Attachment 5_MQ-9 Enterprise PPP (Including Annexes A-O)_01 July 2024.pdf

CUI

MQ-9 Enterprise

Program Protection Plan (PPP)

Medium Altitude Unmanned Aircraft Systems (UAS) Division Air Force Life Cycle Management Center (AFLCMC)

Wright-Patterson Air Force Base (WPAFB), OH

Program Executive Officer for Intelligence, Surveillance, Reconnaissance, and Special Operations Forces

(PEO / ISR & SOF)

1 JULY 2024

DISTRIBUTION STATEMENT D: Distribution Authorized to the Department of Defense and US DoD Contractors only (Administrative or Operational Use) [8 July 2019]. Other requests shall be referenced to Medium Altitude UAS Division.

WARNING- This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

The Office of Primary Responsibility (OPR) is the Medium Altitude UAS Division Chief of Security, WIIV-Inbox@groups.af.mil.

This document rescinds (in its entirety) the MQ-9 Reaper PPP, 8 July 2019 & the MQ-9B PPP, 12 April 2022.

Controlled by: USAF Controlled by: AFLCMC/WII CUI Category: CTI Distribution: D POC: J. Banks (937) 255-8582

WARNING

NOTICE TO ACCOMPANY THE DISSEMINATION OF EXPORT CONTROLLED

TECHNICAL DATA

Export of the attached information (which includes, in some circumstances, release to foreign nationals with the United States [US]) without first obtaining approval or license from the Department of State for items controlled by International Traffic In Arms Regulation (ITAR), or the Department of Commerce for items controlled by the Export Administration Regulation (EAR), may constitute a violation of law.

Under Title 22 USC 2778, the penalty for unlawful export of items or information controlled under the ITAR is up to two (2) years imprisonment, or a fine of $100,000, or both. Under 50 USC, Appendix 2410, the penalty for unlawful export of items or information controlled under the EAR is a fine of up to $1,000,000, or five times the value of the exports, whichever is greater; or for an individual, imprisonment of up to 10 years, or a fine of up to $250,000, or both.

In accordance with your certification that establishes you as a ”qualified US contractor,” unauthorized dissemination of this information is prohibited and may result in your disqualification as a qualified US contractor and may be considered in determining your eligibility for future contracts with the DoD.

The US Government assumes no liability for direct patent infringement, or contributory patent infringement, of misuse of technical data.

The US Government does not warrant the adequacy, accuracy, currency, or completeness of the technical data.

The US Government assumes no liability for loss, damage, or injury resulting from manufacture or use for any purpose of any product, article, system, or material involving reliance upon any or all technical data furnished in response to the request for technical data.

If the technical data furnished by the Government will be used for commercial manufacturing or other profit potential, a license for such use may be necessary. Any payments made in support of the request for data do not include or involve any license rights.

Include a copy of this notice with any partial or complete reproduction of the data that is provided to qualified US contractors.

MQ-9 ENTERPRISE

PROGRAM PROTECTION PLAN

VERSION 1.0

(1 July 2024)

COORDINATED BY:

Digitally signed by

DYE.TODD.C DYE.TODD.C.1256144

.1256144421 Date: 2024.07.15 17:13:01 -04'00'

TODD C. DYE, Colonel, USAF Senior Materiel Leader Medium Altitude UAS Division

APPROVED BY:

JOSHUA P. WILLIAMS, Colonel, USAF

PEO, SOF & ISR

WILLIAMS.JOSH

UA.PROP.124411

Digitally signed by

WILLIAMS.JOSHUA.PROP.12

44117518 Date: 2024.07.22 09:11:55 -04'00'

MQ-9 Enterprise Program Protection Plan Revision/Approval History

Version Reason for Update Approval ACAT Date

1.0 2007 MQ-1/MQ-9 PPP 658 AESS

(Delegated)

ACAT II 21 Aug 07

2.0 First draft of MQ-9

Block 5 PPP

DRAFT ACAT ID 15 Nov 10

2.1 2011 MQ-9 PPP OSD (Acquisition Technology and Logistics)

ACAT ID 1 Apr 11

2.2 2012 MQ-9 PPP (Signed) OSD (Acquisition Technology and Logistics)

ACAT 1D 25 Oct 12

3.0 2019 MQ-9 Reaper PPP PEO / ISR & SOF ACAT II/III 08 Jul 19

1.0 2022 MQ-9B PPP PEO / ISR & SOF ACAT II/III 12 Apr 22

1.0 2024 MQ-9 Enterprise PPP PEO / ISR & SOF ACAT II/III 01 Jul 24

Table of Contents

SECTION PAGE

1.0. Executive Summary 7

1.1. Program Protection Plan Purpose 7

1.2. Technology/System Description 7

1.2.1. System Characteristics 7

1.3. Program Protection Responsibilities 7

2.0. Program Protection Summary 8

2.1. Schedule 8

2.2. CPI and Critical Functions and Components Protection 8

3.0. Critical Program Information (CPI) and Critical Components (CC) 9

3.1. Identification Methodology 9

3.1.1. Process for Identifying CPI 9

3.1.2. Criteria for Finalizing the CPI List 9

3.2. Organic/Inherited/Horizontal Protection 10

4.0. Threats, Vulnerabilities, Countermeasures and Risks (TVCR) 12

4.1. Threat Products 13

4.2. Vulnerabilities 13

4.3. Countermeasures 13

4.3.1. Anti Tamper (AT) 14

4.3.2. Cybersecurity Strategy 15

4.3.3. Supply Chain Risk Management (SCRM) 16

5.0. Processes for Program Management and Implementation of PPP 16

5.1. Audits/Inspections 17

5.1.1. Defense Counterintelligence Security Agency (DCSA) 17

5.1.2. Program Protection Lead (PPL) 17

5.1.3. Letter of Offer and Acceptance Security Instructions (LSI) 17

5.2. Engineering/Technical Reviews 17

5.3. Verification and Validation 17

6.0. Processes for Monitoring and Reporting Compromises 18

7.0 Program Protection Costs 19

7.1. 32 CFR Part 117 or National Industrial Security Program Operating Manual (NISPOM) Rule 19

