The conclusion of the OIG report.

[LiberalFighter]

9. Excerpts

2009-2013 Hillary Clinton p 5
2009
CFR Provision added: "Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency recordkeeping system."

The FAM also included examples of emails that could constitute Federal records, including those providing key substantive comments on a draft action memorandum, documenting significant Department decisions and commitments reached orally, and conveying information of value on important Department activities. The Department has frequently reminded employees of this requirement, including through a November 2009 announcement to all employees that noted that Federal records can be found in “any media, including email, instant messages, social media, etc.” However, the Department believes that the majority of the millions of emails sent to and from Department employees each year are non-permanent records with no long-term value.

p 6

At the Department, compliance with this regulation and preservation of emails that constitute Federal records can be accomplished in one of three ways: print and file; incorporation into the State Messaging and Archive Retrieval Toolset (SMART); or the use of the NARA-approved Capstone program for capturing the emails of designated senior officials. Since 1995, the FAM has instructed employees, “until technology allowing archival capabilities for long-term electronic storage and retrieval of E-mail messages is available and installed,” emails warranting preservation as records must be printed out and filed with related Department records. NARA regulations codified in 2009 also specified that agencies must not use an electronic mail system to store the recordkeeping copy of electronic mail messages identified as Federal records unless that system contains specific features. However, according to the Department, its technology has “lagged behind” this mandate.

p 7

In 2009, IRM introduced SMART throughout the Department, enabling employees to preserve a record copy of emails through their Department email accounts without having to print and file them. However, the Office of the Secretary elected not to use SMART to preserve emails, in part because of concerns that the system would allow overly broad access to sensitive materials. As a result, printing and filing remained the only method by which emails could properly be preserved within the Office of the Secretary in full compliance with existing FAM guidance.

p 8

Requirements for Email Records in Personal Accounts: As previously stated, documents can qualify as Federal records regardless of the location, method of creation, or the medium involved. Consequently, records management requirements have always applied to emails exchanged on personal email accounts, provided their content meets the definition of a record. In 2004, NARA issued a bulletin noting that officials and employees “must know how to ensure that records are incorporated into files or electronic recordkeeping systems, especially records that were generated electronically on personal computers.” In 2009, NARA amended its regulations explicitly to address official emails on personal accounts:

Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency recordkeeping system.

In the 2014 amendments to the Federal Records Act, Congress added a provision prohibiting agency employees from creating or sending a record using “a non-official electronic messaging account” unless they copy their official electronic messaging account in the original creation or transmission of the record or forward a complete copy of the record to their official electronic messaging account within 20 days. Shortly before the enactment of the 2014 amendments, the Department issued an interim directive with similar requirements38 and subsequently updated the FAM in October 2015 as follows:

Under the Presidential and Federal Records Act Amendments of 2014, employees are prohibited from creating or sending a record using a non-official email account unless the employee (1) copies the employee’s official email account in the original creation or transmission, or (2) forwards a complete copy of record (including any attachments) to the employee’s official email account not later than 20 days after the original creation or transmission….The U.S. National Archives and Records Administration has advised that ”personal accounts should only be used in exceptional circumstances.” Therefore, Department employees are discouraged from using private email accounts (e.g., Gmail, AOL, Hotmail, etc.) for official business. However, in those very limited circumstances when it becomes necessary to do so, the email messages covering official business sent from or received in a personal account must be captured and managed in a Department email system in a manner described above in accordance with the Presidential and Federal Records Act Amendments of 2014. If an employee has any emails (regardless of age) on his or her private email account(s) that have not already been forwarded to the employee’s official email account, then such emails need to be forwarded to the employee’s state.gov account as soon as possible. Employees are reminded that private email accounts should not be used to transmit or receive classified information.

p 9
The above in bold was being followed by Clinton before this even went into effect.

