WhiteHouse / fitara

Management and Oversight of Federal IT Resources
https://management.cio.gov
107 stars 34 forks source link

Federal Statistical Agency law and Executive Directives in conflict with FITARA #27

Closed kittysmith closed 9 years ago

kittysmith commented 9 years ago

Comment from the Council of Professional Associations on Federal Statistics Regarding Proposed Guidelines for the Federal Information Technology Acquisition Reform Act

The Council of Professional Associations on Federal Statistics (COPAFS) represents over 300,000 individual researchers, educators, public health professionals, civic groups, and businesses that rely on the quality and accessibility of statistics that can only be effectively collected, managed, and curated by the federal government. COPAFS contends that the proposed guidance for the Federal Information Technology Acquisition Reform Act (FITARA) would violate federal law and Executive Directives that assure critically essential independence of officially designated statistical agencies and should thus explicitly exclude these agencies from its requirements. Potential consequences of less than independent collection, storage, announcement, dissemination, and selective accessibility to federal statistics include economic market disruption (related to agencies’ time-sensitive release of principle economic indicators), inadequate communication with those who answer surveys or use resultant data, and slow response to the need for on-the-minute statistical information for unanticipated federal policy or program decision making.

The Confidential Information Protection and Statistical Efficiency Act (CIPSEA; Pub.L. 107–347, 116 Stat. 2899, 44 U.S.C. § 101) provides strong confidentiality protections to many Federal agencies conducting statistical information collections such as surveys and censuses as well as other statistical activities including data analysis and modeling. Under CIPSEA, it is the statistical agencies themselves, not the Department within they reside, that hold ultimate responsibility and accountability for the confidential information that the agency acquires under a CIPSEA pledge. Any inappropriate use or disclosure of CIPSEA-protected information violates the law and can undermine public trust. The minimum standards for safeguarding confidential information under CIPSEA make clear that each person having access to confidential information understands the statistical uses that apply to his/her responsibility in maintaining the confidentiality of that information. In addition, these standards make clear that it is the statistical agency that is independently accountable for each part of the information protection process, including: • determining and monitoring procedures for statistical collection and statistical release; • evaluating the reason for accessing the information and controlling access to the information; • maintaining physical and information systems security

We are particularly concerned that the proposed FITARA guidelines would prevent statistical agencies from guaranteeing the confidentiality of the data for which they are, by law, the stewards. As users of the data and selective data access procedures, we support statistical agencies’ independent monitoring, access and security and trust them to continue their outstanding job in doing so. Without the agencies’ guarantees, it would not be surprising to see survey response rates drop, with a consequential decrease in the accuracy of survey statistics.

Statistical Policy Directive #1 on “Fundamental Responsibilities of Federal Statistical Agencies and Recognized Statistical Units” (http://www.gpo.gov/fdsys/pkg/FR-2014-12-02/pdf/2014-28326.pdf) is more explicit about the actions and activities that must be independently controlled by the agencies without the influence of others, including the Secretaries of the Cabinet Departments in which they are organized. The Directive, issued under the authority of the Budget and Accounting Procedures Act of 1950 (31 U.S.C. 1104 (d)) and the Paperwork Reduction Act of 1995 (44 U.S.C. 3504 (e)), is aimed at maintaining trust in the accuracy, objectivity, and integrity of the Federal statistical system and its products. Lack of trust causes uncertainty about the validity of measures the Nation uses to monitor and assess its performance, progress, and needs by undermining the public’s confidence in the information released by the Government and/or reducing response rates to extents that affect quality. Even the perception of a lack of objectivity or a 30-second delay in the release of market-sensitive statistics can have substantial consequences. Statistical Directive #1 specifies the responsibilities for which statistical agencies are held accountable. Under Responsibility #3, “Conduct objective statistical activities,” several requirements are notable with regard to the proposed FITARA guidelines:

• “Federal statistical agencies and recognized statistical units must function in an environment that is clearly separate and autonomous from the other administrative, regulatory, law enforcement, or policy making activities within their respective Departments.” We interpret IT oversight as falling within administrative activities, meaning that it has to occur within the statistical agencies, not from outside. • “Federal statistical agencies must be able to conduct statistical activities autonomously, (including)… when and how to store and disseminate their statistical products and which staff to select to join their agencies.”

