Freedom of Information Act: Agencies Are Implementing Requirements but Additional Actions Are Needed

FOIA requires federal agencies to provide the public with access to government records and information based on the principles of openness and accountability in government. Each year, individuals and entities file hundreds of thousands of FOIA requests. In the last 9 fiscal years, federal agencies subject to FOIA have received about 6 million requests.

GAO was asked to review federal agencies' compliance with FOIA requirements. Our objectives, among others, were to (1) determine the extent to which agencies have implemented selected FOIA requirements; (2) describe the methods established by agencies to reduce backlogged requests and the effectiveness of those methods; and (3) identify any statutory exemptions that have been used by agencies as the basis for withholding (redacting) information from requesters.

To do so, GAO selected 18 agencies based on their size and other factors and assessed their policies against six FOIA requirements. GAO also reviewed the agencies' backlog reduction plans and developed a catalog of statutes that agencies have used to withhold information.

All 18 selected agencies had implemented three of six Freedom of Information Act (FOIA) requirements reviewed. Specifically, all agencies had updated response letters to inform requesters of the right to seek assistance from FOIA public liaisons, implemented request tracking systems, and provided training to FOIA personnel. For the three additional requirements, 15 agencies had provided online access to government information, such as frequently requested records, 12 agencies had designated chief FOIA officers, and 12 agencies had published and updated their FOIA regulations on time to inform the public of their operations. Until these agencies address all of the requirements, they increase the risk that the public will lack information that ensures transparency and accountability in government operations.

The 18 selected agencies had backlogs of varying sizes, with 4 agencies having backlogs of 1,000 or more requests during fiscal years 2012 through 2016. These 4 agencies reported using best practices identified by the Department of Justice, such as routinely reviewing metrics, as well as other methods, to help reduce their backlogs. Nevertheless, these agencies' backlogs fluctuated over the 5-year period (see figure). The 4 agencies with the largest backlogs attributed challenges in reducing their backlogs to factors such as increases in the number and complexity of FOIA requests. However, these agencies lacked plans that described how they intend to implement best practices to reduce backlogs. Until agencies develop such plans, they will likely continue to struggle to reduce backlogs to a manageable level.

Agencies used various types of statutory exemptions to withhold information when processing FOIA requests during fiscal years 2010 to 2016. The majority of these fell into the following categories: personally identifiable information, national security, law enforcement and investigations, and confidential and commercial business information.

GAO is making recommendations to 16 agencies to post records online, designate chief FOIA officers, update regulations, and develop plans to reduce backlogs. Nine agencies agreed with the recommendations, 1 both agreed and disagreed, 2 disagreed, and 4 neither agreed nor disagreed. GAO continues to believe the recommendations are valid.

The Freedom of Information Act (FOIA), which was enacted into law more  than 50 years ago, requires federal agencies to provide the public with  access to government records and information based on the principles of  openness and accountability in government. Each year, individuals and  entities file hundreds of thousands of FOIA requests for information on  numerous topics that contribute to the understanding of government  actions. These topics have included, among others, the disclosure of  waste, fraud, and abuse; conditions such as unsafe consumer products  and harmful drugs; as well as information related to the government’s  assistance to corporations during the U.S. financial crisis of 2008. In the  last 9 fiscal years, agencies subject to FOIA have reported receiving  about 6 million requests.

Given the significance of FOIA, Congress has had a longstanding interest  in the manner in which the act is being implemented, including the extent  to which federal agencies respond to FOIA requests, the timeliness of the  responses, and the number and nature of exemptions claimed by  agencies in withholding requested information. Since 1978, we have  issued a number of reports that have addressed various aspects of  federal agencies’ efforts to implement the act.

At your request, we reviewed federal agencies’ compliance with FOIA  requirements, backlogs, use of exemptions, and FOIA requests related to  the 2008 financial crisis. Our specific objectives were to (1) determine the  extent to which agencies have implemented selected FOIA requirements;  (2) describe the methods established by agencies to reduce backlogged  requests and the effectiveness of those methods; (3) identify any  statutory (b)(3) exemptions that have been used by agencies as the basis  for withholding (redacting) information; and (4) determine what FOIA  requests, if any, agencies received and processed that related to entities  that received government assistance amounting to 50 percent or more  ownership by the federal government during the 2008 financial crisis.

To address the first and second objectives, we reviewed the FOIA-related  actions of a nonprobability sample of 18 federal agencies. We identified  these agencies by considering: the number of FOIA requests received,  the sizes of FOIA backlogs, and the average time for processing FOIA  requests for fiscal years 2012 through 2016. We also chose the agencies  to represent a range of sizes (by number of employees)—large (10,000 or  more), medium (1,000 to 9,999), and small (999 or fewer). Table 1 lists  the selected agencies by size.

For the first objective, we reviewed six FOIA requirements outlined in the  FOIA Improvement Act of 2016 and the OPEN Government Act of 2007.  These specific requirements call for agencies to (1) update response  letters, (2) implement tracking systems, (3) provide FOIA training, (4),  provide records online, (5) designate chief FOIA officers, and (6) update  and publish timely and comprehensive regulations.

We then obtained and reviewed available documentation from the 18  selected agencies describing their decisions and actions related to the  requirements. This documentation included policies pertaining to the  processing and tracking of FOIA requests and appeals, the methods used  to communicate with requesters, and any related training offered to  personnel involved in processing FOIA requests. We compared the  agencies’ documentation to FOIA implementation guidance issued by the  Department of Justice (Justice). We also interviewed relevant officials at  each selected agency.

In addition, we interviewed officials of the Office of Management and  Budget (OMB) and Justice’s Office of Information Policy (OIP) to discuss  the status of efforts to develop a government-wide FOIA request portal,  as required by the 2016 amendments to FOIA. We also met with  members of the Chief FOIA Officers Council, as well as officials in  Justice’s OIP and the National Archives and Records Administration’s  (NARA) Office of Government Information Services (OGIS) to determine  what, if any, actions these agencies have taken to assist FOIA-reporting  agencies with complying with the requirements of the 2016 amendments  to FOIA. The findings related to our first objective are not generalizable to  the 117 FOIA reporting agencies.

For the second objective, we first reviewed requirements for agencies to  produce backlog reduction plans, as outlined in Justice’s annual chief  FOIA officer report guidance and OMB’s Open Government Directive of  2009. We then determined whether agencies had developed such plans  as required, by interviewing relevant agency personnel and reviewing  existing plans. Further, we analyzed data on Justice’s FOIA.gov website  to identify any instances of a reported reduction in an agency’s FOIA  backlog when the agency had a backlog reduction plan in place.

To assess the reliability of the data we retrieved from FOIA.gov, we  interviewed knowledgeable officials in Justice’s OIP and electronically  tested the data for outliers, missing values, and syntactical discrepancies.  We found the data to be sufficiently reliable for the purposes of reporting  agencies’ total FOIA requests and FOIA backlogs in fiscal years 2012  through 2016  We also compared best practices for reducing backlogs, as identified by  Justice’s OIP, with each agency’s procedures to determine the extent to  which the practices were being used. In addition, we interviewed relevant  officials at each selected agency to determine the reasons for any  changes in the number of backlogged requests at the agency and what  actions the agency was taking to reduce its backlog or implement  reduction plans. The findings from our second objective are not  generalizable to the 117 FOIA reporting agencies.

To address the third objective, determining the exemptions that have  been used by agencies as the basis for withholding (redacting)  information, we developed a catalog of (b)(3) statutes that agencies  previously have used, or reasonably could have used, to withhold  information in FOIA records under the (b)(3) exemption. To develop the  catalog, we compiled a list of (b)(3) exemptions, along with the number of  times each exemption was used by at least 1 of 117 agencies for which  annual FOIA report data covering fiscal years 2010 through 2016 were  available on Justice’s FOIA.gov website. We refined our list of agencies  that used (b)(3) exemptions by standardizing the statutes’ citations to  ensure they consistently referred to existing U.S. Code sections.

Further, to create our catalog we (1) categorized each (b)(3) statute  based on the general subject matter (2) identified the number of times  each exemption was used by agencies, and (3) determined the date of  the most recent legislative action for each statute to identify which  statutes were subject to a 2009 amendment to the (b)(3) exemption. To  assess the reliability of the data we retrieved from FOIA.gov, we  electronically tested the data for outliers, missing values, and syntactical  discrepancies. We also interviewed relevant agency officials at Justice to  discuss their actions to ensure the consistency of the data presented in  FOIA.gov on agencies’ uses of FOIA (b)(3) exemptions. We found the  data to be sufficiently reliable for the purposes of this objective.

For the fourth objective, we reviewed reports that discussed entities that  received Troubled Asset Relief Program (TARP) assistance during the  2008 financial crisis, such as the Department of Treasury’s (Treasury)  Monthly Reports to Congress (dated October 2008 and November  2014), and relevant prior GAO reports. Our work focused on identifying  those entities in which Treasury held 50 percent or more of the entity’s  common stock and the dates during which Treasury held that stock. As a  result of this review, we identified three corporations in which Treasury  held 50 percent or more of the entities’ common stock during certain  periods between 2008 through 2014. These three corporations were the  American International Group (AIG), General Motors (GM), and General  Motors Acceptance Corporation (Ally). We also interviewed cognizant  agency officials at the Department of the Treasury.

In addition to Treasury, we identified three other agencies that received  FOIA requests related to the identified entities—the Federal Deposit  Insurance Corporation (FDIC), Federal Reserve Board, and the Office of  the Comptroller of Currency and reviewed their handling of FOIA requests  relating to AIG, Ally, and GM during the calendar years that Treasury  held 50 percent or more common stock (2008 through 2014). In this  regard, we reviewed the requests to determine (1) the number of requests  received, (2) the resolution of the requests, and (3) the length of time it  took the agency to respond. Lastly, we interviewed relevant agency  officials at each of the four selected agencies to better understand if and  how FOIA requests were received and processed.

We conducted this performance audit from January 2017 to June 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. A more detailed discussion of  our objectives, scope, and methodology is provided in appendix I.

The Freedom of Information Act establishes a legal right of access to  government information on the basis of the principles of openness and  accountability in government. Before FOIA’s enactment in 1966, an  individual seeking access to federal records faced the burden of establishing a “need to know” before being granted the right to examine a  federal record. FOIA established a “right to know” standard, under which  an organization or person could receive access to information held by a  federal agency without demonstrating a need or reason. The “right to  know” standard shifted the burden of proof from the individual to a  government agency and required the agency to provide proper  justification when denying a request for access to a record.

