1110-0NEW Supporting Statement B - Lawful Access (2023)

1110-0NEW Supporting Statement B - Lawful Access (2023).docx

Lawful Access Data Collection

OMB: 1110-0088

Document [docx]

Download: docx | pdf

Supporting Statement for Paperwork Reduction Act Submissions

Request for a new data collection with an OMB control number for the Lawful Access Data Collection

OMB Control #: Request an OMB Control Number

Part B. Statistical Methods

1. Universe and Respondent Selection

Due to the unique nature of data encryption and the points of access available to collecting this type of information, the FBI’s UCR Program has moved outside the traditional universe of contributing agencies. While some traditional law enforcement agencies can capture and analyze encrypted devices and software, many agencies either do not have the capability or designate the responsibility to outside entities that specialize in the forensic analysis of devices and software encryption. The FBI’s UCR Program has identified two specific access points for this information. The first of these access points are criminal forensic science laboratories. These facilities employ forensic specialists that work with digital communication and storage devices recovered from crime scenes or seized during the serving of a warrant. These labs work to access seized devices and are the primary access point for data on cases negatively impacted by encryption. The second access point are traditional law enforcement agencies (LEA). As the primary source of criminal investigations resides at the LEA level, these agencies can provide the closest look at investigation impacted by encryption and encrypted devices.

The LADC will focus on providing submission access to both groups to maximize potential submissions. Some LEAs manage their own forensic labs for decryption, but many agencies use state crime labs, fusion centers, or third-party vendors to gain access to encrypted data. The FBI will accept submissions from both groups of agencies, while also using methods to minimize the risk of duplicative reporting, such as agency case numbers provided, if possible, for each submission and requesting that submissions be completed by digital forensic experts.

The LADC is designed to collect information on cases that are impacted by locked/encrypted devices or encrypted data. This information will provide a more comprehensive view of the impact encryption has on criminal justice investigations. The collection methodology will focus on gathering submissions from the access points listed above.

2. Procedures for Collecting Information

Participating agencies will submit the details of an incident to the COLECT accessible through LEEP for all registered users. The LADC is designed to collect all instances of criminal cases or investigations which are negatively impacted by device or software encryption from all eligible agencies in the nation. Thus, the FBI’s UCR Program will not be utilizing special sampling methodology for the LADC. The LADC will also not implement estimation methodology, as the collection is designed to gather the total volume of impacted cases reported by agencies rather than an estimated national total.

3. Methods to Maximize Response

As with all UCR data collection, participation in the LADC is voluntary. The FBI maximizes response rates through liaison with agencies and state programs. For the LADC, the FBI’s UCR Program is developing a robust communications plan to message out the existence and utility of the LADC to bring awareness to the mission and encourage participation from eligible agencies. The FBI’s UCR Program also has dedicated staff available for assistance in submissions and training on the submission process. The mission of the LADC is to acquire data on investigations and cases impacted by encryption, establish guidelines for the LADC, and publish LADC analyses and reports. Although the FBI’s UCR Program makes every effort through its editing procedures, training practices, and information to ensure the validity of the data it receives, the accuracy of LADC data will depend primarily on the adherence of each contributor to the established standards of reporting. Over the next several years of the LADC, the FBI’s UCR Program will continue to conduct analysis on the reported data and pursue opportunities to conduct research on the collection’s universe of reporting agencies and potential completeness.

4. Task Force and Testing

Since the discussion began on the development of the LADC, the FBI’s UCR Program has been working to research and establish a team of experts in the field of lawful access issues to assist in the development and improvement of this new collection. The Lawful Access Task Force was established and began meeting to discuss the collection on September 21, 2021.

