Office of the Secretary: Evaluation of Email Records Management and Cybersecurity Requirements

UNCLASSIFIED ESP-16-03 Office of Evaluations and Special Projects May 2016 Office of the Secretary: Evaluation of Email Records Management and Cybersecurity Requirements IMPORTANT NOTICE: This report is intended solely for the official use of the Department of State or the Broadcasting Board of Governors, or any agency or organization receiving a copy directly from the Office of Inspector General. No secondary distribution may be made, in whole or in part, outside the Department of State or the Broadcasting Board of Governors, by them or by other agencies or organizations, without prior authorization by the Inspector General. Public availability of the document will be determined by the Inspector General under the U.S. Code, 5 U.S.C. 552. Improper disclosure of this report may result in criminal, civil, or administrative penalties. UNCLASSIFIED UNCLASSIFIED May 2016 OFFICE OF EVALUATIONS AND SPECIAL PROJECTS Office of the Secretary: Evaluation of Email Records Management and Cybersecurity Requirements What OIG Found ESP-16-03 The Federal Records Act requires appropriate management and preservation of Federal Government records, regardless of What OIG Evaluated physical form or characteristics, that document the organization, As part of ongoing efforts to respond to functions, policies, decisions, procedures, and essential requests from the current Secretary of State transactions of an agency. For the last two decades, both and several Members of Congress, the Office Department of State (Department) policy and Federal regulations of Inspector General (OIG) reviewed records have explicitly stated that emails may qualify as Federal records. management requirements and policies regarding the use of non-Departmental As is the case throughout the Federal Government, management communications systems. The scope of this weaknesses at the Department have contributed to the loss or evaluation covers the Office of the Secretary, removal of email records, particularly records created by the specifically the tenures of Secretaries of State Office of the Secretary. These weaknesses include a limited ability Madeleine Albright, Colin Powell, Condoleezza to retrieve email records, inaccessibility of electronic files, failure Rice, Hillary Clinton, and John Kerry. to comply with requirements for departing employees, and a general lack of oversight. This report (1) provides an overview of laws, regulations, and policies related to the OIG’s ability to evaluate the Office of the Secretary’s compliance management of email records; (2) assesses the with policies regarding records preservation and use of non- effectiveness of electronic records Departmental communications systems was, at times, hampered management practices involving the Office of by these weaknesses. However, based on its review of records, the Secretary; (3) evaluates compliance with questionnaires, and interviews, OIG determined that email usage records management requirements; and (4) and preservation practices varied across the tenures of the five examines information security requirements most recent Secretaries and that, accordingly, compliance with related to the use of non-Departmental statutory, regulatory, and internal requirements varied as well. systems. OIG also examined Department cybersecurity regulations and policies that apply to the use of non-Departmental systems to What OIG Recommends conduct official business. Although there were few such OIG makes eight recommendations. They requirements 20 years ago, over time the Department has include issuing enhanced and more frequent implemented numerous policies directing the use of authorized guidance on the permissible use of personal systems for day-to-day operations. In assessing these policies, email accounts to conduct official business, OIG examined the facts and circumstances surrounding three amending Departmental policies to provide cases where individuals exclusively used non-Departmental for administrative penalties for failure to systems to conduct official business. comply with records preservation and cybersecurity requirements, and developing a quality assurance plan to address vulnerabilities in records management and preservation. The Department concurred with all of OIG’s recommendations. UNCLASSIFIED UNCLASSIFIED CONTENTS OBJECTIVES AND METHODOLOGY .......................................................................................................................... 1 BACKGROUND ................................................................................................................................................................. 2 PRESERVATION REQUIREMENTS HAVE GENERALLY REMAINED CONSISTENT AS LAWS AND POLICIES RELATED TO THE USE OF EMAILS HAVE EVOLVED ......................................... 4 MANAGEMENT WEAKNESSES CONTRIBUTE TO LOSS OF EMAIL RECORDS ........................................ 12 STAFF EMAIL USAGE AND COMPLIANCE WITH RECORDS MANAGEMENT REQUIREMENTS VARY ............................................................................................................... 19 CYBERSECURITY RISKS RESULT FROM THE USE OF NON-DEPARTMENTAL SYSTEMS AND EMAIL ACCOUNTS ........................................................................................................................ 26 Employees Generally Must Use Department Information Systems To Conduct Official Business ............................................................................................................................. 27 Restrictions Apply to the Use of Non-Departmental Systems ............................................................... 28 The Department Has Issued Numerous Warnings About Cybersecurity Risks ................................ 32 Three Officials Exclusively Used Non-Departmental Systems for Day-to-Day Operations ......... 34 CONCLUSION ................................................................................................................................................................ 42 RECOMMENDATIONS ................................................................................................................................................ 43 APPENDIX A: RELEVANT LAWS AND POLICIES DURING THE TENURES OF THE FIVE MOST RECENT SECRETARIES OF STATE ............................................................................................................................ 47 APPENDIX B: MANAGEMENT RESPONSES ......................................................................................................... 65 ABBREVIATIONS ........................................................................................................................................................... 77 OIG TEAM MEMBERS .................................................................................................................................................. 79 UNCLASSIFIED UNCLASSIFIED OBJECTIVES AND METHODOLOGY In April 2015, the Office of Inspector General (OIG) initiated an evaluation to address concerns identified during recent audits and inspections1 and to respond to requests from the current Secretary of State and several Members of Congress involving a variety of issues, including the use of non-Departmental systems2 to conduct official business, records preservation requirements, and Freedom of Information Act (FOIA) compliance. This report, which is the fourth and final to document OIG’s findings in these areas,3 addresses efforts undertaken by the Department of State (Department) to preserve and secure electronic records and communications involving the Office of the Secretary. Specifically, this report (1) provides an overview of laws, regulations, and policies related to the management of email records; (2) assesses the effectiveness of electronic records management practices involving the Office of the Secretary; (3) evaluates staff compliance with records management requirements; and (4) examines information security requirements related to the use of non-Departmental systems. As part of the current evaluation, OIG reviewed laws, policies, and practices from (and, in some cases, prior to) 1997 through the present, covering the tenures of five Secretaries: Madeleine Albright (January 23, 1997–January 20, 2001); Colin Powell (January 20, 2001–January 26, 2005); Condoleezza Rice (January 26, 2005–January 20, 2009); Hillary Clinton (January 21, 2009– February 1, 2013); and John Kerry (February 1, 2013–Present). OIG reviewed the requirements of the Federal Records Act4 and the Federal Information Security Management Act (FISMA)5 and related regulations; circulars and directives issued by the President, the National Archives and Records Administration (NARA), the National Institute of Standards and Technology (NIST), and the Office of Management and Budget (OMB); applicable 1 OIG has identified the following issues: inconsistencies across the Department in identifying and preserving records, hacking incidents and other issues affecting the security of Department electronic communication, delays and other processing problems related to FOIA requests, and concerns about an Ambassador’s use of private email to conduct official business. See OIG, Review of State Messaging and Archive Retrieval Toolset and Record Email (ISP-I-15-15, March 2015); OIG, Audit of the Department of State Information Security Program (AUD-IT-15-17, October 2014); OIG, Management Alert: OIG Findings of Significant and Recurring Weaknesses in the Department of State Information System Security Program (AUD-IT-14-03,

Load more