According to a 2010 U.S. Government Accountability Office (GAO) report, most agencies do not prioritize records management, as evidenced by lack of staff and budget resources, absence of up-to-date policies and procedures, lack of training, and lack of accountability.

p 12

While these are positive steps, OIG identified multiple email and other electronic records management issues during the course of this evaluation. In its technical comments on this report, the Department noted that its budget has been declining over the past years and has not kept pace with inflation at a time when its national security mission is growing. According to the Department, it did request additional resources for records management for fiscal year 2017, but additional funding will still be needed to fully address its records management challenges.

p 13

Although NARA is responsible for conducting inspections or surveys of agencies’ records and records management programs and practices, it last reviewed the Office of the Secretary’s records retention practices in 1991–a quarter century ago.

p 14

Print and File Requirements Not Enforced: S/ES staff have provided numerous trainings for the Office of the Secretary on records preservation responsibilities and the requirement to print and file email records. However, S/ES staff told OIG that employees in the Office of the Secretary have printed and filed such emails only sporadically. In its discussions with OIG, NARA stated that this lack of compliance exists across the government. Although the Department is aware of the failure to print and file, the FAM contains no explicit penalties for lack of compliance, and the Department has never proposed discipline against an employee for failure to comply. OIG identified one email exchange occurring shortly before Secretary Clinton joined the Department that demonstrated a reluctance to communicate the requirement to incoming staff. In the exchange, records officials within the Bureau of Administration wondered whether there was an electronic method that could be used to capture the Secretary’s emails because they were “not comfortable” advising the new administration to print and file email records.
Limited Ability To Retrieve Email Records: Even when emails are printed and filed, they are generally not inventoried or indexed and are therefore difficult to retrieve. As an illustration, almost 3,000 boxes, each filled with hundreds of pages of documents, would have to be reviewed manually, on a page-by-page basis, in order to identify and review all printed and filed emails from the Office of the Secretary since 1997. To help alleviate this problem, the Office of the Secretary could have adopted an electronic email management system in 2009 with the introduction of SMART. SMART allows users to designate specific emails sent or received through the Department’s email system as record emails; other SMART users can search for and access record emails, depending on the access controls set by the individual who originally saved the email. However, prior OIG reports have repeatedly found that Department employees enter relatively few of their emails into the SMART system and that compliance varies greatly across bureaus, in part because of perceptions by Department employees that SMART is not intuitive, is difficult to use, and has some technical problems.

p 14

Department senior officials discussed the Department’s obligations under the Federal Records Act in the context of personal email accounts. As discussed earlier in this report, laws and regulations did not prohibit employees from using their personal email accounts for the conduct of official Department business.

pp 17-18

In another instance, in a June 3, 2011, email message to Secretary Clinton with the subject line “Google email hacking and woeful state of civilian technology,” a former Director of Policy Planning wrote: “State’s technology is so antiquated that NO ONE uses a State-issued laptop and even high officials routinely end up using their home email accounts to be able to get their work done quickly and effectively.”

p 20

Secretary Powell (January 20, 2001 – January 26, 2005): During Secretary Powell’s tenure, the Department introduced for the first time unclassified desktop email and access to the Internet on a system known as OpenNet, which remains in use to this day. Secretary Powell did not employ a Department email account, even after OpenNet’s introduction. He has publicly written:
To complement the official State Department computer in my office, I installed a laptop computer on a private line. My personal email account on the laptop allowed me direct access to anyone online. I started shooting emails to my principal assistants, to individual ambassadors, and increasingly to my foreign-minister colleagues ….
OIG identified emails sent from and received by Secretary Powell’s personal account in selected records associated with Secretary Powell. During his interview with OIG, Secretary Powell stated that he accessed the email account via his personal laptop computer in his office, while traveling, and at his residence, but not through a mobile device. His representative advised the Department that Secretary Powell “did not retain those emails or make printed copies.” Secretary Powell also stated that neither he nor his representatives took any specific measures to preserve Federal records in his email account. Secretary Powell’s representative told OIG that she asked Department staff responsible for recordkeeping whether they needed to do anything to preserve the Secretary’s emails prior to his departure, though she could not recall the names or titles of these staff. According to the representative, the Department staff responded that the Secretary’s emails would be captured on Department servers because the Secretary had emailed other Department employees.

p 21

NARA agrees with the foregoing assessment but told OIG that Secretary Clinton’s production of 55,000 pages of emails mitigated her failure to properly preserve emails that qualified as Federal records during her tenure and to surrender such records upon her departure.

p 23