7.2. Above NISPOM Rule Requirements 19

7.3. Cost Notes 20

8.0 Foreign Involvement 22

8.1. Status 22

8.1.1. Foreign Military Sales (FMS) Cases 22

8.2. Security Requirements 23

8.2.1. Delegation of Disclosure Authority Letter 23

8.2.2. Letter of Offer and Acceptance (LOA) Security Instruction (LSI) 23

8.2.3. Enhanced End Use Monitoring Handbook and Checklist 23

8.2.4. Foreign National Plan 23

8.2.5. Anti-Tamper 23

Table 1. Program Protection Integrated Product Team (PPIPT) 7 Table 2. Protection Countermeasure Summary 9 Table 3. PPIPT Membership 9 Table 4. O/I/H Protection Information 10 Table 5. Threat Products 13 Table 6. Generic Program Countermeasures/Security Activities 14 Table 7. Loss or Compromise Reporting Requirements 18 Table 8. Program Protection Costs 19 Table 9. Foreign Military Sales (FMS) Cases Current/Future w/ Configurations 22

Figure 1. MQ-9 Remote Split Operations OV-1 15 Figure 2. PLEO Command and Control Operational Concept Graphic OV-1 15 Figure 3. MQ-9 SCRM Unique Suppliers 16

Annex A: References, Terms, and Acronyms Annex B: CPI Methodology Annex C: Threats, Vulnerabilities, Countermeasures, Risks (TVCR) Annex D: MQ-9 Enterprise Security Classification Guide (SCG) Annex E: OPSEC Plan Annex F: Anti-Tamper Plan Annex G: Supply Chain Risk Management (SCRM) Annex H: Cybersecurity Strategy Annex I: System Security Plan (SSP) Annex J: Demilitarization Plan Annex K: Delegation of Disclosure Authority Letter (DDL) Annex L: Foreign National Plan (FNP) Annex M: Counterintelligence Support Plan (CISP) Annex N: Squadron Operations Center Plan (SOC) Annex O: ACAT II Modernization Plan

1.0. Executive Summary

1.1. Program Protection Plan (PPP) Purpose: This PPP is a risk-based, comprehensive, living plan that captures the MQ-9 protection strategy. It serves as the PPP for all Acquisition Category (ACAT) programs (e.g., the baseline MQ-9 Reaper ACAT I, the Upgrade ACAT II, and the System Life Cycle Agile Modernization [SLAM] ACAT II Programs). SLAM consists of the modernization efforts of the Program of Record MQ-9A Joint Urgent Operational Needs (JUONs); Urgent Operational Needs (UONs); Proliferated Low Earth Orbit (PLEO) upgrades; Open Mission System-Stellar Relay (OMS-SR); Link-16; and any other Modernization effort that falls under the SLAM efforts.

1.2. Technology/System Description: The MQ-9A/B (Reaper, Protector, and Sky/Sea Guardian) is an armed, multi-mission, medium-altitude, long-endurance Remotely Piloted Aircraft (RPA) that is employed primarily against dynamic execution targets and secondarily as an intelligence collection asset. Given its significant loiter time, wide-range sensors, multi-mode communications suite, and precision weapons, it provides a unique capability to perform strike, coordination, and reconnaissance against high-value, fleeting, and Time-Sensitive Targets (TST).

1.2.1. System Characteristics: The MQ-9A/B RPA uses a single-engine, turboprop designed to operate at medium-to-high altitude for long endurance sorties. The RPA is flown by a pilot in the Ground Control Station (GCS) over a command link that transmits commands from the GCS to the RPA and telemetry from the RPA to the GCS. The telemetry downlink also includes the sensor data. The MQ-9 RPA operates at flight altitudes up to 50,000 feet mean sea level and operates in both visual meteorological conditions and instrument meteorological conditions. The system continuously records flight data with an operable datalink.

In the event of loss of the data link, the aircraft executes a preplanned, user-programmable mission profile to facilitate restoration of the datalink and minimize collateral damage if the link cannot be reestablished. The Foreign Military Sales (FMS) MQ-9 is configurable based on the requirements of the International Partner.

1.3. Program Protection Responsibilities: Table 1 below identifies the government and contractor parties responsible for various Program Protection efforts for MQ-9 Programs. Overall responsibility lies with the MQ-9A/B Program Managers (PMs) and Foreign Military Sales (FMS) Program Security Assistance Program Managers (SAPMs) who have delegated execution responsibility to the Program Protection Lead (PPL) and specific Subject Matter Experts (SMEs). Program Protection questions shall be directed to the OPR or PM/SAPM.

Title/Role Organization

PM/SAPM AFLCMC/WII

Lead Systems Engineer AFLCMC/WIIE Program Protection Lead (PPL) AFLCMC/WIIV Anti-Tamper Lead AFLCMC/WIIV Cybersecurity Lead AFLCMC/WIIV Integration Engineer GA-ASI Contracting Officer AFLCMC/WIIK Ground Segment Engineer* AFLCMC/WIIE Counterintelligence (CI) Support AFOSI

Intelligence Support AFLCMC/WI2 Table 1. Program Protection Integrated Product Team (PPIPT)

(**IPT responsible parties may vary)

2.0. Program Protection Summary

2.1. Schedule. See integrated master schedule for both Programs of Record (PoR) and each FMS case.

2.2. Critical Program Information (CPI), Critical Functions, and Components Protection. Table 2 is a comprehensive list of the CPI for all MQ-9 variants, both PoR and FMS cases.

