1670-0028_TRIPWire_SS-A

Supporting Statement for Paperwork Reduction Act Submissions

Title: Technical Resource for Incident Prevention (TRIPwire) User Registration and Questionnaire

OMB Control Number: 1670-0028

Supporting Statement A

A. Justification

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

The Cybersecurity Infrastructure Security Agency (CISA), Infrastructure Security Division (ISD), Office of Bombing Prevention (OBP) has a leading role in implementation of the national counter-IED policy, articulated through Presidential Policy Directive 17 (PPD-17), Countering IEDs, serving as the Deputy Administrator of the federal interagency Joint Program Office for Countering Improvised Explosive Devices (JPO C-IED) and working in close collaboration with the White House National Security Council. The JPO C-IED coordinates and tracks Federal government progress in building national counter-IED capabilities. OBP also leads the Department of Homeland Security (DHS) in implementation of the national counter-IED policy, serving as the DHS Counter-IED Program Management Office (PMO) and chairing the DHS IED Working Group.

Through its leadership role, OBP is instrumental in aligning DHS and national counter-IED efforts through centralized and effective coordination of ongoing programs with national policy and strategy goals, resulting in better resource allocation within OBP and across DHS and our Federal, state, local, tribal, territorial and private sector partners.

TRIPwire (Technical Resource for Incident Prevention) is the Department of Homeland Security's online, collaborative information-sharing network for bomb technicians, first responders, military personnel, government officials, intelligence analysts, and select private sector security professionals to increase awareness of evolving IED tactics, techniques, and procedures, as well as incident lessons learned and counter-IED preparedness information. Developed and maintained by OBP, the system combines expert analysis and reports with relevant documents, images, and videos gathered directly from extremist sources to help users anticipate, identify, and prevent IED incidents.

Users from Federal, State, local, and tribal government entities, as well as business and/or other for-profit industries, can elect to register for TRIPwire access. The TRIPwire portal contains sensitive information related to terrorist use of explosives and therefore user information is needed to verify eligibility and access to the system.

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

There are three main instruments within this collection: TRIPwire New User Registrations, TRIPwire Revalidations, and a TRIPwire Questionnaire. The information collected is for internal OBP use only.

TRIPwire User Registrations:

The information collected during the TRIPwire user registration process is reviewed electronically by the OBP to validate the user’s “need to know,” which determines their eligibility for and access to TRIPwire. OBP verifies users need for access by confirming that a valid email address is used to register and checking employment references.

TRIPwire Revalidations:

Annually, users are revalidated based on the information provided during their registration. For revalidation, users and employment references receive a system generated email to validate that access is still required and their information is still accurate.

TRIPwire Questionnaire:

OBP sends registered users a quarterly questionnaire seeking feedback as to how registrants use TRIPwire information, products, and tools. OBP uses the information collected during the quarterly questionnaire is used to review the effectiveness and adequacy of the TRIPwire content and system features.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden.

TRIPwire registration is user-driven and is completed electronically via the secure TRIPwire interface. Users are required to have a computer and access to the Internet. The registration process requires users to provide their full name, assignment, citizenship, job title, employer name, professional address and contact information, as well as an Employment Verification Contact and their contact information. Notifications regarding the user registration are handled via electronic submission responses and/or e-mail. In addition to electronic registration, TRIPwire uses automated notifications to registered users when/if their account or password is set to expire as well as annual re-verification of users’ need for access to TRIPwire.

The TRIPwire Questionnaire is also collected electronically via a survey monkey link that is emailed to respondents. The Survey Monkey settings selected ensure that submissions are anonymous, and that an IP address is not collected.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item 2 above.



While a search of reginfo.gov revealed that user registrations and customer feedback surveys are collected by other government agencies, the information collected for TRIPwire is specific to OBP and not collected or duplicated elsewhere.

To further reduce duplication, the TRIPwire system automatically checks for duplicate usernames when users are registering for and/or changing their account information. If the username selected already occurs in TRIPwire, the user is notified via an electronic message to select a different username before they may proceed with the registration process.

Users may edit their account information at any time. They are not asked to provide personal information beyond registration unless or until their Employment Verification Contact or employment role change, in which case, they must provide updates in order to maintain membership.

5. If the collection of information impacts small businesses or other small entities (Item 5 of OMB Form 83-I), describe any methods used to minimize.

This information collection does not have an impact on small businesses or other small entities.

