1670-0028_TRIPWire_SS-A (1)_ (SAR 8.8.24) with CISA Response (1)

Supporting Statement for Paperwork Reduction Act Submissions

Title: Technical Resource for Incident Prevention (TRIPwire) User Registration and Questionnaire

OMB Control Number: 1670-0028

Supporting Statement A

A. Justification

1. Explain the circumstances that make the collection of information necessary. Identify any legal or administrative requirements that necessitate the collection. Attach a copy of the appropriate section of each statute and regulation mandating or authorizing the collection of information.

The Cybersecurity Infrastructure Security Agency (CISA), Infrastructure Security Division (ISD), Office of Bombing Prevention (OBP) has a leading role in implementation of the national counter-Improvised Explosive Device (IED) policy, articulated through Presidential Policy Directive 17 (PPD-17), Countering IEDs, serving as the Deputy Administrator of the federal interagency Joint Program Office for Countering Improvised Explosive Devices (JPO C-IED) and working in close collaboration with the White House National Security Council. The JPO C-IED coordinates and tracks Federal government progress in building national counter-IED capabilities. OBP also leads the Department of Homeland Security (DHS) in implementation of the national counter-IED policy, serving as the DHS Counter-IED Program Management Office (PMO) and chairing the DHS IED Working Group.

This collection of information is consistent with CISA’s statutory authorities, including the authority provided by 6 U.S.C. § 652(c)(5) (authorizing CISA to “upon request, provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators…”), 6 U.S.C. § 652(e)(1)(C) (authorizing CISA to “integrate relevant information, analysis, and vulnerability assessments…in order to make recommendations…for protective and support measures” by Federal and non-federal entities.), and 6 U.S.C. § 652(c)(11) (authorizing CISA to provide “education, training, and capacity development to federal and non-federal entities to enhance the security and resiliency of domestic and global cybersecurity and infrastructure security.”).

Through its leadership role, OBP is instrumental in aligning DHS and national counter-IED efforts through centralized and effective coordination of ongoing programs with national policy and strategy goals, resulting in better resource allocation within OBP and across DHS and our Federal, state, local, tribal, territorial and private sector partners.

TRIPwire (Technical Resource for Incident Prevention) is the Department of Homeland Security's online, collaborative information-sharing network for bomb technicians, first responders, military personnel, government officials, intelligence analysts, and select private sector security professionals to increase awareness of evolving improvised explosive device (IED) tactics, techniques, and procedures, as well as incident lessons learned and counter-IED preparedness information. Developed and maintained by OBP, the TRIPwire system combines expert analysis and reports with relevant documents, images, and videos gathered from publicly available sources to help users anticipate, identify, and prevent IED incidents.

Users from federal, state, local, and tribal government entities, as well as business and/or other for-profit industries, can register for TRIPwire access. The TRIPwire portal contains sensitive information related to the criminal use of explosives by threat actors, including violent, malicious organizations, which requires a limited, controlled means of dissemination—such as designations of “For Official Use Only,” “Law Enforcement Sensitive,” or “Controlled Unclassified Information.” Therefore, CISA must collect user information in order to verify an individual’s eligibility to access the TRIPwire system.

In addition to new user registrations, CISA will also seek feedback from TRIPwire users via a questionnaire and will request that TRIPwire users revalidate their access status on an annual basis. All information collected/provided pursuant to this ICR will be done so on a strictly voluntary basis.

This is a reinstatement of a previously approved information collection. There are no substantive changes to the information collection, minimal administrative changes due to increased wages. The previously approved collection expired on August 31, 2023

2. Indicate how, by whom, and for what purpose the information is to be used. Except for a new collection, indicate the actual use the agency has made of the information received from the current collection.

There are three main instruments within this collection: TRIPwire New User Registrations, TRIPwire Revalidations, and a TRIPwire Questionnaire. The information collected is for internal OBP use only.

TRIPwire User Registrations:

The information collected during the TRIPwire user registration process is reviewed electronically by the OBP to validate the user’s “need to know,” which determines their eligibility for and access to TRIPwire. OBP verifies users need for access by confirming that a valid email address is used to register and checking employment references.

TRIPwire Revalidations:

Annually, users are revalidated based on the information provided during their registration. For revalidation, users and employment references receive a system generated email to validate that access is still required and their information is still accurate.

TRIPwire Questionnaire:

OBP sends registered users a quarterly questionnaire seeking feedback as to how registrants use TRIPwire information, products, and tools. OBP uses the information collected during the quarterly questionnaire is used to review the effectiveness and adequacy of the TRIPwire content and system features.

