| <<< ABBOTT::ABBOTT$DUA1:[NOTES$LIBRARY]CONTENT-RETRIEVAL.NOTE;1 >>>
-< Document and text processing based on content >-
================================================================================
Note 151.1 Clinton/Gore '92 Volunteer Email Effort 1 of 1
LGP30::FLEISCHER "without vision the people perish" 515 lines 19-FEB-1993 02:32
-< Current Issues in Government Public Access E-Mail >-
--------------------------------------------------------------------------------
CURRENT ISSUES IN GOVERNMENTAL PUBLIC ACCESS E-MAIL
Bruce W. McConnell
Chief, Information Policy
U.S. Office of Management and Budget
February 18, 1993
NOTE: THE VIEWS EXPRESSED BELOW ARE THOSE OF THE AUTHOR, AND DO
NOT REPRESENT THE VIEWS OF THE OFFICE OF MANAGEMENT AND BUDGET.
ISSUE: How can the White House Public Access Electronic Mail
service be advanced as quickly and successfully as
possible?
Summary.
This paper analyzes the issue and recommends a hybrid approach
that builds on work that has already been accomplished during the
campaign and the transition, ensures that this initiative occurs
in harmony with law and policy, uses expertise available in
Federal agencies, and provides for public input into its design.
This paper deals primarily with how best to acquire technology
and services. It is followed by an Appendix that discusses
policy issues that need to be addressed.
Background.
The White House Office of Communications is establishing an
exciting new program that will allow the public to send
electronic mail to "the White House" for consideration and
response just like paper mail. There is a near term requirement
to continue to respond to electronic mail that is coming in to
mailboxes established prior to January 20th. This paper
addresses a longer term goal: to establish a system that
encourages easy public access and uses automation to direct
incoming mail to the appropriate respondent, either within the
White House or in a Federal agency. At issue are the contractual
arrangements to ensure that these goals are achieved effectively
and expeditiously.
During the campaign and transition, MIT's Artificial Intelligence
Laboratory, Symbolics, Inc., and other firms, as part of a unique
research project in computers and political science, provided
technical assistance to bring up a sophisticated electronic mail
service. During the campaign, this service was provided on a
non-partisan basis to five major candidates. It was continued
after the election for the President-Elect. Information was
distributed by MIT simultaneously to a variety of commercial
information services (e.g. Compuserve, America OnLine, MCI,
Prodigy) ensuring each was treated fairly. Information was
further disseminated by volunteers through distribution lists and
"net news" on the Internet. In addition, Compuserve and America
OnLine provided the campaigns with electronic mail boxes. MIT is
continuing work to develop software and systems to support a more
full-blown system. MIT has a proven track record and is eager to
cooperate, and has offered to set up an electronic mail address
for the White House.
Continued reliance by the Government on MIT and Symbolics and on
freely provided commercial network services from any particular
vendor raises appearance and procurement issues. Ideally, a
White House electronic mail address should look to the public
like an official government address. Use of alternate addressing
schemes raises appearance issues. MIT has proposed to use the
".org" domain for the White House mailbox. This name is
ordinarily reserved for not-for-profit organizations. Businesses
and government agencies are not permitted to use that domain
name. The ".com" domain is reserved for commercial users--
businesses and individuals who buy services from a commercial
network service, such as Compuserve. Government users typically
have an Internet address in the ".gov" domain. Use of a domain
address other than ".gov" by the White House would be confusing
to the public. In addition, an address such as
"[email protected]" gives no indication that the address
belongs to the White House and is difficult to remember.
The procurement issues are more significant. Internet services
for government agencies are provided under competitively awarded
contracts or cooperative agreements by a variety of private
sector providers. General purpose X.400 electronic mail service
is provided by competitively awarded General Services
Administration (GSA) contracts with Sprint and AT&T. The
Executive Office of the President's Office of Administration
(EOP/OA), which provides computer support to the White House, is
required by law to use these arrangements. Both the Internet and
the GSA contracts are already highly visible in industry and in
Congress. Given this visibility, and the high profile of
anything the White House does, success of this effort depends on
all actions being conducted in full sunlight and adhering to
legal and regulatory requirements.
Roles of Government Agencies Outside the White House
Two components of the current program need restructuring to bring
them into conformance with Federal law and policy -- the research
component and the service component. For a variety of reasons it
would be useful to make use of the expertise and capabilities in
other Federal agencies to bring about this restructuring.
On the research side, as part of the High Performance Computing
and Communications Initiative (HPCCI), a large number of Federal
agencies, including the National Science Foundation (NSF), the
Defense Advanced Research Projects Agency (DARPA), the National
Aeronautics and Space Administration (NASA), and the Department
of Energy, are funding research on high-bandwidth technologies
and sophisticated applications that require them. One of these
agencies could explore ways to continue the arrangements with MIT
for the short term. For the longer term, one of them, perhaps
NSF, could coordinate a solicitation of grant proposals for
future research.
