Background The Rulemaking Process under the APA Under the APA, agencies engage in three basic phases of the rulemaking process: they initiate rulemaking actions, develop proposed rulemaking actions, and develop final rulemaking actions. Built into agencies’ rulemaking processes are opportunities for internal and external deliberations, reviews, and public comments. Figure 1 provides an overview of the rulemaking process. The public comment portion of the rulemaking process generally comprises three phases: 1. Comment Intake: During this phase, agencies administratively process comments. This may include identifying duplicate comments (those with identical or near-identical comment text, but unique identity information), posting comments to the agency’s public website, and distributing comments to agency subject-matter experts within responsible program offices for analysis. 2. Comment Analysis: During this phase, subject-matter experts analyze and consider submitted comments. This may include the use of categorization tools within FDMS or outside software systems. 3. Comment Response: During this phase, agencies prepare publicly available responses to the comments in accordance with any applicable requirements. Agencies are required to provide some response to the comments in the final rule, but in some cases, an agency may also prepare a separate report to respond to the comments. Legal Requirements for Public Comments As illustrated in figure 1 above, the public has the opportunity to provide input during the development of agencies’ rules. Among other things, the APA generally requires agencies to publish an NPRM in the Federal Register; allow any interested party an opportunity to comment on the rulemaking process by providing “written data, views, or arguments”; issue a final rule accompanied by a statement of its basis and purpose; and publish the final rule at least 30 days before it becomes effective. The APA requires agencies to allow any interested party to comment on NPRMs. The APA does not require the disclosure of identifying information from an interested party that submits a comment. Agencies therefore have no obligation under the APA to verify the identity of such parties during the rulemaking process. Instead, the APA and courts require agencies to consider relevant and substantive comments, and agencies must explain their general response to them in a concise overall statement of basis and purpose, which in practice forms part of the preamble of the final rule. Courts have explained that significant comments are comments that raise relevant points and, if true or if adopted, would require a change in the proposed rule. However, courts have held that agencies are not required to respond to every comment individually. Agencies routinely offer a single response to multiple identical or similar comments. As explained by Regulations.gov’s “Tips for Submitting Effective Comments,” “the comment process is not a vote,” and “agencies make determinations for a proposed action based on sound reasoning and scientific evidence rather than a majority of votes. A single, well-supported comment may carry more weight than a thousand form letters.” The APA includes provisions on the scope of judicial review that establishes the bases under which a court shall find an agency’s action unlawful. Among these APA bases are when the court finds that agency action, findings, and conclusions were “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law” and “without observance of procedure required by law.” How an agency managed and considered public comments may be relevant during judicial review. For example, one basis for a court’s reversal of an agency action has been that, upon review of the statement of basis and purposes, the court concludes the agency failed to consider or respond to relevant and significant comments. Conversely, courts have upheld agency rules when the courts have found the statement of basis and purposes demonstrate the agency considered the commenter’s arguments. The E-Government Act of 2002 The E-Government Act of 2002 requires agencies, to the extent practical, to accept comments “by electronic means” and to make available online the public comments and other materials included in the official rulemaking docket. Executive Order 13563 further states that regulations should be based, to the extent feasible, on the open exchange of information and perspectives. To promote this open exchange, to the extent feasible and permitted by law, most agencies are required to provide the public with a meaningful opportunity to participate in the regulatory process through the internet, to include timely online access to the rulemaking docket in an open format that can be easily searched and downloaded. Most agencies meet these responsibilities through Regulations.gov, a rulemaking website where users can find rulemaking materials and submit their comments, but all agencies are not required to use that platform. In October 2002, the eRulemaking Program was established as a cross-agency E-Government initiative and is currently based within EPA. The eRulemaking PMO leads the eRulemaking Program and is responsible for developing and implementing Regulations.gov, the public- facing comment website, and FDMS, which is the agency-facing side of the comment system used by participating agencies. As of March 2018, Regulations.gov identified 180 participating and 128 nonparticipating agencies. These agencies may be components of larger departmental agencies. Some nonparticipating agencies, including FCC and SEC, have their own agency-specific websites for receiving public comments. The comment systems within the scope of this report are as follows: FDMS and Regulations.gov: FDMS is federal government-wide document management system structured by dockets (or file folders) that offer an adaptable solution to service a wide range of regulatory activities routinely performed by federal agencies. The public-facing website of FDMS is Regulations.gov, which is an interactive website that allows the public to make comments on regulatory documents, review comments submitted by others, and access federal regulatory information. Regulations.gov allows commenters to submit comments to rulemakings by entering information directly in an electronic form on the Regulations.gov website. This form also allows commenters to attach files as part of their comment submission, and can be customized by each participating agency. Appendix II provides an example of one comment form from Regulations.gov. Additionally, all participating agencies allow comments to be submitted by mail or hand delivery. At their discretion, some participating agencies also allow comments to be submitted via email. See table 1. FCC’s Electronic Comment Filing System (ECFS): ECFS is a web- based application that allows anyone with access to the internet to submit comments to FCC rulemaking proceedings. ECFS allows commenters to submit comments to rulemakings through two main avenues: brief text comments submitted as Express filings, and long- form comments submitted as Standard filings. Both types of filings can be submitted through an ECFS comment form, which requires commenters to enter information directly into an electronic form on the ECFS website. See appendix III for examples of the comment forms used by ECFS. Additionally, interested parties with the appropriate technical capabilities can submit either type of filing directly to ECFS via a direct application programming interface (API) or through a public API that is registered with the website Data.gov. Filing comments through an API allows interested parties the ability to file a large number of comments without having to submit multiple individual comment forms. Finally, to accommodate a large volume of comment submissions for the 2015 Open Internet rulemaking, FCC allowed interested parties to submit Express comment filings in bulk through formatted CSV files that were submitted via a dedicated email address and then uploaded into ECFS. Similarly, for the 2017 Restoring Internet Freedom rulemaking, FCC allowed commenters to submit Express comment filings in bulk through a dedicated file- sharing website, and the comments were then uploaded into ECFS. With the exception of these two rulemakings, FCC does not allow comments to be submitted electronically outside of ECFS. Figure 2 shows how ECFS facilitates public commenting by using the processes discussed above. SEC’s Comment Letter Log: When SEC requests public comments on SEC rule proposals, the public can submit comments to rulemakings through an online form, which requires commenters to enter information in an electronic form on SEC’s website. This form also allows commenters to attach files as part of their submission. When commenters submit a comment, it is sent to SEC staff as an email. SEC also allows comments to be