3. Describe whether, and to what extent, the collection of information involves the use of automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses, and the basis for the decision for adopting this means of collection. Also describe any consideration of using information technology to reduce burden.

TRIPwire registration is user-driven and is completed electronically via the secure TRIPwire interface. Users are required to have a computer and access to the Internet. The registration process requires users to provide their full name, assignment, citizenship status, job title, employer name, professional address, and business contact information, as well as an Employment Verification Contact and their business contact information. Notifications regarding the user registration are handled via electronic submission responses and/or e-mail. In addition to electronic registration, TRIPwire uses automated notifications to registered users when/if their account or password is set to expire as well as annual re-verification of users’ need for access to TRIPwire.

The TRIPwire Questionnaire is also collected electronically via a link that is emailed to respondents. The survey settings selected ensure that submissions are anonymous, and that an IP address is not collected.

CISA conducted usability testing on the forms to help with verification of the burden hours and to verify the ease of use.  The usability testing participants helped verified the burden hours and had no difficult traversing through the documents.  Information collected during the use of the form was used to validate the burden information as well. There were no changes to the forms or burden from the usability testing.

4. Describe efforts to identify duplication. Show specifically why any similar information already available cannot be used or modified for use for the purposes described in Item 2 above.



While a search of reginfo.gov revealed that user registrations and customer feedback surveys are collected by other government agencies, the information collected for TRIPwire is specific to OBP and not collected or duplicated elsewhere.

To further reduce duplication, the TRIPwire system automatically checks for duplicate usernames when users are registering for and/or changing their account information. If the username selected already occurs in TRIPwire, the user is notified via an electronic message to select a different username before they may proceed with the registration process.

Users may edit their account information at any time. They are not asked to provide personal information beyond registration until their Employment Verification Contact or employment role change, in which case, they must provide updates in order to maintain membership.

5. If the collection of information impacts small businesses or other small entities (Item 5 of OMB Form 83-I), describe any methods used to minimize.

This information collection does not have an impact on small businesses or other small entities.

6. Describe the consequence to Federal/DHS program or policy activities if the collection of information is not conducted, or is conducted less frequently, as well as any technical or legal obstacles to reducing burden.

This information collection is necessary for TRIPwire to vet registrations and grant users’ access to the system, because TRIPwire contains information products that require a limited, controlled means of dissemination—such as information bulletins marked “For Official Use Only,” “Law Enforcement Sensitive,” or “Controlled Unclassified Information.” Accordingly, TRIPwire cannot allow public access to this sensitive information without user authentication. The information provided determines a user’s “need to know,” which is a safeguard for the sensitive information within the TRIPwire system.

Further, if the information is not collected or is collected less frequently, potential users will not be given access to the system and will lose the ability to receive valuable threat prevention information and resources.

7. Explain any special circumstances that would cause an information collection to be conducted in a manner:

(a) Requiring respondents to report information to the agency more often than quarterly.

(b) Requiring respondents to prepare a written response to a collection of information in fewer than 30 days after receipt of it.

(c) Requiring respondents to submit more than an original and two copies of any document.

(d) Requiring respondents to retain records, other than health, medical, government contract, grant-in-aid, or tax records for more than three years.

(e) In connection with a statistical survey, that is not designed to produce valid and reliable results that can be generalized to the universe of study.

(f) Requiring the use of a statistical data classification that has not been reviewed and approved by OMB.

(g) That includes a pledge of confidentiality that is not supported by authority established in statute or regulation, that is not supported by disclosure and data security policies that are consistent with the pledge, or which unnecessarily impedes sharing of data with other agencies for compatible confidential use.

(h) Requiring respondents to submit proprietary trade secret, or other confidential information unless the agency can demonstrate that it has instituted procedures to protect the information’s confidentiality to the extent permitted by law.



There are no special circumstances causing information to be collected in this manner.

8. Federal Register Notice:

a. Provide a copy and identify the date and page number of publication in the Federal Register of the agency’s notice soliciting comments on the information collection prior to submission to OMB. Summarize public comments received in response to that notice and describe actions taken by the agency in response to these comments. Specifically address comments received on cost and hour burden.

b. Describe efforts to consult with persons outside the agency to obtain their views on the availability of data, frequency of collection, the clarity of instructions and recordkeeping, disclosure, or reporting format (if any), and on the data elements to be recorded, disclosed, or reported.

c. Describe consultations with representatives of those from whom information is to be obtained or those who must compile records. Consultation should occur at least once every three years, even if the collection of information activities is the same as in prior periods. There may be circumstances that may preclude consultation in a specific situation. These circumstances should be explained.



