A02 - SOW - Managed Attribution System 2025.08.pdf

Drug Enforcement Administration Statement of Work

Managed Attribution System Cyber Support Section

PURPOSE

The Drug Enforcement Administration (DEA) Cyber Support Section (ODV) would like to continue to modernize and streamline DEA’s Internet-based investigative resources with an integrated managed attribution and evidence collection system. Deployment of these capabilities, across the entire DEA, will equip agents and analysts with standardized technical tools necessary to safely and effectively conduct online research and collect and preserve evidence.

BACKGROUND

Conducting Internet-based investigations and research browsing has multiplied over the past several years. With the advent of Drug Trafficking Organizations (DTOs) relying heavily upon Internet-based applications and Dark Web sites to facilitate their criminal enterprise, it is anticipated that in the future, electronic communications will be the preferred and exclusive means of communication. The threat landscape described creates opportunities for law enforcement to exploit illicit Dark Web market sites utilized by DTOs and dismantle their operations.

SCOPE OF WORK

Two critical needs have been identified in the field’s ability to safely exploit these forms of communications: managed attribution and integrated evidence collection. The vendor shall provide masked/backstopped IP addresses and browser attributes to obscure identity and prevent activity tracing. Each user will have the option for persistent and non-persistent mode. Within persistent mode the cookies, collected evidence, and browsing history are retained (with full-page and source code capture, timestamps and forensic hashing capabilities) through multiple sessions. Non-persistent mode sessions will start with a new instance of the virtual system. Any data or configuration changes made during the session are discarded once they system is shut down. Any malware encountered during a mission is contained within the secure operation environment (SOE), preventing contagion across agency networks. The procured system is required to be flexible such that other mission critical applications can be added on its secure desktop, including future tools built by the DEA that need to be integrated into the system’s environment.

The deployment of a fully integrated managed attribution and evidence collection tool allows DEA investigators to move online investigation operations onto a SOE, insulated from the DEA’s day-to-day networks. Moreover, it will continue to enable these investigators to conduct non-attributable online activities. This non-attribution shall be conducted through trade-crafted points-of-presence that enable users’ traffic to appear to originate from designated remote locations/geosites rather than from the user’s actual physical location. Vendor will enable users to reach target Websites and services without exposing the IP address of the workstation and thus revealing their true identity and affiliation.

In addition to providing advanced security, managed attribution, and enhanced evidence collection, the Vendor product also provides administrators at the DEA with a variety of account management capabilities. Activities are to be indexed and presented within an administrative interface. Content to be recorded includes user login times and points-of-presence data. DEA users will have the flexibility to sort and export the data as needed, thereby facilitating the discovery process. The oversight/audit function will only be visible to user accounts with special admin permissions – these users will be determined by DEA program administrators as part of contract implementation.

Additionally, the vendor shall provide the capabilities to leverage emerging mobile technologies. The system should incorporate features that replicate a mobile phone, providing the ability to send/receive messages, make and receive calls and voicemails, and install applications within emulated mobile phone. Examples of applications include digital asset wallets on the virtual platform to enable users to swap or exchange digital assets within the secure environment.

The system shall also incorporate the Exodus wallet natively installed within the virtual environment. The application will provide users with direct access to manage cryptocurrency assets.

PERFORMANCE OBJECTIVES

Vendor shall provide the following:

1. Provide anonymized connections to the Public Internet

• General unattributed secure connections for routine browsing and investigative research on the Internet.

• Browser interfaces accessible from inside or outside DEA infrastructure

• Access from regular laptops or workstations without the necessity of installing local software

• Connections to secure Virtual Desktops Interfaces which shall not store any data or browser information on a local system

• Audit trail of user name, local login successful or not successful, and date and time of events

• Ability to journal information the user identifies and store in a secure database for future retrieval and analysis

• Managed attribution for secure connections for Undercover (UC) browsing of specific

Web sites with ability to choose attributable public facing geographic locations displaying IP addresses which cannot be attributed to DEA or other government entities.

