The Government Guide to Digital Open Records Compliance

In 2019, The National Archives and Records Administration (NARA), issued Directive M-19-21. It states that federal agencies must:

• Manage all permanent electronic records in an electronic format
• Create, manage, and maintain permanent federal records—and their metadata—in electronic format
• Have closed their individual records storage facilities and transferred any inactive or temporary paper records to a Federal Records Center or commercial storage facility
• Maintain a records management program that complies with the Federal Records Act

Of course, NARA Directive M-19-21, and the overarching Federal Electronic Records Modernization Initiative (FERMI) are all concerned chiefly with recordkeeping practices for federal agencies. However, the guidance provided is immensely useful for improving and modernizing recordkeeping for state and local entities as well.

Programs like Council of National Archivists’ (CoSA’s) State Electronic Records Initiative (SERI) aims to implement similar changes at a state level government. There are also state-level regulations, initiatives, and guidance to consider.

The reality is, public-sector entities are dealing with a proliferation of online data sources and electronic records that all need to be managed appropriately. These could be related to website content, an organization’s official social media accounts, text messages sent both internally and externally, and even chats and files found within a modern collaboration tool like Microsoft Teams.

Given the volume, velocity, and variety of content; the complexity of websites; and the number of official social media accounts created and maintained by the average government organization, it quickly becomes clear how complying with modern recordkeeping demands can be challenging. For instance:

• How can automated systems be put in place to capture, categorize, and retain all historical website and social media content?
• How does an organization develop measures to ensure the integrity and preservation of website and social media records when this data is being hosted by a third party such as WordPress, Facebook (Meta), or X?
• How can this data ultimately be transformed and exported for easy transfer to a state archive?

Given the cloud-based nature of this data, traditional tools and workflows do not work. What is needed is an approach that is geared specifically towards online data, is scalable, and does not require manual processes.

All U.S. states have freedom of information regulations and sunshine laws that apply to modern electronic records. This includes website content, official social media accounts, text messages, and instant messages over collaboration apps.

EXAMPLE

During the COVID-19 pandemic, many states, cities, government departments, and local health authorities made use of their official websites and social media channels to keep the public informed. And given the unprecedented nature of the event, this information changed regularly, often on a daily (or even hourly) basis. As a result, there were a lot of FOIA requests for specific information that appeared on a website or social media account on a particular day. Fulfilling these requests has been difficult. Not only does this data need to be found and exported in a format appropriate for a records request, but if it has been edited or deleted on the original platform, it can be almost impossible to retrieve.

So, it’s clear that public-sector organizations need to ensure that they are—at a minimum—able to fulfill records requests related to these modern data sources.

It is far better, however, to take a proactive approach.

At its core, sunshine laws are aimed at improving government transparency. For this reason, proactive disclosure is highly recommended. Beyond reducing the number of records requests that must be processed, the proactive disclosure of official documents (especially frequently requested records) increases government transparency and builds public trust.

Consequently, many organizations are opting to take a best-practice approach and make as much information as possible publicly available—including historical website and social media content. (Jump to example.)

Online data presents unique challenges for meeting recordkeeping requirements:

• Ownership of Online Data: Cloud-based data owned by third parties makes it difficult for agencies to control and manage in alignment with recordkeeping best practices.
• Manual Processes: Relying on manual record capture methods like screenshots is labour-intensive, time-consuming and lacks the necessary metadata for compliance.
• Capturing Regularly at Scale: Organizations struggle to capture content on a frequent basis when they have large websites or active social media accounts, which results in significant record gaps.
• Capturing Complex Content: Websites and social media posts contain complex content, like Java, media files, links, etc., that is difficult to capture entirely, reliably. Content can also be edited or deleted, creating multiple records of a single post or webpage.
• Reviewing and Producing Records:Locating, accessing and then producing complex online data with sufficient accuracy and in required timeframes for compliance is challenging.

What can organizations do to effectively meet these challenges and archive online data in a compliant manner? Here are nine rules that organizations can follow to manage data appropriately and mitigate the risks associated with non-compliant recordkeeping:

1. Only Make Use of Official Accounts

Government bodies must create and use designated official social media accounts for official business communication and statements. This is essential to convey trust and ensure compliance.

Private accounts should be kept entirely separate. Providing separate devices for official usage can be beneficial in keeping communications clearly separated and facilitating the division of professional and personal conversations. It also prevents employees from accidentally posting under an official account instead of a personal one.

It is important to ensure that all staff members are fully aware of and briefed on the importance of this requirement. This applies to all digital channels, from social media to mobile text messaging.

Government bodies need to carefully control these accounts, implement a clear usage policy, and train staff on best practices. Access to these channels is also a consideration; only authorized people should have access to official accounts, and these permissions should be carefully calibrated to give the right levels of control.

