Attachment 3 NCITE Phase X BOA SOW.pdf

Attachment 3 DRAFT NCITE Statement of Work

70RSAT25RFI000013

DRAFT Statement of Work DHS Center of Excellence Basic Ordering Agreement

The National Counterterrorism Innovation, Technology and Education Center (NCITE)

I. Background

The Homeland Security Act (HSA) of 2002, as amended, mandated that DHS designate university-based centers for the purpose of establishing a coordinated, university-based system to enhance our nation's homeland security. DHS established its Centers of Excellence (COEs) program to fulfill this mission. The COEs conduct research, analysis, and educational programs to enhance homeland security capabilities. The HSA also identified that S&T could use grants, cooperative agreements, or contracts. The initial suite of COEs was funded as grants. Since then, S&T has utilized the cooperative agreement instrument for COE base funding. In addition, the DHS S&T Office of University Programs (OUP) established COE Basic Ordering Agreements (BOAs) in July 2010 to allow for contract funding to the COEs, where appropriate. These two mechanisms support the OUP mission to maximize DHS’s return on investment in university-based research and education.

Traditionally, federal funding for basic and applied research and educational programs by universities is through the use of assistance instruments (grants/cooperative agreements), as the fundamental purpose of the work to be performed by the recipient is in the furtherance of the public good. OUP funds grants and cooperative agreements to the COEs to establish fundamental research and education programs in specific multidisciplinary subject matter areas.

DHS S&T expects the universities that comprise the COEs to become self-sufficient over time and to obtain additional sources of funding beyond S&T OUP’s investment in order to support more directed research. Interest in the work of the COEs has increased, particularly among other DHS components.

Other S&T Divisions and DHS components frequently need to access the capabilities created by the COEs at the lead or partner universities for directed research, analysis, and related technical services, both unclassified and classified. It should be noted, however, research that is more directed and research involving classified information cannot be performed under S&T’s grants and cooperative agreements, as the appropriate funding instrument would be a contract. Also, our customers have identified emerging needs that require a timely response (e.g., research on the effects on the U.S. of emerging threat groups and countering violent extremism) that could be more quickly addressed through issuance of a task order under a Basic Ordering Agreement

(BOA).

II. Scope of Work

Based on the success of the current BOA vehicles, DHS S&T OUP intends to issue a BOA for The National Counterterrorism Innovation, Technology and Education Center (NCITE). This NCITE COE will research and develop solutions, protocols, and capabilities to support DHS operations that detect, assess, mitigate, and respond to known and potential threats and other hazards that could adversely impact the Nation’s people, agriculture, and economy. DHS seeks research that explores the nature of countering terrorism operations from multiple perspectives including that of the adversaries (threat) and that of Homeland security stakeholders.

The five-year BOA will accommodate additional DHS requirements for COE research, analysis, and technical services in the research areas for NCITE. The BOA will be issued for a five-year period, ending in 2031. OUP estimates the value of the task orders issued under this BOA to range from $0.25 - $7 million, and $1-$7 million annually depending on the task orders awarded.

We based this estimate on the following:

1. The historical funding of projects as assistance supplements.

2. As NCITE matures and builds up their capabilities/tools, DHS S&T’s customers will seek to increase their use of those capabilities and tools.

3. Use of a procurement action in lieu of obtaining assistance authority will allow more

DHS S&T customers to utilize the capacity developed at NCITE.

Statement of Work The National Counterterrorism Innovation, Technology and Education Center (NCITE).

1. Independently, and not as an agent of DHS, the Contractor shall furnish services, qualified personnel, materials, equipment and facilities as needed to conduct research, analysis, or services in the focus thrust area of the Center of Excellence.

1.1 The NCITE COE will conduct a range of activities including user-inspired basic and applied research, and education and training initiatives to support and enhance DHS analytic efforts.

DHS seeks research that explores the nature of countering terrorism operations from multiple perspectives including that of the adversaries (threat) and that of Homeland security stakeholders.

DHS seeks to counter terrorism by combining prevention, disengagement, and disruption efforts to break the cycle of recruitment, radicalization, and violence. These efforts must include partnerships across federal, SLTT governments, local community organizations, and the private sector. DHS must also anticipate emerging terrorist tactics and provide the Homeland Security Enterprise (HSE) workforce with the skills and latest technology to identify vulnerabilities and trends.

