Supporting Statement

SUPPORTING STATEMENT

U.S. Department of Commerce

Bureau of Industry and Security

Critical Technology Assessment: Encryption Products

OMB Control No. 0694-0119

This is a request to approve a new survey instrument under the existing generic collection authority.

A. Justification

1. Explain the circumstances that make the collection of information necessary.

The Bureau of Industry and Security (BIS), Office of Technology Evaluation (OTE), in coordination with the U.S. Department of Defense, National Security Agency (NSA) is conducting a critical technology assessment of the U.S. encryption industry. This project was initiated to assess the competitive position of the encryption industry and the effectiveness of dual-use export controls in ensuring a vibrant domestic base for these important products. NSA is participating in the effort to provide a national security mission perspective to the survey and subsequent analysis (see letter in ROCIS). Also participating in this assessment are industry representatives from the Alliance for Network Security as well as a number of individual encryption-related firms.

Encryption is a method of hiding or encoding data and information so that it can be sent securely to the intended party. Widely used in software and hardware products, encryption is necessary for the secure transmission of personal communication, financial information, medical records, defense needs and other applications. The proposed survey and assessment will assist in BIS and NSA analysts in better upstanding the competitive environment and future challenges facing the encryption sector. The public version of the report will also assist U.S. industry monitor trends, benchmark performance and raise awareness of potential diminishing domestic manufacturing capabilities in this sector.

OTE has authority under Section 705 of the Defense Production Act of 1950, as amended and Executive Order 12656, to conduct assessments and collect information from industry in support of the U.S. industrial base. These assessments are normally undertaken at the request of the Department of Defense, with one or more of the Armed Services participating. They usually focus on industrial, financial and economic issues affecting specific defense-related industries or critical technologies. The survey questionnaire, which covers the 2006-2009 period, is the primary source of information needed for an industrial base assessment of this type.

The information gained from the survey will be used to: 1- quantify and assess the state of the U.S. encryption sector and the competitive challenge from non-U.S. producers, 2- document the impact of dual-use export controls on U.S. firms and encryption exports, and 3- provide government and industry representatives with a comprehensive picture of this critical sector to benchmark future performance and capabilities.

OTE is the focal point for industrial base and critical technology analyses among civilian Federal agencies by virtue of the above mentioned statute and executive order, which includes mandatory data collection authority to carry out these responsibilities. OTE has conducted approximately 40 assessments of this nature in the past 20 years under various related defense industrial base programs. Assessments generally review in detail those industries experiencing employment, international competition, financial, production, investment and other difficulties in their ability to support defense and national security programs. The survey document is designed to collect information that facilitates this kind of in-depth analysis.

2. Explain how, by whom, how frequently, and for what purpose the information will be used. If the information collected will be disseminated to the public or used to support information that will be disseminated to the public, then explain how the collection complies with all applicable Information Quality Guidelines.

OTE intends to survey approximately 140 firms and distributors representing various segments of the U.S. Encryption Industry used in hardware and software products. The survey is a one-time only request. Quantitative data obtained from the survey will be compiled into an aggregate database for analysis and eventual publication. This data is needed to assess trends in production, sales and exports, market share, international competition, export controls and foreign dependencies. Qualitative questions are used in some cases to complement the statistical data. Using the aggregated survey data, the overall goal is to enable the private sector and government agencies to monitor trends, benchmark industry and government performance, and raise awareness of non-U.S. capabilities and dependencies.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological techniques or other forms of information technology.

To lessen the burden on respondents, OTE is encouraging the firms to provide electronic responses. Each respondent will receive a personalized letter which outlines the requirements of the study and the scope of information required. The letter will also contain directions to a secure website where the respondent can gain access to the Excel survey application. This approach was used successfully in a 2007 Defense Mission-Critical Microchip Industry, 2008 Counterfeit Electronics and 2008 5-Axis Machine Tool Surveys. All three surveys were reviewed and approved by OMB.

The statistical information requested in the survey tracks closely with categories and groups commonly used in the industry and verified by field-testing the OTE survey. Most firms and organizations will have the information computerized and will be able to retrieve it in the form requested on the survey. Other questions will require thought and perhaps discussion among several individuals for proper responses. These questions do not lend themselves to standardized computer automation. However, the questions only require brief responses in the text boxes provided.

Due to the high-tech nature of the encryption industry, we are expecting almost all firms and organizations to respond electronically.

4. Describe efforts to identify duplication.

The information sought in the survey is unique and not available from any other source, either public or private. Some of the basic corporate background data requested is submitted by firms in a statistical sample to the U.S. Census Bureau. However, the Census Bureau is precluded by law from releasing information on specific companies.

5. If the collection of information involves small businesses or other small entities, describe the methods used to minimize burden.

This survey will be distributed to a limited number of small businesses as the majority of encryption producers and distributors are medium and large size firms. The electronic survey instrument was designed to minimize the burden on all respondents. If for any reason the respondent cannot complete the survey in Excel, OTE will work with the respondent on an alternate form of submission. However, due to the high-tech nature of the encryption industry, we are expecting almost all firms and organizations to respond electronically.

6. Describe the consequences to the Federal program or policy activities if the collection is not conducted or is conducted less frequently.

In the case of this critical technology assessment of encryption products, a survey is the only method available to OTE to carry out its responsibilities under the Defense Production Act of 1950, as amended, and Executive Order 12656. Without the information gathered from the survey OTE could not: quantify and assess the health and competitiveness of encryption producers and distributors; document the impact of dual-use export controls on sales and exports; report on non-U.S. competition, foreign dependencies and future challenges, or benchmark industry and government performance.

