What on Web merits saving?

Exactly which parts of an agency's Web site constitute federal records, subject to rules governing retention and disposition, depends on the agency in question.Officials of the National Archives and Records Administration and other agencies reached no consensus at last week's FedWeb 2002 conference at the National Institutes of Health in Bethesda, Md.The debate over maintenance of Web records was just one of the hot-button issues at the annual gathering. Other workshops tackled such topics as Web site design and performance, security requirements and the Government Paperwork Elimination Act.'The federal government is using the Web for every conceivable purpose,' said William Lefurgy, deputy director of NARA's Modern Records Program.NARA wants to help agencies develop best practices for managing records on Web sites, Lefurgy said. From NARA's perspective, many if not most agency sites contain official records that need to be managed as such, Lefurgy said. That applies both to what appears on browser screens and to back-end databases and scripts.NARA has drafted a guidance document for managing agency Web records, Lefurgy said. Archives officials hope the guidance will gain approval from the Office of Management and Budget by the end of the month.Consultant J. Timothy Sprehe, who joined the agency representatives in a panel discussion, said he doesn't believe all things on agency Web sites are public records, especially if they're copies of paper documents, such as Federal Register entries. Dynamic content, though, is a gray area.Sprehe urged agency webmasters, content managers and records officers to talk to each other and agree on ground rules for retention.The Energy Information Administration keeps a registry of its site content so that if someone inquires about a document that was removed, staff members can track it down, he said.Carolyn K. Offutt, Superfund webmaster for the Environmental Protection Agency, said she believes the electronic documents on the site she manages'including all static pages, graphics, databases and other dynamic content'are federal records.Someone from Offutt's staff takes a snapshot of the Superfund site every three months. She praised NARA's effort to capture snapshots of agency sites at the end of the Clinton administration.In 1996, EPA gave NARA a proposed schedule for maintaining its Web records, she said, but NARA rejected it two years later because it might set a precedent. NARA still has not approved retention schedules for Web content, she added.As a regulatory agency, EPA makes decisions and issues standards, and people have to be able to research the background of those decisions and standards online, Offutt said.Jeanne Young, a records manager for the Federal Reserve Board, said she views her agency's site as a bulletin board. The Web is just a distribution medium, Young said, and many records are not posted there.The board in fact has three Web sites'one public, one for the agency and an intranet that 'truly functions as a bulletin board,' Young said. The internal site has links to such newspapers as the Washington Post and Wall Street Journal, plus a market ticker.'I think we'd be in a lot of trouble if we tried to incorporate those as records of the Federal Reserve,' Young said.Web management documents are records, however, even though not everything on the site is a record, Young said. Furthermore, board regulators are opposed to considering the site a records repository, Young said.NARA can give guidance but must leave it up to agencies to determine what is and isn't a record, she said.Charles R. McClure, director of the Information Use Management and Policy Institute at Florida State University, predicted that 'many of the people in this room are going to be just as cranky when they see the new guidance as when they didn't have it.'Other FedWeb workshops focused on security and performance, regardless of the records issue.Selene Dalecky, an electronic product developer for the Government Printing Office, said the staff of the GPO Access Web site measures its effectiveness in many ways.Basic usage data comes from analysis of log files and online bookstore orders, Dalecky said. The staff periodically surveys volunteers from government libraries, other agencies and the public. GPO officials annually conduct an opt-in online survey of site visitors.Nora Rice, the CIO Council's program manager, urged agency officials to present a unified, simplified view of agency business processes to their Web users in order to reap the benefits of GPEA.Larry Dusold, a webmaster for two sites developed by the Food and Drug Administration, urged his audience to protect their Web sites with an 'onion skin' of multiple security layers.If the barrier around the Web site is high enough, hackers will decide it's not worth the effort to penetrate or deface it, said Dusold, chief of telecommunications and scientific computer support for FDA's Center for Food Safety and Applied Nutrition.Dusold discussed security measures that every public Web site should have. The list includes turning off all unnecessary TCP/IP services, using internal and external Web server monitors and enforcing strict password rules.