The proposed FITARA guidelines would violate this requirement on several levels, including Departmental CIO approval of agencies’ selections for their own CIO, and their influence on decisions concerning statistical software and secure statistical data storage technology.

Furthermore, under Responsibility #4 “Protect the trust of information providers by ensuring the confidentiality and exclusive statistical use of their responses,” statistical agencies themselves, not their Departments, are responsible for maintaining strict privacy and confidentiality of statistical data. They are also independently responsible for assuring that the data are made available and utilized only for “statistical purposes,” as defined by law. We are also concerned that the many approval processes required by the proposed FITARA guidelines could jeopardize the timeliness of federal statistics’ release, and the ability of statistical agencies’ “sworn agent” contractors to fulfill tasks central to the agencies’ missions. Federal statistics are used: to allocate federal funding and services to states and local areas; as economic indicators directing private sector investment and location decisions; in gauging the state of economic development, education, trade, transportation, health and other functions of government; and to evaluate federal programs for evidence-based policy decision making. They must be accurate, objective, relevant, timely, and accessible to individuals cleared by the responsible statistical agencies solely for “statistical purposes” as defined by CIPSEA. CIO’s are a vital part of the support required to achieve this. But only the statistical agencies have the training and know-how to carry out the unique responsibilities given them by law and through Executive Directives.

Designated (by OMB) federal statistical agencies and currently recognized (by OMB) statistical units are: the Bureau of Economic Analysis, Bureau of Justice Statistics, Bureau of Labor Statistics, Bureau of Transportation Statistics, Census Bureau, Economic Research Service (USDA), Energy Information Administration, National Agricultural Statistics Service, National Center for Education Statistics, National Center for Health Statistics, National Center for Science and Engineering Statistics, Office of Research, Evaluation and Statistics (Social Security Administration), Statistics of Income Division (IRS), Microeconomic Surveys Unit (Federal Reserve Board), Center for Behavioral health Statistics and Quality, Substance Abuse and Mental Health Services (HHS), and the National Animal Health Monitoring System of the Animal and Plant Health Inspection Service (USDA).

COSSADC commented 9 years ago

The Consortium of Social Science Associations (COSSA) writes to endorse the statement made by the Council of Professional Associations on Federal Statistics (COPAFS) regarding proposed guidelines for the Federal Information Technology Acquisition Reform Act (FITARA), and asks that federal statistical agencies be excluded from the requirements within the law.

COSSA is a nonprofit organization serving as a united voice for more than 100 professional associations, scientific societies, research centers and institutes, and colleges and universities who care about a robust social and behavioral scientific research enterprise, including a vibrant federal statistical system.

COSSA agrees with COPAFS' comments that the proposed FITARA guidance would "violate federal law and Executive Directives that assure critically essential independence of officially designated statistical agencies and should thus explicitly exclude these agencies from its requirements."

swpierson commented 9 years ago

The American Statistical Association comments echo those of COAPS and are posted at http://www.amstat.org/misc/pdfs/FITARA.pdf, with the text pasted below:

May 29, 2015

Tony Scott United States Chief Information Officer Administrator, Office of E-Government & Information Technology Office of Management and Budget 725 17th Street, NW Washington, DC 20503

Dear Administrator Scott,

As President of the American Statistical Association, I write to on comment on the draft guidance to implement the Federal Information Technology Acquisition Reform Act (FITARA). We urge that every effort be made to ensure that FITARA not undermine the work of the federal statistical agencies, work which is critical to informing policymaking, decision-making, and public administration.

Our specific concern is that FITARA implementation could jeopardize the confidentiality pledges statistical agencies make. We are concerned that it could significantly degrade their autonomy and ability to provide timely responses to support both routine and special data analyses, both of which are vital to a statistical agency’s effectiveness and the analytical value of the functions it supports.

We understand and appreciate the importance of ensuring successful management and oversight of IT issues. Just as important are the confidentiality issues, the safeguards for which are set forth in the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA) and CIPSEA Implementation Guidance (2007). The balance needed in implementing these two statutes is evident in the fact that they are each separate titles in the same act, the E-Government Act of 2002. We emphasize that the respect for confidentiality, in reality and perception, is of paramount importance to federal statistical agencies and programs.