submitted via email and mail. After review, staff upload the comment and any associated data into the Comment Letter Log, which is the internal database that SEC staff use to manage the public comment process, and post the comment to the public website. See appendix IV for an example of a comment form on SEC’s website. Selected Agencies Collect Some Information from Commenters and Accept Anonymous Comments through Regulations.gov and Agency-Specific Websites Selected Agencies Collect Some Identity Information through Comment Forms Consistent with the discretion afforded by the APA, Regulations.gov and agency-specific comment websites use required and optional fields on comment forms to collect some identity information from commenters. In addition to the text of the comment, each participating agency may choose to collect identity information from the Regulations.gov comment form by requiring commenters to fill in other fields, such as name, address, and email address before they are able to submit a comment. Participating agencies may also choose to collect additional identity information through optional fields. For example, while EPA does not make any fields associated with identity information available to commenters, CFPB makes all fields available and requires that commenters enter something into the first name, last name, and organization name fields before a comment can be submitted. Table 2 shows the fields on Regulations.gov in which each of the participating agencies we analyzed require commenters to enter information and the optional fields available for commenters to voluntarily enter information. FCC requires that all commenters complete the following fields on both the Standard and Express comment forms in ECFS: (1) name, (2) postal address, and (3) the docket proceeding number to which they are submitting a comment. The ECFS comment form also allows commenters to voluntarily provide additional information in optional fields, such as email address. Similarly, SEC’s comment forms require commenters to provide (1) first and last name, (2) email address, and (3) the comment content, before a comment can be successfully submitted. The comment form also allows commenters to voluntarily provide other information in optional fields, such as their city and state. Agencies Accept Anonymous Comments Regardless of the fields required by the comment form, the selected agencies all accept anonymous comments in practice. Specifically, in the comment forms on Regulations.gov, ECFS, and SEC’s website, a commenter can submit a comment under the name “Anonymous Anonymous,” enter a single letter in each required field, or provide a fabricated address. In each of these scenarios, as long as a character or characters are entered into the required fields, the comment will be accepted. Further, because the APA does not require agencies to authenticate submitted identity information, neither Regulations.gov nor the agency-specific comment websites contain mechanisms to check the validity of identity information that commenters submit through comment forms. As part of the Regulations.gov modernization effort, the Office of Information and Regulatory Affairs (within the Office of Management and Budget) and the Department of Justice proposed language for a disclosure statement on every comment form that would require the commenter to acknowledge that they are not using, without lawful authority, a means of identification of another person with any comment they are submitting. Commenters would be required to acknowledge their agreement with the statement before their comment could be submitted. According to PMO officials, even with this disclosure statement, anonymous comments would still be permitted and accepted by Regulations.gov. This disclosure statement was proposed in response to allegations of comments being submitted to rulemakings on behalf of individuals without their permission. As of April 2019, this proposed language has not yet been approved by the Executive Steering Committee for Regulations.gov. However, the proposed disclosure statement would be provided on the Regulations.gov comment form, and it is unclear whether similar information would be made available to commenters submitting comments via email or mail. In contrast to the other selected agencies, according to FCC officials, FCC rules require the submission of the commenter’s name and mailing address, or the name and mailing address of an attorney of record. However, in March 2002, FCC initiated a rulemaking related to the submission of truthful statements to the commission. Among other issues, FCC sought comment on whether rulemaking proceedings should be subject to an already existing rule that prohibited the submission of written misrepresentations or material omissions from entities that are subject to FCC regulation. In its final rule, issued in March 2003, FCC decided to continue to exempt comments to rulemakings from this rule because of the potential that such a requirement would hinder full and robust public participation in such policy-making proceedings by encouraging disputes over the truthfulness of the parties’ statements. According to FCC officials, to comply with APA requirements, the commission tries to minimize barriers that could prevent or discourage commenters from participating in the commenting process, and in practice accepts anonymous comments. See figure 3 for an example of an anonymous comment in ECFS. Additionally, in our survey of program offices with rulemaking responsibilities at selected agencies, 39 of 52 offices reported that they received anonymous comments on some rulemakings for which their office has been responsible since 2013. The remaining 13 offices responded that they did not receive or were unaware of receiving anonymous comments, though most of these offices do not have high levels of rulemaking activity or receive a high volume of comments. Regulations.gov and Agency-Specific Comment Websites Collect Some Information about Public Users’ Interaction Regulations.gov and agency-specific comment websites also collect some information about public users’ interaction with their websites through application event logs and proxy server logs. This information, which can include a public user’s Internet Protocol (IP) address, browser type and operating system, and the time and date of webpage visits, is collected separately from the comment submission process as part of routine information technology management of system security and performance. The APA does not require agencies to collect or verify this type of information as part of the rulemaking process. Regulations.gov collects some information from commenters accessing the website but it is never linked to any specific comment. In Regulations.gov, proxy server logs capture information such as the country from which a user accesses the site, the user’s browser type and operating system, and the time and date of each page visit on the website. According to PMO officials, this information is provided to the eRulemaking PMO in summary statistics that are used to assess what information is of least interest to Regulations.gov visitors, determine technical design specifications of the website, and identify system performance problems. This information is collected about all public users visiting Regulations.gov, regardless of whether they submit a comment. Further, because the PMO receives this information in the form of summary statistics, it cannot be connected to any specific comment. The eRulemaking PMO also monitors IP addresses that interact with Regulations.gov via security firewalls, but, according to PMO officials, the web application firewall (WAF) logs (a type of application event log) have never been connected to specific comments, though in some cases the URL the blocked user was attempting to access may be captured in the log. FCC officials stated that the current ECFS application architecture does not facilitate FCC identifying the source IP address of the submitter of a specific comment filed in ECFS. FCC collects information about public users’ interactions with ECFS through its web-based application proxy server logs, including the IP address from which a user accesses the site and the date and time of the user’s interaction. However, ECFS does not obtain or store IP addresses as part of the comment data it collects when a public user ultimately submits a comment. Within the current architecture, ECFS would require officials to match date and time stamps from the proxy server log to the ECFS comment data to connect a given IP address to a specific comment. SEC officials stated it would be difficult to match the large number of daily hits to their general website to the much smaller number of comments submitted to their rulemaking proceedings. SEC collects information about public users’ interactions with the SEC.gov website