Any person, defined broadly to include attorneys filing on behalf of an  individual, corporations, or organizations, can file a FOIA request. For  example, an attorney can request labor-related workers’ compensation  files on behalf of his or her client, and a commercial requester, such as a  data broker who files a request on behalf of another person, may request  a copy of a government contract. In response, an agency is required to  provide the relevant record(s) in any readily producible form or format  specified by the requester, unless the record falls within a permitted  exemption that provides limitations on the disclosure of information.  Appendix II includes a table describing the nine specific exemptions that  can be applied to withhold information that, for example, is classified,  confidential commercial, privileged, privacy, or falls into one or several  law enforcement categories.

FOIA Amendments and Guidance Call for Improvements in How Agencies Process Requests

Various amendments have been enacted and guidance issued to help  improve agencies’ processing of FOIA requests, including:

The Electronic Freedom of Information Act Amendments of 1996 (e- FOIA amendments) strengthened the requirement that federal  agencies respond to a request in a timely manner and reduce their  backlogged requests. The amendments, among other things, made  a number of procedural changes, including allowing a requester to  limit the scope of a request so that it could be processed more quickly  and requiring agencies to determine within 20 working days whether a  request would be fulfilled. This was an increase from the previously  established time frame of 10 business days.

The amendments also authorized agencies to multi-track requests— that is, to process simple and complex requests concurrently on  separate tracks to facilitate responding to a relatively simple request  more quickly. In addition, the amendment encouraged online, public  access to government information by requiring agencies to make  specific types of records available in electronic form.

Executive Order 13392, issued by the President in 2005, directed  each agency to designate a senior official as its chief FOIA officer.  This official was to be responsible for ensuring agency-wide  compliance with the act by monitoring implementation throughout the  agency and recommending changes in policies, practices, staffing,  and funding, as needed. The chief FOIA officer was directed to review  and report on the agency’s performance in implementing FOIA to  agency heads and to Justice in such times and formats established by  the Attorney General. (These are referred to as chief FOIA officer  reports.)

The OPEN Government Act, which was enacted in 2007, made the  2005 executive order’s requirement for agencies to have a chief FOIA  officer a statutory requirement. It also required agencies to include  additional statistics in their annual FOIA reports, such as more details  on processing times and the agency’s 10 oldest pending requests,  appeals, and consultations.

The FOIA Improvement Act of 2016 addressed procedural issues,  including requiring that agencies: (1) make records available in an  electronic format if they have been requested three or more times; (2)  notify requesters that they have a maximum of 90 days to file an  administrative appeal, and (3) provide dispute resolution services at  various times throughout the FOIA process. This act also created  more duties for chief FOIA officers, including requiring them to offer  training to agency staff regarding FOIA responsibilities. The act also  revised and added new obligations for OGIS, and created the Chief  FOIA Officers Council to assist in compliance and efficiency. Further,  the act required OMB, in consultation with Justice, to create a  consolidated online FOIA request portal that allows the public to  submit a request to any agency through a single website.

FOIA Authorizes Agencies to Use Other Federal Statutes to Withhold Information Prohibited from Disclosure

In responding to requests, FOIA authorizes agencies to utilize one of nine  exemptions to withhold portions of records, or the entire record. Agencies  may use an exemption when it has been determined that disclosure of the  requested information would harm an interest related to certain protected  areas. These nine exemptions (described in appendix II) can be applied  by agencies to withhold various types of information, such as information  concerning foreign relations, trade secrets, and matters of personal  privacy.

One such exemption, the statutory (b)(3) exemption, specifically  authorizes withholding information under FOIA on the basis of a law  which:  requires that matters be withheld from the public in such a manner as  to leave no discretion on the issue; or establishes particular criteria for withholding or refers to particular  types of matters to be withheld; and  if enacted after October 28, 2009, specifically refers to section  552(b)(3) of title 5, United States Code.

To account for agencies use of the statutory (b)(3) exemptions, FOIA  requires each agency to submit, in its annual report to Justice, a complete  listing of all statutes that the agency relied on to withhold information  under exemption (b)(3). The act also requires that the agency describe for  each statute identified in its report (1) the number of occasions on which  each statute was relied upon; (2) a description of whether a court has  upheld the decision of the agency to withhold information under each  such statute; and (3) a concise description of any information withheld.

Further, to provide an overall summary of the statutory (b)(3) exemptions  used by agencies in a fiscal year, Justice produces consolidated annual  reports that list the statutes used by agencies in conjunction with (b)(3).

As previously noted, agencies are generally required by the e-FOIA  amendments of 1996 to respond to a FOIA request within 20 working  days. Once received, the request is to be processed through multiple  phases, which include assigning a tracking number, searching for  responsive records, and releasing the records response to the requester.

Also, FOIA allows a requester to challenge an agency’s final decision on  a request through an administrative appeal or a lawsuit. Agencies  generally have 20 working days to respond to an administrative appeal.

Figure 1 provides a simplified overview of the FOIA request and appeals  process.

In a typical agency, as indicated, during the intake phase, a request is  logged into the agency’s FOIA tracking system, and a tracking number is  assigned. The request is then reviewed by FOIA staff to determine its  scope and level of complexity. The agency then sends a letter or email  to the requester acknowledging receipt of the request, with a unique tracking number that the requester can use to check the status of the  request.

Next, FOIA staff (noncustodian) begin the search to retrieve the  responsive records. They conduct a search if the agency’s records are  centralized or route the request to the appropriate program office(s), or do  both, as warranted. This step may include requesting that the custodian  (owner) of the record search and review paper and electronic records  from multiple locations and program offices.

Agency staff then process the responsive records, which includes  determining whether a portion or all of any record should be withheld  based on FOIA’s exemptions. If a portion or all of any record is the  responsibility of another agency, FOIA staff may consult with the other  agency or may send (“refer”) the document(s) to that other agency for  processing. After processing and redaction, a request is reviewed for  errors and to ensure quality. The documents are then released to the  requester, either electronically or by regular mail.

Responsibility for the oversight of FOIA implementation is spread across  several federal offices and other entities. These include Justice’s OIP,  NARA’s OGIS, and the Chief FOIA Officers Council. These oversight  offices and the council have taken steps to assist agencies to address the  FOIA provisions.

Justice’s OIP is responsible for encouraging agencies’ compliance with  FOIA and overseeing their implementation of the act. In this regard, the  office, among other things, provides guidance, compiles information on  FOIA compliance, provides FOIA training, and prepares annual summary  reports on agencies’ FOIA processing and litigation activities. The office  also offers FOIA counseling services to government staff and the public.

Issuing guidance. OIP has developed guidance, available on its  website, to assist federal agencies by instructing them in how to  ensure timely determinations on requests, expedite the processing of  requests, and reduce backlogs. The guidance also informs agencies  on what should be contained in their annual FOIA reports to Justice’s  Attorney General.

The office also has documented ways for federal agencies to address  backlog requests. In March 2009 the Attorney General issued  guidance and related policies to encourage agencies to reduce their  backlogs of FOIA requests. In addition, in December 2009, OMB  issued a memorandum on the OPEN Government Act, which called  for a reduction in backlogs and the publishing of plans to reduce  backlogs. Further, in August 2014 and December 2015, OIP held best  practices workshops and issued guidance to agencies on reducing  FOIA backlogs and improving timeliness of agencies’ responses to  FOIA requests. The OIP guidance instructed agencies to obtain  leadership support, routinely review FOIA processing metrics, and set  up staff training on FOIA.

Overseeing agencies’ compliance. OIP collects information on  compliance with the act by reviewing agencies’ annual FOIA reports  and chief FOIA officer reports. These reports describe the number of  FOIA requests received and processed in a fiscal year, as well as the  total costs associated with processing and litigating requests.

Providing training. OIP provides a full suite of FOIA training for  agency FOIA professionals. This training gives instruction on all  aspects of FOIA and is designed for all levels of professionals. For  example, the office offers an annual training class that provides a  basic overview of the act, as well as hands-on courses about the  procedural requirements involved in processing a request from start to  finish. In addition, it offers a seminar outlining successful litigation  strategies for attorneys who handle FOIA cases. OIP also provides  agencies customized training upon request.

Preparing annual reports. Every year, OIP prepares three major  reports for the public, the President, and/or Congress. The first report,  Summary of Annual FOIA Reports, is a summary of the information  contained in the annual FOIA reports that are prepared by each of the  federal agencies subject to the FOIA. The report also provide a  statistical breakdown of the government’s overall FOIA administration.  The second report, Summary of Agency Chief FOIA Officer Reports,  is a summary of the annual chief FOIA officer reports and an  assessment of agencies’ progress in administering FOIA. This report  summarizes government-wide efforts to improve FOIA in five key  areas of FOIA administration, and it individually scores each agency  on several milestones tied to these efforts. The third report, the  Justice FOIA Litigation and Compliance Report, which is directed to  Congress and the President, describes Justice’s efforts to oversee  and encourage government-wide compliance with FOIA, and includes  a list of, and information about, FOIA matters in litigation.

NARA’s OGIS was established by the OPEN Government Act of 2007 as  the federal FOIA ombudsman tasked with resolving federal FOIA disputes  through mediation as a nonexclusive alternative to litigation. OGIS’s  responsibilities include reviewing agencies’ policies, procedures, and  compliance with the statute; identifying methods to improve compliance;  and educating its stakeholders about the FOIA process.

The 2016 FOIA amendments required agencies to update response  letters to FOIA requesters to include information concerning the roles of  OGIS and agency’s FOIA public liaisons. As such, OGIS and Justice  worked together to develop a response letter template that includes the  required language for agency letters. In addition, OGIS, charged with  reviewing agency’s compliance with FOIA, launched a FOIA compliance  program in 2014. OGIS also developed a FOIA compliance self- assessment program, which is intended to help OGIS look for potential  compliance issues across federal agencies.

The Chief FOIA Officers Council is co-chaired by the Director of OIP  and the Director of OGIS. Council members include senior  representatives from OMB, OIP, and OGIS, together with the chief FOIA  officers of each agency, among others. The council’s FOIA-related  responsibilities include: developing recommendations for increasing FOIA compliance and disseminating information about agency experiences, ideas, best  practices, and innovative approaches;  identifying, developing, and coordinating initiatives to increase  transparency and compliance; and promoting the development and use of common performance  measures for agency compliance.

Selected Agencies Collect and Maintain Records That Can Be Subject to FOIA Requests

The 18 agencies selected for our review are charged with a variety of  operations that affect many aspects of federal service to the public. Thus,  by the nature of their missions and operations, the agencies have  responsibility for vast and varied amounts of information that can be  subject to a FOIA request. For example, the Department of Homeland  Security’s (DHS) mission is to protect the American people and the  United States homeland. As such, the department maintains information  covering, among other things, immigration, border crossings, and law  enforcement. As another example, the Department of the Interior’s (DOI)  mission includes protecting and managing the nation’s natural resources  and, thus, providing scientific information about those resources. Table 2  provides details on each of the 18 selected agencies’ missions and the  types of information they maintain.

