Web 2.0 technologies also include social media services, which  allow individuals or groups of individuals to create, organize, edit,  comment on, and share content. As of April 2011, 23 of  24 major federal agencies had established accounts on Facebook, Twitter,  and YouTube. GAO Has Identified Challenges in Agencies’ Use of Social Media

In July 2010, we testified that while the use of Web 2.0 technologies,  including social media technologies, can transform how federal agencies  engage the public by allowing citizens to be more involved in the  governing process, agency use of such technologies can also present  challenges related to records management, privacy, and security. Agencies may face challenges in assessing whether the  information they generate and receive by means of these technologies  constitutes federal records. In addition, attackers may use social media to collect  information and launch attacks against federal information systems. While Facebook, Twitter, and YouTube offer unique  ways for agencies to interact with the public, we identified several distinct  ways that federal agencies are using the three social media services. Despite varying features of the three platforms, agency interactions can be  broadly categorized by the manner in which information is exchanged  with the public, including reposting information already available on an  agency Web site, posting original content not available on agency Web  sites, soliciting feedback from the public, responding to comments, and  linking to non-government Web sites. Facebook was used to post content such as pictures and descriptions of  officials on tours or inspections. YouTube was often used to publish videos of officials discussing topics of  interest to the public. Twenty-two of 23  agencies used social media to solicit comments from the public. Agencies used Facebook to respond to comments received on their  Facebook pages. Federal Agencies Have Made Mixed Progress in Developing Policies and Procedures for Managing and Protecting Information Associated with Social Media Use

Federal agencies have made mixed progress in developing records  management guidance and assessing privacy and security risks associated  with their use of commercially provided social media services. Specifically, 12 of the 23 major federal agencies that use Facebook,  Twitter, and YouTube have developed and issued guidance to agency  officials that outlines (1) processes and policies for how social media  records are identified and managed and (2) record-keeping roles and  responsibilities. Further, 12 agencies have updated their privacy policies to  describe whether they use personal information made available through  social media. However, the widespread use of social media technologies also introduces  risks, and agencies have made mixed progress in establishing appropriate  policies and procedures for managing records, protecting the privacy of  personal information, and ensuring the security of federal systems and  information. Specifically, regarding our recommendation that the  department conduct and document a security risk assessment to assess  security threats associated with agency use of commercially provided  social media services and identify security controls that can be used to  mitigate the identified threats, he stated that the department shared GAO’s  concern regarding the security of information in commercially provided  social media but that since the department had already determined that its  use of social media sites would be limited to providing the public with  “low-impact” information, no further risk assessment or certification and  accreditation was required. Appendix I: Objectives, Scope, and Methodology

Our objectives were to:    describe how agencies are currently using commercially provided social    determine the extent to which federal agencies have developed and  implemented policies and procedures for managing and protecting  information associated with the use of commercially provided social  media services. These categories were (1) reposting information available on  agency Web sites; (2) posting content not available on agency Web sites;  (3) soliciting comments; (4) responding to comments on posted content;  and (5) providing links to non-government Web sites. We interviewed officials at each of  these agencies to discuss recent efforts to oversee the development of  social media policies and procedures and assess risks. Environmental Protection Agency

To ensure that appropriate privacy and security measures are in place  when commercially provided social media services are used, we  recommend that the Administrator of the Environmental Protection  Agency take the following two actions:    Conduct and document a privacy impact assessment that evaluates  potential privacy risks associated with agency use of social media services  and identifies protections to address them.
Why GAO Did This Study

Federal agencies increasingly use recently developed Internet technologies that allow individuals or groups to create, organize, comment on, and share online content. The use of these social media services-- including popular Web sites like Facebook, Twitter, and YouTube-- has been endorsed by President Obama and provides opportunities for agencies to more readily share information with and solicit feedback from the public. However, these services may also pose risks to the adequate protection of both personal and government information. GAO was asked to (1) describe how federal agencies are currently using commercially provided social media services and (2) determine the extent to which agencies have developed and implemented policies and procedures for managing and protecting information associated with this use. To do this, GAO examined the headquarters-level Facebook pages, Twitter accounts, and YouTube channels of 24 major federal agencies; reviewed pertinent policies, procedures, and guidance; and interviewed officials involved in agency use of social media..

What GAO Found

Federal agencies have been adapting commercially provided social media technologies to support their missions. Specifically, GAO identified several distinct ways that 23 of 24 major agencies are using Facebook, Twitter, and YouTube. These include reposting information available on official agency Web sites, posting information not otherwise available on agency Web sites, soliciting comments from the public, responding to comments on posted content, and providing links to non-government sites. For example, agencies used Facebook to post pictures or descriptions of the activities of agency officials and to interact with the public. Agencies used Twitter to provide information in an abbreviated format and to direct the public back to official agency sites. YouTube was used to provide alternate means of accessing videos available on official agency sites, share videos of agency officials discussing topics of interest, or to solicit feedback from the public. The use of these services can pose challenges in managing and identifying records, protecting personal information, and ensuring the security of federal information and systems. However, the 23 major agencies that GAO identified as using social media have made mixed progress in developing and implementing policies and procedures to address these challenges: (1) Records management: 12 of the 23 agencies have developed and issued guidance that outlines processes and policies for identifying and managing records generated by their use of social media and record-keeping roles and responsibilities. (2) Privacy: 12 agencies have updated their privacy policies to describe whether they use personal information made available through social media, and 8 conducted and documented privacy impact assessments to identify potential privacy risks that may exist in using social media given the likelihood that personal information will be made available to the agency by the public. (3) Security: 7 agencies identified and documented security risks (such as the potential for an attacker to use social media to collect information and launch attacks against federal information systems) and mitigating controls associated with their use of social media. In several cases, agencies reported having policies in development to address these issues. In other cases, agencies reported that there was no need to have policies or procedures that specifically address the use of social media, since these are addressed in existing policies. However, social media technologies present unique challenges and risks, and without establishing guidance and assessing risks specific to social media, agencies cannot be assured that they are adequately meeting their responsibilities to manage and preserve federal records, protect the privacy of personal information, and secure federal systems and information against threats.

What GAO Recommends

GAO recommends that agencies ensure that appropriate records management, privacy, and security measures are in place. Most of the agencies agreed with GAO's recommendations. Three agencies did not agree with recommendations made to them; GAO maintains that the actions are necessary.