through proxy server logs, including the IP address from which a user accesses the website and the user’s date, time, and URL requests. However, according to officials, a public user never directly interacts with the Comment Letter Log, and none of the information from the proxy log is included as part of the data it collects in association with comment submissions. Despite this difficulty, SEC officials stated that linking the proxy log data from the general SEC.gov website to a specific comment in the Comment Letter Log could be done on a case-by-case basis. Most Selected Agencies Have Some Internal Guidance Related to Commenter Identity Seven of 10 selected agencies have documented some internal guidance associated with the identity of commenters during the three phases of the public comment process, but the substance of this guidance varies, reflecting the differences among the agencies and their respective program offices. For example, as shown in table 3, BLM has no internal guidance related to identity information, while CFPB has internal guidance related to the comment intake and response to comments phases. For selected agencies that have guidance associated with the identity of commenters, it most frequently relates to the comment intake or response to comment phases of the public comment process. The guidance for these phases addresses activities such as managing duplicate comments (those with identical or near-identical comment text but varied identity information) or referring to commenters in a final rule. In addition, some agencies have guidance related to the use of identity information during comment analysis. Agencies are not required by the APA to develop internal guidance associated with the public comment process generally, or identity information specifically. For the three selected agencies that did not have identity-related guidance for the public comment process, cognizant officials told us such guidance has not been developed because identity information is not used as part of their rulemaking process. For example, BLM officials stated that the only instance in which identity information would be considered is when threatening comments are referred to law-enforcement agencies. Identity-Related Guidance for Comment Intake According to our analysis of the internal guidance the selected agencies provided, five of the 10 agencies have documented identity-related guidance associated with the comment intake phase. (See table 4.) Identity-related guidance for the comment intake phase addresses posting comments and their associated identity information to public comment websites. The guidance generally falls into two categories: (1) the treatment of duplicate comments (those comments with identical or near-identical content, but unique identity information) and (2) the management of comments reported to have been submitted using false identity information. Four of the 10 selected agencies have documented guidance on defining and posting duplicate comments, which may also be referred to as mass mail campaigns. However, in accordance with the discretion afforded them under the APA, agency definitions of duplicate comments and recommendations on how to manage them during comment intake vary. Specifically, for EBSA and WHD—the selected agencies within the Department of Labor (DOL)—one comment letter with multiple signers is considered one comment, while the same comment submitted by multiple signers as separate letters is counted separately. In both cases, however, each individual signer may provide unique identity information. In contrast, EPA guidance states that mass mail submissions often include attachments containing either bundled duplicate messages or a single comment with multiple signatures. For EPA, each signature is counted as a duplicate comment submission. As of February 2019, CFPB’s draft guidance does not explicitly define duplicate comments, but it does note that “duplicate identical submissions” are not subject to the agency’s policy of posting all comments. Instead, the official responsible for managing the docket during comment intake may remove duplicate comments from posting or decide not to post them. According to CFPB officials, this policy is only applicable to comments that contain entirely identical comment content and identity information, and does not apply to mass mailing campaigns. Similarly, when DOL agencies receive duplicate comments as part of mass mail campaigns, the agency can choose to post a representative sample of the duplicate comment to Regulations.gov along with the tally of the duplicate or near-duplicate submissions, or post all comments as submitted. EPA guidance states that duplicate comments submitted as part of mass mailings are to be posted as a single primary document in Regulations.gov with a tally of the total number of duplicate comments received from that campaign. However, as discussed later in this report, EPA may post all duplicate comments it receives, depending on the format in which they are submitted. Comments with Potentially False Identity Information Five of the 10 selected agencies have documented internal guidance on how to manage posting comments that may have been submitted by someone falsely claiming to be the commenter. However, the procedures related to addressing comments with potentially false identity information also vary among agencies. For EBSA and WHD, guidance from DOL states that if a comment was submitted by someone falsely claiming to be the commenter, the identifying information is to be removed from the comment and the comment is treated as anonymous and remains posted. In cases where an individual claims that a comment was submitted to CFPB or SEC using the individual’s identity information without his or her consent, both agencies’ guidance provide staff with discretion to redact, reattribute, or otherwise anonymize the comment letter in question. According to internal guidance from CFPB, EPA, and SEC, if agency officials are able to confirm that a comment was submitted by someone falsely claiming to be the commenter, such as by the agency sending an email to the address associated with the comment, the comment may not be made available to the public. SEC officials stated that although they have discretion to remove the comment from public posting, the typical response is to encourage the individual making the claim to submit another comment correcting the record. Similarly, if a member of the public contacts EPA claiming that a comment was submitted using his or her identity information without consent and agency staff cannot confirm it, EPA guidance directs staff to ask the requester who submitted the claim to submit another comment to the docket explaining that the original comment was submitted without the individual’s consent. Both comments will be included in the docket. Identity-Related Guidance for Comment Analysis According to our analysis of the guidance the selected agencies provided, four of the 10 agencies have identity-related guidance for the comment analysis phase (see table 5). Identity-related guidance for the comment analysis phase includes criteria for coding comments for analysis, including by identifying the type of commenter (such as an individual or interest group). CMS guidance states that, during review, comments should be separated by issue area and tables may be used to assist in the grouping of comments and preparing briefing materials. While this guidance notes that these tables may be used to group commenters based on their identity during review, when summarizing comments later in the process the guidance indicates that CMS officials should avoid identifying commenters by name or organization. FDA training materials address how to prepare comment summaries to help ensure the agency has properly identified all comments regarding an issue. To conduct a quality-control check on the comment review process, FDA sorts the comments by commenter and reviews the comments from a sample of key stakeholders, including interested trade associations and consumer or patient groups, to confirm that relevant issues were identified. For EBSA and WHD, guidance from DOL recommends attaching the “organization name” to comments within a docket to improve transparency and help the agency and public users search for organizations within Regulations.gov. In addition, DOL guidance suggests flagging comments for additional review, including at least one flag based on identity. Identity-Related Guidance for Responding to Comments According to our analysis of the guidance the selected agencies provided, five of the 10 agencies have documented identity-related guidance for responding to comments. (See table 6.) Identity-related guidance for the response to comments phase includes guidance for agency officials on how, if at all, to address identity information related to comments in