6. Describe the consequence to Federal/DHS program or policy activities if the collection of information is not conducted, or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

This information collection is necessary for TRIPwire to vet registrations and grant users access to the system. TRIPwire cannot allow public access to sensitive information without user authentication. The information provided determines a user’s “need to know,” which is a safeguard for the sensitive information within the TRIPwire system.

Further, if the information is not collected or is collected less frequently, potential users will not be given access to the system and will lose the ability to receive valuable threat prevention information and resources.

7. Explain any special circumstances that would cause an information collection to be conducted in a manner:

(a) Requiring respondents to report information to the agency more often than quarterly.

(b) Requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it.

(c) Requiring respondents to submit more than an original and two copies of any document.

(d) Requiring respondents to retain records, other than health, medical, government contract, grant-in-aid, or tax records for more than three years.

(e) In connection with a statistical survey, that is not designed to produce valid and reliable results that can be generalized to the universe of study.

(f) Requiring the use of a statistical data classification that has not been reviewed and approved by OMB.

(g) That includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use.

(h) Requiring respondents to submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information’s confidentiality to the extent permitted by law.



There are no special circumstances causing information to be collected in this manner.

8. Federal Register Notice:

a. Provide a copy and identify the date and page number of publication in the Federal Register of the agency’s notice soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

b. Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported.

c. Describe consultations with representatives of those from whom information is to be obtained or those who must compile records. Consultation should occur at least once every three years, even if the collection of information activities is the same as in prior periods. There may be circumstances that may preclude consultation in a specific situation. These circumstances should be explained.



	Date of Publication	Volume Number	Number	Page Number	Comments Addressed
60Day Federal Register Notice:	August 27, 2019	84	166	44912 - 44913	0
30-Day Federal Register Notice	December 30, 2019	84	249	71971 - 71972	0

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

There is no offer of monetary or material value for this information collection.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.



While there is no expectation of confidentiality, TRIPwire does, however, meet the moderate (as defined in the DHS 4300A Sensitive Systems Handbook) impact level for protecting, encrypting, and safeguarding user-collected information. TRIPwire applicants must provide their full name, assignment, citizenship, job title, employer name, professional work address and contact information, as well as an Employment Verification Contact and their contact information. The system does not store sensitive personally identifiable information (PII) such as social security numbers.

The DHS Privacy Office review finds that this is a privacy sensitive collection requiring a Privacy Impact Assessment (PIA) and a System of Records Notice (SORN). The collection is covered by PIA - DHS Privacy Impact Assessment 015, “DHS Web Portals,” Dated June 15, 2009; and the SORN - DHS/ALL-004 - General Information Technology Access Account Records System (GITAARS) November 27, 2012, 77 FR 70792.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

There are no questions of sensitive nature.

12. Provide estimates of the hour burden of the collection of information. The statement should:



a. Indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated. Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates. Consultation with a sample (fewer than 10) of potential respondents is desired. If the hour burden on respondents is expected to vary widely because of differences in activity, size, or complexity, show the range of estimated hour burden, and explain the reasons for the variance. Generally, estimates should not include burden hours for customary and usual business practices.

b. If this request for approval covers more than one form, provide separate hour burden estimates for each form and aggregate the hour burdens in Item 13 of OMB Form 83-I.

c. Provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories. The cost of contracting out or paying outside parties for information collection activities should not be included here. Instead, this cost should be included in Item 14.

TRIPwire was designed and is marketed to bomb squad, law enforcement, emergency services, and security personnel in state, local, tribal, and territorial (SLTT) governments or the private sector in order to learn about current terrorist IED tactics, techniques, and procedures, including design and emplacement considerations.

OBP estimates approximately 1,333 new annual registrations for system access.¹ Respondents include SLTT law enforcement and security personnel, as well as private-sector security personnel. OBP estimates that it takes approximately 0.17 hours (10 minutes) to complete the registration process. Each user will have to provide one registration submission.

OBP estimates approximately 2,000 currently registered users need to revalidate their system access. It takes approximately 0.02 hours (1 minute) to respond to the request.

The questionnaire is sent out quarterly to two groups of registered users. The first group receives the questionnaire in the first and third quarters and the second group receives the questionnaire in the second and fourth quarters. OBP estimates approximately 500 responses are received each quarter. Thus, each group submits 1,000 responses annually and there may be two responses per respondent. It takes approximately 0.08 hours (5 minutes) to complete the questionnaire.

