Findings Table of Contents Highlights Audit Report Report Number HR-AR-15-007 September 15, 2015 Appendices Recommendations U.S. Postal Inspection Service Mail Covers Program — Phase II Print Highlights Table of Contents Findings Highlights This is a follow-up to a previous report that Appendices Recommendations reviewed handling of mail covers requested by external law enforcement agencies. Background A mail cover is an investigative tool used to track criminal activity. During fiscal years (FY) 2010 through 2014, the U. S. Postal Inspection Service approved 118,577 mail covers requested by postal inspectors and 39,966 requested by external law enforcement authorities. Authorized by the chief postal inspector or a designee, a mail cover involves U.S. Postal Service or Postal Inspection Service personnel recording information from the outside of a mailpiece, such as the sender’s address. Personnel are not permitted to open mailpieces without a search warrant. The Postal Inspection Service’s Criminal Investigations Service Center (CISC), the primary administrator of the mail covers program, is responsible for maintaining accountable mail cover documents and Postal Service (PS) Forms 2008 and 2009. PS Form 2008, Letter of Instruction, provides guidance for completing, returning, and safeguarding mail covers. PS Form 2009, Information Regarding Mail Matter, is used to record information from the outside of the mailpiece, such as the sender’s name and address. These forms contain information such as names, addresses, and financial institutions that, if used in the aggregate, could reveal personally identifiable information. When an external mail cover request is approved, CISC sends PS Forms 2008 and 2009 to the Postal Service, which records mailpiece information. Both documents are returned to CISC, U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 which forwards PS Forms 2009 to the requesting external law enforcement agency. The external law enforcement agency must return PS Forms 2009 to CISC within 60 days after the end of the mail cover. For approved internal mail cover requests, CISC sends PS Forms 2008 and 2009 to the Postal Service, which records the information (or the postal inspector will record the information). Once the information is recorded, the Postal Service must send accountable documents to the requesting postal inspector. Depending on the case, the documents must be returned to CISC within 60 days or before the case is closed. Postal inspectors also conduct interdiction mail covers, which focus on large volumes of mail at specific postal facilities and may last up to 120 days. This is a follow-up to a previous report that reviewed handling of mail covers requested by external law enforcement agencies. The objectives of the current audit were to follow up on recommendations from the previous audit and assess how the Postal Inspection Service handled internal mail cover requests from postal inspectors and the impact of publicly reporting mail cover statistics. What The OIG Found The Postal Inspection Service and Postal Service management addressed three of the four recommendations from our prior audit involving external and national security mail covers. Print 1 Highlights Table of Contents Findings Specifically, management completed actions to ensure national security mail covers were handled appropriately, mail cover requests were properly approved and justified, periodic reviews were conducted, and controls were improved to ensure facility personnel process mail covers timely. Postal Service management is currently completing actions to ensure data integrity in the Postal Inspection Service mail cover application. Appendices Recommendations However, the CISC was still not ensuring accountable documents were returned timely. For external requests, 49 of 75 files we sampled (65 percent) from prior audit work had accountable information that still had not been returned. Also, accountable documents for 16 mail cover files judgmentally selected from FY 2015 were not returned timely, not returned at all, or not retained in the mail cover file. To address this issue, Postal Inspection Service management implemented the use of a Postal Service tracking system to monitor mail covers at postal facilities and began developing a debarment process to hold external law enforcement agencies accountable for not returning accountable documents. Internal mail cover requests from postal inspectors had similar issues. Specifically, Postal Inspection Service personnel closed 79 of 120 mail cover files (66 percent) during FYs 2012 through 2014 without PS Forms 2009 being returned. In addition, we found accountable documents for 10 of the 16 mail cover files judgmentally selected from FY 2015 (63 percent) were closed without PS Forms 2009 being returned. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Also, Postal Service employees responsible for documenting mailpiece information at nine judgmentally selected facilities did not always safeguard mail cover information, follow mail cover procedures for recording information, or complete the mail cover. In addition, Postal Inspection Service personnel did not notify the requesting law enforcement agency in one of the 11 incidents where the mail cover was compromised when the investigated subject was informed about the mail cover. During the audit, CISC officials updated standard operating procedures and reiterated to staff the requirement to notify the requesting agency when a compromise occurs and to document the notification. Further, personnel at three facilities did not complete separate PS Forms 2009 for each mailpiece recorded for interdiction mail covers, as required. Instead, they recorded the information on a spreadsheet or in the Postal Inspection Service database. Although it may be more efficient to complete a single document attached to a spreadsheet listing all of the mailpieces, consideration should be given to the impact on the confidentiality and security of mail cover information. Finally, management could improve transparency in the mail covers program by publicly reporting annual mail cover statistics. These issues occurred because management did not have a process in place to hold external law enforcement agencies accountable for not returning mail cover documents and did not always monitor and track accountable mail cover Print 2 Highlights Table of