’s October 1997 order and ordered, among other things, the NARA working group to have an implementation plan to the Archivist by September 30, 1998. In September 1998, on the basis of recommendations made by the NARA- sponsored electronic records working group, the Archivist decided to take several steps. Specifically, the Archivist agreed to (1) issue a NARA bulletin to give guidance to agencies on how to schedule the retention of program and unique administrative records in all formats; (2) modify other GRSs to authorize the deletion of electronic source records for administrative records after a recordkeeping copy has been produced; (3) publish guidance on a new GRS for information technology records in the Federal Register by March 15, 1999; and (4) form a follow-on group by January 1999 to continue work on electronic recordkeeping guidance issues. On September 29, 1998, after the Archivist notified the court of NARA’s intended actions, the court ordered that the Archivist was authorized to state that agencies could continue to follow current disposition practices for electronic records until they receive other disposition schedule approval from NARA, notification by NARA that the government’s appeal has been resolved and NARA has provided further guidance as a result of the appellate court’s decision, or further order of the court. In response to the court’s ruling, as of May 1999, NARA had taken the following actions: • Issued NARA Bulletin 99-04 on March 25, 1999, to guide agencies on scheduling how long to keep electronic records of their program activities and certain administrative functions formerly covered under GRS 20. Agencies have until February 1, 2000, to submit to NARA either new Page 11 B-281101 records schedules for their electronic copies or a detailed plan for scheduling the records. Agencies that submit a plan must commit to scheduling their electronic copies within 2 years, unless NARA approves a different time frame. NARA is also offering no-cost training to agency records officers to assist in developing schedules or plans. • Issued a revision in the general records schedules on December 21, 1998, to authorize agencies’ disposal of certain administrative records (such as personnel, travel, and procurement) regardless of physical format, after creating an official recordkeeping copy. • Drafted a new general records schedule for certain administrative records to document the management of information technology. NARA has received comments from agencies on this draft, has made revisions, and will send the draft out for agencies’ comments again. NARA plans to incorporate the agencies’ comments and send the draft to OMB for comment. • Initiated a follow-on study group in January 1999—Fast Track Guidance Development Project (FastTrack)—intended to answer the immediate questions of agencies about ERM. FastTrack is intended to answer agencies’ questions that can be resolved relatively quickly without major research. FastTrack staff consists of NARA staff, agency officials, and consultants. NARA’s plan is to disseminate information to agencies over its Web site and include best practices and frequently asked questions. Our review of the ERM activities in four states and three foreign ERM Activities of governments showed that approaches to ERM differ. These entities often Selected State and did things differently from each other and/or NARA. Foreign Governments Some States Have Some state governments are making decisions regarding the same ERM challenges that face NARA and federal agencies, while some are waiting to Centralized Policies but see what works for other governments. Our interviews with officials from Decentralized Custody of four states (Florida, Oklahoma, Oregon, and Texas) revealed that these Records states approach some issues differently than the federal government or 9 each other. In general, the four state archiving agencies provide centralized policies and procedures that are described in either state law or administrative 9 Our descriptions of the requirements imposed by state laws and regulations are primarily based on our interviews with state officials. Page 12 B-281101 rules. State archiving agencies that take physical custody of the actual records do so when the records are no longer needed by the individual agencies but are of archival value. In these cases, the states do not have the capability to maintain the records in electronic format but require nonelectronic copies. The four states have relied on record-tracking systems, which allow them to determine where specific records are located. Two of the four states that we selected emphasized the use of the Internet as a mechanism that allows both the archivist and the general public to determine where records may be found. While the state officials indicated that state law and the administrative rules that they issue guide their records management requirements, they also interact with NARA and other states to assist in determining their states’ policies. The state archiving officials we interviewed were all aware, to varying degrees, of the recent federal actions and activities dealing with the archiving of electronic records. However, some of the states are moving forward independently and have been doing so for several years. For example, according to state officials, during the past 10 years, Texas has continually revised its records management manual, records management statutes, and administrative rules. Further, according to state officials, Texas continues to study ways of providing better support to agencies’ records management programs. In November 1998, the Texas Electronic Records Research Committee completed a legislatively directed report that made several recommendations to help agencies manage their electronic records as required and make state agency documents in electronic formats readily available to the public. The committee’s recommendations include guidelines to enable better coordination among records management, archives, and information systems staff within agencies. The recommendations to the Texas State Library and Archives Commission and the Department of Information Resources included • establishing administrative procedures and training to ensure that all staff work together to identify and manage electronic records to meet retention and archival preservation requirements, • making