2. Beware of BYOD

Incorporating personal devices into official government communications can be risky. It provides less security, making information more vulnerable to exposure and alteration, and it also makes it harder to keep track of conversations across multiple channels. In a Bring-your-own-device (BYOD) environment, personal and professional lines can become blurred, and it can be challenging to keep official records.

If official information is held on personal devices, it can legally be requested. Many people may feel that this is an infringement of their privacy. Ideally, government issued devices should be used to keep this area clear-cut.

If BYOD devices are necessary, ensure that electronic device management or mobile device management (MDM) applications are installed to mitigate the risks. Be sure to have a clear policy and training for all staff regarding the use of BYOD devices.

3. Collect All Communications

Meeting open records requirements goes far beyond archiving emails—obligations extend to text messages, social media accounts, website content, and beyond. All communication channels used by government bodies can be considered business records and must be archived by law. Therefore, all types of communication should be preserved, and those records should be protected from alteration or deletion. Conducting a complete audit of all communication channels can be helpful in ensuring that you are aware of your full liability and can take the necessary steps to ensure that everything is correctly captured and archived to meet required compliance standards.

In addition to archiving this information, government bodies need to monitor communication channels for inappropriate content, particularly in public-facing feeds. Thorough archiving practices can help keep track of any necessary moderation.

4. Know and Understand Relevant Sunshine Laws

In order to comply with sunshine laws, it is necessary to maintain accurate records that can be accessed in a timely manner when open records requests are received. It is also important to be clear about the specific requirements for archiving public records, including the required retention periods and guidelines for permanent deletion. Failing to comply with these laws can result in severe penalties and can damage your agency’s reputation. Without the ability to easily locate and access information, you may be forced to resort to costly external eDiscovery processes, which can consume a significant amount of time and resources.

It is therefore crucial to establish and maintain an effective recordkeeping system that satisfies all legal requirements. This includes periodic reviews of your recordkeeping practices to ensure that they remain up-to-date and fully compliant with any changes to the law.

5. Always Consider the First Amendment

When it comes to online communication between the public and government entities, a complex web of legal and ethical considerations can arise. While the First Amendment protects freedom of speech, it can also complicate the ways in which organizations can moderate user comments.

In order to maintain a safe and inclusive online space for all users, it is important for organizations to establish a clear policy outlining what kind of behavior is unacceptable. This might include, for example, profanity, racism, homophobia, or threats of violence.

It is also crucial for organizations to take steps to record and preserve all comments, even those that are edited or deleted. This can be particularly important in the event that a First Amendment challenge arises, as a complete archive can help organizations defend their actions and maintain transparency. By taking proactive steps to create a clear policy and establish robust recordkeeping practices, organizations can better manage online communication and protect themselves from potential legal and ethical issues.

6. Store Data in Original File Formats

Highly regulated sectors, including the government, must adhere to strict requirements for storing data. Failure to comply with these standards may result in severe legal consequences. Therefore, it is crucial to ensure that all records are stored in accordance with these regulations.

Some organizations may believe that screenshots or backups from a Content Management System (CMS) are sufficient for recordkeeping purposes. However, these records do not meet the high regulatory standards of the public sector. They may not be in the original file format, and may lack the necessary metadata to prove their authenticity and validity as official records.

To comply with the required recordkeeping standards, it is essential to store records in their original file formats. For instance, a JPEG may lack the necessary associated metadata, making it unsuitable for recordkeeping in the public sector. It is important to note that these requirements often change and organizations should keep themselves updated with the latest regulations to avoid legal issues.

7. Collect Metadata and Apply Timestamps/Signatures

The rules governing the collection of metadata and the application of timestamps and signatures are related to the previous rule. If a government organization becomes involved in a legal matter, records must be collected with associated information that enables them to be deemed irrefutable legal evidence.

Metadata and timestamps help link the record in question to the specific moment in time when it was created and guarantee the original nature of the content. This ensures that a document has not been edited or tampered with.

Governments must prove the accuracy of their records and ensure compliance, regardless of whether they are being requested in a litigation case. The organization must prove that the record is an authentic document and an accurate representation of what appeared on a website or social media account at any given time.

Public bodies should collect the data and keep it in its original format, as previously mentioned. They should also collect all associated metadata and furnish the record with a timestamp and digital signature. By doing this, an organization can prove that the record accurately reflects what appeared on a website or social media account on a particular day.

8. Preserve in Non-Rewritable, Non-Erasable WORM Format and WARC

Formats such as WORM and WARC can help to guarantee the long-term preservation of digital data.

The “Write Once, Read Many” format (WORM) prevents the modification or deletion of data. Another useful format for long-term preservation of digital data is the Web Archive Format Files (WARC). WARC stores web pages and other digital resources, including images and metadata, in their original source code.