The NCITE COE should describe how to integrate technologies and concepts into DHS operations to avoid, prevent, mitigate or stop a threatened or actual act of terrorism. Potential approaches include the utilization of innovative technologies (e.g., a new approach to leverage available technology to identify patterns and indicators of terrorist activity among disparate types of data), optimized operational procedures, and a skilled workforce trained in the latest methods to identify and respond to terrorist threats. NCITE will research and develop solutions, protocols, and capabilities to support DHS operations that detect, assess, and respond to known and potential threats.

1.2 To meet the diverse needs of DHS in keeping the homeland safe at and beyond the border, NCITE is integrating programs that address the following research and workforce development objectives:

1.2.1 Understand the evolving terrorism and targeted violence threat environment, and support partners in the HSE through this specialized knowledge.

1.2.2 Prevent terrorists and other hostile actors from entering the United States, and deny them opportunity to exploit the Nation’s trade, immigration, and domestic and international travel systems.

1.2.3 Prevent targeted terrorism and targeted violence.

1.2.4 Enhance U.S. infrastructure protections and community preparedness.

1.2.5 Enhance counterterrorism capabilities to detect threats to the Homeland.

1.2.6 Advance data analytics in intelligence analysis;

1.2.7 Develop new operational methods to integrate emerging technologies, tools, data streams, and analytics into operations.

1.2.8 Use academic initiatives and innovations to enhance workforce development and educate and train current and future personnel throughout the HSE.

1.3 Research Themes:

Topic Area One: Understanding the Nature of Counterterrorism and Targeted Violence Operations

DHS seeks research that explores the nature of countering terrorism operations from two perspectives—the adversary (threat) and that of homeland security stakeholders (federal, state and local government/private sector). Research from the adversary perspective will analyze the terrorist tactics, techniques, and procedures, structures, capabilities and intentions to help develop and/or examine courses of actions to reduce their capabilities to commit an act of terrorism. Research from the government perspective will seek to develop more effective partnerships for terrorism prevention among international, federal, SLTT and private sector entities, in part through after-action analysis of government response to terrorist incidents, including analysis of opportunities for prevention.

Below are representative research questions of interest to DHS by topic (questions not listed in priority order):

a) Terrorist Tactics, Techniques, and Procedures (TTP)

i) Can foreign terrorist organizations successfully exploit any latent vulnerabilities in U.S.

border security using the knowledge, skills, and abilities of transnational criminal organizations? If so, which FTOs are best positioned to do so?

ii) What is the nature of the threat (e.g., source, patterns) from American Youth mobilized to commit ideological or targeted violence?

iii) What has changed in the extremist threat to and inside America since October 7, 2023?

b) Cyber Tech and Operations

i) How could terrorists exploit emerging technologies for fundraising or transferring funds to or out of the US? Are terrorists increasing their use of virtual currencies? If not, what could lead them to use virtual currencies more, moving forward? If yes, what is the factual and methodological basis for this conclusion, and are there any deterrents or potential tools for tracking and exploiting these investments?

ii) How will the evolution of the Internet of Things (IoT) create potential vulnerabilities in terms of terrorist targeting? What can DHS do to mitigate those impacts without adversely impacting IoT development?

iii) How can we improve methods of lawfully intercepting and thwarting terrorist communications as communications continue to shift toward end-to-end encryption?

iv) Regarding adversarial communications and social media, how do we identify and thwart self-propagating malware (bot) activity in or near real-time?

c) Data Solutions (Including Big Data)

i) How can we leverage AI and/or machine learning in assisting to identify terrorist content, actors, and activities?

ii) How can analysts fully leverage all available data in its various forms to identify patterns, signatures, and indicators of terrorist activity?

iii) What tools and competencies can be made available to analysts for fusing and integrating disparate data of interest? Are there any critical gaps that require future development to integrate disparate data?

iv) What types of data analytics can best support traditional CT analysis?

v) What strategies (people, process, technologies) should DHS pursue in conjunction with its partners (SLTT, private sector, IC, and/or international community) for data management to enable machine learning and artificial intelligence capabilities? How do we develop high confidence data for supervised learning approaches and how do we provide sufficient data for unsupervised learning of machine learning algorithms?

vi) What strategies (people, process, technologies) should DHS pursue to provide analysts, operators and oversight (Office of General Counsel (OGC), Privacy, Office for Civil Rights and Civil Liberties (CRCL)) transparency in terms of how machine learning algorithms work and desired outcomes and compliance mechanisms to ensure that algorithms perform as intended (e.g. compliance)?

Topic Area Two: Strengthening the Nationwide Suspicious Activity Reporting Initiative

The Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) is a joint collaborative effort by DHS, the Federal Bureau of Investigation (FBI), and SLTT law enforcement partners.