library and archives standards applicable to all state records maintained in electronic format, • seeking a legislative change in the Local Government Records Act so that the rules for managing electronic records can be amended to make these standards applicable to all local government records maintained in electronic format, Page 13 B-281101 • jointly establishing and publishing guidelines for using standard functional requirements for electronic recordkeeping systems, • studying the issues of retaining electronic records of enduring value for historical and research purposes to identify available options and associated costs with the intent of proposing legislative action, • developing cost models for providing information to the public on-line, and • working with the Office of the Attorney General to jointly establish rules and guidelines for providing and managing access to publicly available government information without compromising the privacy of citizens. Similarly, according to state officials, Florida’s current records management policy is based primarily on 10 to 15 years of legislatively directed studies and reports on information management as well as experience gained through Florida’s archive and historical records program, which it has operated since 1967. In September 1998, a consultant’s report on access to state government electronic information of long-term or archival value recommended that, among other things, the Florida State Archives take custody of electronic records when an agency is defunct and has no successor agency or when the records of an ongoing agency have archival value. The report also recommended that the Florida State Archives (1) serve as a “locator” for information about archived electronic records; (2) review the agencies’ annual reports on information systems; (3) assist in detailed reviews of the records policies and procedures of individual agencies; and (4) contract with an outside party to maintain the electronic records, including storing, providing access, and regularly migrating data to meet preservation requirements. From our interviews with officials in the four states and review of documentation, we learned that some states have arrived at decisions on how to address ERM issues. For instance: • Policies and Procedures. According to state officials, the state archives agencies in the four states we surveyed generally provide centralized policies and procedures, described in either state legislation or administrative rules, that are the catalysts for policy development. Other considerations mentioned by the state archives officials were federal laws, recommendations made by internal and state auditors, observations of other states and the federal government, and private business practices. • Guidance. The records management regulations in Texas, Florida, and Oregon provide specific guidance to state agencies. For example, Texas provides guidance on (1) standardized definitions for terms related to managing electronic records; (2) minimum requirements for the Page 14 B-281101 maintenance, use, retention, storage, and destruction of electronic records; (3) records management program administration that incorporates ERM objectives into agency directives, ensures that training is provided, ensures the development and maintenance of up-to-date electronic systems documentation, and specifies the location and media on which electronic records are maintained; (4) security of electronic records; and (5) public access to electronic records. Although some differences exist in content or approach, state code or administrative rules for Florida and Oregon provide equally detailed, and often closely paralleled, guidance to state agencies for managing electronic documents. • Electronic records retention. State agencies in Texas, Florida, and Oklahoma retain archiving responsibility and custody of electronic records. When paper or microfilm records are no longer needed at the agency level, those of archival value are transferred to a central storage facility. In Texas, ERM and archiving system design are functions that are decentralized to state agencies, while Florida establishes minimum electronic recordkeeping requirements for all state agency records management and archiving systems. Texas has implemented an automated inventory tracking system to facilitate access to nonelectronic records maintained by the archives. Florida is considering using a contractor to develop and maintain storage and access for electronic archival records, including migration and software requirements. • Development of a governmentwide information locator system. While Oregon and Oklahoma use what is basically a manual system to provide the public with access to archived records, Texas and Florida have developed Internet-accessible government information locator systems. The Texas Record and Information Locator Service is an on-line resource for accessing government information statewide—the next version will identify, describe, and locate individual state government information resources as well as print publications, individual documents, and databases available to the public on the Internet. The Florida Government Information Location System provides public Internet access to the location of electronic and nonelectronic public records. • Training. All four states sponsor organized records management training programs or workshops for state employees. • Enforcement of records management requirements. Authority to enforce mandated records management requirements varies among the states. For example, according to state officials, Oregon can impound records in danger of being lost, and citizens of Florida can request a state attorney Page 15 B-281101 investigation when they think that records may have been prematurely destroyed. Florida is also currently considering a requirement for formal statements of compliance from all state agencies. The Texas State Code establishes requirements for state agencies to transfer archival records to the State Archives or preserve them within the agency. The National Historical Publications and Records Commission (NHPRC), the grantmaking affiliate of NARA, provides funds to state and local archives, colleges and universities, libraries and historical societies, and other nonprofit organizations to help locate, preserve, and provide public access to documents