Attachment 1 SOW Software A IDIQ Amd 2.docx

ATTACHMENT 1, Revised Amendment 2, 6/17/2024, see track changes

UNITED STATES SECRET SERVICE

Forensics Software, IDIQ A, (Brand Name or Equal) Statement of Work (SOW)

The purpose of this Statement of Work (SOW) is to acquire six forensics software products and training, brand name or equal, on an as needed basis in support of the United States Secret Service (USSS) National Computer Forensics Institute (NCFI).

These products are utilized within training courses offered by the NCFI to law enforcement personnel, judges, and prosecutors from around the country. The products are transitioned from the classroom to the students for use within their law enforcement jurisdictions to support their on-going and future law enforcement cyber and digital forensics investigations.

1. Background The USSS was established as a law enforcement agency in 1865. While most people associate the USSS with Presidential protection, our original mandate was to investigate the counterfeiting of U.S. currency--which we still do. Today, our primary investigative mission is to safeguard the payment and financial systems of the United States. This has been historically accomplished through the enforcement of the counterfeiting statutes to preserve the integrity of United States currency, coin, and financial obligations. Since 1984, our investigative responsibilities have expanded to include crimes that involve financial institution fraud, computer and telecommunications fraud, false identification documents, access device fraud, advance fee fraud, electronic funds transfers, and money laundering as it relates to our core violations. Today’s high-tech environment presents new challenges to law enforcement as cyber criminals and others increasingly exploit computers and the internet to threaten our banking, financial, and critical infrastructures.

The NCFI provides training to state/local law enforcement, prosecutors, and judges in many areas of digital forensics and cyber investigations. To assist in investigating and prosecuting Law Enforcement cases, the USSS NCFI requires commercial forensic software products to support its Congressional mandate. All items are to be brand name or equal.

This is a commercial Indefinite Delivery Indefinite Quantity (IDIQ) contract to acquire six types of forensic software, on an as needed basis, in support of the NCFI. This IDIQ has a 5-year ordering period.

2. Scope

The contractor shall deliver the following six types of forensic software products (brand name or equal) to the NCFI located in Hoover, Alabama:

(1) Cyber Triage with in-person instruction by Sleuth Kit Labs, with three (3) years Software Maintenance Services (SMS)

(2) Oxygen Forensic Detective by Oxygen Forensics with two (2) years Software Maintenance Services (SMS)

(3) CellHawk with in-person instruction by LeadsOnline 70US0924R70094619, Forensics Software, IDIQ A

(4) TRM Forensics with in-person instruction by TRM Labs

(5) Amped Five with in-person instruction by Amped Software

(6) Authenticate with in-person training by Amped Software Each set of software shall contain the required, brand name or equal items (as appropriate) as listed within the tables in Section 3 of this document. If substitutes are offered, the contractor shall notify the government by providing manufacturer specification sheet(s) for government evaluation and agreement the “or equal” offered is equivalent to the brand name items requested (see paragraph 4.2 for further details regarding this process).

3. Requirements: Products/Services In accordance with the ordering procedures, the contractor shall provide the following products/ services, as defined in this SOW, as orders are placed on the IDIQ.

3.1 Cyber Triage. Cyber Triage by Sleuth Kit Labs, brand name or equal, shall meet the following technical parameters:

· Two day in-person classroom instruction by Sleuth Kit Labs representatives at the NCFI facility in Hoover, AL, for every 20 or more licenses activated covering the use of the tool for criminal investigations.

· Three years of software maintenance services that includes software updates and support.

· Provides fast automated collection, analysis, and correlation of data that ensures complete threat assessments.

· Investigates endpoints to determine severity and scope of SIEM system alerts.

· Integrates with other leading cyber security tools: Demisto, DFLabs, IBM QRadar SIEM, IBM Resilient, Phantom, Polyswarm, ReversingLabs, Splunk, The Sleuth Kit, Swimlane, Volatility, and Yara

· Provides automated techniques and backend databases that allow collection, analyzing, and interpretation of results.

· Provides an agentless approach that works when security teams don’t have administrator privileges.

· Investigates endpoints by pushing the collection tool over the network, collecting relevant data, and analyzing it for malware and suspicious activity.