**(See Annex B for additional information regarding MQ-9 Enterprise CPI.)

CPI # Countermeasure Key

1 2 3 4 5 6 7 8 9 10 11 12 Organic 1 X X X X X X X X X X X X Organic 2 X X X X X X X X X X X X Organic 3 X X X X X X X X X X X X Organic 4 X X X X X X X X X X X X Organic 5 X X X X X X X X X X X X Organic 6 X X X X X X X X X X X X Organic 7 X X X X X X X X X X X X Organic 8 X X X X X X X X X X X X Organic 9 X X X X X X X X X X X X Organic 10 X X X X X X X X X X X X Inherited 11 X X X X X X X X X X X Inherited 12 X X X X X X X X X X X Inherited 13 X X X X X X X X X X X Inherited 14 X X X X X X X X X X X Inherited 15 X X X X X X X X X X X Inherited 16 X X X X X X X X X X X Inherited 17 X X X X X X X X X X X Inherited 18 X X X X X X X X X X X Inherited 19 X X X X X X X X X X X Inherited 20 X X X X X X X X X X X Inherited 21 X X X X X X X X X X X Inherited 23 X X X X X X X X X X X Inherited 24 X X X X X X X X X X X Inherited 25 X X X X X X X X X X X Inherited 26 X X X X X X X X X X X Inherited 27 X X X X X X X X X X X Inherited 28 X X X X X X X X X X X Inherited 29 X X X X X X X X X X X Inherited 30 X X X X X X X X X X X Horizontal 31 X X X X X X X X X X X X

KEY

Countermeasures

X = Implemented

1 Training 8 Physical Security 2 Systems Engineering 9 Network Security 3 Configuration Management 10 Industrial Security 4 Cybersecurity 11 Foreign Involvement/Protection 5 Personnel Security 12 Supply Chain Risk Mitigation 6 Operations Security (OPSEC)

7 Information Security (includes Communications Security)

Table 2. Protection Countermeasure Summary

3.0. CPI and Critical Components

3.1. Identification Methodology: A multi-disciplined PPIPT was formed to evaluate the MQ-9 and make recommendations on program CPI and to evaluate mission critical functions and components IAW DoDI 5200.39 and DoDI 5000.02 as amended. PPIPT membership is shown in Table 3. To properly identify CPI, a thorough decomposition of the system was necessary to ensure that all components and subsystems that may contain CPI were evaluated on their own merit.

PM Lead Engineer PPL Financial Manager Logistics Manager Cybersecurity Contracting

Manager Intelligence

Test Manager Contractor Security Counterintelligence Operational Command Representative

Defense Counterintelligence and Security Agency (DCSA)

Contractor Functional Experts

Table 3. PPIPT Membership

3.1.1. Process for Identifying CPI: See Annex B

3.1.2. Criteria for Finalizing the CPI List: The PPIPT’s final review focused on impacts of loss and exploitation to the MQ-9 system. This analysis considered the full range of exploitative impacts to MQ-9 systems, which could affect integrity and availability as well as provide advantages to an adversary’s indigenous Unmanned Aircraft System (UAS) development efforts. This determination is subjective, but considered development, design, and integration characteristics which provide exploitative opportunities adversaries.

3.2. Organic/Inherited/Horizontal Protection:

Organic (O)/Inherited (I)/Horizontal (H) Protection Information

CPI O/I/H Program Office

Applicable PPPs Planned Interactions

1. C2 S/W and MQ-9 Line of Sight (LOS) and Beyond Line of Sight

(BLOS)

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

2. Predator Primary Data Link (PPDL)

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

3. Space-based & airborne imaging radar technology

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

4. Air-to-Ground Targeting Accuracy Algorithms

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

5. Ground Moving Target Indicator (GMTI)

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

6. MTS Resolution O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

7. Automatic Target Recognition (ATR)

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

8. Afghan Enabler

(MALET)

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

9. 3-D Targeting O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

10. C2 S/W for MQ-9 Simulator (AVSIM)

O MQ-9 SPO MQ-9 Enterprise PPP Periodic updates

CPI O/I/H Program Office Applicable PPPs Planned Interactions

11. ARC-210 Radios I PMA-209 ARC-210 PPP

- INFOSEC Module A5A1

Periodic updates

12. INS and related components

I GPS PO GPS PPP Periodic updates

13. SAASM GPS

Receivers

I GPS PO GPS PPP Periodic updates

14. APX-119 Cooperative

IFF

I APX-119 APX-119 PPP Periodic updates

15. CDL Waveforms I CDL PO CDL PPP Periodic updates

16. VORTEX Family I VORTEX PO VORTEX PPP Periodic updates

17. AGM-114 Hellfire Missile

I JAMS PO,

Redstone Arsenal, AL

Hellfire PPP Periodic updates

18. Navigation Message

(NAV MSG)

I PNT PO

(JSSMO),

Robins AFB

GPS PPP Periodic updates

19. Receiver Autonomous Integrity Monitoring

(RAIM)

