Statement of Work - 70B03C26Q00000328.pdf

Statement of Work – 70B03C26Q00000328

Office of Field Operations

Trusted Traveler Program (TTP)

Global Entry Airport Modernization

Statement of Work (SOW)

70B03C26Q00000328

1.0 BACKGROUND

U.S. Customs and Border Protection (CBP) is one of the major components of the Department of Homeland Security (DHS) charged with protecting America’s borders from terrorism, human and drug smuggling, illegal migration, and agricultural pests while simultaneously facilitating the flow of legitimate travel and trade. As the nation’s single, unified border agency, CBP represents the first line of defense of America’s borders. CBP agents frequently interact with the public in a variety of operational environments.

CBP seeks biometric solutions capable of enabling travelers to proceed through high-throughput lanes in a continuous flow environment utilizing biometric facial comparison solution integrated with CBP Traveler Verification Services (TVS) or successor systems.

TVS is a facial biometric matching service that compares live-captured photographs against temporary galleries, which are assembled using source photos of travelers arriving or departing the port of entry. The service verifies travelers’ identities and responds within seconds with match results. The operational deployment is intended for arriving Global Entry air travelers.

The solution shall capture facial images and transmit those images to CBP systems for processing.

CBP shall perform biometric matching, traveler verification, identity adjudication, and traveler processing functions through TVS or successor Government systems.

2.0 SCOPE

This Statement of Work (SOW) covers the design, deployment, and integration of a Biometric Facial Comparison solution at (38) Thirty-Eight international airport terminals with the highest Global Entry saturation. The solution will capture facial images of travelers in motion, submit them to CBP systems for matching and processing, and provide officers with real-time traveler status.

The Contractor shall provide all personnel, management, equipment, software, integration support, testing, documentation, training, maintenance, technical support, and sustainment services necessary to implement and support the Biometric Facial Comparison.

The Contractor shall:

• Design and configure the solution

• Provide required hardware and software

• Install and integrate solution components

• Conduct testing and validation

• Provide technical documentation

• Provide operator and administrator training

• Provide technical support and maintenance

• Support cybersecurity and privacy compliance activities

• Support deployment activities

3.0 OVERALL SOLUTION REQUIREMENTS

The primary objective of this effort is to implement a biometric facial comparison solution capable of supporting traveler processing through continuous flow operational environments while maintaining security, operational efficiency, and traveler throughput requirements.

The objectives of this effort are to:

• Enable continuous processing without requiring travelers to stop except when additional inspection is needed.

• Improve traveler throughput at POEs.

• Reduce officer interaction requirements for low-risk travelers.

• Improve traveler processing efficiency while maintaining security standards.

• Support biometric identify verification using CBP approved systems.

• Provide scalable biometric processing capabilities.

3.1 Facial Capture: Provide the capability to capture facial images of travelers while travelers remain in motion within a designated facial capture zone.

3.2 Integration with CBP Systems: Provide captured facial images meeting CBP image quality requirements and support integration with CBP systems for traveler processing.

3.3 Officer Feedback: Provide officers with timely traveler processing status information necessary to support traveler processing operations.

3.4 Exception Processing: Provide capabilities supporting the identification and routing of travelers requiring additional processing

3.5 Continuous Flow Operations: Support continuous traveler movement through the processing area while maintaining operational throughput

4.0 SOFTWARE SOLUTION REQUIREMENTS

Contractor shall provide a software solution that meets these minimum operating criteria.

4.1 Operational Reliability: System shall consistently perform its intended job without failure or downtime 99% of the time.

4.2 No Facial Match (TV rate): System shall provide for a Maximum No Facial Match rate of no more than 5% of all GE passengers.

4.3 Photo Capture Rate: System shall provide for a Minimum Photo Capture rate of 99% of all passengers

4.4 System shall have the ability to process up to 3,500 passengers per day at each installed solution.

4.5 Quality of photo: System shall provide for a Minimum TVS system rated image for all passengers 98% of the time.

5.0 PHYSICAL STRUCTURE REQUIREMENTS

Contractor shall provide a physical solution that meets these minimum criteria.

5.1 Contractor shall provide a self-supporting physical archway or similar structure with integrated lighting, as needed, and camera configuration that meets the overall project solution and objectives.

5.2 Integrates with the individual Airport FIS aesthetic but also provides for a clear identification for Global Entry Passengers.

5.3 Structure shall be designed so passengers can pass through it.

5.4 Provides for enclosure and/or secure concealment of all wiring both electrical and data.

5.5 Minimize impacts to existing CBP facilities, infrastructure, and operational environments

5.6 Be flexible to support different sized facial capture zones and traveler vetting areas to accommodate all Ports of Entry (POEs).

