U.S. ENVIRONMENTAL PROTECTION AGENCY
OFFICE OF INSPECTOR GENERAL
Information Technology
Congressionally Requested Audit:
EPA Needs to Improve Processes
for Preserving Text Messages as
Federal Records
Report No. 17-P-0062 December 21, 2016
251 - 500
Texts
501 -1000
Texts
3% Over 1000
1 -1
No Texts
38%
45%
EPA Mobile Device Users' Text Messages Sent or
Received 1st Quarter Fiscal Year 2015
-------
This is one of the U.S. Environmental Protection Agency Office of Inspector General's
products associated with records management. For details on our other reports on
records management, go to:
• Congressionally Requested Inquiry Into the EPA's Use of Private and Alias Email
Accounts (Report No. 13-P-0433, issued September 26, 2013)
• Review of EPA's Process to Release Information Under the Freedom of
Information Act (Report No. 14-P-0262, issued May 16, 2014)
Report Contributors:
Rudolph M. Brevard
Vincent Campbell
Eric K. Jackson Jr.
Nii-Lantei Lamptey
Christina Nelson
Teresa Richardson
Scott Sammons
Abbreviations
EPA U.S. Environmental Protection Agency
FOIA Freedom of Information Act
MDM Mobile Device Management
NARA National Archives and Records Administration
OCIR Office of Congressional and Intergovernmental Relations
OEI Office of Environmental Information
OIG Office of Inspector General
WCF Working Capital Fund
Cover image: Volume of text messages for EPA employees using government-issued mobile
devices purchased through the EPA's Working Capital Fund. (EPA OIG image)
Are you aware of fraud, waste or abuse in an
EPA program?
EPA Inspector General Hotline
1200 Pennsylvania Avenue, NW (2431T)
Washington, DC 20460
(888) 546-8740
(202) 566-2599 (fax)
OIG Hotline@epa.gov
Learn more about our OIG Hotline.
EPA Office of Inspector General
1200 Pennsylvania Avenue, NW (2410T)
Washington, DC 20460
(202) 566-2391
www.epa.gov/oiq
Subscribe to our Email Updates
Follow us on Twitter @EPAoig
Send us your Project Suggestions
-------
tftD STAf.
U.S. Environmental Protection Agency 17-P-0062
^ T> r^ffiAA rvf I r»r» r\/\r»4,rv^
December 21, 2016
• u.o. i_i i vii kji ii i id iiai riuicuu
^ Office of Inspector General
® J
At a Glance
CD
^ PR0^0
-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
THE INSPECTOR GENERAL
December 21, 2016
MEMORANDUM
SUBJECT: Congressionally Requested Audit: EPA Needs to Improve Processes for
Preserving Text Messages as Federal Records
Report No. 17-P-0062
FROM: Arthur A. Elkins Jr.
TO: Stan Meiburg, Acting Deputy Administrator
Office of the Administrator
Ann Dunkin, Chief Information Officer
Office of Environmental Information
This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the
U.S. Environmental Protection Agency (EPA). The project number for this audit was OA-FY15-0063.
This report contains findings that describe the problems the OIG has identified and corrective actions the
OIG recommends. This report represents the opinion of the OIG and does not necessarily represent the
final EPA position. Final determinations on matters in this report will be made by EPA managers in
accordance with established audit resolution procedures.
The EPA's Office of the Administrator and Office of Environmental Information are responsible for
addressing the issues discussed in the report.
Action Required
In accordance with EPA Manual 2750, the agency either agreed with our recommendations or agreed to
take sufficient corrective actions, and all recommendations are considered resolved pending completion
of corrective actions. The OIG may make periodic inquiries on progress in implementing corrective
actions for all the recommendations. Please update the EPA's Management Audit Tracking System as
you complete planned corrective actions. Your response will be posted on the OIG's public website,
along with our memorandum commenting on your response. Your response should be provided as an
Adobe PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation
Act of 1973, as amended. The final response should not contain data that you do not want to be released
to the public; if your response contains such data, you should identify the data for redaction or removal
along with corresponding justification.
^£DSX
* A \
1®|
VPR0^°
We will post this report to our website at www.epa.gov/oig
-------
Congressionally Requested Audit:
EPA Needs to Improve Processes for
Preserving Text Messages as Federal Records
17-P-0062
Table of C
Chapters
1 Introduction 1
Purpose 1
Background 1
Responsible Offices 3
Scope and Methodology 3
Prior Audit Work 4
2 Findings on Issues Raised by Congressional Committee
Regarding Preserving Text Message Records 6
Findings Based on Congressional Inquiry 6
Conclusion 13
Recommendations 14
Agency Response and OIG Evaluation 14
3 Additional Areas for Improvement Noted in EPA's
Mobile Device Management to Better Preserve Text Message Records 16
Strategy Needed to Manage Configuration Settings of All
Government-Issued Mobile Devices 16
Mobile Device Management Solution Does Not Manage
Text Messages 17
Conclusion 18
Recommendations 19
Agency Response and OIG Evaluation 19
Status of Recommendations and Potential Monetary Benefits 21
Appendices
A Distribution of EPA Text Messages by EPA Offices and Senior Officials .... 22
B Details on Scope and Methodology 24
C Region 2 Response to Draft Report 26
D EPA Headquarters Consolidated Response to Draft Report 30
E Distribution 37
-------
Chapter 1
Introduction
Purpose
The U.S. Environmental Protection Agency (EPA) Office of Inspector General
(OIG) conducted this audit to address a congressional inquiry into the EPA's
compliance with its records management practices for preserving text messages as
federal records. The inquiry asked several questions related to EPA records
management policy and practices. The OIG developed audit objectives based on
the congressional questions. Specifically, we sought to determine whether the EPA:
• Implemented policies and procedures to determine which text messages to
preserve and steps to ensure employees are knowledgeable of this guidance.
• Implemented processes to respond to congressional and Freedom of
Information Act (FOIA) requests involving agency employees' text messages.
• Used text messages (on government-issued or personal devices) for
official business.
• Deleted, destroyed, lost or misplaced text messages needed for records
management; and, if applicable, the rationale for destroying text
communication records.
• Took disciplinary actions against employees for deleting, destroying,
losing or misplacing text communication records.
• Notified the National Archives and Records Administration (NARA)
about the potential loss of any federal text records, and how often the
losses occurred.
Background
Text messaging appears to be a common method of
communicating for employees across the agency. For the
12-month period from July 1, 2014, to June 30, 2015, the
EPA's quarterly mobile device utilization reports showed
that over 3.1 million text messages were sent or received
by EPA employees who have government-issued mobile
devices procured under the agency's Working Capital
Fund (WCF). Additionally, the EPA's program and
regional offices have reported 247 mobile devices
procured outside of the WCF that have text messaging
capabilities, and the volume of text messages sent or
The EPA's Quarterly
Mobile Device
Utilization Reports
document the volume
of text messages sent
or received by EPA
WCF mobile devices.
These reports do not
distinguish or contain
details on the
sources or
destinations of the
text messages.
17-P-0062
1
-------
received for these devices is not reflected in the 3.1 million text messages because
WCF personnel do not have access to the detailed usage information for these
devices and could not provide data for the non-WCF mobile devices. See
Appendix A for the distribution of text messages sent and received by EPA office,
and the distribution of text messages sent and received by EPA senior officials.
NARA Bulletin 2015-02, Guidance on Managing Electronic Messages, dated
July 2015, states that the Federal Records Act was amended in November 2014,
and added a new definition for electronic messages. The term electronic messages
means electronic mail and other messaging systems that are used for purposes of
communicating between individuals. The bulletin provides the following list of
types of electronic messaging with examples.
Table 1: Types and examples of text messaging
Types of electronic messaging
Examples
Chat/instant messaging.