The 18 selected agencies reported that they received and processed  more than 2 million FOIA requests from fiscal years 2012 through 2016.  Over this 5-year period, the number of reported requests received  fluctuated among the agencies. In this regard, some agencies saw a  continual rise in the number of requests, while other agencies  experienced an increase or decrease from year to year. For example,  from fiscal years 2012 through 2014, DHS saw an increase in the number  of requests received (from 190,589 to 291,242), but in fiscal year 2015,  saw the number of requests received decrease to 281,138. Subsequently,  in fiscal year 2016, the department experienced an increase to 325,780  requests received.

In addition, from fiscal years 2012 through 2015, the reported numbers of  requests processed by the selected agencies showed a relatively steady  increase. However, in fiscal year 2016, the reported number of requests  processed by these agencies declined. Further, figure 2 provides a  comparison of the total number of requests received and processed in  this 5-year period.

Selected Agencies Implemented the Majority of FOIA Requirements Reviewed

Among other things, the FOIA Improvement Act of 2016 and the OPEN  Government Act of 2007 call for agencies to (1) update response letters,  (2) implement tracking systems, (3) provide FOIA training, (4), provide  records online, (5) designate chief FOIA officers, and (6) update and  publish timely and comprehensive regulations. The 18 agencies that we  included in our review had implemented the majority of the 6 selected  FOIA requirements. Specifically,

16 agencies implemented tracking that was compliant with  requirements for people with disabilities

18 agencies provided FOIA training for agency staff

13 agencies designated chief FOIA officers, and

5 agencies published their updated FOIA regulations by the required  due date, and 8 agencies did so after the due date.

Figure 3 summarizes the extent to which the 18 agencies implemented  the selected FOIA requirements.

Beyond these selected agencies, Justice’s OIP and OMB also had taken  steps to develop a government-wide FOIA request portal that is intended  to allow the public to submit a request to any agency from a single  website.

Selected Agencies Had Updated Their FOIA Response Letters

The 2016 amendments to FOIA required agencies to include specific  information in their responses when making their determinations on  requests. If part of a request is denied, for example, agencies must inform  requesters that they may seek assistance from the FOIA public liaison of the agency or OGIS,   file an appeal to an adverse determination within a period of time that  is not less than 90 days after the date of such adverse determination;  and seek dispute resolution services from the FOIA public liaison of the  agency or OGIS.

Among the 18 selected agencies, all had updated their FOIA response  letters to include this required information.

All Selected Agencies Had Implemented FOIA Tracking Systems and Most Were Compliant with Requirements for People with Disabilities

Various FOIA amendments and guidance call for agencies to use  automated systems to improve the processing and management of  requests. In particular, the OPEN Government Act of 2007 amended  FOIA to require that federal agencies establish a system to provide  individualized tracking numbers for requests that will take longer than 10  days to process and establish telephone or Internet service to allow  requesters to track the status of their requests.

Further, the President’s January 2009 Freedom of Information Act  memorandum instructed agencies to use modern technology to inform  citizens about what is known and done by their government. In addition,  FOIA processing systems, like all automated information technology  systems, are to comply with the requirements of Section 508 of the  Rehabilitation Act of 1973 (Rehabilitation act (as amended)). This act  requires federal agencies to make their electronic information accessible  to people with disabilities.

Each of the 18 selected agencies had implemented a system that  provides capabilities for tracking requests received and processed,  including an individualized number for tracking the status of a request.  Specifically,

Ten agencies used commercial automated systems, (DHS, EEOC,  FDIC, FTC, Justice, NARA, NASA, NTSB, Pension Benefit Guaranty  Corporation, and USAID).

Three agencies developed their own agency systems (State, DOI, and  TVA).

Five agencies used Microsoft Excel or Word to track requests  (Administrative Conference of the United States, American Battle  Monuments Commission, Broadcasting Board of Governors, OMB,  and U.S. African Development Foundation).

Further, all of the agencies had established telephone or Internet services  to assist requesters in tracking the status of requests; and they used  modern technology (e.g., mobile applications) to inform citizens about  FOIA. For example, the commercial systems allow requesters to submit a  request and track the status of that request online. In addition, DHS  developed a mobile application that allows FOIA requesters to submit  requests and check the status of existing requests.

However, while 16 agencies FOIA tracking systems were compliant with  requirements of Section 508 of the Rehabilitation Act (as amended), two  agencies—TVA and DOI—had systems that were not compliant.  According to TVA officials, the agency does not have a 508 compliance  certification. DOI officials stated that its FOIA system will undergo 508  compliance testing but did provide a date for completion of the testing.  Having systems that are compliant with Section 508 of the Rehabilitation  Act (as amended) is essential to ensure that the department’s electronic  information is accessible to all individuals, including those with disabilities.

Agencies’ Chief FOIA Officers Have Offered FOIA Training

The 2016 FOIA amendments require agencies’ chief FOIA officers to offer  training to agency staff regarding their responsibilities under FOIA. In  addition, Justice’s OIP has advised every agency to make such training  available to all of their FOIA staff at least once each year. The office has  also encouraged agencies to take advantage of FOIA training  opportunities available throughout the government.

The 18 selected agencies’ chief FOIA officers offered FOIA training  opportunities to staff in fiscal years 2016 and 2017. For example:

Twelve agencies provided training that gave an introduction and  overview of FOIA (the American Battle Monuments Commission,  Broadcasting Board of Governors, EEOC, Justice, FDIC, FTC, NARA,  Pension Benefit Guaranty Corporation, State, TVA, U.S. African  Development Foundation, and USAID).

Four agencies offered training for their agencies’ online FOIA tracking  and processing systems (DOI, EEOC, NTSB, and Pension Benefit  Guaranty Corporation).

Five agencies provided training on responding to, handling, and  processing FOIA requests (DHS, DOI, EEOC, Justice, and State).

Seven agencies offered training on understanding and applying the  exemptions under FOIA (the Broadcasting Board of Governors,  EEOC, FDIC, FTC, Justice, State, and U.S. African Development  Foundation).

Four agencies offered training on the processing of costs and fees  (EEOC, Justice, NASA and TVA).

The Majority of Selected Agencies Posted Required Records Online

Memorandums from both the President and the Attorney General in 2009  highlighted the importance of online disclosure of information and further  directed agencies to make information available without a specific FOIA  request. Further, FOIA required online access to government  information and required agencies to make information available to the  public in electronic form for four categories: agency final opinions and orders, administrative staff manuals and staff instructions that affect the  frequently requested records.

While all 18 agencies that we reviewed posted records online, only 15 of  them had posted all categories of information, as required by the FOIA.  Specifically, 7 agencies—the American Battle Monuments Commission,  the Pension Benefit Guaranty Corporation, and EEOC, FDIC, FTC,  Justice, and State—had, as required, made records in all four categories  publicly available online. In addition, 5 agencies that were only required to  publish online records in 3 categories—the Administrative Conference of  the United States, Broadcasting Board of Governors, DHS, OMB, and  USAID— had done so. Further, 3 agencies that were only required to  publish online records in two of the categories—U.S. African  Development Foundation, NARA, and TVA—had done so. The remaining  3 agencies—DOI, NASA, and NTSB—had posted records online for three  of four required categories.

Regarding why the three agencies did not post all of their four required  categories of online records, DOI officials stated that the agency does not  make publicly available all FOIA records that have been requested three  or more times, as it does not have the time to post all such records that  have been requested. NASA officials explained that, while the agency  issues final opinions, it does not post them online. NTSB officials said  they try to post information that is frequently requested, but they do not  post the information on a consistent basis.

Making the four required categories of information available in electronic  form is an important step in allowing the public to easily access to  government documents. Until these agencies make all required  categories of information available in electronic form, they cannot ensure  that they are providing the required openness in government.

Most Agencies Designated a Senior Official as a Chief FOIA Officer

In 2005, the President issued an executive order that established the role  of a chief FOIA officer. In 2007, amendments to FOIA required each  agency to designate a chief FOIA officer who shall be a senior official at  the assistant secretary or equivalent level.

Of the 18 selected agencies, 13 agencies have chief FOIA officers who  are senior officials at the assistant secretary or equivalent level. The  assistant secretary level is comparable to senior executive level positions  at levels III, IV, and V. Specifically,

State has designated its Assistant Secretary of Administration, Bureau

DOI and NTSB had designated their Chief Information Officers;

Administrative Conference of the United States, Broadcasting Board  of Governors, FDIC, NARA, and U.S. African Development  Foundation have designated their general counsels;   Justice, NASA, TVA, and USAID designated their Associate Attorney  General, Associate Administrator for Communications, the Vice  President for Communications, and the Assistant Administrator for the  Bureau of Management, respectively; and

DHS designated its Chief Privacy Officer.

However, 5 agencies—American Battle Monuments Commission, EEOC,  Pension Benefit Guaranty Corporation, FTC, and OMB—do not have  chief FOIA officers who are senior officials at the assistant secretary or  equivalent level. According to officials from 4 of these agencies, the  agencies all have chief FOIA officers and officials believed they had  designated the appropriate officials. Officials at FTC acknowledged that  the chief FOIA officer position is not designated at a level equivalent to an  assistant secretary but a senior position within the agency. However,  while there are chief FOIA officers at these agencies, until the chief FOIA  officers are designated at the Assistant Secretary or equivalent level, they  will lack assurance regarding the necessary authority to make decisions  about agency practices, personnel, and funding.

Most Selected Agencies Updated Regulations as Required to Inform the Public of Their FOIA Operations

FOIA requires federal agencies to publish regulations in the Federal  Register that inform the public of their FOIA operations. Specifically, in  2016, FOIA was amended to require agencies to update their regulations  regarding their FOIA operations. To assist agencies in meeting this  requirement, OIP created a FOIA regulation template. Among other  things, OIP’s guidance encouraged agencies to: describe their dispute resolution process, describe their administrative appeals process for response letters of  denied requests, notify requesters that they have a minimum of 90 days to file an  include a description of what happens when there are unusual  circumstances, as well as restriction on agencies’ abilities to charge  certain fees when FOIA's times limits are not met;  and update the regulations in a timely manner (i.e., update regulations by  180 days after the enactment of the 2016 FOIA amendment).

Five agencies in our review—DHS, DOI, FDIC, FTC, and USAID— addressed all five requirements in updating their regulations. In addition,  seven agencies addressed four of the five requirements: the  Administrative Conference of the United States, EEOC, Justice, NARA,  NTSB, Pension Benefit Guaranty Corporation, and TVA did not update  their regulations in a timely manner.