Continuation of technical arrangements with MIT would need to be
handled carefully. In particular, it would be important to
ensure that MIT did not disqualify itself from bidding on future
competitions by creating an organizational conflict of interest,
and that the playing field for future competitions remained
level.
On the service side, GSA's "FTS 2000" contracts with Sprint and
AT&T provide low cost, government-wide long distance services,
including electronic mail, to Federal agencies. The system
provides a gateway to the Internet, and is consistent with
Federal regulations requiring use of international X.400
standards. Most Federal agencies are already moving rapidly to
establish X.400 mailboxes under a pilot program sponsored by the
Office of Management and Budget (OMB). In addition, as noted
earlier, Internet services can be acquired through a variety of
commercial vendors.
Advantages of the GSA contract include ease of ordering service,
commercial-grade security and reliability, and low prices.
Disadvantages include lack of File Transfer Protocol (FTP)
service for Internet use and complex X.400 addressing. A direct
Internet connection improves addressing and allows FTP, but
creates security risks and raises standards issues. Over the
next several months, GSA could work with other Federal agencies
to provide secure, robust service to the White House that uses a
mix of Internet and X.400 services.
Conclusion.
A hybrid approach is recommended that draws upon the resources of
several different Federal agencies to establish the White House
Public Access electronic mail program. The first step is to
create a program plan with milestones. Issues such as those in
the Appendix which follows need to be considered as part of that
plan.
APPENDIX: Policy Considerations on Creating
an Electronic Mail System
Electronic mail is rapidly becoming an indispensable tool of
government. Agencies use it routinely to communicate with their
employees and with other agencies. More and more, innovative
agencies are using electronic mail to conduct virtually every
kind of public business they now carry out using telephones,
paper or facsimile.
While this service is on its way to becoming ubiquitous, no
central policy or set of governing procedures cover its use,
primarily because electronic mail has many characteristics. It
can be seen as an official record, a private communication, an
automated transaction, etc. It is also important to note that,
unlike private sector use of electronic mail, governmental use is
affected by many different laws and regulations, each of which
should be considered in implementing an electronic mail system.
This paper discusses six kinds of electronic mail policy
considerations that officials of the Executive Office of the
President (EOP) should address:
- Records Management
- Privacy;
- Security;
- Permissable Use;
- Organizational, Social and Ethical Impacts.
It is not meant to be a comprehensive listing of legal and
regulatory requirements. Employees should be notified of
policies in each of these areas. As noted below, the laws which
apply to Federal agencies do not always apply to all agencies of
the Executive Office of the President. When possible, the issues
discussed below should be considered and built in during the
design of the system.
RECORDS MANAGEMENT
[NB: This is a very volatile area of law. Before proceeding,
officials should familiarize themselves with the two Armstrong
cases (Armstrong v. Bush, 721 F. Supp. 343, DDC 1989; and
Armstrong v. Executive Office of the President, Civil Action No.
89-142, DDC January 6, 1993) and ongoing litigation.]
The Federal Records Act (FRA) (44 USC 2101-2118, 2901-2910, 3101-
3107,3301-3324) requires agencies to document their official
business and maintain records according to records schedules. It
states:
The head of each agency shall make and preserve records
containing adequate and proper documentation of the
organization, functions, policies, decisions,
procedures, and essential transactions of the agency
and designed to furnish the information necessary to
protect the legal and financial rights of the
Government and of persons directly affected by the
agency's activities. (44 USC 3101)
The FRA defines "records" as:
all books, papers, maps, photographs, or other documentary
materials, regardless of physical form or characteristics,
made or received by an agency of the United States
Government under Federal law or in connection with the
transaction of public business... (44 USC 3301)
In the EOP, most agencies create "records" under the FRA and must
comply with its requirements. However, some offices, especially
the White House Office and the Office of the Vice President, do
not. The FRA says that records
created or received by [these offices] whose function
is to advise and assist the President, in the course of
conducting activities which relate to or have an effect
upon the carrying out of the constitutional, statutory,
or other official or ceremonial duties of the President
are covered by the Presidential Records Act (PRA). (44 USC 2201
et seq.) The PRA requires documentation of the official business
of the Presidency, including records documenting political
activities, but does not cover personal records of the President
"of a purely private or nonpublic character."
In the mixed environment of the EOP, some of its agencies may
create (or receive) both "Federal records" and "Presidential
records," such as the National Security Council or the Office of
Management and Budget. Development of an electronic mail system
should take this environment into consideration.