and other historical materials. NHPRC has made several grants to states in recent years to assist them in their ERM efforts. Some Foreign Governments NARA is working with Australia, Canada, and the United Kingdom on common ERM challenges. Our review of public documents showed that, Are More Centralized and although these countries share common challenges, they each have taken Provide More Detailed somewhat different approaches to making ERM decisions. Guidance Than Others The Australian, Canadian, and United Kingdom governments differ from each other, as well as NARA, in how they archive national records. For example, Australia has strong central authority and decentralized custody. Due to this decentralized custody, Australia must rely on a government- maintained information locator system to determine where the records are located. Since agencies within the governments can have various software systems, decentralized custody places the responsibility on the agencies, not the national archives, to ensure that records are retrievable regardless of any changes in hardware or software technology requirements. Use of the Internet is being integrated into their systems for search, retrieval, and/or requests for information. Australia has somewhat detailed records retention guidance to which its agencies must adhere. Since it does not have direct custody of electronic records, the Australian central archiving agency has compliance audit authority to ensure that individual agencies follow records management and archiving policies and laws. Implementation of an automated records management software system is under way. Canada’s national archives takes a somewhat different approach. Canada established “vision statements,” rather than specific policies, and the individual agencies maintain their own electronic records until they have no more operational need for them. At that point, records of archival value are transferred to the national archives. Also, Canada offers use of the Internet for searching, requesting, and retrieving pertinent records. Page 16 B-281101 The United Kingdom established broad guidelines, which are put into practice by its individual agencies or departments in a partnership arrangement with its national archives. These guidelines address all types of records, including electronic records. Currently, the Public Record Office has several study groups addressing management of electronic records and overall strategy for E-mail and office desktop systems. Case studies in five different departments are currently in progress to identify alternative practices for electronic recordkeeping. NARA is also part of two ongoing international initiatives that are to study and make recommendations regarding ERM. The first effort—International Research on Preservation of Authentic Records in Electronic Systems (INTER PARES)—is made up of archivists from seven countries (United States, Canada, Ireland, Italy, Netherlands, Sweden, and United Kingdom) and six research teams (United States, Canada, Northern Europe, Italy, Australia, and the Collaborative Electronic Notebook Systems Association). INTER PARES first met in Washington, D.C., in June 1998. The second effort is made up of English-speaking countries (United States, United Kingdom, Australia, and Canada). This group first met in London, England, in July 1998. NARA and federal agencies are being challenged to effectively and Conclusion efficiently manage electronic records in an environment of rapidly changing technology and increasing volume of electronic records. On the basis of our discussions with officials from NARA and four judgmentally selected agencies, we determined that ERM programs vary greatly across agencies. NARA had planned to conduct a baseline survey intended to obtain governmentwide information on agencies’ ERM programs, but NARA has now postponed the survey because it believes that it should first complete a BPR effort to improve guidance and assistance to agencies. Considering that the BPR effort would more likely result in changes that are practical and functional for the agencies if it included an assessment of where the agencies are today in terms of ERM, the survey should not be postponed. In order for NARA to have the best information to make decisions during Recommendation its BPR effort and, thereby, improve ERM in the federal government, we recommend that the Archivist, National Archives and Records Administration, conduct a baseline assessment survey now and use the information as input into the BPR effort, rather than postpone the survey until after the effort is completed. Page 17 B-281101 On June 7, 1999, we provided the Archivist with a draft of this report for Agency Comments and comment. We received his comments in a letter dated June 22, 1999, which Our Evaluation is reprinted in appendix II. In commenting on our draft report, the Archivist said that we have ably outlined significant electronic records challenges faced by NARA and federal agencies. The Archivist also commented, however, that he did not concur with our recommendation to conduct a baseline assessment survey now and use the information as input into the BPR effort. The Archivist stated that the survey has been put “on hold only temporarily,” and that he is “committed to conducting it in a timely fashion, and in a way that provides the greatest benefit to NARA and the agencies in improving Federal records management programs.” While there is general agreement that the baseline survey is needed and should be done, we disagree with the Archivist over the timing of the survey. During our review, we looked for justification for conducting the survey before, during, or after the BPR effort. Conducting the baseline survey now could provide valuable information for the BPR effort, while also accomplishing the survey’s intended purpose of providing baseline data on where agencies are with regard to records management programs. Because agencies vary in their implementation of ERM programs, the baseline survey would provide much richer data than the limited information collection effort outlined by the Archivist in his response letter and would fulfill an agency strategic goal. NARA would also be in a better position in later years to assess the impacts of its BPR effort, as well as to assess progress toward achieving its long-range performance targets as outlined