70US0920R70090037_RFP_Multiple Universities IDIQ solicitation_final.pdf

70US0920R70090037

1. REQUEST NO.

5a. ISSUED BY

NAME

a. NAME

c. STREET ADDRESS

d. CITY

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON

OR BEFORE CLOSE OF BUSINESS (Date)

2. DATE ISSUED 3. REQUISITION/PURCHASE REQUEST NO. 4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG.1

RATING

6. DELIVERY BY (Date)

7. DELIVERY

9. DESTINATION

a. NAME OF CONSIGNEE

b. STREET ADDRESS

PAGE OF PAGES

5b. FOR INFORMATION CALL: (No collect calls)

TELEPHONE NUMBER

AREA CODE NUMBER

8. TO:

b. COMPANY

e. STATE f. ZIP CODE

c. CITY

d. STATE e. ZIP CODE

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it to the address in Block 5a. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services. Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

THIS RFQ

REQUEST FOR QUOTATION

(THIS IS NOT AN ORDER)

IS IS NOT A SMALL BUSINESS SET ASIDEX

08/09/2020 504215

1 81

COMMUNICATIONS CENTER (PRO)

245 MURRAY LANE SW

BLDG T-5

PRO-PROCUREMENT DIV

WASHINGTON DC 20223

Multiple

202 406-6940KEISHA PENDER

08/14/2020 1200 ET

FOB DESTINATION

OTHER

(See Schedule)X

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

The purpose of this solicitation is to purchase University Research and Development (R&D) in accordance with the Statement of Work (SOW).

This RFP is for Multiple IDIQ Time and Materials, Labor Hours contract with a Base Year and Four (4)option years.

Proposals are due in response by Friday, August 14,2020 at 12pm.

All Proposals should be sent to Keisha Pender at keisha.pender@usss.dhs.gov.

Period of Performance: 09/01/2020 to 08/31/2025 Continued ...

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS (%) b. 20 CALENDAR DAYS (%) c. 30 CALENDAR DAYS (%) d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations

13. NAME AND ADDRESS OF QUOTER

b. STREET ADDRESS

c. COUNTY

d. CITY e. STATE f. ZIP CODE

14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

16. SIGNER

a. NAME (Type or print)

c. TITLE (Type or print)

a. NAME OF QUOTER

AREA CODE

NUMBER

15. DATE OF QUOTATION

b. TELEPHONE are are not attached

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition not usable

STANDARD FORM 18 (REV. 6-95)

Prescribed by GSA - FAR (48 CFR) 53.215-1(a)

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 81

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

70US0920R70090037

0001 Base Year: NCFI University Research and 1 US

Development

USSS BETC: DISB

Period of Performance: 09/01/2020 to 08/31/2021

1001 Option Year 1: NCFI University Research and 1 US

Development

USSS BETC: DISB

(Option Line Item)

09/01/2021

Period of Performance: 09/01/2021 to 08/31/2022

2001 Option Year 2: NCFI University Research and 1 US

Development

USSS BETC: DISB

(Option Line Item)

09/01/2022

Period of Performance: 09/01/2022 to 08/31/2023

3001 Option Year 3: NCFI University Research and 1 US

Development

USSS BETC: DISB

(Option Line Item)

09/01/2023

Period of Performance: 09/01/2023 to 08/31/2024

4001 Option Year 4: NCFI University Research and 1 US

Development

USSS BETC: DISB

(Option Line Item)

09/01/2024

Product/Service Description: IT AND TELECOM- OTHER IT AND TELECOMMUNICATIONS

Period of Performance: 09/01/2024 to 08/31/2025

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

This solicitation (70US0920R70090037) is for commercial items in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. The solicitation constitutes the only solicitation: proposals are being requested and a written solicitation will not be issued. The solicitation document and incorporated provisions and clauses are those in effect through the Federal Acquisition Circular 2020-

08. The reference number is 70US0920R70090037 and is issued as a Request for Proposals (RFP) unless otherwise indicated herein. This solicitation is Unrestricted. The associated North American Industry Classification System (NAICS) code 541519. The size is large business. The anticipated period of performance will be (1) Base Year and Four (4) Option Years. The Government intends to award a Time and Materials, Labor Hours, Multiple Indefinite Delivery, Indefinite Quantity (IDIQ) contracts for the Department of Homeland Security, U.S. Secret Service as a result of this RFP. The maximum ceiling for this Multiple IDIQ award is $3,200,000.00.

