April 11, 2018 VIA CERTIFIED MAIL The Honorable Arthur A. Elkins, Jr. Inspector General U.S. Environmental Protection Agency Officer of the Inspector General (2410T) 1200 Pennsylvania Avenue, N.W. Washington, D.C. 20460 Re: Request for Investigation – EPA Employee Use of Unapproved Applications Dear Inspector General Elkins: I write on behalf of Cause of Action Institute (“CoA Institute”), a nonprofit strategic oversight group committed to ensuring that government decision-making is open, honest, and fair.1 In carrying out its mission, CoA Institute uses investigative and legal tools to educate the public about the importance of government transparency and accountability. As part of our ongoing effort to investigate instances where government officials have used alternative methods of communication to conduct official business in contravention of agency rules and federal records management laws, we have been examining the possible alienation of federal records at the Environmental Protection Agency (“EPA”). We have twice advised the Administrator of the obligations imposed by the Federal Records Act (“FRA”) with respect to the recovery of all electronic records created or received on unauthorized mobile applications. Our most recent notice, which was addressed to Administrator Pruitt earlier this week, raises new concerns about the use of instant messaging applications and personal web-based email accounts by EPA employees on agency- furnished and taxpayer-funded mobile devices, including iPhones and iPads.2 Our concerns are based on a contractor-generated report that was orally requested by the EPA Office of Inspector General (“OIG”) during its investigation into the use of “Signal” and “WhatsApp,” but which may never have been provided to your office in full.3 This report confirms that at least sixteen other mobile applications with electronic messaging capabilities were downloaded and operating on EPA hardware, as well as at least three web-based email applications. To the extent the OIG has not already done so, we respectfully request that your office immediately investigate the use of these applications and the possible legal issues arising therefrom. Background Shortly after President Trump took office, the press reported that a group of career EPA employees were using an encrypted messaging application called “Signal” to discuss ways to prevent 1 See CAUSE OF ACTION INST., About, www.causeofaction.org/about (last accessed Apr. 11, 2018). 2 Letter from CoA Inst. to Hon. Scott Pruitt, Adm’r, Envtl. Prot. Agency (Apr. 10, 2018) (attached as Exhibit 1). 3 See EPA MDM Mobile Application Summary (attached as Exhibit 2). EPA OIG April 11, 2018 Page 2 incoming political appointees from implementing the Administration’s policy agenda.4 Concerned that EPA employees were using Signal to conceal their communications from oversight, or to bypass EPA record-keeping obligations under the Freedom of Information Act (“FOIA”) and the FRA, CoA Institute notified then-Acting Administrator McCabe of her obligation as agency head to ensure that all work-related records created or received on Signal were retained or retrieved by the EPA.5 As a result of that notification, your office opened an investigation.6 Shortly thereafter, the U.S. House of Representatives Committee on Science, Space, and Technology also directed you to analyze the allegations surrounding Signal that had been reported in the press.7 Following Congress’s lead, the National Archives and Records Administration (“NARA”) opened its own inquiry into the potential violation of records management laws.8 The NARA inquiry apparently remains open, as the EPA has yet to file a final report with the Archivist.9 Over the past year, CoA Institute has pieced together troubling details concerning the use of Signal and other unauthorized communication applications at the EPA. These facts have come to light only because of our investigatory efforts, which have included three FOIA requests10 and two lawsuits, one of which is ongoing.11 For example, according to records released to CoA Institute 4 Andrew Restuccia, Marianne Levine, & Nahal Toosi, Federal workers turn to encryption to thwart Trump, POLITICO (Feb. 2, 2017), http://politi.co/2km4Qrb; EPA Employees Are Using Encryption Technology To Hide Resistance To Trump—But Is It Legal?, DAILY CALLER (Feb. 2, 2017), http://bit.ly/2wJfqkI. The use of Signal at the EPA mirrored reports about the use of electronic messaging platforms across the federal government. See, e.g., Hamza Shaban, After Trump’s Win, Secure Messaging App Signal’s Downloads Increase 400%, BUZZFEED (Dec. 1, 2016), https://bzfd.it/2IuoZWZ. 