This format is especially important for government agencies as they are required to use WARC to comply with FOIA and open records laws. WARC also exports all social media records, including metadata, making it a valuable source for digital forensics investigations and legal authentication.

9. Serialize and Retain on Duplicate Media

Government agencies must ensure that all information and archived records are securely backed up. To protect the information from incidents or significant failures, all data must be serialized and retained on duplicate media. Serialization ensures that data can be transmitted, stored, and reconstructed without any loss or corruption. In addition to serialization and backup, it is crucial to choose a reliable vendor to store your records. A good vendor should have the necessary certifications, such as ISO 27001, to ensure that they meet the highest standards of security and reliability. Additionally, it is important to ask about their “worst case scenario” recovery plans to ensure that your records can be recovered even in the event of a significant failure or disaster.

It is also essential to have a comprehensive disaster recovery plan in place. This plan should include regular testing to ensure its effectiveness and relevance. It should also specify the roles and responsibilities of all parties involved in the recovery process and outline the steps to be taken to minimize the impact of any loss or failure.

Overall, ensuring the security and reliability of information and records is a complex and ongoing process that requires careful planning and implementation. By following best practices such as serialization, backup, vendor selection, and disaster recovery planning, you can minimize the risk of data loss and ensure the continuity of your operations in the event of an incident or failure.

Public sector organizations often find their online channels, such as official Facebook pages, becoming public forums for conversation and debate. This makes it crucial, yet challenging, to capture these ongoing conversations in real-time. 

The content is dynamic, as citizens are constantly replying and adding to the conversation, and comments are being edited and deleted. Agencies are regularly forced to delete comments due to profanity, threats of violence, and other inappropriate behavior, and users themselves may choose to delete their comments. However, open records laws require that these comments be captured, preserved, and made available upon request. The question is, how can agencies archive this data? 

One way is to use a proactive and automatic solution like Pagefreezer. Pagefreezer can capture all of your website, social media, and Microsoft Teams data. These captures ensure compliance with regulations and allow archives to be used in the eDiscovery process.

Having access to this data can also help public sector organizations identify trends, track public sentiment, and measure the effectiveness of their engagement strategies. It can also help them to identify potential issues before they become major problems. 

Public-sector entities also have a responsibility to act as openly and transparently as possible. When it comes to online data like social media content, this means making all records, including edits to posts and deleted comments, freely available to the public. Pagefreezer has developed a public portal specifically to meet these transparency needs.

A public portal makes the open records compliance process as easy as possible. Share online data with your constituents on-demand, 24/7. Citizens can access records, perform keyword searches, and download content in PDF format. This helps to build trust between the public and government organizations, and fosters more open and democratic communication.

The City of Sacramento’s Public Portal

The City of Sacramento exemplifies a proactive approach by making its archived websites and social media account records freely available through a public portal.
This allows any member of the public to:

• Filter, browse, and view website and social media archives
• Perform full-text searches through the entire archive
• Download archived pages in PDF format
• Visually compare different versions of archived pages

Visit the City of Sacramento’s Public Portal Here.

By making a small and proactive investment in a comprehensive archiving solution and public portal, Sacramento can now rest assured that:

• All its digital communications are automatically archived and retained appropriately for compliance with sunshine and eDiscovery laws.
• Expensive fines and penalties for non-compliance with sunshine laws, the Federal Rules of Evidence, the Federal Rules of Civil Procedure, and the eSign Act are completely avoided.
• All additions, edits, changes, and deletions are captured and verified immediately, preparing it for potential eDiscovery.
• Public information request costs are significantly reduced, requiring little-to-no staff time and allocated resources for turnaround.
• Speed and efficiency of responses to information requests are dramatically improved.

Choosing the right data archiving vendor is crucial for improving workflows, reducing risk, boosting transparency, saving resources, and ensuring data accessibility. When narrowing down your options, consider these questions:

1. How User-Friendly Is the Archiving Solution?

Implementing an archiving solution can be counterproductive if the user experience is clunky and frustrating. When comparing solutions, consider the following qualities:

• Is the user interface modern and intuitive?
• Does it offer records for social media, website content, and other data sources in a native formatting and full-context?
• Does it require extensive training to accomplish basic tasks?
• Does it offer a user-friendly public portal that allows the public to gather their own records directly from the archive?

2. Which Platforms Can You Archive Through the Platform?

Your government organization likely has multiple accounts on multiple platforms that require regular monitoring and engagement. When evaluating archiving tools, consider the following:

• Does the solution support popular social media platforms such as Facebook, Twitter, and Instagram?
• Can it archive other online data sources, such as website content, mobile text messages, WhatsApp, and team collaboration tools like Microsoft Teams, Slack, and Workplace from Meta?
• Does it offer real-time archiving through API integration with relevant platforms? (Avoid solutions that simply crawl social media pages.)
• Can the solution capture social media content retrospectively?