I PNT PO

(JSSMO),

Robins AFB

GPS PPP Periodic updates

20. GPS Crypto I GPS PO GPS PPP Periodic updates

21. Honeywell FALCN Spiral 2

I FALCN PO FALCN PPP Periodic updates

22. AN/DPX-7

Transceiver IFF

I IFF PO IFF PPP Periodic updates

CPI O/I/H Program Office Applicable PPPs Planned Interactions

23. High Assurance Internet Protocol Encryptor (HAIPE)

I HAIPE PO HAIPE PPP Periodic updates

24. Secure Encryption Module (SEM)

I SEM PO SEM PPP Key management &

COMSEC

inspections

25. OUTDRAGON I UK Periodic updates

26. IPX-250X I IPX-250X PO IPX-250X PPP Key management &

COMSEC

inspections

27. KG-250X I KG-250X PO KG-250X PPP Key management &

COMSEC

inspections

28. MX-20 EO/IR I MX-20 PO MX-20 PPP Periodic updates

29. Combat Search & Rescue (CSAR) Radio

I CSAR PO CSAR Radio PPP Periodic updates

30. SecureView I SecureView PO SecureView PPP Periodic updates

31. Lynx Multi-Mode

Radar (MMR) H GA-ASI Contact the OPR for Lynx

MMR documentation Stand-alone AT Plan

Table 4. O/I/H Protection Information

4.0. Threats, Vulnerabilities, Countermeasures, Risks (TVCR): The MQ-9 Program Protection Lead is responsible for requesting intelligence threat products supporting the MQ-9 Enterprise. AFOSI 10th Field Investigations Squadron at Wright-Patterson AFB and the DIA Threat Analysis Center (TAC) are responsible for supporting threat product requests. AFOSI will generate and provide an Integrated Threat Assessment (ITA) per agreement outlined in the Counterintelligence Support Plan (CISP) and the DIA TAC will generate and provide an all-source counterintelligence threat assessment on possible foreign intelligence connections with suppliers of critical components. These products will be used by the MQ-9 PPIPT to assess program threats, identify risks and vulnerabilities, and subsequently develop and implement appropriate security countermeasures. See Annex C for details.

4.1. Threat Products: This table outlines the threat products utilized by the MQ-9 team to assess program vulnerabilities and apply mitigation countermeasures. These products are not provided as part of this PPP but are available upon request by contacting the OPR. (See Table 5 below).

Threat Products Threat Product Classification Product Owner

Integrated Threat Assessment S//FISA AFOSI UAS Technology Profile S//NF Defense Intelligence Agency

Production Requests S//NF, TS/SCI NASIC

Validated Online Lifecycle Threat

(VOLT)

S//NF,

TS/SCI NASIC

Technology Collection Trends in the US Defense Industry CUI DCSA

Terrorist Threat to the UAS Enterprise S//NF AFOSI

AFOSI (Blueline, Redline, etc.) S AFOSI Det 2/ Counterintelligence WPAFB

Table 5. Threat Products

4.2. Vulnerabilities: CPI vulnerabilities have been identified and outlined based on their application within the MQ-9 system. The primary focus is to assess the physical, logical, and counterintelligence threats to the system which if left unmitigated through countermeasures leave the system vulnerable to defeat and/or exploitation. See Annex C (classified) for details.

4.3. Countermeasures: Table 6 below summarizes generic countermeasures or security activities applicable to all program information, facilities, and personnel that support MQ-9 activities and contribute to the protection of MQ-9 CPI and critical functions and components.

Type Detail COMSEC Communications Security (COMSEC) is used to protect both classified and unclassified traffic on military communication networks, including voice, video, and data. It is used for both analog and digital applications and both wired and wireless links. MQ-9 COMSEC/crypto is controlled by GA-ASI's COMSEC account in Poway, CA, during acquisitions and by individual operational units once transferred to the US Air Force. The High Desert (HD) Account may hold different keys than the operational or testing account.

OPSEC The MQ-9 OPSEC Program is outlined in Annex E.

Foreign Visit Program

Annex J outlines the protection responsibilities agreed to between the MQ-9 Program Office and GA- ASI for the handling and processing of foreign visitors in proximity of Air Force activities.

CPI Protection Training

The PM has instituted a tiered training program. Tier 1 is for general training of what CPI is and Tier II is for personnel who handle, store, develop and/or maintain CPI. All industry partners who have this PPP, implemented via DD Form 254, DoD Contract Security Classification Specifications, will implement this tiered training.

Cybersecurity Prime contractor network security architecture and configuration will be managed by the CIO (or equivalent). Prime contractor has a SIPRNet enclave located in Poway, CA. Network security procedures and countermeasures applicable to subnets containing government CUI are available upon request. Program contractors will comply with DoDI 8582.01, “Security of Unclassified DoD Information on Non-DoD Information Systems”.

Secure System Administration

Networks (NIPR & SIPR) within the WPAFB enclave are locally managed by the 88 CG. Domain controllers and authentication methods are provided by 83 NOSC/Det 3 at WPAFB. Prime Contractor network security architecture, configuration, and authentication controls will be managed by the contractor CIO (or equivalent).

Personnel Security

The objective of the personnel security program is military, civilian, and contractor personnel assigned to MQ-9 Program duties maintain the integrity needed while working in sensitive positions. Failure to report derogatory information may potentially damage national security, reliability, and trustworthiness.

Individuals must report derogatory information to the security team for mitigation. Failure to report derogatory information, particularly during periodic reinvestigation, may be grounds for suspension or revocation of an individual's security clearance eligibility.

Industrial Security

Industrial security includes the safeguarding by contractors of sensitive information released during all phases of the contracting, licensing, and grant process, including bidding, negotiation, award, performance, and termination. These measures are required either by the NISPOM Rule or via specific contract requirements as specified in a DD Form 254.

Physical Security

Physical security includes physical measures designed to safeguard personnel and to prevent unauthorized access to equipment, installations, material, and documents to safeguard them against espionage, sabotage, damage, and theft. Specific details regarding the protection criteria can be found in Department of the Air Force Instruction (DAFI) 31-101, Integrated Defense. Each location implements physical security per local conditions, this section outlines the minimum standards.

Table 6. Generic Program Countermeasures/Security Activities

4.3.1 Anti-Tamper: Anti-Tamper Plan regulates how CPI will be protected. See Annex F (classified) for details.

4.3.2. Cybersecurity Strategy: This strategy was developed to be implemented as a long-term plan and approach for cybersecurity throughout the MQ-9 program life cycle. The Cybersecurity strategy is a tool for the PMs/SAPMs, PPLs, Authorizing Official (AO), Authorizing Official Designated Representative (AODR), and relevant review and approval authorities to plan for, identify, assess, mitigate, and manage risks to the system. See Annex H for details.

