The minutes of the March 19--20, 2013, Federal Open Market Committee (FOMC) meeting were scheduled to be released on April 10, 2013, at 2:00 p.m. Following standard practice, to prepare for this release the approved FOMC minutes were provided to a limited distribution of Board of Governors of the Federal Reserve System (Board) staff on April 9, 2013. A Board official in the Congressional Liaison Office (CLO), who obtained the FOMC minutes from a staff member included in the limited distribution, e-mailed the FOMC minutes to an e-mail distribution list (CLO contact list) shortly after 2:00 p.m. on April 9, 2013, one day earlier than the scheduled release date. The early release was detected by another Board official on the morning of April 10, 2013, which resulted in the official issuance of the FOMC minutes at 9:00 a.m. on April 10, 2013, rather than the scheduled 2:00 p.m. release time. Shortly before the minutes were publicly released, the Board's Chairman contacted the Office of Inspector General (OIG) to request our review of the early release. Accordingly, we determined that our audit objectives would be to evaluate the Board's processes for distributing the approved FOMC minutes to Board staff prior to their public release and the Board's management controls to prevent the early distribution of those minutes.
The FOMC consists of 12 members: the Board's 7 Governors; the President of the Federal Reserve Bank of New York; and 4 of the remaining 11 Reserve Bank Presidents, who serve one-year terms on the FOMC on a rotating basis. In addition to the FOMC members, the FOMC has its own officers that include individuals from the Board and the Reserve Banks.1 The FOMC is scheduled to meet eight times throughout the year, and at these meetings, the FOMC members review economic and financial conditions, determine the appropriate stance of U.S. monetary policy, and assess the risks to the FOMC's long-run goals of price stability and sustainable economic growth. In December 2004, the FOMC decided to release the minutes of FOMC meetings three weeks after each meeting.
After an FOMC meeting, the Board's Division of Monetary Affairs (Monetary Affairs) is responsible for drafting sections of the FOMC minutes that cover meeting participants' perspectives on current economic developments, the economic outlook, and the monetary policy decision made at the meeting.2 In addition, Monetary Affairs is the system owner of the publication system that is used to distribute the approved FOMC minutes, as well as other confidential FOMC information, to certain Board staff. Within Monetary Affairs, the FOMC Secretariat is responsible for communicating to the public the Federal Reserve's decisions related to monetary and financial policy.
The Federal Reserve System's Program for Security of FOMC Information requires that Board staff obtain prior authorization from the FOMC Chairman, or the FOMC Secretary on the Chairman's behalf, to access any confidential FOMC information, including the FOMC minutes.3 The authorization process begins with the staff member's section manager and line officer submitting a request for access to confidential FOMC information to the FOMC Secretariat. If the staff member meets the requirements for access to confidential FOMC information, the staff member is provided a link to the Program for Security of FOMC Information.4 After agreeing to abide by the Program for Security of FOMC Information,5 the staff member gains the ability to access confidential FOMC information; however, according to the Program for Security of FOMC Information, access to this information is granted on a "strict ‘need-to-know' basis." The Program for Security of FOMC Information states that any questions related to the classification, distribution, or handling of FOMC information should be directed to the FOMC Secretariat.
The FOMC Secretariat stores the approved FOMC minutes in the publication system so that designated Board staff can access them for preparation and release to the public. The Program for Security of FOMC Information requires that access to FOMC information, including the FOMC minutes, be limited to those with a strict need to know. As the publication system owner, the FOMC Secretariat maintains an access control list to limit access to information stored on the system and has the ability to further restrict access to specific documents, including the FOMC minutes, to a subset of users on the access control list.
When the FOMC minutes are accessed in the publication system, the system logs the date, time, and name of the Board staff member who downloaded the FOMC minutes and the location where the minutes were saved. The Division of Information Technology's guidelines for reviewing the publication system logs state that the publication system access logs are reviewed frequently throughout each week. If Division of Information Technology staff detect that an unauthorized individual has accessed the system, the FOMC Secretariat is notified. In addition, Board staff in the FOMC Secretariat stated that they review the publication system access logs after the approved FOMC minutes have been loaded into the system.
Once Board staff have retrieved the FOMC minutes from the publication system, the Program for Security of FOMC Information requires that FOMC information, including the minutes, be handled at least as securely as material classified by the Board as Restricted-Controlled FR. For Restricted-Controlled FR digital information, relevant provisions of the Board's Information Classification and Handling Standard 6 require that (1) access be limited to specific Federal Reserve staff who are authorized and have an official business purpose to access the information and (2) any e-mail transmissions that contain the information include indicators in the message body noting that either the message or the message and any attachments are Restricted-Controlled FR. Further, the Information Classification and Handling Standard states that providing Restricted-Controlled FR information to unauthorized individuals could result in the risk of serious monetary loss or a serious negative effect on the Board's ability to perform its mission.
