Attachment B - Statement of Work Amendment 2.pdf

UNCLASSIFIED

Attachment B – Statement of Work

Federal Bureau of Investigation (FBI)

Directorate of Intelligence

Tactical Social Media Exploitation Tool

Change History

Date Version Change Summary

12/17/2021 1.0 Initial Version

1/5/2022 2.0 Updated Version

1/21/2022 3.0 Amendment 2

1. Introduction

1.1 Background

The Directorate of Intelligence’s (DI) Strategic Technology Unit I (STU I) is responsible for managing internet search tools for Social Media Exploitation (SOMEX) of Publicly Available

Information (PAI). These tools are used by Special Agents, Intelligence Analysts, Staff Operations

Specialists (SOSs), and others around the FBI. The target materials are PAI, meaning no logins or court orders are required to access them. STU I requires tools that search on relevant websites to find

PAI reliably and quickly. These tools provide critical information without being intrusive because the data they return is publicly available.

The DI’s Strategic Technology Section (STS) is developing a comprehensive strategy that matches

SOMEX needs of the FBI workforce and its mission, incorporating broad and narrow-focused

SOMEX capabilities. The Bureau is looking to acquire access to a system that compliments its current capabilities. STS aims to identify a complimentary tool, or suite of tools, to improve the end user’s tactical capabilities to evaluate the holistic threat picture.

STS recently conducted a wide-reaching survey of users and needs to understand every level of enterprise SOMEX requirements and capability gaps. Some gaps currently limit our users’ ability to dive deeper into specific threats and potential threat actors. The FBI is searching for a solution to that problem.

During an investigation or command post, the FBI needs the ability to search against relevant social media sources where threat activity occurs. Users need to be able to define searches that return relevant scoped results in a simple interface. Additional tactical requirements include data aggregation that leads to social network analysis, geospatial mapping, and image analytics.

Furthermore, the ability to identify changes in social media profiles and broad access to publicly available information on the most widely used social media sources for enhanced link analysis is desired. At this time the FBI must identify a new tool, or suite of tools, that satisfy these gaps while also complimenting the strategic tool.

1.2 Scope

This contract will provide 5,000 licenses for a commercial off-the-shelf (COTS) software, including software maintenance support, training, and reach-back support, on a hybrid firm fixed price (FFP) basis with travel being reimbursed at cost. This contract is intended to satisfy the gaps in the FBI’s

SOMEX capabilities.

2. Requirements/Specifications The FBI requires a COTS PAI research software solution (“tool” or “software”) that can be used to search for relevant data on the open web and from public sites. The tool will be used to identify social media and mobile messaging data and other relevant PAI on persons of interest and their associates under legal authorities available in an FBI assessment or predicated investigations. It shall allow user-defined searches on key words and topics, as well as geofencing capabilities. The tool shall provide real-time alerting capabilities via email and contain language translation within the tool. The FBI defines geofencing as a virtual perimeter for a real-world geographic area. The

Contractor shall remain compliant with the FBI Domestic Investigations and Operations Guide

(DIOG).

The tool shall be able to gather information from the following mandatory online and social media data sources: Twitter, Facebook, Instagram, YouTube, LinkedIn, Deep/Dark Web, VK, and

Telegram.

The following platforms are preferrable: Snapchat, TikTok. Reddit, 8Kun, Gab, Parler, ask.fm, Weibo, Discord, additional fringe platforms, and other encrypted messaging platforms. There may be additional open platforms deemed necessary by the FBI. A Contractor may receive a strength for their ability to provide the preferrable data sources.

The software shall be a website which users can access easily over the FBI unclassified system. It shall allow FBI users to log in with generic accounts which do not indicate name or affiliation of the users. It shall be able to search and retrieve data from as many websites as possible, in a low-footprint and/or anonymous manner. A Contractor may receive a strength for their ability to provide more data sources that outlined by the Government.

2.1 Technical Requirements

The Contractor shall provide the FBI the following:

Licenses: 5,000 licenses with access to the search tool along with services behind the license

(updates, bug fixes, maintenance, etc.) for the above listed sources, at a minimum.

Maintenance: Operations and Maintenance (O&M) of the software shall be included, where software can be modified and improved based on reasonable requests. Continual updates, including user functionality, security patching, and number or sources provided, shall be available to handle the fluid environment of the open internet. Source updates shall be possible to the available data sources as new sources, websites, and useful internet pages are identified. The Government shall receive notice of changes, updates, and improvements to the system before they are implemented, if possible.

Customer Support: The Contractor shall provide a customer assistance helpdesk to address questions or issues from end users. The helpdesk shall be available 9:00am – 8:00pm Eastern Time, Monday through Friday. Furthermore, occasional after-hours access shall be provided for emergencies. The company shall provide an after-hours POC or contact mechanism for such 24/7 emergencies.

