DARPA-BAA-16-34.pdf

Broad Agency Announcement Enhanced Attribution

DARPA-BAA-16-34

April 22, 2016

Defense Advanced Research Projects Agency Information Innovation Office 675 North Randolph Street Arlington, VA 22203-2114

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 2

Table of Contents

I. Funding Opportunity Description

II. Award Information

A. Awards

III. Eligibility Information

A. Eligible Applicants

C. Cost Sharing/Matching

D. Other Eligibility Requirements

IV. Application and Submission Information

A. Address to Request Application Package

B. Content and Form of Application Submission

C. Submission Dates and Times

D. Funding Restrictions

E. Other Submission Requirements

V. Application Review Information

A. Evaluation Criteria

B. Review and Selection Process

VI. Award Administration Information

A. Selection Notices

B. Administrative and National Policy Requirements

C. Reporting

VII. Agency Contacts

VIII. Other Information

A. Frequently Asked Questions (FAQs)

B. Proposers Day

C. Submission Checklist

D. Associate Contractor Agreement Clause (ACA)

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 3

PART I: OVERVIEW INFORMATION

Federal Agency Name: Defense Advanced Research Projects Agency (DARPA), Information Innovation Office (I2O)

Funding Opportunity Title: Enhanced Attribution

Announcement Type: Initial Announcement

Funding Opportunity Number: DARPA-BAA-16-34

Catalog of Federal Domestic Assistance Numbers (CFDA): Not Applicable

Dates o Posting Date: April 22, 2016 o Proposers’ Day: April 25, 2016 o Proposal Due Date: June 7, 2016, 12:00 noon (ET) o BAA Closing Date: June 7, 2016, 12:00 noon (ET)

Anticipated Individual Awards: There are multiple technical areas (TAs) for this solicitation. Currently, DARPA anticipates multiple awards in TA1; one or more awards in TA2; and one or more awards in TA3.

Types of Instruments that May be Awarded: Procurement contracts, Other Transactions

Agency Contacts o Technical POC: Dr. Angelos Keromytis, Program Manager, DARPA/I2O o BAA Email: enhanced-attribution@darpa.mil o BAA Mailing Address:

DARPA/I2O

ATTN: DARPA-BAA-16-34

675 North Randolph Street Arlington, VA 22203-2114 o I2O Solicitation Website: http://www.darpa.mil/work-with-us/opportunities

PART II: FULL TEXT OF ANNOUNCEMENT

http://www.darpa.mil/work-with-us/opportunities

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 4

I. Funding Opportunity Description

DARPA is soliciting innovative research proposals in the area of cyber attribution. The goal of the Enhanced Attribution program is to develop technologies for generating operationally and tactically relevant information about multiple concurrent independent malicious cyber campaigns. The objective is to not only collect and validate this pertinent information, but to create the means to share such information with any of a number of interested parties without putting at risk the sources and methods used for collection. Proposed research should investigate innovative approaches that enable revolutionary advances in science, devices, or systems.

Specifically excluded is research that primarily results in evolutionary improvements to the existing state of practice.

This Broad Agency Announcement (BAA) is being issued, and any resultant selection will be made, using procedures under Federal Acquisition Regulation (FAR) 35.016. Any negotiations and/or awards will use procedures under FAR 15.4. Proposals received as a result of this BAA shall be evaluated in accordance with evaluation criteria specified herein through a scientific review process.

DARPA BAAs are posted on the Federal Business Opportunities (FBO) website (https://www.fbo.gov/).

The following information is for those wishing to respond to this BAA.

Background

Malicious actors in cyberspace currently operate with little fear of being caught due to the fact that it is extremely difficult, in some cases perhaps even impossible, to reliably and confidently attribute actions in cyberspace to individuals. The reason cyber attribution is difficult stems at least in part from a lack of end-to-end accountability in the current Internet infrastructure. Cyber campaigns spanning jurisdictions, networks, and devices are only partially observable from the point of view of a defender that operates entirely in friendly cyber territory (e.g., an organization’s enterprise network). The identities of malicious cyber operators are largely obstructed by the use of multiple layers of indirection. The current characterization of malicious cyber campaigns based on indicators of compromise, such as file hashes and command-and-control infrastructure identifiers, allows malicious operators to evade the defenders and resume operations simply by superficially changing their tools, as well as aspects of their tactics, techniques, and procedures. The lack of detailed information about the actions and identities of the adversary cyber operators inhibits policymaker considerations and decisions for both cyber and non-cyber response options (e.g., economic sanctions under EO-13694).

