close X
04/9/2018

Cause of Action Institute Launches Investigation into Agency Use of Instant Messaging Applications

The number of communications devices and platforms has mushroomed in recent years, making communication both quicker and easier. Naturally, these technologies have been incorporated into business and government. The use of instant messaging applications (“IM”) for business communications has become so common that most enterprise software includes IM functionality (for example, Google Hangouts, Skype for Business instant messaging, Slack, etc.).

In response to these developments, the Federal Records Act (“FRA”) was amended in 2014 to codify a new definition of electronic messages.  The FRA now states that electronic messages include “electronic mail and other electronic messaging systems that are used for purposes of communicating between individuals” 44 U.S.C. § 2911. Electronic communications sent or received in the course of agency business—regardless of the method of message delivery—are therefore federal records and must be properly captured, retained, and stored such that they can be searched and reproduced upon request. National Archives and Records Administration (“NARA”) Bulletin 2015-02, “Guidance on Managing Electronic Messages,” makes this explicitly clear.

Unfortunately, recent events have highlighted the failure of federal agencies to properly capture, retain, and store electronic messages, including:

  • five months of missing, and then recovered, text messages between the FBI’s Peter Strzok and Lisa Page related to their official duties,
  • 2016 EPA Inspector General investigation into the use of encrypted text messages,
  • CFPB using encrypted messaging apps, the so-called “Dumbledore’s Army”,
  • IRS not retaining communications through their internal instant messaging system due to a memorandum of understanding with the Treasury Employees Union, and
  • NOAA’s questionable use of Google Hangouts.

It appears incidents of federal agencies neglecting and/or intentionally failing to properly capture, retain, and store electronic messages that are federal records are not isolated or exceptional. In light of this, CoA Institute has launched a broad inquiry into federal agencies’ efforts to implement the 2014 FRA amendments and NARA Bulletin 2015-02. Last week, CoA Institute sent FOIA requests to nearly forty agencies seeking records:

  • regarding policies on the use, retention, and management of electronic (instant) messages;
  • related to implementation of or compliance with NARA Bulletin 2015-02;
  • reflecting the electronic messaging systems installed on agency devices; and
  • reflecting whether the agency has enabled automatic electronic message archiving, indexing, and eDiscovery features on instant messaging platforms in use.

The FRA and Freedom of Information Act are essential to government transparency and accountability and they must be enforced even when—or especially when—government regulations, policies, and practices lag behind the implementation of new technologies. With respect to instant messages, the federal government’s characteristic bureaucratic torpidity bears potentially far-reaching implications for proper oversight of the federal government. With this investigation, CoA Institute seeks to discover whether (and where) government neglect or exploitation of new technologies threatens transparency and accountability.

 

Thomas Kimbrell is a research fellow at Cause of Action Institute.

Media, Blog Learn More
03/30/2018

CoA Institute Lawsuit Prompts Archivist to Examine Potential Record Destruction at NOAA

Cause of Action Institute (“CoA Institute”) filed a lawsuit last summer against the National Oceanic and Atmospheric Administration (“NOAA”) seeking copies of electronic records created through the agency’s Google-based email platform.  These types of records are commonly known as “instant messages.”  The Freedom of Information Act (“FOIA”) requests at issue (available here and here) also sought formal agency guidance on the retention of “Google Chat” or “Google Hangouts” messages.  We had already learned, through earlier investigation, that at least one internal NOAA handbook, dating from March 2012, instructed agency employees to treat all chat messages as “off the record,” raising concerns about potential unlawful record destruction at NOAA.

Media Coverage of CoA Institute’s Lawsuit Tipped-off the National Archives

The Daily Caller News Foundation reported on CoA Institute’s lawsuit shortly after it was filed.  Officials at the National Archives and Records Administration (“NARA”), which is tasked with policing federal records management across the government, took notice of the story and subsequently opened an inquiry on July 17, 2017 into CoA Institute’s allegations.  NARA gave NOAA “30 calendar days” to indicate how it planned to address the retention of “Google Chat and Skype messages,” and, if necessary, to report an “unauthorized disposition,” that is, the improper destruction of records.

As far as we know, eight months later, NOAA still has not responded to NARA.  We only learned about the NARA inquiry due to the agency’s recent decision to proactively disclose information on all pending investigations into the unauthorized disposition of federal records.  We have filed FOIA requests with NOAA and NARA in order to discover the status of the inquiry, and we will provide further updates as more details become available.

The fact that CoA Institute had to file a FOIA request to obtain NOAA’s response to the NARA inquiry, as well as related communications, shows that NARA’s proactive disclosure regime on this topic could be improved.  NARA should add another category of materials to its webpage that includes all correspondence received from an agency under investigation for the improper treatment of records.

NOAA’s Questionably Legal Google Chat Policy Flouts NARA Guidance

It goes without saying that an agency-wide policy to treat all chat messages as categorically “off the record” is problematic.  Even if an agency expects its employees to keep business-related communications, which could qualify for retention under the Federal Records Act (“FRA”), off a chat-based platform, it is reasonable to assume that some messages worthy of preservation will be sent or received over instant messaging.  NARA Bulletin 2015-02 makes that point clear.  And even if some instant messages were not worthy of long-term historical preservation, they would still qualify as transitory records subject to NARA-approved disposition schedules.

A categorical policy such as the one that NOAA has adopted creates a moral hazard.  Officials who want to thwart transparency can communicate with chat or instant messaging and, at least in this case, there is no way for the agency, NARA, or the public to catch them in the act.  NOAA officials have been observed using Google Chat to communicate during a contentious meeting of the New England Fishery Management Council.  If an agency like NOAA refuses to police how its employees are using the chat function on their Google-based email accounts, it should disable the function all together.

Regardless of whether electronic messages created through Google Chat or Google Hangouts are subject to the FRA, they may still be subject to the FOIA, which defines an “agency record” in broader terms than the FRA’s definition of a “federal record.”  By failing to implement any sort of mechanism for preserving chat messages—even for the briefest period—NOAA is depriving the American public of access to records that could be particularly important in showing how the agency operates and regulates.

The worst part of this saga is that NOAA knew it was treading a thin line in deciding to treat Google Chat messages as “off the record.”  According on documents obtained through the FOIA, NOAA’s lawyers and records management specialists were aware that electronic messages would need to be saved for public disclosure if Google Chat were “on the record.”  Notes from an October 20, 2011 meeting reflect this:

NOAA also recognized that chat messages could, in theory, be subject to the FRA.  Yet NOAA Records Officer Patricia Erdenberger reasoned that, by treating Google Chat as “off the record,” the agency’s FRA obligations could be bypassed.  Making a questionable analogy to phone calls, Erdenberger suggested that chat messages be “considered transient electrons.”

Agencies must do a better job at keeping pace with evolving forms of technology.  As one of my colleagues has argued, the use of non-email methods of electronic communication—including text and instant messaging, as well as encrypted phone applications like Signal—has serious implications for federal records management.  The Department of Commerce, NOAA’s parent agency, has not updated it policy for handling electronic records since May of 1987.  NARA, for its part, has been critical of the Department’s failure to revise this guidance, which is “heavily oriented towards the management of digital records on storage media such as diskettes and magnetic tape.”  Still, thirty years is a long time for such inaction, even for the federal government.  The transparency community must therefore intensify its efforts to hold the government accountable until more effective ways of handling electronic records are introduced.

Ryan Mulvey is Counsel at Cause of Action Institute

Media, Blog Learn More