Training: Comprehensive training for new users, regular refreshers, and occasional specialized training shall be offered to make the users comfortable and successful using the tool. The company shall be open to creating new training if special needs arise. Training will primarily be virtual, though on-site training at FBI locations in Washington DC and some Field Offices around the U.S. may also be needed depending on Government needs. If travel is necessary to conduct on-site training, it will be conducted in accordance with Section 5 of this SOW.

Simple graphic user interface (GUI) and presentation: The tool shall be user-friendly enough that long-term, on-site technical assistance is not required. This shall be demonstrated before award of the contract by the Vendor providing screen shots and explanations of steps needed for basic functions in the system.

Anonymity: Searches of PAI portals and information shall be anonymous and managed by the tool.

Where possible, FBI users shall be able to log in with generic accounts which do not indicate name or affiliation of the users. At the same time, each user shall have their own log-in which can be tracked to know number of accounts and which persons have accounts. For receiving data in the vendor system, the anonymity shall include caching of the data and other technical methods that do not require users to log directly into target websites. By caching, it is meant that the system pulls data from the focus websites and stores it, so users are searching the vendor system rather than going to websites directly.

Control of Searches: The software shall provide the ability for a user to create, modify, and adjust queries and search terms when needed and on-the-fly. This would include most search parameters, such as being able to edit/modify target, data sources searched, and timeframes of the searches.

Alert capabilities: Alerts to the users based on pre-set queries shall be provided for both subjects and events. Alerts shall be delivered in email format outside the system, if possible, and/or within the system to a user’s account. The criteria that set alerts shall also be manageable by the user to be able to exclude items that are not useful, and to be able to modify the alerts to improve returns.

It is highly preferable that alerts be timely, close to real-time, or as soon as an item is found that meets the user’s criteria. Real-time or close to real-time, is defined as providing information within

8 minutes of it being posted on the open web.

Retention of the data returns: The information collected from online sources via the tool shall be retained in the Vendor’s system(s) and made available to users in their accounts through queries. The tool shall allow users to review information before it is exported/downloaded to any FBI systems— the tool shall not automatically download information to FBI systems. Persistent searches shall be set by users for up to 90 days maximum, at which time the search must be canceled and can be reset by users if needed. The data collected during those 90 days shall remain accessible to the users the entire time. The Government prefers that the Contractor retain data long-term (for at least a year, and longer when possible), to facilitate searches when new information is obtained by the FBI for past events. Users shall be able to manage the data returns within their accounts.

The following is a list of required and desirable technical capabilities for the tool. A Contractor may receive a strength if they are able to provide the desirable technical capabilities.

Primary/Required Capabilities

Keyword-Based Search: Keywords shall be a basic form used to collect data (e.g., usernames, email addresses, hashtags, demographic information, mentions, etc.). This shall include advanced search.

Information shall be returned in formats that can be ordered chronologically or by other important markers on the data. A Contractor may receive a strength for their ability to search for entities such as emoticons and similar internet functions.

Foreign Languages: Ability to handle foreign languages in searches and provide machine translation products, shall be built into the system and easily managed. The tool shall provide all of the following languages, along with any others possible: Spanish, Russian, Chinese, Arabic, French, Farsi, Korean. A Contractor may receive a strength if they are able to provide additional languages above those that are required.

Manipulation of Returned Data: The users shall have the ability to mark returned items as reviewed, priority, and other useful markings. The system shall also provide recommendations of helpful and better ways to search and options for maximizing returns.

Geo Capabilities: The tool shall include region/state, city, and custom geo-fencing bounding boxes.

User shall be able to pair keyword searches with geospatial capabilities to view all social media postings for a specific area. This shall be possible by location information that the user has made publicly available.

Aggregated Data Source: The ability to look at multiple data sources at one time for analysis shall be included. Users shall have access to a continuous data stream of all major and minor data sources, mobile apps, messaging apps, etc.

Link Analysis: Users shall have the ability to view connections between subject/posters, the subject’s network, linked accounts, catalogs of friends, follower lists, and biographical details. This shall be represented in useful, manipulatable charts and graphs.

Persistent Search: System shall provide the ability to monitor feeds without having to actively run multiple searches through many different platforms. In that way, alerts shall be generated and waiting for a user when they log into the system. These persistent searches will be for periods up to 90 days maximum but can be restarted at the end of that period at the request of the end user. The Government defines persistent search as the ability to monitor feeds on an active and continuous basis, with no end user action needed, for continued awareness of events and situations. The Government’s definition of persistent search includes the ability to schedule searches to occur on an interval to be determined by the end user, to include intervals as often as every 8 minutes.

