The FBI UCR Program’s Lawful Access Data Collection
The
purpose of the Lawful Access Data Collection is to gather data on the
number of instances where device or software encryption negatively
impacts a law enforcement investigation. The collection will gather a
number of basic details about the encryption, device/software, and
investigation in order to provide details about instances of lawful
access denial.
The purpose of this testing plan is to
conduct cognitive interviews and basic usability testing with a
volunteer group of qualified agencies to assess the preliminary
collection instrument and the upcoming online submission site. These
testing procedures will provide valuable feedback to the FBI UCR
Program as it further refines and improves the Lawful Access Data
collection.
The respondent sample is made up of voluntary agencies and representatives who, as part of their regular job duties, handles encrypted devices and software in relation to investigative cases. Many of the participants were recommended by members of the Lawful Access Task Force, a group made up of Federal, State, and Local organizations with expertise in lawful access issues. The Respondent group will participate in cognitive interviews as well as virtual usability testing, where applicable. If external access to usability is not achievable, the FBI will gather a group of on-site personal with experience with data encryption to perform usability testing of the submission platform.
[ ] Customer Comment Card/Complaint Form [ ] Customer Satisfaction Survey
[ ] Usability Testing (e.g., Website or Software [ ] Small Discussion Group
[ ] Focus Group [X] Other: Usability Testing & Cognitive Interviews
The collection is voluntary.
The collection is low-burden for respondents and low-cost for the Federal Government.
The collection is non-controversial and does not raise issues of concern to other federal agencies.
The results are not intended to be disseminated to the public.
Information gathered will not be used for the purpose of substantially informing influential policy decisions.
The collection is targeted to the solicitation of opinions from respondents who have experience with the program or may have experience with the program in the future.
Name: Bryan A. Sell – Survey Statistician, FBI UCR Program
To assist review, please provide answers to the following question:
Is personally identifiable information (PII) collected? [ ] Yes [X ] No
If Yes, will any information that is collected be included in records that are subject to the Privacy Act of 1974? [ ] Yes [ ] No
If Yes, has an up-to-date System of Records Notice (SORN) been published? [ ] Yes [ ] No
Is an incentive (e.g., money or reimbursement of expenses, token of appreciation) provided to participants? [ ] Yes [X] No
Category of Respondent |
No. of Respondents |
Participation Time |
Burden |
Cognitive Interview Process |
20 |
45 minutes |
15 hours |
Usability Testing |
20 |
30 minutes |
10 hours |
Totals |
20 (Combined Test Group) |
75 minutes |
25 hours |
If you are conducting a focus group, survey, or plan to employ statistical methods, please provide answers to the following questions:
Do you have a customer list or something similar that defines the universe of potential respondents and do you have a sampling plan for selecting from this universe? [X] Yes [] No
If the answer is yes, please provide a description of both below (or attach the sampling plan)? If the answer is no, please provide a description of how you plan to identify your potential group of respondents and how you will select them?
The
FBI UCR Program has identified two primary access points for Lawful
Access information:
Criminal Forensic Science Laboratories – Facilities that primarily focus on encrypted devices and data at rest.
Digital Surveillance Teams – Teams that observe instance of data in motion and encrypted software data.
Agencies
who either contain these access points or who utilize these access
points from their-party organizations for their investitive needs
make up the universe for the Lawful Access Data Collection. As the
FBI UCR Program is looking to maximize participation from all
potential respondents identified as part of the universe, no sampling
methods will be developed for this collection.
For the
testing procedures identified in this generic clearance request, The
participant group is entirely voluntary and is made up of a group of
agencies and representatives belonging to the identified universe.
Again, no sampling methods were uses due to the voluntary nature of
the testing procedures.
How will you collect the information? (Check all that apply)
[X] Web-based or other forms of Social Media
[ ] Telephone
[X] In-person
[ ] Other, Explain
Will interviewers or facilitators be used? [X] Yes [ ] No
Please
make sure that all instruments, instructions, and scripts are
submitted with the request.
Definitions
Originating Agency Identifier (ORI)–A unique identifying code assigned by the UCR Program to each participating agency for the purpose of access and tracking the submission of data.
NIBRS
Incident Number–A unique identifying number generated by the
UCR System for each incident submitted to the NIBRS.
Encryption–The
process of encoding messages or information in such a manner that
only people with the knowledge or means to decrypt the message can do
so.