developing the final rule. As discussed previously, during comment analysis, CMS guidance indicates that officials should avoid identifying commenters by name or organization when summarizing comments. These summaries may then be used as a basis for the agency’s formal comment summary included in the preamble of the final rule. CFPB guidance states that a summary of the rulemaking process should be developed for the preamble of the final rule and include how many comments are received and from which type of commenter. CFPB is to describe both the commenters and comments in general terms rather than identify commenters by name or entity. For example, rather than naming a specific financial institution, CFPB may refer to “industry commenters” in the final rule. For EBSA and WHD, guidance from DOL states that when several commenters suggest the same approach to revising or modifying the proposed rule, the names of specific commenters can be cited as a list in a footnote. When choosing which commenter should appear first in the list, DOL agencies are to select the commenter with the strongest or most detailed discussion on the issue. However, it is not necessary to always identify commenters by name, and, according to DOL officials, the department’s general practice is not to do so. Instead, the agency may use phrases such as “several commenters,” or “comments by the ABC Corporation and others.” DOL agencies may also reference commenters by type rather than name, using terms including “municipal agency, state workforce agency, employer, academic representative, agency, and industry,” among others. FDA training materials recommend that the final rule include a very brief explanation of the number and scope of comments to the proposed rule, including who submitted them. Commenters are not identified as individuals, but rather by commenter type, such as trade associations, farms, or consumer advocacy organizations, among others. Selected Agencies’ Treatment of Identity Information Collected during the Public Comment Process Varies Within the discretion afforded by the APA, the 10 selected agencies’ treatment of identity information during the comment intake, comment analysis, and response to comments phases of the public comment process varies. Selected agencies differ in how they treat identity information during the comment intake phase, particularly in terms of how they post duplicate comments, which can lead to identity information being inconsistently presented to public users of comment systems. Selected agencies’ treatment of identity information during the comment analysis phase also varies. Specifically, program offices with responsibility for analyzing comments place varied importance on identity information during the analysis phase. All agencies draft a response to comments with their final rule, but the extent to which the agencies identify commenters or commenter types in their response also varies across the selected agencies. Selected Agencies Vary in Their Treatment of Identity Information during the Comment Intake Phase Within the discretion afforded by the APA and E-Government Act, selected agencies vary in how they treat identity information during the comment intake phase, which includes identifying duplicate comments and posting comments to the public website. Further, the way in which the selected agencies treat comments during the comment intake phase results in identity information being inconsistently presented on the public website. Generally, officials told us that their agencies either (1) maintain all comments within the comment system, or (2) maintain some duplicate comment records outside of the comment system, for instance, in email file archives. Specifically, officials from four selected agencies (CMS, FCC, FDA, and WHD) stated that they maintain all submitted comments in the comment system they use. Officials from the other six agencies (BLM, CFPB, EBSA, EPA, FWS, and SEC) stated that their agencies maintain some comment records associated with duplicate comments outside of the comment system. Among the four agencies that maintain all submitted comments within their comment system, our review of comment data showed that practices for posting duplicate comments led to some identity information or comment content being inconsistently presented on the public website. For example, according to CMS officials responsible for comment intake, CMS may post all duplicate comments individually, or post duplicate comments in batches. When duplicate comments are posted in batches, the comment title will include the name of the submitting organization followed by the total number of comments. However, as discussed previously, CMS does not have any documented policies or guidance associated with the comment intake process, and we identified examples where the practices described by CMS officials differed. On one CMS docket, for instance, staff entered more than 37,000 duplicate comments individually, with the commenter’s name and state identified in the comment title. However, the attached document included with each of the posted comments was an identical copy of one specific comment containing a single individual’s identity information. While all the individual names appear to have been retained in the comment titles, and the count of total comments is represented, any additional identity information and any potential modifications made to each duplicate comment submitted have not been retained either online or outside of FDMS, and are not presented on the public website. (See fig. 4.) Similarly, although our analysis of WHD comments did not suggest that any comments were missing from Regulations.gov, on one WHD docket almost 18,000 duplicate comments were associated with a single comment with one individual’s name identified in the comment title. While all of the comments are included within 10 separate attachments, none of the identity information included with these comments can be easily found without opening and searching all 10 attachments, most of which contain approximately 2,000 individual comments. (See fig. 5.) Our review of comment data showed that the selected agencies that maintain some comment records outside of the comment system (six of 10) also follow practices that can inconsistently present some identity information or comment content associated with duplicate comments. For BLM and FWS, agency officials responsible for comment intake stated that all comments received through Regulations.gov are posted, but a single example may be posted when duplicate paper comments are received. As discussed previously, neither BLM nor FWS have internal guidance or policy associated with comment intake. For CFPB, EBSA, EPA, and SEC, the agency may post a single example along with the total count of all duplicate comments, but does not necessarily post all duplicate comments online. Thus, identity information and unique comment contents for all duplicate comments may not be present on the public website. For example, on one CFPB comment, the agency posted an example of a submitted comment containing only the submitter’s illegible signature. None of the other associated identity information for the posted sample, or any of the duplicate comments, is included in the comment data. (See fig. 6.) Similarly, for all duplicate comments received, SEC posts a single example for each set of duplicate comments and indicates the total number of comments received. As a result, the identity information and any unique comment content beyond the first example are not present on the public website. (See fig. 7.) The Importance of Identity Information to Comment Analysis Varies On the basis of the results from our survey, program offices with responsibility for analyzing comments differ in the importance they place on identity information during the analysis phase. Because subject-matter experts are responsible for reviewing public comments and considering whether changes to the proposed rule should be made, program offices generally analyze comments. Officials from all but one of the 52 program offices we surveyed responded that they were responsible, in whole or in part, for analyzing public comments. In our survey of program offices with regulatory responsibilities in the 10 selected agencies, at least one program office in each agency reported that the identity or organizational affiliation of a commenter is at least slightly important to comment analysis. Additionally, five of the 10 selected agencies (CMS, EPA, FCC, FDA, and FWS) had at least one program office that reported that the identity or organizational affiliation of a commenter is not at all important to comment analysis. None of the 52 program offices we surveyed responded that the identity of an individual commenter is extremely important to their analysis, while only one program office responded that the commenter’s