Further, four agencies addressed three or fewer requirements (U.S.  African Development Foundation, State, NASA, and Broadcasting Board  of Governors) and two agencies (American Battle Monuments  Commission and OMB) did not address any of the requirements. Figure 4  indicates the extent to which the 18 agencies had addressed the five  selected requirements.

Agencies that did not address all five requirements provided several  explanations as to why their regulations were not updated as required:

American Battle Monuments Commission officials stated that while  they updated their draft regulation in August 2017, it is currently  unpublished due to internal reviews with the commission’s General  Counsel in preparation for submission to the Federal Register. No  new posting date has been established. American Battle Monuments  Commission last updated its regulation in February 26, 2003.

State officials noted that their regulation was updated 2 months prior  to the new regulation requirements but did not provide a specific  reason for not reissuing their regulation. As such, they explained that  they have a working group reviewing their regulation for updates, with  no timeline identified. State last updated its regulation on April 6,  2016.

NASA officials did not provide a reason for not updating their  regulation as required. Officials did, however, state that their draft  regulation is with NASA’s Office of General Counsel for review. NASA  last updated its regulations on August 11, 2017.

Broadcasting Board of Governors officials did not provide a reason for  not updating their regulation as required. Officials did, however, note  that the agency is in the process of updating its regulation and  anticipates it will complete this update by the end of 2018. The  Broadcasting Board of Governors last updated its regulation on  February 2, 2002.

OMB officials did not provide a reason for not updating the agency’s  regulation as required. Officials did, however, state that due to a  change in leadership they do not have a time frame for updating their  regulation. OMB last updated its regulation on May 27, 1998.

The chief FOIA officer at the U.S. African Development Foundation  stated that, while the agency had updated and submitted its regulation  to be published in December 2016, the regulation was unpublished  due to an error that occurred with the acknowledgement needed to  publish the regulation in the Federal Register. The regulation was  subsequently published on February 3, 2017. The official further noted  that when the agency responds to FOIA requests, it has not charged a  fee for unusual circumstances, and, therefore, agency officials did not  believe they had to disclose information regarding fees in their  regulation.

Until these six agencies publish updated regulations that address the  necessary requirements, as called for in FOIA and OIP guidance, they  likely will be unable to provide the public with required regulatory and  procedural information to ensure transparency and accountability in the  government.

Justice and OMB Have Taken Steps to Develop an Online FOIA Request Portal

The 2016 FOIA amendments required OMB to work with Justice to build a  consolidated online FOIA request portal. This portal is intended to allow  the public to submit a request to any agency from a single website and  include other tools to improve the public’s access to the benefits of FOIA.  Further, the act required OMB to establish standards for interoperability  between the consolidated portal and agency FOIA systems. The 2016  FOIA amendments did not provide a time frame to develop the portal and  standards.

With OMB's support, Justice has developed an online portal. In this  regard, Justice’s OIP officials stated that the National FOIA Portal  provides the functionality required by FOIA, including the ability to make a  request to any agency and the technical framework for interoperability.  According to OIP officials, in partnership with OMB, OIP was able to  identify a dedicated funding source to operate and maintain the portal to  ensure its success in the long term, with major agencies sharing in the  costs to operate, maintain, and fund any future enhancements designed  to improve FOIA processes. The first iteration of the National FOIA Portal  launched on Justice’s FOIA.gov website on March 8, 2018.

Agencies Have Methods to Reduce Backlogged Requests, but Their Efforts Have Shown Mixed Results

The 18 selected agencies in our review had FOIA request backlogs of  varying sizes, ranging from no backlogged requests at some agencies to  45,000 or more of requests at other agencies. Generally, the agencies  with the largest backlogs had received the most requests. In an effort to  aid agencies in reducing their backlogs, Justice’s OIP identified key  practices that agencies can use. However, while the agencies reported  using these practices and other methods, few of them managed to reduce  their backlogs during the period from fiscal year 2012 through 2016. In  particular, of the four agencies with the largest backlogs, only one— NARA—reduced its backlog. Agencies attributed their inability to  decrease backlogs to the increased number and complexity of requests,  among other factors. However, agencies also lack comprehensive plans  to implement practices on an ongoing basis.

Agencies Have FOIA Request Backlogs of Varying Sizes, and Most Increased from Fiscal Year 2012 through 2016

The selected agencies in our review varied considerably in the size of  their FOIA request backlogs. Specifically, from fiscal year 2012 through  2016, of the 18 selected agencies

10 reported a backlog of 60 or fewer requests, and of these 10  agencies, 6 reported having no backlog in at least 1 year.

4 agencies had backlog numbers between 61 and 1,000 per year; and

4 agencies had backlogs of over 1,000 requests per year.

The four agencies with backlogs of more than 1,000 requests for each  year we examined were Justice, NARA, State and DHS. Table 3 shows  the number of requests and the number of backlogged request for the 18  selected agencies during the 5-year period.

Over the 5-year period, 14 of the 18 selected agencies experienced an  increase in their backlogs in at least 1 year. By contrast, 2 agencies  (Administrative Conference of the United States and the U.S. African  Development Foundation) reported no backlogs, and 3 agencies  (American Battle Monument Commission, NASA and NARA) reported  reducing their backlogs. Further, of the 4 agencies with the largest  backlogs (DHS, State, Justice, and NARA) only NARA reported a backlog  lower in fiscal year 2016 than in fiscal year 2012. Figure 5 shows the  trends for the 4 agencies with the largest backlogs, compared with the  rest of the 18 agencies.

In most cases, agencies with small or no backlogs (60 or fewer) also  received relatively few requests. For example, the Administrative  Conference of the United States and the U.S. African Development  Foundation reported no backlogged requests during any year but also  received fewer than 30 FOIA requests a year. The American Battle  Monuments Commission also received fewer than 30 requests a year and  only reported 1 backlogged request per year in 2 of the 5 years  examined. However, the Pension Benefit Guaranty Corporation and FDIC  received thousands of requests over the 5-year period, but maintained  zero backlogs in a majority of the years examined. PBGC received a total  of 19,120 requests during the 5-year period and only reported a backlog  of 8 requests during 1 year, fiscal year 2013. FDIC received a total of  3,405 requests during the 5-year period and reported a backlog of 13  requests in fiscal year 2015 and 4 in fiscal year 2016.

The four agencies with backlogs of 1,000 or more (Justice, NARA, State,  and DHS) received significantly more requests each year. For example,  NARA received between about 12,000 and 50,000 requests each year,  while DHS received from about 190,000 to 325,000 requests. In addition,  the number of requests NARA received in fiscal year 2016 was more than  double the number received in fiscal year 2012. DHS received the most  requests of any agency—a total of 1,320,283 FOIA requests over the 5- year period.

Agencies Identified a Variety of Methods to Reduce Backlogs, but Few Saw Reductions

The Attorney General’s March 2009 memorandum called on agency chief  FOIA officers to review all aspects of their agencies’ FOIA administration  and report to Justice on steps that have been taken to improve FOIA  operations and disclosure. Subsequent Justice guidance required  agencies to include in their chief FOIA officer reports information on their  FOIA request backlogs, including whether the agency experienced a  backlog of requests; whether that backlog decreased from the previous  year; and, if not, reasons the backlog did not decrease. In addition,  agencies that had more than 1,000 backlogged requests in a given year  were required to describe their plans to reduce their backlogs. Beginning  in calendar year 2015, these agencies were to describe how they  implemented their plans from the previous year and whether that resulted  in a backlog reduction.

In addition, Justice’s OIP identified best practices for reducing FOIA  backlogs. The office held a best practices workshop on reducing backlogs  and improving timeliness. The office then issued guidance in August 2014  that highlighted key practices to improve the quality of a FOIA program.  OIP identified the following methods in its best practices guidance.

Utilize resources effectively. Agencies should allocate their  resources effectively by using multi-track processing, making use of  available technology, and shifting priorities and staff assignments to  address needs and effectively manage workloads.

Routinely review metrics. Agencies should regularly review their  FOIA data and processes to identify challenges or barriers.

Additionally, agencies should identify trends to effectively allocate  resources, set goals for staff, and ensure needs are addressed.

Emphasize staff training. Agencies should ensure FOIA staff are  properly trained so they can process requests more effectively and  with more autonomy. Training and engagement of staff can also  solidify the importance of the FOIA office’s mission.

Obtain leadership support. Agencies should ensure that senior  management is involved in and supports the FOIA function in order to  increase awareness and accountability, as well as make it easier to  obtain necessary resources or personnel.

Agencies identified a variety of methods that they used to address their  backlogs. These included both the practices identified by Justice, as well  as additional methods.

Ten agencies maintained relatively small backlogs of 60 or fewer  requests and were thus not required to develop plans for reducing  backlogs. However, 2 of these 10 agencies, who both received significant  numbers of requests, described various methods used to maintain a  small backlog:

PBGC officials credit their success to training, not only for FOIA staff,  but all Incoming personnel, while also awarding staff for going above  and beyond in facilitating FOIA processing. Pension Benefit Guaranty  Corporation has incorporated all the best practices identified by OIP,  including senior leadership involvement that supports FOIA initiatives  and program goals, routine review of metrics to optimize workflows,  effective utilization of resources and staff training.

According to FDIC officials, their overall low backlog numbers are  attributed to a trained and experienced FOIA staff, senior  management involvement, and coordination among FDIC divisions.  However, FDIC stated the reason for the increase in backlogs in fiscal  year 2015 was due to increased complexity of requests.

The 4 agencies with backlogs greater than 60 but fewer than 1,000  (EEOC, DOI, NTSB, and USAID) reported using various methods to  reduce their backlogs. However, all 4 showed an increase over the 5-year  period.

EEOC officials stated that they had adopted practices recommended  by OIP, such as multi-track processing, reviewing workloads to ensure  sufficient staff, and using temporary assignments to address needs.  However, EEOC has seen a large increase in its backlog numbers,  going from 131 in fiscal year 2012 to 792 in fiscal year 2016. EEOC  attributed the rise in backlogs to an increase in requests received,  loss of staff, and the complex and voluminous nature of requests.

DOI, according to agency officials, has also tried to incorporate  reduction methods and best practices, including proactively releasing  information that may be of interest to the public, thus avoiding the  need for a FOIA request; enhanced training for its new online FOIA  tracking and processing system; improved interoffice collaboration;  production of monthly reports on backlogs and of weekly charts on  incoming requests, to heighten awareness among leadership; and  monitoring trends. Yet DOI has seen an increase in its backlog, from  449 in fiscal year 2012 to 677 in fiscal year 2016, an increase of 51  percent. DOI attributed the increase to the loss of FOIA personnel, an  increase in the complexity of requests, an increase in FOIA-related  litigation, an increase in incoming requests, and the fact that staff  have additional duties.

