Future Proof – Protecting our digital future

Here are a whole host of questions we have received about managing social media information. We will continue to add to this list of FAQs as people ask us more interesting social media questions.

1. How do I determine what records from my organisation’s social media activities need to be retained?

2. My IT manager says social media applications are not official business systems and therefore we don’t need to keep records of corporate social media activities. What should I say to her?

3. Do I really have to make official records to document what my organisation is doing on Facebook? If so, how do I do it?

4. Can I keep social media records in the business system that generates them?

5. Do I need to know the time and date that I broadcast a particular social media message and know when someone receives it?

6. With my social media records, do I need to keep them in their original format and make sure they look just like they did in their original social media environment?

7. Is Facebook a government business system? My IT section says that it is not.
 

1.How do I determine what records from my organisation’s social media activities need to be retained?

If your organisation is:

• pushing business information through social media channels
• receiving business-related communications through social media
• building an official business presence in any social media system

then it has legal (including under the State Records Act) and business requirements to be able to account for the business it is transacting via social media.

Organisations use social media in a variety of different ways and for various different types of business operations. What information needs to be captured and maintained will depend on the business processes or operations being carried out via the social media application.

As social media is a relatively new and a rapidly evolving technology, there are no defined, best practice ways for making and keeping social media records. You will need to choose strategies that best meet your business needs and technological environment, based on a full assessment of potential business risks and information requirements.

2. My IT manager says social media applications are not official business systems and therefore we don’t need to keep records of corporate social media activities. What should I say to her?

Your IT manager may be focussed on the blurry line between some of the more informal communications on your social media channels and the more substantial business that may be occurring there.

This however should not distract from the fact that organisational decisions and programs may be being publicly questioned on your social media accounts, that your organisation may be publicly promoting its programs and operations on social media and that you may be using social media for other legitimate business purposes, such as public consultation on policy or regulatory proposals.

If you are using social media for business purposes then the information being made available or the information received via social media is official government business information and you do need to assess whether you need a social media recordkeeping strategy.

A social media recordkeeping strategy will enable you to:

• account for your business operations that are moving to social media environments
• assist clients who choose to engage with the organisation through social media
• ensure that the business intelligence generated in social media is fed back into business operations and is maintained and accessible for business purposes for as long as it is required
• determine what business records in your social media channels need to be exported out of their native environment and into corporate recordkeeping or business systems
• evaluate, monitor, improve and assess your social media strategies and the business processes you are moving to social environments.

The very public nature of social media-based operations brings with it a public expectation of openness and accountability. If government is engaging in social spaces, people expect that fit and proper processes will apply to the social media communications as much as they apply to traditional, more formal communications. Good recordkeeping of your social media operations is a key way to meet this expectation.

3. Do I really have to make official records to document what my organisation is doing on Facebook? If so, how do I do it?

The business conducted via social media is official government business. Your organisation does need to know the advice, decisions and commitments that are being made via social media and making official records is the way to do this.

That said, all business is not created equal and there is no over-arching requirement to keep absolutely all records of business in your organisation. You should make and keep records based on an assessment of your business needs and risks. Decisions about whether to make and keep records should be based on questions like:

Will I need this information:

• for reporting?
• as the basis for subsequent actions?
• to incorporate user-generated content into business products or processes?
• for responding to future enquiries?
• to feed business intelligence back into the organisation?
• for legal requirements?
• for ongoing client management?
• for planning?
• to monitor or improve business process?
• to measure the impact of your social media strategies?

You also don’t have to necessarily officially capture all comments, posts, updates etc. You can choose to capture only the content that has ongoing business requirements or relevance.

When making these decisions about what records to officially capture, you also need to bear in mind that social media systems are generally third party owned and located in the cloud. There are no guarantees that social media systems will keep your information or make it accessible for any significant periods of time. Therefore if there are business needs to keep records of your social media operations, you do need to proactively plan for the export of relevant information out of your social media system.

Ways you can make records of your Facebook activity include:

• regularly export your Facebook generated Activity Log from the Facebook administrators page – this will provide a copy of all posts, comments etc on your Facebook page
• using a third party service such as Social Safe to regularly export a version of your Facebook content
• if only a small proportion of your Facebook content needs to be officially captured, using RSS feeds of updated content, screenshots, reporting or other mechanisms to capture this content.

See also Strategies for managing social media information: How do I capture social media records

4. Can I keep social media records in the business system that generates them?

Our unofficial surveys across government show that organisations are using lots of different systems to drive their social media operations. Some are using channels such as Twitter and Facebook directly, while others have off-the-shelf or purpose-built business systems that are used to generate content and then automatically broadcast this through various social media channels.

Irrespective of what system you use, can you keep your social media records in this system?