The following are some records management issues to consider:
* Because official agency business will be conducted over
electronic mail systems, the real issue is how to ensure
that the recordkeeping requirements of the PRA and the FRA
are met. Thus, if it is determined that electronic mail
will not be used as the official record of an agency action,
then employees should be instructed how to record official
business which is transacted over the system. This policy
should be coupled with training of EOP officials as to what
constitutes a record.
* If any of the electronic messages created or sent on the
system are records under either the PRA or the FRA, then an
agency must secure the records against loss or alteration,
and must schedule the records according to National Archives
and Records Administration (NARA) directives for archiving
and possible permanent preservation. A system for
identifying and discarding non-record material should be
developed. Special consideration should be given to
preserving the privacy of the President and employees whose
unofficial personal messages may be commingled with Federal
or Presidential records.
* While for most agencies, a very small proportion of Federal
records are deemed by the National Archives to have enduring
value, for the agencies of the EOP, the opposite is true.
* The Freedom of Information Act (FOIA) (5 USC 552) requires
disclosure of Federal records when a request is received
from the public, with certain exceptions. Any Federal
record, as defined by the FRA, is subject to the FOIA. The
FOIA may also apply to documents not considered records
under the FRA (e.g. an individual's preliminary draft of a
document, or office chronological files). However, the FOIA
does not apply to Presidential records. Separation of
Federal records and Presidential records is required to
prevent inadvertent disclosure of Presidential records under
FOIA.
* If records created or received on electronic mail are
retained in electronic form, they should be logically
separated into "folders" or groups of messages. Each folder
should contain only records from the same activity or on the
same subject. Contents should be purged or copied to
storage media periodically, in accordance with approved
agency records schedules. Storage media should be properly
labeled, indexed and preserved to ensure electronic mail
records are available and accessible. The establishment of
naming conventions, and labeling with the title of the data,
dates of use, originating office, software and equipment on
which data were produced, and access restrictions greatly
enhances the ability to use the records later.
* Accounting and audit systems have more specific requirements
for documenting financial decisions, such as maintenance of
drafts. If financial decision-making is carried out over an
electronic mail system, documents should conform to General
Accounting Office and Treasury requirements.
* Electronic decision documents for final signature should
have the electronic equivalent of signoff sheets, including
dates of signing. Drafts reflecting substantive changes
should be maintained showing dates and officials who made
changes. ("Managing Electronic Records," National Archives
and Records Administration, 1990)
* Back-up, search, and retention capabilities should be built
into the system from the design stages.
PRIVACY
The Privacy Act of 1974 (5 USC 552a) grants certain access and
amendment rights to individuals for records about themselves
maintained by agencies. It also requires agencies to maintain
only accurate, relevant, timely, and complete records and to
protect them from unauthorized disclosure. The Electronic
Communications Privacy Act (18 USC 2701 et seq.) makes
unauthorized access or disclosure of electronic mail a crime.
Individuals also have Constitutional rights of privacy.
The following are privacy issues which should be considered when
creating a policy on electronic mail:
* The retrieving of records by an individual's name triggers
the access, amendment and due process rights of the Privacy
Act. These individuals could be agency employees, employees
of other agencies, members of the public who correspond with
the agency, or subjects of a message. This retrieval by
name also imposes requirements on record keepers to issue
notice in the Federal Register; to maintain accurate,
timely, relevant, and complete records; to protect the
records from unauthorized disclosure; and to make an
accounting of record disclosures other than those made
within an agency or under the Freedom of Information Act.
Note that while the White House Office and Office of the
Vice President, for example, are exempt from the Privacy Act
because they are not "agencies" within its meaning,
Presidential records are not per se exempt. A record
originating in the Vice President's Office and sent to the
Office of Administration (OA), for example, would be covered
by the Privacy Act while in the control of OA.
* Confidentiality must be maintained when information about
individuals is transmitted over the system by employees who
work with Privacy Act records in their daily work.
* Access to an employee's electronic mail by an employer is a
potentially contentious area that should be directly
addressed. Choices range from treating all electronic mail
as accessible at any time, to limiting access to particular
circumstances when such access is necessary. For example,
access may be necessary during a business crisis if an
employee is absent when information is required, for
administrative reasons such as gathering usage statistics or
addressing system problems, or for law enforcement. In any
case, it is important to notify the employee in advance of
what the rules are. An employee may have the right to
advance notice of the monitoring, due process when an
adverse action is initiated, or access to and amendment of
records created by the monitoring.
* If monitoring is to be carried out, it should be done in the
least intrusive way possible to acquire the required
information. Usage statistics, for example, may only
require the date and time stamps of messages, rather than
the sender and recipients' names. Fixing a mailbox may only
require gathering header information, rather than the entire
contents of messages. Intrusive monitoring may have a
"chilling effect" on usage of the system.