Advanced Filtering Capabilities: The system shall provide the ability to create permanent filters based on various metrics. This capability goes beyond simple key-word search.

Timeline creation showing entity trends: The data shall provide the ability to not only be ordered chronologically, but to provide a timeline bringing in disparate sources and returns to create a picture of events as they unfolded.

Sentiment Analysis: Tool shall provide sentiment analysis, including emotion analysis, using word lists or natural language processing, to be able to determine likely attitudes of the targets.

Desirable capabilities

Predictive Analytics: Tool shall provide the ability to project the likely future trends based on the current state of the data.

Bot detection: The tool shall have the ability to identify false and automated accounts, such as bots.

Network-Based Search: The followers, likes, and commenters on a social media platform shall be used to collect data, wherever possible. When possible, those types of communications shall be available just as the primary content is available.

2.2 Data Sources:

The tool shall provide access to as many data/internet/PAI sources as possible, but must include those listed as mandatory in Section 2 of this SOW.

The FBI will evaluate sources on a regular basis and shall have the ability to request the Contractor add or remove sources as threats and threat actors change.

3 Period of Performance The period of performance (POP) is anticipated to be one (1) 12-month base year and four (4) exercisable 12-month option years as shown below:

Period Begin End

Base Year 3/1/2022 2/28/2023

Option Year 1 3/1/2023 2/29/2024

Option Year 2 3/1/2024 2/28/2025

Option Year 3 3/1/2025 2/28/2026

Option Year 4 3/1/2026 2/28/2027

The actual period of performance will be established at the time of award.

4 Place of Performance

Most of the performance will take place at the Contractor’s facilities.

The Contractor shall meet with the Government representatives on this contract when and if needed, either at the Vendor facility or at an FBI facility. The primary location for the Government representatives for this contract is Huntsville, AL, though meetings can also be virtual. Vendor personnel will be escorted at all times if the meeting occurs at an FBI facility.

5 Travel The Contractor may need to travel to an FBI Field Office, FBI conference, or other event to provide training or to participate in meetings. These instances will be handled on a case-by-case basis and require prior written approval by the Contracting Officer (CO).

Should the Government authorize travel (Contracting Officer (CO)/COR) pre-authorized in writing as a bona fide need, directly task related, or as an Other Direct Cost (ODC) under this SOW, such travel shall be conducted in accordance with Joint Travel Regulation (JTR), Federal Travel

Regulations (FTR) and FBI travel policies. The FTR is available at http://www.gsa.gov.

Travel will not be reimbursed within a 50-mile radius of the primary work site. No costs associated with commuting to and from one’s domicile to work locations will be authorized or reimbursed. The

Contractor shall minimize travel and encourage cost savings alternatives for meetings, e.g., teleconferencing.

If travel is approved, the Contractor shall provide receipts for all travel expenses incurred to the

CO/COR when invoicing. Only actual expenses will be paid with no mark-up for overhead or profit.

Travel reimbursements will be limited to the amount funded each base/option year unless otherwise modified. If required, the Government will establish a not-to-exceed (NTE) value for travel. The

Contractor shall notify the Government when it has reached seventy-five percent (75%) of this NTE total. At which time, the Government will reassess this NTE value and increase it if planned travel for the remainder of the period of performance is in excess of the funds remaining. Any increase will be subject to the availability of funds and prior Government approval.

6 Deliverables

Deliverable Title Deliverable Date Method of Delivery

User Materials, training aides, and system guides.

As outlined below Email

Monthly Status Reports 10th of each month Email

Meetings As requested In-person or Virtual http://www.gsa.gov/ http://www.gsa.gov/

6.1 User Materials, Training Aids, and System Guides

The Contractor shall provide all possible user materials, training aides, and system guides to assist users as they work in the system. These materials shall be provided to the Contracting Officer’s

Representative (COR) no later than (NLT) five (5) business days after receipt of the award and shall be in a virtual format where possible.

The Contractor shall provide updated materials as they become available.

6.2 Monthly Status Reports (MSR)

The Contractor shall submit a MSR to the Government no later than the 10th of each month.

6.2.1 Content

The report shall be unclassified and include, at a minimum, the following items:

• Statistical Data o Number of account holders o Number of active users o Number of terms searched

• Planned Updates o Any planned upgrades / system enhancements o Anticipated upgrades / system enhancements

6.3 Meetings

The Contractor shall attend and participate in regular meetings with the Government at an agreed upon medium, time and frequency. The attendees of these meetings will be dependent on the purpose of the meeting but shall include at a minimum the FBI COR, FBI Program Manager, and Contractor

Program Manager (or main Contractor point of contact). These meetings will primarily be virtual but may be in-person at an FBI location to be determined. The Government will provide no less than 14 days’ notice of their request to have an in-person meeting.

