04.04_SSJ_Redacted.pdf

OFFICE OF ACQUISITION MANAGEMENT

ICE Acquisition Manual 3006.301-90

FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE

SOLE SOURCE JUSTIFICATION: SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS EXCEEDING SAT, INCLUDING BRAND NAME

Page 1 of 6 Version 1.1

J&A-21-00371

Pursuant to the requirements under the authority of simplified procedures for commercial items at 41 U.S.C. 1901as implemented by Federal Acquisition Regulation (FAR) Subpart 13.501 and consistent with the content requirements of FAR 6.303-2.

1. Agency and Contracting Activity.

The Department of Homeland Security, U.S. Immigration and Customs Enforcement, Office of Acquisition Management, proposes to enter into a contract on behalf of Homeland Security Investigations (HSI), National Intellectual Property Rights Coordination Center (IPR Center) on a basis of other than full and open competition.

2. Nature and/or description of the action being approved.

(a) Type of action: Firm-fixed price contract. New action.

(b) Amount the current J&A is justifying: $2,030,000.00

(c) Brief Description: Investigations & Operations Support Dallas (IOSD) intends to procure, on a sole source basis, access to National Cyber-Forensics & Training Alliance’s (NCFTA) forensic and analytical information sharing capabilities. This action is being taken pursuant to the authority of FAR 13.501. The vendor listed below is the only known source capable of providing the necessary information that is required by the IPR Center.

National Cyber-Forensics and Training Alliance Limited 2000 Technology Dr, Suite 450 Pittsburg, PA 15219

3. Description of Supplies/Services. Describe the supplies or services to be acquired.

Provide the estimated total value (including options, if any).

This requirement is for access to NCFTA’s forensic and analytical information sharing capabilities that are required by the National Intellectual Property Rights Coordination Center (IPR Center) to combat commercial fraud, such as identity theft, and IPR crime that threatens both the U.S. economy and the public’s health and safety. NCFTA is the only known source capable of providing the necessary information that is required by the IPR Center. This information provided during the performance of the contract will be used by HSI. on site access to information intelligence, technical support, and analytical support.

FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE

Page 2 of 6 Version 1.1

Period Period of Performance Amount Base Year 9/26/2021 – 9/25/2022 $406,000.00 Option Period One 9/26/2022 – 9/25/2023 $406,000.00 Option Period Two 9/26/2023 – 9/25/2024 $406,000.00 Option Period Three 9/26/2024 – 9/25/2025 $406,000.00 Option Period Four 9/26/2025 – 9/25/2026 $406,000.00

Total $2,030,000.00

4. Identification of the authority.

This action is being taken under the authority of Simplified Procedures for Commercial Items, 41 U.S.C. 1901 as implemented by FAR 13.501.

5. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

The White House issued an Executive Order titled, Improving the Security of Consumer Financial Transactions. The White House specifically named the NCFTA as an entity that DHS must coordinate with:

Sec. 2 (a) by February 15, 2015, the Attorney General, in coordination with the Secretary of Homeland Security, shall issue guidance to promote regular submissions, as appropriate and permitted by law, by Federal law enforcement agencies of compromised credentials to the National Cyber-Forensics and Training Alliance's Internet Fraud Alert System.

The National Cyber-Forensics & Training Alliance (NCFTA) is a 501(c) (3) non-profit corporation, was created with the mission of facilitating collaboration between private industry, academia, and law enforcement to identify, mitigate and neutralize complex cyber related threats. The NCFTA’s 52 member onsite combined staff includes analysts, managers, FBI, ICE’s Homeland Security Investigation (HSI), Customs and Border Protection (CBP), U.S. Secret Service and U.S. Postal Inspection Service agents/analysts, State and Local law enforcement, members of academia, and industry representatives. The NCFTA regularly hosts temporary duty assignments from national and international law enforcement agencies and private sector companies. The NCFTA is also partnered and co-located at the Internet Crime Complaint Center (IC3).

The only partnership of its kind in the world, the NCFTA develops joint initiatives that bring focus to our unique collaborative model and contributes to a timelier understanding of the most significant cyber threats, as well as other noteworthy trends. In doing so, the NCFTA has established an expansive alliance between subject matter experts (SMEs) in the academic, public and private sectors consistent with our mission. In doing so the NCFTA easily adapts to meet new threats through a steady influx of personnel and ideas and facilitates the timely sharing of actionable intelligence.

FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE

Page 3 of 6 Version 1.1

The NCFTA functions as a conduit between private industry and law enforcement with a core mission to identify, mitigate, and neutralize cyber-crime. In an effort to streamline intelligence exchange, the NCFTA will often organize SMEs interaction into threat-specific initiatives. Once a significant online scheme is realized and a stakeholder consensus defined, an initiative is developed wherein the NCFTA manages the collection and sharing of intelligence with the affected parties, industry partners, appropriate law enforcement, and other SMEs. The NCFTA is the only partnership of its kind in the world that receives cyber-crime intelligence voluntarily provided by the private sector for use in strategic intelligence threat development that is shared by agreement of all parties directly with U.S. law enforcement. This intelligence comes into the NCFTA through NCFTA organized and managed initiatives.