To estimate the labor costs for respondents to complete the annual registration, OBP uses the average hourly compensation rates for SLTT law enforcement and emergency personnel, and private-sector security personnel. OBP used Bureau of Labor Statistics (BLS) data to estimate the average hourly wage rate for SLTT police and sheriff’s patrol officers (hereafter referred to as police officers), SLTT emergency management directors, and private-sector security personnel.² The weighted average hourly wage rate for SLTT respondents is $21.37³, while the average hourly wage rate for private-sector security personnel is $15.41. To account for benefits, OBP multiplies the wage for SLTT police officers and emergency management directors by a compensation factor of 1.6028, and the private security personnel wage by a compensation factor of 1.4270. ⁴ The average hourly compensation rate for respondents is $32.53.⁵

As shown in Table 1, OBP estimated that the annual burden on respondents will be 422 hours with a labor cost of $13,736.

Table A12. Estimated Annualized Burden Hours and Costs

Form Name	Number of Respondents	Number of Responses per Respondent	Average Burden per Response (hours)	Total Time Burden (hours)	Average Hourly Compensation Rate	Total Labor Cost
TRIPwire New User Registrations	1,333	1	0.167	222	$32.53	$7,230
TRIPwire Revalidations	2,000	1	0.017	33	$32.53	$1,084
TRIPwire Questionnaire	1,000	2	0.083	167	$32.53	$5,422
Total	4,333			422		$13,736

Note: Totals may not sum due to rounding.

13. Provide an estimate of the total annual cost burden to respondents or record keepers resulting from the collection of information. (Do not include the cost of any hour burden shown in Items 12 and 14.)

The cost estimate should be split into two components: (1) a total capital and start-up cost component (annualized over its expected useful life); and (b) a total operation and maintenance and purchase of services component. The estimates should take into account costs associated with generating, maintaining, and disclosing or providing the information. Include descriptions of methods used to estimate major cost factors including system and technology acquisition, expected useful life of capital equipment, the discount rate(s), and the time period over which costs will be incurred. Capital and start-up costs include, among other items, preparations for collecting information such as purchasing computers and software; monitoring, sampling, drilling and testing equipment; and record storage facilities.



If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and explain the reasons for the variance. The cost of purchasing or contracting out information collection services should be a part of this cost burden estimate. In developing cost burden estimates, agencies may consult with a sample of respondents (fewer than 10), utilize the 60-day pre-OMB submission public comment process and use existing economic or regulatory impact analysis associated with the rulemaking containing the information collection as appropriate.

Generally, estimates should not include purchases of equipment or services, or portions thereof, made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not associated with the information collection, (3) for reasons other than to provide information to keep records for the government, or (4) as part of customary and usual business or private practices.

There are no recordkeeping, capital, start-up or maintenance costs associated with this information collection.

14. Provide estimates of annualized cost to the Federal Government. Also, provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing, and support staff), and any other expense that would have been incurred without this collection of information. You may also aggregate cost estimates for Items 12, 13, and 14 in a single table.



The Federal Government contracts support staff that will review and process each submitted TRIPwire registration. The help desk staff earn a salary equivalent to Computer Support Specialist at an hourly compensation rate of $39.76.⁶

OBP estimates that it will take the help desk staff approximately 0.12 hours (7 minutes) to complete the registration review process. Given the estimate of 1,333 respondents, help desk staff will require approximately 156 hours to process user registrations. Processing user registrations will cost $6,184 annually (156 hours × $39.76 per hour).

The TRIPwire revalidation process is automatically generated by the system and does not require review by a help desk or government staff member. Therefore, there is no burden to the Federal government related to the TRIPwire revalidations.

The questionnaire results are initially compiled by the help desk contract support. It takes one help desk staff member approximately 3 hours to compile the results each quarter (i.e., approximately 0.006 hours per report). The results are then sent to the TRIPwire program manager (GS 14, Step 2) for review. It takes approximately 2 hours to review the results each quarter. The compensation rate for a GS 14, Step 2 staff member is $98.16 per hour.⁷ Compiling and reviewing the questionnaires will result in 20 annual burden hours and cost $1,262.

The total estimate annual cost to government is $7,447.

Table A14: Estimated Annual Federal Government Burden Hours and Costs

Form Name	Number of Reports	Average Burden per Report (hours)	Total Time Burden (hours)	Average Hourly Compensation Rate	Total Labor Cost
TRIPwire User Registration Processing	1,333	0.12	156	$39.76	$6,184
TRIPwire Questionnaire - Compilation	2,000	0.01	12	$39.76	$477
TRIPwire Questionnaire – Review	4	2.00	8	$98.16	$785
Total	3,337		176		$7,447

Note: Totals may not sum due to rounding.

