GUIDELINES
FOR ELECTRONIC RECORDS MANAGEMENT
ON STATE AND FEDERAL AGENCY WEBSITES


Charles R. McClure
E-mail: cmcclure@mailbox.syr.edu
Distinguished Professor
Syracuse University
School of Information Studies
Syracuse, NY 13244
Telephone: 315-443-2743

J. Timothy Sprehe, Ph.D.
E-mail: jtsprehe@intr.net
President, Sprehe Information
Management Associates, Inc.
4201 Connecticut Ave., N.W.
Washington, DC 20008
Telephone: 202-364-5300


I. INTRODUCTION

The purpose of this research project, supported under a grant from the National Historical Publications and Records Commission (NHPRC), was to develop records management and preservation strategies for electronic information contained in state and federal agency websites. More specifically, the project aimed to:

In the course of their research, the investigators:

In the data collection stages of the research project, a study team at Syracuse University focused in early 1997 on locating information from state websites, state employees, and listservs related to records management. They searched all 50 states' websites; subscribed to, monitored, and interacted with listservs pertinent to records management; and conducted electronic mail and telephone surveys in all 50 states concerning electronic records management (ERM) and records management on websites. In addition to these surveys, other data collection techniques the investigators used were questionnaires, focus groups, and in-depth interviews. The investigators conducted site visits to three states and five federal agencies. They made presentations to, and collected data from, the National Association of Government Archivists and Records Administrators (NAGARA), the National Records Management Conference of the U.S. Environmental Protection Agency, the World Wide Web Federal Consortium, the Federal Webmasters Forum, and the FedNet '97 conference. The research profited from several informal meetings with senior staff at the U.S. National Archives and Records Administration and the National Library of Canada, meetings conducted independently by the investigators and not funded under the NHPRC grant.

The project advisory committee met twice, in February at the outset of the research and in November, at the point when the investigators had finished data collection and were formulating preliminary conclusions.

A final report provides in detail the project's methodologies, data collection activities, related literature analysis, side-by-side analysis of seven agency policy statements, and other study products. The final report, as well as a copy of these guidelines, can be found at .

II. WEBSITE RECORDS MANAGEMENT

Ground-Rule Assumptions

State and federal agencies are public bureaucracies, and, as such, they share many common characteristics. They also are widely diverse organizations with respect to legal and regulatory structures, as well as mission, size, scale, organizational complexity, and many other factors. In approaching the task of proposing model guidelines for website records management in state and federal agencies, the investigators subscribed to certain assumptions about the agencies themselves and the policy context into which guidelines might be inserted. This section describes the assumptions that have served as touchstones in writing the guidelines.

Discussion of Terms

Website. The term "website" defies precise definition. The World Wide Web Federal Consortium (1996, Appendix A) defines a website as: "A collection of information, documents, or databases that is provided to a user community using World Wide Web formats and protocols." For the purposes of these guidelines, the working definition is: a website is a set of Uniform Resource Locators (URLs) that fall under a single administrative control. This is an operational rather than analytic definition, used because the research project found no consistent patterns in how websites are administered and named. A state government, for example, may have a single umbrella domain name; within the umbrella domain name, each department of state government may have its own sub-website; major offices, bureaus, or administrations within a department may have sub-sub-sites; and so on, into ever more detailed refinements. And all of this occurs within a single domain name so that the user at least knows that all of the URLs pertain to that particular state. In other cases, subagencies in federal departments may have unique domain names, so that the user is unable to tell from the URL that the subagency is a component of the larger department. The department's umbrella website simply hyperlinks to the subagency URLs. The point is that the permutations and combinations in website administration appear endless. As long as the organization treats a set of URLs in a unitary fashion, the set is a single website.

Record. The term "record" is used in the realm of archives and records management[1], and the same term is used in the realm of information technology. The two usages have overlapping but dissimilar meanings. In this report, the term record is used in the meaning found within the world of archives and records management. This meaning of record is the definition found in statutes, whether federal or state. For example, the definition of the term under the Federal Records Act is as follows:

A record consists of information, regardless of medium, detailing the transaction of business. Records include all books, papers, maps, photographs, machine-readable materials, and other documentary materials, regardless of physical form or characteristics, made or received by an Agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that Agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the value of data in the record. (44 U.S.C. 3301, reference [bb]) [See, for example, .]