Resources unique only to NCFTA include target centric analyses, intelligence assessments, “one-off” and affiliate network reports, and monthly and quarterly initiative summaries. A “one-off report” is an analysis of one suspect website; an affiliate network typically runs up to 200 domains at once and is traced by unique hash value identifiers that serve as the digital fingerprint of an online file. The information contained in the report is culled from both various open-source databases and private industry leads and intelligence. The NCFTA keeps a historical database of all researched websites, allowing them to trace and link inactive websites with current sites.

NCFTA also has access to partner information. Partner information can corroborate and enhance an investigative lead, as well as be the originating source for a successful investigation. Examples of partner information may be consumer complaint data housed by the NWC3 and IC3, private listservs belonging to internet service providers, and confidential data housed in industry databases. The intelligence provided by industry may even be real time data that is transferred to NCFTA databases through advanced IT systems. This service is only available to ICE if we enter into a formal contract with the NCFTA.

The NCFTA is also unique in that it allows industry to share intelligence with other companies in their sector through confidentiality agreements and through their status as a non-profit organization. Without the NCFTA’s partnership, industry may be less inclined to share intelligence with their competition. The NCFTA collates this intelligence into a comprehensive analytical report, ultimately providing their law enforcement partners with a greater perspective on emerging crimes affecting entire industries.

The NCFTA is also used as a portal for law enforcement to anonymize and direct non-actionable leads back to industry for trend analysis, industry updates, etc. This service would allow ICE-HSI to gain industry wide input and potentially gather additional evidence for a criminal investigation. ICE-HSI currently does not have a method by which to file and strengthen non-actionable leads.

FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE

Page 4 of 6 Version 1.1

6. Description of efforts made to ensure that offers are solicited from as many potential sources as is practicable.

This is sole-source action that is being taken under the authority of Simplified Procedures for Commercial Items, 41 U.S.C. 1901 as implemented by FAR 13.501.

OAQ intends to post a notice of intent to sole source and make a redacted version of this justification publicly available pursuant to FAR 13.501(a)(1)(iii) and 6.305(a) within 14 days after contract award.

7. Determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

ICE OAQ-MSD awarded a contract (HSCEMD-16-P-00098) for a period of five years performance with NCFTA and HSI/IPR center in which the pricing was determined to be fair and reasonable. The CO will determine whether the anticipated pricing under the new order is fair and reasonable by comparing it to the historical pricing of the previous order. The Market Research Report also discusses the GA Report, “GAO-07-705: Cybercrime: Public and Private Entities FAC Challenges in Addressing Cyber Threats” and a White House Report dated May 2009.

8. Description of market research.

The Market Research Report drafted by the IPR Center discusses the Executive Order cited above in Section 5 of this SSJ and a GAO Report, “GAO-07-705: Cybercrime: Public and Private Entities Face Challenges in Addressing Cyber Threats”. It also discusses Internet research of other organizations working with the U.S. government to combat cyber and IPR crime. The IPR Center also engaged FBI personnel to gain perspective on an established NCFTA partnership. Through this research, it has been determined that while there are other facilities that focus on cyber and/or IPR crime, no organizations have a comparative global network of partners.

9. Any other facts supporting the justification.

Not Applicable.

10. A listing of the sources, if any that expressed, in writing, an interest in the acquisition.

No other sources have provided, in writing, in interest in this acquisition.

FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE

SOLE SOURCE JUSTIFICATION: SIMPLIFIED PROCEDURES FOR CERTAIN

COMMERCIAL ITEMS EXCEEDING SAT, INCLUDING BRAND NAME

Page 5 of 6 Version 1.1

11. A statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for supplies or services required.

In order to remove barriers to competition for subsequent actions, the IPR Center will continue to conduct market research to find other sources that offer services comparable to those offered by NCFTA.

12. DHS intends to post the requirement pursuant to FAR 13.501(a)(1)(iii) and 6.305(a).

13. Technical/Requirements Personnel Certification.

I certify that the requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Date

Unit Chief, Intellectual Property Unit National IPR Coordination Center Homeland Security Investigations

14. Contracting Officer’s Certification.

I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Chris Trujillo Contracting Officer

09/20/2021_ _

Digitally signed by

CHRISTOPHER H TRUJILLO

Date: 2021.09.21 05:46:57 -05'00'

FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE

Page 6 of 6 Version 1.1

15 Approval.

Albert J. Dainton Competition Advocate Office of Acquisition Management (OAQ) U.S. Immigration and Customs Enforcement (ICE)

ALBERT J

DAINTON

Digitally signed by ALBERT J

DAINTON

Date: 2021.09.21 14:28:18 -04'00'