Potential offerors are hereby notified that the solicitation and subsequent amendments to the solicitation will only be available by downloading the documents at BetaSAM) Website at https://beta.sam.gov/. This office will not issue hard copy solicitations. By submitting a response to this solicitation, the vendor will be self-certifying that neither the offeror nor the principal corporate officials and owners are currently suspended, debarred, or otherwise ineligible to receive contracts from any Federal Agency.

This solicitation is comprised of:

I. FORMAT AND SUBMISSION OF PROPOSALS

II. PROVISIONS AND CLAUSES

III. ADDITIONAL INFORMATION FOR OFFERORS

I. FORMAT AND SUBMISSION OF PROPOSALS

Part A.

Pricing :

Offerors shall complete the attached spreadsheet with their proposed unit and extended prices for a (1) Base Year and Four (4) Option Years. See attachment entitled, “Item Description” under “packages” within BetaSAM.

http://www.fbo.gov/

Part B.

Offerors shall provide the methodology used to successfully perform the work outlined in the Performance Work Statement (PWS) to meet the topics.

1) Name, title, telephone number, and email address of the point of contact.

2) Nine-digit DUNS. The DUNS is used to verify that the vendor is in the System for Acquisition Management (SAM). By submitting a quotation, the Offeror acknowledges the Government requirement to be in the SAM database prior to award of any contract.

Information about SAM may be found at www.sam.gov.

3) Nine-digit TIN. The Taxpayer Identification Number is necessary for electronic payment.

4) FAR 52.212-3, Offeror Representations and Certifications-Commercial Items. If you have completed the annual representations and certifications electronically through SAM at www.sam.gov, then provide a statement as such and it will be verified.

5) Relevant Past Performance Prospective contractors must provide examples of relevant past performance. It is requested that the offeror provide the attached Past Performance Survey to their references, who should in turn submit the surveys directly to the contract specialist via email. In accordance with FAR 15.305(a) (2)(iv) an offeror without a record of relevant past performance or for whom information on past performance is not available, will not be evaluated favorably or unfavorably on past performance.

Part C.

Following receipt of the information listed in Part B above, the government will evaluate all prospective offerors and make an award based on the best value trade-off offer that is received from responsible contractors. An award notification will be emailed directly to all interested parties. All documents required for submission of Proposals must be sent to Keisha Pender via email at keisha.pender@usss.dhs.gov and Shauntynee Penix at shauntynee.penix@usss.dhs.gov. Hard copy or faxed quotations shall not be accepted.

II. PROVISIONS AND CLAUSES

See attachment entitled, “RFP 70US0920R70090037- Provisions and Clauses” under “packages” within BetaSAM.

mailto:keisha.pender@usss.dhs.gov

III. ADDITIONAL INFORMATION FOR OFFERORS

All questions regarding the solicitation must be emailed to the contract specialist, Keisha Pender at keisha.pender@usss.dhs.gov and Shauntynee Penix at shauntynee.penix@usss.dhs.gov no later than August 11, 2020 by 12:00 PM EST.

The deadline for receipt of final Proposals are August 14, 2020 by 12:00PM EST.

Communications with other officials may compromise the competitiveness of this acquisition and result in cancellation of the requirement.

ADDENDUM TO REQUEST FOR PROPOSAL

Proposal Submission and Evaluation

Offeror is requested to submit one (1) signed and dated original of the proposal.

Responses shall contain the following:

Selected topic of your choice or a topic from the list of Topics in Section 5 Specific Tasks (**Note: The list of Topics are encouraged). Topic shall not exceed 5 pages.

Quality assurance plan and procedures Past performance information Pricing information

1. Evaluation Steps

Step I, Written: Proposals will be evaluated based on the evaluation criteria described in this request for proposal.