The NSI has concentrated on reporting delivered information that has supported FBI terrorism investigations and watchlisting by the Terrorist Screening Center. The NSI is a standardized process—including stakeholder outreach, privacy protections, training, and facilitation of technology—for identifying and reporting suspicious activity in jurisdictions across the country and serves as the unified focal point for sharing SAR information. The COE will support the NSI in the review of existing indicators and behaviors, potential identification of new indicators related to homeland security threats, and later provide validation of those indicators and behaviors.

Examples of COE research questions that may support this initiative include:

a) How can counterterrorism and prevention workforce practitioners increase the frequency and quality of reports to prevent targeted violence?

b) To what extent is the Nationwide Suspicious Activity Reporting Initiative (NSI) fulfilling its intended objectives?

c) What are pre-operational planning behaviors that individuals who committed acts of terrorism or targeted violence engaged in prior to carrying out an attack? How do these behaviors comport to Nationwide Suspicious Activity Reporting Indicators?

Topic Area Three: Preventing Terrorism and Targeted Violence and Analyzing Prevention Programs

DHS seeks research projects that directly support its terrorism prevention programs. The goal of terrorism prevention is to render terrorism ineffective as a tactic in the United States by diminishing opportunities for recruitment and inspiration for the support and use of ideologically motivated violence. To accomplish this, prevention programs target radicalization and mobilization to violence. Radicalization to violence is the process by which individuals come to believe that violence is justified to achieve political or social change, while the term “mobilization” is used to denote individuals engaging in crime and/or violence in furtherance of their ideology. For simplicity, these related and sometimes overlapping processes are often shortened and referred to as “radicalization to violence.”

Terrorism prevention seeks to address all radicalization paths regardless of ideology and therefore projects should consider all forms of violent extremism and stages of radicalization to violence.

Research projects will aim to develop analytic methods to support threat detection, awareness raising, community engagement, intervention programs and countering the narrative. Unless otherwise identified below, DHS does not seek basic research that improves understanding.

Rather, DHS seeks projects that have direct applicability to ongoing or future programs designed to prevent terrorism.

The major questions that DHS seeks the respondent to explore by topic are below:

a) General Research to Practice

i) What is the return on investment of terrorism prevention?

ii) What is the most effective way to communicate unclassified research about terrorism and targeted violence prevention to different audiences (e.g., practitioners, policymakers, other fields)?

iii) What ways can we prevent terrorism and targeted violence at events that are adjacent or related to National Special Security Events (NSSE)?

b) Evaluations of Existing Programs

DHS has a strong interest in promoting best practices in terrorism prevention. To this end, DHS practitioners would work with the performer to identify community-based intervention initiatives for process and impact evaluations and/or demonstration experiments. Examples of programs that DHS would seek to evaluate include the following types of programs:

i) Training and awareness raising programs;

ii) Engagement programs, including tabletop exercises and roundtables

iii) Intervention programs working with:

a. individuals radicalizing to violence who have not yet committed a criminal act (i.e.

early intervention programs)

b. individuals radicalized to violence that have committed a criminal act (i.e. diversion programs)

c. individuals radicalized to violence incarcerated or released from incarceration (i.e.

rehabilitation programs)

iv) Efforts to combat terrorist use of the Internet, such as:

a. What is the impact of different counter and alternative narratives?

b. How does removal of pro-terrorist content for terms of service violations impact online radicalization? To what extent does the speed with which content is removed or challenged by competing narratives affect its discoverability and resonance?

c. How can DHS better improve the efficiency and effectiveness of its communication tools/assets that it leverages to convey Homeland risk concerns with SLTT, private sector, and community partners? How can DHS better leverage SLTT and private sector communication tools/assets, to ensure all applicable individuals, receive risk information?

d. In the context of improving counterterrorism analysis, sentinel events are when prevention fails, such as arrests or attempted / successful attacks. What can researcher-practitioner teams learn from sentinel events to improve current analytic training and anticipate future training needs for counterterrorism analysts?

Topic Area Four: Building the Current and Future National Security Workforce

DHS needs to actively address future workforce requirements and capabilities. Research in this area will include both current and anticipated capabilities and roadmaps to realize them. DHS seeks research projects that directly support its intelligence analyst requirements. The goal is to formalize analyst recruitment, training, and professional development. Research should be conducted into organizations with developed professional analyst career tracks to determine “best in class” programs that DHS will benefit from adopting. Research projects will aim to develop analytic programs to support recruiting, training, and further professionalizing the intelligence analyst profession. Program evaluation should include established U.S. Government analyst programs in addition to private sector offerings both within and outside academia.

