[The following are the proposed principles on electronic record Freedom of Information Act issues that have been drafted by a working group of the Information Infrastructure Task Force, toward the objective of possible consensus legislation. They are being circulated for review and comment by federal agencies, members of the FOIA-requester community and other interested members of the public.]
1. As a general rule, information maintained in electronic form should be no less subject to the Act than information maintained in conventional record form.
2. Agencies should strive to make information available affirmatively on their own initiative in order to meet anticipated public demands for it, rather than be compelled to meet such demands under subsection (a)(3) of the FOIA. In other words, FOIA processes should not be encumbered by requests for routinely available records or information that can most efficiently be made available to the public through some other means.
3. To the extent that agencies make such data available through electronic means under OMB Circular A-130, that data should not be subject to the Act.
4. An agency's practical ability to make records and information affirmatively available to the public apart from the FOIA is far greater as to nonexempt records than as to any record or information that is partially exempt and requires redaction.
5. Agencies should strive to make information available through electronic means wherever practicable, including under the FOIA; public access to agency records and information should be enhanced through electronic means.
6. The FOIA is not an independent basis for requiring agencies to maintain records or information; other statutes establish such requirements.
7. Agencies should make use of electronic information technology in order to most efficiently administer their responsibilities under the Act.
8. Agencies should strive to meet their responsibilities under subsection (a)(1) of the Act, and to the maximum extent practicable under subsection (a)(2) as well, through electronic means.
9. For any records or information made available under the FOIA in the form of electronic products or through electronic services, applicable fees should neither exceed nor be less than the direct costs of providing those products or services. (The meaning of the term "direct costs" should receive particular attention in the context of electronic records.)
10. Consistent with the information-dissemination policy goals of OMB Circular A-130, the "direct costs" of providing electronic products and services under the FOIA should be determined in such a way as to not discourage use of non-FOIA dissemination channels.
11. Private commercial interests in computer software or any other valuable electronic information that is maintained by an agency should be protected through an efficient FOIA mechanism; where such protection is limited under existing law, Congress should consider whether it should be extended as a matter of legislative policy.
12. Any government interests in computer software or any other valuable electronic information that is maintained by an agency should be protected only to the limited extent provided for under existing law; Congress should consider whether this protection should be extended as a matter of legislative policy.
13. In determining the applicability of the Act to information maintained in electronic information systems, consideration should be given to the potential for FOIA requests to "shut down," or otherwise impair the operation of, entire systems.
14. The term "record" (or "information") should be defined in the text of the FOIA, but that definition should not necessarily be tied to any definition of "record" that is used for purposes of other statutes (e.g., Federal Records Act or Privacy Act).
15. As a practical matter, rules governing the extent of agency obligations under the Act should be designed to be as clear and workable as possible -- especially within the realm of electronic records -- in order to promote uniformity among agencies, minimize uncertainty among FOIA requesters, and avoid potential disagreements between the two.
16. Information or data maintained outside of the government that is accessed electronically by an agency, but merely viewed by agency employees, should not be deemed to come into the agency's possession and control by virtue of such electronic access.
17. Any such data that is retrieved into an agency database by an agency employee or agent, or is printed out in paper form, becomes subject to the Act.
18. Rules governing the circumstances under which agencies may merely view, and not preserve, distributed data in the performance of their functions should be established through legal and policy mechanisms other than the FOIA.
19. Rules governing the circumstances under which agencies may transfer agency information to contractors, for its subsequent maintenance as "distributed data" available to the agency only in that way, likewise should be established apart from the FOIA -- but with a recognition of the FOIA consequences of such transfers (cf. Privacy Act subsection (m)).
20. As a general rule, data that is continuously changing should nonetheless be subject to the Act.
21. Special procedures might be required to accommodate FOIA applicability to such data on a "snapshot" basis, while at the same time not unduly impairing the operation of the electronic system involved.
22. Any such nonexempt data for which there is an anticipated public demand is likely to be made available affirmatively, pursuant to OMB Circular A-130, thereby removing any potential FOIA complication for that data.
23. The Act should generally apply to information maintained by an agency in "digitized" form.
24. However, the Act should not apply to any such information that is so transitory in character that it is not ordinarily preserved for agency documentation purposes; such information should be explicitly excluded. Examples: some voicemail, some security monitor tapes, and some information maintained in "multimedia" form.
25. Agencies should not convert any information into "digitized" form for the purpose of altering its status under the FOIA.
26. The term "computer software" is closely related to, but somewhat
broader than, the term "computer program," though the two terms in most
instances may be used interchangeably. As a general rule, "computer
software" may be regarded as the computer programs, routines, and symbolic
languages that control the functioning and direct the operation of
computer hardware. (See American Heritage Dictionary, 3d ed., 1992, at
1713.) It might also be regarded as including any underlying or
associated documentation. (See Random House Unabridged Dictionary, 2d
ed., 1987, at 1814.) A "computer program" may be regarded as a set of
statements or instructions to be used directly or indirectly in a computer
in order to bring about a certain result. (See 17 U.S.C.A.