Figure 1: MQ-9 RSO Operational View (OV-1)

Figure 2: OV-1 Proliferated Low Earth Orbit (PLEO) C2 Operational Concept Graphic

OE Suppli

Domes Taiw

Forei Chin

Ke

4.3.3. Supply Chain Risk Management (SCRM): SCRM efforts manage these Supply Chain risks and maintain system availability, integrity, and confidentiality. SCRM activities closely align with traditional security countermeasures such as Information Security, Industrial Security, Personnel Security, Physical Security, Operations Security, and Cybersecurity. This plan; however, spotlights these protection strategies on the actual cybersecurity vulnerabilities themselves. See Annex G for details.

Figure 3. MQ-9 SCRM Unique Suppliers

5.0. Processes for Program Management and Implementation of PPP: Primary responsibility for execution of the PPP during design, development, and test lies with MQ-9 PMs/SAPMs. The PMs/SAPMs are accountable to the Government for ensuring security is maintained throughout the program. The Program Protection Lead (PPL) is tasked with implementation and monitoring of program security efforts to effect countermeasures and procedures defined as part of the PPP. Additionally, the PMs/SAPMs designate the PPLs as the main program facilitator for the PPIPT. This group represents all functional offices, agencies, and industry (including Prime and sub-contractors), and is charged with protecting the program from a multitude of security threats. The PPIPT make up is determined by the phase of the program and issues being addressed. The PPL determines the make-up of the PPIPT prior to each meeting based on issues the PPIPT will address.

5.1. Audits/Inspections: Oversight and inspection of CPI and critical component protection measures is conducted by both the Defense Counterintelligence and Security Agency (DCSA) and the PPL. Audits, reviews, inspections, and/or program protection surveys should be conducted on an annual basis, at a minimum, at all locations that handle, process, and store MQ-9 CPI. Specific threats and vulnerabilities of each location may be cause for more frequent validations. The evaluating party (DCSA or PPL) will provide a written report to the PMs/SAPMs documenting the results of a countermeasure implementation evaluation within 30 days of completion. All inspection reports will be reviewed by the PPIPT to ensure deficiencies noted in annual inspections have been mitigated. Identified deficiencies which cannot be corrected will be briefed to the PMs/SAPMs and contracting officer for further resolution.

5.1.1. Defense Counterintelligence and Security Agency (DCSA): DCSA conducts periodic audits, reviews, and/or inspections of Defense Contractor Facilities to ensure proper implementation of required countermeasures which fall within the NISPOM Rule.

5.1.2. Program Protection Lead (PPL): The PPL will conduct an annual inspection of implemented protection countermeasures which fall outside of normal NISPOM Rule requirements. The PPL works with the local DCSA office to ensure gaps in protection are identified and reviews the contractor’s annual DCSA report for trend analysis. The PPL also establishes the frequency of non-DCSA inspections. Ideally, the PPL and DCSA will conduct a joint inspection; however, due to schedule conflicts this might not be possible.

5.1.3. Letter of Offer and Acceptance Security Instructions (LSI) (FMS only): The purpose of the LSI is to establish procedures and assign responsibilities for implementation of security requirements prescribed by the LOA, as amended, between the United States of America and the country concerning the Foreign Military Sales of the MQ-9. It provides instructions regarding the classification of information and equipment as well as specific security procedures including the handling and transfer of classified materials, Enhanced End Use Monitoring Assets, physical security parameters, and visit procedures.

5.2. Engineering/Technical Reviews: CPI protection requirements are relayed through several means.

Requirements are developed and relayed through the PPIPT as well as Request for Proposal (RFP) language and contracts. All RFPs and Statements of Work (SOWs) are reviewed by the PPL to ensure they contain the appropriate CPI protection requirements. If CPI protection requirements change during the contract period, the PPL and Contracting Officer will develop the appropriate change letter or contract modification to relay the new CPI protection requirements.

5.3. Verification and Validation: The MQ-9 program contains CPI inherited from one or more DoD programs. This CPI is identified in Table 4. Both government and industry have the responsibility of applying protection countermeasures as directed by the inherited PPP and SCG. Industry partners handling, storing, and integrating these CPI items must implement the required protection countermeasures. Since the inherited CPI is identified in this PPP, this PPP serves as the requirement to protect. Additionally, the CPI protection methods must be incorporated in the applicable tier training as necessary.

6.0. Processes for Monitoring and Reporting Compromises: Reporting the loss or comprise of program or inherited program CPI is required. If any person or office becomes aware of, or detects the loss or compromise of CPI, that person or office will immediately notify their respective Facility Security Officer (FSO) or security manager of the events surrounding the loss or compromise. Communicating compromises and monitoring of CPI is clearly stated in contracts and DD Forms 254. See SOW and DD Form 254 for details, handling procedures, and notification requirements. To prevent additional loss or compromise, the PPL may implement additional countermeasures which may require immediate implementation.

(See Table 7 below)

Reporting

Requirement Rationale

Loss of CPI If lost, major system modifications may be required to prevent mission interruption. It may also indicate a foreign collection or reverse engineering effort designed to replicate or defeat the MQ-9.

Classified data If lost, key details regarding the MQ-9 would be compromised, constituting a grave threat to national security.

Science and Technical Information

If lost, technical and design details would be compromised enabling an adversary to develop countermeasures or copy the MQ-9.

Proprietary data If lost, companies’ competitive or design advantage in the MQ-9 could be compromised.

Privacy Act Info If lost, personnel in the MQ-9 Enterprise are at greater risk to identity fraud and/or social engineering.

Countermeasure protection

If lost, effectiveness of countermeasures is reduced and in some instances, nullified.

Export controlled If lost, information and technologies may be exported illegally (and compromise the program).