Google Chat, Skype for Business,
IBM Sametime, Novell Groupwise
Messenger, Facebook Messaging.
Text messaging, also known as Multimedia
Messaging Service and Short Message Service.
iMessage, Short Message Service and
Multimedia Messaging Service on
devices, such as Blackberry, Windows,
Apple or Android devices.
Voicemail messaging—systems that can have
voicemail sent to email as an attachment. In
addition, messages that can be sent or received
from land-line or mobile phones.
Google Voice, voice-to-text conversion.
Other messaging platforms orapps, such as
social media or mobile device applications. These
include text, media and voice messages.
Twitter Direct Message, Slack, Snapchat,
WhatsApp, Pigeon, Yammer, Jive, or
other internal collaboration networks.
Source: NARA Bulletin 2015-02, Guidance on Managing Electronic Messages.
The bulletin further states that "electronic messages created or received in the
course of agency business are Federal records." The guidance states:
At this time, current business practices make it more likely other
types of electronic messages, such as chat or text messages,
contain transitory information or information of value for a much
shorter period of time. Regardless, agencies must capture and
manage these records in compliance with Federal records
management laws, regulations and policies.
In February 2015, the EPA updated its records management policy, which details
the agency's requirements for handling electronic messages—such as text
messages—as electronic records. The policy states that EPA staff that generate
and receive records are legally required to maintain them, and the policy further
requires electronic records—such as substantive or non-transitory text
messages—to be transferred to an electronic records management system. The
policy states, "Some records are transitory in nature, which means they are of
17-P-0062
2
-------
short-term (180 days or less) interest, including in electronic form, and have
minimal or no documentary or evidential value." However, non-transitory
(substantive) records contain informational value and should be stored in an
approved records management system.
FOIA requires agencies to make available copies of records, regardless of form and
content, when a FOIA request is submitted. Additionally, Congress may send a
request for information that may be contained in the form of an electronic message
(text message) that also must be provided when requested. As such, the 3.1 million
text messages sent and received on EPA mobile devices must be reviewed to
identify the relevant text communications subject to federal record-keeping
requirements, and FOIA and congressional requests.
In evaluating the 3.1 million text messages
sent and received, we interviewed the
Administrator and several senior officials on
their text message usage. We learned from the
Administrator and senior officials, and by
inspecting some of their text messages, that
the contents were:
• Work related.
• Personal text messages.
• Messages originating from electronic
messaging systems.
• One-time passwords used to connect
remotely to the EPA's network.
Responsible Offices
The Office of Environmental Information (OEI)—which includes the Chief
Information Officer—manages the EPA's National Records Management
Program, which provides leadership and direction in managing the records that
support the EPA's mission. Within the Office of the Administrator, the Office of
Congressional and Intergovernmental Relations (OCIR) serves as the EPA's
principal point of contact with Congress, states and local governments. OCIR
coordinates the EPA's formal positions and technical assistance to Congress, and
manages the agency's congressional correspondence process.
Scope and Methodology
We performed this audit from January 2015 through July 2016, in accordance
with generally accepted government auditing standards. Those standards require
that we plan and perform the audit to obtain sufficient and appropriate evidence to
provide a reasonable basis for our findings and conclusions based on the audit
From our interviews:
• Work-related texts were
described as government
business, lunch arrangements,
and notices of employees'
work status.
• Personal texts were described
as family communications.
• Texts from electronic
messaging systems were
described as social media
notifications (public tweets
from Twitter) and alerts related
to weather, traffic, school, or
Office of Personnel
Management's notification on
federal government
operational status.
17-P-0062
3
-------
objectives. We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objectives.
We interviewed the EPA Administrator; Acting Deputy Administrator; Assistant,
Associate and Regional Administrators; EPA General Counsel; Agency Records
Officer; Agency FOIA Officer; and other EPA employees who were engaged in
using EPA-provided (government-issued) mobile devices for text messaging or
were responsible for managing the EPA's FOIA and records-keeping programs.
Overall, we conducted 70 interviews within the following offices:
• Office of the Administrator
• Office of Administration and Resources Management
• Office of Air and Radiation
• Office of Chemical Safety and Pollution Prevention
• Office of Enforcement and Compliance Assurance
• Office of Environmental Information
• Office of General Counsel
• Office of Land and Emergency Management
• Office of Research and Development
• Office of Water
• Region 1 (Boston)
• Region 2 (New York)
• Region 6 (Dallas)
Appendix B provides further details on our scope and methodology.
EPA's Region 2 Regional Administrator provided additional details regarding the
use of her government-issued mobile device. The Region 2 Regional
Administrator also had concerns that the report presented a misleading picture of
the use of text messaging within the EPA. We added additional information
within the background section to address the Regional Administrator's concerns.
Our analysis determined that EPA employees sent or received 3.1 million
electronic messages in the form of text messages on government-issued mobile
devices. In the context of our audit objectives, these text communications, in
addition to text messages from the 247 mobile devices procured outside the WCF,
represent the universe of items that must be reviewed to determine whether they
are subject to federal recordkeeping requirements, as well as FOIA and
congressional requests. The EPA Region 2 Regional Administrator's response is
in Appendix C.
Prior Audit Work
In fiscal year 2013, the OIG published a report from a previous congressionally
requested inquiry into the EPA's records management practices, Congressionally
Requested Inquiry Into the EPA's Use of Private and Alias Email Accounts, Report
No. 13-P-0433. dated September 26, 2013. We made five recommendations for the
17-P-0062
4
-------
EPA to improve its records management program, and the EPA had completed all
the corrective actions.
The OIG also published a briefing report, Review of EPA's Process to Release
Information Under the Freedom of Information Act, Report No. 14-P-0262. dated
May 16, 2014. We recommended that the EPA issue final FOIA procedures by
September 30, 2014, and that senior information officials at each region and
program office certify that local FOIA procedures are consistent with the agency's
final procedures. The EPA completed all the corrective actions.
17-P-0062
5
-------
Chapter 2
Findings on Issues Raised by
Congressional Committee Regarding
Preserving Text Message Records
During our audit work to provide responses to a congressional inquiry, we did not
find instances where the EPA intentionally circumvented the Federal Records Act
when handling text messages. This inquiry also requested the OIG to provide
information regarding:
• Employees' knowledge of text message preservation requirements.
• Processes for responding to congressional and FOIA requests.
• Employees' use of text messages for official business.
• Disciplinary actions taken related to missing text message records.
• Correspondences to NARA on potential loss of federal records.
We did find some areas where improvements are needed, related to responding to
congressional requests for records, conducting searches on FOIA requests, and
preserving text message records. Below are the results of our audit in response to
the congressional committee's inquiry for all these areas, regardless of whether
the need for process improvements was identified.
Findings Based on Congressional Inquiry
Based on our review of the issues raised by a congressional inquiry, we identified
related business practices that could potentially cause the EPA to not comply with
federal record-keeping requirements. The issues identified with these related
practices could prevent the EPA from identifying and preserving all text message
records that may be federal records or responsive to congressional inquiries. As
such, the EPA should strengthen controls by:
• Documenting formal procedures for responding to congressional requests.
• Providing instructions to employees on what to search (in particular,
government-issued mobile devices) when a FOIA request is submitted to
the EPA
• Preserving text communication records before mobile devices are
replaced, or when devices are no longer needed for official duty or before
they are automatically deleted by the mobile device
Details regarding each of the issues raised by the congressional inquiry follow.
17-P-0062
6
-------
Whether the EPA implemented policies and procedures to determine
which text messages to preserve and steps to ensure employees are
knowledgeable of this guidance.
The EPA has implemented records management policies and procedures that
direct employees on which text messages to preserve, and has taken steps to
ensure employees are knowledgeable of the issued guidance.