Officials at NTSB stated that the board utilized contractors and  temporary staff assignments to augment staffing and address  backlogs. Despite the effort, NTSB saw a large increase in backlogs,  from 62 in fiscal year 2012 to 602 in fiscal year 2016. Officials stated  that the reason for the increase was an increased complexity of  requests, including requests for “any and all” documentation related to  a specific subject, often involving hundreds to thousands of pages per  request.

According to USAID officials, the agency conducts and reviews  inventories of its backlog and requests to remove duplicates and  closed cases; groups and classifies requests by necessary actions  and responsive offices; and initiates immediate action. In addition,  USAID seeks to identify tools and solutions to streamline records for  review and processing. However, its backlog numbers have  continually increased, from 201 in fiscal year 2012 to 318 in fiscal year  2016. USAID attributes that increase to an increase in the number of  requests, the loss of FOIA staff, an increased complexity and volume  of requests, competing priorities, and world events that may drive  surges in requests.

Of the four agencies with the largest backlogs, all reported taking steps  that, in some cases, included best practices identified by OIP; however,  only NARA successfully reduced its backlog by the end of the 5-year  period.

Justice officials noted that the department made efforts to reduce its  backlog by incorporating best practices. Specifically, OIP worked with  components within Justice through the Component Improvement  Initiative to identify causes contributing to a backlog and assist  components in finding efficiencies and overcoming challenges. The  chief FOIA officer continued to provide top-level support to reduction  efforts by convening the department’s FOIA Council to manage  overall FOIA administration. In addition, many of the components  created their own reduction plans, which included hiring staff, utilizing  technology, and providing more training, requester outreach, and  multitrack processing.

However, despite these efforts, the number of backlogs steadily  increased during the 5-year period, from 5,196 in fiscal year 2012 to  10,644 in fiscal year 2016, an overall increase of 105 percent. Justice  attributes the increase in backlogs to several challenges, including an  increase in incoming requests and an increase in the complexity of  those requests. Other challenges that Justice noted were staff  shortages and turnover, reorganization of personnel roles, time to  train incoming staff, and the ability to fill positions previously held by  highly qualified professionals.

NARA officials stated that one key step NARA took was to make  corrections in its Performance Measurement and Reporting System.  They noted that this system previously comingled backlogged  requests with the number of pending FOIA requests, skewing the  backlog numbers higher. The improvements included better  accounting for pending and backlogged cases, distinguishing between  simple and complex requests, and no longer counting as “open” cases  that were closed within 20 days, but not until the beginning of the  following fiscal year. In addition, officials also stated that the FOIA  program offices have been successful at working with requesters to  narrow the scope of requests.

NARA also stated that it was conducting an analysis of FOIA across  the agency to identify any barriers in the process. Officials also  identified other methods, including using multi-track processing,  shifting priorities to address needs, improved communication with  agencies, proactive disclosures, and the use of mediation services.

NARA has shown significant progress in reducing its backlog. In fiscal  year 2012 it had a backlog of 7,610 requests, which spiked to 9,361 in  fiscal year 2014. However, by fiscal year 2016, the number of  backlogged requests had dropped to 2,932, even though the number  of requests received more than doubled for that fiscal year. However,  NARA did note challenges to reducing its backlog numbers, namely,  the increase in the number of requests received.

State developed and implemented a plan to reduce its backlog in  fiscal year 2016. The plan incorporated two best practices by focusing  on identifying the extent of the backlog problem and developing ways  to address the backlog with available resources. According to State  officials, the effort was dedicated to improve how FOIA data were  organized and reported. Expedited and ligation cases were top  priorities, whereas in other cases a “first in, first out” method was  employed.

Even with these efforts, however, State experienced a 117 percent  increase in its backlog over the 5-year period. State’s backlog doubled  from 10,045 in fiscal year 2014 to 22,664 in fiscal year 2016. Among  the challenges to managing its backlog, State reported an increase in  incoming requests, a high number of litigation cases, and competing  priorities. Specifically, the number of incoming requests for State  increase by 51 percent during the 5-year period. State has also  reported that it has allocated 80 percent of its FOIA resources to meet  court-ordered productions associated with litigation cases, resulting in  fewer staff to work on processing routine requests. This included,  among other efforts, a significant allocation of resources in fiscal year  2015 to meet court-imposed deadlines to process emails associated  with the former Secretary of State, resulting in a surge of backlogs.

In 2017 State began an initiative to actively address its backlogs. The  Secretary of State issued an agency-wide memorandum stating the  department’s renewed efforts by committing more resources and  workforce to backlog reduction. The memo states new processes are  to be implemented for both the short- and long-term, and the FOIA  office has plans to work with the various bureaus to outline the tasks,  resources, and workforce necessary to ensure success and  compliance. With renewed leadership support, State has reported  significant progress in its backlog reduction efforts.

DHS, in its chief FOIA officer reports, reported that it implemented  several plans to reduce backlogs. The DHS Privacy Office, which is  responsible for oversight of the department’s FOIA program, worked  with components to help eliminate the backlog. The Privacy Office  sent monthly emails to component FOIA officers on FOIA backlog  statistics, convened management meetings, conducted oversight, and  reviewed workloads. Leadership met weekly to discuss the oldest  pending requests, appeals, and consultations, and determined  needed steps to process those requests.

In addition, several other DHS components implemented actions to  reduce backlogs. Customs and Border Protection hired and trained  additional staff, encouraged requesters to file requests online,  established productivity goals, updated guidance, and utilized better  technology. U.S. Citizenship and Immigration Services, National  Protection and Programs Directorate, and Immigration and Customs  Enforcement increased staffing or developed methods to better  forecast future workloads ensure adequate staffing. Immigration and  Customs Enforcement also implemented a commercial off-the-shelf  web application, awarded a multimillion-dollar contract for backlog  reduction, and detailed employees from various other offices to assist  in the backlog reduction effort.

Due to efforts by the Privacy Office and other components, the  backlog dropped 66 percent in fiscal year 2015, decreasing to 35,374.  Yet, despite the continued efforts in fiscal year 2016, the backlog  numbers increased again, to 46,788. DHS attributes the increases in  backlogs to several factors, including an increase in the number of  requests received, increased complexity and volume of responsive  records for those requests, loss of staff and active litigation with  demanding production schedules.

One reason the eight agencies with significant backlogs may be  struggling to consistently reduce their backlogs is that they lack  documented, comprehensive plans that would provide a more reliable,  sustainable approach to addressing backlogs. In particular, they do not  have documented plans that describe how they will implement best  practices for reducing backlogs over time, including specifying how they  will use metrics to assess the effectiveness of their backlog reduction  efforts and ensure that senior leadership supports backlog reduction  efforts, among other best practices identified by OIP.

While agencies with backlogs of 1,000 or more FOIA requests are  required to describe backlog reduction efforts in their chief FOIA officer  reports, these consist of a high-level narrative and do not include a  specific discussion of how the agencies will implement best practices over  time to reduce their backlog. In addition, agencies with backlogs of fewer  than 1,000 requests are not required to report on backlog reduction  efforts; however, the selected agencies in our review with backlogs in the  hundreds still experienced an increase over the 5-year period.

Without a more consistent approach, agencies will continue to struggle to  reduce their backlogs to a manageable level, particularly as the number  and complexity of requests increase over time. As a result, their FOIA  processing may not respond effectively to the needs of requesters and  the public.

Various Types of Statutory Exemptions Exist and Many Have Been Used by Agencies

FOIA requires agencies to report annually to Justice on their use of  statutory (b)(3) exemptions. This includes specifying which statutes they  relied on to exempt information from disclosure and the number of times  they did so. To assist agencies in asserting and accounting for their use  of these statutes, Justice instructs agencies to consult a running list of all  the statutes that have been found to qualify as proper (b)(3) statutes by  the courts.

However, agencies may also use a statute not included in the Justice list,  because many statutes that appear to meet the requirements of (b)(3)  have not been identified by a court as qualifying statutes. If the agency  uses a (b)(3) statute that is not identified in the qualifying list, Justice  guidance instructs the agency to include information about that statute in  its annual report submission. Justice reviews the statute and provides  advice to the agency, but does not make a determination on the  appropriateness of using that statute under the (b)(3) exemption.

Based on data agencies reported to Justice, during fiscal years 2010 to  2016, agencies claimed 237 statutes as the basis for withholding  information. Of these statutes, 75 were included on Justice’s list of  qualifying statutes under the (b)(3) exemption (see appendix III for a list of  these statutes). Further, we identified 140 additional statutes that were  not identified in our 237 statutes claimed by agencies during fiscal years  2010 to 2016, but have similar provisions to other (b)(3) statutes  authorizing an agency to withhold information from the public (see  appendix IV for a list of these additional statutes).

We found that the 237 statutes cited as the basis for (b)(3) exemptions  during the period from fiscal years 2010 to 2016 fell into 8 general  categories of information. These categories were (1) personally  identifying information, (2) national security, (3) commercial, (4) law  enforcement and investigations, (5) internal agency, (6) financial  regulation, (7) international affairs, and (8) environmental. Figure 6  identifies the eight categories and the number of agency-claimed (b)(3)  statutes in each of the categories.

Of the 237 (b)(3) statutes cited by agencies, the majority—178—fell into 4  of the 8 categories:

Forty-nine of these statutes related to withholding personally  identifiable information including, for example, a statute related to  withholding death certificate information provided to the Social  Security Administration.

Forty-five statutes related to the national security category. For  example, one statute exempted files of foreign intelligence or  counterintelligence operations of the National Security Agency.

Forty-two statutes were in the law enforcement and investigations  category, including a statute that exempts from disclosure information  provided to Justice pursuant to civil investigative demands pertaining  to antitrust investigations.

Forty-two statutes fell into the commercial category. For example, one  statute in this category related to withholding trade secrets and other  confidential information related to consumer product safety.

The remaining 59 statutes were in four categories: internal agency  functions and practices, financial regulation, international affairs, and  environmental. The environmental category contained the fewest number  of statutes and included, for example, a statute related to withholding  certain air pollution analysis information.

As required by FOIA, agencies also reported the number of times they  used each (b)(3) statute. In this regard, 33 FOIA-reporting agencies  indicated that they had used 10 of the 237 (b)(3) statutes more than  200,000 times. Of these 10 most-commonly used statutes, the single  most-used statute (8 U.S.C § 1202(f)) related to withholding records  pertaining to the issuance or refusal of visas to enter the United States. It  was used by 4 agencies over 58,000 times.