7 Security Vendor shall be a US-owned and US-based company. Vendor personnel working directly on the project (such as providing support, training, and setting up accounts) shall be US Citizens or permanent green-card holders.

The FBI has determined that performance of this effort does not require the Contractor to have access to classified National Security Information (herein known as classified information). However, the data the contractor may encounter in fulfilling this requirement will likely be Law Enforcement

Sensitive (LES) and shall be managed with care and not shared outside of the confines of the FBI or this contract.

The contractor shall comply with:

(1) The Security Agreement (DD Form 441), including the National Industrial Security

Program Operating Manual (DoD 5220.22-M)

(2) Any revisions to that manual, notice of which has been furnished to the contractor.

If subsequent to the date of this contract, the security classification or security requirements under this contract are caused to be changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract may be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

The contractor is obligated to comply with all relevant clauses and provisions incorporated into this contract and with the Contractor Non-Disclosure Agreement, and as referenced therein, the

NISPOM, dated January 1995, and all applicable FBI security policies and procedures, including the

DCIDs if applicable. As applicable, the contractor shall maintain a security program that meets the requirements of these documents.

When deficiencies in the contractor’s treatment of sensitive (LES) data are noted which do not warrant immediate default, the contractor shall be provided a written notice of the deficiencies and be given a period of 90 days in which to take corrective action. If the contractor fails to take the necessary corrective action, the CO may terminate the whole or any part of this contract, for default.

The contractor shall maintain and administer, in accordance with all relevant clauses and provisions set forth or incorporated into this contract, a security program that meets the requirements of these documents.

7.1 Confidentiality and Non-Disclosure

In the course of performance pursuant to this contract, the contractor may access nonpublic information. In that event, the contractor shall agree that it will not use or disclose any such information unless authorized by the Contracting Officer’s Representative (COR) or the Contracting

Officer. The contractor shall further agree that it will use its best efforts to ensure that its employees and others performing services under this contract will not use or disclose any such information unless authorized by the Contracting Officer’s Representative (COR) or the CO. The contractor shall protect information in accordance with the Privacy Act of 1974 (5 U.S.C. 552a) and the Freedom of

Information Act (5 U.S.C. 552, as amended). To that end, the contractor shall agree that each of its employees and others performing duties under this contract will sign the Non-Disclosure Agreement set forth below.

7.2 Disclosure of Data

All data produced, developed and/or delivered as a result of this Contract, shall be the sole property of the FBI and shall be treated by the Contractor as official FBI documentation to be released by the

FBI only. Duplication or disclosure of the data and other information produced by the Contractor hereunder is prohibited. Accordingly, the Contractor shall not disclose said data, any interpretations thereof, or data derivation therefore, to third parties whether real or artificial in contravention of these provisions, without the prior written approval of the FBI CO. The Contractor shall ensure that this clause is incorporated in any agreements reached with any subcontractors, consultants, agents, or representatives employed by the Contractor in Contract performance or otherwise. All personnel working on this Contract may be required to sign a Non-Disclosure Form. No release of information shall be made without the prior written consent of the Office of Public Affairs and the Contracting

Officer. The Contractor and author are warned that disclosure is not without potential consequences.

The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications.

7.3 Disclosure of Data Under the Freedom of Information Act (FOIA) If a request for information contained in a proposal is requested under the FOIA, the Government shall have the right to disclose any information or data contained in a proposal that results in a contract to the extent provided under the FOIA, notwithstanding any restrictive legends that may have been placed upon it in accordance with other contract provisions. The Government will, before disclosure, make an administrative determination on a case-by-case basis as to whether the information requested is exempt from disclosure by one of the established exceptions to the ACT. In making this determination the procedures outlined in 28 CFR, paragraph 16.7 shall be followed which, in part, affords the submitter of a proposal an opportunity to object to disclosure.

7.4 Indemnification

a) Responsibility for Government Property

(1) The Contractor assumes full responsibility for and shall indemnify the Government against any and all losses or damage of whatsoever kind and nature to any and all Government property, including any equipment, supplies, accessories, or parts furnished, while in his custody and care for storage, repairs, or services to be performed under the terms of this contract, resulting in whole or in part from the negligent acts or omissions of the Contractor, any subcontractor, or any employee, agent or representative of the Contractor or subcontractor.