In order to distinguish between records in the archival/records management sense and records in the information technology sense, the guidelines refer to "official records" (archival/records management) and "computer records" (information technology). Not all computer records are official records, and not all official records are computer records. This point seems so elementary as to approach triteness, yet the confusion between the two senses of the term continually clouded site visits and discussions involving both webmasters and records officers during the course of the project.

Transfer to Recordkeeping System. A recordkeeping system is defined as "a set of policies and procedures for organizing and identifying [official] files or documents to speed their retrieval, use, and disposition" (NARA 1993). State and federal government recordkeeping systems include the important condition that the system must comply with applicable laws and regulations for official records management and archives. When official records occur on agency websites (and are not elsewhere captured in recordkeeping systems), it is absolutely insufficient to say that the agency is keeping computer records of the websites. The reason it is insufficient is because the agency has no way of knowing whether the computer records comply with the conditions laid on official recordkeeping systems. An official recordkeeping system, for example, entails records schedules for authorized disposition of the records. If the reader finds the foregoing discussion confusing, a simply way to clarify the matter is to examine the rules set forth for software systems under DoD 5015.2-STD, the Department of Defense standard referred to below.

Purpose-Prepared and Interactive Real Time Website Postings. The research project encountered two different kinds of record creation on websites. In one case, the informational material is created by a content creator or manager, usually in a program office and usually in a word processing system. The material is then transmitted to the webmaster who posts the material on the website without change. Here the webmaster performs a purely technical function of transferring electronic information, for example, from an agency intranet message to an Internet website posting, and only the content manager exercises control over the content[2]. This kind of material may be designated as purpose-prepared website postings. Here one presumes that responsibility for keeping records of the information form and content of the posting rests with the content manager. That is to say, records management would normally be accomplished before the materials are posted to the website[3].

In the second case, however, the record is created interactively in real time, beyond immediate control of a content manager or records officer. The example below of the public hearing is a case of interactive real time website postings. This latter case appears to be a new phenomenon for which traditional records management policies and procedures are inapplicable. The postings are interactive because they involve a back-and-forth between agency officials and members of the public involving questions and response and/or comments and rejoinders that are unrehearsed and unscripted. If the record is being created "on the fly," special measures are necessary to establish a linkage with an agency records system.

While interactive real time postings may be infrequent at the moment, they seem certain to occur more often in the future as agencies discover more innovative ways to serve the public through the Internet. The distinction between purpose-prepared and interactive real time website postings should become clearer from examination of the examples cited in the next section.

Relationship of Website Records Management to Other Policies

Records Management Policies. Some agencies embrace without examination the erroneous assumption that no original official record materials occur on their websites that are not elsewhere captured into recordkeeping systems. Many agencies use disclaimers to state that the information on their websites is not the "official version."[4] Despite these disclaimers, in-depth interviewing revealed multiple cases where record-quality materials appear uniquely in agency web postings. The reason this is so is because agencies continually explore more innovative uses of their networks and often venture into usage modalities that no one anticipated even a few months ago. Here are some examples where record-quality materials may occur on websites and not be found elsewhere:

The conclusion drawn from these examples is simple: agency officials must understand that some materials posted on agency Internet websites qualify as official government records and must be transferred into appropriate recordkeeping systems.

Both federal and state agencies must clarify requirements and responsibilities for ERM, both within and external to the individual agency.

Other Policies. Website records management is a subject that has ramifications for and is affected by many other policy areas. In the normal course of business, state and federal agencies likely will have developed policies dealing with these areas. Among the policy areas that touch website records management are policies for:

Rather than creating de novo a policy on privacy, security, Internet usage, etc., the state or federal official is most likely to be in the situation of having to apply pre-existing policy on such topics. The pre-existing policies may or may not fall under the individual official's jurisdiction, when he or she addresses website records management. Policy governing acquisition and management of information technology or software systems, for example, may very well be the domain of another official or another agency. Given the great diversity of such policies in the myriad contexts of state and federal agencies, an appropriate response is:

Sooner or later, in some form or other, all state and federal agencies must deal with the foregoing policy areas. Hence, in setting boundaries on the scope of the research activities, the "principle of parsimony" dictated that guidelines would not be written for policy areas that the agencies would ordinarily cover in the course of other business. For example, the guidelines do not cover basic records management concepts and principles, or general best practices for establishing and maintaining agency home pages and websites.