In February 2015, the EPA updated its records management policy, which details
the agency's requirements for handling electronic messages—such as text
messages—as electronic records. The policy states that EPA staff that generate
and receive records are legally required to maintain those records, and further
requires electronic records—such as text messages—to be transferred to an
electronic records management system. The policy also states:
Some records are transitory in nature, which means they are of
short-term (180 days or less) interest, including in electronic form,
and have minimal or no documentary or evidential value.
However, non-transitory (substantive) records contain informational value and
should be stored in an approved records management system. The policy further
states:
Similarly, users of text messaging, instant messaging or other
transient messaging technologies on EPA information systems are
responsible for ensuring that messages that result in the creation of
a substantive (or non-transitory) federal record are saved for
Federal Records Act purposes and placed in a recordkeeping
system.
In March 2015, the EPA issued instructions on forwarding text messages from
government-issued mobile devices to the EPA's email system. The EPA also
distributed quarterly records management broadcasts via email to reiterate
employees' responsibilities for preserving federal records, including text
messages. Based on the employees interviewed regarding their awareness of the
agency's text message preservation guidance, we found that most employees were
knowledgeable of the new guidance for preserving text messages.
In October 2015, the EPA deployed its annual records management training to
further inform employees of their records management responsibilities, which
included managing text message records. We evaluated the training, and found
that it reinforced the February 2015 records management policy—specifically, the
preservation of text messages from mobile devices.
There are no findings or recommendations for this area.
17-P-0062
7
-------
Whether the EPA implemented processes to respond to congressional
and FOIA requests involving agency employees' text messages.
Responding to Congressional Requests
OCIR has implemented an overall process for responding to congressional requests
for records. However, OCIR has not documented procedures for responding to
congressional requests to include agency employees' text message records.
We requested that OCIR provide us the documented procedures for the EPA's
process for responding to congressional requests. OCIR provided a template for
responding to members of Congress. The template only describes the format of
the correspondence letter for responding to the request. An OCIR official stated
that they have a process for handling congressional requests, but the process is
undocumented. The OCIR official also stated that all employees responding to
congressional requests are trained and familiar with responding to congressional
requests.
The task for responding to congressional requests involves several critical steps
and levels of review. Figure 1 illustrates these undocumented steps.
Figure 1: OCIR undocumented congressional response process
¦Submits request to EPA
EPA's
Congressional
Correspondence
Unit
¦ Reviews elements of request
¦Forwards request to appropriate EPA program/regional
office via Correspondence Management System
Program/Regional
Office
¦Reviews and prepares response to request
¦ Submits response to OCIR within 2 weeks of receipt
¦ May request extension to submit response, if necessary
•Associate Administrator reviews and approves
response
• Principal Deputy Associate Administrator reviews
and approves response
Congressional
Requester
¦ Receives EPA's response
-
Source: Information compiled by OIG.
17-P-0062
8
-------
OCIR stated that it is currently piloting an initiative that will make the
congressional response process more efficient and effective. Once the pilot of the
new process is completed, OCIR plans to roll it out agencywide and have a formal
written process that will reflect the new way of processing congressional
correspondence. The EPA completed the roll-out in the fall of 2016, and plans to
issue final procedures by end of fiscal year 2017. However, until the agency
documents its procedures for responding to congressional requests for federal
records, including text records, the EPA lacks a standard for handling
congressional responses across the agency's program and regional offices.
A recommendation for this area is included at the end of this chapter.
Responding to FOIA Requests
The EPA's national FOIA program, managed at headquarters, has an overall
process and a detailed procedure for responding to FOIA requests. However, the
procedure does not include steps for FOIA personnel to follow regarding
searching mobile devices for responsive text message records. As a result, FOIA
personnel outside of headquarters indicated that unless the FOIA request
specifically requires the agency to search for text messages, this media is neither
searched nor included in the response. According to the agency FOIA officer,
when text messages are required to be searched, the agency relies on the
employees to capture and preserve text messages as records. The FOIA officer
also indicated that the process—as specified in agency guidance—is supposed to
be used by employees to preserve the records within the EPA's record-keeping
system, where they could be subsequently searched in response to FOIA requests.
Our audit work disclosed that government-issued mobile devices of senior
officials are searched for text messages that need to be preserved as records at
different intervals. For example, some senior EPA officials have their staff search
their mobile devices from periodically (at least monthly) to every 20 days.
Based on the above, the possibility exists that the EPA could receive a FOIA
request before an employee forwards and preserves their potential text message
records within the agency's record-keeping system and, thus, the impacted
government-issued mobile device would not have been searched. As such,
improving instructions to employees about FOIA and their record responsibilities
could strengthen the agency's record-keeping internal controls for searching all
potential sources of records in the event an employee has not already captured the
applicable records in the agency's record-keeping system.
A recommendation for this area is included at the end of this chapter.
17-P-0062
9
-------
Whether the EPA used text messages (on government-issued or
personal devices) for official business.
EPA employees use their government-issued mobile
devices to send and receive text messages for official
business. Our review of a sample of text messages
currently residing on government-issued mobile devices
for the EPA Administrator and senior officials found that
most of the messages were work-related but transitory in
nature.
From July 1, 2014, through June 30, 2015, EPA employees sent and received over
3.1 million text messages using government-issued mobile devices procured
under the WCF. Figure 2 illustrates the volume of these text messages during this
12-month period by quarter.
Figure 2: Agency total volume of text messages by quarter
"Transitory" means
records of short-
term interest that
have minimum or
no documentary or
evidential value.
¦ 4th Quarter
Fiscal Year 2014
¦ 1st Quarter
Fiscal Year 2015
¦ 2nd Quarter
Fiscal Year 2015
¦ 3rd Quarter
Fiscal Year 2015
1
371,734
>
708,550„_. rtn
~ 659,549
7
k
Source: Information compiled by OIG from EPA Quarterly Mobile Device Utilization Reports.
We interviewed 16 senior officials and 22 staff employees about their text usage.
The EPA Administrator and senior officials indicated that most of their text
messages were:
• One-time passwords to connect remotely to the EPA's network.
• Messages to staff or other EPA officials regarding office meetings.
• Traffic alerts and public tweets.
Additionally, one senior official and some staff indicated they have used their
government-issued mobile device for personal reasons, along with sending
personal text messages to communicate with family. The EPA Administrator and
17-P-0062
10
-------
senior officials stated that they do not conduct official business on their personal
mobile devices. Other staff employees interviewed provided the same responses.
Based on the EPA's records management policy, records are typically created while
conducting official business. However, the EPA notes that "not all information
created or received constitutes a record." As such, it is possible for an EPA
employee to use text messaging for official business, without any of those text
messages being considered records that require preserving. As noted in Figure 3,
11 officials used text messaging for official business; however, less than half (five
of 11) sent or received text messages that were considered a record by the senior
official. Likewise, as noted in Figure 4, only 18 percent of the interviewees (four of
22) sent or received text messages that were considered a record by the employee.
There are no findings or recommendations for this area.
Figure 3: Senior officials' interview responses related to text usage
Senior Officials
18
5
No
11
No
11
Yes
5
Yes
Used Text Messaging for Sent/Received Texts
Official Business Considered a Record
Source: Information compiled by OIG.
Figure 4: Staff interview responses related to text usage
Staff
25
18
No
22
Yes
4
Used Text Messaging for Sent/Received Texts
Official Business Considered a Record
Source: Information compiled by OIG.
17-P-0062
11
-------
Whether the EPA deleted, destroyed, lost or misplaced text messages
needed for records management; and, if applicable, the rationale for
destroying text communication records.