2. Evaluation Factors:

Proposals will be evaluated in relation to the following evaluation factors:

Factor 1 –Fulfillment of the Performance Work Statement Factor 2 - Past performance Factor 3 – Quality Plan Factor 4 - Price mailto:keisha.pender@usss.dhs.gov

PERFORMANCE WORK STATEMENT (PWS)

DIGITAL MULTIMEDIA FORENSIC RESEACH AND

DEVELOPMENT

SECTION 1

INTRODUCTION

1. INTRODUCTION: The United States Secret Service (USSS) Office of Investigation (INV), National Computer Forensics Institute (NCFI) and NCFI-LAB provide digital forensics instruction to state and local law enforcement officers, prosecutors, and judges, develop novel hardware and software solutions for extracting and analyzing digital evidence, and apply hardware and software solutions to support criminal investigations.

This will be a services contract to provide academic institutions with a pathway to utilize their knowledge and skill to further the mission of the Secret Service. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Scope: On an as needed basis, the Contractor(s) shall provide original, not already funded, digital forensics research for any number of the tasks as outlined in section

1.3. An academic institution may mix and match any of the tasks for which they are able to demonstrate a specialized expertise. Any submitted proposals will be the subject of deconfliction with any known research funding outside this contract.

Attached to this PWS is a research topic listing as defined by digital forensics practioners and academics. Proposals are not limited to the topics, but are encouraged.

1.2 The tasks will be conducted at the location specified in the Place of Performance section. The Offeror shall designate a Project Manager as the designated point of contact through which requests can be communicated by USSS personnel.

1.3 Tasks: The tasks are outlined as follows:

1.3.1 Task 1 – Computer forensics, to include live capture;

1.3.2 Task 2 – Mobile device forensics, to include cell phones, skimmers, vehicles, IoT devices, drones;

1.3.3 Task 3 – Network intrusion response, mitigation, apprehension;

1.3.4 Task 4 – Cloud acquisition and analysis;

1.3.5 Task 5 – Audio forensics;

1.3.6 Task 6 – Image forensics, to also video and photography forensics;

1.3.7 Task 7 – Facial identification forensics;

1.3.8 Task 8 – Securing critical infrastructure;

1.3.9 Task 9 – Medical device tampering detection;

1.3.10 Task 10 – Support mechanism for state and local officers that may require technical assistance with a digital evidence examination

1.4 Period of Performance: The period of performance shall be for one (1) Base Year and Four (4) option years. The Period of Performance reads as follows:

Base Year 09/01/2020 – 08/31/2021 Option Year I 09/01/2021 – 08/31/2022 Option Year II 09/01/2022 – 08/31/2023 Option Year III 09/01/2023 – 08/31/2024 Option Year IV 09/01/2024 – 08/31/2025

SECTION 2

GENERAL INFORMATION

2 GENERAL INFORMATION:

2.1 Type of Contract: The government will award an Indefinite Delivery Indefinite Quantity (IDIQ) requisition for the acquisition of academic research projects as proposed by the contractor(s).

2.2 Quality Control Plan: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which the contractor assures them self that work complies with the requirement of the contract. The QCP is to be delivered to the CO, CS and COR, within 30 days after contract award. Updated QCPs shall be submitted to the CO, CS and COR within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

2.3 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

The contractor shall ensure close communication/coordination with the Program Manager (PM).

The contractor shall track requirement milestones, correspondence, and any information regarding current and future procurement requisitions and/or requirements for requisitions.

2.4 Progress Meetings: The PM/COR and onsite contractor personnel shall meet on a monthly basis to discuss progress, review contractor performance, exchange information and resolve emergent technical problems and issues. These meetings shall take place at the Government’s facility or via teleconference for circumstances as agreed to by the government and the contractor(s).

2.5 Recognized Federal Holidays: The contractor is not required to perform services on the following holidays: (other days delegated by POTUS)

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

2.6 Hours of Operation: The contractor is responsible for conducting business between the hours of 9am until 5pm Monday thru Friday except Federal holidays or when the facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

Situational telework, under emergency circumstances, can be granted at the discretion of the SAIC/ASAIC of the NCFI or the COR of the contract.