Further, of the 10 most-commonly used statutes, the statute used by the  greatest number of agencies (26 U.S.C § 6103) related to the withholding  of certain tax return information; it was used by 24 FOIA-reporting  agencies about 30,000 times. By contrast, some statutes were only  used by a single agency. Specifically, the Department of Veterans Affairs  used a statute related to withholding certain confidential veteran medical  records (38 U.S.C. § 7332) more than 16,000 times. Similarly, EEOC  used a statute related to employment discrimination on the basis of  disability (42 U.S.C. § 12117) more than 10,000 times.

Table 4 shows the 10 most-used statutes under the (b)(3) exemption, the  agency that used each one most frequently, and the number of times they  were used by that agency for the period covering fiscal years 2010  through 2016.

The OPEN FOIA Act of 2009 Limitation on (b)(3) Exemptions Has Had an Uneven Impact on Subsequent Legislation

The OPEN FOIA Act of 2009 amended FOIA to require that any federal  statute subsequently enacted must specifically cite paragraph (b)(3) of  FOIA to qualify as a (b)(3) exemption statute. Prior to 2009, a federal  statute qualified as a statutory (b)(3) exemption if it (1) required that the  matters be withheld from the public in such a manner as to leave no  discretion on the issue, or (2) established particular criteria for withholding  or referred to particular types of matters to be withheld. According to  statements by the sponsor of the legislation during the Senate debate,  (b)(3) statutory exemptions should be clear and unambiguous, and  vigorously debated by Congress before they are enacted into law.

In response to the amendment, in 2010, Justice released guidance to  agencies stating that any statute enacted after 2009 must specifically cite  to the (b)(3) exemption to qualify as a withholding statute under FOIA.  Further, the guidance encouraged agencies to contact Justice with  questions regarding the implementation of the amendment.

In our review of the 237 (b)(3) statutes claimed by agencies during fiscal  years 2010 through 2016, 21 of these statutes were initially enacted and  82 were amended after 2009. Of the 21 statutes initially enacted after  2009, 9 cited (b)(3). Further, of the 82 statutes amended, 9 cited (b)(3).

While reflecting provisions of law authorizing or requiring the withholding  of agency information from the public, the number of these statutes not  having a reference to the (b)(3) exemption is evidence of the OPEN FOIA  Act’s uneven impact on the establishment of statutory FOIA exemptions.

Agencies Received and Processed FOIA Requests for Information Related to the Trouble Asset Relief Program

As previously noted, FOIA requires federal agencies to provide the public  with access to various types of information that can contribute to the  understanding of government operations. One of these areas has related  to the 2008 financial crisis, in which the Emergency Economic  Stabilization Act of 2008 played a significant role in stabilizing the federal  financial system. The act initially authorized $700 billion to assist financial  institutions and markets, businesses, and homeowners through TARP,  although that authorization was later reduced to $475 billion.

Treasury, which was given authority under the act, established the Office  of Financial Stability to carry out the program’s activities. These activities  included injecting capital into key financial institutions, implementing  programs to address problems in the securitization markets, providing  assistance to the automobile industry, and offering incentives for  modifying residential mortgages. In addition, federal financial regulators— FDIC, the Federal Reserve Board, and the Office of the Comptroller of the  Currency—each played a key role in regulating and monitoring financial  institutions.

Following the law’s enactment, in certain periods from 2008 through  2014, three corporations—AIG, GM, and Ally—received federal financial  assistance that amounted to 50 percent or more ownership by the federal  government. The actions with regard to TARP subsequently led to the  Treasury and the three financial regulatory agencies receiving FOIA  requests for government records related to the three corporations.  Specifically, the Federal Reserve Board, FDIC, the Office of the  Comptroller of the Currency, and Treasury received 166 FOIA requests  for information about these three corporations from September 2008  through January 2014.

The requests asked for various agency records related to the  corporations, for example,  records related to Treasury’s stewardship and oversight of AIG and its  subsidiaries;  records related to the Federal Reserve Board and Ally specific to the  individual submitting the FOIA request’s review;  records concerning GM’s contract with the Stillwater Mining Company;  and all communications between the Office of the Comptroller of the  Currency and AIG from June 2007 through March 2009.

Of the 166 requests, 88 were processed as full grant, partial grant, or full  denial; 34 were withdrawn by the requester; 24 were closed because the  agency responded that it had no records regarding the requests; and 20  fell into other disposition categories. Table 5 summarizes the  disposition/resolution of the FOIA requests that each of the four federal  agencies received relating to information on AIG, GM and Ally for certain  periods from September 2008 to January 2014 (the time frame for which  the government held 50 percent or more of the corporations’ common  stock), and the type of disposition used most often to close the requests.

The 18 agencies we reviewed had fully implemented half of the six key  FOIA requirements and the vast majority of agencies implemented two  additional requirements. However, 5 agencies published and updated  their FOIA regulations in a timely and comprehensive manner. Fully  implementing FOIA requirements will better position agencies to provide  the public with necessary access to government records and ensure  openness in government.

Selected agencies varied considerably in the size of their backlogs. While  10 reported a backlog of 60 or fewer requests, 4 had backlogs of over  1,000 per year. Agencies identified a variety of methods that they used to  address their backlogs, including practices identified by Justice, as well  as additional methods. However, the selected agencies varied in the  success achieved for reducing their backlogs. This was due, in part, to a  lack of plans that describes how the agencies will implement best  practices for reducing backlogs over time. Until agencies develop plans to  reduce backlogs, they will be limited in their ability to respond effectively  to the needs of requesters and the public.

We are making a total of 24 recommendations to 16 agencies in our  review. Specifically:  The Secretary of the American Battle Monuments Commission should  designate a chief FOIA officer at the assistant secretary level or  equivalent. (Recommendation 1)

The Secretary of the American Battle Monuments Commission should  update and publish comprehensive FOIA regulations that include  requirements established by law and Justice guidance.  (Recommendation 2)

The Chief Executive Officer and Director of the Broadcasting Board of  Governors should update and publish comprehensive FOIA regulations  that include requirements established by law and Justice guidance.  (Recommendation 3)

The Secretary of DHS should take steps to develop and document a plan  that fully addresses best practices with regards to reduction of  backlogged FOIA requests. (Recommendation 4)

The Secretary of DOI should ensure its FOIA tracking system is compliant  with Section 508 requirements. (Recommendation 5)

The Secretary of DOI should provide frequently requested records online.  (Recommendation 6)

The Secretary of DOI should take steps to develop and document a plan  that fully addresses best practices with regards to reduction of  backlogged FOIA requests. (Recommendation 7)

The Chair of EEOC should designate a chief FOIA officer at the assistant  secretary level or equivalent. (Recommendation 8)

The Chair of EEOC should take steps to develop and document a plan  that fully addresses best practices with regards to reduction of  backlogged FOIA requests. (Recommendation 9)

The Chairman of the FTC should designate a chief FOIA officer at the  assistant secretary level or equivalent. (Recommendation 10)

The Attorney General of the United States should take steps to develop  and document a plan that fully addresses best practices with regards to  reduction of backlogged FOIA requests. (Recommendation 11)

The Archivist of the United States should take steps to develop and  document a plan that fully addresses best practices with regards to  reduction of backlogged FOIA requests. (Recommendation 12)

The Administrator of NASA should update and publish comprehensive  FOIA regulations that describe dispute resolution services, and notifies  requesters of the 90 days for appeals. (Recommendation 13)

The Administrator of NASA should provide agency records of final  opinions online. (Recommendation 14)

The Chairman of NTSB should provide frequently requested records  online. (Recommendation 15)

The Chairman of NTSB should take steps to develop and document a  plan that fully addresses best practices with regards to reduction of  backlogged FOIA requests. (Recommendation 16)

The Director of OMB should update and publish comprehensive FOIA  regulations that include requirements established by law and Justice  guidance. (Recommendation 17)

The Director of OMB should designate a chief FOIA officer at the  assistant secretary level or equivalent. (Recommendation 18)

The Director of Pension Benefit Guaranty Corporation should designate a  chief FOIA officer at the assistant secretary level or equivalent.  (Recommendation 19)

The Secretary of State should update and publish comprehensive FOIA  regulations that describe dispute resolution services, and notifies  requesters of the 90 days for appeals. (Recommendation 20)

The Secretary of State should take steps to develop and document a plan  that fully addresses best practices with regards to reduction of  backlogged FOIA requests. (Recommendation 21)

The President of TVA should ensure its FOIA tracking system is  compliant with section 508 requirements. (Recommendation 22)

The Administrator of USAID should take steps to develop and document  a plan that fully addresses best practices with regards to reduction of  backlogged FOIA requests. (Recommendation 23)

The President of the U.S. African Development Foundation should update  and publish comprehensive FOIA regulations that inform a requester of  limited unusual circumstances fees. (Recommendation 24)

We requested comments on a draft of this report from the 21 agencies  included in our review. Of the 16 agencies to which we made  recommendations, 9 agencies agreed with all of the recommendations  directed to them; 1 agency agreed with two and disagreed with one  recommendation; 2 agencies disagreed with all of the recommendations;  and 4 agencies did not state whether they agreed or disagreed with our  recommendations. In addition, 5 agencies to which we did not make  recommendations stated that they had no comments on the report.  Multiple agencies also provided technical comments, which we have  incorporated, as appropriate.

The following 9 agencies agreed with our recommendations:  In emails received from the American Battle Monuments Commission  and the Broadcasting Board of Governors, the two agencies stated  that they agreed with the recommendations in our report.

In written comments, reprinted in appendix V, DHS stated that it  concurred with our recommendations. Regarding the recommendation  to designate a chief FOIA Officer, the department stated that it had  delegated the full authority and responsibility of DHS’s FOIA  operations and programs to the chief privacy officer. The department  asserted that its chief privacy officer is the equivalent of an assistant  secretary, as required, because the official is appointed by the  Secretary under 6 U.S.C § 142 without Senate confirmation in  accordance with the Appointments Clause to the U.S. Constitution.  Further, the department stated that the chief privacy officer position  meets the senior executive service standard under 5 U.S.C §  3132(a)(2) and, accordingly, is comparable to a senior executive level  position. Thus, the department believes it is already in compliance  with the requirement to designate a chief FOIA officer at the assistant  secretary level or equivalent.

For the reasons that it cited, DHS requested that GAO consider this  recommendation to be resolved and closed. Based on our analysis of  the additional information that the department provided to explain the  senior executive level position of the chief privacy officer, we are in  agreement with DHS regarding the position’s equivalency to an  assistant secretary within the department. Accordingly, we have  removed this recommendation from our report.

