NIST, ITL, Use of Cryptography Data Collection - Interview Information Sheet

December 19, 2016, ITL-16-0011

INFORMATION SHEET

Project Title: “Usable Cryptography Interviews”

NIST Principal Investigators:

Co-Principal Investigator: Mary Theofanos, Phone: 301-975-5889

Co-Principal Investigator: Julie Haney, Phone: 301-975-4972

Research Description

This study is being performed to better understand the testing challenges and usability issues encountered by organizations that design and implement cryptography applications. The research is funded and conducted by the National Institute of Standards and Technology (NIST).

Requirements for Participation

You have been asked to participate in this study because of your experience with developing or testing products that use cryptography. In order to participate in this research project, you must be at least 18 years old.

Study Procedures

You will be asked to participate in an in-depth, semi-structured interview about your and your organization’s experiences testing products that use cryptography and using cryptographic standards. The interview may be conducted via the phone, video teleconference, or face-to-face. The interview will be audio-recorded, and the recording will be transcribed. All of your data, including the transcribed responses to interview questions and notes taken by the researchers during the interview, will be recorded without any personal identifiers. This study should take you no more than 60 minutes. In total, we expect to have approximately 25 participants complete the study activities.

Confidentiality

You will be assigned a participant number that will be used for all data in this project. Your identity will be protected to the extent permitted by law, including the Freedom of Information Act. The Office for Human Research Protections (OHRP) of the U.S. Department of Health and Human Services, appropriate NIST researchers, and other appropriate Federal employees may review the records of this study. The study data will be used only by NIST researchers to develop guidance on cybersecurity and privacy training and administration. All of the data, including the audio recording, transcription, and researcher notes will be recorded without identifiers. The data will only be identified by a number and will not be linked back to an individual in any way. NIST will not keep a list that links your participant number to your name or other identifying information. In responding to the freeform questions in the questionnaire, do not include any personally identifiable information in your responses. You also should avoid making comments during the interview that may identify you on the audio recording. If you inadvertently make a disclosure of personal identifying information during the interview, that information will not be transcribed.

Voluntary Participation

Your participation is voluntary. Refusal to participate will involve no penalty or loss of benefits to which you are otherwise entitled. You are free to withdraw from the study at any time during the experiment without penalty. If you decline to answer a question, the interview will continue to the next question. If you withdraw from the study, your data will not be removed from the study.

Potential Risks and Benefits

The risks during performance of the study activities are minimal and not greater than those ordinarily encountered in daily life or in responding to a routine questionnaire or survey. You will not benefit directly by participating in the study. The long-term benefits of this study should be improved usability of cryptography.

Contact Information

For questions regarding this study, please contact Mary Theofanos at 301-975-5880, [email protected]. For questions regarding your rights as a human research subject, please contact Anne Andrews, Director, NIST Human Subjects Protection Office, at 301-975-5445, [email protected], or Laura Baxter in the Office of the Chief Counsel for NIST at 301-975-5622, [email protected]. Any research-related injury during the study should be reported to Mary Theofanos (contact information above).

1