When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

2.7 Place of Performance: The work to be performed under this contract will be performed at

University 1 University 2 University 3 University 4 University 5 Etc.

2.8 Business Continuity Plan: The contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government within thirty (30) days after execution of award. The BCP shall be updated on an annual basis. The BCP shall document contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum shall include the following:

A description of the contractor’s Emergency Management Procedures and Policy A description of how the contractor shall account for their personnel during an emergency How the contractor shall communicate with the Government during emergencies A list of primary and alternate contractor points of contact, each with primary and alternate:

o Telephone numbers o E-mail addresses

Individual BCPs shall be activated immediately after determining that an emergency has occurred. The BCP shall be operational within 24 hours of activation or as directed by the Government, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of life-threatening emergency, the COR shall immediately make contact with the contractor project manager to ascertain the status of any contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the contractor project manager and the COR shall promptly open an effective means of communication and verify:

Key points of contact (Government and contractor) Temporary work location (alternate office spaces, telework, virtual offices, etc.)

Means of communication available under the circumstances (e.g., email, webmail, telephone, fax, courier, etc.)

Essential contractor work products expected to be continued, by priority

The Government and the contractor project manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances. Contractors shall obtain approval from the CO prior to incurring costs over and above those allowed for under the terms of this contract.

2.9 Security Requirements:

The contractor and his/her employees and sub-contractors shall be citizens of the United States or lawful permanent residents (Green Card holders).

The US Secret Service Contracting Officer Representative (COR) or their US Secret Service designee is responsible for determining the contract employee’s position description level as being either Escort Access, Low Risk, or High Risk. The COR or their designee will also make the determination when contract employees require access to US Secret Service controlled Information Technology systems, unless otherwise stipulated within this Statement of Work.

Contract employees shall undergo a Contentious Evaluation as determined by the US Secret Service’s Security Management Division’s, Contractor Support Branch (SMD- CSB) prior to performing any work within US Secret Services controlled access facilities or on US Secret Service’s information technology systems. Additional Contentious Evaluations will be required for continued work requirements as determined by SMD-CSB, but no less than once every two years.

All contractors shall ensure that their employees are pre-cleared prior to the start of any US Secret Service (USSS) contract. Contractor employees for High Risk shall possess a current Tier 4 investigation and a Public Trust prior to performing any work within USSS controlled access facilities or on USSS information technology systems.

The COR or their designee is responsible for ensuring that all employees supporting USSS contracts are compliant with USSS security requirements. Additional Contentious Evaluations shall be required for continued work requirements as determined by Security Management Division (SMD).

At a minimum, the contractor shall submit to the COR the following completed documentation for each High-Risk contract employee requiring access to US Secret Services controlled access facilities, in order to satisfy initial and/or recurring (as requested by the COR) Contentious Evaluations:

DHS-11000-25: Form Contractor Fitness/Security Screens Request Form SSF 4024: US Secret Service Non-Disclosure Agreement SSF 3230A: Disclosure and Authorization Pertaining To Consumer Reports

Pursuant To the Fair Credit Report Act Form 14767: Consent to Disclose Tax Compliance Check (IRS Tax Form)

When work performance requirements exceed Non-Sensitive standards, additional Contentious Evaluations reviews will be required prior to access being granted, specifically:

Contract employees who provide support in Non-IT Low Risk positions must have undergone a minimum of a Tier 1/NACI (National Agency Check and Inquiries) or a higher level favorable Public Trust background investigation within the last 5 years.

Contract employees who provide support in High Risk positions must have undergone a minimum of a Tier 4 Public Trust or higher-level favorable background investigation within the last 5 years.

• For certain positions, SMD may require a contractor to complete the below electronic forms and be subject to a personnel security interview:

• Low Risk - SF 85: Questionnaire for Non-Sensitive Positions

• High Risk - SF 85P: Questionnaire for Public Trust Positions

2.9.1 Privacy Act: Personnel who have access to Privacy Information shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

2.9.2 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

At the close of each work period, government facilities, equipment, and materials shall be secured.

2.9.3 Badge Control: The contractor shall establish and implement methods of making sure all badges issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. No badges issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering badge control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued badges by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate badges to the COR and

PM.