Program Scope

The Enhanced Attribution program aims to make currently opaque malicious cyber adversary actions and individual cyber operator attribution transparent by providing high-fidelity visibility into all aspects of malicious cyber operator actions and to increase the Government’s ability to publicly reveal the actions of individual malicious cyber operators without damaging sources and methods.

https://www.fbo.gov/

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 5

The program will develop techniques and tools for generating operationally and tactically relevant information about multiple concurrent independent malicious cyber campaigns, each involving several operators, and the means to share such information with any of a number of interested parties (e.g., as part of a response option). The program seeks to develop:

technologies to extract behavioral and physical biometrics from a range of devices and vantage points to consistently identify virtual personas and individual malicious cyber operators over time and across different endpoint devices and C2 infrastructures;

techniques to decompose the software tools and actions of malicious cyber operators into semantically rich and compressed knowledge representations;

scalable techniques to fuse, manage, and project such ground-truth information over time, toward developing a full historical and current picture of malicious activity;

algorithms for developing predictive behavioral profiles within the context of cyber campaigns; and technologies for validating and perhaps enriching this knowledge base with other sources of data, including public and commercial sources of information.

Program Structure

The Enhanced Attribution program will produce basic technologies and an integrated experimental prototype comprising an end-to-end data collection, fusion, analysis, and validation and enrichment engine. Proposers may only submit one proposal as lead institution to the Enhanced Attribution program. Each proposal may cover one or more technical areas.

Proposers may include additional pages for each technical area addressed in the technical approach (See Section IV.B.1.a).

The program is divided into three technical areas (TA) that will be working in parallel, starting at program kickoff, and will span three 18-month Phases. TA1 performers will develop technologies for network behavior and activity tracking and summarization. TA2 performers will develop technologies for fusion of TA1-generated data and for predictive analysis of malicious cyber operator activities, and will serve as the architect and integrator of the experimental prototype. TA3 performers will focus on validation and enrichment of TA1-collected and TA2-fused data with non-sensitive information (e.g., publicly available data feeds) with the goal of generating a description of the malicious activities using only such data that the Government can publicly reveal in order to expose the actions of individual malicious cyber operators without damaging sources and methods.

The selected Enhanced Attribution performers are required to collaborate with each other. The Government may determine that an Associate Contractor Agreement (ACA) is necessary to help facilitate an open exchange of information and ensure complete compatibility between software components, the system architecture, equipment, data and other program elements to prevent unnecessary duplication of effort, and to maximize commonality to guarantee appropriate coordination and integration of work. If the Government determines that ACAs are necessary, all selected performers will be required to have their ACAs in place prior to the program kick-off meeting.

The Government will assess performer progress using formal and informal technology evaluations and adversarial engagements driven by specific operational scenarios. The

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 6

operational scenarios will incorporate red teams, US Government cyber operators, and other real world cyber operations. DARPA encourages technical efforts that allow for flexibility in testing and evaluation, to take advantage of opportunities to access data sets under time constraints, while permitting long-term research and development.

At the time of proposal submission, all proposers wishing to submit proposals under TA2 and TA3 must have some personnel with a Top Secret clearance that are eligible for Sensitive Compartmented Information (SCI). It is preferable (but not required) that the Principal Investigator in each TA2 and TA3 proposal be cleared at that level.

Proposers to TA1 are not required to hold or obtain security clearances. However, it is strongly encouraged that TA1 performers have personnel with a Top Secret clearance that are eligible for SCI. It is preferable (but not required) that the Principal Investigator in each TA1 proposal be cleared at that level.

The requirement for security clearance applies to all teams but does not apply to all personnel in a team. Academic and small company participation is explicitly encouraged, subject to the proposal- and project-wide requirement stated earlier in this section.

Technical Areas

The three TAs within the Enhanced Attribution program are:

Behavior and Activity Tracking and Summarization (TA1) Fusion and Predictive Analysis (TA2) Validation and Enrichment (TA3)

Behavior and Activity Tracking and Summarization (TA1):

TA1 performers will explore techniques for tracking malicious cyber operators from various vantage points, toward characterizing the individual behavior and cyber-relevant actions taken by said operators, taking advantage of prior knowledge (e.g., software toolchain used in the campaign). Although behavioral biometrics and activity tracking are two distinct goals, DARPA encourages performers to pursue technical approaches that enable both.

Vantage points of interest include, but are not limited to:

Internet-of-Things (IoT) devices Mobile phones Development (Dev) and Operations (Ops) desktops and laptops of malicious cyber operators Network infrastructure

Proposers need only focus on one vantage point, but may choose to pursue multiple vantage points. Proposers may specify a focus vantage point different from the ones listed above, as long as they make clear in their proposal its relevance to the goals of the program.

TA1 proposers should include the following topics among those discussed in their proposal:

1. Attribution has often focused on group or organization identification and rarely on the

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 7

individuals that comprise said groups and organizations. Proposers should discuss how their solutions would identify and consistently track personas, and how such personas may be linked to identities.

2. Behavioral biometrics extracted from endpoint systems must consider and minimize the negative impact to end-user experience due to technical footprint. Proposers should discuss how their solutions would minimize performance impact and minimize utilized bandwidth while providing sufficient information to allow reconstruction of malicious cyber operator activities by TA2.

3. Proposers should consider what, if any, Human Subjects Research (HSR) considerations their technical approach may raise, and consult their Institutional Review Board (IRB) as appropriate. Should such considerations apply, DARPA strongly encourages proposers to include relevant documentation in their proposals (e.g., a determination by the IRB).