The EPA Administrator, senior officials and other employees interviewed
indicated they did not delete, destroy, lose or misplace text messages needed for
records management. However, our field work noted instances where potential
text message records could have been deleted or lost as a result of employee
actions. For example:
• During the replacement of the government-issued mobile device for one
Regional Administrator, the possibility existed that text message records
were not captured within the agency's record-keeping system. The
information technology director stated the Regional Administrator signed
a form indicating the replaced government-issued mobile device was
searched for potential records. The information technology director also
stated that they did not search the replaced device for records. The region
representatives indicated they were unsure, during the period in question,
whether they had a process to regularly search the Regional
Administrator's government-issued mobile device for potential text
message records. It was about 8 months after the Regional Administrator
received his new government-issued mobile device that the region
implemented such a process. We were not able to determine whether
actual text message records were lost because the Regional
Administrator's previous mobile device was not available for inspection.
• A senior official with a high level of text message usage may have lost
text messages that could have been considered federal records. We
requested text message samples from this senior official's mobile device
for January 2015 and March 2015. The senior official responded that they
did not have any text messages on the device for that time period. The
senior official's mobile device was set to automatically delete text
messages every 30 days. Therefore, some of those deleted text messages
could be substantive in nature, and need to be preserved in the agency's
record-keeping system.
• When we requested a sample of current text messages from a headquarters
senior official, the official indicated there were no text messages on the
government-issued mobile phone even though the EPA's quarterly mobile
device usage report documented frequent text message usage by this
official for the period in question. Since the official indicated that there
were no text messages on his mobile device, we did not inspect the senior
official's mobile device and, therefore, we were not able to determine
whether actual text message records were lost.
A recommendation for this area is included at the end of this chapter.
17-P-0062
12
-------
Whether the EPA took disciplinary actions against employees for
deleting, destroying, losing or misplacing text communication records.
We did not identify instances where the EPA should consider taking disciplinary
actions against employees for deleting, destroying, losing or misplacing text
communication records. During our interviews, the EPA Administrator and other
senior officials indicated that for those employees reporting directly to them, they
were not aware of any employees deleting, destroying, losing or misplacing text
messages records, and thus they did not have the necessity to take disciplinary
actions against any employees. Interviews with regional counsel from Regions 1,
2 and 6, as well as staff from the EPA's Office of Human Resources, indicated
they had no knowledge of an employee being disciplined within the last 3 years
for unlawfully deleting, destroying, losing or misplacing text communication
records.
There are no recommendations for this area.
Whether the EPA notified NARA about the potential loss of any federal
text records, and how often the losses occurred.
We found that the EPA notified NARA regarding potentially or actually lost,
damaged or destroyed records nine times between 2006 and 2014. According to the
agency, only one of these notifications was related to the possibility of destruction
of text messages. The agency's letter to NARA, dated October 9, 2014, states that
the text messages requested under FOIA by an outside group were not produced or
preserved. The letter further states that:
... EPA determined that it is not aware of federal records that were
unlawfully destroyed. For the reasons discussed below, EPA has
no reason to believe that text messages existed that qualified as
federal records and were unlawfully destroyed. EPA cannot,
however, determine with absolute, unequivocal certainty the
content of every single text message that may at one point have
existed.
There are no findings or recommendations for this area.
Conclusion
While the EPA has a records management program, the agency can strengthen its
internal controls to ensure employees fully comply with documented records
management policies and procedures. We noted a lack of documented procedures
for retrieving text messages in response to congressional requests, FOIA
procedures not including instructions to search government-issued mobile devices
17-P-0062
13
-------
for unpreserved text message records, employees not preserving potential text
message records when replacing their government-issued mobile devices, and
employees not being able to produce text messages on government-issued mobile
devices. These deficiencies create gaps in the agency's ability to capture all
potential text message records needed to support agency decisions that impact
human health and the environment.
Recommendations
We recommend that the Deputy Administrator:
1. Require the Office of Congressional and Intergovernmental Relations to
document formal procedures for responding to congressional requests for
records, including text records.
We recommend that the Chief Information Officer, Office of Environmental
Information:
2. Remind agency employees that, as appropriate, all text messages that are
potentially responsive to a Freedom of Information Act or a congressional
request must be available for inclusion in searches conducted by the agency
to prepare responses to these requests.
3. Determine whether potential text message records were lost during the
replacement of the noted mobile device during the instance where the senior
official could not provide the requested text messages (Page 12, Bullet 1),
or during the instance when the senior official's mobile device
automatically deleted messages after 30 days (Page 12, Bullet 2), and notify
the National Archives and Records Administration if warranted.
Agency Response and OIG Evaluation
The EPA generally agreed with our findings and partially agreed with our
recomm endati ons.
For Recommendation 1, OCIR indicated it would document the procedures for
responding to a congressional request for records by summer 2017. We revised
the recommendation and consider this recommendation resolved with corrective
actions pending.
For Recommendation 2, OEI initially indicated that by December 31, 2016, it
would complete a proposed alternate corrective action to notify agency Senior
Information Officials to direct them to ensure that all text messages responsive to a
FOIA or congressional request are available. This alternative corrective action did
not address our concerns. The office should adopt a more structured method to
notify its government-issued mobile device users and the individuals responsible
17-P-0062
14
-------
for handling FOIA and congressional requests about the text message requirement.
The proposed alternative corrective action would make notifications within the
agency dependent upon others normally not involved in processing FOIA or
congressional requests. This information should be made widely available for
employees' immediate reference, similar to other records management information
available on the agency's National Records Management website. Upon further
discussions, OEI indicated that by March 31, 2017, it would add language to the
fiscal year 2017 mandatory records management training to address our concerns
and reinforce the importance of searching government-issued devices for
unpreserved text message records. We accept the proposed recommendation and
consider this recommendation resolved with corrective actions pending.
OEI partially agreed with Recommendation 3 and stated the respective EPA office
has the initial responsibility for determining whether a record was lost. The office
proposed an alternative corrective action that calls for the agency to determine
whether a record was lost by December 31, 2016. We did not agree with this
proposed corrective action because the action did not satisfy the intent of our
recommendation. The proposed alternative corrective action is vague and unclear
as to whether the National Records program would have oversight to ensure all
potential lost records are reported to NARA as required. According to the EPA, the
Agency Records Officer is within OEI and this individual "is responsible for
providing leadership and direction for the Agency's records management program."
Upon further discussions, OEI indicated:
• Regarding the potential loss of text records when a senior official's
government-issued mobile device was replaced, the EPA concluded that
no text records were lost and that the EPA will provide results of its
investigation to the Agency Records Officer by December 31, 2016.
• Regarding the senior official's government-issued mobile service
configured to delete text messages at 30 days, the EPA will investigate this
matter to determine whether any text records were lost, and provide the
results to the Agency Records Officer by December 31, 2016. Also, by
January 31, 2017, the Agency Records Officer will consult with the Office
of General Counsel to determine whether a notification to NARA is
required to document the potential loss of text records.
The corrective actions for Recommendation 3 meet the intent of our
recommendation, and we consider this recommendation resolved with corrective
actions pending.
17-P-0062
15
-------
Chapter 3
Additional Areas for Improvement Noted
in EPA's Mobile Device Management to
Better Preserve Text Message Records
In addition to the issues discussed in Chapter 2, we noted further ways in which
the EPA's mobile device management processes can be improved to better
capture and preserve text message records residing on government-issued mobile
devices. Office of Management and Budget Circular A-123, Management's
Responsibility for Internal Controls, dated December 21, 2004, indicates that
management is responsible for establishing and maintaining internal controls and,
due to the rapid changes in information technology, these controls must be
adjusted to remain effective. The EPA's ability to capture and preserve text
messages on government-issued mobile devices is hindered by the lack of:
• A strategy to manage text records on all government-issued mobile devices.
• A mobile device management (MDM) solution to manage text messages.
As a result, of the over 3.1 million text messages used on government-issued
mobile devices (procured under the WCF) from July 1, 2014, to June 30, 2015,
the EPA cannot be assured that those text messages that qualified as federal
records were appropriately captured and preserved, or made available in response
to external party inquiries.