CIPSEA, in short, requires that data, collected under a pledge of confidentiality and for exclusively statistical purposes, be used for statistical purposes only. The relationship of confidentiality to control over IT resources is emphasized in the National Academy of Sciences’ Principles and Practices for a Federal Statistical Agency (fifth edition, 2013), in the discussion of the Independence Principle:

i) “As part of confidentiality protection, an agency should have the authority to manage the storage of confidential micro-data on secure servers that are controlled by the agency and not by a department-wide information technology system. A statistical agency should also have policies and procedures to inform data providers of the manner and level of confidentiality protection and the kinds of research and analysis that will be allowed with the data.” (p. 21) ii) “Protection from political and other undue external influence over a statistical agency’s data collection, production, dissemination, and other operations necessitates that the agency have the necessary authority for professional decisions in key aspects of its work, including the following: … authority to control information technology systems in order to securely maintain the integrity and confidentiality of data and reliably support timely and accurate production of key statistics.” (p. 39) iii) “The authority to ensure that information technology systems fulfill the specialized needs of the statistical agency is another important aspect of independence. A statistical agency must be able to vouch for the integrity, confidentiality, and impartiality of the information collected and maintained under its authority so that it retains the trust of its data providers and data users. Such trust is fostered when a statistical agency has control over its information technology resources, and there is no opportunity or perception that policy, program, or regulatory agencies could gain access to records of individual respondents. A statistical agency also needs control over its information technology resources to support timely and accurate release of official statistics, which are often produced under stringent deadlines.” (p. 40)

OMB also recognizes the importance of IT autonomy for federal statistical agencies, most recently in Statistical Policy Directive #1, “Fundamental Responsibilities of Federal Statistical Agencies and Recognized Statistical Units.” In the Federal Register notice announcing the directive being finalized, Office of Information and Regulatory Affairs Administrator Howard Shelanski notes their agreement with a commenter’s “recommendation to emphasize that a Federal statistical agency or recognized statistical unit has authority over the processing, storage, and maintenance of the data that it collects”. He notes they added text referencing the CIPSEA Implementation Guidance. The directive itself, Responsibility 3, on conducting objective statistical activities, includes these sentences: "Accordingly, Federal statistical agencies and recognized statistical units must function in an environment that is clearly separate and autonomous from the other administrative, regulatory, law enforcement, or policy-making activities within their respective Departments. Specifically, Federal statistical agencies and recognized statistical units must be able to conduct statistical activities autonomously when determining what information to collect and process, the physical security and information systems security employed to protect confidential data, which methods to apply in their estimation procedures and data analysis, when and how to store and disseminate their statistical products, and which staff to select to join their agencies."

Responsibility 4, on protecting the trust of information providers, concludes with this sentence: “Federal statistical agencies and recognized statistical units must fully adhere to legal requirements and follow best practices for protecting the confidentiality of data, including training their staffs and agents, and ensuring the physical and information system security of confidential information. (CIPSEA Implementation Guidance, 33362 at 33374)” It’s also important to note that OMB used the Principles and Practices of a Federal Statistical Agency as one of its primary reference documents.

In summary, we ask you to carefully consider the missions of statistical agencies and confidentiality requirements in the OMB FITARA guidance and urge you to allow the statistical agencies to maintain authority over their IT functions and personnel so they can continue to perform their work effectively and efficiently.

Thank you for your consideration.

Sincerely, David Morganstein President, American Statistical Association

bsweezy commented 9 years ago

Thank you @kittysmith @COSSADC and @swpierson for your comments. Because of your comments, we have revised the handling of statistical agenices and units in the memorandum. Preserving the ability of the statistical community to conduct its important work in part depends on confidence in the confidentiality guarantees which it provides to its information providers. To help clarify how to apply these requirements to the statistical community, the final memorandum includes language addressing this directly within the "scope and applicability" section. This includes: "With respect to Federal statistical agencies and units as defined in the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA), covered agencies under FITARA shall implement this guidance in a manner that ensures that statistical data collected under a pledge of confidentiality solely for statistical purposes are used exclusively for statistical purposes, consistent with CIPSEA."

kittysmith commented 9 years ago

Hi, Mr. Sweeny.