The Contractor shall prohibit the use of Government issued badges by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR and PM.

2.9.4 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

2.9.5 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the

Contracting Officer’s Representative and Contractor of any deficiencies;

coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of appointment issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

2.9.6 Key Personnel: The following personnel are considered key personnel by the government: The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 7am to 5pm, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

Contracting Manager:

Alternate:

2.9.7 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear an NCFI badge in the performance of this service.

2.9.8 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. Contractor personnel shall be required to sign SSF 4024: US Secret Service Non-disclosure Agreement.

The Contractor shall notify the Contract immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the COR to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the COR may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

2.9.9 Payment for Unauthorized Work. The Contractor will not be paid for the performance of work that is not authorized under the contract. No payments will be made for any unauthorized services or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor on their own volition or at the request of an individual other than a duly appointed PM or COR. Only a duly appointed CO is authorized to change the specifications, terms, or conditions under this effort.

2.9.10 Removing an Employee (contractor) for Misconduct or Security Reasons.

The Government at its sole discretion may direct the Contractor to remove the contractor employee from the facilities for misconduct or security reasons.

Such removal does not relieve the Contractor of the responsibility to provide sufficient qualified staff for adequate and timely service. The Government will provide the Contractor with an immediate written rationale for the removal of the employee through the USSS COR.

SECTION 3

DEFINITIONS & ACRONYMS

3. DEFINITIONS AND ACRONYMS:

3.1. DEFINITIONS:

3.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

3.1.2. CONTRACTING OFFICER (CO). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

3.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations.

This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

3.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

3.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes, reports, software coding.

3.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

3.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.3.1.8. QUALITY ASSURANCE (QA). The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

3.1.9. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

3.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

3.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor.

The Government does not have private of contract with the subcontractor.

3.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

3.1.12. WORK WEEK. Monday through Friday, unless specified otherwise.

3.2. ACRONYMS:

ACOR Alternate Contracting Officer's Representative CFR Code of Federal Regulations CO Contracting Officer COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf FAR Federal Acquisition Regulation HSAR Homeland Security Acquisition Regulation OCI Organizational Conflict of Interest PM Program Manager POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program TE Technical Exhibit

SECTION 4

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

4. GOVERNMENT FURNISHED ITEMS AND SERVICES:

4 General: The Contractor will provide the workspace, equipment, and supplies necessary to perform the required services. The Government will provide the required computer/laptop to obtain access to the USSS network (if applicable). The Government will provide the required training (if applicable).

4.1 Contractor Liability: The contractor shall conserve and protect Government resources. The contractor shall utilize Government equipment for official business only and in accordance with applicable laws, regulations, policies, etc., as well as safeguard said equipment. The contractor shall bear the cost of any damage to Government-owned equipment due to contractor negligence.

SECTION 5

SPECIFIC TASKS

5 SPECIFIC TASKS:

5.1 Contractor Personnel qualifications:

• High school diploma (or the equivalent) and not less than one year of experience in programming languages to include, but not limited to, HTML, Java, C+, and C#, Python, CSS.

• Experience with file systems, operating systems, and memory management.

• Experience writing in technical writing is preferred.

5.2 Deliverables

Deliverables of these tasks may be in the form of hardware, software, or documented (repeatable and verifiable) processes.

Certification by the Government of satisfactory services provided shall be contingent upon the contractor performing in accordance with the terms and conditions of the contract, this document, the approved technical and cost proposal, and all amendments.

The USSS COR may be encouraged to meet bi-weekly at the place of performance to discuss performance and the following deliverables:

Monthly Project Status report in Electronic Format due 10th workday of every work month. Report should include:

• Accomplishments, planned activity, Assistance needed, Issues/problems and amount of time and money expended.

• All Contractor developed processes and procedures and other forms of intellectual property developed under TOs issued against this contract shall be considered Government property.

• All documentation, photography, and electronic data and information collected by the Contractor and entered into or generated in support of TOs issued against this contract shall be considered Government property, and shall be returned to the Government at the end of the performance period.

Final Report in Electronic Format due within 10 days of end of each contract year.