During the three-week period following an FOMC meeting, the minutes are drafted, edited, and approved before being released to the public.7 During the first week, officers in Monetary Affairs and the FOMC Chairman review the draft of the minutes prepared by Board staff. During the second week, the minutes are circulated for comment among FOMC meeting participants. During the third week, the final version of the FOMC minutes is provided to the FOMC members for approval. After the minutes are approved, FOMC Secretariat staff prepare and load the minutes into the publication system.
After the FOMC minutes are loaded into the publication system, FOMC Secretariat staff send an e-mail notification, which includes a link to the minutes in the publication system, to certain staff in the Office of Board Members, which includes the Public Affairs Office8 (Public Affairs), the Public Information Outreach Program (PIO), and the Web Communications and Development section of Publishing and Communications Services (Web Communications). A Public Affairs assistant described to us the steps followed upon receipt of the e-mail:
When the PIO receives the e-mail notification from the FOMC Secretariat, an assigned editor in PIO uses the link in the e-mail to download the FOMC minutes from the publication system to a secure local drive. The editor prepares the minutes for publication and, at the direction of Public Affairs, enters the requested release date and time for the MAS and the Board's public website. The assigned editor submits changes to another PIO editor, who finalizes the publication. When the release of the FOMC minutes is accompanied by a Summary of Economic Projections, Web Communications ensures that the projections are compliant with section 508 of the Rehabilitation Act of 1973. These steps, including the four enumerated above, are typically accomplished approximately 24 hours before publication of the minutes to facilitate their timely publication. At the scheduled release time, customarily 1:00 p.m. for the MAS and 2:00 p.m. for the Board's public website, the FOMC minutes are posted.
After the FOMC minutes are publicly released, the Special Assistant to the Board in the CLO sends the minutes received from a Public Affairs assistant to the CLO contact list. The CLO contact list includes congressional staffers, trade association staffers, professional contacts at several financial services companies, contacts at other government agencies, and certain staff in the CLO.
On Tuesday, April 9, 2013, one day before the FOMC minutes from the meeting held on March 19-20, 2013, were scheduled for public release, a Public Affairs assistant received the e-mail notification from the FOMC Secretariat that the FOMC minutes were ready in the publication system. The Public Affairs assistant followed the four steps he described to us, including downloading the FOMC minutes and e-mailing a copy of the minutes as an attachment to the Special Assistant to the Board in the CLO. The Special Assistant to the Board drafted an e-mail to be sent to the CLO contact list with the FOMC minutes as an attachment. The Special Assistant to the Board in the CLO told the OIG that he was confused about the date, and at approximately 2:00 p.m. on April 9, 2013, one day earlier than the scheduled release, he sent the e-mail.
Early the next day, April 10, 2013, Board officials became aware that the minutes had been sent the prior afternoon and immediately notified the Board's Chairman. Subsequently, officials in the Federal Reserve System and other government agencies were notified of the early release, and the Board's Chairman and the General Counsel contacted the OIG. The Board's Chairman authorized the release of the FOMC minutes at 9:00 a.m. on April 10, 2013, before the U.S. financial markets opened and five hours earlier than the scheduled time. Public Affairs officials informed the Board's Governors and the FOMC participants of the early release of the FOMC minutes to the CLO contact list and the plan to release the FOMC minutes at 9:00 a.m. The FOMC minutes were released on the Board's public website at 9:00 a.m.
By April 12, 2013, Board officials from Public Affairs, the CLO, Monetary Affairs, the Legal Division, and the FOMC Secretariat had met to discuss immediate action that could be taken to improve the processes related to the FOMC minutes distribution. The Board officials informed the Board's Governors and the members of the FOMC that they were instituting the following changes:
While the initial description of these changes specified that only e-mail addresses ending in .gov would be included on the CLO contact list, we learned in a subsequent meeting with Board officials that the change to the CLO contact list was to limit the list to government recipients, which may include e-mail addresses that do not end in .gov.
To determine whether these changes were being followed, we reviewed the May 22, 2013, e-mail sent by the Special Assistant to the Board in the CLO to the CLO contact list regarding the April 30-May 1, 2013, FOMC meeting minutes. The e-mail included a link to the information on the Board's website, rather than the minutes as an attachment; it was sent after the minutes were released; and it was sent to government recipients only.
