Built-in protection

If you've already got comprehensive security and privacy practices in place at your agency, you're ahead of the game in electronic-records management.'It's a question of the agency having a good computer security and privacy program and appropriately applying it to systems that create records,' said Reynolds Cahoon, the National Archives and Records Administration's CIO and assistant archivist for human resources and information services.To some degree, security and privacy in records management transcends the medium.'You're just transferring the same procedures in paper to electronic [format] so you should already have pretty good procedures in place for ensuring security,' said Chris O'Donnell, records officer at the Environmental Protection Agency.At a time when agencies are facing mandates to establish more collaborative management practices, records management can no longer be the lonely province of records officers, toiling away in the lower levels of the agency, officials said.To ensure that appropriate security and privacy practices are incorporated into e-records management, all parts of an agency have to be involved in its oversight. A multifarious management structure is critical.'If an organization is doing its security correctly, it would involve the program officials, who are the system owners; the IT officials, who have to support and operate the system; the information security officer associated with that system; the agency's chief security officer; and the agency's records officer,' Cahoon said.'They are all collaborating on what the level of security needs to be for that particular system,' he said. 'That's part of that risk assessment that has to be done. If we follow the process and involve the right people, the right level of security for records will be established.'Under the Federal Information Security Management Act, all systems, including records management systems, must be assessed for risk, and certified and accredited.Similar multidisciplinary oversight should be applied to e-records scheduled under provisions of the Privacy Act of 1974 and the E-Government Act of 2002, records experts said.[IMGCAP(2)] The Privacy Act requires agencies to make reasonable efforts to ensure that information is complete, accurate and relevant before disclosing it to a nonfederal organization.The E-Government Act requires agencies to develop privacy impact assessments for new or modified IT systems.'For systems that have privacy implications, you would involve your Privacy Act officer,' said Nancy Allard, NARA's co-manager of the E-Record Management System project. 'For example, when NARA does its privacy impact assessments, the Privacy Act officer reviews them very carefully.' She noted that NARA's privacy officer reports to the agency's general counsel, who is also part of the oversight structure.Concern for appropriate security and privacy practices in records management should begin at the top of an agency's information management structure, with the CIO.'Very, very near the top of every CIO's agenda is security and privacy,' Cahoon said. 'So all of the systems that create federal records are subject to appropriate security and privacy guidance and regulations.'At the Nuclear Regulatory Commission, which regulates commercial nuclear power plants in the United States and the civilian use of nuclear materials, the CIO's office is responsible for implementing security and privacy policies relating to records.The Office of Nuclear Security and Incident Response 'sets the standards on what is classified and what needs to be secured in terms of content,' said Jacqueline Silber, NRC's CIO. Once the classification is determined, she said, the office of the CIO is responsible both for the policy and for handling the information.Silber described records security as a 'minute-by-minute' effort at NRC, especially for documents that are made available to the public.'Every document that gets out is checked at two or three stops along the way,' she said.NRC's records-review processes involve both computer and manual checks, said Francine Goldberg, director of NRC's division of information management and records services.The NRC uses a records management system called the Agencywide Documents Access and Management System, which was launched four years ago.'We have automated tools within ADAMS that will shut down a document that is sensitive and has been released by mistake,' Goldberg said. 'On top of that, we have people who do manual checks in case that piece of software fails.'[IMGCAP(3)] Still, new electronic formats present all sorts of records management challenges. E-mail is a glaring example. The sheer volume is staggering'millions of pieces of electronic correspondence pass through government systems every day.Thus, on one level, there is the problem of having to review large amounts of e-mail for security and privacy issues.'Having to review large amounts of e-mails for a Freedom of Information Act request is an example,' said Lewis Bellardo, deputy archivist for NARA. 'It can be in the hundreds of thousands of e-mails that have to be reviewed. That's a traditional problem [reviewing paper FOIA requests] but it gets bigger when you have large volumes of electronics.'Kenneth Thibodeau, director of NARA's Electronic Record Archives program, said, 'One of the ways that the explosion [of e-mail] is making security more complicated is that it's possible to get a collection of ostensibly completely open records and discover stuff in there that shouldn't be there. We've encountered this on several occasions.''Tools are gradually being developed to allow the search to become more sophisticated and to have a lot of that kind of parsing of the records into what's open and what's not,' Bellardo said.Electronic correspondence also presents security and privacy hurdles beyond its volume'the desultory way that users often treat e-mail, for example. 'E-mail is very challenging,' Silber said. 'It makes communications very simple but there's a tendency to think of e-mail as an informal means of communication.'Silber said NRC has specific policies on what constitutes an official record at the agency and they apply to any format.'If it's an e-mail, it's still an official record if it meets those criteria,' she said. 'A constant challenge is making sure that the staff understands that they need to communicate and share information the most secure way while balancing openness.'