(2) If due to the fault, negligent acts (whether of commission or omission) and/or dishonesty of the Contractor or its employees, any Government-owned or controlled property is lost or damaged as a result of the Contractor’s performance of this contract, the Contractor shall be responsible to the Government for such loss or damage, and the Government, at its option, may in leu of payment thereof, require the Contractor to replace at its own expense, all property lost or damaged.

b) Hold Harmless and Indemnification Agreement

The Contractor shall save and hold harmless and indemnify the Government against any and all liability claims, and cost of whatsoever kind and nature for injury to or death of any person or persons and for loss or damage to any Contractor property or property owned by a third party occurring in connection with or in any way incident to or arising out of the occupancy, use, service, operation, or performance of work under the terms of this contract, resulting in whole or in part from the acts or omissions of the Contractor, any subcontractor, or any employee, agent, or representative of the

Contractor or subcontractor.

c) Government’s Right of Recovery

Nothing in the above paragraphs shall be considered to preclude the Government from receiving the benefits of any insurance the Contractor may carry which provided for the indemnification of any loss or destruction of, or damages to property in the custody and care of the Contractor where such loss, destruction or damage is to Government property. The Contractor shall do nothing to prejudice the Government's right to recover against third parties for any loss, destruction of, or damage to

Government property, and upon the request of the CO, shall, at the Government's expense, furnish to the Government all reasonable assistance and cooperation (including assistance in the prosecution of suit and the execution of instruments of assignment in favor of the Government) in obtaining recovery.

d) Government Liability

The Government shall not be liable for any injury to the Contractor's personnel or damage to the

Contractor's property unless such injury or damage is due to negligence on the part of the

Government and is recoverable under the Federal Torts Claims Act, or pursuant to other Federal statutory authority.

7.5 Organizational Conflict of Interest

In accordance with FAR Part 9.5, Organizational Conflict of Interest (OCI):

(a) The Contractor warrants that, to the best of his knowledge and belief, and except as otherwise set forth in this contract, he does not have any OCI as defined in paragraph (b) below.

(b) The term “organizational conflict of interest” means a situation where a Contractor has interest, either due to its other activities or its relationship with other organizations, which place it in a position that may be unsatisfactory or unfavorable (1) from the Government's standpoint in being able to secure impartial, technically sound, objective assistance and advise from the

Contractor, or in securing the advantages of adequate competition in its procurement; or (2) from industry's standpoint in that unfair competitive advantages may accrue to the Contractor in question.

(c) The Contractor agrees that, if after award it discovers an actual or potential OCI with respect to this contract, he shall make an immediate and full disclosure in writing to the CO which shall include a description of the action which the Contractor has taken or proposes to take to avoid, eliminate or neutralize the conflict. The Government may, however, terminate the contract for the convenience of the Government.

(d) In the event that the Contractor was aware of an actual or potential OCI prior to the award of this contract and intentionally did not disclose the conflict to the CO, the Government may terminate the contract at no cost to the Government.

(e) In the event that the Government discovers an actual or potential OCI during source selection (of which the contractor was aware and did not disclose), the Offeror will no longer be considered for award.

7.6 Inherently Governmental Functions

The Contractor shall not perform any Inherently Governmental Functions (IGF) under this contract in accordance with OMB Policy Letter 11-01 (September 12, 2011), Inherently Governmental

Functions and FAR Subpart 7.5. Whenever the Contractor is participating in any situation where it may be assumed that they are an FBI employee, the Contractor shall identify themselves as a

Contractor employee. If during the course of work, through receipt of technical direction, or in carrying out the Statement of Work, the Contractor shall immediately notify the CO and COR if any portion of the work appears to be an IGF.

7.7 Safeguarding of Information

In accordance with National Institute of Standards and Technology (NIST) 800-171, the Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. Except as required in the course of their duties, they shall not communicate, to any person, non-public information known to them by reason of their performance of services under this contract unless the CO has specifically authorized such disclosure in writing. Further, no article, book, pamphlet, recording, broadcast, speech, television appearance, film, or photographs concerning any aspect of the contract shall be published or disseminated through any media without the prior written authorization of the CO. These obligations do not cease upon termination of this contract. The Contractor shall include the substance of this provision in all contracts for employment and in all subcontracts hereunder.

7.8 Notification of Conflicts of Interest Regarding Personnel

(a) In addition to the requirements of the contract clause entitled “Organizational Conflicts of

Interest,” the following provisions with regard to employee personnel performing under this contract shall apply until the earlier of the following two dates: the termination date of the affected employee(s) or the expiration date of the contract.

(b) The Contractor agrees to notify immediately the COR and the CO of (1) any actual or potential personal conflict of interest with regard to any of its employees working on or having access to information regarding this contract, or (2) any such conflicts concerning subcontractor employees or consultants working on or having access to information regarding this contract, when such conflicts have been reported to the Contractor. A personal conflict of interest is defined as a relationship of an employee, subcontractor employee, or consultant with an entity that may impair the objectivity of the employee, subcontractor employee, or consultant with an entity that may impair the objectivity of the employee, subcontractor employee, or consultant in performing the contract work.