The major questions that DHS seeks the respondent to explore are:

a. What steps can the counterterrorism and prevention workforce take to create a more cohesive culture focusing on trust and cooperation across its many components that manage the counterterrorism and targeted violence prevention missions?

b. How does DHS professionalize the intelligence analyst career track compare to comparable IC programs? How can DHS better leverage government and non- government programs to enhance career field professionalization?

c. What workforce development strategies hold the most promise for the modern counterterrorism organization?

d. What CT-related skills would help fortify non-governmental owners and operators (e.g., in education, technology, or specific parts of critical infrastructure) in securing against emerging/novel terrorist or targeted violence threats?

e. What knowledge, skills, abilities, and other characteristics will be needed over the next 10 years to train and develop prevention experts both inside and outside of government?

III. Other Contract Details

1. Period of Performance

The sole-source BOA will be for a period of 5 years. A BOA of shorter duration would not provide the time that DHS would need to conduct the initial science, testing, piloting, and potentially transitioning of research. This 5-year period of performance (POP) is the historical POP for the issuance of the COE BOAs, and allows for DHS components to issue multiple year task orders under the BOAs as a strategic sourcing vehicle. The purpose is to streamline ongoing access of the capabilities available from the COEs. Task Order Request for Proposals (TORPs) POPs will vary based on the requirement.

2. Travel Travel will be required in the performance of the duties listed. International travel may require pre-approval.

3. DHS-Furnished Information and Property Not applicable.

4. Place(s) of Performance The place(s) of performance will be determined through the performance of duties required in the task order(s).

5. Program Status Report/Deliverables The Contracting Officer and COR responsible for establishing BOAs will manage the contractual and technical aspects of the BOAs themselves, whereas the ordering officers and assigned CORs within each ordering component will manage their respective task orders using a combination of monitoring techniques including the use of in-process review meetings, monthly status reports, and reviews of all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the terms and conditions of the respective task orders and BOAs.

6. Invoices No invoices will be issued against the BOA because no funds will be issued on the BOA. However, the TORP level COs and CORs will address as per current policy. Rate Agreement Pricing is updated annually by the universities.

7. Classified Information The BOA task orders do allow for sensitive and classified work.

8. Funding Requirements Obligation of funds shall be accomplished solely through Task Orders issued in accordance with the terms and conditions of the BOA. It is the responsibility of the DHS component requiring offices to commit and obligate sufficient and appropriate funds in issuing their respective Task Orders under the COE BOAs. The amount of funds obligated and made available for payment will be specified in each Task Order. Funding shall be obligated under each Task Order in accordance with federal appropriations laws, federal acquisition regulations specified in each BOA, and internal DHS component procedures and practices.

9. Foreign Participation Reporting Instructions The admittance of foreign detailees, scientists, and students into DHS sponsored/funded academic and other programs may result in continuous exposure of DHS information, personnel, IT systems, technologies, facilities, resources, and programs by non-U.S. citizens. In order to mitigate this potential security risk, DHS Management Policy 121-08 stipulates all foreign detailees, scientist, professors, principal investigators, and student nominees involved in long-term (greater than 30 days) DHS sponsored/funded academic or other DHS programs must submit a DHS Form 11055 to the Director of the Office of University Programs. The awardee is required to ensure all foreign investigators and students working on DHS sponsored/funded research or receiving tuition or travel support of any kind through this award, complete DHS Form 11055, to report all foreign national students/teaching assistants. Within the Form, Section I (Foreign National Information), Section II (Foreign National Information-Passport/Visa), and Section III (Foreign National Information (Employer Information) must be completed. Sponsor information will be completed internally at S&T.

Please complete, save and return Form 11055 by email to: Rebecca.Medina@hq.dhs.gov. Do Not Use the “Submit” button on the form. For individual engagements with foreign nations, the Recipient will submit Form 11055 at least 30 days prior to the activity in which the foreign nationals participate. Please indicate your Center of Excellence affiliation and position title in the email.

VI Points of Contact DHS S&T Technical Representative:

Corey Davenport Department of Homeland Security Washington, DC Phone: 771-233-5060 Email: Cory.Davenport@hq.dhs.gov

DHS S&T Contracting Officer:

Danette Williams Department of Homeland Security Washington, DC 20528 Email: Danette.Williams@hq.dhs.gov mailto:Cory.Davenport@hq.dhs.gov mailto:Danette.Williams@hq.dhs.gov

VI Points of Contact