	Date of Publication	Volume Number	Number	Page Number	Comments Addressed
60Day Federal Register Notice:	1/10/2025	90	6	2012-2013	0
30-Day Federal Register Notice	7/29/2025	90	143	35710-35711	0

9. Explain any decision to provide any payment or gift to respondents, other than remuneration of contractors or grantees.

There is no offer of monetary or material value for this information collection.

10. Describe any assurance of confidentiality provided to respondents and the basis for the assurance in statute, regulation, or agency policy.



While there is no expectation of confidentiality, TRIPwire does, however, meet the moderate (as defined in the DHS 4300A Sensitive Systems Handbook) impact level for protecting, encrypting, and safeguarding user-collected information. TRIPwire applicants must provide their full name, assignment, citizenship status, job title, employer name, professional work address and contact information, as well as an Employment Verification Contact and their contact information. The system does not store sensitive personally identifiable information (PII) such as social security numbers.

The DHS Privacy Office review finds that this is a privacy sensitive collection requiring a Privacy Impact Assessment (PIA) and a System of Records Notice (SORN). The collection is covered by PIA - DHS Privacy Impact Assessment 015, “DHS Web Portals,” Dated June 15, 2009; and the SORN - DHS/ALL-004 - General Information Technology Access Account Records System (GITAARS) November 27, 2012, 77 FR 70792.

11. Provide additional justification for any questions of a sensitive nature, such as sexual behavior and attitudes, religious beliefs, and other matters that are commonly considered private. This justification should include the reasons why the agency considers the questions necessary, the specific uses to be made of the information, the explanation to be given to persons from whom the information is requested, and any steps to be taken to obtain their consent.

There are no questions of a sensitive nature.

12. Provide estimates of the hour burden of the collection of information. The statement should:



a. Indicate the number of respondents, frequency of response, annual hour burden, and an explanation of how the burden was estimated. Unless directed to do so, agencies should not conduct special surveys to obtain information on which to base hour burden estimates. Consultation with a sample (fewer than 10) of potential respondents is desired. If the hour burden on respondents is expected to vary widely because of differences in activity, size, or complexity, show the range of estimated hour burden, and explain the reasons for the variance. Generally, estimates should not include burden hours for customary and usual business practices.

b. If this request for approval covers more than one form, provide separate hour burden estimates for each form and aggregate the hour burdens in Item 13 of OMB Form 83-I.

c. Provide estimates of annualized cost to respondents for the hour burdens for collections of information, identifying and using appropriate wage rate categories. The cost of contracting out or paying outside parties for information collection activities should not be included here. Instead, this cost should be included in Item 14.

.

TRIPwire User Registrations

OBP estimates approximately 1,333 new annual registrations for system access.¹ OBP estimates that it takes approximately 0.17 hours (10 minutes) to complete the registration process. Each user will have to provide one registration submission.

TRIPwire Revalidations

OBP estimates approximately 2,000 currently registered users need to revalidate their system access, annually. It takes approximately 0.02 hours (1 minute) to respond to the request.

TRIPwire Questionnaire

The questionnaire is sent out quarterly to two groups of registered users. The first group receives the questionnaire in the first and third quarters and the second group receives the questionnaire in the second and fourth quarters. OBP estimates approximately 500 responses are received each quarter. Thus, each group submits 1,000 responses annually and there may be two responses per respondent. It takes approximately 0.08 hours (5 minutes) to complete the questionnaire.

Labor Cost Estimate

To estimate the labor costs for respondents to complete the new user registrations, annual revalidations, and questionnaires OBP uses the average hourly compensation rates for SLTT law enforcement and emergency personnel, and private-sector security personnel, because TRIPwire was designed and is marketed to bomb squad, law enforcement, emergency services, and security personnel in state, local, tribal, and territorial (SLTT) governments or the private sector. OBP used Bureau of Labor Statistics (BLS) data to estimate the average hourly wage rate for SLTT police and sheriff’s patrol officers (hereafter referred to as police officers), SLTT emergency management directors, and private-sector security personnel.² The weighted average hourly wage rate for SLTT respondents is $37.17,³ while the average hourly wage rate for private-sector security personnel is $19.44. To account for benefits, OBP multiplies the wage for SLTT police officers and emergency management directors by a compensation factor of 1.6235, and the private security personnel wage by a compensation factor of 1.4220. ⁴ The average hourly compensation rate for respondents is $38.69.⁵

Accordingly, OBP estimates that the annual burden on respondents will be 422 hours with a total labor cost of $16,333, as show in in Table A12.