Contents What The OIG Recommended We recommended management complete the debarment process to hold external law enforcement agencies accountable for returning accountable documents, establish formal procedures to monitor and track accountable mail cover documents, establish mandatory training requirements for Postal Service personnel responsible for handling and safeguarding mail covers, conduct a study to determine the use of electronic media, including spreadsheets, and its impact on the confidentiality and security of mail cover information and establish guidelines to report mail cover statistics. Appendices Recommendations Findings documents, sufficiently oversee compliance, or clarify requirements and train personnel for internal mail cover requests. In addition, officials did not have guidelines for reporting mail cover statistics. Insufficient controls over the mail covers program could hinder the Postal Inspection Service’s ability to conduct effective investigations, lead to public concerns over privacy of mail, and harm the Postal Service’s brand. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 3 Highlights Transmittal Letter Table of Contents September 15, 2015 MEMORANDUM FOR: GUY J. COTTRELL CHIEF POSTAL INSPECTOR EDWARD F. PHELAN, JR. VICE PRESIDENT, DELIVERY OPERATIONS KELLY M. SIGMON VICE PRESIDENT, RETAIL AND CUSTOMER SERVICE OPERATIONS Findings E-Signed by Janet Sorensen VERIFY authenticity with eSign Desktop FROM: Janet M. Sorensen Deputy Assistant Inspector General for Revenue and Resources Appendices Recommendations SUBJECT: Audit Report – U.S. Postal Inspection Service Mail Covers Program — Phase II (Report Number HR-AR-15-007) This report presents the results of our audit of the U.S. Postal Inspection Service Mail Covers Program — Phase II (Project Number 15RG009HR000). We appreciate the cooperation and courtesies provided by your staff. If you have any questions or need additional information, please contact Monique P. Colter, director, Human Resources and Support, or me at 703-248-2100. Attachment cc: U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Corporate Audit and Response Management Print 4 Cover Highlights.......................................................................................................1 Background.................................................................................................1 What The OIG Found..................................................................................1 What The OIG Recommended...................................................................3 Transmittal Letter...........................................................................................4 Findings.........................................................................................................6 Conclusion..................................................................................................7 Status of Accountable Documents From Prior Audit...................................8 Accountable Mail Cover Documents...........................................................8 Handling and Safeguarding Mail Cover Information at Postal Facilities.....9 Safeguarding Mail Cover Information.......................................................9 Procedures and Processes for Handling Mail Covers............................10 Compromised Mail Covers........................................................................ 11 Interdiction Mail Cover Procedures...........................................................12 Reporting Mail Cover Statistics.................................................................12 Recommendations......................................................................................14 Management’s Comments........................................................................14 Evaluation of Management’s Comments..................................................15 Appendices..................................................................................................16 Appendix A: Additional Information...........................................................17 Background ...........................................................................................17 Objective, Scope, and Methodology.......................................................17 Prior Audit Coverage..............................................................................19 Appendix B: Management’s Comments....................................................20 Contact Information.....................................................................................23 Appendices Recommendations Findings Table of Contents Highlights Table of Contents U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 5 Highlights Table of Contents Findings During FYs 2010 through 2014, the Postal Inspection Service approved 118,577 mail covers requested by postal inspectors Introduction This report presents the results of our self-initiated audit of the U.S. Postal Inspection Service Mail Covers Program — Phase II (Project Number 15RG009HR000). This is a follow-up to a prior U.S. Postal Service Office of Inspector General (OIG) report, Postal Inspection Service Mail Covers Program (Report Number HR-AR-14-001, dated May 28, 2014). That report evaluated whether the U.S. Postal Service and the Postal Inspection Service effectively and efficiently handled mail cover requests from external law enforcement agencies, including those used to protect national security. The objectives of the current audit were to follow up on recommendations from the previous audit and assess how the Postal Inspection Service handled internal mail cover requests from postal inspectors and the impact of publicly reporting mail cover statistics. See Appendix A for additional information about this audit. A mail cover is an investigative tool used to track criminal activity for investigatory purposes or as part of an investigation of a single suspect. During fiscal years (FY) 2010 through 2014, the Postal Inspection Service approved 118,577 mail covers requested by postal inspectors and 39,966 requested by external law enforcement authorities. Authorized by the chief postal inspector (CPI) or a designee, a mail cover involves Postal Service personnel or postal inspectors recording information from the outside of a mailpiece, such as the sender’s address. The mail covers program does not permit