A04 Justification and Approval (final 112320) signatures redacted.pdf

DEPARTMENT OF THE DEFENSE

WASHINGTON HEADQUARTER SERVICES

ACQUISITION DIRECTORATE

Control Number: 2021-WHS-0009

SOLE SOURCE JUSTIFICATION UNDER SIMPLIFIED PROCEDURES

FOR CERTAIN COMMERCIAL ITEMS

UNDER FEDERAL ACQUISITION REGULATION (FAR) 13.5

1. AGENCY AND CONTRACTING ACTIVITY:

Agency

Office of the Secretary of Defense (OSD)

Defense Digital Services (DDS)

Contracting Activity

The Department of Defense (DoD)

Washington Headquarter Services (WHS)

Acquisition Directorate (AD)

2. DESCRIPTION OF ACTION:

This action is for a sole source purchase order to Akamai Technologies, Inc. CAGE

Code: 1YEZ5; 145 Broadway, Cambridge, MA 02142 for continued Domain Name

Services (DNS) Resolver Services for the Defense Digital Services (DDS). The purchase order will for a period of performance of three months from 28 October 2020 to 27

January 2021 with an total dollar value of $1M.

3. DESCRIPTION OF SUPPLIES OR SERVICES:

The Defense Digital Services (DDS) has a requirement for DNS Resolver Services

(DNS) that will enhance DoD’s efforts to protect its website domains against cybersecurity threats. Specifically, the requirements must provide outbound DNS resolver service, leverage private industry to deploy a DNS service that can be used by other government agencies and partners, as well as provide a consolidated, cloud-based storage for identifying and researching threats. In addition, the services will enhance

DoD’s capability to detect and mitigate real-time phishing campaigns, spoofing or hijacking router DNS settings and protect U.S. government efforts to address COVID-

19 projects under Operation Warp Speed.

Period of Performance

The Period of Performance of this firm-fixed price, sole-source contract is 90 days to allow for a GAO decision on the filed protests. The contract has a 30-day base period and two 30-day option periods.

Performance Period Dates Amount

Base Period (1 month) $ 333,333.34

Option Period 1 (1 month) $ 333,333.34

Option Period 2 (1 month) $ 333,333.34

Total: $1,000,000.00

4. AUTHORITY CITED:

This acquisition is conducted under the procedures of FAR subpart 13.5, used in accordance with the authority of 41 U.S.C § 1901. FAR 13.5 authorizes the use of Part 13 simplified procedures for certain commercial items.

Acquisitions conducted under simplified acquisition procedures are exempt from the competition requirements listed in FAR Part 6. FAR 13.501(a)(1). Instead, Contracting

Officers are required to promote competition to the maximum extent practicable. FAR

13.104. FAR Part 13 requires the agency to justify in writing sole source acquisitions.

FAR 13.501(a)(1)(i). The agency may solicit from only one source if the circumstances of the contract action deem only one source reasonably available. FAR 13.106-1(b)(1)(i).

“Urgency” is a circumstance under which only one source may be reasonably available.

Id.

5. REASON FOR AUTHORITY CITED:

Given the present circumstances, only one source, Akamai Technologies is reasonably available. As further explained below, the circumstances which render only one source reasonably available are the urgency of the required DNS services, and the presence of a

CICA Stay that prohibits the Government from receiving the services under a recently awarded contract.

Urgency

These critical services are urgent because on a daily basis, adversaries make considerable efforts to implant malware, copy data, transfer data, or retrieve

(un)classified information off DoD networks. If DoD does not receive these services, systems protected by Internet Access Protocol (IAP) security tools are furthervulnerable because IAP tools do not provide protections to the DNS protocol itself but to applications that use DNS.

Some facts that demonstrate the critical nature of this requirement shows that in the past few months, DDS identified over 63 million queries across 17 thousand unique domains that should have blocked based on threat intelligence. This includes queries for domains associated with typosquatting (e.g., mail[.]mi and gmial[.]com), thousands of callbacks to servers associated with named attack campaigns, and evidence of widespread malware. DDS has also identified several million queries to domains hosted under an adversarial country top-level domains (TLDs) including 1.7M total queries across 487 unique domains (2% of all unique domains) in Russia, over 80,000K total queries across

108 unique domains in China, and over 8,000 total queries across seven unique domains in Iran.

In addition, to the stated urgency of protecting DoD websites, this award supports the

U.S. government’s Operation WARP SPEED (OWS) COVID-19 efforts. Several of the

OWS agencies need additional DNS layer protection from cyberattacks as they rapidly deploy COVID-19 vaccines and studies. If the networks that manage this effort are compromised, the damage is simply unacceptable.

Moreover, a recent (October 2020) advisory from the National Security Agency (NSA) details 25 vulnerabilities that Chinese state-sponsored malicious cyber actors are currently exploiting or targeting, to encourage successful hacking operations against a multitude of networks. The advisory specifically calls out vulnerabilities with Windows

Domain Name Service. The advisory further notes that targeted information could enable China to build an operational picture of U.S. defense networks, military disposition, logistics and related military capabilities that could be exploited prior to or during a crisis.”

Delayed services will further expose current DoD systems to unauthorized collection, exploitation and intellectual property theft. Each day of delay, further exposes DoD, DoDIN, OWS partner websites, and affiliated hospitals to disruption by hackers.

