GAO audit: Public records mishandled by National Archives

By Lisa Rein
Washington Post Staff Writer
Wednesday, October 27, 2010; 11:57 PM

As the federal government shifts its records from paper to computers, the National Archives, the nation's recordkeeper, has left itself vulnerable to significant security breaches by failing to properly safeguard reams of sensitive information, government auditors said Wednesday.

Four out of five federal agencies are at risk of illegally destroying public records, and the Archives has a huge backlog of documents that need to be preserved, the Government Accountability Office also found.

The two reports by Congress's watchdog arm say that many agencies do not follow proper procedures for disposing of public records as they assess whether to keep or destroy them. And the Archives, as it preserves records electronically, has left itself open to hackers.

Among other findings of the year-long audits: The Archives did not protect its computer networks with a strong firewall to keep out unauthorized users; passwords are weak; sensitive information is not encrypted; and there are not enough physical controls on who can enter computer areas.

"Collectively, these weaknesses could place sensitive information . . . at increased and unnecessary risk of unauthorized access, disclosure, modification, or loss," the auditors wrote. Even though the agency has a well-formed information security program, the auditors attributed most of the weaknesses they identified to the agency's failure to fully implement it.

The GAO gave the Archives good marks for improving its oversight of how well the government is safeguarding and preserving its records. But the auditors concluded that big challenges remain, including a "large and persistent" backlog of paper and media records that need to be preserved.

In a statement, Archivist David S. Ferriero called his agency's mandate to safeguard "billions" of original records an "enormous and complex undertaking" made more challenging by the demands of creating electronic records on multiple platforms. All public research institutions face the same risks and challenges, he said.

Ferriero, who has been in the job for a year, said he welcomes the audits. "Since becoming archivist . . . I have committed to making improvements in how we deliver on the [Archives'] core mission of protecting and providing access to the records of our government," he said.

The National Archives and Records Administration operates records centers in 20 states, including 13 presidential libraries. Its budget is about $470 million this year. Records range from arcane legal documents to the Declaration of Independence, the U.S. Constitution and other treasured pieces of history on display in the agency's Washington rotunda.

The reports, requested by Sen. Charles E. Grassley (R-Iowa) come more than a year after news reports of key items missing from the Archives, including a patent file for the Wright brothers' flying machine. It was last seen in 1980 after passing around multiple Archives offices, the Patent and Trademark Office and the National Air and Space Museum. The reports released Wednesday highlight a lost computer drive from the Clinton administration that exposed Social Security numbers of White House staffers and visitors.

Each government agency is supposed to either seek permission to destroy records or recommend preservation at the Archives. Proposals to dispose of records must be published in the Federal Register and undergo a 30-day comment period.

The auditors found that some documents face the threat of deterioration even though they've already been tagged for preservation. Just 35 percent of the Archives' holdings were preserved last year, the report says. In some cases, a document's condition is already so poor it can't be read. The backlog comes to more than 2 million cubic feet of records.

The Associated Press contributed to this report.

© 2010 The Washington Post Company