organizational affiliation is extremely important to its analysis. (See fig. 8.) According to officials we interviewed from eight of the 10 selected agencies, the substance of the comment is considered during analysis rather than the submitted identity information. Officials from six of these agencies emphasized that because the agency accepts anonymous comments, identity is not relevant to their analysis of comments. However, officials from four of the eight selected agencies stated that, in certain instances, identity information may be noted. In the case of FDA, officials explained that commenters are required to indicate a category to which they belong, such as “individual consumer” or “academia.” According to FDA officials, however, these categories were used to assist in writing the comment response, rather than informing the analysis. Officials from the Department of the Interior’s Office of the Solicitor (responsible for part of the comment process at BLM and FWS) stated that the agency may make particular note of comments submitted by a law firm, as these comments can help the agency understand the position of the law firm and to prepare a defense in the event that a lawsuit is filed. Similarly, officials from EPA stated that they are familiar with many commenters and their positions on certain issues, due to prior legal interactions. In another example of how an agency may consider the identity of a commenter, officials from FWS stated that when scientific data are provided in support of a comment, subject-matter experts will verify the data and their source. Selected Agencies Differ in How They Identify Commenters When Responding to Comments All selected agencies draft a response to comments with their final rule, but the extent to which the agencies identify commenters in their response varies. In our survey of program offices with regulatory responsibility, officials from 51 of 52 offices stated that they are responsible in whole or in part for responding to comments. Of those responsible, at least one program office from eight of the 10 agencies (28 of 52 offices) reported that they identified comments by commenter name, organization, or comment ID number in the response to comments for at least some rulemakings since 2013. In the case of WHD, officials we interviewed explained that when they discuss a specific comment in the preamble to the final rule, they provide the name of the organization that submitted the comment so that anyone interested in locating the response to the comment may do so easily. We found that EBSA and FCC also identified commenters by individual or organizational name in their response to comments, while EPA referred to comments by their comment ID number. For example, in a rule finalized in 2018, EPA referred to comment ID numbers in the response to comments: “Two comments: EPA-R06-RCRA-2017-0556-0003 and EPA- R06-RCRA-2017-0556-0005 were submitted in favor of the issuance of the petition.” EPA officials noted that there is variation within the agency in terms of how commenters are identified when the agency is responding to comments, and there may be some situations where the commenter is identified by name. Officials from all program offices within CFPB and BLM responded to the survey that they never identified comments by commenter name, organization, or comment ID in their responses to public comments. In its response to comments in a 2014 final rule, for example, CFPB stated that “industry commenters also emphasized the need to coordinate with the States,” without specifying the organization or specific comments. Similarly, in its response to comments document for a 2016 rule, for example, BLM responded directly to the themes and issues raised by comments while stating that the issue was raised by “one commenter” or “some commenters.” Selected Agencies’ Practices Associated with Posting Identity Information Are Not Clearly Communicated to Public Users of Comment Websites The 10 selected agencies have implemented varied ways of posting identity information during the comment intake process, particularly regarding posting duplicate comments, as allowed by the APA. Our analysis of Regulations.gov and agency-specific comment websites shows that these practices are not always documented or clearly communicated to public users of the websites. Public users are members of the public interested in participating in the rulemaking process via Regulations.gov or agency-specific websites. They may or may not submit a comment. In part to facilitate effective public participation in the rulemaking process, the E-Government Act requires that all public comments and other materials associated with the rulemaking docket should be made “publicly available online to the extent practicable.” There may be situations where it is not practicable to post all submitted items, for example when resource constraints prevent the scanning and uploading of thousands of duplicate paper comments. Because the content of such comments is still reflected in the administrative record, such practices are not prohibited by the APA or the E-Government Act. However, key practices for transparently reporting open government data state that federal government websites—like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. This helps public users make informed decisions about how to use the data provided. In the case of identity information submitted with public comments, for example, public users may want to analyze identity information to better understand the geographic location from which comments are being submitted, and would need information about the availability of address information to do so. The Administrative Conference of the United States has made several recommendations related to managing electronic rulemaking dockets. These include recommendations that agencies disclose to the public their policies regarding the treatment of materials submitted to rulemaking dockets, such as those associated with protecting sensitive information submitted by the public. As described earlier in this report, the varied practices that selected agencies use with regard to identity information during the public comment process results in the inconsistent presentation of this information on the public websites, particularly when it is associated with duplicate comments. Although the APA and E-Government Act do not include any requirements associated with the collection or disclosure of identity information, we found that the selected agencies we reviewed do not effectively communicate the limitations and inconsistencies in how they post identity information associated with public comments. As a result, public users of the comment websites lack information related to data availability and limitations that could affect their ability to use the comment data and effectively participate in the rulemaking process themselves. Selected Agencies’ Practices Associated with Posting Identity Information on Regulations.gov Vary and Are Not Clearly Communicated to Public Users Public users of Regulations.gov seeking to submit a comment are provided with a blanket disclosure statement related to how their identity information may be disclosed, and are generally directed to individual agency websites for additional detail about submitting comments. The Regulations.gov disclosure statements and additional agency-specific details are provided on the comment form, and a user seeking to review comments (rather than submit a comment) may not encounter them on Regulations.gov. Regulations.gov provides the following disclosure statement at the bottom of each comment submission form: Any information (e.g., personal or contact) you provide on this comment form or in an attachment may be publicly disclosed and searchable on the Internet and in a paper docket and will be provided to the Department or Agency issuing the notice. To view any additional information for submitting comments, such as anonymous or sensitive submissions, refer to the Privacy Notice and User Notice, the Federal Register notice on which you are commenting, and the Web site of the Department or Agency. Similar information is provided to all public users in the Privacy Notice, User Notice, and Privacy Impact Assessment for Regulations.gov and the eRulemaking Program. While all of these note that any information, personal or otherwise, submitted with comments may be publicly disclosed, public users are not provided any further detail on Regulations.gov regarding what information, including identity information, they should expect find in the comment data. We found that when Regulations.gov provides public users with additional agency-specific information about the comment intake process, including accepting and posting comments, it is typically provided in the context of the comment form and does not provide public users enough detail to determine