See Section VI.B.2.

Fusion and Predictive Analysis (TA2):

TA2 performers will work collaboratively with TA1 and TA3 performers to provide the innovative R&D required to assemble the Enhanced Attribution architecture into a scalable experimental prototype. TA2 performers will focus on fusing ground truth information generated by TA1 performers to create an up-to-date knowledge base of each malicious cyber operator, task the different sources of information to reflect different collection priorities as a monitored malicious campaign progresses, and develop predictive profiles of malicious operators based on historical and ground truth data. Predictive profiles can leverage existing frameworks (e.g., cyber kill chain) or present novel and new frameworks.

TA2 proposers should include the following topics among those discussed in their proposal:

1. Fusing data from multiple sources requires dealing with out-of-sequence data and data that are related but whose causal order is uncertain. Proposers should describe how their solutions would effectively fuse and compose data into coherent narratives that describe the multiple concurrent workflows cyber adversaries are engaged in.

2. As data sources increase, so too does the volume of captured data. Proposers should explain how their proposed technology would handle large data volume ingestion, storage, and access.

3. Proposers should explain how their technologies would enable them to search, reason over, and identify patterns in the data, toward developing predictive activity models of individual malicious cyber operators.

4. Similarly, proposers should explain how their technologies would enable TA3 performers to search, reason over, and validate and if possible enrich their adversary models using non-sensitive sources of information.

5. The experimental prototype must be deployable to end-user facilities with limited connectivity to the public Internet. As such, proposers should explain strategies for minimizing required efforts to package and deploy the system as a self-contained unit.

Validation and Enrichment (TA3):

TA3 performers will enrich the knowledge base with additional sources of information, DARPA-BAA-16-34 ENHANCED ATTRIBUTION 8 including publicly available data (e.g., WHOIS records), commercial data (e.g., threat intelligence feeds), and Government-only data, to complement TA1 data toward developing a broader picture of malicious activity and identifying weaknesses in their TTPs, tools, and infrastructure. DARPA anticipates that the ingestion of such data would be of limited scope, based on the data’s relationship with the ground truth data that TA1 generates. Some examples of cyber operations information of interest include, but are not limited to:

Network-based information (e.g., PCAP, NetFlow, firewall and IDS logs) Host-based information (e.g., antivirus logs, resident files, registry settings) Network Presence Information (e.g., WHOIS and DNS records)

TA3 proposers should include the following topics among those discussed in their proposal:

1. The goal of Enhanced Attribution is to compose an explanatory and operationally useful narrative of malicious cyber operator actions that can be publicly disclosed in order to expose the actions of individual malicious cyber operators without damaging sources and methods. Performers should discuss how their solutions would expose known but hidden structure of cyber actions leveraging information that can be publicly disclosed.

2. Often pertinent, publicly available information is transient in nature. Performers should explain how their technologies would address the transient nature of data and how their technologies would operate after the fact and with real-time data.

3. DARPA is particularly interested in meaningful metrics for evaluating the overall effectiveness of this enhanced attribution effort. Performers are encouraged to consider such metrics and to explain how they will evaluate their technologies in light of these metrics.

Program Phases and Metrics

Throughout the Enhanced Attribution program, performers will be expected to continually refine their respective technologies and integrate their solutions into an operational prototype. During Phase 1, performers will utilize simulated threat actors where ground truth is explicitly known.

During Phase 2, performers will utilize cyber operators-in-training where ground truth is explicitly known. During Phase 3, performers will utilize operators-in-action where ground truth may not be explicitly known. It is expected that additional data will become available during the course of the program. Performers should be able to either receive or bring their prototypes to such data, for the purposes of both technology refinement and evaluation. DARPA anticipates that TA3 performers, in particular, will need to use sensitive data early on in the program, due to the envisioned concept of operations for that set of technologies.

Provided below are metrics indicative of expected progress. Proposers are encouraged to provide additional metrics, as appropriate for their technical approach and methodology.

Metric Phase 1 Phase 2 Phase 3 TA1 Profile & Activity Accuracy 60% 75% 90% TA2 Reconstruction Accuracy 35% 50% 75% TA3 Validation and Enrichment 20% 35% 50%

Schedule and Milestones

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 9

For each year of the effort, there will be quarterly program reviews with the DARPA technical team, which include two site visits and two Principal Investigator (PI) meetings. During these reviews, DARPA will assess progress toward solution via performer briefings, technical discussions, demonstrations, and informal end‐of‐phase evaluations based on the metrics of each phase.

PI meetings will focus on open technical exchange that includes discussion of difficulties encountered and possible solutions. The goals of the PI meetings will be to: (a) review and share innovations/accomplishments of the program; (b) review and discuss plans and options for technology demonstrations and prototypes; (c) review and discuss results from meetings and events conducted prior to the tests and evaluations; (d) demonstrate prototypes; and (e) plan for the next six‐month period.

