Informed Consent

ATTACHMENT 8

INFORMED CONSENT FORM

Project Title: “Password Generation Study”

Co-Principal Investigator: Mary Theofanos

Co-Principal Investigator: Yee-Yin Choong

Co-Principal Investigator: Kristen Greene

RESEARCH DESCRIPTION

This study is being performed to determine how to improve password policies. The research is funded and conducted by the National Institute of Standards and Technology (NIST). You will be given a set of password requirements and asked to generate as many passwords as possible within a time limit. You will then be given a different set of password requirements and asked to generate as many passwords as possible within a time limit. After the password generation tasks, you will be asked to select a password for different types of hypothetical accounts. As a break after these tasks, you will be asked to play five simple computer games. Next, you will be asked to log into those hypothetical accounts. Your hands will be video recorded during the study. Your face will not be recorded on video. Following the tasks, you will be asked to complete a questionnaire about your test experience. All of the data will be recorded without any identifiers. This process should take you no more than 90 minutes.

Confidentiality: Your identity will be protected to the extent permitted by law, including the Freedom of Information Act. Members of the NIST IRB, appropriate NIST researchers, and other appropriate Federal employees may review the records of this study. The data will be used by NIST researchers to provide guidance on computer security password policies. All of the data, including the video recordings and questionnaire data, will be recorded without identifiers. All of the data will only be recorded by a number, and will not be linked back to an individual in any way.

You are free to withdraw from the study, without penalty, at any time during the experiment. In total, we expect to have approximately 200 subjects complete the experiment. You will be paid $75 in cash for your participation in this study before you leave.

There are no risks involved in participating in this study, nor are there any immediate benefits. The long-term benefits of this study to society should be improved computer security password policies.

Contact Information:

For questions regarding this study, please contact Yee-Yin Choong at 301-975-3248, yee-yin.choong@nist.gov, Kristen Greene at 301-975-8119, kristen.greene@nist.gov, or Mary Theofanos at 301-975-5889, mary.theofanos@nist.gov. For questions regarding your rights as a human subject, please contact Richard R. Cavanagh, NIST IRB Chair, at (301) 975-4447 or richard.cavanagh@nist.gov. Any research-related injury during the study should be reported to Yee-Yin Choong at 301-975-3248, yee-yin.choong@nist.gov, Kristen Greene at 301-975-8119, kristen.greene@nist.gov, or Mary Theofanos at 301-975-5889, mary.theofanos@nist.gov.

"I have read the above description of this research project. I have also spoken to the NIST researcher, Yee-Yin Choong, Kristen Greene, or Mary Theofanos, who answered any questions I had about this project. I acknowledge that I have received a personal copy of this form. I agree to participate in this research and I understand that I may withdraw, without penalty, at any time.”

Participant Signature: _____________________________________ Date: _____________________________________

NIST Researcher (Print Name) ______________________________

NIST Researcher (Signature) ________________________________ Date: _____________________________________

Witness (Print Name): ____________________________________

Witness (Signature): ______________________________________ Date: _____________________________________

NIST Approval _____________ 1