what comment data will be available for use when searching comments that are already submitted. Specifically, each comment form contains a pop-up box under the heading “Alternate Ways to Comment,” which reflects the language associated with comment submission methods included in the NPRM on which individuals are seeking to comment. Additionally, three participating agencies in our review (EPA, FWS, and WHD) provide additional detail about posting practices on the comment form under the heading “Agency Posting Guidelines.” Both FWS and WHD indicate that the entire comment, including any identifying information, may be made available to the public. Although WHD follows DOL policy associated with posting duplicate comments, which allows some discretion in posting practices, according to a WHD official, without exception, all comments are posted to Regulations.gov. In our review of WHD comment data, we did not identify instances where this practice was not followed. The “Agency Posting Guidelines” provided by EPA inform public users that all versions of duplicate or near-duplicate comments as part of mass mail campaigns may not be posted; rather a representative sample will be provided, with a tally of the total number of duplicate comments received. (See fig. 9.) However, this information does not provide enough detail to help public users determine whether all of the individual comments and associated identity information are posted within this docket, because it indicates that samples are provided for duplicate comments, rather than all of the copies submitted. We found that one EPA docket received more than 350 separate sets of duplicate comments comprising a total of more than 4.3 million comments (as reported by Regulations.gov) but there is variation in how these comments were posted. Specifically, EPA inconsistently presented duplicate comments: 198 of the 350 duplicate comment sets in this docket were submitted via email. Of the duplicate comment sets submitted via email, 45 sets have all comments posted in Regulations.gov, while 153 sets have a sample of the comments posted. According to EPA officials, this inconsistency results from the format in which the comments were submitted. For example, when duplicate comments are compiled into a single document and submitted to EPA through one email, all of the comments will be posted, whereas duplicate comments that are emailed separately will be accounted for in the tally accompanying a sample comment. While the APA and the E-Government Act do not require comments to be posted in any particular way, EPA has established detailed internal guidance for the comment intake process for its Docket Center staff. This document is in draft form, but clearly lays out the processes EPA staff are expected to follow when duplicate comments are submitted in different ways, and what naming conventions will be used in different instances. However, EPA does not provide similar information to public users about the process it uses to determine whether all duplicate comments will be posted, making it challenging for public users to determine whether all comments are available on Regulations.gov. Participating Agency Websites The eRulemaking PMO provides participating agencies with flexibility in how they choose to use FDMS and Regulations.gov, with each department or agency responsible for managing its own data within the website. As a result, Regulations.gov directs public users to participating agencies’ websites for additional information about agency-specific review and posting policies. We found that all of the selected participating agencies provide additional information of some kind about the public comment process on their own websites. However, the provided information usually directs users back to Regulations.gov or to the Federal Register. Further, even when selected participating agencies include details on their website about the agency’s posting practices or treatment of identity information associated with public comments, it does not fully describe data limitations that public users need to make informed decisions about how to use the data provided. Specifically, seven of the eight participating agencies (BLM, CMS, CFPB, EPA, FWS, FDA, and WHD) direct public users back to Regulations.gov and the Federal Register, either on webpages that are about the public comment process in general, or on pages containing information about specific NPRMs. As discussed previously, however, the disclosure statement on Regulations.gov directs public users to the agency website for additional information. Although three of these participating agencies (EPA, FWS, and FDA) do provide public users with information beyond directing them back to Regulations.gov or the Federal Register, only FDA provides users with details about posting practices that are not also made available on Regulations.gov. EPA: The additional information provided on EPA’s website largely replicates the “Agency Posting Guidelines” provided on the Regulations.gov comment form, as shown in figure 9. As discussed previously, however, the way in which EPA posts duplicate comments varies, and the provided information does not include details about the process the agency uses to determine whether all duplicate comments will be posted. FWS: One NPRM-specific web page that we identified communicated to public users that all comments will be posted on Regulations.gov, including any personal information provided through the process. This largely replicates the “Agency Posting Guidelines” provided on the Regulations.gov comment form, as well as language included in the NPRM itself. However, according to an FWS official, when the agency receives hard-copy duplicate comments through the mail, only one sample of the duplicate is posted publicly on Regulations.gov. FWS does not have any policies related to this practice and the information FWS provides to public users does not include details about how the agency determines which comment to post as the sample. FDA: On its general website, FDA includes a webpage titled, “Posting of Comments.” On this page, FDA provides users with a detailed explanation about a policy change the agency made in 2015 related to the posting of public comments submitted to rulemaking proceedings. Specifically, prior to October 2015, FDA did not publicly post comments submitted by individuals in their individual capacity. See figure 10. After October 15, 2015, FDA’s policy is to publicly post all comments to Regulations.gov, to include any identifying information submitted with the comment. In our review of FDA comments submitted to dockets opened since October 15, 2015, we did not identify instances where this policy was not followed. The one participating agency in our scope (EBSA) that does not direct public users back to Regulations.gov instead recreates the entire rulemaking docket on its own website. On the main EBSA webpage related to regulations, public users can find links to various websites related to rulemaking, including a “Public Comments” page, but not Regulations.gov. From the “Public Comments” page, public users can access pages that are specific to NPRMs and other activities for which EBSA is requesting public comments. On the NPRM-specific webpages, the rulemaking docket that can be found on Regulations.gov is duplicated, including individual links to each submitted comment. Certain document links, such as those for the proposed rule or final rule, direct a public user to the Federal Register document, but the comment links do not direct users to Regulations.gov. While EBSA follows DOL guidance associated with posting duplicate comments, which allows some discretion in posting practices, EBSA does not have a policy for how comments are posted to Regulations.gov or its own website, and in the examples we reviewed the content of the docket pages does not always match. According to EBSA officials, the agency began this practice prior to the development of Regulations.gov, and has continued it because internal staff and other stakeholders find the webpages useful. However, we have previously reported that reducing or eliminating duplicative government activities can help agencies provide more efficient and effective services. Further, on EBSA’s “Public Comments” webpage, public users are informed that comments with inappropriate content will be removed, but no other information associated with EBSA’s posting practices is provided on this general page. In one instance on an NPRM-specific webpage, public users are informed that identity information has been removed from certain comments due to the inclusion of personal health information, but most of the NPRM-specific webpages we reviewed did not include this disclosure. Additionally, duplicate comments are posted on the NPRM- specific webpages under the heading “Petitions,” and are posted with a number following