5 Letter from CoA Inst. to Catherine McCabe, Acting Adm’r, & Ann Dunkin, Chief Info. Officer, Envtl. Prot. Agency (Feb. 2, 2017), available at https://coainst.org/2GvU93C 6 See Investigation Update: EPA Employees’ Use of an Encrypted Messaging App to Thwart Transparency and Fight the White House, COA INST. (Nov. 27, 2017), https://coainst.org/2Ejz2vk; see generally CoA Inst., Press Release: CoA Institute Uncovers EPA Investigation into Employees’ Use of Encrypted Messaging App (Mar. 23, 2017), available at http://coainst.org/2vJa7Nr. 7 See, e.g., Andrew Restuccia, Conservatives demanding details on federal workers’ encryption use, POLITICO (Feb. 14, 2017), https://politi.co/2GB33sA. 8 Letter from Laurence Brewer, Chief Records Officer, Nat’l Archives & Records Admin., to John Ellis, Envtl. Prot. Agency (Feb. 22, 2017), available at https://coainst.org/2H9LtNu. 9 See Unauthorized Disposition of Federal Records, NAT’L ARCHIVES & RECORDS ADMIN., http://bit.ly/2pKZjyq (last visited Apr. 11, 2018) (describing EPA Signal inquiry as an “ongoing investigation”). 10 See Letter from CoA Inst. to Ms. Ann Dunkin, Chief Info. Officer, Envtl. Prot. Agency (Sept. 11, 2017), available at https://coainst.org/2H9qIRT; Letter from CoA Inst. to Ms. Ann Dunkin, Chief Info. Officer, Envtl. Prot. Agency (Aug. 30, 2017), available at https://coainst.org/2GwtEel; Feb. 2, 2018 Letter, supra note 5; see also CoA Inst., Press Release: CoA Institute Investigates EPA Employees Using Electronic Messaging Apps to Thwart Transparency (Feb. 3, 2017), available at http://coainst.org/2x4EUc7; Alex Swoyer, Lawsuit demands EPA say if employees using encrypted messages to evade open-records laws, WASH. TIMES (Feb. 2, 2017), http://bit.ly/2kWNMdn. 11 Cause of Action Inst. v. Envtl. Prot. Agency, No. 17-2549 (D.D.C. filed Nov. 28, 2017); Cause of Action Inst. v. Envtl. Prot. Agency, No. 17-0509 (D.D.C. filed Mar. 21, 2017); see generally CoA Inst., Press Release: CoA Institute Files Second Lawsuit for Records Concerning EPA Employees’ Use of Encrypted Messaging App (Nov. 28, 2017), available at https://coainst.org/2q0YLob; CoA Inst., Press Release: Lawsuit Demands Records on EPA Employees’ Use of Encrypted Messaging App (Mar. 22, 2017), available at http://coainst.org/2ocoSJR; see also Michael Bastasch, EXCLUSIVE: EPA Has A Report Identifying Officials Using Encryption Apps, And This Legal Group Wants It Made Public, DAILY CALLER (Aug. 30, 2017), http://bit.ly/2Ejx2mJ; Steven Trader, EPA Sued Over Employees’ Use of Encrypted Messaging App, LAW360 (Mar. 23, 2017), http://bit.ly/2wSpKai. EPA OIG April 11, 2018 Page 3 earlier this month, your office has, in fact, already completed its investigation into Signal and another encrypted messaging application, called “WhatsApp,” which was used more widely across the EPA’s workforce.12 But one agency record reveals vital information that may never have been transmitted to the OIG.13 That document, which provides a summary of all applications installed on most agency- furnished devices, was generated by an EPA contractor using the agency’s “Mobile Device Management” software.14 The record indicates that at least sixteen other applications with electronic messaging capabilities were downloaded and operating on EPA hardware. 15 These applications included the following: AIM LINE BlackBerry Messenger Skype Facebook Messenger Slack Google Hangouts Snapchat GroupMe Telegram Jabber Viber KakaoTalk WeChat Kik WickrMe In addition to these electronic messaging applications, several web-based email applications also were installed by EPA employees. These applications raise the same FRA and FOIA concerns as the use of Signal and WhatsApp because they can be used by agency employees to communicate about work-related business on a personal email account. At least three such applications were downloaded to EPA devices, including AOL, Gmail, and Yahoo Mail.16 Most, and perhaps all, of the foregoing messaging and email applications were unapproved for work-related use and installed in violation of official EPA policy. Although your office reported that the EPA disabled the “Apple Store” on most agency-furnished devices last summer,17 it remains unclear whether some employees still have the ability to download applications without prior approval or supervision, or whether already-installed unauthorized applications have been deleted. 12 See Investigation Update: EPA Employees Used a Range of Messaging Apps and Other Non-Work-Related Programs on Agency Issued Mobile Devices, COA INST. (Apr. 4, 2018), https://coainst.org/2qcAMBQ; see also Ralph R. Smith, IG Report: No Record Retention Violations Revealed at EPA, FedSmith (Apr. 9, 2018), http://bit.ly/2GP7xjq; Joe Crow, EPA Employee Downloaded ‘Boycott Trump’ App on Taxpayer-Funded Phones, Newsmax (Apr. 5, 2018), https://nws.mx/2GQhetZ; Elizabeth Harrington, EPA Employee Downloaded