Electronic Records Management: A Special Case. Agencies wishing to apply the guidelines to their own situations will quickly discover that one area of policy development is especially critical for website records management: electronic records management. At the present writing, the field of ERM policy for state and federal agencies is still new and largely undeveloped. Pioneer efforts are occurring in many places, as this report's literature review indicates, but one cannot yet point to a well settled body of doctrine dealing with how government agencies should manage their electronic records in general, as well as their website records in particular. The research project found that the best predictor of whether an agency has dealt seriously with website records management is whether the agency already has or is in process of developing an ERM policy.

The research project analyzed the seven federal agency records management policies that the investigators were able to locate[5]. For agencies that are just beginning the process of developing their ERM, three examples offer good starting points for adapting the work of others to the mission and needs of an agency.

Website Administrative Models and Responsibilities

This research has reinforced the obvious facts that state and federal agencies' Internet activities range from the elementary to the highly sophisticated. The state of website development in a given agency is a function of many factors, among which are the following.

Smaller agencies with very specific missions (or smaller components that operate their own websites within larger agencies) tend to have more limited website development. Larger agencies that have complex missions and programs accompanied by correspondingly larger information technology investments and expertise understandably have substantially more resources to devote to their websites. Agencies that have more top-down hierarchical structure, such as the military services, tend to have more formally developed policies and procedures governing website activities. On the one hand, some agencies "live in a fish bowl" of close, continuous scrutiny by their legislature, the courts, the press, and the public, and hence are correspondingly more careful about what appears on their websites. On the other hand, those same agencies tend to have public constituencies that press for release of ever more government information, and hence have more fully mature websites.

Three major areas of responsibility affect website recordkeeping: webmasters (or website managers), content managers, and records officers. The three areas of responsibility are distinguished as follows:

The functions of developing website content, managing agency records, and managing websites are often lodged in different parts of agency organization, command very different skills, and are carried out by different people. With some exceptions, webmasters are not records officers and records officers are not webmasters. Content managers are most often the subject matter specialists in program offices, and they are neither records officers nor webmasters.

The dimension of time further complicates the picture. Some agencies are just now beginning their website activities, while others have several years of experience. For those just starting out, the generalizations in the previous paragraph often do not hold true; in the beginning, the webmaster frequently discharges all three responsibilities. The webmaster sets up and maintains the servers, designs the home page "look and feel," chooses the contents, decides when postings go up and come down, and, if anyone worries about website records management, it is the webmaster.

The pace of change in ERM and website development is extremely rapid, with new uses being discovered and piloted every day. Table 1 summarizes typical evolutionary stages at the time this research was carried out.


Table 1: Typical Stages in Website Administration and Responsibilities


Accountability Exposure Analysis

Inevitably, agencies must cope with accountability for their websites. In its fundamental sense, accountability means the ability to reconstruct an accurate picture of the past through records that can be used as evidence[7]. Agencies are accountable in many ways, beginning with their responsibilities to abide by the laws enacted by their legislatures. Accountability in the present context also means the real possibility that agencies will be called to account-- whether in a court of law, in the court of public opinion, before the legislature, or in the court of history--for what appears on their websites. Accountability comes in many forms and shapes as well, from appearing before a hostile legislative committee with television cameras whirring, to answering a court's subpoena, to responding to reference librarians phoning to ask what became of a web posting from six months ago.

Accountability is at the heart of archives and records management; the raison d'etre of records is accountability. Records management accountability consists of discharging responsibilities to keep records under applicable statutes. Just as with any other business activity, agencies must keep records about their websites to satisfy a range of responsibilities, most notably records management statutes and regulations. Exactly what website records agencies should keep is a matter for debate, study, legal opinion, and senior management decision making within each agency, but the fundamental recordkeeping mandate cannot be in doubt.

A complicating factor is that different websites have different levels of what is here called "accountability exposure," the real likelihood of being called to account and the level of precision and detail the accounting will require.