Strategy Needed to Manage Configuration Settings of All
Government-Issued Mobile Devices
EPA employees have access to government-issued mobile devices that allows them
to change the configuration of each device's text message retention settings. NARA
Bulletin 2015-02, Guidance on Managing Electronic Messages, encourages federal
agencies to remove reliance on individual users to increase the ability to capture and
produce records. However, we noted the following:
WCF Mobile Devices: Our observation of 15 government-issued mobile devices
procured through the WCF disclosed that the EPA does not have a permanent
configuration setting that prevents employees from changing how long text
messages are retained on the device. The employee has the ability to choose a
text message retention period of 30 days, 1 year or forever. As a result, the
mobile device would auto-delete text messages based on the specified time
period (30 days or 1 year) if the configuration setting is not set to retain text
messages forever. While most government-issued mobile devices were
configured to retain text messages "forever," our analysis disclosed that at least
one Assistant Administrator with high text message usage had a government-
17-P-0062
16
-------
issued mobile phone that was configured to delete text messages after 30 days.
Because this senior official's mobile device was not configured to prevent the
deletion of text messages, text messages potentially substantive in nature could
have been deleted before being preserved in the agency's record-keeping system.
Non-WCF Mobile Devices: Ten EPA offices reported having mobile devices
with text messaging capabilities procured outside of the EPA's WCF. Unlike
mobile devices procured under the WCF, these devices are not compatible
with, and are not managed by, the EPA's MDM solution that manages
configuration settings on mobile devices. The lack of a configuration control
setting to preserve or capture text records on these devices exposes the EPA to
the potential loss and destruction of federal records. The EPA's OEI has no
oversight of these government-issued mobile devices' settings to ensure they
comply with EPA standards. As such, having oversight to ensure the devices
comply with current and planned agency mobile device configuration settings
is important to ensure all required text messages are preserved and available to
meet the EPA's FOIA and congressional requests, as well as records
management responsibilities.
Subsequent to the release of our discussion document, EPA officials indicated
the contracts for non-WCF government-issued mobile devices had expired,
and these devices are now covered under a contract overseen by the WCF.
However, our review of the provided documentation disclosed that 47 percent
(202 of 429) of the non-WCF government-issued mobile devices with text
message capabilities are not covered under the WCF contract or the
management of the MDM solution. In addition, OEI is uncertain as to whether
all non-WCF mobile devices have been replaced with new devices that can be
managed by the agency's enterprise MDM solution. As such, the EPA is in a
position where it cannot effectively manage all government-issued mobile
devices' configuration settings to facilitate the preservation of required text
messages to meet its records management responsibilities.
Mobile Device Management Solution Does Not Manage Text Messages
The EPA implemented an enterprise MDM in fiscal year 2015 to manage and
configure the inventory of mobile devices procured under the agency's WCF.
EPA personnel indicated that the agency will use its MDM to manage:
• A variety of mobile devices with multiple operating systems across
multiple service providers.
• Password security.
• Applications on mobile devices.
During earlier conversations with the agency, OEI representatives indicated the
MDM does not have the capability to prevent the deletion of text messages, and the
EPA did not have current plans to add text message management capabilities to
17-P-0062
17
-------
restrict employees from arbitrarily changing a device's text messaging retention
settings. We noted that the EPA's actions regarding the implementation of its
MDM solution appear to be consistent with practices outlined by the National
Institute of Standards and Technology Special Publication 800-124 Rev. 1,
Guidelines for Managing the Security of Mobile Devices in the Enterprise.
The EPA's MDM solution manages the security aspect of mobile devices.
However, the EPA has not found a solution to manage the agency's records
management responsibilities created by using text messaging. To meet the records
management challenges associated with using electronic messaging (text
messaging), NARA Bulletin 2015-02 recommends, among other things, that an
agency:
• Configure electronic messaging systems to allow for automated capture of
electronic messages and metadata; removing reliance on individual users
will increase ability to capture and produce messages.
• Use third-party services to capture messages, such as a service that
captures all email, chat and text messages created through agency-
operated electronic messaging systems.
The volume of EPA text message communications versus the number of text
messages saved as federal records leaves questions about whether all potential
records were saved. The inability of senior officials to provide text messages
when requested, and the inability of the MDM solution to capture and preserve or
prevent the deletion of text messages, also raises doubt that all potential text
message records were saved. As such, these issues warrant the need for the EPA
to reassess the capabilities of its MDM solution and consider NARA's
recommendations for preserving text messages, to comply with records
management requirements.
Subsequent to the release of our discussion document, an EPA representative
indicated they were conducting research to identify an alternative solution to
capture text messages on mobile devices. We requested documentation from the
office regarding its research. The documentation provided indicates that the EPA
has identified possible solutions for managing text messaging on its government-
issued mobile devices. However, the EPA representative stated the agency is still
exploring its options.
Conclusion
The agency could improve transparency of environmental and human health
decisions by enhancing its record management controls that affect the
preservation and availability of records.
17-P-0062
18
-------
Recommendations
We recommend that the Chief Information Officer, Office of Environmental
Information:
4. Develop and implement a strategy instructing employees not to change the
text message retention settings.
5. Develop a plan to replace any phones not technically compatible with the
new mobile device management solution identified during market research
in response to Recommendation 6. Also, develop a process to approve
waivers for any office that identifies a significant business need to keep
the existing device and identifies an alternative solution for records
management for that existing device.
6. Formalize a plan with milestone dates to conduct market research to
determine whether an enterprise mobile device management solution can
manage text message communications to help the agency meet its record-
keeping responsibilities. Document a management decision if a new
solution is appropriate for implementation and, if needed, create a project
plan with milestone dates for implementing the new solution.
Agency Response and OIG Evaluation
OEI did not agree with Recommendation 4 and proposed an alternative corrective
action. OEI indicated it will modify the EPA's Mobile Device Employee Notice
by December 31, 2016, to state that employees shall not modify the text message
retention settings. The alternative corrective action would address our concerns,
and we modified the report accordingly. We consider this recommendation
resolved with corrective actions pending.
OEI indicated that corrective action has been completed for Recommendation 5.
However, the EPA did not provide all the requested documentation to
demonstrate that the actions taken fully addressed the recommendation. The EPA
had not provided documentation to support that the previous non-WCF mobile
devices were replaced with newer devices that can be managed by the enterprise
MDM solution. OEI requested that we remove the original recommendation of
replacing previous non-WCF mobile devices with newer devices to be managed
by the MDM, because the EPA has not identified a technical solution compatible
with EPA's MDM to capture text records on mobile devices. We modified the
recommendation to correspond with the planned corrective action and milestone
date for Recommendation 6. As such, we accept the corrective action and
consider this recommendation resolved with corrective actions pending.
OEI agreed with Recommendation 6. OEI indicated that it just completed market
research and did not find a tool capable of meeting its needs. OEI indicated it
17-P-0062
19
-------
would complete new market research no later than September 30, 2018. We
consider this recommendation resolved with corrective actions pending.
17-P-0062
20
-------
Status of Recommendations and
Potential Monetary Benefits
RECOMMENDATIONS
Rec.
No.
Page
No.
Subject
Status1
Action Official
Planned
Completion
Date
Potential
Monetary
Benefits
(in $000s)
1
14
Require the Office of Congressional and Intergovernmental
Relations to document formal procedures for responding to
congressional requests for records, including text records.
0
Deputy Administrator
9/30/17
2
14
Remind agency employees that, as appropriate, all text
messages that are potentially responsive to a Freedom of
Information Act or a congressional request must be available for
inclusion in searches conducted by the agency to prepare
responses to these requests.