The Government will specify the locations for the technical interchanges, PI meetings, and other events. For budgeting purposes, assume the locations of the two PI meetings held each year will be in the Washington, D.C. metro area. Actual locations will be determined on performer locations and relative cost to the government. In addition to site visits, regular meetings are encouraged to enhance communications and collaborations, as required, among the performers.

Should important issues arise between program reviews, the Government team will be available to support informal interim meetings.

Proposers should propose a detailed schedule that is consistent with the maturity of their approaches and the risk reduction required for their concepts, and their program plan. These schedules will be synchronized across performers, as required, and monitored and revised as necessary, throughout the program’s period of performance. A start date of November 1, 2016, should be assumed for budgeting purposes. Subject to the availability of funding, the program is intended to last for 4.5 years.

Deliverables

Performers are responsible for providing, at a minimum, the following deliverables, as applicable:

Slide Presentations – Annotated slide presentations will be submitted within two weeks after program kick‐off meeting and after each review.

Monthly Coordination Reports – A monthly technical coordination report describing progress made, resources expended, and any issues requiring the attention of the Government team will be provided within 10 days after the end of each month. Monthly expenditure reports and uploading of required deliverables to the DARPA Technology Financial Information Management System (TFIMS) reporting system are required by all program performers.

System Development Plan (SDP – TA2 performers only) – An SDP will be provided within one month after the kickoff meeting for each phase, and shared with other performers for synchronization. The SDPs for each phase will be based on the performers’ proposal and will be presented at the kickoff meeting for each phase. The SDP will describe the scope of the design and development effort, describe applicable hardware and/or software architecture in sufficient detail for review and planning, DARPA-BAA-16-34 ENHANCED ATTRIBUTION 10 reference any applicable documents, and provide a program schedule.

Software – All computer software developed or delivered under the program must be delivered as source (including entire version control history) and as object (executable) code. Include the source listings and source code for the target computer systems.

DARPA encourages delivered software under this effort ,to be completely maintainable and modifiable with no reliance on any non‐delivered computer programs or documentation.

Software Documentation – Software documentation shall be provided within one month after the end of each phase documenting source code, hardware description language specifications, system diagrams, part numbers and other data necessary to maintain and to produce copies of the software.

Final Technical Report – The final report, due at contract completion, will concisely summarize the effort conducted and provide any lessons learned during the development of the technology.

Proposals are not limited to just these and may contain additional deliverables.

Government-Furnished Property/Equipment/Information

Proposals should clearly state any assumptions regarding the use of proposed Government test facilities and capabilities, as well as any proposed Government Furnished Equipment (GFE) used as part of their development, test, and evaluation approach. Proposers should not make any presumptions the Government will provide any GFE and should identify the need date and the anticipated cost to purchase the equipment if not available as GFE.

Intellectual Property

The program will emphasize creating and leveraging open source technology and architecture.

Intellectual property rights asserted by proposers are strongly encouraged to be aligned with open source regimes.

A key goal of the program is to establish an open, standards-based, multi-source, plug-and-play architecture that allows for interoperability and integration. This includes the ability to easily add, remove, substitute, and modify software and hardware components. This will facilitate rapid innovation by providing a base for future users or developers of program technologies and deliverables. Therefore, it is desired that all noncommercial software (including source code), software documentation, hardware designs and documentation, and technical data generated by the program be provided as deliverables to the Government, with a minimum of Government Purpose Rights (GPR), as lesser rights may adversely impact the lifecycle costs of affected items, components, or processes. See Section VI.B.2 for more details on intellectual property.

Security Clearance Requirements

See Section III.D.

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 11

II. Award Information

A. Awards

Multiple awards are anticipated. The level of funding for individual awards made under this solicitation has not been predetermined and will depend on the quality of the proposals received and the availability of funds. Awards will be made to proposers whose proposals are determined to be the most advantageous and provide the best value to the Government, all factors considered, including the potential contributions of the proposed work, overall funding strategy, and availability of funding. See Section V for further information.

The Government reserves the right to:

select for negotiation all, some, one, or none of the proposals received in response to this solicitation;

make awards without discussions with proposers;

conduct discussions with proposers if it is later determined to be necessary;

segregate portions of resulting awards into pre-priced options;

accept proposals in their entirety or to select only portions of proposals for award;

fund proposals in increments and/or with options for continued work at the end of one or more phases;

request additional documentation once the award instrument has been determined (e.g., representations and certifications); and remove proposers from award consideration should the parties fail to reach agreement on award terms within a reasonable time or the proposer fails to provide requested additional information in a timely manner.

Proposals selected for award negotiation may result in a procurement contract or Other Transaction (OT) depending upon the nature of the work proposed, the required degree of interaction between parties, and other factors.

In all cases, the Government contracting officer shall have sole discretion to select award instrument type and to negotiate all instrument terms and conditions with selectees. Proposers are advised that regardless of the instrument type proposed, DARPA may select other award instruments, as it deems appropriate. DARPA will apply publication or other restrictions, as necessary, if it determines that the research resulting from the proposed effort will present a high likelihood of disclosing performance characteristics of military systems or manufacturing technologies that are unique and critical to defense. Any award resulting from such a determination will include a requirement for DARPA permission before publishing any information or results on the program. For more information on publication restrictions, see the section below on Fundamental Research.

