Comprehensive Testing Plan: Lawful Access Data Collection

Request for Approval under the “Generic Clearance for the Collection of Routine Customer Feedback” (OMB Control Number: 1110-0057)

TITLE OF INFORMATION COLLECTION:

The FBI UCR Program’s Lawful Access Data Collection

PURPOSE:

The purpose of the Lawful Access Data Collection is to gather data on the number of instances where device or software encryption negatively impacts a law enforcement investigation. The collection will gather a number of basic details about the encryption, device/software, and investigation in order to provide details about instances of lawful access denial.

The purpose of this testing plan is to conduct cognitive interviews and basic usability testing with a volunteer group of qualified agencies to assess the preliminary collection instrument and the upcoming online submission site. These testing procedures will provide valuable feedback to the FBI UCR Program as it further refines and improves the Lawful Access Data collection.

DESCRIPTION OF RESPONDENTS:

The respondent sample is made up of voluntary agencies and representatives who, as part of their regular job duties, handles encrypted devices and software in relation to investigative cases. Many of the participants were recommended by members of the Lawful Access Task Force, a group made up of Federal, State, and Local organizations with expertise in lawful access issues. The Respondent group will participate in cognitive interviews as well as virtual usability testing, where applicable. If external access to usability is not achievable, the FBI will gather a group of on-site personal with experience with data encryption to perform usability testing of the submission platform.

TYPE OF COLLECTION: (Check one)

[ ] Customer Comment Card/Complaint Form [ ] Customer Satisfaction Survey

[ ] Usability Testing (e.g., Website or Software [ ] Small Discussion Group

[ ] Focus Group [X] Other: Usability Testing & Cognitive Interviews

CERTIFICATION:

I certify the following to be true:

1. The collection is voluntary.

2. The collection is low-burden for respondents and low-cost for the Federal Government.

3. The collection is non-controversial and does not raise issues of concern to other federal agencies.

4. The results are not intended to be disseminated to the public.

5. Information gathered will not be used for the purpose of substantially informing influential policy decisions.

6. The collection is targeted to the solicitation of opinions from respondents who have experience with the program or may have experience with the program in the future.

Name: Bryan A. Sell – Survey Statistician, FBI UCR Program

To assist review, please provide answers to the following question:

Personally Identifiable Information:

1. Is personally identifiable information (PII) collected? [ ] Yes [X ] No

2. If Yes, will any information that is collected be included in records that are subject to the Privacy Act of 1974? [ ] Yes [ ] No

3. If Yes, has an up-to-date System of Records Notice (SORN) been published? [ ] Yes [ ] No

Gifts or Payments:

Is an incentive (e.g., money or reimbursement of expenses, token of appreciation) provided to participants? [ ] Yes [X] No

BURDEN HOURS

Category of Respondent	No. of Respondents	Participation Time	Burden
Cognitive Interview Process	20	45 minutes	15 hours
Usability Testing	20	30 minutes	10 hours
Totals	20 (Combined Test Group)	75 minutes	25 hours

FEDERAL COST: The estimated annual cost to the Federal government is $37,018

If you are conducting a focus group, survey, or plan to employ statistical methods, please provide answers to the following questions:

The selection of your targeted respondents

1. Do you have a customer list or something similar that defines the universe of potential respondents and do you have a sampling plan for selecting from this universe? [X] Yes [] No

If the answer is yes, please provide a description of both below (or attach the sampling plan)? If the answer is no, please provide a description of how you plan to identify your potential group of respondents and how you will select them?

The FBI UCR Program has identified two primary access points for Lawful Access information:

• Criminal Forensic Science Laboratories – Facilities that primarily focus on encrypted devices and data at rest.

• Digital Surveillance Teams – Teams that observe instance of data in motion and encrypted software data.

Agencies who either contain these access points or who utilize these access points from their-party organizations for their investitive needs make up the universe for the Lawful Access Data Collection. As the FBI UCR Program is looking to maximize participation from all potential respondents identified as part of the universe, no sampling methods will be developed for this collection.

For the testing procedures identified in this generic clearance request, The participant group is entirely voluntary and is made up of a group of agencies and representatives belonging to the identified universe. Again, no sampling methods were uses due to the voluntary nature of the testing procedures.

Administration of the Instrument

1. How will you collect the information? (Check all that apply)

[X] Web-based or other forms of Social Media

[ ] Telephone

[X] In-person

[ ] Mail

[ ] Other, Explain

2. Will interviewers or facilitators be used? [X] Yes [ ] No

Please make sure that all instruments, instructions, and scripts are submitted with the request.

Definitions

Originating Agency Identifier (ORI)–A unique identifying code assigned by the UCR Program to each participating agency for the purpose of access and tracking the submission of data.