Below is a listing of major participants and organizations taking part in the Lawful Access Data Collection Task Force:

FBI Task Force Contributors:

National Domestic Communications Assistance Center

External Task Force Contributors:

Association of State Criminal Investigative Agencies (ASCIA)
Orange County Sheriff’s Department (California)
Florida Department of Law Enforcement
Columbus Police Department (Ohio)
New York County District Attorney’s Office
Nassau County Police Department (New York)
Director of Government and Legislative Affairs National District Attorneys Association

Major Law Enforcement Organizations:

International Association of Chiefs of Police (IACP)
Major Cities Chiefs Association (MCCA)

The Lawful Access Task Force assisted the FBI’s UCR Program in constructing the framework of the collection focusing on the following data elements:

Basic agency and case information
Type of device or software encountered
Association of the victim or offender with the encrypted data
Categories of criminal offenses associated with the reported case
Current status of the reported case

The FBI’s UCR Program used these main areas of focus to develop a questionnaire designed to gather details and data elements surrounding the negative impact of data encryption on investigation efforts and criminal cases.

Coordination with West Virginia Fusion Center

On February 3, 2022, the FBI’s UCR Program sent staff dedicated to the development of the Lawful Access Data Collection to Charleston, West Virginia, to meet with staff from the West Virginia Fusion Center and discuss the ongoing development of the LADC and to gain firsthand knowledge of the issues faced by digital forensics labs when dealing with encrypted devices.

The visit provided the development team a great deal of insight into the availability of data before and after professionals gain access to encrypted data and the time frame often needed for the process. The West Virginia Fusion Center, as well as several local law enforcement agencies in the area, have voiced their desire to support the FBI’s UCR Program in the development of the collection, including participating in in-person testing of the questionnaire and acting as an information resource as development continues.

Pilot Testing Procedures and Results

For the pilot testing, a sample of voluntary agencies were selected to participate in the cognitive interviews. In total, the FBI’s UCR Program completed four separate group testing sessions gathering feedback from four agencies and 12 experts in the fields of digital forensics and law enforcement. The selection criteria for the pilot sample reflected a purposive sample and represented a broad spectrum of agency characteristics, including agency size, agency type, and geographic location. Each participating agency was pre-screened for potential candidates which have experience in device encryption and investigations involving encrypted data. All agencies selected for the pilot agreed voluntarily to participate in the pilot research.

Pilot testing began February 10, 2022 and was completed February 27,2022. In that time, the FBI’s UCR Program completed four group interviews with the following agencies:

West Virginia Fusion Center in Charleston, WV
West Virginia State Police Crime Lab in Morgantown, WV
District Attorney Office of New York
Florida Department of Law Enforcement

These group cognitive interview sessions followed the proposed methods outlined in the previously approved comprehensive testing plan. The results of these interviews revealed several areas where the FBI could improve the collection questionnaire prior to formal launch of the LADC. The FBI developed solutions to these areas and implemented them into a revised collection questionnaire that is included with this clearance package. Listed below are a selection of improvements made to the LADC based on the cognitive interview testing results.

The addition of an automated message activated upon entering the submission form explaining the purpose of the collection, when to submit an incident, and who should be the main submitter of information.
A reorganization of the form to better delineate between agency and case information versus incident and encryption information. This change separates the form into two sections and allows agencies to submit information specific to each encrypted device encountered.
Rewording of several questions to improve clarity and understanding for submitters. This included rewriting questions and adding additional code options for selection.

Along with cognitive interviews, the FBI conducted system usability testing with six pilot participants. These participants were given mock submission scenarios and asked to use the online submission platform to submit an incident. These test submissions were timed by a member of the FBI’s UCR Program and times were recorded for evaluation. Findings showed the average time of completion of a LADC submission was 3 minutes and 12 seconds. This average time of completion is used to generate accurate burden estimates on reporting agencies. Usability participants also completed a post-usability assessment allowing the participants to grade the usability of the system in a number of key areas. Feedback from these assessment forms was used to assess the ease of use and functionality of the online submission platform.

With the completion of the pilot testing, the FBI is moving forward with final enhancements of the LADC and upon completion, will plan for collection launch once formal approval of the collection is achieved.

5. Contacts for Statistical Aspects and Data Collection

Scott E. Schubert

Law Enforcement Engagement and Data Sharing (LEEDS) Section Chief

[email protected]

Amy C. Blasher

Assistant LEEDS Chief

[email protected]

304-625-4840

Edward L. Abraham

Crime and Law Enforcement Statistics Unit Chief

[email protected]

304-625-2136