B. Fundamental Research

It is DoD policy that the publication of products of fundamental research will remain unrestricted to the maximum extent possible. National Security Decision Directive (NSDD) 189 established the national policy for controlling the flow of scientific, technical, and engineering information produced in federally funded fundamental research at colleges, universities, and laboratories. The Directive defines fundamental research as follows:

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 12

'Fundamental research' means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons.

As of the date of publication of this BAA, the Government expects that program goals as described herein either cannot be met by proposers intending to perform fundamental research or the proposed research is anticipated to present a high likelihood of disclosing performance characteristics of military systems or manufacturing technologies that are unique and critical to defense. Therefore, the Government anticipates restrictions on the resultant research that will require the contractor to seek DARPA permission before publishing any information or results relative to the program.

Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not. While proposers should clearly explain the intended results of their research, the Government shall have sole discretion to select award instrument type and to negotiate all instrument terms and conditions with selectees. Appropriate clauses will be included in resultant awards for non-fundamental research to prescribe publication requirements and other restrictions, as appropriate.

For certain research projects, it may be possible that although the research being performed by the prime contractor is restricted research, a subawardee may be conducting fundamental research. In those cases, it is the prime contractor’s responsibility to explain in its proposal why its subawardee’s effort is fundamental research.

The following statement or similar provision will be incorporated into any resultant non-fundamental research procurement contract or other transaction:

There shall be no dissemination or publication, except within and between the contractor and any subawardees, of information developed under this contract or contained in the reports to be furnished pursuant to this contract without prior written approval of DARPA’s Public Release Center (DARPA/PRC). All technical reports will be given proper review by appropriate authority to determine which Distribution Statement is to be applied prior to the initial distribution of these reports by the contractor. With regard to subawardee proposals for Fundamental Research, papers resulting from unclassified fundamental research are exempt from prepublication controls and this review requirement, pursuant to DoD Instruction 5230.27 dated October 6, 1987.

When submitting material for written approval for open publication, the contractor/awardee must submit a request for public release to the DARPA/PRC and include the following information: (1) Document Information: document title, document author, short plain-language description of technology discussed in the material (approx.

30 words), number of pages (or minutes of video) and document type (e.g., briefing, report, abstract, article, or paper); (2) Event Information: event type (conference, principal investigator meeting, article or paper), event date, desired date for DARPA's approval; (3) DARPA Sponsor: DARPA Program Manager, DARPA office, and contract number; and (4) Contractor/Awardee's Information: POC name, email and phone. Allow

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 13

four weeks for processing; due dates under four weeks require a justification. Unusual electronic file formats may require additional processing time. Requests may be sent either via email to public_release_center@darpa.mil or by mail at 675 North Randolph Street, Arlington VA 22203-2114, telephone (571) 218-4235. Refer to the following for link for information about DARPA’s public release process: http://www.darpa.mil/work-with-us/contract-management/public-release.”

mailto:public_release_center@darpa.mil

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 14

III. Eligibility Information

A. Eligible Applicants

All responsible sources capable of satisfying the Government's needs may submit a proposal that shall be considered by DARPA.

1. Federally Funded Research and Development Centers (FFRDCs) and Government Entities

Federally Funded Research and Development Centers (FFRDCs) and Government entities (e.g., Government/National laboratories, military educational institutions, etc.) are subject to applicable direct competition limitations and cannot propose to this BAA in any capacity unless they meet the following conditions: (1) FFRDCs must clearly demonstrate that the proposed work is not otherwise available from the private sector; and (2) FFRDCs must provide a letter on official letterhead from their sponsoring organization citing the specific authority establishing their eligibility to propose to Government solicitations and compete with industry, and their compliance with the associated FFRDC sponsor agreement’s terms and conditions. This information is required for FFRDCs proposing to be prime contractors or subawardees. Government entities must clearly demonstrate that the work is not otherwise available from the private sector and provide written documentation citing the specific statutory authority and contractual authority, if relevant, establishing their ability to propose to Government solicitations. At the present time, DARPA does not consider 15 U.S.C. § 3710a to be sufficient legal authority to show eligibility. While 10 U.S.C.§ 2539b may be the appropriate statutory starting point for some entities, specific supporting regulatory guidance, together with evidence of agency approval, will still be required to fully establish eligibility.

DARPA will consider FFRDC and Government entity eligibility submissions on a case-by-case basis; however, the burden to prove eligibility for all team members rests solely with the proposer.

2. Foreign Participation Non-U.S. organizations and/or individuals may participate to the extent that such participants comply with any necessary nondisclosure agreements, security regulations, export control laws, and other governing statutes applicable under the circumstances.