For each of its websites, an agency should perform an accountability exposure analysis; that is, an appraisal of the extent to which the agency is or is not fulfilling its legal and other responsibilities under recordkeeping statutes and other obligations, and the real possibility the agency will be called to account. Depending on the outcome of the analysis, the agency should design appropriate management and recordkeeping responses.

Accountability exposure analysis could be conducted as an informal appraisal carried out by well-informed management, or it could be a more formal exercise. One may think of certain parts of agency organizations as being specifically in the business of accountability. In particular, an agency's legal counsel and its public affairs office perform the functions of monitoring the agency's accountability vis-a-vis the law and the public, respectively. It is not surprising, then, that, in many of the agencies the research project examined, the legal counsel and public affairs offices play important gatekeeper functions for websites. In DoD, for example, the approval of the Assistant Secretary of Public Affairs is needed in order to establish a website. In agencies frequently the subject of litigation, the legal counsel's offices are particularly sensitive to website content.

Parallels can be drawn between accountability exposure analysis and what is known in other contexts as risk analysis or risk assessment. Risk analysis is a set of procedures applied to information systems to determine an appropriate level of security for the systems. In a typical security context, for example, agencies are enjoined to "protect government information commensurate with the risk and magnitude of harm that could result from the loss, misuse, or unauthorized access to or modification of such information" (OMB 1993)[8].

The neologism accountability exposure analysis was coined deliberately in order to avoid nomenclature in the realm of information systems security. The kind of accountability under discussion here is much broader than information systems security. Here, accountability includes, for example, political and public relations risks as well as the risk that important materials pertaining to the history of the agency might be lost. As a minor example, the Virginia legislature is called the General Assembly. When a state agency referred to its website as a "Virtual Assembly," the agency attracted unfavorable attention from state legislators.

The key aspects of accountability are the ability to reconstruct what occurred in the past and the exactness of reconstruction that circumstances may demand. Cost of reconstruction is a vitally important factor, but so is the likelihood the reconstruction will be required. It makes no sense to create expensive procedures for reproducing exactly what occurred on a website in the distant past when the agency is never likely to need an exact reproduction.

Accountability Exposure Analysis and Recordkeeping Response

Following this line of reasoning, different levels of accountability exposure demand different levels of recordkeeping response, as the typology illustrated in Table 2 suggests.


Table 2: Accountability Exposure Analysis and Recordkeeping Response
(Note: This is a .pdf file)


III. GUIDELINES FOR WEBSITE RECORDS MANAGEMENT

State and federal agencies should adapt the guidelines below to their individual circumstances.

Primary Records Management Principle

The primary records management principle for state and federal agency websites is:

When materials are posted to an agency website and . . .

the materials qualify as records, and . . .

the materials have not already been adequately captured in an agency recordkeeping system, then . . .

the agency must take steps to establish a linkage between the website and an agency recordkeeping system and transfer the records into the recordkeeping system.

Website Guidelines: General Information Resources Management

The research project found again and again that lower-level webmasters, who were almost always both innovative and responsible individuals, had taken on general management functions for websites because their senior management had not yet recognized the significance of new Internet applications for agency missions. Certain functions with respect to website management properly fall within the realm of general IRM. That is, they pertain to the responsibilities of an agency's Chief information Officer, a senior manager, rather than the responsibilities of webmasters or content managers, who are more likely to be mid-level managers. Policy issues requiring coordination at a senior management level (e.g., with the agency's general counsel and public affairs offices) often need ironing out before mid-level managers can proceed to develop operational procedures. For this reason, the guidelines are split in two: first, general IRM, and second, records management viewed as part of IRM.

A. Information Resources Management Guidelines

A.1. Raise the Level of Education/Awareness Concerning Website Accountability. Agency IRM managers should ensure that management throughout the agency is made aware of both the positive potentialities and negative liabilities that websites offer for mission fulfillment. This includes appropriate reminders about records management statutes and regulations, as well as other policy areas referred to above.

A.2. Conduct Accountability Exposure Analysis for Each Agency Website. Agency managers should see to it that their agencies analyze the accountability exposure of each website, both when the site is established and periodically thereafter.