the title of the comment. While public users are informed that the number represents the total number of comments submitted, not all links include a copy of each individual comment. This practice aligns with DOL guidance, but as a result, the way in which EBSA posts duplicate comments varies even within dockets, and the provided information does not include details about the process the agency uses to determine whether all duplicate comments will be posted. Additionally, because EBSA recreates rulemaking dockets on its own website without referencing Regulations.gov or explaining the process, public users lack assurance about how EBSA’s data sources relate to one another. Because participating agencies are not required to adhere to standardized posting practices, Regulations.gov directs public users to participating agency websites for additional information about posting practices and potential data limitations. However, the additional information provided on the selected agencies’ websites is rarely different from what is provided on Regulations.gov. Further, it does not describe the limitations associated with the identity information contained in publicly posted comments, and in many cases simply directs users back to Regulations.gov. As allowed for under the APA, all of the participating agencies in our review vary in the way in which they post identity information associated with comments—particularly duplicate comments. However, the lack of accompanying disclosures may potentially lead users to assume, for example, that only one entity has weighed in on an issue when, actually, that comment represents 500 comments. The APA, E-Government Act and relevant Executive Orders establish the importance of public participation in the rulemaking process, to include access to electronic rulemaking dockets in formats that can be easily searched and downloaded. Further, key practices for transparently reporting open government data state that federal government websites— like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. Without better information about the posting process, the inconsistency in the way in which duplicate comments are presented to public users of Regulations.gov limits public users’ ability to explore and use the data and could lead users to draw inaccurate conclusions about the public comments that were submitted and how agencies considered them during the rulemaking process. Agency-Specific Comment Websites Do Not Clearly Communicate Posting Policies to Public Users Both SEC and FCC use comment systems other than Regulations.gov and follow standardized posting processes associated with public comments submitted to their respective comment systems, but SEC has not clearly communicated these practices to the public. Although it appears to users of the SEC website that the agency follows a consistent process for posting duplicate comments, this practice has not been documented or communicated to public users of its website. As discussed earlier, SEC posts a single example for each set of duplicate comments and indicates the total number of comments received. As a result, the identity information and any unique comment content beyond the first example are not accessible to the public online. According to SEC officials, this practice is not documented in formal policy, and is not explicitly communicated to public users of the SEC’s comment website. Although SEC does provide public users with some information on its “How to Submit Comments” page, this information is limited to informing public users that all comments will be posted publicly, without any edits to personal identifying information, and no other information related to SEC’s posting process is provided. Without clearly communicated policies for posting comments, public users of SEC.gov do not have information related to data sources and limitations needed to determine whether and how they can use the data associated with public comments. In contrast, FCC identifies its policies for posting comments and their associated identity information in a number of places on the FCC.gov website, and on the ECFS web page within the general website. Regarding comments submitted to rulemaking proceedings through ECFS, public users are informed that all information submitted with comments, including identity information, will be made public. According to FCC officials, all comments are posted directly to ECFS as they are submitted, without intervention by FCC staff. Further, according to officials, all duplicate comments remain in ECFS as individual comments, unless an organization submits a Standard filing with an attached file containing multiple comments. Our review of ECFS comment data did not identify discrepancies with this practice. Conclusions While the public comment process allows interested parties to state their views about prospective rules, the lack of communication with the public about the way in which agencies treat identity information during the posting process, particularly for duplicate comments, may inhibit users’ meaningful participation in the rulemaking process. While the APA does not include requirements for commenters to provide identity information, or for agency officials to include commenter identity as part of their consideration of comments, key practices for transparently reporting open government data state that federal government websites—like those used to facilitate the public comment process—should fully describe the publicly available data, to include disclosing data sources and limitations. Without clearly communicating how comments and their associated identity information are presented in the data, public users could draw inaccurate conclusions about public comments during the rulemaking process, limiting their ability to participate in the rulemaking process. Five selected agencies do not have a policy for posting comments, and the selected agencies generally do not clearly communicate to public users about the way in which they publicly post comments and their associated identity information. In addition, one agency fully duplicates rulemaking dockets on its own website, without informing users that the information may be found in a searchable database on Regulations.gov. Regulations.gov does not provide detailed information about posting policies, and seven of the eight participating agencies in the scope of our review direct public users back to Regulations.gov or the Federal Register on their own websites. Further, the available information is provided on the comment form, so public users seeking to review comment data that had been previously submitted may not encounter it. Because all of the participating agencies in our review vary in the way in which they post identity information associated with comments—particularly duplicate comments—the lack of accompanying disclosures may potentially lead users to reach inaccurate conclusions about who submitted a particular comment, or how many individuals weighed in on an issue. As a result, public users of Regulations.gov do not have information related to data sources and limitations that could affect their ability to effectively use the comment data and, consequently, participate in the rulemaking process. Similarly, users of SEC.gov do not have information related to data sources and limitations needed to determine whether and how they can use the data associated with public comments, because the agency lacks a policy for posting duplicate comments and associated identity information to the public. In short, more clearly communicated information about posting policies, particularly with regard to identity information and duplicate comments, could help public users make informed decisions about how to use the comment data these agencies provide, and how comments may have informed the rulemaking process. Recommendations for Executive Action We are making the following eight recommendations to the Directors of BLM, CFPB, and FWS; the Administrators of CMS, EPA, and WHD; the Assistant Secretary of Labor for EBSA; and the Chairman of the SEC, respectively: The Director of BLM should create and implement a policy for standard posting requirements regarding comments and their identity information, particularly for duplicate comments, and should clearly communicate this policy to the public on the BLM website. (Recommendation 1) The Administrator of CMS should create and implement a policy for standard posting requirements regarding comments and their identity information, particularly for duplicate comments, and should clearly communicate this policy to the public on the CMS website. (Recommendation 2) The Director of CFPB should finalize its draft policy for posting comments and their identity information, particularly for duplicate comments, and clearly communicate it to the public on the CFPB website. (Recommendation 3) The Assistant