• Browser interfaces accessible from inside or outside DEA infrastructure

• Access from regular laptops or workstations without the necessity of installing local software

• Connections to secure Virtual Desktops Interfaces (VDI) which shall not store any data or browser information on a local system

• Emulated mobile phone feature with the capability to send/receive messages, make and receive calls and voicemails, and install applications.

• Exodus wallet natively installed within the VDI.

• Audit trail of user name, local logins successful or not successful, and date and time of events.

• Ability to journal information the user identifies and store in a secure database for future retrieval and analysis which may be evidentiary in nature

• The offeror, in consultation with DEA shall identify the number and location of rotating IP address sites (AKA “Geosites”) to be established in the following potential locations:

• Tier 1 – CONUS/Canada and Western Europe

• Tier 2 – Latin America, Eastern Europe, Asia

• Tier 3 – Middle East, Africa

Upon the establishment of a list of mutually agreed upon number and location of Geosites between the vendor and DEA, the vendor shall develop a mutually agreed upon timetable for their establishment.

2. Journal and evidence storage infrastructure securely separated from the VDI browsing infrastructure.

3. Distributed Administrative access and control to permit the following:

• Provision Administrative Super Users

• DEA Administrators shall be able to provision and de-provision Special Agent (SA) and

Intelligence Analysts (IA) users and assign privileges for each user, i.e., Read-Write access, access to evidence store, etc.

• All Administrator access shall require 2-factor identification

• All Administrator actions shall be auditable

• DEA Administrators shall be able to assign Geolocations for UC users

• Each Field Division shall have at least one geographically pertinent IP address available for the Division, and a static IP address if it would be a requirement for a particular case

4. Training materials and administer training to provide the DEA end user community with the requisite knowledge and skills to fully use the Managed Attribution System. Training materials will be reviewed and approved by the Contracting Officer’s Representative (COR) prior to utilization in training sessions. The vendor shall provide instructors specifically qualified to teach DEA end users how to use all of the software applications and capabilities residing within the Managed Attribution System. The vendor shall provide on-site training to end users, to provide users the fundamental skills in which to use, navigate, and access the system to reduce any potential learning curves for end users of the systems.

The vendor shall provide on-site training to privileges users, to provide the privileged uses the fundamental knowledge and skills in which to manage, issue, and troubleshoot end users and user access while using, navigating, and accessing the system to reduce any potential learning curves for the privileged user and end users of the systems. When applicable and upon request, the vendor shall provide a means of virtual training to facilitate training requirements when training in person is not optional or practical.

5. Travel for on-site training shall be pre-approved in writing by the COR.

PLACE OF PERFORMANCE

The vendor shall maintain a cloud-based infrastructure. With a logically separated virtual environment.

PERIOD OF PERFORMANCE

The period of performance for services described in the SOW is established from August 14, 2025 through August 13, 2031. The period of performance is a five (5)-year ordering period.

Base Ordering Period – Effective from the date of award through 12 months from the Effective Date of Contract (EDOC).

Base Period (12 Months): Date of award plus 364 days.

Ordering Period 1 (12 Months): 365 Days Through 729 Days after contract award.

Ordering Period 2 (12 Months): 730 Days Through 1,094 Days after contract award.

Ordering Period 3 (12 Months): 1,095 Days Through 1,459 Days after contract award.

Ordering Period 4 (12 Months): 1,460 Days Through 1,824 Days after contract award.

FAR 52.217-8 Option (6 Months): 1,825 Days Through 2,007 Days after contract award

DELIVERABLES

Vendor shall provide deployment of above described services across the DEA for up to 200 concurrent users. The system shall include CONUS points of presence for each field division and OCONUS points of presence. The locations of these presences will be determined by DEA program managers in consultation with Vendor.

INSPECTION/ACCEPTANCE

1. DEA retains final approval authority for acceptance of all products.

2. DEA will only approve payment for work performed by Vendor for DEA to access the above described products/services.