The following is a listing of encouraged, but not required research topics for Digital Multimedia Forensics. Topic shall not exceed 5 pages:

Validation Repository Documents recommending mandatory accreditation of forensic laboratories continue to be published. To assist agencies that may be lacking some of the necessary resources in becoming accredited, a central repository of software validation reports needs to be created, specifically for multimedia evidence, e.g. video, audio, image. Additionally, validation reports of tools provide tremendous value. More specifically, a report that that validates a tool claim is of primary importance. For example, DVR Examiner claims to collect all data; is this claim accurate? The repository should be open to the public.

Submitters of the validation reports will use a format prescribed by NIST.

Control Systems Forensic Acquisitions and Analysis Tools and processes for both incident response and forensic analysis of industrial internet of things (IIOT), industrial control systems (ICS), and supervisory control and data acquisition systems (SCADA) must be developed.

Virtual Reality Headsets A study needs to be completed to determine what types of data can be recovered from virtual reality devices. Once the artifacts are identified, a tool / process for data acquisition and analysis needs to be created. Early research into these devices indicate that new acquisition methods may need be required.

Drone interception / tagging State and local law enforcement has limited options to address to reports of drone activity. A reasonably priced, non-classified solution needs to be addressed to intercept and safely land drones. Additionally, the solution should allow the remote “tagging” of devices to allow an officer to track the drone to a landing location.

VR Forensics

A study needs to be completed to determine what types of data can be recovered from virtual reality devices

Wearables What data, beyond what is exposed to the user, may be available from devices to include smartwatches and fitness trackers. i.e. there are situations where a wearable may be able to establish a time of death not otherwise known.

Autopsy Module, Bootable USBs Software code that loads to a bootable drive that allows to search for artifacts based on examiner selected options, e.g. time/date, images.

Case Management Tracking Software Case management software that collects statistical information regarding the types of exhibits examined, whether encryption was present, whether encryption did not allow for the exhibit to be examined, etc. The data will be used for an agency to make curriculum, tool, and training decisions.

AI Tool to Determine Age of Child Exploitative Material Investigators and digital forensic examiners are tasked with viewing and determining if child exploitative material exists on digital media. This is time consuming and has a negative impact on the examiners mental health. An AI tool to perform this review and identify images of child exploitative material can automate the process. Additionally, an error rate for the tool can be calculated and used to potentially report a number of images without examiner interaction.

Study on the authentication constraints for video from mobile devices based on the methods used for extraction (transmission) of video from the device Binary objects differ in regard to structure and resolution depending on the method used to transmit/extract video from a mobile device. This study would gather samples from a wide set of device types and uses multiple extraction methods per device. It would document the differences and results in a clearinghouse of information for examiners and investigators to understand the effects on authentication practices of data from devices, e.g., PRNU analysis, Structural Signature analysis, literal metadata analysis.

Image Distortion Removal Tool Identify and validate a restoration tool to partially or completely remove image distortion imposed by known wide angle lenses used in smart doorbells. The tool is designed specifically to follow a process for un-distorting the particular image under examination.

As these distortion problems may be described mathematically, a specific filter can be designed to compensate for each distortion. The degree to which a distortion can be successfully removed may be limited by the accuracy with which the actual distortion process can be described mathematically.

Hand Skin Feature Database

Capture standardized images of hands to create a database of images that can be used by examiners when conducting photographic comparison and by researchers when assessing the individuality of skin features. The standardized approach used will allow for future additions to the database from other researchers. The availability of the database will also allow for future research on this collection of images.

Drone Photogrammetry Scanning Tool Study There has been a big shift in law enforcement to using drones for crime scene measurements. There has been no real research in this area showing the accuracy or ability for personnel to use this effectively. A study is needed to determine the reliability of these devices and if they really have a role in forensic investigations.

Packet Inspection Tool (Forensic Committee) Tool or a plug-in to an existing tool that:

- Identifies network traffic based on port, ip address, e.g. one could hover over the packet in something like Wireshark and the tool would identify the source application, e.g.

Facebook Messenger.

- Pulls streaming video and images from either a live network stream capture or a saved capture, e.g. pcap file, enabling the file to display in its native format.