5.7 Ability to be moved when POEs are reconfigured.

5.8 Flexible to support differing lighting variances and sound levels.

5.9 Ruggedized to reduce damage, wear and tear and potential maintenance. tampering

5.10 Provide officers with an unobstructed view in the inspection area.

5.11 Protect biometric and Personally Identifiable Information (PII)

6.0 SOFTWARE LICENSING AND MAINTENANCE

Contractor shall provide for the following recurring services for the base period and subsequent options years.

5.1 All recurring software licensing for provided software solutions.

5.2 Maintenance of physical structure and attached equipment.

7.0 APPLICABLE DOCUMENTS

Contractor shall comply with all applicable Federal laws, regulations, standards, and policies, including but not limited to:

• Federal Acquisition Regulation (FAR)

• DHS 4300A Sensitive Systems Handbook

• NIST SP 800-53

• Privacy Act of 1974

• Section 508 Accessibility Requirements

• DHS Information Security Program

• CBP TVS Technical Specifications

• Applicable DHS and CBP cybersecurity policies

• Interface Control Documentation (ICDs)

• Enterprise architecture requirements

• Applicable DHS/CBP directives and regulations

8.0 PERIOD OF PERFORMANCE

The period of performance for this Contract shall be:

• 12-month base period from award including installation, maintenance and software licensing

• Installations shall start a maximum of 30 days after award and vendor shall be capable of completing 2 installations per week.

9.0 PLACE OF PERFORMANCE

Work shall be performed at 38 international terminals identified by CBP and other designated CBP facilities and operational locations as required for system integration and support. This chart represents the full list and potential installation order for specific International Airport locations.

1 JOHN F KENNEDY INTL (JFK) (Terminal 4)

2 BOSTON / LOGAN INTL (BOS)

3 SAN FRANCISCO INTL AIRPORT (SFO) (Terminal G)

4 DALLAS/FT WORTH INTL (DFW)

5 SEATTLE/TACOMA INTL (SEA)

6 PHILADELPHIA INTL (PHL)

7 TORONTO, PEARSON INTERNATIONAL (YYZ) Terminal 1 8 TORONTO, PEARSON INTERNATIONAL (YYZ) Terminal 3 9 NEWARK LIBERTY INTERNATIONAL (EWR) (Terminal C) 10 NEWARK LIBERTY INTERNATIONAL (EWR) (Terminal B) 11 MIAMI INTL, FL (MIA) (Terminal D) 12 MIAMI INTL, FL (MIA) (Terminal J) 13 HARTSFIELD-JACKSON ATLANTA (ATL) (Terminal E) 14 WASHINGTON DULLES INTL (IAD) (Main terminal)

15 LOS ANGELES INTL (LAX) (TBIT)

16 LOS ANGELES INTL (LAX) (Terminal 7)

17 GEORGE BUSH INTERCONTINENTAL AIRPORT, HOUSTON (IAH)

18 CHICAGO O'HARE INTL (ORD)

19 JOHN F KENNEDY INTL (JFK) (Terminal 1) 20 JOHN F KENNEDY INTL (JFK) (Terminal 8) 21 MIAMI INTL, FL (MIA) (Terminal E) 22 SAN FRANCISCO INTL AIRPORT (SFO) (Terminal A)

23 CHARLOTTE DOUGLAS INTL (CLT)

24 DENVER INTL (DEN)

25 DETROIT METRO WAYNE COUNTY (DTW)

26 FORT LAUDERDALE – HOLLYWOOD INTL (FLL)

27 PHOENIX SKY HARBOR INTL (PHX)

28 ORLANDO INTL (MCO)

29 MINNEAPOLIS – SAINT PAUL INTL (MSP)

30 DANIEL K. INOUYE INTL, HONOLULU (HNL)

31 AUSTIN-BERGSTROM INTL (AUS)

32 SAN DIEGO INTL (SAN)

33 SALT LAKE CITY INTL (SLC)

34 LUIS MUNOZ MARIN INTL, SAN JUAN (SJU)

35 VANCOUVER INTL (YVR)

36 WILLIAM P. HOBBY, HOUSTON (HOU)

37 TAMPA INTL (TPA)

38 BALTIMORE-WASHINGTON INTL (BWI)

10.0 GOVERNMENT – FURNISHED EQUIPMENT / INFORMATION (GFE/GFI)

The Government shall provide the following equipment:

• CBP Network approved server with appropriate configuration for vendor supplied software and vendor supplied camera system

• CBP Network approved switches

The Government shall provide for the following:

• Access to CBP facilities

• Existing infrastructure connectivity

• TVS interface specifications

• Existing traveler processing lane access

11.0 TRAINING REQUIREMENTS

The Contractor shall provide the following:

• Installation guides

• Operational guides

• Technical documentation

• System administration documentation

• Technical support services

• Operator training

12.0 INSPECTION AND ACCEPTANCE (Installation)

Inspection of the equipment and installation will be by the Contracting Office Representative (COR) at the GE Ports of Entry.