· Provides a score assessment to digital forensic artifacts that determine how relevant an item is to an investigation.

· Possesses the ability to ingest disk images, logical file sets, and outputs from other collectors in order to parse registry hives, event logs, and other source files with artifacts.

· Capable of scanning executables with 40+ malware detection engines.

· Provides recommended artifacts for investigative follow up.

3.2 Oxygen Forensic Detective. Oxygen Forensic Detective by Oxygen Forensics, brand name or equal, shall meet the following technical parameters:

· Two day in-person classroom instruction by Oxygen Forensics representatives at the NCFI facility in Hoover, AL, for every 20 or more licenses activated covering the use of the tool for criminal investigations.

· Two years of software maintenance services that includes software updates and support.

· Offers data extraction from Apple iOS, Android devices, feature phones, media, and SIM cards.

· Offers simultaneous acquisition of several devices.

· Imports numerous backups and images, including iTunes, Android backups, GrayKey, JTAG, Chip-off, UFED, XRY images, .dar archives, Warrant Returns, and more.

· Has proprietary methods to bypass screen locks on mobile devices, including Samsung, LG, Motorola, as well as devices based on Mediatek, Spreadtrum, Kirin, Exynos or Qualcomm chipsets.

· Can automatically find passwords to encrypted iTunes backups and Android images.

· Allows investigators to gain access to cloud services that include iCloud, Google, Microsoft, Samsung, Huawei, E-mail server, Facebook, Twitter, Instagram, Dropbox, WhatsApp, Telegram, Viber, WickrMe, etc.

· Offers the ability to decrypt WhatsApp backups via phone number.

· Allows users to utilize either account credentials or tokens to access any supported cloud storage.

· Can extract credentials and tokens directly from a mobile device as well as collect them on Windows, Mac, and Linux OS computers. Credentials can then be used to extract evidence from the associated cloud service.

· Possesses the ability for verbose data parsing and analysis from drone collections, flight logs, mobile apps, and cloud services.

· Can create or import drone physical extractions and parse GPS locations showing valuable route data as well as device telemetry to include: speed, direction, altitude, temperature, and more.

· Supports data from various models of DJI and Parrot drones.

· Allows users to decode drone images and videos, locations with time stamps and other data. Provides for drone data extraction from cloud services that can be accomplished via login/password or token from DJI, SkyPixel or My Parrot clouds.

· Possesses a utility for extracting and decrypting credentials, system files, and user data from web browsers and desktop apps on computers running Windows, macOS, or Linux.

· Supports numerous desktop apps supported, including WhatsApp, Viber, WickrMe, Telegram, Skype, Signal, Microsoft Mail, Microsoft Outlook, Thunderbird, all the popular Web browsers, pre-installed Apple apps, etc.

· Allows for collected tokens and passwords to be used for cloud data extraction while extracted web browser, messenger, and email data that can be imported for further analysis and analytics with mobile data artifacts in one case.

· Offers data extraction from Amazon Alexa and Google Home.

· Can perform logical acquisition of smartwatches based on MTK chipsets allowing forensic experts to extract device model, contacts, calls, messages, multimedia files, and other data.

· Can acquire complete data from various fitness apps, like Apple Health (including data synched with Apple Watch), Samsung Health, Google Fit, FitBit, Endomondo, and more.

· Possesses Optical Character Recognition which allows investigators to easily convert any words contained in a screenshot or photo to machine-encoded text.

· Offers the use of a quick filter to search for text across the processed images.

· Displays statistical analysis such as an Activity Chart, Activity Matrix, Last Contacted, Data Types, Top 10 Applications, Contacts, or Groups.

· Display the investigator’s interactions with the evidence, including: assigning tags, marking data as Key Evidence, adding and editing notes, running hash set searches.

· Provides a convenient platform to explore social connections between a device owner and contacts or between several devices.

· Provides a Timeline section that provides a view of all device events in one list – chats within apps, calls, web activity, web connections, photos and videos, calendar events, and more. Events can be viewed for one device or a group of devices, allowing easy identification of common group activities. Sort and filter by date, time, activity frequency, contact, remote party, or other data points to focus only on the most relevant data.