CICA Stay

On August 6, 2020, WHS issued a competitive RFQ under for the DNS services described in section 3, above. The solicitation was posted to sam.beta.gov site, and the competition was open to all vendors. The solicitation was for a contract with a base period of one year, and two one-year options periods. Multiple vendors submitted quotes in response to the RFQ. After evaluating the quotes, the agency determined that Akamai

Technologies’ quote represents the best value to the Government. The Government awarded the contract to Akamai Technologies on September 30, 2020. Performance of the services commenced on October 1, 2020.

On October 12, 2020, an unsuccessful Quoter, ERP Services Inc., filed a GAO protest

(B419315.1) challenging the award decision. (On October 13, 2020, another vendor, Barquin Solutions, also filed a GAO protest challenging the award decision.) After receiving the protest, WHS as required by 31 U.S.C. § 3553(d)(3)(A)(ii), ceased performance of the awarded contract pending resolution of the protests. (This is known as a CICA Stay.)

WHS has competed the requirement for DNS services, but it is now prohibited from proceeding with performance on the competed contract due to the CICA Stay. However, the agency cannot wait the 100 days for the protest to be resolved in order to receive the

DNS services because of the urgent and compelling need for these services. (See above discussion.)

Since the Government needs the services immediately but cannot proceed with the original contract, WHS must award a short-term contract to receive the services while the protests are pending and the CICA Stay is in effect. The Government cannot conduct a competition for the short-term contract since it requires these services immediately, while a competition would take a minimum of 2-4 weeks, even using simplified procedures.

Even conducting an acquisition without the time-consuming platform demonstrations that took place on the protested acquisition, there are complex technical factors, such as validation of uptimes, FedRamp High, storage formats, etc. that must be verified and validated for each Quoter. As stated in the above section, DoD requires these services now, and cannot wait the 2-4 weeks to compete this short-term contract.

The Government needs the services immediately and does not have the time to select a vendor through competition. The Government is aware of Akamai’s capabilities through its evaluation of Akamai’s quote submitted in response to the August 2020 RFQ. On that acquisition, the Government determined that Akamai’s quote represents the best value to http://www.sam.beta.gov/ the Government. As such, the Government is confident in Akamai’s ability to provide these same services on this bridge contract.

In summary, the Government is faced with the following set of circumstances: the

Government urgently needs to obtain short-term DNS services pending resolution of the protest, given that performance on the competed contract was stayed; there is not time to compete the short-term contract; and the Government is already aware of Akamai’s capability to provide the required services. Under such circumstances, the Government deems Akamai as the one source reasonably available for this short-term requirement.

6. EFFORTS TO OBTAIN COMPETITION:

This sole-source contract is for a short-term contract that will only be used to obtain the

DNS services while the GAO protests are resolved. WHS has already competed the longer-term contract, the protest of which necessitated this sole-source contract.

7. FAIR AND REASONABLE COST DETERMINATION:

The Contracting Officer has ensured that the price is fair and reasonable based on price analysis techniques listed in FAR 15.404-1(b)(2).

8. MARKET RESEARCH:

Previous market research included: 1) discussions with SMEs within DoD, including

Military personnel responsible for procuring DNS resolver solution at the White House;

2) DISA personnel responsible for Enterprise Recursive Service for the DoDIN; 3) implementation of a one-week pilot to demonstrate the feasibility of the service; 4) examination of how other governments, including the UK government, provides the service; 5) review of white papers, articles, and blog posts from industry experts on the topic; and 6) review of current work in adjacent or related projects.

As previously mentioned, on August 6, 2020, an unrestricted Request for Quote (RFQ) was solicited on beta.SAM.gov to compete this requirement.

9. OTHER FACTS:

The funding for this short-term sole source contract is separate from the original contract.

This short-term sole-source contract will not lessen the size of the protested contract.

Upon resolution of the protests, the Government will modify the dates of the period of performance on the protested contract so that that it will still be of the same duration as it was originally solicited. As such, this separately funded, sole-source short-term contract will not reduce the length of the protested contract.

10. INTERESTED SOURCES:

Akamai Technologies, Inc.

Nominet US

11. ACTIONS TO INCREASE COMPETITION:

As discussed in section 5, above, the longer-contract was competed and that competition was open to all vendors.

KAO.DAVID.HOBERT.11121728 Digitally signed by

KAO.DAVID.HOBERT.1112172870

Date: 2020.11.23 11:34:31 -05'00'

12. Is this acquisition for a non-competitive follow-on acquisition previously awarded on a non-competitive basis?

☐ Yes. A copy of the previous justification is attached. The actions to remove any barriers to competition cited on the previous justification ☐ were ☐ were notcompleted [Must include explanation of why the answer is “no”].

☐ No. The original acquisition was conducted on a competitive basis.

Not Applicable. This is a new requirement.

CERTIFICATION

I hereby, certify that the supporting data under my cognizance included in this justification are accurate and complete to the best of my knowledge and belief.

WHITAKER.CHRISTOPHER.PAUL.125

6571508

Digitally signed by

WHITAKER.CHRISTOPHER.PAUL.1256571508

Date: 2020.11.10 12:57:01 -06'00'

Christopher Whitaker, Contracting Officer Representative/ DDS Date

Digitally signed by DARBY.KIMBERLY.H.1043694665 Date: 2020.11.12 11:01:19 -05'00'

Kimberly Darby, Contracting Officer, WHS/AD Date

APPROVAL

Base on the foregoing, this justification is, hereby approved.

David H. Kao, Competition Advocate, Acquisition Directorate Date

DARBY.KIMBERLY.H.1043694665