Data-in-Motion–Data
that is in transit between the source and the destination. Examples
of data in motion are emails, text messages, audio messages, etc.
Data-at-Rest–Data
stored on the memory systems of digital devices, hard drives,
removable memory, etc.
Criminal
Forensic Crime Laboratories–Facilities dedicated to the access,
decryption, and analysis of digital data.
Digital
Surveillance Teams–Specialized teams of experts designed to
intercept digital communications in transit from source to
destination.
Encrypted
Device(s)/Media–Any mobile or nonmobile device or media that
can store, transmit, or display encrypted information.
Application/Software
Encryption–Any software application or program that utilizes
encryption code to encrypt, send, or display data.
Federal
Bureau of Investigation Uniform Crime Reporting Program’s
Lawful Access Data Collection Instrument
Navigation
Question:
Is your agency reporting encrypted device(s)/media or application/software encryption?
Encrypted Device(s)/Media (navigate to Section 1)
Application/Software
Encryption (navigate to Section 2)
Section 1: Encrypted Device/Media
Originating Agency Identifier (ORI): ______________________
Date of Device(s) Seizure: ____________________
NIBRS Incident Number: ___________________
Agency Case Identification: ____________________
Please describe the encrypted device/media that negatively impacted the investigation?
iPhone (include OS versions in conditional selection)
IOS 10 or older
IOS 11
IOS 12
IOS 13
IOS 14
IOS 15 or newer
Android (include OS versions in conditional selection)
Android 7 or older
Android 8
Android 9
Android 10
Android 11
Android 12 or newer
Hard Drive
Removable Media
Other: ____________
Is there an additional device/media to report?
Yes (additional question 1.5)
No (skip to question 1.7)
Was/Were the device(s)/media encountered associated with the victim or the offender? (select all that apply)
Victim
Offender
What is/are the criminal act/offense type(s) associated with the encrypted device(s)/media? (select all that apply)
Murder and Violent Crimes
Theft Offenses
Cybercrime
Drug/Narcotic Violations
Sex Offenses of an Adult
Sex Offenses of a Minor
Child Sexual Abuse Material (CSAM)
Acts Involving Deception or Corruption
Other Offenses
What was/is the outcome of the case?
Unknown
Pending
Penetration/Access/Decryption
Partial Penetration/Access/Decryption
Abandoned
Section 2: Application/Software Encryption
Originating Agency Identifier (ORI): ______________________
Date of Application(s)/Software Encryption Reporting: ____________________
NIBRS Incident Number: ___________________
Agency Case Identification: ____________________
Please identify the application/software that negatively impacted the investigation?
Apple iMessage
Apple Facetime
Signal App
Telegram App
Snap Chat
Other: _______________
Is there an additional application/software to report?
Yes (additional question 2.5)
No (skip to question 2.7)
Was/were the application(s)/software encountered associated with the victim or the offender? (select all that apply)
Victim
Offender
What is/are the criminal act/offense type(s) associated with the encrypted application(s)/software? (select all that apply):
Murder and Violent Crimes
Theft Offenses
Cybercrime
Drug/Narcotic Violations
Sex Offenses of an Adult
Sex Offenses of a Minor
Child Sexual Abuse Material (CSAM)
Acts Involving Deception or Corruption
Other Offenses
What was/is the outcome of the case?
Unknown
Pending
Penetration/Access/Decryption
Abandoned
Privacy
Act Statement
Authority: The collection of this information is authorized under United States Code (U.S.C) 28 U.S.C. § 534; 34 U.S.C. § 10211; 44 U.S.C. § 3101; and the general record keeping provision of the Administrative Procedures Act (5 U.S.C. § 301). The system will automatically collect certain contact information from you with your submission (e.g., telephone number and email address).
Principal Purpose: Collecting your contact information allows the FBI to contact you with any clarifying questions regarding your submission. This allows the FBI to verify submitted information and ensure the accuracy of the data.
Routine Uses: All contact information will be maintained in accordance with the Privacy Act of 1974. Your information may be disclosed with your consent, and may be disclosed without your consent as permitted by all applicable routine uses as published in the Federal Register (FR), including the routine uses for The FBI Central Records System (JUSTICE/FBI-002), published at 63 FR 8659, 671 (Feb. 20, 1998) and amended at 66 FR 8425 (Jan. 31, 2001), 66 FR 17200 (Mar. 29, 2001), and 82 FR 24147 (May 25, 2017), and the FBI Online Collaboration Systems (JUSTICE/FBI-004), published at 82 FR 57291 (Dec. 4, 2017). Routine uses may include sharing information with other federal, state, local, tribal, or territorial law enforcement agencies.