NIBRS Incident Number–A unique identifying number generated by the UCR System for each incident submitted to the NIBRS.

Encryption–The process of encoding messages or information in such a manner that only people with the knowledge or means to decrypt the message can do so.

Data-in-Motion–Data that is in transit between the source and the destination. Examples of data in motion are emails, text messages, audio messages, etc.

Data-at-Rest–Data stored on the memory systems of digital devices, hard drives, removable memory, etc.

Criminal Forensic Crime Laboratories–Facilities dedicated to the access, decryption, and analysis of digital data.

Digital Surveillance Teams–Specialized teams of experts designed to intercept digital communications in transit from source to destination.

Encrypted Device(s)/Media–Any mobile or nonmobile device or media that can store, transmit, or display encrypted information.

Application/Software Encryption–Any software application or program that utilizes encryption code to encrypt, send, or display data.

Federal Bureau of Investigation Uniform Crime Reporting Program’s
Lawful Access Data Collection Instrument

Navigation Question:

Is your agency reporting encrypted device(s)/media or application/software encryption?

• Encrypted Device(s)/Media (navigate to Section 1)

• Application/Software Encryption (navigate to Section 2)
  

Section 1: Encrypted Device/Media

1. Originating Agency Identifier (ORI): ______________________

2. Date of Device(s) Seizure: ____________________

3. NIBRS Incident Number: ___________________

4. Agency Case Identification: ____________________

5. Please describe the encrypted device/media that negatively impacted the investigation?

• iPhone (include OS versions in conditional selection)

  • IOS 10 or older

  • IOS 11

  • IOS 12

  • IOS 13

  • IOS 14

  • IOS 15 or newer

• Android (include OS versions in conditional selection)

  • Android 7 or older

  • Android 8

  • Android 9

  • Android 10

  • Android 11

  • Android 12 or newer

• Hard Drive

• Removable Media

• Other: ____________

1. Is there an additional device/media to report?

• Yes (additional question 1.5)

• No (skip to question 1.7)

1. Was/Were the device(s)/media encountered associated with the victim or the offender? (select all that apply)

• Victim

• Offender

1. What is/are the criminal act/offense type(s) associated with the encrypted device(s)/media? (select all that apply)

• Murder and Violent Crimes

• Theft Offenses

• Cybercrime

• Drug/Narcotic Violations

• Sex Offenses of an Adult

• Sex Offenses of a Minor

• Child Sexual Abuse Material (CSAM)

• Acts Involving Deception or Corruption

• Other Offenses

1. What was/is the outcome of the case?

• Unknown

• Pending

• Penetration/Access/Decryption

• Partial Penetration/Access/Decryption

• Abandoned

Section 2: Application/Software Encryption

1. Originating Agency Identifier (ORI): ______________________

2. Date of Application(s)/Software Encryption Reporting: ____________________

3. NIBRS Incident Number: ___________________

4. Agency Case Identification: ____________________

5. Please identify the application/software that negatively impacted the investigation?

• WhatsApp

• Apple iMessage

• Apple Facetime

• Signal App

• Telegram App

• Snap Chat

• Other: _______________

1. Is there an additional application/software to report?

• Yes (additional question 2.5)

• No (skip to question 2.7)

1. Was/were the application(s)/software encountered associated with the victim or the offender? (select all that apply)

• Victim

• Offender

1. What is/are the criminal act/offense type(s) associated with the encrypted application(s)/software? (select all that apply):

• Murder and Violent Crimes

• Theft Offenses

• Cybercrime

• Drug/Narcotic Violations

• Sex Offenses of an Adult

• Sex Offenses of a Minor

• Child Sexual Abuse Material (CSAM)

• Acts Involving Deception or Corruption

• Other Offenses

1. What was/is the outcome of the case?

• Unknown

• Pending

• Penetration/Access/Decryption

• Abandoned

Privacy Act Statement

Authority: The collection of this information is authorized under United States Code (U.S.C) 28 U.S.C. § 534; 34 U.S.C. § 10211; 44 U.S.C. § 3101; and the general record keeping provision of the Administrative Procedures Act (5 U.S.C. § 301). The system will automatically collect certain contact information from you with your submission (e.g., telephone number and email address).

Principal Purpose: Collecting your contact information allows the FBI to contact you with any clarifying questions regarding your submission. This allows the FBI to verify submitted information and ensure the accuracy of the data.