7. Explain any special circumstances that require the collection to be conducted in a manner inconsistent with OMB guidelines.

There are no special circumstances that will result in the collection of information in a manner inconsistent with the guidelines of 5 CFR 1320.6.

8. Provide information of the PRA Federal Register notice that solicited public comments on the information collection prior to this submission. Summarize the public comments received in response to that notice and describe the actions taken by the agency in response to those comments.__Describe the efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported.

The Federal Register notice is not applicable to this collection because it falls within the scope of the BIS generic authority entitled, “National Security and Critical Technology Assessments of the U.S. Industrial Base,” approved under OMB Control No. 0694-0119. This authority is renewed every three years (last renewed in 2006) to support on-going BIS defense industrial base assessment needs.

OTE staff developed the survey in consultation with industry and government experts over a period of several months. The following is a list of those individuals who provided input and advice:

Government

Julie Kinloch, National Security Agency, 240-373-0207

Richard Bergamaschi, National Security Agency, 240-373-0207

Randy Pratt, BIS, National Security and Technology Transfer Controls, 202-482-5303

Companies

Roz Thompsen, Alliance for Network Security, 202-547-6661

Michael Angelo, NetlQ Corporation, 713-418-5396

Don Johnson, Institute for Defense Analysis, 703-330-5902

Charles Kolodgy, International Data Corporation, 508-935-4014

9. Explain any decisions to provide payments or gifts to respondents, other than remuneration of contractors or grantees.

This survey will not involve any payment or gifts to respondents; however, copies of the completed Encryption Products Critical Technology Assessment will be provided to the respondents upon request.

10. Describe any assurance of confidentiality provided to respondents and the basis for assurance in statute, regulation, or agency policy.

The survey and cover letter provide assurances to the respondents that the information collected through the survey will be deemed business confidential and will be treated in accordance with Section 705 of the Defense Production Act of 1950, as amended (50 U.S.C.A. app. Section 2061 et. seq.). This section prohibits the publication or disclosure of such information unless the President determines that its withholding is contrary to the national defense. The survey will be administered and the data collected via a secure internet server. Information submitted will not be shared with any non-government entity, other than in aggregate form, and the U.S. Department of Commerce will protect the confidentiality of such information pursuant to the appropriate exemptions from disclosure under the Freedom of Information Act (FOIA), should it be the subject of a FOIA request. OTE has a long and successful track record of protecting business confidential information collected under the above statute.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private.

This survey will not collect information that could be construed as being of a sensitive nature, such as information concerning sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered sensitive or private.

12. Provide an estimate in hours of the burden of the collection of information.

OTE estimates that the total burden placed on the respondents by this Cost Resolutions Solution survey effort will be approximately 1,680 hours. This is based on distributing surveys to 140 respondents with an average time of 12 hours needed to complete the survey.

This burden estimate is subject to variations among individual respondents because of differences in record keeping, organization size, and other variables. The estimate is based on the past experience of OTE, as well as feedback from companies and organizations that have completed our surveys. OTE has conducted surveys of various industries, including imaging and sensors, biotechnology, cartridge and propellant actuated devices, counterfeit electronics, 5-axis machine tools, microelectronics and others.

The estimated total cost to respondents of this information collection is $58,800. This estimate was calculated by assuming a respondents' average work rate of $35 per hour multiplied by the total burden hours of 1,680.

13. Provide an estimate of the total annual cost burden to the respondents or record-keepers resulting from the collection (excluding the value of the burden hours in #12 above).

This item is not applicable because the survey questionnaire will not impose any annual costs on respondents involving capital and start-up costs or affect the costs of operation, maintenance, or purchased services.

14. Provide estimates of annualized cost to the Federal government.

The estimated cost to the Federal government for the survey is $80,126. A major portion of this cost is related to the survey questionnaire, which includes preparation, collecting and verifying the information, and analyzing the data. Other costs will be incurred in summarizing the analysis and findings, preparing the final report, and report printing and distribution. The direct employee costs were estimated by assuming the hours spent on the project as about one-half year equivalent, or 26 weeks and taking half the annual pay of one GS-14, step 10. The direct employee cost is $66,772.

Indirect or overhead costs associated with the project are calculated as 20 percent of the direct employee cost, or $13,354. A review of OTE budgets from previous years indicates costs for building maintenance, telephone, computers, and space rental charges generally run about 20 percent of total employee costs.

15. Explain the reasons for any program changes or adjustments.

Because the nature of this collection of information falls within BIS’s generic authority entitled, “DOC/BIS National Security and Critical Technology Assessments of the U.S. Industrial Base,” (OMB Control No. 0694-0119), there is no increase in burden hours. This is the first time BIS has used this authority in FY2010 (a total of 24,000 authorized annually), an unused balance to the authority of 22,320 annual burden hours (24,000 minus 1,680) will remain if the assessment is approved under this authority.

16. For collections whose results will be published, outline the plans for tabulation and publication.

All data collected will be aggregated before publishing to protect company confidentiality. The surveys will be provided electronically to the 140 companies in January 2010. The analysis and report writing will be prepared in draft form by the end of April 2010. The final report is planned for publication in May 2010.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain the reasons why display would be inappropriate.

Not applicable. BIS will display the expiration date of this information collection authority on all survey and instructional instruments the public receives.

18. Explain each exception to the certification statement.

Not applicable.

B. COLLECTIONS OF INFORMATION EMPLOYING STATISTICAL METHODS

Not applicable.

Attachment: U.S. Department of Defense, National Security Agency, Letter of Cooperation

7