personnel to open sealed letters or packages. A search warrant is necessary to open sealed mail. law enforcement authorities. Appendices is responsible for maintaining accountable mail cover documents, PS Forms 2009 and 2008. PS Form 2009, Information Regarding Mail Matter, is used to record information from the outside of the mailpiece such as the sender’s name and address. PS Form 2008, Letter of Instruction, provides guidance for Postal Service personnel to complete, return, and safeguard mail covers. These accountable documents contain information such as names, addresses, and financial institutions that, if used in the aggregate, could reveal personally identifiable information. When an external mail cover request is approved, CISC sends PS Forms 2008 and 2009 to Postal Service personnel, who record mailpiece information. They must return both documents to CISC, who forwards the PS Forms 2009 to the requesting external law enforcement agency. The external law enforcement agency must return PS Forms 2009 to CISC within 60 days after the end of the mail cover. Recommendations Findings and 39,966 requested by external The Postal Inspection Service’s Criminal Investigations Service Center (CISC), the primary administrator of the mail covers program, For approved internal mail cover requests, CISC sends PS Forms 2008 and 2009 to Postal Service personnel and they record the information or the postal inspector will record the information. Once the information is recorded, Postal Service personnel must send the accountable documents to the requesting postal inspector. For Postal Inspection Service area cases,1 postal inspectors must return accountable documents to CISC within 60 days of the end of the mail cover. For jacketed cases,2 the postal inspector must return the accountable documents to CISC before the mail cover file or the investigation is closed. Postal inspectors also conduct interdiction mail covers, which focus on large volumes of mail at specific postal facilities, as opposed to a specific sender or address. Interdiction mail covers may last up to 120 days unless an extension is approved. 1 2 U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Postal inspectors use area cases when reviewing allegations and complaints that have not reached a point where an inspector determined it is possible to prosecute or take administrative action against a suspect. Jacketed cases are used when an investigation results in evidence gathered to support potential administrative action or prosecution against a suspect. Print 6 Table of Contents Highlights Conclusion The Postal Inspection Service and Postal Service management addressed three of the four recommendations from our prior audit involving external and national security mail covers. Specifically, management completed actions to ensure national security mail covers were handled appropriately, mail cover requests were properly approved and justified, periodic reviews were conducted, and controls were improved to ensure facility personnel process mail covers timely. Postal Service management is currently completing actions to ensure data integrity in the Postal Inspection Service mail cover application. CISC was still not ensuring accountable documents were returned timely. For external requests, 49 of 75 files we sampled (65 percent) from the prior audit work had accountable Findings information that still had not been returned, and accountable documents for 16 mail cover files judgmentally selected Appendices Recommendations from FY 2015 were not returned timely, not returned at all, or not retained in the mail cover file. However, CISC was still not ensuring accountable documents were returned timely. For external requests, 49 of 75 files we sampled (65 percent) from the prior audit work had accountable information that still had not been returned, and accountable documents for 16 mail cover files judgmentally selected from FY 2015 were not returned timely, not returned at all, or not retained in the mail cover file. To address this issue, Postal Inspection Service management implemented the use of a Postal Service tracking system to monitor mail covers at postal facilities and began developing a debarment process to hold external law enforcement agencies accountable for not returning accountable documents. Internal mail cover requests from postal inspectors had similar issues. Specifically, Postal Inspection Service personnel closed 79 of 120 mail cover files (66 percent) during FYs 2012 through 2014 without PS Forms 2009 being returned. In addition, we found accountable documents for 10 of the 16 mail cover files judgmentally selected from FY 2015 (63 percent) were closed without PS Forms 2009 being returned. Also, Postal Service employees who were responsible for documenting mailpiece information at nine judgmentally selected facilities did not always safeguard mail cover information, follow mail cover procedures for recording information, or complete the mail cover. In addition, Postal Inspection Service personnel did not notify the requesting law enforcement agency in one of the 11 incidents where the mail cover was compromised when the investigated subject was informed about the mail cover. During the audit, CISC officials updated standard operating procedures and reiterated to staff the requirement to notify the requesting agency when a compromise occurs and to document the notification. Further, personnel at three facilities did not complete separate PS Forms 2009 for each mailpiece recorded for interdiction mail covers as required. Instead, they recorded the information on a spreadsheet or in the Postal Inspection Service database. Although it may be more efficient to complete a single document attached to a spreadsheet listing all of the mailpieces, consideration should be given to the impact on the confidentiality and security of mail cover information. Finally, management could improve transparency in the mail covers program by publicly reporting annual mail cover statistics. These issues occurred because management did not have a process in place to hold external law enforcement agencies accountable for not returning mail cover documents, did not always monitor and track accountable mail cover documents, sufficiently oversee compliance, or clarify requirements and train personnel for internal mail cover requests. In addition, officials did not have guidelines for reporting mail cover statistics. Insufficient controls over the mail covers program could hinder the Postal Inspection Service’s ability to conduct effective investigations, lead to public concerns over privacy of mail, and harm the Postal Service’s brand. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 7 Highlights Status of Accountable Documents From Prior Audit In our prior audit we identified law enforcement agencies that were not returned on time or maintained at the CISC. Recommendations Appendices CISC officials attempted to obtain some of the missing documents from the external law enforcement agencies and Postal Service personnel. Postal Inspection Service management stated that, effective March 31, 2015, they implemented the use of to monitor mail covers at postal facilities to ensure the return of accountable documents. In addition, Postal Inspection Service management began developing a debarment process to hold external law enforcement agencies accountable for not returning mail cover documents. Although these controls should resolve these issues, we are recommending management proceed with completing the debarment process. Accountable Mail Cover Documents Postal Inspection Service officials did not always properly handle accountable documents from internal mail cover requests from postal inspectors. Specifically, Postal Inspection Service personnel closed 79 of 120 mail cover files (66 percent) during FYs 2012 through 2014 without PS Forms 2009 being returned. The mail cover file should not be closed until every PS Form 2009 is either returned to CISC or accounted for. Fifty-one of the 79 mail covers involved preliminary investigations (known as area cases) and the postal inspectors should have returned the documents within 60 days of the end of the mail cover period. For the remaining 28 mail covers, postal inspectors should have returned PS Forms 2009 before CISC officials closed the mail cover files or before the postal inspector closed the investigation. Findings Table of Contents 120 mail cover files for external In our prior audit we identified 120 mail cover files for external law enforcement agencies that were not returned on time or maintained at the CISC. To determine whether these documents have since been returned from Postal Service personnel and external law enforcement agencies, we reviewed a statistical sample of 75 files. We found that Postal Service personnel or external law enforcement agencies did not return accountable documents for 49 of 75 files (65 percent). As of the date of this review, PS Forms 2009 and 2008 were unaccounted for up to 762 days beyond the mail cover period. We also found accountable documents for 16 mail cover files judgmentally selected from FY 2015 were not returned timely, not returned at all, or not retained in the mail cover file. All PS Forms 2009 and 2008 must be returned to the CISC within 60 days after the end of the mail cover. As of the date of this review, PS Forms 2009 and 2008 were unaccounted for up to 762 days beyond the mail cover period. In addition, we also found accountable documents for 10 of the 16 mail cover files judgmentally selected from FY 2015 (63 percent) were closed without PS Forms 2009 being returned. Postal inspectors4 stated that they were not required to complete PS Forms 2009 for drug and dangerous mail investigations because they recorded the information in the Inspection Service Integrated Information System (ISIIS).5 They further stated that Post Office personnel did not always provide the documents or did not know why the documents were not returned to the CISC. Also, Postal Inspection Service management stated that postal inspectors did not complete PS Forms 2009 for mail covers that were automatically generated, approved, and closed6 because the mail cover information was entered in ISIIS and they thought this replaced the requirement to complete a PS Form 2009.7 While recording mailpiece information directly into ISIIS could be more efficient, management should consider the impact on the confidentiality and security of mail cover information. 3 4 5 6 7 U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 We contacted 14 postal inspectors responsible for requesting 24 of 79 mail covers. An enterprise-wide application that incorporates advanced technology to consolidate and provide web-based interfaces among applications critical to Postal Inspection Service investigations. Mail covers that are automatically generated, approved and closed in ISIIS are generally associated with mail covers for drug activity and only last for 1 day. Postal Inspection Service officials must enter all seized mailpiece information related to drug investigations into the ISIIS database, which automatically generates, approves, and closes a mail cover for each mailpiece. Print 8 Highlights Handling and Safeguarding Mail Cover Information at Postal Facilities Postal Service employees did not always safeguard mail cover information, follow mail cover procedures for recording mail cover information, or process the mail cover as required. We conducted unannounced visits at nine judgmentally selected8 postal facilities in the New York, Chicago, and Los Angeles districts to assess how Postal Service employees safeguarded and handled mail cover requests. At a Postal Service facility in the New York District, a carrier placed a mail cover package on top of his mail casing station, Personnel at six of nine facilities did not adequately safeguard accountable documents. For example, at a Postal Service facility in the New York District, a carrier placed a mail cover package on top of his mail casing station, where it was accessible to all employees. Figure 1. Mail Cover on Mail Casing Station where it was accessible to all employees. Appendices Recommendations Findings Table of Contents Safeguarding Mail Cover Information Source: OIG photograph taken March 4, 2015. Management stated they were aware of procedures for safeguarding accountable mail cover documents; however, they did not provide adequate oversight to ensure employees followed the procedures. To address this issue, the station manager stated that he met with supervisors to discuss the importance of properly handling and safeguarding mail covers. He also designated a drawer in his office for maintaining mail cover documents. 