Table A12. Estimated Annualized Burden Hours and Costs

Form Name	Number of Respondents	Number of Responses per Respondent	Average Burden per Response (hours)	Total Time Burden (hours)	Average Hourly Compensation Rate	Total Labor Cost
TRIPwire New User Registrations	1,333	1	0.167 (10 min)	223	$38.69	$8,595
TRIPwire Revalidations	2,000	1	0.017 (1 min)	34	$38.69	$1,290
TRIPwire Questionnaire	1,000	2	0.083 (5 min)	166	$38.69	$6,448
Total	4,333			423		$16,333

Note: Totals may not sum due to rounding.

13. Provide an estimate of the total annual cost burden to respondents or record keepers resulting from the collection of information. (Do not include the cost of any hour burden shown in Items 12 and 14.)

The cost estimate should be split into two components: (1) a total capital and start-up cost component (annualized over its expected useful life); and (b) a total operation and maintenance and purchase of services component. The estimates should take into account costs associated with generating, maintaining, and disclosing or providing the information. Include descriptions of methods used to estimate major cost factors including system and technology acquisition, expected useful life of capital equipment, the discount rate(s), and the time period over which costs will be incurred. Capital and start-up costs include, among other items, preparations for collecting information such as purchasing computers and software; monitoring, sampling, drilling and testing equipment; and record storage facilities.



If cost estimates are expected to vary widely, agencies should present ranges of cost burdens and explain the reasons for the variance. The cost of purchasing or contracting out information collection services should be a part of this cost burden estimate. In developing cost burden estimates, agencies may consult with a sample of respondents (fewer than 10), utilize the 60-day pre-OMB submission public comment process and use existing economic or regulatory impact analysis associated with the rulemaking containing the information collection as appropriate.

Generally, estimates should not include purchases of equipment or services, or portions thereof, made: (1) prior to October 1, 1995, (2) to achieve regulatory compliance with requirements not associated with the information collection, (3) for reasons other than to provide information to keep records for the government, or (4) as part of customary and usual business or private practices.

There are no recordkeeping, capital, start-up or maintenance costs associated with this information collection.

14. Provide estimates of annualized cost to the Federal Government. Also, provide a description of the method used to estimate cost, which should include quantification of hours, operational expenses (such as equipment, overhead, printing, and support staff), and any other expense that would have been incurred without this collection of information. You may also aggregate cost estimates for Items 12, 13, and 14 in a single table.



TRIPwire Registrations

The Federal Government contracts support staff that will review and process each submitted TRIPwire registration. The help desk staff earn a salary equivalent to Computer Support Specialist at an hourly compensation rate of $43.51.⁶

OBP estimates that it will take the help desk staff approximately 0.12 hours (7 minutes) to complete the registration review process. Given the estimate of 1,333 respondents, help desk staff will require approximately 156 hours to process user registrations. Processing user registrations will cost $6,767 annually (156 hours × $43.51 per hour).

TRIPwire Revalidations

The TRIPwire revalidation process is automatically generated by the system and does not require review by a help desk or government staff member. Therefore, there is no burden to the Federal government related to the TRIPwire revalidations.

TRIPwire Questionnaire

The questionnaire results are initially compiled by the help desk contract support. It takes one help desk staff member approximately 3 hours to compile the results each quarter (i.e., approximately 0.006 hours per report). The results are then sent to the TRIPwire program manager (GS 14, Step 2) for review. It takes approximately 2 hours to review the results each quarter. The compensation rate for a GS 14, Step 2 staff member is $116.78 per hour.⁷ Compiling and reviewing the questionnaires will result in 20 annual burden hours and cost $1,442.

Accordingly, the total estimate annual cost to government is $8,209 (see Table A14).

Table A14: Estimated Annual Federal Government Burden Hours and Costs

Form Name	Number of Reports	Average Burden per Report (hours)	Total Time Burden (hours)	Average Hourly Compensation Rate	Total Labor Cost
TRIPwire User Registration Processing	1,333	0.117 (7 min)	155.5	$43.51	$6,767
TRIPwire Questionnaire - Compilation	2,000	0.006 (1 min)	11.7	$43.51	$508
TRIPwire Questionnaire – Review	4	2.00	8.0	$116.78	$934
Total	3,337		175.2		$8,209

Note: Totals may not sum due to rounding.

