CUI//PRVCY Management Implication Report: The EPA Failed to Comply with the OIG's Preservation Requests for Access to Mobile Device Information June 4,2024 | Report No. 24-N-0045 ------- ' „sPEcr0 A CUI//PRVCY OFFICE OF INSPECTOR GENERAL U.S. ENVIRONMENTAL PROTECTION AGENCY MEMORANDUM June 4, 2024 SUBJECT: FROM: TO: Management Implication Report: The EPA Failed to Comply with the OIG's Preservation Requests for Access to Mobile Device Information Paul H. Bergstrand, Assistant Inspector General Office of Special Review and Evaluation Kimberly Patrick, Principal Deputy Assistant Administrator Office of Mission Support Purpose: We are alerting the U.S. Environmental Protection Agency to the need to ensure that mobile devices for separating employees are properly preserved and timely accessible to the Office of Inspector General to prevent the loss of evidence and other relevant records. The EPA OIG is conducting an administrative investigation of a senior official for alleged ethics violations. In^^^J 2024, we notified the EPA Office of Mission Support that the senior official intended to leave, or separate from, the Agency in 2024, and we requested that the OMS preserve the information on the senior official's electronic devices. Upon the senior official's separation 30 days later, the OMS received five electronic devices from the official but failed to retain the three mobile devices in a way that would allow us or the Agency to access the information stored on them. As a result, we have been unable to retrieve the information and any potential federal records on these devices that may be relevant to our investigation, including text messages, telephone contact lists, and other forms of messaging. Background: The Federal Records Act requires that every federal agency, including the EPA, "make and preserve records containing adequate and proper documentation of the organization, functions, policies, decisions, procedures, and essential transactions of the agency." 44 U.S.C. § 3101. These records serve to furnish information necessary for protecting both the legal and financial rights of the government and individuals directly affected by an agency's activities. Id. The definition of a federal record includes electronic messages, which encompass SMS texts, chat and instant messaging, and other forms of digital communication. At the EPA, the Records Management Policy, Directive No. CIO 2155.5 (August 17, 2021), outlines principles, responsibilities, and requirements for managing the Agency's records, which include "all records, regardless of format or medium, made or received by EPA personnel under federal law or in connection with the transaction of public business, and preserved or appropriate for preservation as Any roquoat for public roloaao muat bo aont to the EPA OIG for procoaaing under the Freedom of Information Act. To report potential fraud, waste, abuse, misconduct, or mismanagement, contact the OIG Hotline at (888) 546-8740 or OIG.Hotline@epa.gov. 1 ------- CUI//PRVCY evidence of EPA functions, organization and activities or because of the value of the information they contain." For example, each EPA program office and region must establish and maintain a records management program that meets the prescribed minimum requirements, including "[m]anag[ing] records in any format (e.g., paper, emails, IMs [instant messages], text messages, ... and other social media tools that generate communications) in accordance with applicable statutes, regulations, and EPA policy and guidance"; "[m]aintain[ing] electronic records (e.g., IMs, text messages, electronic documents, ... and other social media tools that generate communications) in an approved electronic records system"; and "[m]aintain[ing] records so they can be accessed for appropriate business reasons by staff who have a need to know the information." The EPA has a number of other directives that relate to the identification and preservation of Agency information, including Preservation of Separating, Transferring or Separated Personnel Records, Directive No. CIO 2155-P-04.2 (June 6, 2022), and Preserving Agency Information of Separating Personnel, Directive No. 2155-P-07.1 (July 28, 2021). Notably, these directives do not provide instructions for preserving mobile device information subject to an OIG preservation request. The Inspector General Act of 1978, as amended, grants the OIG "timely access to all records, reports, audits, reviews, documents, papers, recommendations, or other materials available to" the EPA which relate to the programs and operations of the Agency and for which the OIG has investigative and other responsibilities. 