in the Archivist’s letter. Finally, we are concerned about how long it may take to complete the baseline survey if it is put on hold until after the BPR effort. Given that this effort is expected to take 18 to 24 months after it is started and the baseline survey is expected to take about 2 years, the baseline of governmentwide records management programs may not be established until perhaps sometime in calendar year 2003. There is also the possibility that the baseline survey would be further delayed while the BPR initiatives have a chance to gain a foothold throughout the government. For these reasons, we continue to believe that the baseline survey should be done now, as the BPR effort gets under way. Page 18 B-281101 We are sending copies of this report to the Honorable Joseph Lieberman, Ranking Minority Member of this Committee, and the Honorable John W. Carlin, Archivist of the National Archives and Records Administration. We will make copies available to others upon request. Major contributors to this report are acknowledged in appendix III. If you have any questions, please call me on (202) 512-8676. Sincerely yours, Laurie E. Ekstrand Associate Director, Federal Management and Workforce Issues Page 19 Contents Letter 1 Appendix I 22 Scope and Methodology Appendix II 24 Comments From the National Archives and Records Administration Appendix III 26 GAO Contacts and Staff Acknowledgments Abbreviations BPR business process reengineering DOD Department of Defense EPA Environmental Protection Agency ERM electronic records management GRS general records schedule GSA General Services Administration INTER PARES International Research on Preservation of Authentic Records in Electronic Systems NARA National Archives and Records Administration NASA National Aeronautics and Space Administration NHPRC National Historical Publications and Records Commission OMB Office of Management and Budget OTS Office of Thrift Supervision Page 20 GAO/GGD-99-94 Preserving Electronic Records Page 21 GAO/GGD-99-94 Preserving Electronic Records Appendix I Scope and Methodology To obtain information on the challenges that confront the National Archives and Records Administration (NARA) and federal agencies as a result of their increased reliance on electronic media, we interviewed NARA and agency officials from four judgmentally selected agencies—the Environmental Protection Agency (EPA), the General Services Administration (GSA), the National Aeronautics and Space Administration (NASA), and the Department of the Treasury’s Office of Thrift Supervision (OTS). We also (1) interviewed other electronic records management (ERM) professionals from educational institutions and records managers’ organizations and (2) reviewed documents and papers written on the subject by these professionals and others. We also attended ERM seminars, conferences, and meetings where NARA and many agencies were represented, and these challenges were discussed. To obtain information on the status of agencies’ and NARA’s implementation of ERM, we made limited contacts at the previously mentioned agencies to obtain information on their policies and procedures. We interviewed records management officials at these agencies and reviewed pertinent documentation. We selected EPA because they have an active, progressive records management program; we selected GSA because they have oversight records management responsibilities in addition to operating their own records management program. We chose NASA and OTS because they are piloting ERM software to help them manage electronic records. We also obtained and 1 reviewed the Department of Defense’s (DOD) ERM software standard. In addition, we interviewed NARA staff and reviewed NARA’s guidance and oversight responsibilities. We also interviewed an official of the Office of Management and Budget (OMB) to determine how OMB assists NARA in providing guidance to agencies. To obtain information on ERM policies and procedures of some other governments (state and foreign), we judgmentally selected three states (Florida, Oregon, and Texas) on the basis of recommendations from records management professionals who said that these states are considered leaders in ERM. We also contacted another state near our Dallas Field Office that was not mentioned by these professionals (Oklahoma). At the four states, we interviewed officials and reviewed documentation of their policies and procedures. (See footnote 9 in this report.) 1 Design Criteria Standard for Electronic Records Management Software Applications, November 1997, issued under the authority of DOD Directive 5015.2, Department of Defense Records Management Program, April 11, 1997. Page 22 GAO/GGD-99-94 Preserving Electronic Records Appendix I Scope and Methodology In addition, we obtained policies, procedures, and other public documentation from the Internet Web sites of three judgmentally selected foreign countries (Australia, Canada, and the United Kingdom) that records management professionals identified as being advanced in ERM. These three countries also work with NARA on various ERM initiatives. Page 23 GAO/GGD-99-94 Preserving Electronic Records Appendix II Comments From the National Archives and Records Administration Page 24 GAO/GGD-99-94 Preserving Electronic Records Appendix II Comments From the National Archives and Records Administration Page 25 GAO/GGD-99-94 Preserving Electronic Records Appendix III GAO Contacts and Staff Acknowledgments Michael W. Jarvis, (202) 512-6363 GAO Contacts James H. Burow Acknowledgments James W. Turkett Warren Smith James L. Rose James M. Rebbe David F. Plocher Carol M. Hillier Page 26 GAO/GGD-99-94 Preserving Electronic Records Page 27 GAO/GGD-99-94 Preserving Electronic Records Page 28 GAO/GGD-99-94 Preserving Electronic Records Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Order by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 th th 700 4 St. NW (corner of 4 and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send e-mail message with “info” in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. G100 Official Business Penalty for Private Use $300 Address Correction Requested 410356
National Archives: Preserving Electronic Records in an Era of Rapidly Changing Technology
Published by the Government Accountability Office on 1999-07-19.
Below is a raw (and likely hideous) rendition of the original report. (PDF)