0693-0043 NIST ITL Youth Password Survey Supporting Statement

OMB CONTROL NUMBER 0693-0043

NIST GENERIC CLEARANCE FOR USABILITY DATA COLLECTIONS

NIST, Information Technology Laboratory (ITL)

Youth Password Survey

Survey Questionnaires for: Questions to understand youth password behaviors and practices

1. Explain who will be surveyed and why the group is appropriate to survey.

As part of the usable security password research, the Visualization and Usability Group (VUG), of the Information Technology Laboratory (ITL), of the National Institute of Standards and Technology (NIST) intends to recruit up to 1800 students. Participants/students will be youth between 3^rd and 12^th grades. Participants will be recruited from a minimum of three (up to nine) different school districts: at least one from mid-west and one from DC/MD/VA area.

The purpose of this study is to examine youth password practices. The research goal is to understand youth practices, perceptions, and knowledge regarding passwords. The ultimate goal is the development of useful guidance to help youth understand best practices for passwords.

2. Explain how the survey was developed including consultation with interested

parties, pretesting, and responses to suggestions for improvement.

The survey questions were developed and refined based on previous password research within NIST, and discussions with teachers, the National Initiative of Cybersecurity Education (NICE), the Department of Education, content experts, and survey experts.

Since the survey participants span from 3^rd grade to 12^th grades, the survey was designed with age-appropriate language accommodating student reading levels. While survey question contents will remain constant, flexibility on exact wording is required to adapt to grade specific reading levels.

3. Explain how the survey will be conducted, how customers will be sampled if

fewer than all customers will be surveyed, expected response rate, and actions

your agency plans to take to improve the response rate.

Each of the school districts will identify three schools (one for 3^rd to 5^th graders, one for 6^th to 8^th graders, and one for 9^th to 12^th graders). The schools will assist in recruiting between 100 and 200 students per school. There will be total of 300-600 students sampled per school district for a maximum of 1800 students for the study.

For the 3^rd to 5^th graders, once a student receives parental consent to participate, he/she will receive a survey with 15 questions, followed by 5 demographic questions. A teacher will read each question to the students for them to answer. This process will take at most 30 minutes.

For the 6^th to 12^th graders, once a student receives parental consent to participate, he/she will receive a survey with 16 questions, followed by 5 demographic questions. This process will take at most 15 minutes.

4. Describe how the results of the survey will be analyzed and used to generalize

the results to the entire customer population.

NIST researchers will perform data analysis. Descriptive statistics will be run on demographic questions. Descriptive and inferential statistics will be run on the survey questions. The analysis will explore the ways in which the data fit with or contradict current research on password practices and behaviors. We intend to publish the results from this study in a research journal article. No generalization will be made beyond the study participants and their demographics.

There will be no collection, storage, access, use, or dissemination of personally identifiable information from the survey. As stated in the provided consent form, participants will be assigned a participant reference code that will be associated with their responses.  Data will not be linked back to a respondent.  NIST will not create or keep a list that links the participant reference code to a participant.