A.3. Ensure that Records Management Is Included in Agency Accountability Exposure Analysis. Agency managers should familiarize themselves with records management statutes and regulations sufficiently to ensure that records management responsibilities are adequately discharged within agency websites.

A.4. Establish Overall Management and Control Structure for Agency Websites. Agency managers should establish policies and procedures governing who has the authority to create websites, including the conditions under which the agencies' legal counsels and public affairs offices should be consulted.

A.5. Identify Responsibilities for Websites. Agency managers should examine the organization and functioning of their websites to identify the offices and persons functioning as webmasters, content managers, and records officers.

A.6. Establish and Maintain Communications. Agency managers should take steps to ensure that webmasters, content managers, and records officers communicate regularly with one another rehe specification of the set of responsibilities pertaining to website management and assign the responsibilities to the various offices and persons who will function as webmasters, content managers, and records officers, including the responsibility to coordinate with one another.

B. Records Management Guidelines

Given an overall IRM regimen for agency website management, certain functions remain that deal just with records management. The guidelines below cover records management aspects of websites.

B.1. Develop or Review Agency Electronic Records Management Policy and Procedures. Agencies should develop an overall ERM policy and associated procedures in order to manage website records, as well as other non-paper records.

B.2. Carry Out Accountability Exposure Analysis for Each Website and Design Appropriate Records Management Response.

B.2.a. For each website, the webmaster, content manager, and records officer should jointly determine the site's accountability exposure, seeking advice, where appropriate, from legal counsel and the public affairs office. Websites may be classified as having low, moderate, or high accountability exposure.

B.2.b. The webmaster, content manager, and records officer should jointly determine appropriate recordkeeping responses to low, moderate, and high accountability exposure sites.

B.3. Examples of Different Records Management Responses.

B.3.a. Low Accountability Exposure. Existing records management policies and procedures suffice. Continue periodic review of website to determine whether accountability exposure increases.

B.3.b. Moderate Accountability Exposure. In addition to policies and procedures for low accountability exposure, create and maintain an historical log for the website. Suggested data elements to include in the historical log are:

B.3.c. High Accountability Exposure. In addition to policies and procedures for low and moderate accountability exposure, create procedures for periodically taking an electronic "snapshot" of the entire website. These snapshots are official records to be transferred to a recordkeeping system. A snapshot may be taken as frequently as daily, hourly, or at some other period. Agencies should review frequently the appropriate periodicity of snapshots.

B.4. Establish Records Management Linkages and Transfers. Agencies should ensure that, where record-quality materials occur on websites, linkages have been established to agency recordkeeping systems and the automatic transfer of records to recordkeeping systems actually occurs.

B.5. Assign Records Management Responsibilities for Purpose-Prepared and Interactive Real time Website Postings.

B.5.a. Purpose-Prepared Materials. For materials prepared in advance for website posting, the agency should establish procedures for capturing records of the materials and transferring them to recordkeeping systems.

B.5.b.Interactive Real time Materials. For materials that appear on agency websites as a result of an interactive real time event, agencies should assign responsibilities, preferably in advance of the event's occurrence, specifying how the materials will be assessed from a recordkeeping standpoint, which program office has recordkeeping responsibility for the materials, and how resulting records will be transferred to agency recordkeeping systems, and establishing follow-up review to ensure that transfers actually occur.

IV. IMPROVING RECORDS MANAGEMENT ON STATE AND FEDERAL AGENCY WEBSITES

Next Steps and Open Issues

The guidelines propose a number of ideas and approaches for managing electronic records on state and federal websites. The research suggests answers to some questions but also raises new issues perhaps not previously encountered. The investigators believe the following issues are particularly important.

Awareness of the Importance of ERM on Websites. A number of state and federal agencies contacted by the study team showed little awareness of the possibility that records occur on agency websites, let alone their implications. For some, the idea that official records were on their websites and thus, fell within records management programs had not been considered. The research demonstrates a significant need for increasing the awareness of state and federal officials as to the importance of managing electronic records on government websites.

Raising awareness may require a range of educational programs in each agency. It will also require leadership from key agencies such as NARA at the federal level as well as state archivists and records managers at the state level. The importance of developing strategies, guidelines, and policies for ERM in state and federal websites will only continue to increase in the future as more records are available only in electronic format, and only on websites.

