RFI QA_2.16.26.pdf

Question Answer How many devices are anticipated to be needed at one time and in how many locations?

1 and 1

The objective states “operating from an access method that involves local wireless technologies”. Is this meant to test if wireless access to the device could be used to circumvent security measures? That seems to be the intent but we want to confirm.

Yes

Would any modifications to the device’s hardware, firmware, or software be allowed for this testing?

Testing and development, yes. Final prototype, no.

Would there be interest in 5g/LTE protocol level attacks?

no

Would electromagnetic fault injection be in scope and allowed?

no

How much technical info, code, etc would be provided about the mobile device being evaluated?

Make and model

In order to respond in the most effective manner, can you please provide information on which FBI organization requires this capability?

OTD

Other OTAs provide a funding confidence level that relays whether funding is available for specific efforts and so that the solution proposed can be appropriately tailored to the funding level. Can you please provide any information as to whether funding is available for this effort? If so, how much?

At this time, we do not yet have funding identified for this effort. As a result, we’re unable to provide a funding confidence level or specify an anticipated amount.

Evaluation of mobile device security using a wireless access method

RFI #: 15F067-26-PN-MEA02

What are the commercial terms that the government envisions putting in place for this OTA?

At this stage, the Government anticipates structuring the OTA with commercial‑leaning terms that emphasize flexibility, streamlined execution, and a collaborative approach to risk. While the final terms will be informed by market feedback and the specific technical objectives of the effort, we expect the agreement to incorporate elements commonly used in commercial contracting.

Our intent is to create an environment that supports rapid innovation while still ensuring transparency, accountability, and value for the Government. We welcome industry’s input as we refine these terms and are committed to shaping an agreement framework that enables effective partnership and successful delivery.

Does the government have an Allocation of rights template that is anticipated for this OTA?

At this time, the Government does not have a predetermined Allocation of Rights template identified for this OTA. We anticipate working collaboratively with industry to shape terms that balance innovation, flexibility, and the Government’s long‑term sustainment needs.

As we move forward, we welcome feedback on preferred IP frameworks and any commercial approaches that have proven effective in similar efforts. This dialogue will help ensure the final agreement structure supports both mission success and a productive partnership.

Are there any price analysis techniques the government intends to utilize for this OTA?

The Government anticipates using price analysis techniques that are consistent with commercial practices and appropriate for the flexible nature of an

OTA.

Will the government negotiate license agreements for prototypes?

During this market research phase, the Government is open to receiving recommendations from industry regarding license agreements for prototypes. Our goal is to use this feedback to shape a solicitation and agreement structure that is mutually beneficial and supports successful execution under the OTA framework. We welcome any insights or proposed approaches your team would like to share.

Under section B. Technical Approach, the document refers to “alignment with government requirements”.

Can you specify what requirements you have in mind?

See section "PURPOSE AND STATEMENT OF OBJECTIVES", or related question.

Are there any specific requirements for the security posture checks mentioned under “Technical Objectives? Should that include device compromise (jailbreak/root) detection, malware detection, etc?

Assess how secure the required device is from an access method involving local wireless technologies.

Are there specific scenarios that you have in mind when using the term “local wireless technologies” under the heading of “Technical Objectives”?

Yes, there are many scenarios that involve local wireless technologies and how a device might be compromised by them.

Will past performance with the FBI or other DOJ components be considered?

Past performance with the FBI or other DOJ components may be considered as part of the Government’s overall assessment, particularly when it demonstrates relevant experience, successful execution in similar mission areas, or the ability to operate effectively within the Department’s requirements. While OTAs offer flexibility in evaluation approaches, we value insights that help us understand a partner’s capabilities and track record.

That said, prior work with DOJ is not a prerequisite.

We welcome participation from both traditional and non‑traditional vendors, and we will consider any past performance—government or commercial—that meaningfully reflects the contractor’s ability to deliver on the objectives of this effort.

Is there a requirement to capture and save all sms traffic to and from the mobile device?

No

What local technology do you want to access/leverage?

There is no limitation to the wireless technology, except for cellular - that is not within scope for this

OTA

How many mobile devices will be part of this effort? Only one device at a time, though the model could differ.

Are the mobile devices managed using a Unified Endpoint Management solution?

Possibly

Is there a requirement to integrate with SIEMs or other third party solutions?

No

Does the prime contractor require a Facility Security Clearance (FCL) to perform work on the contract?

No

Do subcontractors require an FCL to perform work on the contract?

No

Will a DD-254 be provided upon award? Yes

What wireless protocols are applicable: WiFi 802.11 a/b/g/n/ac/ax/be, Bluetooth 4/5/LE, NFC, UWB, etc.?

Anything except for cellular

Would USB-based access also be within the scope of the activity?

No

What hardware, firmware, operating system, and software is expected on the device? For example:

Android 15 running on a Mediatek Dimensity 9400 chipset, or A18 Pro running iOS26…

Both Android and iOS are within scope for this OTA.

Latest OS for both. MTE based iPhones are outside scope of this OTA.

Are you interested in a singular product working on an existing device, or ongoing maintenance and support of a platform?

An OTA is for a singular working prototype. OTAs can have follow up work on production should the singular prototype be sufficient.

Can you share what "realistic operational scenarios" exist for this use case?

Factors that will be assessed include: time to complete assessment, security posture of device, how alerting assessment is, etc.

Would the Government please describe its anticipated acquisition approach (e.g., phases, down-select, demonstration, etc.) for the prototype OTA

At this stage, the Government has not yet finalized its anticipated acquisition approach for the prototype OTA. We are still assessing the most effective structure and expect that the final approach—whether phased activities, down‑selects, demonstrations, or other mechanisms—will be shaped by the feedback we receive from industry.