Technical data If lost, technical and design details would be compromised enabling an adversary to develop countermeasures or copy the MQ-9.

OPSEC/Critical Information List

If lost, technical and design details or operational information would be compromised enabling an adversary to develop countermeasures or copy the MQ-9.

CUI data If lost, technical and design details or operational information would be compromised enabling an adversary to develop countermeasures or copy the MQ-9.

Compromised processes

If unique details regarding how the MQ-9 is developed, produced, tested, and/or fielded are compromised, it may result in additional design or supply chain vulnerabilities.

Table 7. Loss or Compromise Reporting Requirements

7.1. 32 CFAR Part 117 or National Industrial Security Program Operating Manual (NISPOM) Rule Requirements: These costs will be included in the administrative charges. Some examples of these countermeasure costs include Safes, clearances, access control, security training, storage, marking, and destruction of information both classified and unclassified.

7.2. Above NISPOM Rule Requirements: Because many security costs are not separately proposed or tracked, a completely accurate cost breakdown is not possible.

Security Discipline

Description Cost

Classified connectivity2

At Det 3 and Gray Butte At GA-ASI

$.12M/ year $.2M/year

OPSEC3 GA-ASI implement OPSEC Raytheon implement

OPSEC

L-3 CSW implement

OPSEC

Admin Admin Admin

CPI

Identification

- Cumulative Costs ~.4M4

Cybersecurity Government personnel costs5

Program costs6

~$.5M/ year Cumulative

PPP

Countermeasures7

- GA-ASI implement Annex C

- Raytheon implement Annex C

- L-3 Harris implement Annex C

Cumulative

Training8 - CPI training at GA-ASI

- CPI training at Raytheon

- CPI training at L-3 CSW

Admin Admin Admin

Total cost9 N/A Table 8: Program Protection Costs

7.0. Program Protection Costs

7.3. Cost Notes:

1. Sensitive Compartmented Information Facility (SCIF) in Poway, California: The AFLCMC’s Det 3 moved to new offices in Poway CA. The new facility requirements for Det 3 included a SCIF, which is being constructed by the contractor. The cost for building the SCIF will not be billed directly to any Air Force contract.

2. Classified Connectivity: The program office funds a T3 connection between Edwards AFB and Det 3 facilities in Poway CA. Additionally, the program office sponsors and funds a SIPRNet connection at GA-ASI. These connections (combined) cost ~$320,000 per year.

3. Operations Security (OPSEC): The OPSEC costs are difficult to track. OPSEC is not a

NISPOM Rule requirement. Each SOW released from the Medium Altitude UAS Division (see Table 7) contains a requirement to implement the OPSEC plan countermeasures identified in Annexes C and E. However, these costs are not reflected in proposals, but rather incorporated into contractor administrative overhead rates.

4. Government Critical Program Information (CPI) Identification Costs: These costs represent the estimated overall cost (in terms of man hours) incurred in the identification of Block 5 CPI and any further identification activities. These costs do not reflect CPI identification costs associated with previous CPI identification efforts. The estimated cost is based upon 3-5 major CPI review assessments, each taking about a week to accomplish.

5. Government Personnel Cybersecurity Costs: This cost is an estimate based upon three dedicated support contractors. It reflects an estimated per year cost for Government cybersecurity support.

6. Program Cybersecurity: These costs are embedded within each contract. It includes discrete tasks (i.e., support for risk management framework documentation), but most costs are embedded within engineering tasks that are not easily separable. Therefore, no dollar value can easily be provided to track the true costs.

7. Program Protection Plan (PPP) Countermeasures: Like OPSEC provision, countermeasures are difficult to track; perhaps more so because countermeasures can be NISPOM Rule requirements, above NISPOM Rule requirements and/or industry standards.

Each SOW released from the Medium Altitude UAS Division (see Table 7) contains a requirement to implement the countermeasures identified in Annex C. Additionally, each prime contractor’s BOA was modified to include additional security handling requirements for software. These costs are not reflected in proposals, but rather incorporated into administrative overhead.

8. Training: For the purposes of this section, training costs only represent training at contractor facilities. There are certainly costs associated with Government PPP countermeasure training as well, but since this training is incorporated with numerous other annual security training requirements, tracking it separately is not needed. However, requiring additional training for industry adds cost to contracts.

9. Total Costs: No overall protection cost is possible to record due to the nature of how security costs are incurred. Any number associated as the "Total Cost" for security would be sufficiently inaccurate that it adds no value.

8.1. Status: The program currently has multiple FMS efforts. Additionally, several countries have received information regarding MQ-9, and there is a potential for future involvement with numerous additional countries.

8.1.1. Foreign Military Sales (FMS) Cases: There are current MQ-9 Blk 5 FMS cases with the United Kingdom (UK), France, Italy, Spain and Netherlands. Taiwan is procuring MQ-9 Blk 1s.

The UK, Belgium and Taiwan are currently procuring MQ-9Bs. The GCS variants typically include Blk 15/25 for Blk 1 sales; Blk 30 for Blk 5 sales; and Certified Ground Control Station(s) for MQ-9B sales. The interest in the MQ-9 and its variants is growing exponentially worldwide, and each system developed and sold will require special attention for program protection and export compliance requirements.

Country MQ-9A Blk 1 Delivered? Blk 5 Delivered?

MQ-9B Variant (Protector, SkyGuardian, SeaGuardian)

Delivered?