Image Comparison (Image Committee) (latent/image comparison) - During the process of performing comparison work involving images processing may occur to clarify the image. Have a program which can perform a comparison of the original image and the clarified image at the pixel or macro block analysis level, e.g. this was added, this was changed and showing that information was added/removed of what values were changed in a pixel. If there is a specific area in an images which is important in drawing a conclusion, one can analyze the changes to assist in the interpretation of the information in forming their opinion/conclusion.

Aspect Ratio Tool to easily identify the level of compression and original aspect ratio. Can utilize existing timestamp display research of video files to identify original recording source.

Software tool that can analyze video files and identify the amount of compression or degradation of video files as compared to a possible original. Also identify proper aspect ratio in the event that this is different from the originally recorded. Possibly display in a visual format to make it easy to explain to the layperson/jury. This would assist in demonstrating why video appears the way it does and why something may not appear in digitally recorded video but actually happened in real life. A bit of a unicorn but would be cool to have along with some pixie dust.

Haptic Gloves As technology evolves and connectivity expands, there needs to be an easy way to interact with video and images on large screens. With the advent of multi-touch mice, there is some ability to drag and zoom available, but a tool should be developed to easily share to connected screens, zoom to areas of interest and manipulate playback speed from a singular device. Hollywood has a lot of bad ideas when it comes to how Forensics works, but technology also tends to evolve from ideas made popular in TV and movies.

While we have stun guns, mobile video communicators, and even remotes that operate doors and windows, a motion sensitive wearable has yet to be made to move and manipulate video and images.

Frame Rates A black box study that defines error analysis for speed determination of vehicles depicted in video, based on frame rates, compression algorithms, and resolution needs to be developed.

Containerized environments and associated technologies (e.g. Kuberbetes, Amazon) While the underlying concept is not new, there has been significant movement recently towards containerized application deployments, especially in enterprise environments.

This has also led to increased ubiquity of related technologies, such as orchestration systems like Kubernetes, software-defined and overlay networks, distributed/cloud storage (and other “new” storage paradigms), and deployments where computer, storage, and other resources are spread across on-premises resources and potentially multiple “cloud” providers. These technologies introduce new types of potentially relevant forensic artifacts, potentially change the location of “traditional” artifacts, and may add complexities and nuances to acquisition and analysis processes. Research into what artifacts are available and best practices for acquisition and analysis would help us keep pace with these technology advances.

Anti-forensics awareness and detection Training curriculum needs to be developed regarding raising awareness to practitioners of anti-forensics techniques and tools. Additionally a software application needs to be developed for the detection of current and future anti forensics tools and techniques, e.g.

malware that after execution wipes itself, obfuscation, artifact wiping.

Data artifacts from artificial intelligence environments A study to determine what artifacts of evidentiary value may exist on artificial intelligence (AI) systems, software and connected devices. Are there ‘logs’ of AI decisions that can be identified and followed? Can the AI decision trees be identified (or even altered) from the systems or will it require analysis of source code from the AI vendor? What specific artifacts from AI systems that can answer forensic questions? e.g.

a suspect claims that he didn’t run over the victim, his autonomous car did.

AI technology to speed up investigations Study and tool opportunities. With identification of processes that exist in digital forensics capabilities that can be repeated in software systems, a defined algorithm could be implemented to execute the process and decision tree. What digital forensics processes and decisions trees are repeatable and consistent enough to be implemented in elementary artificial intelligence algorithms?

Quantum computing digital forensics

A study to determine how US law enforcement can leverage quantum computing to tackle difficult problems, e.g. encryption. Additionally, the study should include what artifacts are available that indicate quantum computing was being used.

Logical Acquisition Tool There is currently no industry standard tool to acquire logical files to an open source format forensic storage container. The two prevailing tools/formats are based upon proprietary code, not compatible with each other, and not readable by many other forensic tools. An open source forensic container format does exist (AFF4) however, no tools have yet been developed to acquire logical files to it.

A tool to enable trained and non-forensically trained personnel to forensically preserve LOGICAL files/data provided to them by witnesses or victims (e.g. photos, cell phone video, other digital documents) when the consent scope or other circumstances preclude acquiring the entire volume or device.