0
Chief Information Officer,
Office of Environmental
Information
3/31/17
3
14
Determine whether potential text message records were lost
during the replacement of the noted mobile device during the
instance where the senior official could not provide the requested
text messages (Page 12, Bullet 1), or during the instance when
the senior official's mobile device automatically deleted
messages after 30 days (Page 12, Bullet 2), and notify the
National Archives and Records Administration if warranted.
0
Chief Information Officer,
Office of Environmental
Information
1/31/17
4
19
Develop and implement a strategy instructing employees not to
change the text message retention settings.
0
Chief Information Officer,
Office of Environmental
Information
12/31/16
5
19
Develop a plan to replace any phones not technically compatible
with the new mobile device management solution identified
during market research in response to Recommendation 6.
Also, develop a process to approve waivers for any office that
identifies a significant business need to keep the existing device
and identifies an alternative solution for records management for
that existing device.
0
Chief Information Officer,
Office of Environmental
Information
9/30/18
6
19
Formalize a plan with milestone dates to conduct market
research to determine whether an enterprise mobile device
management solution can manage text message
communications to help the agency meet its record-keeping
responsibilities. Document a management decision if a new
0
Chief Information Officer,
Office of Environmental
Information
9/30/18
solution is appropriate for the implementation and, if needed,
create a project plan with milestone dates for implementing the
new solution.
1 0 = Recommendation is open with agreed-to corrective actions pending.
C = Recommendation is closed with all agreed-to actions completed.
U = Recommendation is unresolved with resolution efforts in progress.
17-P-0062
21
-------
Appendix A
Distribution of EPA Text Messages by
EPA Offices and Senior Officials
For the 12-month period from July 1, 2014, to June 30, 2015, the EPA's quarterly mobile
device utilization reports show that over 3.1 million text messages were sent or received by
EPA employees who had government-issued mobile devices procured under the agency's
WCF. Figure A-l illustrates the volume of text messages sent or received from WCF mobile
devices by program/regional office.
Figure A-1: Volume of text messages sent or received by office from July 1, 2014,
through June 30, 2015
350,000
300,000
250,000
200,000
150,000
100,000
50,000
0
cr LU
o w
oooooooo
.2 .2 .2 .2 .2 .2 .2 .2 .2 .2
0)0)0)0)0)0)0)0)0)0)
(D(D(D(D(D(D(D
-------
Figure A-2 illustrates the volume of text messages sent or received from WCF devices of the
Administrator and other senior official from July 1, 2014, through June 30, 2015.
Figure A-2: EPA senior officials' text messages from July 1, 2014, through June 30,
2015
8,000
7,000
6,000
5,000
4,000
o>
o
o
co
CO
3,000
2,000
1,000
0
m
CD CO
CM
"3-
o
I
w
X
o
CM
a:
a:
CO O
CM CT>
00 CM CM CM U ¦£-
II
CO C\| CT> -*t
Is- CD -
CT>
- .2 ^
5? o) O
CO 2
LU
2 2—i
o) o) O
CD CD
01 01
O .2 .2
0
O)
CD
01
LU
o
CL
o
¦
-------
Appendix B
Details on Scope and Methodology
Text Message Usage of EPA's Senior Officials and EPA Staff Analysis
We obtained, reviewed and analyzed the EPA's Quarterly Mobile Device Utilization Reports
that summarize the agency's mobile device usage for devices purchased and managed under the
WCF from October 1, 2014, to June 30, 2015. We did not use the actual mobile device billing
invoices. We created a spreadsheet that analyzes the EPA mobile device billing reports to
determine the users with the most or high text message usage, and found that 3.1 million text
messages were sent or received on these WCF mobile devices. From these analyses, we selected
and interviewed senior officials and staff from headquarters in Washington, D.C., and Regional
Administrators and select regional staff from Regions 1, 2 and 6, based on text message usage.
During the interviews, we determined to what extent the senior officials and staff use text
messages on their government-issued mobile devices for official business, and their knowledge
of preserving text messages as federal records.
We also interviewed these individuals regarding their text usage (e.g., personal, work-related,
alerts) and reviewed or inquired about the configuration settings on their devices for retaining
text messages that may be records. We obtained a listing of mobile devices procured outside the
WCF (non-WCF) from EPA program and regional offices.
We analyzed the device listing and identified the mobile devices used for text messaging. We
selected and interviewed Region 1 users because the region had users who had mobile devices
that exceeded their allowance for text messages. We also reviewed a sample of text messages
that resided on the government-issued mobile devices of the EPA Administrator and the
Regional Administrators from Regions 1, 2 and 6. We selected the Assistant Administrators with
the highest text message usage, and requested samples of text messages from their government-
issued mobile devices with a date range of January 2015 to March 2015. We were not able to
collect and review a sample of text messages residing on all these selected officials' government-
issued mobile devices, because one senior official's device deleted the text messages after
30 days, and another senior official stated that he did not have any text messages even though the
EPA's quarterly mobile device usage report documented a high number of text messages during
the time frame for the requested text messages. We also obtained text message records of EPA
employees, including the EPA Administrator, who preserved text messages in the EPA's record-
keeping system from 2009 to June 30, 2015.
Agency Records Management Review
We reviewed the EPA's Interim Records Management Policy, dated June 28, 2013, and the
revised Records Management Policy, dated February 12, 2015, to determine if any guidance
existed for preserving text messages as federal records. We reviewed the EPA's records
17-P-0062
24
-------
management policies and procedures for information relevant to preserving federal records
created using text messaging technologies.
NARA Notification Review
We interviewed the agency's records officer and records management staff, and obtained
documentation to determine the number of times the EPA notified NARA regarding lost or
misplaced federal records over the past 15 years, to include the current and previous EPA
Administrators' tenures.
FOIA and Congressional Request Processing Review
We interviewed the EPA headquarters FOIA officer and select regional FOIA personnel
responsible for managing FOIA and congressional requests. We gathered and evaluated
information regarding each office's FOIA and congressional request processing procedures.
17-P-0062
25
-------
Appendix C
Region 2 Response to Draft Report
MEMORANDUM
DATE:
October 4, 2016
SUBJECT: Response to Office of Inspector General Draft Report No. OA-FY15-0063 "Review
Resulting from Congressional Inquiry Found EPA Needs to Improve Processes for
Preserving Text Messages as Federal Records," - Additional Information
As you are aware, I provided my comments to the subject draft report on September 19, 2016 (copy
attached). Since my response, I was provided with additional information and data which I believe is
important information to supplement my previous response.
The attached data provides the detail of text messaging activity on my EPA cell phone account for the
period of July 1, 2015 through September 15, 2015. As you will note, there were 708 text messages. Of
these 708 messages, 699 (98.7%) of these were incoming tweets from Twitter feeds that I subscribed to.
Please note that the code "40404" is Twitter's feed number.
Given this detailed information, and existing EPA records retention policies, it is clear that these
incoming tweets are not records of the Agency and they do not meet the criteria as established for
records retention. With this, I again strongly recommend that the nature and content of this report,
along with illustrations contained in the draft report be modified to be responsive to Congress' request
for a review on this subject.
As this data would seemingly be available for the other accounts included in this review, it could be
useful for the information be gathered to further clarify to the readers of this report that person-to-
person texts, as well as tweets are considered "text messages" in this context. These tweets do not
meet the requirements to constitute a record of the receiver of the tweet. I think that this information
further supports my previous recommendation that the OIG consider deleting the statement that "[t]he
volume of EPA test message communications versus the number of text messages saved as federal
records leaves questions about whether all potential records were saved."