· Compiles a full list of geo coordinates from all the sources that include photos, videos, apps, drone flight logs, and more to identify a device’s frequently visited places, a visualization of a device’s movements within specified period of time, and pinpoints common locations of several devices

· Allows searching across a single device, all devices in a case, or all devices in a database for text, phone numbers, email addresses, geo coordinates, IP addresses, MAC addresses, credit card numbers, and file hashes including Project VIC.

· Provides a Regular Expression library is available for custom search functions, and the Keyword List Manager and Watchlists allow investigators to create a set of keywords and perform searches during or after an extraction.

· Provides the ability to classify images into eighteen different categories that include pornography, extremism, drugs, alcohol, and weapons while importing device data and also on already-imported extractions.

· Allows users to create and set their own tags, as well as export entries to data reports by simply selecting the relevant tags.

· Offers the ability for investigators to categorize human faces that includes detailed face analytics (gender, race, age), immediate categorization and matching, and support for massive volumes of data.

· Allows the creation of reports that can be sent to colleagues to be opened in a free portable utility application viewer.

· Offers advanced analysis of Plist files.

· Allows Investigators to open plain XML and binary XML files, view entries according to their type (string, data, numbers, etc.), convert values, open external files for analysis, and export .plist file data in XML format for further analysis by external tools.

· Provides data export from any section to many popular file formats including PDF, RTF, XLS, XML, HTML, etc.

· Allows a report to be created to include a single device, several devices, several sections or even selected records. Reports are highly customizable to display only the data required for any type of case. XML reports can be integrated into other analytic software platforms.

· Can export data into the Relativity software format.

· Provides a SQLite Viewer for examining SQLite files that allows investigators to open any SQLite database, recover deleted records, convert values to a readable format, build visual and non-visual SQL queries and save them for further use, run search, and finally export selected entries to customization data reports.

3.3 CellHawk. CellHawk by LeadsOnline, brand name or equal, shall meet the following technical parameters:

· Two days of in-person classroom instruction by LeadsOnline representatives at the National Computer Forensics Institute’s facility in Hoover, Alabama for every 20 or more licenses activated covering the use of the tool for criminal investigations.

· One year subscription with software maintenance services that includes software updates and support.

· Capable of ingesting any record with a date and timestamp, incoming and outgoing numbers, and geo-location data.

· Supports records from carriers including AT&T, Spring, USCellular, Metro, Cricket Wireless, Verizon, Facebook, Google, Snapchat, TextNow, Cellebrite, and Uber.

· Extracts meaningful data to provide pattern analysis of data

· Provides clean, simple, accurate visuals of data.

· Accepts, analyzes, processes and maps all call detail records and tower dump records.

· Provides animation analysis tools to visualize geolocation data over time.

· Maintains current cell tower and sector location data.

· Provides drag and drop functionality for call detail record mapping.

· Provides link analysis for connections between multiple phones and their interactions.

3.4 TRM Forensics. TRM Forensics by TRM Labs, brand name or equal, shall meet the following technical parameters:

· Five days in-person classroom instruction by TRM Labs representatives at the NCFI facility in Hoover, AL for every 20 or more licenses activated covering the use of the tool and the investigation of cryptocurrency for criminal investigations.

· One year of software maintenance services that includes software updates and support.

· Assesses risk and identifies any previous suspicious activity related to an NFT before engaging with a buyer or seller.

· Maintains a 99.99% API uptime and operates on a highly available public cloud architecture.

· Provides comprehensive risk profiles for wallets, addresses and entities, including high-risk on- chain activity or affiliates.

· Traces the flow of funds across 29 different blockchains and 70 million digital assets, all within the same graph or table

· Allows users to collaborate with their team in real time using built-in case management that allows the addition of notes, uploaded files, or link graphs, customers, transactions, alerts, and addresses to build a case.

· Allows searches for an address, transaction, entity or event to view comprehensive risk profiles for wallets, addresses, and entities.

· Builds graph to trace the flow of funds.

· Allows user to move seamlessly across blockchains to trace the flow of funds and visualize multi- layer relationships with automated tracing.

3.5 Amped Five. Amped Five by Amped Software, brand name or equal, shall meet the following technical parameters:

· Two days in-person classroom instruction by Amped Software representatives at the NCFI facility in Hoover, AL for every 20 or more licenses activated covering the use of the tool for criminal investigations.