Requirements open source writes to an open source container GUI and command line interface versions for Windows/Linux/OS X does not require installation runs without administrator privileges can be executed as an administrator to acquire target file system meta calculates and preserves hash values for acquired files as well as for the entire container can verify hash values for acquired data can export individual acquired files from a container can mount a container as a volume on the host

Standard Metadata Dictionary Through research/polling of agencies/regulations, a standard data-dictionary needs to be developed addressing required metadata that needs to be maintained when preserving digital archives.

Database Forensics A better set of tools needs to be developed for enterprise level database forensics. There are plenty of forensic tools that address sqlite, but not enough for Oracle and other full databases. As such, examiners end up having to create the proper queries. As it is not expected that a typical, competent, examiner has the ability to write their own scripts to parse a binary image, the same is true for database query construction. The tool should allow for indexed searches similar to other traditional forensic tools, as well as have analytics to assist in pivoting to other types of information.

Decision Tree

A decision tree application needs to be developed that can be pushed to investigators to assist in the field acquisition of oddball or outlier DVR manufacturers. The application should include a walkthrough of items such as:

- identification of dvr makes/models;

- a workflow to retrieve the best quality video acquisition;

- fields that guide the user to proper documentation.

SOP Tree Mobile application that can take any SOP, configure it into a decision tree, and allow a user to input notes, pictures, etc.

MDM Study A study needs to be developed to address Mobile Device Management tool artifacts, e.g.

what artifacts remain if a device is removed from or “wiped” by a service. Additionally, if the service is removed for the purpose of conducting an exam, what are the residual effects of doing so. Also, a SOP needs to be developed addressing the proper way to remove a service and the examination steps that should follow.

Automated Camera Resolving Power Tool An automated tool to determine what the effective resolving power is for any image capture device. Items such as latent prints, shoe impressions, and tire tracks need to be captured at a resolution that allows for minute detail to be resolved for the most effective analysis. Current methods of determining the resolution of a camera system are very manual, expensive and constitute a sophisticated process that most departments cannot, or will not conduct. This tool will eliminate the subjective nature of this testing and standardize the quality of images across the law enforcement community by making it automated, no cost and easy to do. The tool packages a validation, verification and certification of a camera system to capture images for forensic analysis. This tool, be it an app or website of installable software, would be freely available to law enforcement agencies thereby increasing the testing of camera systems, standardizing the verification of them and significantly increasing the quality of evidence images taken.

Encryption Containers A tool needs to be developed to allow a brute force attack on an encrypted container. The container (most likely in the form of a binary file) should be loaded into an emulator to allow for attacks without concern for incorrect attempt or time lock-outs.

Infrared Transmitters Tool that identifies infrared transmitters, e.g. looking down a street and identifying existing video cameras as potential sources of digital artifacts.

Infrared Cameras Infrared cameras do not give accurate colors; a study is required to show how colors actually display under IR.

DVR Specifications

Study to prove/disprove a dvr’s quality specifications of recovery, e.g. analog screen captures vs traditional.

Image Authentication The use of the PRNU tool to authenticate images (matching) is acceptable for older cameras; however, newer cameras have vibration reduction, etc. that destroys the artifacts required by PRNU. What else can be used?

Errors of Height Subject height is typically determined using photogrammetry; however, errors rates of the newer laser scanning photogrammetry process can complicate the situation, but by what degree?

Lead Generation A tool is required for leads generation for field investigative agents. The tool will provide a ‘quick look’ at forensic exam artifacts in order to assist with the investigation. The tool's function will be isolated from the deeper forensic examination. All processes will be logged.

Analytics Pivot A cyber analytics tool is required for quick ip, mac, etc. resolution/connection to pivot from recovered data to additional case leads, e.g. location vectors for intrusions.

VR Forensics A study needs to be completed to determine what types of data can be recovered from virtual reality devices

Wearables What data, beyond what is exposed to the user, may be available from devices to include smartwatches and fitness trackers.

5G As land based mobile networks and handsets evolve to 5g, what will the implications be for current investigative techniques and forensic methods.

Containerized environments and associated technologies While the…