A02 - SOW - Managed Attribution System.docx

Drug Enforcement Administration Statement of Work Managed Attribution System Cyber Support Section

PURPOSE

The Drug Enforcement Administration (DEA) Cyber Support Section (ODV) would like to continue to modernize and streamline DEA’s Internet-based investigative resources with an integrated managed attribution and evidence collection system. Deployment of these capabilities, across the entire DEA, will equip agents and analysts with standardized technical tools necessary to safely and effectively conduct online research and collect and preserve evidence.

BACKGROUND

Conducting Internet-based investigations and research browsing has multiplied over the past several years. With the advent of Drug Trafficking Organizations (DTOs) relying heavily upon Internet-based applications and Dark Web sites to facilitate their criminal enterprise, it is anticipated that in the future, electronic communications will be the preferred and exclusive means of communication. The threat landscape described creates opportunities for law enforcement to exploit illicit Dark Web market sites utilized by DTOs and dismantle their operations.

SCOPE OF WORK

Two critical needs have been identified in the field’s ability to safely exploit these forms of communications: managed attribution and integrated evidence collection. The DEA proposes issuing a request for information (RFI) for a fully managed virtual environment designed specifically for the unique challenges of online research and investigation. The vendor shall provide masked/backstopped IP addresses and browser attributes to obscure identity and prevent activity tracing. Each user will have the option for persistent and non-persistent mode. Within persistent mode the cookies, collected evidence, and browsing history are retained (with full-page and source code capture, timestamps and forensic hashing capabilities) through multiple sessions. Non-persistent mode sessions will start with a new instance of the virtual system. Any data or configuration changes made during the session are discarded once they system is shut down. Any malware encountered during a mission is contained within the secure operation environment (SOE), preventing contagion across agency networks. The procured system is required to be flexible such that other mission critical applications can be added on its secure desktop, including future tools built by the DEA that need to be integrated into the system’s environment.

The deployment of a fully integrated managed attribution and evidence collection tool allows DEA investigators to move online investigation operations onto a SOE, insulated from the DEA’s day-to-day networks. Moreover, it will continue to enable these investigators to conduct non-attributable online activities. This non-attribution shall be conducted through trade-crafted points-of-presence that enable users’ traffic to appear to originate from designated remote locations/geosites rather than from the user’s actual physical location. Vendor will enable users to reach target Websites and services without exposing the IP address of the workstation and thus revealing their true identity and affiliation.

In addition to providing advanced security, managed attribution, and enhanced evidence collection, the Vendor product also provides administrators at the DEA with a variety of account management capabilities. Activities are to be indexed and presented within an administrative interface. Content to be recorded includes user login times and points-of-presence data. DEA users will have the flexibility to sort and export the data as needed, thereby facilitating the discovery process. The oversight/audit function will only be visible to user accounts with special admin permissions – these users will be determined by DEA program administrators as part of contract implementation.

Additionally, the vendor shall provide the capabilities to leverage emerging mobile technologies. The system should incorporate features that replicate a mobile phone, providing the ability to send/receive messages, make and receive calls and voicemails, and install applications within emulated mobile phone. Examples of applications include digital asset wallets on the virtual platform to enable users to swap or exchange digital assets within the secure environment.

The system shall also incorporate the Exodus wallet natively installed within the virtual environment. The application will provide users with direct access to manage cryptocurrency assets.

PERFORMANCE OBJECTIVES

Vendor shall provide the following:

1. Provide anonymized connections to the Public Internet

a. General unattributed secure connections for routine browsing and investigative research on the Internet.

· Browser interfaces accessible from inside or outside DEA infrastructure

· Access from regular laptops or workstations without the necessity of installing local software

· Connections to secure Virtual Desktops Interfaces which shall not store any data or browser information on a local system

· Audit trail of user name, local login successful or not successful, and date and time of events

· Ability to journal information the user identifies and store in a secure database for future retrieval and analysis

b. Managed attribution for secure connections for Undercover (UC) browsing of specific Web sites with ability to choose attributable public facing geographic locations displaying IP addresses which cannot be attributed to DEA or other government entities.

· Browser interfaces accessible from inside or outside DEA infrastructure

· Access from regular laptops or workstations without the necessity of installing local software

· Connections to secure Virtual Desktops Interfaces (VDI) which shall not store any data or browser information on a local system

· Emulated mobile phone feature with the capability to send/receive messages, make and receive calls and voicemails, and install applications.

· Exodus wallet natively installed within the VDI.

· Audit trail of user name, local logins successful or not successful, and date and time of events.

· Ability to journal information the user identifies and store in a secure database for future retrieval and analysis which may be evidentiary in nature

2. Journal and evidence storage infrastructure securely separated from the VDI browsing infrastructure.

3. Distributed Administrative access and control to permit the following:

a. Provision Administrative Super Users

b. DEA Administrators shall be able to provision and de-provision Special Agent (SA) and Intelligence Analysts (IA) users and assign privileges for each user, i.e., Read-Write access, access to evidence store, etc.

c. All Administrator access shall require 2-factor identification

d. All Administrator actions shall be auditable

e. DEA Administrators shall be able to assign Geolocations for UC users

f. Each Field Division shall have at least one geographically pertinent IP address available for the Division, and a static IP address if it would be a requirement for a particular case

The vendor shall maintain a cloud-based infrastructure. With a logically separated virtual environment.

PERIOD OF PERFORMANCE

The period of performance for services described in the SOW is established from August 14, 2025 through August 13, 2031. The period of performance is one year from the effective date of the contract with four (4) successive twelve month option periods. In the event the options are exercised, maximum periods of performance for each option shall be as follows:

Base Period (12 Months): Date of award plus 364 days.

Option Period 1 (12 Months): 365 Days Through 729 Days after contract award.

Option Period 2 (12 Months): 730 Days Through 1,094 Days after contract award.

Option Period 3 (12 Months): 1,095 Days Through 1,459 Days after contract award.

Option Period 4 (12 Months): 1,460 Days Through 1,824 Days after contract award.

FAR 52.217-8 Option (6 Months): 1,825 Days Through 2,007 Days after contract award

DELIVERABLES

Vendor shall provide deployment of above described services across the DEA for up to 200 concurrent users. The system shall include CONUS points of presence for each field division and OCONUS points of presence. The locations of these presences will be determined by DEA program managers in consultation with Vendor.

INSPECTION/ACCEPTANCE

1. DEA retains final approval authority for acceptance of all products.

2. DEA will only approve payment for work performed by Vendor for DEA to access the above described products/services.