I would be more than happy to request all text messaging information sent/received on my EPA cell
phone account for a greater period of time should your office require this information.
cc: Ann Dunkin, OEI
Kevin Christensen, OIG
Charles Sheehan, OIG
John Svec, R2
17-P-0062 26
FROM:
Judith Enck
Regional Administrator, Region 2
TO:
Rudolph M. Brevard, Director
Information Resources Management Audits
Office of Inspector General
-------
MEMORANDUM
DATE: September 16, 2016
SUBJECT: Response to Office of Inspector General Draft Report No. OA-FY15-0063
"Review Resulting from Congressional Inquiry Found EPA Needs to Improve
Processes for Preserving Text Messages as Federal Records," dated August 25,
2016.
FROM: Judith Enck
Regional Administrator, Region 2
TO: Rudolph M. Brevard, Director
Information Resources Management Audits
Office of Inspector General
Thank you for the opportunity to respond to the issues and recommendations in this draft audit
report. Following is a summary of Region 2's overall position along with our request to eliminate
the charts on pages 2 and 3, to provide a more accurate representation of the data reported.
REGION 2' S OVERALL POSITION
Region 2 does not concur with this report's portrayal of "text messaging" at EPA and with the
statistics provided by the OIG on Figures 1 and 2 of the draft report on text message usage. This
draft report is inaccurate and provides a misleading impression in that it counts incoming public
tweets and other social media communication (traffic reports, weather alerts, etc.) as text
messages. As a result, the draft report gives an inaccurate picture of the volume and nature of
text messaging by EPA employees. This fact greatly distorts the statistics provided by the OIG
on the usage of text messaging. Based on our review of data on text usage, it is evident that I
rarely use text messages for agency communication. Yet, Figure 2 on page 3 of the draft report
states that I have sent or received 3,915 texts from July 1, 2014 through June 30, 2015. Over
99% of these are likely incoming (never outgoing) public tweets.
After I met with IG investigators on August 11, 2015,1 disabled my ability to receive public
tweets on my EPA phone and the number of texts dropped from 4,732 texts during the period
from April 2014 through September 2015, to 227 texts during the period from October 2015
through June 2016. The following chart illustrates this important fact.
17-P-0062
27
-------
Text data for Region 2 Administrator's EPA Cellular Phone - April 2014 to June 2016
1,400 1,319
Total Texts
¦ Apr-Jun 2014
745
¦ July-Sept 2014
1,319
¦ Oct-Dec 2014
1,085
Fl Jan-Mar 2015
766
¦ July-Sept 2015
817
¦ Oct-Dec 2015
213.00
¦ Jan-Mar 2015
8.00
¦ Apr-Jun 2016
6.00
Most importantly, to meet the definition of a record, an item must be (1) recorded information,
(2) created or received in the conduct of agency business, and (3) preserved as evidence of the
organization, functions, policies, decisions, procedures, operations or other activities of the
government or because of the informational value of data in them.
Because tweets do not meet these characteristics and were for informational purposes only, they
are not considered records, and EPA policy and guidance advise that they should be deleted
when they are no longer needed for reference.
Including incoming public tweets is not responsive to Congress' request to have accurate
information about preserving text messages. The fundamental design of this IG report does not
answer that question and I believe should be revised. If the systems and technology that are
available to EPA cannot distinguish between a text and a tweet, then while time consuming, each
so-called text should be reviewed and classified accordingly.
If this cannot be done, the entire premise of this report needs to be reconsidered. I am also
suggesting that the IG modify the language of this Draft Report at the beginning to make clear to
readers that IG investigators were unable to distinguish between "text messages" that were
person-to-person communications and those that were other types of communications including
public broadcast messages. This is fundamental to providing an informed response to the
Congressional inquiry, as well as a clear and accurate report to the public.
17-P-0062
28
-------
Region 2 requests the OIG to revise Figures 1 and 2 of the report, so that the distorted figures
from Region 2 are more accurate.
Further, please consider deleting the statement in Chapter 3 that "[t]he volume of EPA text
message communications versus the number of text messages saved as federal records leaves
questions about whether all potential records were saved." While the IG may find an adequate
basis in other evidence to conclude that there are questions about whether all potential records
were saved, the 3.1 million volume figure does not provide an appropriate basis for that
conclusion.
CONTACT INFORMATION
If you have any questions regarding this response, please feel free to contact me at (212) 637-
5000, enck.judith@epa.gov or have your staff contact Region 2's Audit Coordinator, John Svec,
at (212) 637-3699, svec.john@epa.gov.
Thank you.
cc: Ann Dunkin, OEI
Kevin Christensen, OIG
John Svec, R2
17-P-0062
29
-------
Appendix D
EPA Headquarters Consolidated Response to
Draft Report
September 30, 2016
MEMORANDUM
SUBJECT: Response to Office of Inspector General Report No. OA-FY15-0063, Audit of
EPA's Text Message Practices," dated August 25, 2016.
FROM: Ann Dunkin
Chief Information Officer
TO: Arthur A. Elkins, Jr.
Inspector General
Thank you for the opportunity to respond to the issues and recommendations in the subject audit
report. Following is a summary of the agency's overall position, along with its position on each
of the report recommendations. For those report recommendations with which the agency agrees,
we have provided either high-level intended corrective actions and estimated completion dates to
the extent we can or reasons why we are unable to provide high-level intended corrective actions
and estimated completion dates at this time. For those report recommendations with which the
agency does not agree, we have explained our position, and proposed alternatives to
recommendations.
We appreciate the dialogue that has occurred in this matter between our offices because it has
provided the Agency with an opportunity to share the latest information on EPA efforts to
address a complex area of technology and records management. However, we still have some
concerns with your recommendations that have not been addressed. We have noted those and
our non-concurrence with the recommendations at this time, in the attached table.
If you have any questions regarding this response, please contact Judi Maguire, OEI's Audit
Follow-up Coordinator at maguire.iudi@epa.gov or (202)564-
7422.
Attachment
cc: Rudy Brevard
Judi Maguire
Vincent Campbell
Theresa Richardson
Elena Larsen
17-P-0062
30
-------
Wendy Blake
Lynn Kelly
Liza Hearns
Rena Keys
Robin Richardson
Rebecca Moser
Pam Shenefiel
Tom Reilly
17-P-0062
31
-------
EPA Response for Audit OA-14-0063 "EPA's Process for Preserving Text Messages
pas*e
#
Recommendation
Asencv Response
Corrective Action OR Proposed Alternative Recommendation
14
Rec. #1
Require the Office of
Congressional and
Intergovernmental Relations
to document formal
procedures for responding to
congressional requests for
records.
OCIR concurs with the OIG's recommendation of
updating its procedures for responding to
congressional requests for records. OCIR is
currently undergoing a Lean initiative that will
result in formal written procedures for processing
congressional correspondence more efficiently in
the future. However, OCIR does not concur in
the recommendation to also include in those
procedures "searching and providing record from
all media, including text message records" as
searches and production of records are done by
program offices working with OEI. OCIR
proposes alternative recommendation language.
If the purpose of this audit recommendation is to
ensure that text message records are properly
captured when responding to congressional
requests for records, we would recommend
eliminating from recommendation #1 the second
sentence referring to including searches and
production of records in OCIRs procedures.
Instead we would recommend revising
recommendation #2 to include Congressional
requests in its scope.
Proposed alternative recommendation: Require the Office of Congressional and
Intergovernmental Relations to document formal procedures for responding to
congressional requests for records.
Corrective action: OCIR will document its procedures for responding to a
Congressional Request for records by summer of 2017
17-P-0062
32
-------
14
Rec. #2
Remind Agency employees
that, as appropriate, all text
messages that are potentially
responsive to a FOIA request
or a Congressional request
must be available for
inclusion in searches
conducted by the Agency to
prepare responses to these
requests.
OEI does not concur with recommendation #2,
and proposes an alternative recommendation.
While OEI concurs with ensuring that text
messages are searched for and located, as
appropriate, in response to FOIA requests, we are
concerned that this recommendation could be
misinterpreted as requiring the Agency to search
for already deleted text messages, because it asks
EPA to search for "unpreserved" messages.