(c) The Contractor agrees to notify the COR and CO prior to incurring costs for that employee's work when an employee may have a personal conflict of interest. In the event that the personal conflict of interest does not become known until after performance on the contract begins, the

Contractor shall immediately notify the CO of the personal conflict of interest. The Contractor shall continue performance of this contract until notified by the CO of the appropriate action to be taken.

(d) The Contractor agrees to insert in any subcontract or consultant agreement placed hereunder, provisions, which shall conform substantially to the language of this clause, including this paragraph (d), unless otherwise authorized by the CO.

7.9 Rights of Egress and Ingress

During the life of this contract, the rights of ingress to and egress from the FBI facility for the

Contractor’s representative(s) shall be for temporary visits such as kick-off and other required meetings and shall be made available as required. During all operations on Government premises, the Contractor’s personnel shall comply with rules and regulations governing the conduct of personnel and the operation of the facility. The Government reserves the right to require Contractor personnel to "sign in" upon entry and "sign out" upon departure from the FBI facility.

7.10 Information of Resellers or Data Brokers

Under this contract, the FBI could obtain personally identifiable information (PII) about individuals from the Contractor. The Contractor hereby certifies that it has a security policy in place which contains procedures to promptly notify any entity whose PII (as defined by OMB) was, or is reasonably believed to have been, lost or acquired by an unauthorized person while the data is under the control of the Contractor. In any case in which the data that was lost or improperly acquired reflects or consists of data that originated with the FBI or reflects law enforcement or national security interest in the data, the Contractor shall notify the CO so that the FBI may determine whether notification would impede a law enforcement investigation or jeopardize national security. In such cases, the Contractor shall not notify the individuals until it receives further instruction from the FBI.

7.11 Publication of Information Related to Business with the Federal Bureau of

Investigation In accordance with the clause below, Contractor shall forward draft language it wishes to publicly display on its website, (or third-party website), regarding the contract to the authorized CS / CO for proper adjudication. The FBI specifically requires that Contractors shall not divulge, publish, or disclose information or produce material acquired as or derived from the performance of their duties.

In addition, the Contractor shall not use the FBI Seal on its website, promotional materials or elsewhere, without permission from the FBI’s Office of the General Counsel (OGC).

For the purposes of this Clause, “divulge, publish or disclose” shall include, but not be limited to:

information released in any media or all media including on the Internet or websites; publications, studies, books, thesis, photographs, films or public announcements, press releases describing any part of the subject matter of this contract or any phase of any program hereunder, except to the extent that:

1. Such information was publicly available prior to the commencement of the contract or;

2. Disclosure is required by law, regulation, subpoena or government or judicial order., No release of information shall be made without the prior written consent of the Office of Public

Affairs (OPA) and the CS / CO. The Contractor and author are warned that disclosure is not without potential consequences. The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications. These obligations do not cease upon completion of the contract.

7.12 Contractor Code of business Ethics and Conduct

In accordance with FAR Part 3, Improper Business Practices and Personal Conflict of Interest.

(a) Government contractors must conduct themselves with the highest degree of integrity and honesty.

(b) Contractors should have a written code of business ethics and conduct. To promote compliance with such code of business ethics and conduct, contractors should have an employee business ethics and compliance training program and an internal control system that -

(1) Are suitable to the size of the company and extent of its involvement in Government contracting;

(2) Facilitate timely discovery and disclosure of improper conduct in connection with

Government contracts; and

(3) Ensure corrective measures are promptly instituted and carried out.

7.13 Release of Information-Publications by Contractor Personnel The Federal Bureau of Investigation (FBI) specifically requires that Contractor shall not divulge, publish, or disclose information or produce material acquired as or derived from the performance of their duties.

For purposes of this clause, "Information" shall include but not be limited to: in any media or all media including on the web or web sites; publication, studies, books, these, photographs, films or public announcements, press releases describing any part of the subject matter of this contract or any phase of any program hereunder, except to the extent such is:

(i.) already known to the contractor prior to the commencement of the contract

(ii.) required by law, regulation, subpoena or government or judicial order to be disclosed, including the Freedom of Information Act.

No release of information shall be made without the prior written consent of the Office of Public

Affairs and the Contracting Officer. The contractor and author are warned that disclosure is not without potential consequences. The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications.

Where appropriate, in accordance with established academic publishing practices, the FBI reserves the right to author/co-author any publication derived from this contract. These obligations do not cease upon completion of this contract.

7.14 Security of Systems and Data, Including Personally Identifiable Data

a. Systems Security

The work to be performed under this contract requires the handling of data that originated within the

Department of Justice, data that the contractor manages or acquires for the Department, and/or data that is acquired in order to perform the contract and concerns Department programs or personnel.