Routine Uses: All contact information will be maintained in accordance with the Privacy Act of 1974. Your information may be disclosed with your consent, and may be disclosed without your consent as permitted by all applicable routine uses as published in the Federal Register (FR), including the routine uses for The FBI Central Records System (JUSTICE/FBI-002), published at 63 FR 8659, 671 (Feb. 20, 1998) and amended at 66 FR 8425 (Jan. 31, 2001), 66 FR 17200 (Mar. 29, 2001), and 82 FR 24147 (May 25, 2017), and the FBI Online Collaboration Systems (JUSTICE/FBI-004), published at 82 FR 57291 (Dec. 4, 2017). Routine uses may include sharing information with other federal, state, local, tribal, or territorial law enforcement agencies.

Lawful Access Data Collection

After-Action Survey

Law Enforcement Enterprise Portal (LEEP) Use

1. Think back to registering and obtaining access to LEEP.

   1. Was the process simple and easy to navigate?

   2. Did you feel the security measures in place to protect the information submitted to the collection are necessary?

   3. Did the security of LEEP help with any apprehension you may have had in submission of this data?

2. Was the collection easy to locate?

3. Was the form easy to complete?

4. Do you have any recommendation on improving the survey layout?

5. Did you contact anyone from the FBI’s UCR Program staff for assistance?

   1. If you contacted the UCR Program staff for assistance, please describe the interaction.

Survey Instrument

1. How much time did it take you to complete the survey instrument?

   1. 5–10 minutes

   2. 11–20 minutes

   3. 21–30 minutes

   4. More than 30 minutes

2. Did the survey instrument appropriately guide you to which questions to answer, based on your responses?
   
   
   

3. Did the questionnaire ask appropriate questions to assess the incident based on the criteria established within the collection to include:

   1. Basic agency and case information

   2. Type of device or software encountered

   3. Association of the victim or offender with the encrypted data

   4. Categories of criminal offenses associated with the reported case

   5. Current status of the reported case

4. Were the questions easily understood?
   
   
   

5. Did you use the tool tips during the session to further understand the question?

   1. If yes, did the tool tip thoroughly explain the intent and meaning of the question?
      
      
      

6. Were there any questions you did not understand which need further clarification or defined as a tooltip?

   1. If yes–please explain.
      
      
      

7. Do you feel additional questions are needed?

   1. If yes–please explain.
      
      
      

Additional Information

1. Are you comfortable with the collection as it has been established?

   1. If no–please explain.
      
      
      

2. Do you have concerns with contributing data to a collection such as this?

   1. If yes–please explain.
      
      
      

3. Additional thoughts/comments/concerns:

Instructions for Usability and Informed Consent

This research project seeks your response to several elements associated with the negative impacts to case investigations caused by device or data encryption. This survey should take less than 30 minutes to complete. While completing this survey will provide no direct benefit for you, it will provide data to be analyzed to support the ability to develop a greater understanding of the impact caused by lawful access denial and digital encryption.

Please complete the provided survey and return it to the researchers. Your participation in the survey is completely voluntary and constitutes no risk to you. If you change your mind during the survey and decide you do not wish to continue, you may stop at any time. Also, you are not required to answer any questions that you do not want to answer. Returning a survey indicates your consent to participate in this study.

For this study, please answer each question of the survey. Do not include any personally identifiable information for either yourself or any member of your department in the survey questionnaire. You may provide your own or department information in the submission process within the electronic application. Any information provided as part of this survey will only be viewed by members of the Lawful Access Development Team for the purposes of confirming participation.

The FBI’s UCR Program thanks you in advance for your help, time, and especially your insight in filling out this questionnaire. By completing responses to this survey, you are consenting for your participation. If you have any questions, or want information on research results, please feel free to contact the Crime and Law Enforcement Statistics Unit, FBI’s Uniform Crime Reporting Program, by telephone at 304-625-6634.

Consent Script for Cognitive Interviews

Thank you for participating in this cognitive interview.

Your feedback will help the FBI UCR Program refine the language and instructions for the new Uniform Crime Reporting Program’s Lawful Access Data Collection.

The purpose of this interview is to gain insight to your experiences answering the proposed collection questionnaire.

Your participation in this interview is voluntary and you may discontinue your participation at any time without penalty.

Your name will not be associated with any information you provide and will only be known to the individuals at the FBI working on the project.

This interview is a requirement of the project. If you choose not to complete the interview or voluntarily choose to discontinue the interview, you will no longer be responsible for further participation in the project.

There are no known risks associated with this interview.

The interview will take approximately 30-45 minutes.

The interview will not be recorded. Notes from your observations will be recorded by [insert name].

The information obtained through these interviews may be published in reports or presented at professional meetings, but your identity will be kept strictly confidential.

If you have any questions about your rights as a participant that I have not answered, you may contact the Crime and Law Enforcement Statistics Unit at 304-625-6634.

Do you have any questions regarding me, the project, or this interview before we begin?

15