Q&A: Tim Creagan on the 508 refresh and agency compliance (Part 2)

(Continued from Q&A: Tim Creagan on the 508 refresh and agency compliance)

FGIT: You mentioned enforceability. At the hearing, a few people mentioned that some agencies think that they're in compliance--and maybe they're just misunderstanding the regulations--but they're actually not as accessible as they should be. The example was that feature-by-feature something could be accessible to someone with an auditory disability or a visual impairment, but it's not accessible for both across the board. Are those statements correct?

Creagan: What you're mentioning really is the continuous, unchanging distinction between accessibility and accommodation. In some senses, you could say that accessibility is a legal construct in that, for a procuring official, they can specify the features in a product. And they can specify the functional performance criteria up to a point. And they can procure a product. And there may be an individual with a disability that goes to use that fully-conformant product and they can't use it. And that person is going to need an accommodation. They're going to need a solution just for them.

So, it's a real push/pull, because obviously, the point is why make products and go through all this trouble of evaluating them for features and buy them, if your users can't use them? The point is, accessibility is only giving you so much. For users who need more than that, they're going to have to have accommodations.

So, 508 is never going to get rid of 504. That's just reality.

FGIT: And 504 is...

Creagan: Sure, Section 504 of the Rehabilitation Act, and that says agencies receiving federal funds are required to provide reasonable accommodations.

FGIT: During the hearing Michael Paciello, of the Paciello Group, encouraged agencies to ramp up tools, training and quality assurance reports. Any recommendations around that as to what agencies should be doing to make sure that they're fulfilling their requirements around these rules?

Creagan: Certainly, in the draft, as I mentioned before, there's a lot of reference to tools and training that are available in the advisory. You know, there's references to those websites, there's references to various standards, again, the harmonization with WCAG--WCAG has suggested ways of doing things.

One of the things that we constantly do, is we encourage people to ask questions and the agencies themselves, under the law, not the regulations themselves that we're talking about, but the original law, agencies are responsible for enforcing 508 against themselves, in their own environment. So part of that presupposes that they're going to have policies and procedures in place. Not only for enforcement but also for determination: How does an agency make a determination that they are conformant with 508? And that agency should have a policy in place that explains how they address this.

As a practical matter, we hear from agencies all the time, saying that isn't something that they've explicitly developed, or something that's more of an ad hoc thing or situational. So what we do is we point to some agencies that have spent a lot of time and money developing procedure and policies, such as the U.S. Postal Service, such as the Internal Revenue Service, the Social Security Administration, as examples that they can look to and perhaps incorporate some of those procedures in their own activities.

And to be fair, those three agencies I mentioned are huge, they have large IT budgets and they have a very, very large user-interface population. People go to their websites all the time. So this is an issue they've been dealing with for years, where if you're a smaller agency you really don't have as much public interaction, this may not have been as much of a priority for you. But hopefully by now I hope we're getting the word out and people know what they should be focusing on.

FGIT: Regarding the self enforcement by agencies, that they have a policy in place for monitoring this, are there any that are doing more formal auditing? Is there ever an instance where GAO or any agency would come through and audit around these regulations?

Creagan: That's a good question. I don't believe so. The way the 508 law is written I do not believe that there are any explicit requirements anywhere that someone could come in and ask, "Where's your 508 policy?" I think that under the FAR, (Federal Acquisition Regulation) the FAR has language that says, the agencies are supposed to be conformant with the provisions of 508. And what they talk about is the provision in section 36 CFR Part 1194.

So, the FAR procurements are supposed to be done according to those standards. What it comes down to is, if it's in a procurement situation, the enforcement could be from unsuccessful bidders. They could say, "Hey, my product was much more conformant than the product that got the award. I'm going to file a bid protest." So, that's one method of enforcement.

Users, people with disabilities, members of the public who interact with an agency can say, "Hey, I did not get the benefit of the most conformant product here." And they can file complaints. Typically, the agency complaints may be handled at the administrative level first, but again that's a procedure that the agencies are supposed to set. The statute says that if the agencies don't have a policy, one policy they can look at is the 504 enforcement policies which are the ones they would use for handling complaints under reasonable accommodation.

No, the Government Accountability Office is not going to go through and check them. Now, having said that, there may be--and I'm not the right person the answer this question, the right person to answer this question is probably Terry Weaver at GSA, because she's in policy protection there--there may be IT policies which require agencies to have policies and procedures in place and reporting requirements and stuff like that. And it may be that the affect of one of those policies is that agencies have to demonstrate conformance with "whatever." And that "whatever" may include conformance with 508. I don't know, I can't cite you to a specific policy.

For instance, there's been a number of security policies put in place in recent years, and security can affect 508 because it may be that an IT shop at an agency has to comply with a security policy and because of that, they're now going to limit the functionality of some of their IT out there, for security reasons. So that would be an affect on 508, but that is permissible under the law because the agency has to do what best meets their business needs. So if their business needs this particular policy and it is a priority, then you have to have accessibility in context with that and if the context says you have to shut down, I don't know, the user's ability select font sizes, unless the IT department approves it, then that's what will happen. So, 508 isn't absolute. It doesn't trump everything else.

FGIT: Thanks for clarifying how enforcement works...

Creagan: One thing I would encourage your readers to be aware of is that in this day and age, IT is really everybody's job. Where as in the past people may have thought, "Well, I create content for the agency's outreach, and how that content gets used, tweaked or made accessible, that's not really my problem. I don't deal with that. I ship that off to the IT geeks." Well that may have been true in the past, but it's less and less true now. Because what you find more and more is that agencies are saying, "Okay, you folks that are generating content, you have to generate it in an accessible way." And the response will be, "What!? I don't know what that means."

All you agencies that are pushing out Twitter or any of this new media stuff--Twitter, Facebook, YouTube broadcasts, social webpages--there are a bunch of issues associated around that. Some of the issues are the user agreements, for instance. Agencies can't enter into user agreements as they're currently written because they're intended for the general public, when the general public goes to use one of those services. Because agreements with social media companies basically say: You, the user, agree to be bound by the laws of California or whatever jurisdiction it is, you agree to arbitration, you agree to all this stuff--which federal agencies can't do. So the user agreement is something that has to be developed and negotiated between the agency and whoever it is before any of that content should be up and running.

Sometimes that didn't always happen. And people were in such a rush to get things out they weren't really thinking, "Oh, we need to have a policy in place for this." That's an issue. The question of how the content will be accessible, that's an issue. Who's going to vet this stuff, how often are you going to change it? All of those are operational questions. And those are some of the things we were getting at with ANPRM.

What do you do if your agency has a much wider array of "official agency communications?" You put it out on Twitter and you have an RSS feed, and TV ads, and YouTube--all of that has to be made accessible. So how is that going to affect your operations? What are the benefits and burdens of doing it that way?

Related Articles:
Agencies struggle with 508 compliance, procurement
Prepare now for 508 web-compliance changes
Social media panel: Feds shouldn't fear failure
Are government websites fully accessible to the disabled?
It's a challenge to make Gov 2.0 accessible to disabled