For all systems handling such data, the contractor shall comply with all security requirements applicable to Department of Justice systems, including but not limited to all Executive Branch system security requirements (e.g., requirements imposed by OMB and NIST), DOJ IT Security Standards, and DOJ Order 2640.2E. The contractor shall provide DOJ access to and information regarding the contractor's systems when requested by the Department in connection with its efforts to ensure compliance with all such security requirements and shall otherwise cooperate with the Department in such efforts. DOJ access shall include independent validation testing of controls, system penetration testing by DOJ, FISMA data reviews and access by the DOJ Office of the Inspector

General for its reviews.

The use of contractor-owned laptops or other media storage devices to process or store data covered by this clause is prohibited until the contractor provides a letter to the Contracting Officer (CO) certifying the following requirements:

1. Laptops must employ encryption using a NIST Federal Information Processing Standard (FIPS)

140-2 approved product;

2. The contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

3. Mobile computing devices will utilize anti-viral software and a host-based firewall mechanism;

4. The contractor shall log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required. All DOJ information is sensitive information unless designated as non-sensitive by the Department;

5. Contractor-owned removable media, such as removable hard drives, flash drives, CDs, and floppy disks, containing DOJ data, shall not be removed from DOJ facilities unless encrypted using a NIST

FIPS 140-2 approved product;

6. When no longer needed, all removable media and laptop hard drives shall be processed (sanitized, degaussed or destroyed) in accordance with security requirements applicable to DOJ;

7. Contracting firms shall keep an accurate inventory of devices used on DOJ contracts;

8. Rules of behavior must be signed by users. These rules shall address at a minimum: authorized and official use; prohibition against unauthorized users; and protection of sensitive data and personally identifiable information;

9. All DOJ data will be removed from contractor-owned laptops upon termination of contractor work.

This removal must be accomplished in accordance with DOJ IT Security Standard requirements.

Certification of data removal will be performed by the contractor's project management and a letter confirming certification will be delivered to the CO within 15 days of termination of contractor work.

b. Data Security

By acceptance of, or performance on, this contract, the contractor agrees that with respect to the data identified in paragraph a, in the event of an actual or suspected breach of such data (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the contractor will immediately (and in no event later than within one hour or discovery) report the breach to the CO and the Contracting

Officer's Technical Representative (COTR).

If the data breach occurs outside of regular business hours and/or neither the CO nor the COTR can be reached, the contractor shall call the DOJ Computer Emergency Readiness Team (DOJCERT) at

1-866-US4-CERT (1-866-874-2378) within one hour of discovery of the breach. The contractor shall also notify the CO as soon as possible during regular business hours.

c. Personally Identifiable Information (PII) Notification Requirement

The contractor further certifies that it has a security policy in place that contains procedures to promptly notify any individual whose personally identification information (as defined by OMB) was, or is reasonably believed to have been, breached. Any notification shall be coordinated with the

Department and shall not proceed until the Department has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by the contract shall be coordinated with, and be subject to the approval of, the Department. The contractor assumes full responsibility for taking corrective action consistent with the Department's Data Breach Notification Procedures, which may include offering credit monitoring when appropriate.

d. Pass-through of Security Requirements to Subcontractors

The requirements set forth in Paragraphs a through c above, apply to all subcontractors who perform work in connection with this contract. For each subcontractor, the contractor must certify that it has required the subcontractor to adhere to all such requirements. Any breach by a subcontractor of any of the provisions set forth in this clause will be attributed to the contractor.

B. Information Resellers or Data Brokers

Under this contract, the Department obtains personally identifiable information about individuals from the contractor. The contractor hereby certified that it has a security policy in place which contains procedures to promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, lost or acquired by an unauthorized person while the data is under the control of the contractor. In any case in which the data that was lost or improperly acquired reflects or consists of data that originated with the Department or reflects sensitive law enforcement or national security interest in the data, the contractor shall notify the

Department Contracting Officer so that the Department my determine whether notification would impede a law enforcement investigation or jeopardize national security. In such cases, the contractor shall notify the individuals until it receives further instruction from the Department.

7.15 Contractor Suitability

Access to FBI facilities and information is subject to specific security and suitability requirements.

The FBI reserves the right and prerogative to deny and/or restrict facility and information access of any contractor employee determined by the FBI, at any time prior to or during performance, to be unsuitable for access and/or present a risk of compromising sensitive government information to which he or she would have access to under this contract. Contractors will be allotted a reasonable amount of time, determined by the government, to replace the employee found not suitable for contract performance. Failure to replace the employee may result in a no cost termination by the government.