· One year of software maintenance services that includes software updates and support.

· Provides forensic image and video enhancement capabilities with fully customizable processes for conversion, restoration, enhancement, measurement, presentation, and reporting.

· Possesses more than 140 filters and tools to convert, process, enhance, analyze, present, and document images and videos.

· Has been validated and accepted for use in US criminal courts.

· Works with images, videos, and most proprietary CCTV/DVR formats

· Converts the majority of formats from video surveillance systems with no quality loss.

· Analyzes specific details of images and videos such as EXIF metadata, video format and codec features, frame-by-frame encoding type, and compression macroblocks.

· Allows the selection of frames of interest and selecting a range, a specific view, or specific frames defined by the user.

· Processes the frames by combining multiple filters and tools in order to restore specific defects and enhance the final result.

· Estimates the height of a person from an image or the speed of a vehicle from a video.

· Creates video presentations by combining multiple sources, applying annotations, and audio and video redactions to footage.

· Automatically generates a report containing the scientific methodology of all processing steps.

3.6 Authenticate. Authenticate by Amped Software, brand name or equal, shall meet the following technical parameters:

· Three days in-person classroom instruction by Amped Software representatives at the NCFI facility in Hoover, AL for every 20 or more licenses activated covering the use of the tool for criminal investigations.

· One year of software maintenance services that includes software updates and support.

· Provides complete software capabilities to unveil the processing history of a digital image or video.

· Provides over 40+ tools and filters that include integrity analysis, content tampering analysis and deepfake detection.

· Provides resources on the web for carrying out reverse image search, cross-checking image location and sun position, and retrieving reference images for integrity analysis.

· Allows for bath processing, customizable configurations, and optional post-processing parameters.

· Provides image ballistic tools that allows a user to verify which camera was used to shoot a specific photo, even if the photo has been scaled, cropped, or re-saved.

· Produces a customizable forensic report that explains and details results and allows for reproducible results.

3.7 Product Activation Timing. NCFI operates on a trimester system. Class trimesters are from October through January, February through May, and June through September. The following trimester’s course schedule is announced at the beginning of the proceeding trimester. (e.g., October through January’s course schedule is announced in June; February through May’s course schedule is announced in October, etc.) The NCFI COR will coordinate with the vendor 60-90 days prior to the course start date, to assure ample quantity of the software line items are ordered, delivered, and on hand to support the class start date. However, The product/license start date of all products the software line item (license) shall will NOT activate or start until the first day of class. at the NCFI. This date will be given by the COR of the contract or their designee to a POC at the vendor’s company 60-90 days prior to the start date of the class. Note: There are typically 25 students per course, yet not all will attend, therefore the government COR will work with the vendor to assure only the required number of licenses are activated at the class start date. The governments’ goal is to provide as much advanced notice as possible.

4. Acceptance:

4.1 *Each software package shall be packaged in a courier shippable cardboard box with contents labeled on the outside indicating the contents and type of software. Each box should not be more than 40 pounds in weight.

4.2 All deliveries are the contractor’s responsibility. The contractor shall coordinate the deliveries with the Contracting Officer’s Representative (COR) or Office Point of Contact (POC) prior to the delivery, specifying the date and time (see paragraph 7 for the POC information). The contractor shall be responsible for off and on loading equipment and materials. Coordination of deliveries shall follow the process noted below:

(a). Vendor shall email a detailed shipment tracking spreadsheet to Michael.Searcy@usss.dhs.gov and Robert.peterson@usss.dhs.gov when items are shipped and when delivery service verifies delivery.

(b). Software packages shall not be shipped until complete. To do otherwise, requires written approval from the COR (Michael Searcy).

(c). No substitutions are allowed without written approval from the COR.

(d). Contractor shall email a detailed shipment tracking spreadsheet to Michael.Searcy@usss.dhs.gov and Robert.Peterson@usss.dhs.gov when items are shipped and when delivery service verifies delivery.

(e) Vendor shall email a courtesy copy of all invoices uploaded to IPP to Michael.Searcy@usss.dhs.gov and Robert.Peterson@usss.dhs.gov.

