Attachment_No.2_-_SOW.pdf

Public Source Program Office for the

Office of the Chief Information Officer

Social Media Alerting Statement of Work

Request for Proposal Number

15F06720R0000063

1/17/2020

FEDERAL BUREAU OF INVESTIGATION

Statement of Work – ATTACHMENT TWO

1 Scope

This Statement of Work (SOW) describes the Federal Bureau of Investigation's (FBI) requirements to proactively monitor and respond to threats to U.S. national security interests via early alerts from online, social media platforms.

2 Background

Social media platforms are often used as the first means of alerting to various threats, natural disasters, and crimes; sometimes before the authorities are called. Through this procurement, the FBI seeks to acquire a Commercial-off-the-shelf (COTS) social media alerting tool that will allow for the receipt of publicly available data from social media platforms. The intent is not to “scrape” or otherwise monitor individual social media activity. Instead, the requirement seeks to identify an immediate alerting capability to better enable the FBI to quickly respond to ongoing national security and public safety-related incidents.

3 Requirements

3.1 Early alerting of ongoing national security and public safety-related incidents

3.1.1. The social media alerting tool (“the tool”) shall provide notifications to FBI users of national security and public safety incidents in real time.

3.1.1.1 “Real time” is defined as No Later Than (NLT) one minute before incidents are reported via applicable global media sources.

3.2.1.2 “National security incident” is defined as an event/activity that threatens the security of the U.S., including its citizens, economy, infrastructure, and institutions, which is regarded as a duty of the government.

3.2.1.3 “Public safety incident” is defined as an event/activity that threatens the welfare and safety of the general public.

3.1.2 The tool shall provide registered users with notifications of national security and public safety incidents via contractor-developed algorithms and methods.

3.1.3. Alerts provided shall be vetted by the contractor for accuracy and relevancy before they are provided to the end user.

3.1.3.1 “Accuracy” is defined as alerting that reflects correct information regarding incidents as they are happening, and is free from false information, unnecessary embellishment, or incorrect logistical details (e.g., wrong timeframe or geolocation).

3.1.3.2: “Relevancy” is defined as information that satisfies the needs of the end user and relates to current, ongoing national security and/or public safety incidents

3.1.3.3: Based on mission need, the FBI may provide additional relevant alert criteria after award. The contractor shall incorporate all additional criteria into available alerting algorithms.

3.1.4. The tool must allow for review of notifications before such information can be saved to FBI systems.

3.1.5. The tool must provide FBI users the ability to delete alerts and manage retention of information collected.

3.1.6. The FBI must be able to audit use of the tool.

3.1.6. The tool must have the capability to deactivate any geofencing, tracking, and scraping functionalities if they are a standard capability of the tool.

3.1.6.1. “Geofencing” is defined as the use of GPS technology to create a virtual geographic boundary, enabling software to trigger a response when a mobile device enters or leaves a particular area.

3.1.7 The tool shall not automatically download any information collected to an FBI system of records, as defined in the Privacy Act, 5 U.S.C. § 552a(a)(5).

3.1.8 The tool should not retain information, or if it does retain information, it must self-purge such information every 7-10 days.

3.1.9. All information provided to the FBI by the tool shall be legally obtained, and in accordance with law, regulation, policy, and applicable social media platform terms of service and privacy policies.

3.2 Worldwide scope via alerting from multiple social media platforms

3.2.1. The tool shall provide alerting notifications from multiple existing social media platforms.

The content of such notifications shall be derived only from publicly available, open source information.

3.2.2. Each alert shall provide a specific location and timestamp for the relevant event.

3.3 Customization based on location, content, and other user-created filters.

3.3.1. Information constituting advanced notification is derived from constant monitoring of publicly available data on social media platforms based on contractor-developed algorithms and/or keywords relevant to national security and location.

3.3.2. At a minimum, notifications shall be sent via email to either an FBI team account or individual FBI user accounts based on real-time incidents occurring in designated location(s) of interest. Subject to FBI security approvals, notifications may also be sent via a contractor-developed mobile application.

3.3.3. The tool shall permit individual end users to customize notifications based on delivery frequency, content of interest, date and time period of interest, and geographical layers.