B. Procurement Integrity, Standards of Conduct, Ethical Considerations, and Organizational Conflicts of Interest

Current federal employees are prohibited from participating in particular matters involving conflicting financial, employment, and representational interests (18 U.S.C. §§ 203, 205, and 208). Once the proposals have been received, and prior to the start of proposal evaluations, the Government will assess potential conflicts of interest and will promptly notify the proposer if any appear to exist. The Government assessment does NOT affect, offset, or mitigate the proposer’s responsibility to give full notice and planned mitigation for all potential organizational conflicts, as discussed below.

Without prior approval or a waiver from the DARPA Director, in accordance with FAR 9.503, a contractor cannot simultaneously provide scientific, engineering, technical assistance (SETA) or similar support and also be a technical performer. As part of the proposal submission, all

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 15

members of the proposed team (prime proposers, proposed subawardees, and consultants) must affirm whether they (their organizations and individual team members) are providing SETA or similar support to any DARPA technical office(s) through an active contract or subcontract. All affirmations must state which office(s) the proposer, subawardees, consultant, or individual supports and identify the prime contract number(s). All facts relevant to the existence or potential existence of organizational conflicts of interest (FAR 9.5) must be disclosed. The disclosure must include a description of the action the proposer has taken or proposes to take to avoid, neutralize, or mitigate such conflict. If in the sole opinion of the Government after full consideration of the circumstances, a proposal fails to fully disclose potential conflicts of interest and/or any identified conflict situation cannot be effectively mitigated, the proposal will be rejected without technical evaluation and withdrawn from further consideration for award.

If a prospective proposer believes a conflict of interest exists or may exist (whether organizational or otherwise) or has questions on what constitutes a conflict of interest, the proposer should send his/her contact information and a summary of the potential conflict via email to the BAA email address before time and effort are expended in preparing a proposal and mitigation plan.

C. Cost Sharing/Matching

Cost sharing is not required; however, it will be carefully considered where there is an applicable statutory condition relating to the selected funding instrument (e.g., OTs under the authority of 10 U.S.C. § 2371).

D. Other Eligibility Requirements

Ability to Support Classified Testing and Evaluation

At the time of proposal submission, all proposers wishing to submit proposals under TA2 and TA3 must have some personnel with a Top Secret clearance that are eligible for SCI. It is preferable (but not required) that the Principal Investigator in each TA2 and TA3 proposal be cleared at that level.

Proposers to TA1 are not required to hold or obtain security clearances; however, it is strongly encouraged that TA1 performers have personnel with a Top Secret clearance that are eligible for SCI. It is preferable (but not required) that the Principal Investigator in each TA1 proposal be cleared at that level.

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 16

IV. Application and Submission Information

A. Address to Request Application Package

This document contains all information required to submit a response to this solicitation. No additional forms, kits, or other materials are needed except as referenced herein. No request for proposal (RFP) or additional solicitation regarding this opportunity will be issued, nor is additional information available except as provided at the Federal Business Opportunities website (https://www.fbo.gov), or referenced herein.

B. Content and Form of Application Submission

1. Proposals Proposals consist of Volume 1: Technical and Management Proposal (including mandatory Appendix A, optional Appendix B, and an optional Appendix C) and Volume 2: Cost Proposal.

All pages shall be formatted for printing on 8-1/2 by 11-inch paper with 1-inch margins, single-line spacing, and a font size not smaller than 12 point. Font sizes of 8 or 10 point may be used for figures, tables, and charts. Document files must be in .pdf, .odx, .doc, .docx, .xls, or .xlsx formats. Submissions must be written in English.

Proposals not meeting the format prescribed herein may not be reviewed.

a. Volume 1: Technical and Management Proposal The maximum page count for Volume 1 is 30 pages with a required minimum of 10 technical pages, including all figures, tables and charts but not including the cover sheet, table of contents, references, or appendices. A proposal that contains multiple technical areas may include 10 additional technical pages per technical area. Each technical area submission must be able to stand on its own merit and be evaluated independently. DARPA may select individual components from a proposal, and thus the technical work and cost breakdown must be clearly delineated along TA boundaries within each proposal. A submission letter is optional and is not included in the page count. Appendix A does not count against the page limit and is mandatory.

Appendix B does not count against the page limit and is optional. Additional information not explicitly called for here must not be submitted with the proposal, but may be included in the bibliography in Appendix B. Such materials will be considered for the reviewers’ convenience only and not evaluated as part of the proposal.

Appendix C does count against the page limit, and is optional. Appendix C must arrive at DARPA via appropriate channels by the proposal due date.

Volume 1 must include the following components:

i. Cover Sheet: Include the following information.

Label: “Proposal: Volume 1” BAA number (DARPA-BAA-16-34) Technical area(s): note here whether or not Appendix C is part of the https://www.fbo.gov/

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 17

proposal Proposal title Lead organization (prime contractor) name Type of organization, selected from the following categories: Large Business, Small Disadvantaged Business, Other Small Business, HBCU, MI, Other Educational, or Other Nonprofit

Technical point of contact (POC) including name, mailing address, telephone, and email

Administrative POC including name, mailing address, telephone number, and email address

Award instrument requested: procurement contract (specify type) or OT.1 Total amount of the proposed effort.