State/Federal Coordination of ERM Policies. While are many differences certainly exist between the needs of state versus federal agencies with respect to ERM of websites, this research identified more similarities in terms of issues, practices, and concerns. Better sharing of information, policies, practices and lessons learned needs to occur between the state and federal officials that deal with ERM in general, and particularly those dealing with ERM on websites. Development of a national clearinghouse to exchange and manage such information would greatly assist in the development of ERM on websites. Such an effort would in itself increase awareness of the importance of ERM issues related to state and federal websites.

Website Records Schedules. The guidelines call for transferring record-quality website materials to recordkeeping systems, an imperative that means bringing the materials under records schedules. Few state and federal agencies are likely to have applicable records schedules for records occurring on websites. Hence, an effort to adapt the guidelines to agency circumstances will probably require preparing new or revised schedules for records on web sites, work that should ideally be on the series or file unit level for all material on the web site. If an agency has, say, ten separate records series posted on its website, then it will need ten distinct records schedules (or schedule items) to address the web version of the records.

The Medium and the Message. Finally, the guidelines leave open important issues of records management philosophy. As an example, the discussion here stipulates that, for purpose-prepared website postings, records management responsibility rests with the content manager who prepared the posting, perhaps on a word processing system connected to an intranet. When the posting is transmitted to the public via the Internet, it is an open question as to whether the form and manner in which the information is disseminated (the website) becomes as important as the content itself. The content manager may have transferred the posting's contents to an ERM system, but does and should the ERM system include, as a matter of record, the fact that the contents were disseminated via a website?

Websites as Publications? In various meetings and conversations during the conduct of the research, some of which involved NARA staff, the study team learned that, as a rule of thumb, federal agency publications are considered to be permanent records. This rule of thumb would have serious consequences if it were decided that agency websites are official publications, because it would seem to mean that websites must be preserved as permanent records. The procedural and cost considerations would quickly become prohibitive. At present, no statutory definition of an official federal publication exists, except for the definition in Chapter 19, Title 44, U.S. Code, which defines publication only as it pertains to federal depository libraries. Hence, the question of websites as official publications remains an open issue at the federal level. The presence of this issue only emphasizes the need for website ERM guidelines.

The guidelines also leave untouched entirely new areas of records management such as what to do about multimedia and hyperlinks within website postings. In what sense are hyperlinks within a posting an integral part of the posting for records purposes? How should records managers treat textual postings that include audio and video links?

Conclusion

The proposed guidelines represent a first step in developing both principles and practical approaches for developing and improving records management of state and federal agency websites. The authors recognize that a number of factors will affect the development and use of these guidelines:

These guidelines offer a beginning point for record managers, webmasters, policymakers, and others to develop principles, policies, and practices to better manage records on websites within their agency contexts. Multiple individuals have responsibilities related to records management of state and federal agency websites. Coordination of these responsibilities is critical for the success of any ERM process, and coordination begins with communications. In many instances, mid-level records officers, content managers and webmasters need to increase the awareness of senior management regarding these issues before policies and procedures can be developed. Website ERM appears to be an arena in which the rank and file must educate senior leadership. Discussion of these guidelines within an agency can provide a useful catalyst for increasing awareness and devising procedures for dealing with ERM issues.

This research found knowledge gaps, confusion, and conflicting views on how best to implement programs of ERM for websites, if indeed agencies have thought about them at all. When the study team conducted site visits in expectation of learning how agencies had coped with website ERM issues, the team often found that the agencies had never thought about the issues before. In that sense, the research was "ahead of its time," and perhaps its principal benefit will be to raise awareness of, rather than resolve, the issues.

Best practices in website ERM are changing daily. Doubtless the situation in state and federal agencies is now substantially different from what the research project found less than twelve months ago. Clearly, additional research is needed in this area to monitor evolving policies and practices. Especially needed will be studies that evaluate the success of ERM programs in terms of cost, public access, accountability, ease of use, and other measures.

Finally, these guidelines will evolve and be revised in light of the changing environment in which ERM occurs. The authors welcome comments and suggestions and expect to profit from suggestions to provide a revised and updated version of these guidelines during 1998. Issues related to ERM will only increase in importance, so that continued development of guidelines such as those offered in this research is essential.