1.5.1-SSJ_Redacted.pdf

OFFICE OF ACQUISITION MANAGEMENT

ICE Acquisition Manual 3006.301-90

SOLE SOURCE JUSTIFICATION FOR SIMPLIFIED ACQUISITIONS NOT EXCEEDING

THE SIMPLIFIED ACQUISITION THRESHOLD (INCLUDING BRAND NAME)

SOLE SOURCE JUSTIFICATION

FAR 12.102, FAR Class Deviation 25-21, Rev. 1 for FAR Part 12 (41 U.S.C. 1901)

J&A-26-0080

Pursuant to the requirements under the authority of simplified procedures for commercial items at 41 U.S.C. 1901 as implemented by Federal Acquisition Regulation (FAR) 12.102, FAR Class Deviation 25-21, Rev. 1 for FAR Part 120F

1 and consistent with the content requirements of FAR 6.303-2.

1. Agency and Contracting Activity.

The Department of Homeland Security (DHS) Immigration and Customs Enforcement (ICE), Office of Acquisition Management (OAQ), proposes to enter into a contract on behalf of the Homeland Security Investigations (HSI) Cyber Crimes Center (C3) on a basis of other than full and open competition.

2. Nature and/or Description of the Action being Approved.

(a) Nature of action: DHS/ICE intends to procure, on a sole source basis, software licensing to support student participants of the Treasury Computer Forensics Training Program (TCFTP), which conducts computer forensics training for HSI, the U.S. Secret Service (USSS), and the Internal Revenue Service (IRS). The licenses will be used in upcoming Basic Computer Evidence Recovery Training (BCERT) classes for hands-on training exercises throughout the program and for forensic examinations in the field.

The company below is the only company that can provide the required license.

Passware, Inc.

800 W El Camino Road, Suite 180 Mountain View, CA

(b) Contract type: New, Firm-Fixed Price (FFP) Purchase Order

(c) Estimated total value:

Period Unit Price Total

Base Year

12 mo.

$ ea

1 FAR Class Deviation 25-21, Rev. 1 for FAR Part 12 was issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025. Any subsequent citations to FAR Part 12 in this document will be cited as “RFO FAR” for brevity, and are referring specifically to FAR Class Deviation 25-21, Rev. 1 for FAR Part 12.

SOLE SOURCE JUSTIFICATION FOR SIMPLIFIED ACQUISITIONS NOT EXCEEDING

Total $

(d) Type of funding: Operations and Maintenance Funds (O&M)

(e) Year of funding: Fiscal Year (FY) 2026

(f) Solicitation number: Not Applicable

3. Description of Supplies/Services.

This requirement is for fifty-five (55) Passware Kit ULTRA Software Licensing (inclusive of Passware Kit Forensic, Passware Kit Mobile, Device Decryption add-on, 100 Passware Kit Agents and Online Training) to support student participants of the TCFTP. The TCFTP conducts computer forensics training for HSI, the USSS and the IRS. In support of TCFTP, HSI Computer Forensics Unit (CFU) will host two (2) BCERT classes where students will use Passware, Inc. licenses for hands-on training exercises throughout the program and for forensic examinations in the field.

BCERT is the entry level training required for the purpose of becoming a Computer Forensic Agents/Analysts (CFA). The six-week BCERT will teach the CFA imaging, best practices for digital evidence, digital triage, processing digital media, analyzing digital evidence and report writing. It covers basic forensics topics including the following: Virtual Machines, BIOS, Windows Operating Systems, Number Systems (Binary, Decimal, Hexadecimal, Little Endian, Big Endian), Disk Structures, File Systems (FAT, NTFS), RAIDs, Data Acquisition (Live Imaging, Dead-box Imaging, RAM Capture, Volatile Data), Hashing, Encryption, Forensic Explorer, AXIOM, and Legal Issues. The Passware Kit ULTRA software licenses are needed by the students for hands on training exercises throughout the training program and for forensic examinations in the field.

Passware Kit ULTRA is the main tool used within the Computer Forensics Program (CFP) for password decryption. Passware Kit ULTRA and Password EFS Keys help investigators to discover encrypted electronic evidence and decrypt it quickly. This software combines fast encryption detection engines, password recovery modules for 200+ file types, batch processing, and a portable version to meet all the requirements of the CFP. The tool cracks passwords for documents, archives, databases and hard drives, Windows and Mac users, email accounts and websites. Many types of passwords are recovered or reset instantly. To achieve the highest speed, Passware Kit Forensic uses distributed password recovery and cloud computing, NVIDIA and ATI GPU hardware acceleration. Multiple files are processed simultaneously. Passware Kit ULTRA is the only commercial software capable of instant decryption of BitLocker, TrueCrypt, FileVault2, and PGP hard disks.

Additionally, Passware Kit ULTRA and EFS Keys can be integrated into Guidance Software EnCase, which is one of the main forensic suites employed by the CFP. CFAs can now find

SOLE SOURCE JUSTIFICATION FOR SIMPLIFIED ACQUISITIONS NOT EXCEEDING

and analyze encrypted evidence due to the Passware encryption analysis module in Guidance EnCase (starting from v7) and then use Passware Kit ULTRA for decryption and password recovery. This provides immediate encryption analysis of evidence files with further password cracking and decryption.

Passware, Inc. is the only vendor that can provide the required license.

4. Identification of Statutory Authority Permitting Other Than Full and Open

Competition.

This action is being taken under the authority of Simplified Procedures for Commercial Items, 41 U.S.C. 1901 as implemented by FAR 12.102.

5. Identification of Exception to the Buy American Statute.

Not Applicable.

6. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

The abilities of CFAs will be impacted by possible delays in supporting the HSI, USSS, and IRS criminal investigations if the Passware license is not procured. Furthermore, this may lead to an interruption or halt in performing day-to-day forensic examination operations.

Passware Kit ULTRA Software Licensing supports forensic imaging hardware solutions issued to new CFAs in BCERT. Failing to hold this training class would jeopardize the number of active and available CFAs in HSI, USSS, and IRS, and could compromise the timely seizure and analyzation of data related to ongoing investigations. This application is critical to the Government’s requirements. Passware Kit ULTRA Software Licensing meets the unique needs and requirements of CFP.

The C3 CFP requires Passware licenses because Passware is currently the most effective password recovery and decryption tool available, and its issuance to CFAs in the field is critical for evidence recovery during criminal investigations.

The C3 CFP requires decryption software licenses that are available for offline use to ensure operational capability in field environments without internet access. The program also mandates access to training via an online portal featuring a start-stop module system, enabling agents and analysts to learn at their own pace. Additionally, the decryption tool suite must be fully integrated into current law enforcement sensitive internal Computer Forensic Program processes, supporting seamless evidence recovery workflows. The tool suite must be capable of processing encrypted information from a wide range of environments and targets, including various encryption algorithms, laptops, desktop computers, mobile devices, chipset-specific encryption, and other encrypted platforms. It must also support graphics-based acceleration and distributed processing, operate in a

SOLE SOURCE JUSTIFICATION FOR SIMPLIFIED ACQUISITIONS NOT EXCEEDING

logged environment, and provide comprehensive report generation to document evidence recovery activities.

Other decryption tools that C3 tested include Elcomsoft Password Recovery, Hashcat, John the Ripper, and Oxygen Forensics. These were evaluated against the C3 CFP requirements and relevant DHS policies. Each tool was found to be lacking for the following reasons:

Elcomsoft Password Recovery:

While Elcomsoft offers broad password recovery capabilities, it does not provide access to training via an online portal featuring a start-stop module system, which is required by C3. Most critically, Elcomsoft is owned and headquartered in a country identified as having national security concerns to the United States, which prohibits its use by DHS components due to supply chain and risk management policies.

Hashcat:

Hashcat is an open-source password cracking tool. It lacks the necessary forensic workflow integration required by C3. Additionally, the use of open-source software introduces security concerns, including the potential for unvetted code, lack of formal support, and increased risk of vulnerabilities or malicious code insertion. Hashcat also does not support BitLocker decryption or decryption of Apple Mac computers with the T2 security chip and does not provide training via an online portal featuring a start-stop module system, which is required by C3.

John the Ripper:

Similar to Hashcat, John the Ripper is an open-source password cracking tool primarily designed for password cracking and lacks forensic-specific features. It does not offer the required documentation or support for enterprise use within DHS. John the Ripper also has the same open source and training issues as Hashcat.

Oxygen Forensics:

Oxygen Forensics provides some decryption and password recovery functions, but its primary focus is on mobile device forensics. Its decryption capabilities are limited because it is incapable of processing encrypted information from a wide range of environments and targets, including various encryption algorithms, laptops, desktop computers, chipset-specific encryption, and other encrypted platforms, which is required by C3.

Passware Kit ULTRA software licenses are critical to the CFP to ensure operational continuity of mission critical operations. Without Passware Kit ULTRA software licenses, the TCFTP’s critical functions related to the discovery of encrypted electronic evidence and decrypt it rapidly would not be possible. These licenses are used strictly for forensic purposes by the DHS/HSI CFAs and do not touch the DHS Enterprise Network.

7. Description of Efforts Made to Ensure that Offers are Solicited from as Many Potential

Sources as is Practicable.

SOLE SOURCE JUSTIFICATION FOR SIMPLIFIED ACQUISITIONS NOT EXCEEDING

A notice of intent to solicit from a single source was posted on SAM.gov on February 11, 2026, with a closing date of February 16, 2026, allowing parties to express their interest in writing to the Contracting Officer. No parties expressed interest.

OAQ intends to make this justification publicly available pursuant to FAR 6.301, FAR Class Deviation 25-11, Rev. 1 for FAR Part 61F

2 on SAM.gov 14 days after award, along with the award notice.

8. Determination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable.

The Contracting Officer determined that the anticipated price(s) will be fair and reasonable based on market research and historical pricing found on similar previous purchases. The Contracting Officer may base the determination on: market research, comparison of the proposed price with prices found reasonable on previous purchases; current price lists, catalogs, advertisements, comparison with similar items in a related industry; the Contracting Officer’s personal knowledge of the item being purchased, comparison to an independent Government estimate; and/or any other reasonable basis to determine that the price at the time of award represents the overall best value for the Government and is fair and reasonable.

9. Description of Market Research.

(a) Market research was conducted from December 2025 to January 2026. The market research showed that only Passware, Inc. can provide the license. Passware, Inc.

confirmed via a sole source letter that they do not have any authorized distributors or resellers. A notice of intent to solicit from a single source was posted on SAM.gov on February 11, 2026, with a closing date of February 16, 2026. No parties expressed interest. Published pricing was reviewed to assist with making the price reasonableness determination.

10. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

Not Applicable.

11. A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the Acquisition.

2 FAR Class Deviation 25-11, Rev. 1 for FAR Part 6 was issued as part of the Revolutionary FAR Overhaul (RFO), which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025. Any subsequent citations to FAR Part 6 in this document will be cited as “RFO FAR” for brevity, and are referring specifically to FAR Class Deviation 25-11, Rev. 1 for FAR Part 6.