Place(s) and period(s) of performance Other team member (subcontractors and consultants) information (for each, include Technical POC name, organization, type of organization, mailing address, telephone number, and email address)

Proposal validity period (minimum 120 days) Data Universal Numbering System (DUNS) number2 Taxpayer identification number3 Commercial and Government Entity (CAGE) code4 Proposer’s reference number (if any)

ii. Table of Contents

iii. Executive Summary: Provide a synopsis of the proposed project, including answers to the following questions:

What is the proposed work attempting to accomplish or do?

How is it done today, and what are the limitations?

Who or what will be affected and what will be the impact if the work is successful?

How much will it cost, and how long will it take?

The executive summary should include a description of the key technical challenges, a concise review of the technologies proposed to overcome these challenges and achieve the project’s goal, and a clear statement of the novelty and uniqueness of the proposed work.

iv. Innovative Claims and Deliverables: Describe the innovative aspects of the project in the context of existing capabilities and approaches, clearly delineating the uniqueness

1 Information on award instruments can be found at http://www.darpa.mil/work-with-us/contract-management.

2 The DUNS number is used as the Government's contractor identification code for all procurement-related activities. Go to http://fedgov.dnb.com/webform/index.jsp to request a DUNS number (may take at least one business day). See Section VI.B.8 for further information.

3 See http://www.irs.gov/businesses/small/international/article/0,,id=96696,00.html for information on requesting a TIN. Note, requests may take from 1 business day to 1 month depending on the method (online, fax, mail).

4 A CAGE Code identifies companies doing or wishing to do business with the Federal Government. See Section VI.B.8 for further information.

http://www.darpa.mil/work-with-us/contract-management http://fedgov.dnb.com/webform/index.jsp http://www.irs.gov/businesses/small/international/article/0,,id=96696,00.html

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 18

and benefits of this project in the context of the state of the art, alternative approaches, and other projects from the past and present. Describe how the proposed project is revolutionary and how it significantly rises above the current state of the art.

Describe the deliverables associated with the proposed project and any plans to commercialize the technology, transition it to a customer, or further the work. Discuss the mitigation of any issues related to sustainment of the technology over its entire lifecycle, assuming the technology transition plan is successful.

v. Technical Plan: Outline and address technical challenges inherent in the approach and possible solutions for overcoming potential problems. Demonstrate a deep understanding of the technical challenges and present a credible (even if risky) plan to achieve the project’s goal. Discuss mitigation of technical risk. Provide appropriate measurable milestones (quantitative if possible) at intermediate stages of the project to demonstrate progress, and a plan for achieving the milestones.

vi. Management Plan: Provide a summary of expertise of the proposed team, including any subcontractors/consultants and key personnel who will be executing the work.

Resumes count against the proposal page limit so proposers may wish to include them in Appendix B. Identify a principal investigator (PI) for the project. Provide a clear description of the team’s organization including an organization chart that includes, as applicable, the relationship of team members; unique capabilities of team members; task responsibilities of team members; teaming strategy among the team members; and key personnel with the amount of effort to be expended by each person during the project.

Provide a detailed plan for coordination including explicit guidelines for interaction among collaborators/subcontractors of the proposed project. Include risk management approaches. Describe any formal teaming agreements that are required to execute this project. List Government-furnished materials or data assumed to be available.

vii. Personnel, Qualifications, and Commitments: List key personnel (no more than one page per person), showing a concise summary of their qualifications, discussion of previous accomplishments, and work in this or closely related research areas. Indicate the level of effort in terms of hours to be expended by each person during each contract phase and other (current and proposed) major sources of support for them and/or commitments of their efforts. DARPA expects all key personnel associated with a proposal to make substantial time commitment to the proposed activity and the proposal will be evaluated accordingly. It is DARPA’s intention to put key personnel conditions into the awards, so proposers should not propose personnel that are not anticipated to execute the award.

Include a table of key individual time commitments as follows:

Hours on Project Key

Individual Project

Status (Current, Pending, Proposed) Phase 1 Phase

2 Phase 3 Enhanced Attribution Proposed x x x

Project Name 1 Current x x n/aName 1 Project Name 2 Pending n/a x x

Name 2 Enhanced Attribution Proposed x x x

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 19

Project Name 3 Proposed x x x

viii. Capabilities: Describe organizational experience in relevant subject area(s), existing intellectual property, or specialized facilities. Discuss any work in closely related research areas and previous accomplishments.

ix. Statement of Work (SOW): The SOW must provide a detailed task breakdown, citing specific tasks and their connection to the interim milestones and metrics, as applicable. If proposing more than one TA, separately identify the tasks per each TA.

Each phase of the project should be separately defined. The SOW must not include proprietary information. For each defined task/subtask, provide:

A general description of the objective.

A detailed description of the approach to be taken to accomplish each defined task/subtask.