13.0 QUALITY ASSURANCE

The Contractor shall maintain a quality control program to ensure compliance with contractual requirements and operational performance standards.

The Government reserves the right to monitor Contractor performance throughout the Period of Performance.

14.0 SECTION 508 REQUIREMENTS

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

14.1 Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): GE Airport Mod

Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components: Does not apply

Applicable 508 requirements for software features and components (including but not limited to Software infrastructure)

Applicable 508 requirements for hardware features and components (including but not limited to Other): All requirements in Chapter 4 apply https://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

15.0 ADDITIONAL CONDITIONS AND TERMS

AI Specific Conditions

• The contractor shall ensure AI safeguards are in place and employ AI compliance/risk management practices, including ensuring that the AI product or solution conforms to prevalent industry standards and practices (including the NIST AI Risk Management Framework).

• The contractor’s AI product or solution will not infringe upon or violate any intellectual property rights, rights of likeness or publicity, or any other third-party right of any kind.

• The contractor’s AI product or solution shall cover themes such as privacy, civil rights, and civil liberty concerns; ownership and security of data; means to prevent misuse, unauthorized use, or corruption of AI systems; transparency, accountability, and fairness, including data set integrity, accuracy, foreseeable risks, and social impact.

• The contractor shall assess and mitigate risks related to the potential unintended disclosure of sensitive data from AI models, including conducting a model-specific risk analysis before sharing or releasing AI models and model weights.

• The contractor shall submit documentation on the origins, quality, and suitability of the data used to train AI models, including methods for properly managing biases and preventing unintended disclosure of sensitive data and the AI systems used in the contract’s performance, including model selection, training, testing, and auditing processes.

• The contractor must include details on data sourcing and transparency, especially regarding output weighting regimes, and the responsible use of data.

• The contractor’s AI product or solution will not make or support decisions, based on the illegal consideration of race, ethnicity, gender, national origin, religion, sexual orientation, gender identity, age, nationality, medical condition, or disability in violation of Title VII of the Civil Rights Act of 1964 (Title VII), the Americans with Disabilities Act of 1990 (ADA), and the Age Discrimination in Employment Act of 1967 (ADEA), as amended.

AI Specific Conditions for LLMs

• Provide the acceptable use policy of the original developer of the AI technology.

• Provide the model, system, and/or data card of the solution that includes summaries of the training process, identified risks and mitigations, and model evaluation scores against established benchmarks.

• Create and maintain end user resources such as product tutorials, developer guides, and other tools to ensure maximum utility of the AI technology.

• Develop a dedicated mechanism for end user feedback to the contractor on AI outputs that violate safety and security standards or Unbiased AI Principles.

• Describe what AI safeguards are in place for the model to respond to end user queries for which reliable information is incomplete, contradictory, or subject to individual interpretation.

• List the type of outputs restricted via content moderation and safety filters.

• Disclose any training or development of the AI technology that occurred outside the United States, to include the type of activity and the country in which it occurred.

• Disclose any modifications or configurations undertaken for the AI technology to comply with any regulation from a government other than the U.S. Federal Government.

• Describe any controls in-place to modify AI outputs applied by the vendor if the vendor is not the direct developer of the AI technology

Project Management and Documentation

The contractor shall provide:

• Project management and oversight of initiatives necessary to leverage enterprise data sets as strategic assets for the development of Artificial Intelligence applications.

• Project management and oversight of initiatives including data acquisition, defining technical data, ingest, data governance and metadata management, integration, and preparation of data, including labeling, quality assessment, when executing within DHS.

• Project status updates, risk assessments, data governance plans, and progress towards major milestones.

• Technical documentation for data sets handled and processed.

• Corresponding documentation for business process owners and end users describing metadata, handling, processing, use, and limitations of data sets.

• Documentation of compliance with NIST standards, DHS AI policy, and Unbiased AI Principles (LLMs), as appropriate.

13.0 QUALITY ASSURANCE