Thank you for your willingness to address the inconsistencies between FITARA guidelines and the law and Directives applying to statistical agencies. Any chance we could get together to discuss this? Your language does cover the CIPSEA requirement for confidentiality, but I am not able to tell whether it also preserves the responsibility given the statistical agencies. I would be more than happy to propose, discuss or review alternative language.

Thanks again for your attention to the issue.

Sincerely,

Kitty Smith

Katherine R. Smith, PhD

Executive Director Council of Professional Associations on Federal Statistics (COPAFS) 2121 Eisenhower Ave., Suite 200 Alexandria, VA 22314 Office Phone: 703-836-0404; Direct Phone: 202-407-1292 Our goal: Linking you with a thriving statistical system Visit us at w http://www.copafs.org/ww.copafs.org http://www.copafs.org/

Join us on Twitter: @copafsK

On Mon, Jun 15, 2015 at 12:20 PM, Ben Sweezy notifications@github.com wrote:

Thank you @kittysmith https://github.com/kittysmith @COSSADC https://github.com/COSSADC and @swpierson https://github.com/swpierson for your comments. Because of your comments, we have revised the handling of statistical agenices and units in the memorandum. Preserving the ability of the statistical community to conduct its important work in part depends on confidence in the confidentiality guarantees which it provides to its information providers. To help clarify how to apply these requirements to the statistical community, the final memorandum includes language addressing this directly within the "scope and applicability" section. This includes: "With respect to Federal statistical agencies and units as defined in the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA), covered agencies under FITARA shall implement this guidance in a ma nner tha t ensures that statistical data collected under a pledge of confidentiality solely for statistical purposes are used exclusively for statistical purposes, consistent with CIPSEA."

— Reply to this email directly or view it on GitHub https://github.com/WhiteHouse/fitara/issues/27#issuecomment-112125503.

kittysmith commented 9 years ago

Mr. Sweezy (not Sweeny!) --sorry

On Mon, Jun 15, 2015 at 12:46 PM, Kitty Smith kitty.smith@copafs.org wrote:

Hi, Mr. Sweeny.

Thank you for your willingness to address the inconsistencies between FITARA guidelines and the law and Directives applying to statistical agencies. Any chance we could get together to discuss this? Your language does cover the CIPSEA requirement for confidentiality, but I am not able to tell whether it also preserves the responsibility given the statistical agencies. I would be more than happy to propose, discuss or review alternative language.

Thanks again for your attention to the issue.

Sincerely,

Kitty Smith

Katherine R. Smith, PhD

Executive Director Council of Professional Associations on Federal Statistics (COPAFS) 2121 Eisenhower Ave., Suite 200 Alexandria, VA 22314 Office Phone: 703-836-0404; Direct Phone: 202-407-1292 Our goal: Linking you with a thriving statistical system Visit us at w http://www.copafs.org/ww.copafs.org http://www.copafs.org/

Join us on Twitter: @copafsK

On Mon, Jun 15, 2015 at 12:20 PM, Ben Sweezy notifications@github.com wrote:

Thank you @kittysmith https://github.com/kittysmith @COSSADC https://github.com/COSSADC and @swpierson https://github.com/swpierson for your comments. Because of your comments, we have revised the handling of statistical agenices and units in the memorandum. Preserving the ability of the statistical community to conduct its important work in part depends on confidence in the confidentiality guarantees which it provides to its information providers. To help clarify how to apply these requirements to the statistical community, the final memorandum includes language addressing this directly within the "scope and applicability" section. This includes: "With respect to Federal statistical agencies and units as defined in the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA), covered agencies under FITARA shall implement this guidance in a ma nner tha t ensures that statistical data collected under a pledge of confidentiality solely for statistical purposes are used exclusively for statistical purposes, consistent with CIPSEA."

— Reply to this email directly or view it on GitHub https://github.com/WhiteHouse/fitara/issues/27#issuecomment-112125503.