Secretary of Labor for EBSA should 1. create and implement a policy for standard posting requirements regarding comments and their identity information, particularly for duplicate comments; 2. clearly communicate this policy to the public on the EBSA website; 3. evaluate the duplicative practice of replicating rulemaking dockets on the EBSA website, to either discontinue the practice or include a reference to Regulations.gov and explanation of how the pages relate to one another. (Recommendation 4) The Administrator of EPA should finalize its draft policy for posting comments and their identity information, particularly for duplicate comments, and clearly communicate it to the public on the EPA website. (Recommendation 5) The Director of FWS should create and implement a policy for standard posting requirements regarding comments and their identity information, particularly for duplicate comments, and should clearly communicate this policy to the public on the FWS website. (Recommendation 6) The Chairman of the SEC should develop a policy for posting duplicate comments and associated identity information and clearly communicate it to the public on the SEC website. (Recommendation 7) The Administrator of WHD should clearly communicate its policy for posting comments and their identity information, particularly for duplicate comments, to the public on the WHD website. (Recommendation 8) Agency Comments and Our Evaluation We provided drafts of this product for comment to CFPB, EPA, FCC, SEC, the Department of Health and Human Services, the Department of the Interior, and DOL. We received written comments from three of the selected agencies and the three Departments which are reproduced in appendixes V through X. All of the selected agencies generally agreed with the recommendations directed to them and indicated that they intended to take action to more clearly communicate their posting policies to the public. BLM, EBSA, FWS, and SEC also stated that they intend to develop written policies associated with posting comments. In its written comments, the Department of Health and Human Services stated that CMS already has policies for standard posting requirements. However, CMS could not provide us with this policy during the course of our review, and in the accompanying technical comments, officials stated that guidance associated with posting comments has not been formalized in a written document. Given that we found significant variation in the way that CMS posts comments, even within a single docket, we continue to believe that it is important for CMS to develop and implement a standard policy for posting comments and their identity information, in addition to communicating this policy to the public on the CMS website. CFPB and EPA also stated that they intend to finalize their draft policies for posting comments and their associated identity information. In addition, EPA included technical comments in its letter, which we considered and incorporated in this report as appropriate. FCC had no comments on the draft report, but provided technical comments, which we incorporated as appropriate. The remaining selected agencies and departments also provided technical comments, which we considered and incorporated in this report as appropriate. As arranged with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees; the Director of CFPB; the Administrator of EPA; the Chairmen of FCC and SEC; and the Secretaries of Health and Human Services, the Interior, and Labor. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix XI. Appendix I: Survey of Program Offices with Regulatory Responsibilities within Selected Agencies To determine how selected agencies treat identity information associated with public comments, in October 2018 we surveyed and received responses from 52 program offices within the selected agencies about their practices associated with comment intake (including identifying duplicate comments and posting comments to the public website), comment analysis (including reviewing comments and considering their content), and response to comments. To select the program offices to receive survey questionnaires about the public comment process, we first reviewed agency websites to identify all of the program offices in each of the selected agencies. We then identified program offices with regulatory responsibilities described by the websites and that had issued at least one Notice of Proposed Rulemaking (NPRM) from 2013 through 2017, and provided these lists to the selected agencies for confirmation. Table 7 lists the program offices we surveyed. Survey Development We developed a draft survey questionnaire in conjunction with another GAO engagement team conducting work on the public comment process, and pretested it with program office officials from four of the selected agencies in August and September 2018. We interviewed these officials to improve the questionnaire and ensure that (1) the questions were clear and unbiased, (2) the information could be feasibly obtained by program office officials, (3) the response options were appropriate and reasonable, and (4) the survey did not create an undue burden on program office officials. The process of developing the survey was iterative, where we used the results of one pretest to modify the questionnaire for the next pretest. Survey Administration and Review We distributed the questionnaires to the program offices as fillable Portable Document Format (PDF) forms, in October 2018 requesting that officials collaborate with others in their office to ensure the responses were reflective of the program office as a whole, rather than one individual’s experience. Two agencies, CMS and SEC, have agency-level administrative offices with centralized responsibilities for certain aspects of the public comment process. For these agencies, the selected program offices were instructed to leave certain questions blank, and we provided separate questionnaires for the administrative offices. All 52 program offices completed the survey, but the results cannot be generalized to program offices outside of the selected agencies. In developing, administering, and analyzing this survey, we took steps to minimize the potential errors that may result from the practical difficulties of conducting any survey. Because we surveyed and received responses from all program offices with regulatory responsibilities in the selected agencies, our results are not subject to sampling or nonresponse error. We pretested and reviewed our questionnaire to minimize measurement error that can arise from differences in how questions are interpreted and the sources of information available to respondents. We also answered questions from program offices during the survey, reviewed completed questionnaires, and conducted follow-up as necessary. On the basis of this follow-up and with agreement from the responding officials, we edited responses as needed. For CMS and SEC, we edited the blank questions in the program office questionnaires with responses from their administrative offices. Relevant Survey Questions Appendix II: Regulations.gov Comment Form Example Comments are submitted to Regulations.gov via an electronic comment form. See figure 11 for an example of a comment form from Regulations.gov. Appendix III: Electronic Comment Filing System Comment Forms The Federal Communications Commission’s (FCC) Electronic Comment Filing System (ECFS) allows commenters to submit comments to rulemaking proceedings via a Standard filing and Express filing. A Standard filing allows commenters to attach a file to their comment. See figure 12 for an example of a Standard filing. An Express filing does not allow for files to be attached. See figure 13 for an example of an Express filing. Appendix IV: Securities and Exchange Commission Comment Form Example One way in which comments are submitted to the Securities and Exchange Commission (SEC) is through an electronic comment form. See figure 14 for an example of a comment form from SEC.gov. Appendix V: Agency Comments from the Bureau of Consumer Financial Protection Appendix VI: Agency Comments from the Environmental Protection Agency Appendix VII: Agency Comments from the Department of Health and Human Services Appendix VIII: Agency Comments from the Department of the Interior Appendix IX: Agency Comments from the Department of Labor Appendix X: Agency Comments from the Securities and Exchange Commission Appendix XI: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, David Bruno (Assistant Director), Elizabeth Kowalewski (Analyst in Charge), Enyinnaya David Aja, Gretel Clarke, Lauren Kirkpatrick, James Murphy, Alexandria Palmer, Carl Ramirez, Shana Wallace, and April Yeaney made key contributions to this report. Other contributors include Tim Bober, Dahlia Darwiche, Colin Fallon, Justin Fisher, James Healy, Katie LeFevre, Barbara Lewis, and Maria McMullen.