7.16 Continuing Contract Performance During a Pandemic Influenza or Other

National Emergency During a pandemic or other emergency, the Government understands that the Contractor workforce will experience the same high levels of absenteeism as the Federal employees. Although the

Excusable Delays and Termination for Default clauses used in Government contracts list epidemics and quarantine restrictions among the reasons to excuse delays in contract performance, the

Government expects Contractors to make a reasonable effort to keep performance at an acceptable level during emergency periods.

The Office of Personnel Management (OPM) has provided guidance to federal managers and employees on the kinds of actions to be taken to ensure continuity of operations during emergency periods. This guidance is also applicable to the Government’s current workforce. Contractors are expected to have reasonable policies in place for continuing work performance, particularly those performing mission critical services, during a pandemic influenza or other emergency situation.

The types of actions a federal contractor should reasonably take to help ensure performance are:

Encourage employees to get inoculations or follow other preventive measures as advised by the public health service.

Contractors should cross-train workers as backup for all positions performing critical services. This is particularly important for work such as guard services where telework is not an option.

Implement telework to the greatest extent possible in the workgroup so systems are in place to support successful remote work in an emergency.

Communicate expectations to all employees regarding their roles and responsibilities in relation to remote work in the event of a pandemic health crisis or other emergency.

Establish communication processes to notify employees of activation of this plan.

Integrate pandemic health crisis response expectations into telework agreements.

With the employee, assess requirements for working at home (supplies and equipment needed for an extended telework period). Security concerns shall be considered in making equipment choices;

agencies or contractors may wish to avoid use of employees’ personal computers and provide them with PCs or laptops as appropriate.

Determine how all employees who may telework will communicate with one another and with management to accomplish work.

Practice telework regularly to ensure effectiveness.

Make it clear that in emergency situations, employees must perform al l duties assigned by management, even if they are outside usual or customary duties.

Identify how time and attendance will be maintained.

It is the Contractor’s responsibility to advise the Government Contracting Officer if they anticipate not being able to perform and to work with the Government to fill gaps as necessary. This means direct communication with the Contracting Officer or in their absence, another responsible person in the contracting office via telephone or email messages acknowledging the Contractor’s notification.

The incumbent Contractor is responsible for assisting the Government in estimating the adverse impacts of nonperformance and to work diligently with the Government to develop a strategy for maintaining the continuity of operations.

The Government does reserve the right in such emergency situations to use federal employees, employees of other agencies, contract support from other existing contractors, or to enter into new contracts for critical support services. Any new contracting efforts would be acquired following the guidance in the Office of Federal Procurement Policy issuance “Emergency Acquisitions,” May

2007 and Subpart 18.2 Emergency Acquisition Flexibilities, of the Federal Acquisition Regulation.

7.17 DOJ Residency Requirement

All contractor personnel employed within the United States, both United States citizens and non-

United States citizens, are required to meet the following residency requirements:

a. For three of the five years immediately prior to applying for the specific contract position, the individual must have 1) resided in the United States; 2) worked for the

United States overseas in a Federal or military capability; or 3) be a dependent of a

Federal or military employee serving overseas.

The requirement may be waived for short term contractor personnel (performing duties for a cumulative total of 14 days or less) if there is a critical need for their specialized and unique skills.

These individuals must, however, be United States citizens or Permanent Resident Aliens.

7.18 ENSURING ADEQUATE COVID-19 SAFETY PROTOCOLS FOR FEDERAL

CONTRACTORS (OCT 2021) (DEVIATION)

(a) Definition. As used in this clause -

United States or its outlying areas means—

(1) The fifty States;

(2) The District of Columbia;

(3) The commonwealths of Puerto Rico and the Northern Mariana Islands;

(4) The territories of American Samoa, Guam, and the United States Virgin Islands; and

(5) The minor outlying islands of Baker Island, Howland Island, Jarvis Island, Johnston Atoll, Kingman Reef, Midway Islands, Navassa Island, Palmyra Atoll, and Wake Atoll.

(b) Authority. This clause implements Executive Order 14042, Ensuring Adequate COVID Safety

Protocols for Federal Contractors, dated September 9, 2021 (published in the Federal Register on

September 14, 2021, 86 FR 50985).

(c) Compliance. The Contractor shall comply with all guidance, including guidance conveyed through Frequently Asked Questions, as amended during the performance of this contract, for contractor or subcontractor workplace locations published by the Safer Federal Workforce Task

Force (Task Force Guidance) at https:/www.saferfederalworkforce.gov/contractors/.

(d) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph

(d), in subcontracts at any tier that exceed the simplified acquisition threshold, as defined in Federal

Acquisition Regulation 2.101 on the date of subcontract award, and are for services, including construction, performed in whole or in part within the United States…