27. Items of computer software should be treated as "records" as a general rule -- regardless of their inherent characteristics in individual cases -- if effective statutory protection of the proprietary interests existing in many software items is provided as well.
28. An item of computer "firmware" (a physical object in which computer instructions are embedded) should be treated the same as computer hardware and not as a "record"; any underlying documentation pertaining to such an item, however, should be treated as a "record."
29. Any software that has been acquired by the government, and is made commercially available by the outside proprietary interest holder, should be explicitly excluded from the Act's coverage as a threshold definitional matter; the most effective handling of a FOIA request for such software would be for the agency to simply identify the software as commercially available.
30. In exceptional situations in which acquired software is not made commercially available by the outside proprietary interest holder, the circumstances of the acquisition and of the proprietary interest will have to be examined in order to determine the software's status under the Act.
31. In situations in which acquired software has been "customized" by an agency and for that reason is not commercially available in the exact form in which it is requested, both the acquisition circumstances and the scope of the outside proprietary interest will have to be examined -- together with possible segregation of proprietary from nonproprietary information -- in order to determine the software's status under the Act.
32. Software that is generated totally at government expense, and in which there exists no private proprietary interest, should be subject to the Act and disclosed if not covered by a FOIA exemption (e.g., Exemption 2, which can protect against circumvention of computer-system security). Such software should be made available at direct cost under the FOIA absent any specific authorization by Congress for the charging of a greater fee.
33. Any software that is generated by an outside party under a government contract, in which the government has retained all proprietary interest, should likewise be subject to the Act.
34. Any software that is generated by an outside party under a government contract, in which that party retains some or all of the proprietary interest, should be subject to disclosure under the Act only insofar as is compatible with that proprietary interest (as well as the interests protected by any other applicable FOIA exemption, such as Exemption 2 or Exemption 3).
35. Any software that is generated by an agency and a private party jointly under a cooperative agreement should be subject to disclosure under the Act only insofar as is compatible with the private party's proprietary interest in it (as well as the interests protected by any other applicable FOIA exemption, such as Exemption 2 or Exemption 3).
36. Any software or any other information that is generated by an agency and furnished to an outside party "exclusively" under a cooperative agreement should be treated under the Act in accordance with the provisions of any specific congressional enactment pertaining to such information.
37. If an agency maintains an electronic information system in such a way that objectively understandable access to any nonexempt information in it is dependent upon a computer program that is unavailable to the public (including instances of "embedded proprietary software," even where it may be characterized as "firmware"), then the agency should upon request take all practicable steps to convert the data in order to afford FOIA access to it.
38. The Act's definition of "record" should broadly encompass items in conventional media form -- e.g., books and maps -- as well as information maintained in electronic form.
39. However, as a general rule, it should explicitly exclude any such reference item that has been acquired by the government and either is made commercially available by an outside proprietary interest holder or is otherwise publicly available in the absence of any proprietary interest. Example: library reference materials, such as are discussed in the Tax Analysts decisions. Exception: photocopies of publication portions that, as maintained in agency files, are themselves reflective of agency activity (e.g., copies of sections of the United States Code located in a prosecution file).
40. Likewise, the definition should explicitly exclude any such reference item that is generated by the government and is distributed through GPO or any other such government publication outlet (e.g., GSA's Consumer Information Center), in accordance with OMB Circular A-130.
41. Likewise excluded should be any electronic reference information that is made publicly available by any government agency; such information should be made available through established electronic information outlets, not through FOIA requests.
42. In responding to FOIA requests seeking only specified portions of databases, agencies should search for and retrieve data in the manner in which they do so in the ordinary course of agency business (i.e., with their existing retrieval-programming capability) for the database systems involved.
43. Where requesters seek to have data retrieved according to specifications other than those ordinarily used by agencies for data retrieval from the database system involved, agencies should comply with such requests, as a matter of administrative discretion, where they can efficiently do so.
44. Agencies should be required to retrieve data according to such new specifications only where the extraordinary retrieval activity involved meets some specific standard -- ideally, an objective one (e.g., a set amount of "programming" time, measured in dollar value or otherwise, or the use of a specified level of "programming" expertise).
45. The simplest and most workable objective standard for this
purpose, one that has a firm basis in existing FOIA administration, is the
amount of time that is required for the extraordinary retrieval activity
that is involved (i.e., the time required to develop the computer
programs, routines, and symbolic languages necessary to control the
functioning and direct the operation of the agency's computer system for
that new retrieval purpose); that quantification already is required for
the calculation of an applicable FOIA fee for any computer-search activity
that is undertaken by an agency. (See OMB Uniform FOIA Fee Schedule &
Guidelines, 52 Fed. Reg. 10,011, 10,018-19 (Mar. 27, 1987) (establishing
a fee mechanism for "computer searches" in terms of "hourly" rates); see
also 5 U.S.C.