UK X Yes Protector No Belgium SkyGuardian No Canada SkyGuardian No France X Yes X Yes Italy X Yes X Yes Netherlands X Yes Spain X Yes Taiwan MQ-9A X No Taiwan MQ-9B SeaGuardian No

New Business

Country MQ-9B Variant (Protector, SkyGuardian, SeaGuardian) Brazil SeaGuardian Colombia SeaGuardian Denmark SkyGuardian Egypt TBD Finland TBD Greece SeaGuardian India Sky & SeaGuardian Japan SeaGuardian Kenya TBD Morocco SkyGuardian Latvia TBD Lithuania Sky & SeaGuardian

8.0. Foreign Involvement

New Business

Country MQ-9B Variant (Protector, SkyGuardian, SeaGuardian) Malaysia SeaGuardian Norway TBD Poland SkyGuardian Qatar SeaGuardian Romania SkyGuardian Saudi Arabia Sky & SeaGuardian South Korea SeaGuardian Sweden SkyGuardian United Arab Emirates

SkyGuardian

Table 9: Foreign Military Sales (FMS) Cases Current/Future w/ Configurations

8.2. Security Requirements: This PPP's Annexes contain numerous archival documents specific to foreign programs.

8.2.1. Delegation of Disclosure Authority Letter: Annex K outlines the releasability caveats utilized by Foreign Disclosure Officers to make releasability determinations.

8.2.2. Letter of Offer and Acceptance (LOA) Security Instruction (LSI): Outlines the actual security requirements mandated via the LOA with a purchasing country. The LSI provides equivalent protection standards for the country. An LSI is developed for each International Partner country.

Contact the OPR for additional information.

8.2.3. Enhanced End Use Monitoring Handbook and Checklist: The LSI outlines the tools utilized by the Defense Security Cooperation Agency's End Use Monitoring compliance inspectors.

8.2.4. Foreign National Plan: Annex L outlines the protection responsibilities agreed to between the MQ-9 System Program Office and its Industry Partners for the handling and processing of foreign visitors in proximity to Air Force activities.

8.2.5. Anti-Tamper (AT): Each country requires a stand-alone AT plan (See Annex F).

UNCLASSIFIED

A-1

Annex A

Terms and Acronyms

Wright-Patterson Air Force Base (WPAFB), OH

Program Executive Officer for Intelligence, Surveillance, Reconnaissance, and Special Operations Forces

(PEO / ISR & SOF)

1 JULY 2024

A-2

Terms

Acquisition Facilities: DoD facilities primarily involved in activities related to research, development of systems, testing or evaluation of test results.

Acquisition Systems Protection: The safeguarding of defense systems anywhere in the acquisition process. The protection integrates all security disciplines, counterintelligence and other defensive methods to deny foreign collection efforts and prevent unauthorized disclosure in order to deliver to United States (US) forces uncompromised combat effectiveness over the life expectancy of the system.

Adversary: An individual, group, organization or government hostile to US goals or mission.

Anti-Tamper: The systems engineering activities intended to prevent and/or delay exploitation of critical technologies in US weapon systems. These activities involve the entire life cycle of systems acquisition including research, design, development, implementation and testing of AT measures.

Automated Information System: Assembly of computer hardware, software, firmware or any combination of these, configured to accomplish specific information-handling operations, such as communication, computation, dissemination, processing and storage of information.

Compromise: The known or suspected exposure of sensitive (classified or controlled unclassified) information or material to persons who are not authorized access.

Counterintelligence: Those activities intended to detect, counteract, and/or prevent espionage and other clandestine intelligence activities, sabotage, international terrorist activities or assassinations conducted by or on behalf of foreign powers, organizations or persons; it does not include personnel, physical, document or communications security programs.

Countermeasures: The form of military science that, by employment of devices and/or techniques, has as its objective the impairment of the operational effectiveness of enemy activity.

Countermeasures may include anything that effectively negates an adversary's ability to exploit vulnerabilities.

Critical Information (CI): Is the process of identifying, understanding, prioritizing and counteracting foreign intelligence threats the US faces. Using real-time threat awareness information for countering the threat to classified programs, secrets, technologies and operations enables the US Government to better protect US technology and operations.

Critical Program Information (CPI): Information about the program, technologies and/or systems that if compromised would/could cause significant degradation in mission effectiveness, shorten the expected combat-effective life of the system, reduce technological advantage, significantly alter program direction, or enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability. It includes information about applications, capabilities, processes and end-items, elements or components critical to a military system or network

A-3 mission effectiveness and technology that would reduce the US technological advantage if it came under foreign control.

Controlled Unclassified Information (CUI): Unclassified information to which access or distribution limitations may apply in accordance with applicable national laws or regulations.

Whether the information is provided or generated under the program, the information will be marked to identify its "in confidence" nature. It could include information that has been declassified, but remains controlled.

Delegation of Disclosure Letter (DDL): A letter required as part of the Technology Assessment/Control Plan, prepared by the cognizant DoD Component, that provides detailed guidance regarding releasable elements of the system or technology in question. The DDL must be approved by Under Secretary of Defense for Policy (USD [P]) before any promise or release of sensitive technology.

Foreign Intelligence Collection Threat: The potential of a foreign power, organization or person to overtly or covertly collect information about US acquisition program technologies, capabilities and methods of employment that could be used to develop a similar weapon system or countermeasures to the US system or related operations.

Infrastructure: Items that are used by more than one acquisition program in the pursuit of the development of defense systems. Infrastructure includes laboratories, test facilities, the policy and procedure structure and education and training organizations.

Milestone Decision Authority (MDA): The individual designated in accordance with criteria established by the office of the Under Secretary of Defense (Acquisition, Technology and Logistics) to approve entry of an acquisition program into the next phase of the acquisition process.

Integrated Threat Assessment: An assessment made by the cognizant DoD Component that describes those foreign governments, entities or activities that have the interest and capability to collect information about a system under development.

Need-to-Know: A determination made by an authorized holder of classified or controlled unclassified information that a prospective recipient has a requirement for access to, knowledge of or possession of the information in order to accomplish a designated and approved MQ-9 program function.