EPA policy already requires employees to ensure
that text message records are saved to the official
recordkeeping system within 20 days.
fhttD://intranet.eDa.aov/records/faas/Dda.html#tvD
es-of-pda-records)
We also refer to the following FAQ text available
to all employees at
httD://intranet.eDa.20v/records/faas/Dda.html:
"[Information on your Agency-issued mobile
device may be requested under FOIA, in response
to litigation or in response to a Congressional
request. The same rules and exemptions that
apply to the release of all other EPA documents
under these laws also apply to documents
contained on mobile devices. It is important to
note that if information on your mobile device is
responsive to a litigation hold, FOIA, or other
request, you must preserve the information even
if it is a transitory record that could otherwise be
deleted consistent with the Federal Records Act
requirements."
OEI recommends changing the recommendation
to clarify its intended meaning as follows:
Remind Agency employees that, as appropriate,
all text messages that are potentially responsive to
a FOIA request or a Congressional request must
be available for inclusion in searches conducted
by the Agency to prepare responses to these
requests.
Proposed alternative recommendation: Remind Agency employees that, as
appropriate, all text messages that are potentially responsive to a FOIA request or a
Congressional request must be available for inclusion in searches conducted by the
Agency to prepare responses to these requests.
Corrective action:
EPA will add the following text to the FY17 Records Management Training. This
training is mandatory, so will reach all employees:
"Once you forward a text message record to your email account, it is available to be
searched within your email for future document requests. You must also forward to
your email account any non-record text messages that are responsive to a FOIA or
other document request that are still available at the time you are notified of the
request. These messages, once in the EPA's email system are then available for
information searches/collections in response to FOIA requests, congressional
inquiries or litigation. If you have any text messages responsive to a document
request which have not been forwarded to your EPA email account (for example,
they are non-records or are less than 20 days old), you must forward those messages
to your email account and coordinate with the office in charge of the document
request to ensure those responsive messages are identified and collected."
17-P-0062
33
-------
pasre
#
Recommendation
Asencv Response
Corrective Action OR Proposed Alternative Recommendation
14
Rec. #3
Determine whether potential
text message records were
lost during the replacement
of the noted mobile device
during the instance where the
senior official could not
provide the requested text
messages (Bullet 1, Page 12),
or during the instance when
the senior official's mobile
device automatically deleted
messages after 30 days
(Bullet 2, Page 12), and
notify National Archives and
Records Administration if
warranted.
EPA partially concurs with Recommendation #3.
The first individual cited signed a form indicating
that the mobile device had been searched for
records, and he followed policy. We do not
believe that any further investigation is necessary
in this case but we will document the actions
taken to date to support our position that no
records were lost. EPA will provide
documentation supporting this stance to the
Agency Records Officer.
Regarding the second individual, we first note that
the determination as to whether a record was lost
lies with the Region or Program office, not with
OEI. Therefore we recommend that the affected
office will provide appropriate documentation on
the specifics of this case to the Agency Records
Officer, who in turn will determine whether a
report to NARA is necessary.
Corrective action:
Regarding the first individual, the affected office will provide documentation to the
Agency Records Officer supporting its conclusion that no records were lost, by
12/31/2016.
Regarding the second individual, the affected office will provide documentation
regarding this matter and an assessment as to whether records were lost, to the
Agency Records Officer by 12/31/2016.
In each case, in consultation with the Office of General Counsel, the Agency
Records Officer will determine whether a report to NARA is needed by January 31,
2017.
18
Rec. #4
Develop and implement a
strategy instructing
employees not to change the
text message retention
settings.
OEI does not concur and proposes an alternative
recommendation. There is no technical solution to
prevent employees from changing text message
retention settings on their devices. We can update
the Mobile Device Policy Notice to specifically
prohibit employees from changing the text
message retention settings. The default setting
does not auto-delete, and by policy, employees
are to download their text records to a record
keeping system within 20 days.
Proposed alternative recommendation: Develop and implement a strategy
instructing employees not to change the text message retention settings.
Corrective action: By December 31, 2016, EPA will modify the Mobile Device
Employee Notice to state that employees shall not modify the text message retention
settings.
17-P-0062
34
-------
pasre
#
Recommendation
Asencv Response
Corrective Action OR Proposed Alternative Recommendation
18
Rec. #5
Develop a plan to replace any
phones not technically
compatible with the new
mobile device management
solution identified during
market research in response
to recommendation 6. The
CIO should develop a
process to approve waivers
for any office that identifies a
significant need to keep the
existing device and identifies
an alternative solution for
records management for that
existing device.
OEI does not concur with this recommendation.
OARM with assistance from OEI migrated all
mobile devices to the Working Capital Fund
(WCF) contract, but OEI does not concur with the
recommendation to replace all devices that were
formerly not on the contract with newer devices.
Some offices have migrated older mobile devices
(e.g. flip phones) to the WCF contract and may
continue to have a business need for those devices
(e.g., audio quality is more important than smart
phone capabilities.) These older devices, now on
the WCF contract, are still not capable of being
managed by the MDM. However as discussed in
the response to recommendation #6 below, EPA
has not identified a suitable software at this time
that offers records management capabilities, so
replacing those devices with newer ones capable
of being managed by the MDM offers no records
benefit, and may interfere with the business needs
of the office.
Therefore OEI does not concur with the
recommendations and recommends removing the
recommendation. If the recommendation is
retained, OEI suggests that it be changed to reflect
the time-frame of recommendation #6 below.
OEI recommends removing this recommendation, due to the fact that it does not
result in improvements to the retention of text message content by the Agency.
In the alternative, OEI proposes the following alternative recommendation:
Proposed Alternative Recommendation: If the Agency identifies a records-
management solution for mobile devices after the review scheduled to be conducted
between 6/30/18 and no later than 9/30/18, develop a plan to replace any phones not
technically compatible with any identified solution within 6 months of
implementation of the identified solution (unless a program office identifies a
significant business need to keep the existing device and identifies an alternative
solution for records management for that existing device).
17-P-0062
35
-------
pasre
#
Recommendation
Asencv Response
Corrective Action OR Proposed Alternative Recommendation
18
Rec. #6
Formalize a plan with
milestone dates to conduct
market research to determine
whether an enterprise mobile
device management solution
exist that can manage text
message communications to
help the agency meet its
record-keeping
responsibilities. Document a
management decision if a
new solution is appropriate
for implementation and if
needed, create a project plan
with milestone dates for
implementing the new
solution.
OEI concurs, with a caveat. OEI recently
concluded market research to determine if an
enterprise tool was available to meet Federal
security, legal and records management
requirements. No such tool is currently available.
This finding is consistent with a draft white paper
from NARA indicating that none of the Federal
Agencies they have interviewed have a system to
automatically capture text messages into a
recordkeeping system.
https://www.archives.gov/records-
mgmt/resources/emessageswp.pdf.
This may change as new IT solutions or products
evolve over time and OEI will commit to
revisiting this research in FY18. OEI will
continue to require personal responsibility by the
employees to manage any records that are text
messages.
OEI will agree to develop a plan for
implementation if an acceptable solution is
identified after the market research is finished in
2018.
Corrective action: OEI will complete this new research no sooner than 6/30/18 and
no later than 9/30/18.
17-P-0062
36
-------
Appendix E
Distribution
Office of the Administrator
Deputy Administrator
Chief Information Officer, Office of Environmental Information
Agency Follow-Up Official (the CFO)
Agency Follow-Up Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for Public Affairs
Regional Administrator, Region 2
Principal Deputy Assistant Administrator, Office of Environmental Information
Audit Follow-Up Coordinator, Office of the Administrator
Audit Follow-Up Coordinator, Office of Environmental Information
17-P-0062
37
------- |