Department of Homeland Security (DHS)

U.S. Citizenship & Immigration Services (USCIS)

Office of Security & Integrity (OSI)

PERFORMANCE WORK STATEMENT

1. TITLE:

Online Privacy and Protection Program (OP3)Doxxing

2. BACKGROUND:

DHS and its Components have experienced increased external threats directed toward senior leaders and personnel. Employees have had restricted personal information about themselves or their families publicly disclosed online, often with the intent to threaten, intimidate, or incite criminal activity against them due to their employment with DHS or its Components.

To protect employees from these threats, it is essential to proactively remove employee PII from the internet (including the deep web, dark web, social media, and websites hosted outside the United States), and to reactively respond to incidents where PII has already been disclosed. This effort is designated as the Online Privacy and Protection Program (OP3), to be executed in partnership with a vendor providing necessary services.

3. OBJECTIVE:

USCIS requires services to protect employees from doxxing incidents by proactively and reactively removing employee PII from public internet, deep and dark web sources, and social media sites. The goal is to reduce the likelihood and impact of doxxing incidents for

USCIS employees, including incidents described under 18 U.S. Code § 119.

4. SCOPE:

The vendor will provide OP3 services, including digital forensic searches of the web, dark web, and social platforms to identify potentially nefarious information or threats. The vendor will safeguard the security of USCIS employees and their families by removing PII from the internet and providing continuous monitoring.

Services must support all USCIS staff (approximately 22,000 employees), with scalability as needs develop. The vendor shall provide all necessary personnel, supervision, management, equipment, materials, and services (except government-furnished information) to support

USCIS’s mission to protect employees from internet-based threats.

Coverage shall be continuous for one year from the date the service is activated for each impacted individual.

70SBUR26I00000019 DRAFT

5. REQUIREMENTS/TASKS:

The contractor shall provide a team of personnel with the proper skills, expertise, and recent experience in carrying out online privacy and protection (OP3) services. Services include, but are not limited to:

5.1. CONTINUOUS MONITORING

5.1.1. Monitor public, deep, and dark web sources and social media sites for unauthorized disclosure of personnel and organizational information.

5.1.2. Identify and alert on potential doxxing incidents in real time.

5.2. PII REMOVAL

5.2.1. Remove unauthorized PII from web-based sources, including public, deep, and dark web sources and social media sites.

5.2.2. Limit PII exposure by opting-out employee PII from open source personal information databases.

5.3. REPORTING

5.3.1. Provide USCIS with a reporting interface to monitor total number of enrolled employees, government obligations to date, summary and detailed report about threat alerts, employee’s security reports, actions taken, and individual and agency threat posture.

5.3.2. Work directly with enrolled employees to set up limited service parameters and report on potential threats and response actions.

5.4. VULNERABILITY ASSESSMENT AND PRIVACY THREAT MITIGATION

5.4.1. Deliver vulnerability assessments and privacy threat mitigation services.

5.4.2. Provide privacy threat monitoring and data removal services.

5.5. DATA REPORTING AND NOTIFICATION

5.5.1. Provide timely notification to USCIS and affected employees regarding detected threats and actions taken.

5.6. CONSULTATION AND SUPPORT

5.6.1. Consult with USCIS enrollees and OP3 regarding ongoing threats, mitigation strategies, and escalation procedures.

6. DELIVERABLES

Deliverable Description Frequency Recipient(s)

Initial Implementation

Plan

Detailed plan for onboarding USCIS employees, service activation, and process workflows.

Upon contract award

USCIS OP3 Program

Manager

Deliverable Description Frequency Recipient(s)

Vulnerability

Assessment Report

Assessment of online PII exposure and potential threats for enrolled employees.

Upon enrollment and annually

USCIS OP3 Program

Manager, Enrolled

Employees

Continuous

Monitoring Alerts

Real-time notifications of detected doxing incidents or unauthorized PII disclosures.

As incidents occur

USCIS OP3 Program

Manager, Enrolled

Employees

PII Removal

Confirmation

Documentation of successful removal or takedown of exposed PII from web, social media, and other platforms.

As actions are completed

USCIS OP3 Program

Manager, Enrolled

Employees

Monthly Summary

Report

Summary of monitoring activities, incidents detected, actions taken, and threat posture.

Monthly USCIS OP3 Program

Manager

Threat Mitigation

Recommendations

Recommendations for reducing online vulnerability and improving privacy protection.

Quarterly or as needed

USCIS OP3 Program

Manager, Enrolled

Employees

Annual Performance

Report

Comprehensive report on service effectiveness, metrics, trends, and recommendations for improvement.

Annually USCIS OP3 Program

Manager

Training Materials

Educational materials and guidance for employees on recognizing and responding to doxing threats.

Upon contract award and updates as needed

USCIS OP3 Program

Manager, Enrolled

Employees

Final Closeout Report

Summary of services provided, outcomes achieved, and lessons learned at contract completion.

At contract closeout

USCIS OP3 Program

Manager