3.3.3.1. The tool shall support content filtering based on prioritization, subject matter, identifiers, geographic location, keywords, and photographic tagging.

3.3.3.2. The tool shall permit end users to create filters for alerts specific to the user’s mission requirement and monitor information captured through that filter. The tool shall also permit the end user to seek relevant historical publically available data from social media platforms for further analysis.

3.4 Accessible on multiple devices via email and mobile application(s)

3.4.1. FBI personnel, authorized joint task force personnel, and authorized support-contractor personnel shall be able to access the information via web browser and through multiple devices, to include desktop and FBI-issued mobile devices. Some mobile devices may require the download of an application. The latter can only be made available after thorough vetting by the FBI’s Mobility Program Office.

3.5 Security controls ensure accuracy and reliability of alerting information

3.5.1. In the event of a cybersecurity breach involving the contractor’s tool that could potentially impact the accuracy and reliability of reported alert information, the contractor shall notify the FBI of the incident NLT two (2) hours after discovering the breach.

3.5.2. The tool must pass an FBI Security Risk Assessment.

3.6 Training

3.6.1. Contractor shall provide web-based training available on demand to all FBI personnel using the tool. Upon request, contractor shall provide in-person training regarding tool functionality. An interactive web-based course may count as in-person, as long as the needs of the users are fully met. All training must comply with accessibility standards as defined in Section 508 of the Rehabilitation Act of 1973.

3.6.1.1. Contractor shall develop initial training for all new users upon account creation.

3.6.1.2. Contractor shall provide refresher training when a new release of the tool is available to the FBI, including when the tool is modified to ingest material from new social media sources.

3.6.1.3. Contractor shall provide written user manuals, basic operating procedures, etc.

Written materials shall be updated to reflect new releases and features NLT three business days after a new feature or release is available.

3.7. Helpdesk Support

3.7.1. Contractor shall maintain a helpdesk call line and email address to assist with requests for support from FBI end users. The call line shall be staffed twenty-four hours a day, seven days a week. Emails from overseas offices shall receive a contractor response NLT 12 hours after receipt. Domestic calls and emails small receive a contractor response NLT 2 hours from receipt.

4 Contract POCs

For daily operations, the Office of the Chief Information Officer (OCIO), Public Source Program Office (PSPO), will be the direct counterpart to the Contractor’s management personnel and will provide guidelines for communication. Announcements and general notifications will be conveyed to users through the PSPO, unless the selected offeror is responding to a direct helpdesk inquiry.

No communication pertaining to new capabilities, business development, surveys or contract notification are to be addressed by the Contractor directly to the users, without the approval of coordination of the Contracting Officer in coordination with PSPO staff.

5 User account management

Access to public records data will be used only for authorized investigative purposes, and therefore, must be internally closely monitored. The offeror must provide account and username management. Because users span across all Field offices and Resident Agencies (RAs) as well as HQ Divisions, the monitoring of accounts along with usage will require different levels of administrative rights for FBI personnel.

6 Monitoring and reporting

Monthly reports are received by the 10th of each month. These monthly reports are distributed via email to the aforementioned FBI Contracting Officer and Contracting Officer’s Representative (COR). Any additional recipient must be approved by the COR. Monthly reports are delivered in an excel file format. The monthly report includes all the below:

• Activities, Accomplishments, and Issues reports

• Monthly Summary and Detailed Usage reports (metrics only, no content) o individual account o team account o batching

• Monthly Account Listing reports broken down by field office (if information is provided by the user) o New accounts o Deleted accounts o Transferred accounts

• Completed training sessions broken down by locations (if available), subject and list of attendees

7 Reoccurring Meeting

While monthly meeting are preferred, quarterly meetings are possible with the CO’s or COR’s agreement. Meetings can occur via conference calls, but must occur in person at least twice per year with either the CO and/or the COR in attendance. The standard agenda is below but can be modified as needed with the CO’s and/or COR’s permission

- Contract o Invoice status

- Reports o Usage (Previous Month and Current Fiscal year to date) o Account maintenance activity

- Training o Completed trainings to date (current FY) o Upcoming trainings

- System upgrades/changes o Release notes o Impact on users

- Vendor’s new capabilities and recommendations o Presentation o Pricing model (license/account/usage)