Concerning the second recommendation, to develop and document a  plan that fully addresses practices with regard to the reduction of  backlogged requests, DHS stated that it plans to initiate a department- wide compliance assessment of FOIA operations to identify the  components with the most significant backlog problems and the “root  causes” for these problems. The department said it then intends to  develop a proposed plan for backlog reduction.

In written comments, reprinted in appendix VI, Justice stated that it  agreed with our recommendation and will develop a plan to address  its backlog of FOIA requests to the fullest extent possible. Justice  added that, in fiscal year 2017, it was able to improve all of its  processing times and close all 10 of the department’s oldest requests,  appeals, and consultations, thus, reducing the overall age of its  backlog.

In written comments, reprinted in appendix VII, NARA stated that it is  currently working to develop and document a plan that is intended to  fully address best practices to reduce its backlog of FOIA requests, as  we recommended. The agency said it expects to complete its plan by  the end of December 2018.

In written comments, reprinted in appendix VIII, NASA said that it  concurred with our two recommendations. With regard to the first  recommendation, the agency stated that it is currently working to  update its FOIA regulations, and that the revisions are to include the  90-day appeal rights, as well as describe requesters’ rights to obtain  dispute resolution services from NASA’s FOIA public liaisons and  OGIS.

With regard to the second recommendation, the agency stated that it  is currently working to identity subject matter areas on which the  department can reach final opinions as interpreted under FOIA. The  agency added that, upon identification, it will begin posting final  opinions online.

In written comments, reprinted in appendix IX, State concurred with  our two recommendations and, accordingly, noted that it is currently  working to update its FOIA regulations and evaluate methods to  improve its backlog reduction efforts.

In written comments, reprinted in appendix X, USAID stated that it  concurred with our recommendation and will develop a formal plan  that delineates currently employed best practices to reduce its FOIA  backlog.

In comments provided via email, the United States African  Development Foundation’s General Counsel concurred with our  recommendation. The foundation stated that it will take steps to  update its FOIA regulations. This is to include, informing requesters  about limited unusual circumstances fees, and publishing the updated  regulation in the Federal Register.

One agency agreed with two recommendations, and disagreed with one  other recommendation:  In written comments, reprinted in appendix XI, DOI concurred with the  recommendation to make its FOIA tracking system Section 508- compliant and stated that it is currently testing its system for  compliance. The department also concurred with the recommendation  that it provide frequently requested records online.

However, the department did not concur with our recommendation to  develop and document a plan that fully addresses best practices for  the reduction of backlogged FOIA requests. The department stated  that, in Justice’s OIP guidance, the creation of a formal backlog  reduction plan only applies to agencies with more than 1,000  backlogged requests in a given year. The department said that DOI  did not fall into this category and, therefore, was not required to  develop such a plan.

Although DOI’s existing backlog of FOA requests did not meet the  threshold identified in Justice’s guidance, the department,  nonetheless, experienced a 51 percent increase in backlogged FOIA  requests from fiscal years 2012 to 2016. Thus, having a plan and  practices for reducing backlogged requests could help the department  ensure that its backlog remains manageable, and that DOI is  effectively positioned to respond to the needs of requesters and the  public. Accordingly, we believe that our recommendation to develop a  plan that addresses best practices to reduce the backlog is still  warranted.

In addition, 2 agencies disagreed with our recommendations:  In written comments, reprinted in appendix XII, the Pension Benefit  Guaranty Corporation disagreed with our recommendation that it  designate a chief FOIA officer at the assistant secretary level or  equivalent. The agency said it does not have assistant secretary  positions. The agency added that it believes its current chief FOIA  officer’s position is equivalent to the assistant secretary level and that  this official is an appropriate designee.

We disagree that the current chief FOIA officer’s position is equivalent  to the assistant secretary level. However, the Pension Benefit  Guaranty Corporation’s General Counsel position is at a level that is  equivalent to an assistant secretary. As such, assigning the position to  the General Counsel could help ensure that the chief FOIA officer has  the necessary authority to make decisions about agency practices,  personnel, and funding. As such, we believe our recommendation is  still warranted.

In written comments, reprinted in appendix XIII, TVA disagreed with  our recommendation to ensure that its FOIA tracking system is  compliant with Section 508 of the Rehabilitation Act. The agency  stated that, based on the January 18, 2017, revised Section 508  standards, its current FOIA tracking system meets the standard  related to having a user interface, but does not meet the criteria for  accessibility of electronic content. The agency added that, the current  single user of its system does not require accessibility  accommodations; thus, it would be an undue burden for the agency to  make the system comply with the Section 508 requirements.

While TVA’s current FOIA system does not require accessibility  accommodations and, in the agency’s view, would be unduly  burdensome to modify, as the agency undertakes further  modernization of its IT systems and software, it should ensure that its  FOIA system is compliant with Section 508 requirements. Accordingly,  we stand by our recommendation to the agency.

Further, 4 agencies did not state whether they agreed or disagreed with  the report, although 2 of them offered other comments:  In emails received from EEOC and NTSB, the agencies did not agree  or disagree with the draft report. EEOC offered technical comments,  which we incorporated, as appropriate, while NTSB said it had no  comment.

In written comments, reprinted in appendix XIV, FTC acknowledged  that its chief FOIA officer is not at the assistant secretary level. FTC  also noted that it is a small agency in which there are no position titles  of assistant secretary-level or equivalent. Further, the agency stated  that it believes its chief FOIA officer holds a sufficiently senior position  (associate general counsel) with the necessary authority to fulfill the  functions of the chief FOIA officer. Nevertheless, FTC stated that it  would take our recommendation (to designate a chief FOIA officer at  the assistant secretary level or equivalent) under advisement.

Although FTC is a small agency and does not have positions at the  assistant secretary level, we disagree that the current chief FOIA  officer’s position is sufficiently senior to fulfill the functions required of  this position. However, assigning the chief FOIA officer position to the  General Counsel, or an equivalent level position, could help ensure  that the chief FOIA officer will have the necessary authority to make  decisions about the agency’s practices, personnel, and funding for the  implementation of FOIA. As such, we believe our recommendation is  still warranted.

In comments provided via email from its GAO liaison, OMB stated that  it does not have a position in its organization with the specific title of  assistant secretary. However, the agency noted that, on March 7,  2018, the OMB Director designated the OMB General Counsel to  serve as the agency’s chief FOIA officer. According to OMB, the chief  FOIA officer reports to the Director. Based on the documentation  received, we are in agreement with OMB that the position of General  Counsel is equivalent to an assistant secretary within the department.  Accordingly, we consider this recommendation to be closed.

The remaining 5 agencies to which we did not make recommendations  stated that they did not have any comments on our report. These  agencies were: the Administrative Conference of the United States, FDIC,  the Federal Reserve Board, OCC, and Treasury.

We are sending copies of this report to the Secretaries of the American  Battle Monuments Commission, Homeland Security, Interior, State, and  the Treasury; the Attorney General of the United States; the Archivist of  the United States; the Comptroller of the Currency; Administrators of the  National Aeronautics Space Administration and United States Agency for  International Development; Board of Governors of the Federal Reserve  System; Chairmen of the Administrative Conference of the United States,  Equal Employment Opportunity Commission, Federal Deposit Insurance  Corporation, and National Transportation Safety Board; Chief Executive  Officer and Director of the Broadcasting Board of Governors; Directors of  the Office of Management and Budget and Pension Benefit Guaranty  Corporation; the Presidents of the Tennessee Valley Authority, and  United States African Development Foundation, and the Acting General  Counsel for the Federal Trade Commission. In addition, this report is  available at no charge on the GAO website at http://www.gao.gov  If you or your staff have questions about this report, please contact me at  (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix XV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine (1) determine the extent to which  agencies have implemented selected Freedom of Information Act (FOIA)  requirements; (2) describe the methods established by agencies to  reduce backlogged requests and the effectiveness of those methods; (3)  identify any statutory (b)(3) exemptions that have been used by agencies  as the basis for withholding (redacting) information; and (4) determine  what FOIA requests, if any, agencies received and processed that related  to entities that received government assistance during the 2008 financial  crisis.

To address the first and second objectives, we selected 18 agencies to  review based on the number of FOIA requests received, the sizes of  FOIA backlogs, and the average time of processing FOIA requests for  fiscal years 2012 through 2016. We also chose the agencies to represent  a range of sizes (by number of employees)—large (10,000 or more),  medium (1,000 to 9,999), and small (999 or fewer). Large agencies  selected were the Departments of Homeland Security, Justice, State, and  the Interior; the National Aeronautics and Space Administration, and the  Tennessee Valley Authority. Medium agencies were the National  Archives and Records Administration, the Federal Deposit Insurance  Corporation, the Equal Employment Opportunity Commission, the  Broadcasting Board of Governors, the U.S. Agency for International  Development, and the Federal Trade Commission. Small agencies were  the National Transportation Safety Board, the American Battle  Monuments Commission, the Pension Benefit Guaranty Corporation, the  U.S. African Development Foundation, the Office of Management and  Budget, and the Administrative Conference of the United States.

For our first objective, to determine the extent to which agencies had  implemented FOIA requirements, we examined six FOIA requirements  outlined in the FOIA Improvement Act of 2016 and the OPEN  Government Act of 2007. These requirements were for agencies to (1)  update response letters, (2) implement tracking systems, (3) provide  FOIA training, (4), provide records online, (5) designate chief FOIA  officers, and (6) update and publish timely and comprehensive  regulations. For these six requirements, we reviewed (1) agencies’ FOIA  regulations to determine if they included updates from the 2016 FOIA  amendments and 2007 OPEN Government Act; and if they were updated  by the required deadline; (2) agencies’ FOIA systems to determine if the  systems provided individualized tracking numbers for requests that will  take longer than 10 days to process, if agencies’ established telephone or  Internet service to allow requesters to track the status of their requests;  (3) if agencies’ had designated a chief FOIA officer and what position they  held within the agency; (4) if agencies chief FOIA officers provided annual  FOIA training opportunities to agency staff; (5) if agencies had  appropriately updated response letters in compliance with the 2016 FOIA  amendments; and (6) if agencies were providing electronic documents  publicly available online and posting frequently requested documents as  required by the 2016 FOIA amendments. Since we selected a  nonprobability sample of FOIA reporting agencies, the results of this  analysis are not generalizable to all FOIA reporting agencies.

In addition, we also reviewed the requirement for the development of a  government-wide FOIA request portal and met with Office of  Management and Budget (OMB) officials, and Department of Justice  (Justice) officials in the Office of Information Policy (OIP) to the discuss  the status of development. Further, we met the Chief FOIA Officers  Council, OIP, and National Archives and Records Administration’s  (NARA) Office of Government Information Services (OGIS) to determine  what, if any, actions they have taken to assist agencies with not violating  the provisions of FOIA.