8 U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 We selected facilities in the Los Angeles, New York, and Chicago districts because they had low compliance rates for returning accountable documents to the CISC in 2009. Print 9 Highlights During our visit to a facility in the Chicago District, we observed PS Forms 2008, which had the subject’s name and address posted, on the carrier’s casing station. We also found a mail cover request on the supervisor’s desk, which is on the workroom floor and visible to all employees. The manager stated that the supervisor posted the PS Forms 2008 on the carrier’s casing station as a reminder to perform the mail cover. The mail cover request was kept on the supervisor’s desk to incorporate mail cover requests with other assigned duties. The manager further stated that the supervisor was not sufficiently trained and not familiar with procedures for safeguarding accountable documents. Table of Contents Procedures and Processes for Handling Mail Covers In the Chicago District, we observed PS Forms 2008, which had the subject’s name and address posted, on the carrier’s casing station. We also found a mail cover request on the Personnel at five of the nine facilities did not follow procedures for handling accountable mail cover documents and six did not process mail covers, as required. For example, at a facility in the Los Angeles District, a mail cover request was approved for one subject; however, the supervisor instructed the carrier to record mail cover information for all persons residing at the address. Although the postmaster was not clear why the supervisor provided incorrect guidance to the carrier, he told the supervisor to handle future mail covers according to instructions. During our visit at another facility in the New York District, we found an unopened mail cover request in the inbox attached to the outside of the manager’s office door, where it was accessible to all employees. Figure 2. Mail Cover in Manager’s Inbox Outside Office Door on the workroom floor and visible to all employees. Recommendations Findings supervisor’s desk, which is Appendices Source: OIG photograph taken March 3, 2015. We also noted the mail cover was dated September 21, 2014, and our visit was 129 days past the mail cover end date. The manager stated he was not aware that the mail cover request was in his inbox and the clerk did not receive sufficient training on handling mail cover requests. The manager said he will review and discuss procedures for handling mail covers with employees and conduct daily checks to ensure proper handling of mail covers. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 10 Table of Contents Highlights On March 3, 2015, we visited another facility in the New York District and found an unopened mail cover request dated February 10, 2015, under a stack of papers on the supervisor’s desk. The mail cover was active from February 16 through March 17, 2015. The supervisor could not recall how or why the mail cover request was left on the desk. The facility manager stated a tracking mechanism will be developed to monitor all mail covers assigned to the facility. Mail cover requests are time-sensitive and sent by CISC to postal facilities to obtain information regarding ongoing criminal investigations. The requests instruct facility managers on how to properly handle and safeguard accountable mail cover documents. Facility managers must secure all accountable documents, preferably in a locked drawer. Noncompliance with the instructions may compromise the mail cover and negatively affect ongoing criminal investigations. In response to our prior audit, management implemented the on March 31, 2015, to enhance communication between the CISC and the postal units and to ensure postal personnel process mail covers timely. Although management’s action could address procedures for processing mail covers at postal facilities, the Postal Service must implement additional controls to better safeguard mail covers. At four of 10 facilities where mail cover compromises occurred, Findings management stated they took appropriate action to mitigate future compromises. Compromised Mail Covers Postal Inspection Service officials properly notified requesting external law enforcement agencies of compromised mail covers and documented the facts, as required, in 10 of 11 cases9 that occurred during between FY 2012 and March 2015. A compromised mail cover occurs when someone informs a subject that a mail cover is in effect or reveals information obtained from a mail cover. Postal Inspection Service policy10 states that if a mail cover compromise occurs, the CISC must: ■■ Report the compromise to the requesting agency ■■ Report the compromise to the CPI ■■ Summarize the facts of the compromise in the ISIIS Appendices Recommendations CISC officials involved in the one instance where the requesting agency was not informed of the compromise said they did not convey this information because the compromising incident occurred after the mail cover period. However, the policy requires such notification. At four of 10 facilities where mail cover compromises occurred, management stated they took appropriate action to mitigate future compromises. For example, a postmaster stated that he formally disciplined and provided additional instructions to the responsible manager to ensure mail covers are processed and safeguarded in accordance with policy. Management at another facility stated that they provided additional instructions and oversight to the supervisor in handling and safeguarding mail covers. We could not determine whether management at the remaining six facilities took corrective action because they were no longer working at those facilities. During the audit, CISC officials updated standard operating procedures and reiterated to CISC staff the requirement to notify the requesting agency when a compromise occurs and to document the notification in ISIIS. Therefore, we are not making a recommendation related to this issue. Insufficient controls over the mail covers program could hinder the Postal Inspection Service’s ability to conduct effective investigations, lead to public concerns over privacy of mail, and harm the Postal Service brand. 9 The 11 mail cover compromises occurred at 10 different Postal Service facilities. 10 ISM Section 6-6.7.2, dated January 2012. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 11 Table of Contents Highlights Interdiction Mail Cover Procedures We observed active interdiction mail covers at three Postal Service facilities11 and found that Postal Inspection Service personnel did not complete separate PS Forms 2009 for each mailpiece.12 Postal Inspection Service personnel at two of the facilities recorded mailpiece information onto a spreadsheet and personnel at the other facility recorded the mailpiece information directly into ISIIS. Postal Inspection Service officials stated that the completion and return of a separate PS Form 2009 for each mailpiece recorded under an interdiction mail cover was inefficient due to the large volume of mail. In addition, in recent training, postal inspectors were told to complete one PS Form 2009 and record mailpiece information on a spreadsheet during interdiction mail covers for dangerous mail.13 Although they have requirements These issues occurred because Postal Inspection Service management did not always monitor and track accountable mail cover for area cases and external law enforcement agencies to return mail cover documents within 60 days after the mail cover this requirement for postal inspector investigations. Appendices Recommendations Findings ends, they do not have documents or sufficiently oversee responsible personnel to ensure they complied with mail cover requirements. Although they have requirements for area cases and external law enforcement agencies to return mail cover documents within 60 days after the mail cover ends,14 they do not have this requirement for postal inspector investigations. Postal inspectors can keep accountable documents until the investigation is closed, which could take several years and increase the risk of documents not being returned. Also, postal inspectors did not always complete PS Forms 2009 for drug and dangerous mail investigations and for mail covers that are automatically generated, approved, and closed because they entered the information directly into ISIIS. Policies for completing and returning mail cover documents were not consistent or clear and training conflicted with the policy requirements. Policy stated the mail cover file should not be closed until the forms are either returned or accounted for; while postal inspectors were trained to not complete a separate PS Form 2009 for dangerous mail investigations and record the mailpiece information on a spreadsheet. Postal Inspection Service officials stated that they plan to update the Inspection Service Manual (ISM) to modify the requirement to complete a separate PS Form 2009 for each mailpiece related to interdiction mail covers. In addition, they will update policies to remove the requirement to compete a PS Form 2009 for automatically generated, approved, and closed mail covers. It may seem more efficient to complete a single PS Form 2009 attached to a spreadsheet listing all of the mailpieces; however, before management makes any procedural changes regarding this matter, they should consider the impact on the confidentiality and security of mail cover information. Reporting Mail Cover Statistics The Postal Inspection Service could improve transparency in the mail covers program by publicly reporting annual mail cover statistics. Postal Inspection Service officials stated they did not report mail cover statistics because this could decrease the effectiveness of the program by alerting criminals to techniques used in law enforcement investigations. However, since November 2013, the Postal Inspection Service has provided aggregate statistics in response to public Freedom of Information Act15 (FOIA) requests and congressional testimony.16 11 We visited three facilities with active mail covers in 12 ISM Section 6-6.1.4.2, dated January 2012. 13   14 ISM Section 6-6.6.1 and 6-6.6.2, dated January 2012. 15 A federal law granting public access to government agency information. Government agencies are required to release information unless it falls under one of nine exemptions listed in the act. 16 The CPI provided mail cover statistics as part of his written testimony to Congress on November 19, 2014.  U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 12 Highlights As depicted in Figure 3, during FYs 2010 through 2014, the Postal Inspection Service approved 118,577 and 39,966 mail covers requested by postal inspectors and external law enforcement agencies respectively. The Postal Inspection Service attributes the spike in postal inspector mail covers to a FY 2012 enhancement to ISIIS that created a separate mail cover for each individual mailpiece. The Postal Inspection Service Figure 3. Postal Inspection Service Approved Mail Covers FY 2010 Through 2014 SHOW ALL RESET enhancement to ISIIS that created a separate mail cover for each individual mailpiece. Total Postal Inspector Mail Covers 17 118,577 Total External Law Enforcement Mail Covers 39,966 Recommendations Appendices Click on the graphics below for more details. inspector mail covers to a FY 2012 Findings Table of Contents attributes the spike in postal Postal Inspection Service attributes “ theThespike in postal inspector mail covers to a FY 2012 enhancement to ISIIS that created a separate mail cover for each individual mailpiece. ” Source: Postal Inspection Service. Officials did not have guidelines for reporting mail cover statistics; however, Exception 7E of FOIA protects any information that may reveal techniques used in law enforcement investigations from disclosure. The Postal Inspection Service has relied on Exception 7E to refuse the release of mail cover statistics; however, the White House has directed federal agencies to “apply a presumption of openness” in responding to FOIA requests and encourages agencies to use discretion when releasing information. The Postal Inspection Service, in consultation with other agencies, should make mail cover statistics available to the public to help increase transparency about the program. 17 Includes mail covers initiated and ending in FY 2014, and mail covers initiated in FY 2014, but ending in FY 2015, as of December 15, 2014. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 13 Highlights Table of Contents Recommendations We recommend the chief postal inspector: 1. Proceed with completing the debarment process to hold external law enforcement agencies accountable for returning mail cover documents. We recommend management complete the debarment process to hold external law enforcement agencies accountable for returning documents; establish formal procedures to monitor 2. Establish formal procedures to monitor and track accountable mail cover documents for postal inspectors to ensure they are properly completed, submitted, and maintained at the Postal Inspection Service’s Criminal Investigations Service Center (CISC). These procedures should include requiring inspectors to return all mail cover documents to the CISC within 60 days of the mail cover end date. 3. Conduct a study to determine how using electronic media, including spreadsheets will impact the confidentiality and security of mail cover information. Based on study results, clarify policies and procedures regarding completing Postal Service Form 2009, Information Regarding Mail Matter, for each mailpiece related to interdiction mail covers and for mail covers that are automatically generated, approved, and closed. 4. Establish guidelines to report mail cover statistics annually. Findings and track accountable mail cover We recommend the vice president, Delivery Operations, and the vice president, Retail and Customer Service Operations, documents; conduct a study to determine how using electronic media will impact the confidentiality Appendices Recommendations and security of mail cover information; establish guidelines to report mail cover statistics annually; and establish training requirements for personnel responsible for handling and safeguarding mail covers. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 in coordination with the chief postal inspector: 5. Establish training requirements for Postal Service personnel responsible for handling and safeguarding mail covers to ensure they are aware of their roles and responsibilities regarding the mail cover process. Management’s Comments Management agreed with the findings and recommendation 1, and partially agreed with recommendations 2, 3, 4, and 5. Regarding recommendation 1, management agreed and stated they will develop a debarment process to ensure accountable documents are returned. The target implementation date is March 31, 2016. Regarding recommendation 2, management stated there are existing procedures for monitoring the return of mail cover-related information and agreed that inspectors should return materials to the CISC or other designated repository. Management also stated that they are currently reviewing the existing time limits for the return of mail cover information by postal inspectors, as the existing timeframes may not be appropriate in all situations. Management stated they will determine the appropriate deadlines for postal inspectors to return mail cover information and establish policies outlining those deadlines. The target implementation date is March 31, 2016. Regarding recommendation 3, management stated that, as part of their routine program management, they review the use and impact of technology and related privacy and legal concerns applicable to all programs, including mail covers. They are confident that their protocols meet appropriate confidentiality and security standards. Management also has policies, procedures, and training requirements for the proper handling and protection of sensitive and restricted information, including information in electronic format; and stated that a separate study is not required. Management further stated that they have discretion as to whether PS Forms 2009 are appropriate or necessary and that this report did not suggest that using an alternate format would Print 14 Highlights adversely impact the security or confidentiality of the program. Finally, management agreed that they need to clarify existing policies and procedures regarding the handling and protection of sensitive and restricted mail cover information. The target implementation date is March 31, 2016. Regarding recommendation 4, management stated that they will provide Congress with the total number of mail covers initiated in a given year, if requested. Table of Contents Regarding recommendation 5, management stated that they will reinforce instructions for handling mail cover information on an as needed basis. The target implementation date is March 31, 2016. See Appendix B for management’s comments, in their entirety. Evaluation of Management’s Comments The OIG considers management’s comments responsive to the recommendations and corrective actions should resolve the issues identified in the report. Findings Regarding recommendation 4, we recognize management’s plan to respond to congressional requests for mail cover statistics; however, to further enhance transparency and to apply a presumption of openness in the mail covers program, management should consider reporting mail cover statistics annually. We do not plan to pursue this issue through audit resolution and consider this recommendation closed with the issuance of this report. Appendices Recommendations The OIG considers recommendations 1, 2, 3, and 5 significant, and therefore requires OIG concurrence before closure. Consequently, the OIG requests written confirmation when corrective actions are completed. These recommendations should not be closed in the Postal Service’s follow-up tracking system until the OIG provides written confirmation that the recommendations can be closed. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 15 Highlights Appendices Click on the appendix title to the right to navigate Appendices Recommendations Findings Table of Contents to the section content. Appendix A: Additional Information...........................................................17 Background ...........................................................................................17 Objective, Scope, and Methodology.......................................................17 Prior Audit Coverage..............................................................................19 Appendix B: Management’s Comments....................................................20 U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 16 Highlights Appendix A: Additional Information Background A mail cover is an investigative tool used to make a non-consensual record of data appearing on the outside of any mailpiece. The purpose of the mail cover is to: ■■ Protect national security Table of Contents ■■ Locate a fugitive ■■ Obtain evidence of a crime ■■ Assist in identifying property, proceeds, or assets forfeitable under criminal law ■■ Detect violation of a Postal Service statute All mail cover requests must comply with policies and procedures specified in Title 39, Code of Federal Regulations, Section 233.3, and ISM Section 6-6. The CPI or designee approves mail cover requests, basing their decision on reasonable grounds. Postal inspectors must provide reasonable grounds for a mail cover by using clear, specific, and supportable statements. Findings The Postal Inspection Service’s CISC is responsible for ensuring mail cover requests contain the required elements before approval. Figure 4 provides the number of denied mail covers for FYs 2010 through 2014. CISC makes every attempt to work with the requestors to ensure all requirements are met to approve the mail cover request. However, mail cover requests are generally denied due to a lack of sufficient information to justify approval. Appendices Recommendations Figure 4. Postal Inspection Service Denied Mail Covers FY 2010 Through 2014 FY 2010 FY 2011 FY 2012 FY 2013 FY 2014 Total Total Postal Inspector Denied Mail Covers 44 40 14 28 75 201 Total External Law Enforcement Agency Denied Mail Covers 16 13 7 10 94 140 Source: ISIIS. Objective, Scope, and Methodology This is a follow-up to a prior OIG report, Postal Inspection Service Mail Covers Program (Report Number HR-AR-14-001, dated May 28, 2014), which reviewed mail cover requests from external law enforcement agencies. The objective of the current audit was to assess controls over the management of Postal Inspection Service mail covers. Specifically, we assessed how the Postal Inspection Service handled mail cover requests from postal inspectors and the status of prior audit recommendations. We also assessed the impact of publicly reporting mail cover statistics. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 17 Highlights To accomplish our objective we: ■■ Reviewed applicable policies and procedures related to the mail covers program. ■■ Interviewed Postal Service and Postal Inspection Service officials responsible for managing and conducting mail covers to gain an understanding of their roles and responsibilities. Table of Contents ■■ Reviewed a judgmental sample of 120 mail cover files for FY 2012 through FY 2014. ■■ Reviewed eight national security and 32 additional mail covers for FY 2015. ■■ Observed three active interdictions conducted at three Postal Service facilities. ■■ Reviewed a statistical sample of 75 of 120 files identified in our prior audit to determine whether CISC has since obtained the missing accountable documents from post offices and external law enforcement agencies. ■■ Judgmentally selected and conducted unannounced observations at nine facilities from three districts in the Great Lakes, Pacific, and Northeast areas of operation because they had the lowest compliance rate for returning PS Forms 2009 to the CISC. Findings ■■ Reviewed 11 mail covers that were compromised during FY 2012 through FY 2015. ■■ Assessed internal controls and identified control weaknesses in the mail cover process. ■■ Reviewed training records to determine if responsible Postal Service personnel received sufficient training to perform their roles and responsibilities. Appendices Recommendations ■■ Validated the implementation of corrective actions taken to address prior audit findings and recommendations. ■■ Assessed the impact of publishing mail cover statistics by reviewing government information disclosure policy guidance, consulting with legal experts, and interviewing law enforcement agency officials. We conducted our audit from November 2014 through September 2015, in accordance with generally accepted government auditing standards and included such tests of internal controls as we considered necessary under the circumstances. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We discussed our observations and conclusions with management on August 4, 2015, and included their comments where appropriate. We assessed the reliability of mail cover records by reviewing existing information about the data and the system that produced them and interviewed agency officials knowledgeable about the data. Although we identified some errors and irregularities in the mail cover application, we concluded that the data were sufficiently reliable for the purposes of this review. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 18 Highlights Prior Audit Coverage Table of Contents The OIG issued Postal Inspection Service Mail Covers Program (Report Number HR-AR-14-001, dated May 28, 2014), which found that responsible personnel did not always handle and process mail cover requests timely or return documents relating to the covers to the program files as required. Of the 196 external mail cover requests we reviewed, 21 percent were approved without written authorization and 13 percent were not adequately justified or did not have reasonable grounds transcribed accurately. Also, 15 percent of postal inspectors who conducted national security-related mail covers did not have the required nondisclosure form on file. Appendices Recommendations Findings In addition, the Postal Inspection Service provided evidence of only one periodic review of the mail covers program conducted over the past 3 fiscal years and did not have procedures in place to ensure performance of annual reviews, as required. Finally, the mail cover computer application did not always provide accurate and reliable information because system controls did not ensure completeness, accuracy, and consistency of data. Management agreed with the findings and recommendations. U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 19 Highlights Appendices Recommendations Findings Table of Contents Appendix B: Management’s Comments U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 20 Highlights Table of Contents Findings Recommendations Appendices U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 21 Highlights Table of Contents Findings Recommendations Appendices U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 22 Highlights Table of Contents Findings Appendices Recommendations Contact us via our Hotline and FOIA forms, follow us on social networks, or call our Hotline at 1-888-877-7644 to report fraud, waste or abuse. Stay informed. 1735 North Lynn Street Arlington, VA 22209-2020 (703) 248-2100 U.S. Postal Inspection Service Mail Covers Program — Phase II Report Number HR-AR-15-007 Print 23