SECURITY
The important and sensitive nature of the business conducted by
the EOP requires that the information systems which support it be
secure. The systems used to create, transmit, and store
electronic mail must thus be designed to ensure the appropriate
security -- i.e., the confidentiality, integrity, and
availability -- of electronic mail information.
While electronic mail dramatically improves the ability to
exchange information quickly and widely, it also creates new
vulnerabilities. As with most information systems, internal
threats, such as the misuse or release of sensitive information
by employees, create the greater risk, because authorized users
have much better access to automated information. For this
reason, the Computer Security Act of 1987 (Public Law 100-235)
emphasizes training and awareness programs for Federal employees
and contractors who use Federal computer systems. That Act also
requires sensitive information in Federal computer systems to be
protected commensurate with the potential risk and harm to the
agency from the loss, misuse, or unauthorized alteration or
disclosure of the information.
While eliminating some of the security concerns of paper-based
systems, electronic mail systems also introduce vulnerabilities
which should be considered when systems are designed. Examples
include:
* Access: The electronic link to external computers or
electronic mail servers must prevent unauthorized, direct
access to an agency computer. Digital files coming from
outside the system should be checked for worms or viruses.
* Federal computer systems provide an attractive target. (A
Harpers article contained the suggestion that it is a
citizen's duty to break into the White House computer system
if he or she suspects criminal activity in the White House.)
Such unauthorized access is itself a criminal offense under
the Counterfeit Access Device and Computer Fraud and Abuse
Act of 1984. (18 USC 1030)
* Authenticity: The system should not allow the ability to
send mail in the name of someone else, or to alter mail
before being resent.
* Integrity: Record copies of messages must be protected from
alteration.
* Availability: Electronic mail systems must be protected
from power outages and system crashes, and backup systems
must be provided in case of failure during key use periods.
* Confidentiality: Users should be trained to exercise
caution so as not to send or forward messages to persons who
should not receive them. A few inadvertent keystrokes
(e.g., sending the wrong file) may mistakenly release
sensitive information to the wrong recipients.
Each of these risks should be evaluated in the context of the
specific electronic mail system. Safeguards and detection
procedures must be established. Prevention must be practiced.
Recovery plans must be put in place in the event of unanticipated
incidents.
PERMISSIBLE USE
The Federal Information Resource Management Regulation (41 CFR
201-21.6) prohibits the use of government telecommunications
systems for other than official business. Sound management
practice also suggests that agency policy should make clear who
may use an agency's electronic mail system and what kinds of
activities are authorized.
* Some agencies may choose to allow contractors or the public
to use the system, while others may prohibit anyone but an
agency employee from access.
* An agency should consider which incidental uses of the
system are authorized. It may prohibit all non-official
uses of its system, but this may make some activities less
efficient and more cumbersome, such as leaving phone
messages, or making lunch appointments. (Certain incidental
uses of government telecommunications systems have been
authorized by the General Services Administration.)
* It may also be appropriate to establish "etiquette"
guidelines, such as the procedure to follow when in receipt
of mail intended for others, or limiting use of features
which allow "snooping" on coworkers. The system should not
be used to satisfy someone's idle curiosity about another
employee's affairs.
* Any penalties for violating the permissible use policy
should be public, equitably imposed, and include due process
protections for alleged violators.
ORGANIZATIONAL, SOCIAL AND ETHICAL IMPACTS
The use of electronic mail to communicate within an organization
and with others may introduce new efficiency and productivity,
increase morale, and allow creativity and innovation to flourish.
However, various unintended consequences may result as
individuals are connected electronically to each other and to
extra-agency or extra-governmental organizations. These issues
should be explored more thoroughly and anticipated when adopting
electronic mail in any organization. The following are just
three of many types of issues that should be considered in this
area.
* Disclosure of White House electronic mail, even though not
subject to the Privacy Act, may be unwise. Correspondence
to or from the White House is not subject to the Freedom of
Information Act, and would not normally be available to the
general public. Ethical considerations dictate that
individuals who write to the White House should be notified
if their correspondence would be the subject of research or
be read by other than the intended recipient or office, yet
there is no reliable way to notify these individuals in
advance. Many academic institutions have "human subjects
research" standards requiring written consent and the
ability to withdraw from the research. These standards may
be difficult to meet in a free-wheeling electronic
environment open to the general public.
* The electronic mailboxes of agency heads and other high
officials should be protected from being inundated with
mail, for example, by creating a "private" mailbox for them.
* Absent affirmative actions, electronic mail is used only by
people who have a computer readily available. The users are
not representative of the citizenry at large, and public
electronic mail could lead to inequities in access to
government.
|