4.3 Software Packages shall be delivered no later than the dates indicated within each Delivery Order awarded on this contract. Deliveries MUST be scheduled. If the delivery has to be turned away the vendor will incur the cost for return and reshipment to destination. * Hours of Delivery: 0800-1500 CST (-6 UTC)

4.4 Place of Delivery: NCFI

Attn: Michael Searcy 2020 Valleydale Road, Suite 209 Hoover, AL 35244

4.5 Within each delivery order issued on the IDIQ, the contractor will be required to coordinate and work closely with the USSS technical point of contact for the duration of the project.

4.6 The USSS technical point of contact will notify the contractor in writing of the acceptance or rejection of each deliverable. The review time by the Government will vary based on the size and complexity of the deliverable. Rejected deliverables shall be returned and corrected by the contractor within ten (10) working days of return receipt from the USSS technical point of contact. To assure success with resolving issues promptly, the Contractor shall provide the Government with a support process (help desk or other such process). Hours of availability shall be at a minimum of 8:00 am to 4:00 pm CST, Monday through Friday.

5. Contract Type and Ordering Procedures.

5.1 Type of Contract: The Government will award a commercial IDIQ with an ultimate completion date of 60 months from the date of contract award. This is a firm-fixed price IDIQ with a 5-year ordering period from date of award through 60 months.

5.2 Contract Attachment 3, Approved Pricing Table: This contract attachment establishes the pricing and anticipated delivery order data (across the ordering periods), for each software package. This table shall be used when placing delivery orders as it specifies the approved firm fixed price per line item.

5.3. Ordering Procedures: The complete ordering procedures are contained within Contract Attachment 2, Clauses. As stated above, the FFP price per line item is contained within Attachment 3. The initial delivery order may be executed (awarded) at time of the IDIQ award. When executing subsequent delivery orders the government shall supply the contractor the type of software being acquired, the quantity of each being acquired, the required dates of delivery and send the draft order to the contractor for review and agreement. Once agreement is received, the Government will award the delivery order and provide the Contractor with the final approved copy to execute deliveries against.

5.4 Note: the Government anticipates procuring a set of all software packages at the start of each quarter, within the calendar year, and order them 90 days in advance of the required need date. full complement of each software line item to support the course schedule (see trimester plan, SOW paragraph 3.7) by placing an order every 4 months or three times per year at the start of each trimester, dependent on government funding flow. If funding does not flow in this steady fashion, the government may place large orders (April – September) and a number of smaller orders (October – March) to assure the annual needs are met for the calendar year. All orders will be placed IAW FAR 52.216-19 in Attachment 2 of the contract. Regardless if funds flow in a steady or unsteady state, the NCFI goal is to order enough licenses to assure the vendor has 60 days’ notice to meet the required delivery dates.

5.5 Delivery Requirements: All products/services procured through delivery order shall be delivered in accordance with the delivery schedule contained within the order.

5.6 Technology Refresh: If technology evolves over the course of the contract, technology refresh negotiations may occur every 12 months from time of contract award to assure Government receipt of the latest technology.

6. Period of Performance: The delivery date and period of performance will be annotated within the CLIN Structure and the deliverables table contained within delivery order issued.

7. United States Secret Service Technical Point of Contact

NCFI

Attn: Michael Searcy 2020 Valleydale Rd., Suite 209 Hoover, AL 35244 Michael.searcy@usss.dhs.gov Phone: 404-783-5956

PART 2 DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER (C.O.). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3. DELIVERABLE. Anything that can be physically delivered, but may include non- manufactured things such as meeting minutes or reports.

2.1.4. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the SOW. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.5. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.2. ACRONYMS:

Section 508 Requirements Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text- idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn= div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): software licenses Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components: Does not apply

Applicable 508 requirements for software features and components (including but not limited to Other): All requirements in Chapter 5 apply, including all WCAG

2.0 Level A and AA Success Criteria Apply except 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation, 3.2.4 Consistent Identification, 502 Interoperability with Assistive Technology, 503 Application, 504 Authoring Tools

Applicable 508 requirements for hardware features and components (including but not limited to Peripheral Equipment (ex. keyboards)): All requirements in Chapter 4 apply

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

Section 508 Deliverables

Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.