As we say all the time, recordkeeping is a risk-based decision. You will need to consider your own specific business context, business risks and information needs but, in general, our standard advice would be:

For third-party, cloud-based systems like Twitter, Facebook, You Tube, LinkedIn etc:

• low risk business operations, low value business information – you can leave this information in your social media system and rely on the system to provide ongoing access for the short period of time that you may need business access to this information
• higher risk business operations, higher value business information including decisions, advice, public input, feedback etc that are required for ongoing business operations – export this information out of the social media system because there are no guarantees that the system will provide ongoing information support or accessibility.

For business systems that have the capacity to broadcast through multiple channels:

• information will generally be secure in these systems for the length of the system lifespan, but if the system is upgraded, replaced or decommissioned, you will need to determine if any information in the system needs to be kept for ongoing business or legal purposes.
• it may be easier to regularly export high value information out the system throughout its active life and store this in a central records system, rather than determine at system decommission what information requires export for ongoing support and management.

It is important to note that some social media communications, like emergency broadcasts, can have very long legal retention periods, up to 25 years in some cases. An important part of social media recordkeeping strategies therefore is, when business moves to social media platforms, to determine what you need to do in order to keep the records generated in your social media systems for your required retention periods.

5. Do I need to know the time and date that I broadcast a particular social media message and know when someone received it?

Yes, irrespective of how you decide to keep your key social media communications, a core piece of information you will need to have in any system or environment you use is a fixed record of the date and time that your social media communication was issued.

You do not need to capture information about when someone receives your communication as often this is not possible to do. Geographical coverage issues, volume capacities, specific device issues and device availability can all affect transmission time and potential. You cannot know or mitigate these issues but you can keep a record of when your advice was officially broadcast. Therefore any recordkeeping strategy must ensure that the date and time of your transmission is able to be captured and kept.

If you are using a business system to generate and broadcast social media communications across a variety of channels, for certain high risk transactions you may also want to ensure that your system can generate an exception report, to ensure you are informed if some posts are not successful.

6. With my social media records, do I need to keep them in their original format and make sure they look just like they did in their original social media environment?

With your recordkeeping, what you ultimately want is business information that is accountable, accessible and useable. Capturing records so that they look exactly as they did in the original social media environment may be desirable, but ultimately it is not as important as information accountability, useability and accessibility and process achievability and sustainability.

A number of social media formats are actually very complex, like Facebook’s AJAX format. These formats are great for immediate, dynamic, complex visual presentations of diverse forms of data, but in the long term you don’t want to capture records in this format and create complex, long term, legacy format management problems in your organisation.

For Facebook, rather than exporting records in AJAX, you could capture your original content, be it a post or video or image in its original format, or capture the information via RSS feed, screenshot or export using a third party service such as Social Safe etc. You can also capture user feedback in the same way. These can be captured as official records in your records system.

If you feel that capturing a visual representation of how your social media sites looked at a particular point in time, or how particular posts, images and videos looked together on a site is important, you can take a screenshot of the site and capture this too as part of your official records.

With digital business information, when it gets down to it, what matters isn’t the format, it’s the information contained in the format. So if original format preservation isn’t appropriate or cost effective or sustainable, it is legitimate to look at other options that are appropriate, cost effective and sustainable, and that provide you with the evidence and information you require.

7. Is Facebook a government business system? My IT section says that it is not.

Yes! If you are using it for government business purposes, then it is a government business system and you need to make arrangements to manage the information you are producing and receiving.

Facebook however is not a recordkeeping system – it is owned by an external third party and it is located in the cloud. If you need the business information in Facebook to account for your actions, to incorporate in business processes, to track decisions you have made, to provide input into policy development etc etc, then you need to actively export this information out of Facebook because there are no guarantees that it is going to stay accessible in your Facebook account for as long as you are going to need it.

This however does need to be a risk-based decision. For example, if a Facebook account is just used by a library to promote new acquisitions and (for example) library promotional material only needs to be kept for business and legal purposes for 2 years, then you may decide that leaving it on Facebook is an OK recordkeeping strategy. If however officers are providing development advice on Facebook or answering questions about high level business plans, then this is more contentious and trusting Facebook to keep this information for the much longer retention periods that apply to this type of information is not appropriate.

The standard process at this stage for recordkeeping in Facebook and other social media environments is to do a regular export of your data from these systems.

IT staff do need to understand that Facebook is a business system and that genuine and risky government business is already taking place here. So the export you do and the information you need to capture from Facebook needs to be an accurate representation of the business that is being performed. You need date and time representation of transactions, of comments, of posts, possibly of likes. It is important to sit down with business and determine exactly what they are going to need to account for the actions and transactions that are starting to take place in Facebook. And the business moving to social media and mobile environments is only going to increase, and so it’s important to put in place strategies now that are going to enable you to have good and meaningful information both now and in the future.