5 U.S.C. § 406(a)(1)(A). Separately, as a matter of policy, the EPA has expressly acknowledged the OIG's right to access all records and materials available to the EPA and to "[c]onduct any investigation and issue any reports which the Inspector General deems necessary or desirable." EPA Manual 6500, Functions and Activities of the Office of Inspector General (1994). The manual also requires employees to cooperate and provide assistance during any OIG audit or investigation. The EPA administrator recently reaffirmed these authorities in a May 16, 2023 email to all employees, reminding the "agency and its employees [that they] have a duty to cooperate with OIG." Concerns Identified: We notified a senior official that they were the subject of an ongoing administrative investigation.1 As part of that notification, we reminded the senior official that they were responsible for ensuring that the computer systems and other electronic devices on which they conducted government business, including any government cell phones, remain intact and that no information, including electronic communications such as text messages, be deleted, lost, unpreserved, or destroyed from these devices, intentionally or unintentionally. In^^^J 2024, we notified the OMS that the senior official was separating from the Agency and that it should preserve that official's electronic devices so that we could access them. 1 While our administrative investigations, which are still ongoing, are being conducted in accordance with applicable standards and policies, including the Council of the Inspectors General on Integrity and Efficiency's Quality Standards for Federal Offices of Inspector General, the work related to this memorandum does not constitute an administrative investigation done in accordance with those standards. We did, however, follow the OIG's quality control procedures for ensuring that the information in this report is accurate and supported. Any roquoot for public roloooo muot bo oont to tho EPA OIG for procoooing under tho Freedom of Information Act. 2 ------- CUI//PRVCY Soon after the OIG notification, the senior official separated from the Agency and returned five electronic devices, including three mobile devices, to the OMS. We subsequently requested access to these electronic devices; however, the OMS provided the three mobile devices in a state in which information from these devices could not be retrieved. Specifically, the OMS disconnected service to the mobile devices after the official's separation but prior to their delivery to the OIG, which jeopardized the preservation of, and our access to, information on those devices. Despite several attempts by OIG and OMS personnel, as well as assistance by another law enforcement agency, we have been unable to access the information on the three mobile devices. Furthermore, because of the failure to preserve the mobile devices in a manner that would allow us or the Agency to access them, it is unclear whether the information and any potential federal records on those devices have been preserved. We are concerned that this is not an isolated issue. Recently, we notified another senior official of an ongoing OIG administrative investigation into their alleged ethics violations. Like we did in our request for the other unrelated administrative investigation, we notified the OMS of this senior official's intent to separate from the Agency and requested that the OMS preserve the information on that official's electronic devices. After this second senior official separated, the OMS was prepared to disconnect service to the official's mobile device—the same action that led to access issues with the first senior official's mobile devices. But for our immediate intervention, the OMS would have caused other mobile devices and the information on those devices to become inaccessible and potentially unretrievable. My office is notifying you of these concerns so that the Agency may take whatever steps it deems appropriate. If you decide it is appropriate for your office to take or plan to take action to address these matters, we would appreciate notification of that action. Should you have any questions regarding this report, please contact Kristin Kafka, deputy assistant inspector general for Administrative Investigations, or kafkafody.kristin@epa.gov. or me or bergstrand.paul@epa.gov. cc: Sean W. O'Donnell, Inspector General Janet McCabe, Deputy Administrator Jeffrey Prieto, General Counsel Vaughn Noga, Chief Information Officer and Deputy Assistant Administrator for Information Technology and Information Management, Office of Mission Support Helena Wooden-Aguilar, Deputy Assistant Administrator for Workforce Solutions and Inclusive Excellence, Office of Mission Support Dan Coogan, Deputy Assistant Administrator for Infrastructure and Extramural Resources, Office of Mission Support Stefan Martiyan, Director, Office of Continuous Improvement, Office of the Chief Financial Officer Yulia Kalikhman, Acting Director, Office of Resources and Business Operations, Office of Mission Support Afreeka Wilson, Audit Follow-Up Coordinator, Office of Mission Support Any roquoot for public roloooo muot bo oont to tho EPA OIG for procoooing undor tho Froodom of Information Act. 3 ------- Whistleblower Protection U.S. Environmental Protection Agency The whistleblower protection coordinator's role is to educate Agency employees about prohibitions against retaliation for protected disclosures and the rights and remedies against retaliation. For more information\, please visit the OlG's whistleblower protection webpage. Contact us: Congressional Inquiries: PIG.CongressionalAffairs@epa.gov Media Inquiries: OIG.PublicAffairs@epa.gov line EPA OIG Hotline: OIG.Hotline@epa.gov -pnr Web: epaoig.gov Follow us: X (formerly Twitter): ffiepaoig Linkedln: linkedin.com/company/epa-oig YouTube: voutube.com/epaoig [01 1 nstagram: (S)epa.ig.on.ig ------- |