Operations Security (OPSEC): A process of analyzing friendly actions attendant to military operations and other activities to:

a. Identify those actions that can be observed by adversary intelligence systems.

b. Determine the indicators hostile intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

A-4

c. Select and execute measures that eliminate, or reduce to an acceptable level, the vulnerabilities of friendly actions to adversary exploitation.

Program Information: Information that includes programmatic data and/or information and weapons system, subsystem or component information.

Program Protection: The safeguarding of defense systems and technical data anywhere in the acquisition process to include the technologies being developed, the support systems (e.g., test and simulation equipment) and research data with military applications. This protection activity involves integrating all security disciplines, counterintelligence and other defensive methods to protect the essential program information, technologies and systems data from intelligence collection and unauthorized disclosure.

Program Protection Plan (PPP): A comprehensive protection and technology control management plan established for each defense acquisition program to identify and protect classified and other sensitive information from foreign intelligence collection or unauthorized disclosure. (The PPP is designed to negate the Program Protection Threats and Vulnerabilities.)

Program Protection Survey: A survey, conducted during each acquisition phase, to assess the effectiveness of the countermeasures prescribed in the PPP at a specific point in time.

Program Protection Threats: The program protection threats include life-cycle protection threats, foreign intelligence collection efforts and unauthorized disclosure of critical program information, technologies and systems during the acquisition process.

Risk Management: The comparison and analysis of the relative threat (intent and capability to collect the information), the vulnerability of the asset, the cost and administrative burden of possible countermeasures and the value of the asset used to determine the appropriate level of protection to control and reduce the risk of compromise or disclosure, to acceptable levels. Risk management allows the acceptance of risk in the security process based upon a cost-benefit analysis.

Sensitive Information: Any information that the loss, misuse or unauthorized access of would or could adversely affect the organizational and/or national interest, but which does not meet classification criteria specified in DoD 5200.1-R (reference [c]).

System Decomposition: The separation of the major mission functions and capabilities of the system and the identification of those components or technologies that give the system this ability.

Security Infraction: A security infraction is any other incident that is not in the best interest of security that does not involve the loss, compromise, or suspected compromise of classified information. Security infractions will be documented and made available for review by the PSO during visits.

A-5

Security Violation: Any incident that involves the loss, compromise or suspected compromise of classified information. Additionally, (1) Any knowing, willful, or negligent action that could reasonably be expected to result in an unauthorized disclosure of classified information; (2) any knowing, willful, or negligent action to classify or continue the classification of information contrary to the requirements of E.O. 13526 or its implementing directives; or (3) any knowing, willful, or negligent action to create to continue a SAP contrary to the requirements of E.O.

13526.

Technology Assessment/Control Plan (TA/CP): The document that identifies and describes sensitive program information; the risks involved in foreign access to the information; the participation in the program or foreign sales of the resulting system and the development of access controls and protective measures as necessary to protect the US technological or operational advantage represented by the system.

Technology Transfer: Transferring, exporting or disclosing defense articles, defense service or defense technical data covered by the US Munitions List to any foreign person or entity in the US or abroad.

Threat: The sum of the potential strengths, capabilities and strategic objectives of any adversary that can limit or negate US mission accomplishment or reduce force, system or equipment effectiveness. (see Program Protection Threats.)

Unauthorized Access: Access to information (either classified or sensitive unclassified) by personnel not authorized access to the information. Such access can be either intentional or inadvertent.

Vulnerability: The susceptibility of systems or components to the threat in a given environment.

A-6

Acronyms

88 ABW/IPA 88 Air Base Wing/Information Protection Acquisition 645 AESG 645th Aeronautical Systems Group A&A Assessment and Authorization AB Air Base ABIR Airborne Infrared AC Activity Category ACAT Acquisition Category ACB Activity Control Board ACC Air Combat Command ACPM AC Power Distribution Module ACSM AC Switching Module ADC Analog to Digital Converters ADI Attitude Direction Indicator ADT Air Data Terminal AES Advanced Encryption Standard AESG Aeronautical Systems Group AF Air Force AFB Air Force Base AFCAP Air Force Certification and Accreditation Program AFI Air Force Instruction AFJI Armed Forces Journal International AFLCMC/WII Medium Altitude UAS Division AFMC Air Force Materiel Command AFOSI Air Force Office of Special Investigations AFOTEC Air Force Operational Test and Evaluation Center AFPD Air Force Policy Directive AFPAM Air Force Pamphlet AFPEO Air Force Program Executive Officer AFSAC Air Force Security Assistance Center AFSOC Air Force Special Operations Command AFSSI Air Force System Security Instruction AFTTP Air Force Tactics, Techniques and Procedures AGI Advanced Geospatial Intelligence AGM Air-to-Ground Missile AIAS Acquisition Information Assurance Strategy AIS Automated Information System ANG Air National Guard ANT Antenna AO Authorizing Official AOA Analysis of Alternatives AOC Air Operations Center AODR Authorizing Official Designated Representative AOR Area of Responsibility APX Airborne Radar Transponder ARB Air Reserve Base

A-7

ARC Arc-second Raster Chart ASC Aeronautical Systems Center ASC/CA Executive Director, Aeronautical Systems Center ASC/WIOS Aeronautical Systems Center/ Operations Management and Security for Intelligence, Surveillance, Reconnaissance and Special Operations Forces Directorate

ASC/XPD Aeronautical Systems Center Foreign Disclosure Office ASC/XR2 Aeronautical Systems Center Capabilities and Integration Directorate, Intelligence ASD(C3I) Assistant Secretary of Defense for Command, Control, Communications and Intelligence ASD R&E Assistant Secretary of Defense for Research and Engineering ASI Aircraft Station Interface ASIC Application Specific Integrated Circuits ASIP Airborne Signals Intelligence Payload ASMS Aircraft Stores Management System ASP Acquisition Systems Protection ASPO Acquisition Systems Protection Office Assy Assembly…