For our second objective, to determine the methods established by  agencies to reduce backlogged requests and the effect of those methods,  we reviewed agency documentation to evaluate if the selected agencies  had developed methods for reducing backlogged FOIA requests. We  identified requirements for agencies to produce backlog reduction plans  and determined if agencies developed such plans as required. We  analyzed agencies’ FOIA.gov data to determine if there was a correlation  between the presence of a backlog reduction plan and a reduction in  backlog numbers. We compared a set of identified best practices for  reducing backlogs with agency procedures to determine the extent to  which the best practices are used. In addition, we interviewed agency  officials to determine the reasons for changes in agency backlog numbers  and what actions they are taking to reduce backlogs or implement  reduction plans. The results of this analysis are not generalizable to all  FOIA reporting agencies.

For our third objective, to identify statutory (b)(3) exemptions that have  been used by agencies as the basis for withholding information, we  developed a catalog of (b)(3) statutes that agencies previously have used  to withhold information in FOIA records. To do that, we retrieved all data  on agency use of (b)(3) statutes that were readily accessible on Justice’s  FOIA.gov website. The data on FOIA.gov are for fiscal years 2008 to  2016; however, Justice acknowledged that data prior to 2010 were not  available on FOIA.gov for all agencies. Therefore, we reviewed data for  fiscal years 2010 to 2016. In total, there were 117 distinct agencies that  provided annual report data for at least 1 fiscal year, and that were  represented in fiscal years 2010 through 2016. We developed a catalog  by extracting information from the aggregate of agency annual FOIA  reports that report, among other things, usage of (b)(3) statute, including  the statute’s citation and the number of times the statute was to used  withhold information in a fiscal year.

To assess the reliability of the data we retrieved from FOIA.gov, we  supplemented our analysis with interviews of FOIA officials in Justice’s  OIP on steps they have taken to ensure the consistency of data in  FOIA.gov on agencies’ use of (b)(3) statutes. Our analysis did not include  assessing the reliability of (b)(3) statute data submitted by agencies— Justice guidance states it is the responsibility of each agency to ensure  quality data in their reports. We also electronically tested the data by  identifying outliers, missing values, and syntactical discrepancies. We  found the data to be sufficiently reliable for purposes of our reporting  objective.

To facilitate our analysis, we refined our catalog listing of agencies’ use of  (b)(3) statutes by developing a standardized statute notation assigned to  each agency-used statute in our list. Specifically, our standardization of  agency-used statutes consisted of removing any typographical errors,  ensuring statutes were noted in a consistent U.S. Code format and  referred to existing U.S. Code section, and verifying the existence of  each statute through legal research, as well as standardizing any current  notations of the statute such as those transferred within the U.S. Code by  later legislation. If no current notation existed, then that statute was listed  as is, such as “15 U.S.C. § 80a-30(c)”, which was used by an agency,  and repealed during our review period. No replacement notation could be  found.

For some U.S. Code statutes, we standardized statutes to an entire  section or subsection to reference nondisclosure provisions that contain a  description of the type of information withheld by that statute. Further, for  some U.S. Code statutes that agencies used as a range of statutes, such  as 7 U.S.C. §§ 7411-7425, we determined whether the range contained a  single or multiple (b)(3) statute section(s) and developed a standardized  statute for each (b)(3) section to assign the original agency statute. In  some cases, where agencies used a smaller ranger of statutes, such as  21 U.S.C. §§ 1903-1905, we retained the notation and assigned a  standardized version of the range to the original agency-used statute  range. Additionally, for some U.S. Code statutes that agencies used that  contained two (b)(3) statutes, such as 26 U.S.C. §§ 6103 and 6105, we  developed a standardized statute for each (b)(3) section to assign the  original agency statute.

For those agency-used statutes that could not be immediately  standardized or seemed to be noted in error, we either assigned that  statute to a related section (or sections) containing a nondisclosure  provision, retained the notation and assigned a standardized version of  the statute to the original agency-used statute, or removed that statute  from our catalog. For example, an agency claimed 15 U.S.C. § 7301 as a  (b)(3) statue; however, the statute was a purpose section and 15 U.S.C. §  7306 was the only related nondisclosure provision in that chapter or  subchapter of the Code. Therefore, § 7301 was assigned to the  standardized citation § 7306. Each standardized statute was counted as  one single statute, regardless of the number of sections it represented,  resulting in a total of 237 statutes.

Following our standardization exercise, we developed descriptions of  each statute’s subject matter. We also compared our standardized  statutes list to Justice’s list of qualified statutes to identify those statutes  that qualified if a court has approved of the statute as being a (b)(3)  statute. Next, we classified these statutes into 10 general categories  based on their descriptions.

To determine usage of (b)(3) statutes by agencies, we calculated the  number of times an agency used original agency-used statutes and  assigned those numbers to its associated standardized statute in our  catalog. In cases where an agency appeared to cite multiple statutes,  such as 26 U.S.C. §§ 6103 and 6105, we counted the statutes separately  if we determined they were different. For example, if an agency used 26  U.S.C. §§ 6103 and 6105 500 times during fiscal years 2010 to 2016, we  would assign that number to each standardized statute in our catalog to  ensure that 26 U.S.C. § 6103 and 26 U.S.C. § 6105 each received 500 as  the number of times used. We compiled and sorted these data to obtain  information on which agencies were using the statute, which agency used  it the most, and the approximate number of times the statute was used by  an agency.

To identify which statutes qualified as a (b)(3) exemption under the OPEN  FOIA Act of 2009, we determined the date of the most recent legislative  action for each standardized statute by identifying the dates of enactment  and the most recent amendments of the statutes. We then identified  those statutes enacted or amended after 2009 and we determined if they  cited FOIA’s paragraph (b)(3) by including a citation to 5 U.S.C. 552(b)(3)  or “paragraph (b)(3) of section 552 of title 5, United States Code,” or a  similar citation that includes a reference to paragraph (b)(3).

To identify any additional statutes that the reviewed agencies did not  claim during fiscal years 2010 to 2016, we developed another catalog of  statutes that have similar provisions as other (b)(3) statutes that authorize  an agency to withhold information from the public. Specifically, we utilized  various sources to compile our list of statutes, including annual Justice  reports on statutes determined by courts to constitute a (b)(3) statute, the  National Institute of Standards and Technology’s Guide for Mapping  Types of Information and Information Systems to Security Categories,  and two external nongovernmental organizations (American University  Washington College of Law and ProPublica). In addition, we separately  searched the U.S. Code for the keyword “552(b)(3)” using Lexis Nexis, to  identify any additional statutes for our catalog. However, this additional  catalog does not serve as an definitive or comprehensive list of (b)(3)  statutes available for agencies to claim. Specifically, FOIA gives agencies  broad discretion in deciding whether they can withhold information on the  basis of a statute. For example, FOIA allows for agencies to assert a  federal statute under the (b)(3) exemption if that statute establishes  particular criteria or refers to particular types of matters to be withheld.  Therefore, the statutes we identified may undercount the total number of  exemptions available to agencies.

For our fourth objective, to determine the number and types of FOIA  requests related to private corporations that received funds under the  Troubled Assess Relief program (TARP), we reviewed the Department of  Treasury’s (Treasury) Monthly Reports to Congress (October 2008 and  November 2014) and prior GAO reports relating to TARP. We  identified the corporations that received TARP funds and the federal  agencies that received FOIA requests related to these corporations by  reviewing Treasury’s monthly reports for the time period in which  Treasury held 50 percent or more common stock in corporations that  were under the TARP agreement. We also reviewed prior GAO reports on  TARP to verify the corporations and time period. In addition, we met with  Treasury officials to verify the entities and time period.

The three corporations that received TARP funds were American  International Group, General Motors, and Ally. The agencies that received  FOIA requests about these corporations were Treasury, the Federal  Deposit Insurance Corporation (FDIC), the Federal Reserve Board, and  the Office of the Comptroller of the Currency. We met with these agencies  to identify their involvement in providing assistance to companies related  to TARP.

Next, we reviewed FOIA requests received by these four agencies during  the period in which Treasury owned at least 50 percent or more common  shares in the corporations. We reviewed the FOIA requests to determine  the resolution of the request and the length of time it took the agency to  respond. Lastly, we interviewed agency officials to better understand if  and how FOIA requests were received and processed.

We conducted this performance audit from January 2017 through June  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Freedom of Information Act Exemptions

The Freedom of Information Act (FOIA) prescribes nine specific  categories of information that are exempt from disclosure. These  exemptions are described in the table below.

Appendix III: Catalog of (b)(3) Exemption Statutes Agencies Claimed during Fiscal Years 2010 through 2016

Table 7 describes 237 (b)(3) exemption statutes used by FOIA reporting  agencies during fiscal years 2010 through 2016 and indicates whether  that statute has been found by a court to qualify as a (b)(3) exemption.  Specifically, the Department of Justice, in its oversight role, identified 78  statutes that courts have ruled qualify as a (b)(3) statute. During fiscal  years 2010 through 2016, when responding to FOIA requests, agencies  used 75 of these statutes as the basis for withholding information.

Appendix IV: Catalog of Statutes Authorizing the Withholding of Information but Not Used by Agencies under the (b)(3) Exemption during Fiscal Years 2010 through 2016

Table 8 identifies 140 additional statutes outside of our agency used  catalog that we did not identify as used by agencies during our fiscal year  2010 through 2016 review period. These statutes have similar provisions  to other (b)(3) exemption statutes, authorizing an agency to withhold  information from the public.

Appendix V: Comments from the Department of Homeland Security

Appendix VI: Comments from the Department of Justice

Appendix VII: Comments from the National Archives and Records Administration

Appendix VIII: Comments from the National Aeronautics and Space Administration

Appendix IX: Comments from the Department of State

Appendix X: Comments from the U.S. Agency for International Development

Appendix XI: Comments from the Department of the Interior

Appendix XII: Comments from the Pension Benefit Guaranty Corporation

Appendix XIII: Comments from the Tennessee Valley Authority

Appendix XIV: Comments from the Federal Trade Commission

Appendix XV: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Anjalique Lawrence (assistant  director), Lori Martinez (analyst in charge), Gerard Aflague, Melina  Asencio, David Blanding, Kami Brown, Christopher Businsky, Caitlin  Cusati, Haley Dunn, Elena Epps, Rebecca Eyler, Nancy Glover, James  Andrew Howard, Saida Hussain, Robert Letzler, Lee McCracken, Carlo  Mozo, Brian Palmer, David Plocher, Di’Mond Spencer, Sukhjoot Singh,  Henry Sutanto, and Priscilla Smith made key contributions to this report.