15. Explain the reasons for any program changes or adjustments reported in Items 13 or 14 of the OMB Form 83-I. Changes in hour burden, i.e., program changes or adjustments made to annual reporting and recordkeeping hour and cost burden. A program change is the result of deliberate Federal Government action. All new collections and any subsequent revisions of existing collections (e.g., the addition or deletion of questions) are recorded as program changes. An adjustment is a change that is not the result of a deliberate Federal Government action. These changes that result from new estimates or actions not controllable by the Federal Government are recorded as adjustments.

There are no changes to the collection since the previous OMB approval.

Annual burden cost and the annual government cost due to upward adjustments in loaded hourly wage rates. The annual burden cost increased by $2,597 and the annual government cost increased by $762.



16. For collections of information whose results will be published, outline plans for tabulation and publication. Address any complex analytical techniques that will be used. Provide the time schedule for the entire project, including beginning and ending dates of the collection of information, completion of report, publication dates, and other actions.



The results of this information collection will not be published.

17. If seeking approval to not display the expiration date for OMB approval of the information collection, explain reasons that display would be inappropriate.



CISA will display the expiration date for the Office of Management and Budget’s approval of this information collection.

18. Explain each exception to the certification statement identified in Item 19 “Certification for Paperwork Reduction Act Submissions,” of OMB Form 83-I.

CISA does not request an exception to the certification of this information collection.

1 OBP estimates that in Year 1, there will be 2,000 registrations, while in Year 2 and Year 3, there will be 1,000 registrations each. Therefore, OBP estimates that on average, there will 1,333 registrations per year.

2

BLS. Occupational Employment Statistics. OES Data. May 2023: All Data.

Police and Sheriff’s Patrol Officers (33-3051): https://www.bls.gov/oes/2023/may/oes333051.htm

Emergency Management Directors (11-9161): https://www.bls.gov/oes/2023/may/oes119161.htm

Security Guards (33-9032): https://www.bls.gov/oes/2023/may/oes339032.htm

The 2023 OES data indicates there are 549,340 local police officers with an average hourly wage of $36.89; 55,760 state police officers with an average hourly wage of $39.54; 6,430 local emergency management directors with an average hourly wage of $40.74; 1,810 state emergency management directors with an average hourly wage of $36.99; and 1,202,940 private-sector security guards with an average hourly wage of $19.44.

3

$37.17 per hour = (55,760 state police officers × $39.54 per hour + 549,340 local police officers x $36.89 per hour + 1,810 state emergency management directors × $36.99 per hour + 6,430 local emergency management directors x $40.74 per hour) ÷ (55,760 state police officers + 549,340 local police officers + 1,810 state emergency management directors + 6,430 local emergency management directors).

4

BLS. Employer Costs for Employee Compensation, September 2024. https://www.bls.gov/news.release/archives/ecec_09102024.htm

The compensation factor of 1.6235 for state and local government workers is estimated by dividing total compensation ($61.37) by wages and salaries ($37.80) from Table 3. The compensation factor of 1.4220 for private-sector workers is estimated by dividing total compensation ($43.94) by wages and salaries ($30.90) from Table 4.

5

$38.69 per hour = [(($60.35 per hour × (55,760 state police officers + 549,340 local police officers + 1,810 state emergency management directors + 6,430 local emergency management directors)) + ($19.44 per hour x 1,202,940 private security guards)] ÷ (55,760 + 549,340 + 1,810 + 6,430 + 1,202,940)

6

The hourly compensation rate is the BLS mean hourly wage for a computer support specialist of $31.95 (15-1230, https://www.bls.gov/oes/2023/may/oes_nat.htm#15-0000) multiplied by the compensation load factor of 1.4220 for private-sectors workers as defined above.

7 The compensation rate is estimated as the hourly salary for a GS 14, Step 2 staff member in the Washington, D.C. area of $69.02 (https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/salary-tables/24Tables/html/DCB_h.aspx ) multiplied by a compensation factor of 1.6919 for Federal government workers (Congressional Budget Office. Comparing the Compensation of Federal and Private-Sector Employees, 2011 to 2015. April 2017. https://www.cbo.gov/publication/52637. According to Table 4, Average Total Compensation for all levels of education is $64.80. According to Table 2, Average wages for all levels of education is $38.30. We estimate the compensation factor by dividing total compensation by average wages).