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I. Changes in hour burden, i.e., program changes or adjustments made to annual reporting and recordkeeping hour and cost burden. A program change is the result of deliberate Federal Government action. All new collections and any subsequent revisions of existing collections (e.g., the addition or deletion of questions) are recorded as program changes. An adjustment is a change that is not the result of a deliberate Federal Government action. These changes that result from new estimates or actions not controllable by the Federal Government are recorded as adjustments.



The changes to the collection since the previous OMB approval include: updating the collection title, updating the TRIPwire User registration page, clarifying the revalidation burden, and adding a TRIPwire Questionnaire. Overall, these changes result in a decrease in burden estimates and costs.

For the TRIPwire user registration, specifically, there were 2 data fields removed: requiring a justification for requesting access to TRIPwire and asking users how they found out about TRIPwire. The only other changes were to the look and feel of the layout of the registration pages. The changes are not expected to change the burden time per response.

The annual burden estimates for the collection has decreased by 173 hours, from 595 to 422 and the annual burden cost has decreased by $2,269, from $16,006 to $13,736, due to clarifying the burden for the revalidation process and adding the user feedback questionnaire, in combination with a reduction in the annual number of new user registrations. Estimates were also impacted by updating hourly compensation rates.

The annual government cost for the collection has decreased by $2,443, from $9,890 to $7,447, due to addition of the costs associated with staff compiling and reviewing the TRIPwire Questionnaire, as well as updated wage rates to account for full compensation rates.

16. For collections of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.



The results of this information collection will not be published.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain reasons that display would be inappropriate.



DHS will display the expiration date for the Office of Management and Budget’s approval of this information collection.

18. Explain each exception to the certification statement identified in Item 19 “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

DHS does not request an exception to the certification of this information collection.

1 OBP estimates that in Year 1, there will be 2,000 registrations, while in Year 2 and Year 3, there will be 1,000 registrations each. Therefore, OBP estimates that on average, there will 1,333 registrations per year (= (2,000 in Year 1 + 1,000 in Year 2 + 1,000 in Year 3) ÷ 3 years).

2 BLS. Occupational Employment Statistics. OES Data. May 2018: All Data. Police and Sheriff’s Patrol Officers (33-3051), Emergency Management Directors (11-9161), and Security Guards (33-9032). https://www.bls.gov/oes/tables.htm. The 2018 OES data indicates there are 570,150 local police officers with an average hourly wage of $31.29; 71,580 state police officers with an average hourly wage for $33.74; 5,160 local emergency management directors with an average hourly wage of $36.02; 1,560 state emergency management directors with an average hourly wage of $33.25; and 1,114,380 private-sector security guards with an average hourly wage of $15.41.

3 $31.60 per hour = (641,730 police officers × $31.56 per hour + 6,720 state and local emergency management directors × $35.38 per hour) ÷ (641,730 state and local police officers + 6,720 state and local emergency management directors).

4 BLS. Employer Costs for Employee Compensation – March 2019. Table 1. Employer Costs for Employee Compensation by Ownership. https://www.bls.gov/news.release/archives/ecec_06182019.pdf. The compensation factor of 1.6028 for state and local government workers is estimated by dividing total compensation ($50.89) by wages and salaries ($31.75). The compensation factor of 1.4270 for private-sector workers is estimated by dividing total compensation ($34.49) by wages and salaries ($24.17).

5 $32.53 per hour = [($31.56 per hour × 1.6028 × 641,730) + ($35.38 per hour × 1.6028 × 6,720) + ($15.41 × 1.4270 × 1,114,380)] ÷ (641,730 + 6,720 + 1,114,380).

6 The hourly compensation rate is the BLS average hourly wage for a computer support specialist of $27.86 (15-1150, https://www.bls.gov/oes/2018/may/oes_nat.htm#15-0000) multiplied by the compensation load factor of 1.4270 for private-sectors workers as defined above.

7 The compensation rate is estimated as the hourly salary for a GS 14, Step 2 staff member in the Washington, D.C. area of $58.02 (https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/19Tables/html/DCB_h.aspx) multiplied by a compensation factor of 1.6919 for Federal government workers (Congressional Budget Office. Comparing the Compensation of Federal and Private-Sector Employees, 2011 to 2015. April 2017. https://www.cbo.gov/publication/52637. According to Table 4, Average Total Compensation for all levels of education is $64.80. According to Table 2, Average wages for all levels of education is $38.30. We estimate the compensation factor by dividing total compensation by average wages).