46. Agencies should be required to retrieve data according to new specifications where the extraordinary retrieval activity involves two person-hours or less of computer program-development time. (Note that this standard specifically does not include the computer system operation activities that implement those new specifications and that are distinct from the process of computer-program development. Computer system operation activities include what is referred to as "central processing unit [CPU] operating time" in the OMB Fee Guidelines, 52 Fed. Reg. at 10,018, but also may include other information-processing resources used in the processes of computer operation.)
47. In setting this level of extraordinary search activity that can be compelled by a FOIA requester, it should be recognized that any such requirement, in tandem with the "record" status (and ordinarily nonexempt nature) of agency software, holds some potential for compelled software creation.
48. Similarly, it also should be recognized by Congress that both agency computer-program development resources and agency computer system operation resources are highly valuable and finite; both of these categories of agency resources will be impinged upon by the level of new search activity that is required.
49. Additionally, given the critical importance of agency computer system operation resources to the performance of primary agency missions, and in accordance with Principle #13, above, Congress should likewise establish a specific level of those resources not required to be exceeded in meeting the demands of any FOIA request -- regardless of whether the retrieval activity is extraordinary in any other sense; that level should be set through some workable, objective standard of measurement (e.g., at a resource level equivalent to some fixed dollar amount, as calculated through use of the agency's "resource algorithm" for the particular system involved). The exact level set should be based upon a careful analysis of individual agency resource limitations.
50. Agencies should make use of the capability to redact exempt information through electronic means, including through the acquisition of software packages for those purposes, wherever it is most efficient to do so.
51. Where redactions are made by electronic means, or within electronic information in a manner that is not readily apparent, the requester should be notified of the extent of the redactions.
52. This likewise should apply to redaction in conventional record form, in which case the extent of redactions ordinarily can be shown on the face of partially disclosed records.
53. An agency should not be required to specify the nature or extent of any redaction or withholding of exempt information in the exceptional circumstance in which the very nature or extent of the redaction itself is a sensitive, exempt fact (e.g., where the very volume of exempt information would reveal the magnitude of an ongoing law enforcement investigation). Likewise, this requirement should not apply to the circumstance in which an agency can neither confirm nor deny the existence of any responsive record without disclosing an exempt abstract fact (colloquially known as "Glomarization").
54. Agencies should not be required to aggregate, "compact" or modify electronic data in any way in order to release it to FOIA requesters in nonexempt form; they may do so as a matter of administrative discretion, just as FOIA requesters may modify their requests in order to encompass only nonexempt data.
55. As a general rule, the requester should be given the choice of any existing form in which a requested record is maintained by an agency; in other words, the precedent of Dismukes v. Department of the Interior (which gives the agency its choice among existing multiple record forms, so long as it chooses "reasonably") should no longer be followed.
56. This should apply to choices between conventional record forms (e.g., paper vs. microfilm) as well as to choices between existing electronic formats. Exception: any situation (such as often exists with archival records) in which the original form of a record cannot readily be handled without damage to it, so an existing copy form (e.g., microfilm) is used instead.
57. An exception also should be established for circumstances involving partially exempt records in which agencies need to handle the records in a certain form for purposes of redaction and therefore cannot readily disclose them, as redacted, in a previously existing form. Examples: microfilm or electronic information that must be converted to paper form for redaction purposes.
58. As a general rule, the decision whether to disclose requested records or information in a new form or electronic format is a matter of administrative discretion; in exercising that discretion, agencies should consider administrative efficiency and the existence of identified public demands for the information.
59. Agencies should be required to disclose requested records or information in a new form or electronic format only where information already is maintained in one electronic format, the requester seeks to have it disclosed in a different electronic format, and the agency determines that it can convert the information to the requested format with the expenditure of two person-hours of time or less.
60. The computer system operation resource limitations set forth in Principles #48 and #49, above, should apply to agency obligations under this heading as well.
61. As another exception to the general rule, a FOIA requester should be entitled to obtain a paper "printout" of any nonexempt electronic records -- or any readily retrievable, nonexempt part of such records -- if the requester so prefers and actually pays the full differential cost.
62. The term "major information system" should be defined as it is in OMB Circular A-130. In other words, the scope of electronic information subject to any affirmative FOIA obligation should be clearly established.
63. At the time of "major information system" establishment, agencies should consider both the potential FOIA availability of the information involved as well as the affirmative availability of the information apart from the FOIA.
64. Agencies should establish inventories of their "major information systems" to the maximum extent practicable, in accordance with OMB Circular A-130.
65. An agency should not be required to identify the existence of a particular database or electronic system in the exceptional circumstance in which its existence is itself a sensitive, exempt fact. Example: a new investigatory database the existence of which necessarily reflects the existence of an ongoing law enforcement investigation protectible under Exemption 7(A).
66. Agency affirmative disclosure obligations should extend to records that have been processed under subsection (a)(3) only to the extent determined to be practicable in the exercise of agency administrative discretion.
Go to: FOIA Update Home Page