3. Does the Solution Enable You to Monitor Social Media Accounts and Collaboration Tools?

Most organizations have established policies that define acceptable language and communication within the workplace. However, enforcing these policies effectively on social media and enterprise collaboration platforms presents a unique challenge.
With this in mind, any archiving solution should be able to facilitate platform monitoring, and ideally, even offer built-in tools that can help identify and flag inappropriate language or behavior.

4. How Secure Is My Data?

It’s vital to know that your archived data is safe and secure. The last thing you want is a compromised account that leads to the authenticity and reliability of your records being brought into question.
Ask the following questions related to data security:

• Do both the vendor itself and its data centers prioritize data security?
• Is the vendor SOC 2 compliant and does it have ISO 27001 certification?
• Can a vendor prove compliance with modern security standards? (Ask for the vendor’s CAIQ, your IT team will love you for this.)
• Is the vendor in compliance with privacy regulations like the GDPR and CCPA?

5. Does the Vendor Offer Comprehensive Support?

When it comes to user experience, having comprehensive and reliable support from your government social media archiving vendor is paramount. It is essential that the vendor is equipped to address your inquiries, technical challenges, and any other needs that may arise throughout the process.

Customer support plays a pivotal role, and the vendor should demonstrate a high level of reliability and responsiveness when it comes to handling support tickets. It should be effortless to seek assistance from representatives who possess expertise in the field.

When vetting a vendor, consider these factors:

• Interactive Training and Support: Ask about the training methods provided during onboarding. Ideally, the vendor should offer interactive training sessions rather than relying solely on static videos or documentation. Live demonstrations, hands-on exercises, and opportunities for Q&A sessions can significantly enhance the learning experience and ensure that you grasp the essential functionalities of the solution effectively.
• Ongoing Support: Inquire about the level of support available beyond the initial onboarding process. A reliable vendor will offer continuous support, including access to a responsive customer support team, regular check-ins, and resources to address any future challenges or questions that may arise.

6. What’s the Onboarding Process Like?

Before finalizing your decision, it is crucial to inquire about the archiving solution’s onboarding process. A well-structured and efficient onboarding experience is key to ensuring a smooth transition and successful utilization of the solution. When evaluating vendors, consider the following aspects:

• Clear Onboarding Timeline and Roadmap: Ask the vendor if they can provide a comprehensive onboarding timeline and roadmap. This will give you a clear understanding of the steps involved, key milestones, and estimated timeframes. A transparent roadmap will help you plan effectively and align your organization’s resources accordingly.
• Quick and Easy Implementation: Inquire about the speed and ease of getting up and running with the archiving solution. A vendor that values efficiency and understands the importance of minimizing downtime will have streamlined processes in place. Look for a solution that offers rapid implementation without compromising on the quality of setup and configuration.
• Personalized Onboarding Experience: It is essential to ensure that the onboarding process is personalized and tailored to your organization’s specific needs. Inquire whether the vendor assigns a dedicated representative to guide you through the fundamentals of the solution. Having a knowledgeable expert by your side will facilitate a smoother learning curve and address any questions or concerns promptly.

7. What’s the Pricing Model?

The pricing models employed by vendors can vary significantly. While some vendors determine pricing based on the number of social media records created, providers like Pagefreezer, have a pricing structure based on the number of accounts.

Opting for a vendor that bases pricing on the number of records created may result in increasing costs as your online activity and engagement grows. However, by choosing a solution that operates on the number of accounts, your government organization can maintain budget certainty because pricing remains consistent regardless of your level of social media engagement.

Budget predictability is crucial—pricing based on the number of accounts ensures that you have clear visibility into your costs. As your organization expands its online presence or increases the number of accounts being monitored, you won’t face unexpected or escalating expenses. This approach allows you to effectively plan and allocate your resources while maintaining control over your archiving and monitoring costs.

As the volume and complexity of electronic records continue to grow, public-sector organizations must proactively evolve their recordkeeping strategies. From social media and websites to team chat platforms and mobile messaging, today’s communications demand thoughtful, well-executed archiving processes that align with legal requirements and uphold the values of transparency and accountability.

With Pagefreezer, you get a complete, dependable, user-friendly solution for archiving social media, website, and Microsoft Teams content—trusted by agencies of all sizes, including major federal organizations like the Department of Health and Human Services (HHS).

Here’s what sets us apart:

• Transparent pricing. No hidden fees, so you have budget certainty.
• Uncompromising data security. Your valuable information will never be held hostage or subject to any ransom tactics.
• Exceptional support. Our friendly, knowledgeable team is always just a call away for technical help, training, or general guidance.
• Fully-automated archiving. So you focus on high-impact initiatives across your organization.

By investing in the right systems, training, and policies, public-sector organizations can confidently fulfill their compliance obligations while advancing their commitment to open government.