Lawful
Access Data Collection
After-Action Survey
Law Enforcement Enterprise Portal (LEEP) Use
Think back to registering and obtaining access to LEEP.
Was the process simple and easy to navigate?
Did you feel the security measures in place to protect the information submitted to the collection are necessary?
Did the security of LEEP help with any apprehension you may have had in submission of this data?
Was the collection easy to locate?
Was the form easy to complete?
Do you have any recommendation on improving the survey layout?
Did you contact anyone from the FBI’s UCR Program staff for assistance?
If you contacted the UCR Program staff for assistance, please describe the interaction.
Survey Instrument
How much time did it take you to complete the survey instrument?
5–10 minutes
11–20 minutes
21–30 minutes
More than 30 minutes
Did the survey instrument
appropriately guide you to which questions to answer, based on your
responses?
Did the questionnaire ask appropriate questions to assess the incident based on the criteria established within the collection to include:
Basic agency and case information
Type of device or software encountered
Association of the victim or offender with the encrypted data
Categories of criminal offenses associated with the reported case
Current status of the reported case
Were the questions easily
understood?
Did you use the tool tips during the session to further understand the question?
If yes, did the tool tip
thoroughly explain the intent and meaning of the question?
Were there any questions you did not understand which need further clarification or defined as a tooltip?
If yes–please
explain.
Do you feel additional questions are needed?
If yes–please explain.
Additional Information
Are you comfortable with the collection as it has been established?
If no–please explain.
Do you have concerns with contributing data to a collection such as this?
If yes–please
explain.
Additional thoughts/comments/concerns:
Instructions for Usability and Informed Consent
This
research project seeks your response to several elements associated
with the negative impacts to case investigations caused by device or
data encryption. This survey should take less than 30 minutes
to complete. While completing this survey will provide no direct
benefit for you, it will provide data to be analyzed to support the
ability to develop a greater understanding of the impact caused by
lawful access denial and digital encryption.
Please
complete the provided survey and return it to the researchers. Your
participation in the survey is completely voluntary and constitutes
no risk to you. If you change your mind during the survey and decide
you do not wish to continue, you may stop at any time. Also, you are
not required to answer any questions that you do not want to answer.
Returning a survey indicates your consent to participate in this
study.
For
this study, please answer each question of the survey. Do not
include any personally identifiable information for either yourself
or any member of your department in the survey questionnaire. You
may provide your own or department information in the submission
process within the electronic application. Any information provided
as part of this survey will only be viewed by members of the Lawful
Access Development Team for the purposes of confirming
participation.
The FBI’s UCR Program thanks you in advance for your help, time, and especially your insight in filling out this questionnaire. By completing responses to this survey, you are consenting for your participation. If you have any questions, or want information on research results, please feel free to contact the Crime and Law Enforcement Statistics Unit, FBI’s Uniform Crime Reporting Program, by telephone at 304-625-6634.
Consent Script for Cognitive Interviews
Thank
you for participating in this cognitive interview.
Your
feedback will help the FBI UCR Program refine the language and
instructions for the new Uniform Crime Reporting Program’s
Lawful Access Data Collection.
The
purpose of this interview is to gain insight to your experiences
answering the proposed collection questionnaire.
Your
participation in this interview is voluntary and you may discontinue
your participation at any time without penalty.
Your
name will not be associated with any information you provide and will
only be known to the individuals at the FBI working on the project.
This
interview is a requirement of the project. If you choose not to
complete the interview or voluntarily choose to discontinue the
interview, you will no longer be responsible for further
participation in the project.
There
are no known risks associated with this interview.
The
interview will take approximately 30-45 minutes.
The
interview will not be recorded. Notes from your observations will be
recorded by [insert name].
The
information obtained through these interviews may be published in
reports or presented at professional meetings, but your identity will
be kept strictly confidential.
If
you have any questions about your rights as a participant that I have
not answered, you may contact the Crime and Law Enforcement
Statistics Unit at 304-625-6634.
Do you have any questions regarding me, the project, or this interview before we begin?
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File Title | Fast Track PRA Submission Short Form |
| Author | OMB |
| File Modified | 0000-00-00 |
| File Created | 2023-08-28 |