Identification of the primary organization responsible for task execution

(prime contractor, subcontractor(s), consultant(s)), by name.

A measurable milestone, (e.g., a deliverable, demonstration, or other event/activity that marks task completion).

A definition of all deliverables (e.g., data, reports, software) to be provided to the Government in support of the proposed tasks/subtasks.

Identify any tasks/subtasks (by the prime or subcontractor) that will be accomplished at a university.

x. Schedule and Milestones: Provide a detailed schedule showing tasks (task name, duration, work breakdown structure element as applicable, performing organization), milestones, and the interrelationships among tasks. The task structure must be consistent with that in the SOW. Measurable milestones should be clearly articulated and defined in time relative to the start of the project.

xi. Level of Effort Summary by Task: Provide a one-page table summarizing estimated level of effort per task (in hours) broken out by senior, mid-level and junior personnel, in the format shown below in Figure 2. If proposing more than one TA, provide a separate table for each TA. Also include dollar-denominated estimates of travel, materials and equipment. For this table, consider materials to include the cost of any data sets or software licenses proposed. For convenience, an Excel template is available for download along with the BAA.

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 20

Duration (months) Senior Mid Junior Total SubC Conslt Total

1.1.0 <Phase 1 Task 1 name> 7 240 680 24 944 - 200 944

1.1.1 <Subtask 1.1.1 name> 4 80 280 - 360 - 200 360

1.1.2 <Subtask 1.1.2 name> 3 160 400 24 584 - - 584

1.2.0 <Phase 1 Task 2 name> 6 108 400 1,800 2,308 1,400 - 3,708

1.2.1 <Subtask 1.2.1 name> 3 48 320 1,600 1,968 600 - 2,568

1.2.2 <Subtask 1.2.2 name> 3 60 80 200 340 800 - 1,140

Phase 1 Total Hours 16 348 1,080 1,824 3,252 1,400 200 4,652 Phase 1 Travel 44,000$ 12,000$ 2,000$ 58,000$

Costs Materials & Equipment 8,000$ -$ -$ 8,000$

2.1.0 <Phase 2 Task 1 name> 8 176 560 64 800 100 100 900

2.1.1 <Subtask 2.1.1 name> 7 96 240 24 360 100 100 460

2.1.2 <Subtask 2.1.2 name> 4 80 320 40 440 - - 440

2.2.0 <Phase 2 Task 2 name> 6 180 520 1,800 2,500 1,240 - 3,740

2.2.1 <Subtask 2.2.1 name> 4 140 400 1,200 1,740 400 - 2,140

2.2.2 <Subtask 2.2.2 name> 4 40 120 600 760 840 - 1,600

Phase 2 Total Hours 16 356 1,080 1,864 3,300 1,340 100 4,640 Phase 2 Travel 48,000$ 13,000$ 2,400$ 63,400$

Costs Materials & Equipment -$ -$ -$ -$

3.1.0 <Phase 3 Task 1 name> 9 120 400 120 640 100 100 740

3.1.1 <Subtask 3.1.1 name> 3 40 200 40 280 100 100 380

3.1.2 <Subtask 3.1.2 name> 6 80 200 80 360 - - 360

3.2.0 <Phase 3 Task 2 name> 6 160 800 1,800 2,760 1,200 - 3,960

3.2.1 <Subtask 3.2.1 name> 4 80 400 1,000 1,480 600 - 2,080

3.2.2 <Subtask 3.2.2 name> 3 80 400 800 1,280 600 - 1,880

Phase 3 Total Hours 16 280 1,200 1,920 3,400 1,300 100 4,700 Phase 3 Travel 49,000$ 12,000$ 2,000$ 63,000$

Costs Materials & Equipment -$ -$ -$ -$ Project Total Hours 48 984 3,360 5,608 9,952 4,040 400 13,992

Project Travel 141,000$ 37,000$ 6,400$ 184,400$ Costs Materials & Equipment 8,000$ -$ -$ 8,000$

SOW Task Labor Hours

Figure 1: Example level-of-effort summary table. Numbers illustrate roll-ups and subtotals. The SubC column captures all subcontractor hours and the Conslt column captures all consultant hours.

xii. Appendix A: This section is mandatory and must include all of the following components. If a particular subsection is not applicable, state “NONE”.

(1). Team Member Identification: Provide a list of all team members including the prime, subcontractor(s), and consultant(s), as applicable. Identify specifically whether any are a non-US organization or individual, FFRDC and/or Government entity. Use the following format for this list:

Individual Name

Role (Prime, Organization Non-US? FFRDC or

DARPA-BAA-16-34 ENHANCED ATTRIBUTION 21

Subcontractor or Consultant) Org Ind. Govt?

(2). Government or FFRDC Team Member Proof of Eligibility to Propose: If none of the team member organizations (prime or subcontractor) are a Government entity or FFRDC, state “NONE”.

If any of the team member organizations are a Government entity or FFRDC, provide documentation (per Section III.A.1) citing the specific authority that establishes the applicable team member’s…