SOO_06 Sep 2024.pdf

Statement of Objectives (SOO)_06 Sep 2024 Publicly Available Electronic Information (PAEI)

I. Background & Purpose:

In 2023, Defense Counterintelligence and Security Agency (DCSA) Background Investigation (BI) established a Publicly Available Electronic Information (PAEI) branch which was designated to integrate PAEI as a data source within the background investigation and support the research needed for the implementation of PAEI. The pilot and research studies began in 2016 to begin understanding how PAEI could be a benefit to BI and furthermore how it would fit into the BI process. Research between 2016 and 2024 supports that there have been several indicators of violence that ahead of time are almost foreshadowed online.

The Federal Vetting Personnel Investigative Standards, Trusted Workforce 2.0 (TW 2.0) is going to establish PAEI searches as an official data source. Throughout FY23 and FY24, DCSA conducted targeted studies to determine where PAEI is the most suitable within the BI line of products. To further PAEI research, the DCSA PAEI team may conduct PAEI searches on Tiers 2-5 (inclusive of reinvestigations).

To meet DCSA’s established implementation timelines, in FY25 DCSA will pursue a risk-based implementation strategy that will focus on investigations with known indicators and high risk/threat populations. DSCA will pursue PAEI implementation in tandem with TW 2.0. TW 2.0 standards require a PAEI check at the moderate and high tier investigation levels.

DCSA is looking to procure a web-based platform/tool that accesses public data from across the internet and compiles reports and data from PAEI (i.e. social media, public records, web articles, and more). DCSA requires, either through licenses or an automated delivery service accounted by number of records, the ability to search for and receive data from PAEI sources to enhance the BI analysts decision in their ability to determine trustworthiness of the subject of investigation.

These search capabilities must be automated, scalable, have modifiable query capabilities to refine search criteria based on requirements, and provide information to include but not limited to, videos, images, original posts, shared posts, comments on threads or postings, and actions such as “likes” or other demonstrated action toward something which has been posted and is publicly available to view.

II. Period and Place of Performance:

a. Base Period of Performance (PoP) consists of one (1) 12-month period, followed by four (4) 12-month option PoPs.

b. All performance is expected to take place at the vendor’s facility. Delivery of reports/results will be arranged as described in Section III Performance Objectives and Minimum Requirements and Section IV Deliverables of the SOO.

III. Performance Objectives & Minimum Requirements:

a. Each PoP allows for a maximum of 3,000 PAEI searches. Any remaining quantities (of that 3,000) at the end of each PoP will be deobligated back to the Government.

Vendor will only invoice for the number of PAEI requests actually sent during that invoicing period.

b. Require platform, application, and method for FIRE analysts to receive PAEI on subjects of investigation, population is to be determined.

c. Platform must include the ability to modify query fields.

d. Delivery of results/reports shall include posts, videos, images, comments, responses, actions, and more on a wide range of PAEI.

e. Vendor shall never create dummy profiles, false personas, or other mechanisms to obtain information not publicly available.

f. Must provide web-based access and have no additional hardware or software to install and/or will not connect to any DCSA system.

g. Product must be fully functional and be commercial off the shelf (COTS) capability.

h. Vendor, partner, and sub-contractor (as applicable) must be entirely US owned -OR- FOCI mitigated.

i. Vendor’s ability to ingest requests must be available no later than one (1) day after award is made.

j. Must provide ability to conduct audits of queries conducted by each user.

k. Able to scrape social media and bespoke websites on demand, extract rich domain and IP information with historical data, and use facial verification to confirm 1-to-1 image association in near real time.

l. Able to curate multi-lingual PAEI data, with automated translation functions for a variety of different languages.

m. Able to quickly prioritize concerning content for review and alert analysts in a clear way.

n. Provide quote detection, risk detection, similarity detection, and in-image text detection that will pivot and build reports based on emotions and sentiment based on anticipated risks.

o. Able to curate data from multiple PAEI data sources:

1. Foreign and domestic social media platforms, foreign and domestic news publications, public arrest and court records, and deep/dark web sources.

p. Enable users to read the English language within a web-based platform as well as translate conversations and chat messages into English. Users should be able to view original language content and translated content side-by-side.

q. All data is assumed to be highly sensitive, including the raw/derived data, the multimedia, and the collection and analytic configuration. Online persona details are assumed to be highly sensitive and have additional security controls applied.

Therefore, additional security measure must be adhered to protect data and users.

r. All data and online personal details (name, email, and passwords) must be stored with encryption to protect user data.

s. All links being accessed under this requirement, by vendor or DCSA, must be anonymized.

t. Users should be able to obtain PAEI reports which can then be paired down to relevant information.

u. Able to to query behavioral flags which are aligned with the DCSA adjudicative guidelines and issue criteria.

v. Users must be able to review the factors contributable to the associated confidence percentage for each reported finding.

w. Ability for all DCSA users to have access to search history among all other DCSA users.

x. Platform must purge queries or reports IAW official retention criteria.

y. Platform will not to be used for Continuous Vetting nor Continuous Evaluation efforts or monitoring.

z. Vendor must be compliant with all laws, regulations, and policies governing the collection and assessment of PAEI (e.g., Security Executive Agent Directive (SEAD) 4, SEAD-5 guidelines, etc.).

IV. Deliverables:

a. Call or online support services:

1. Available Monday through Friday 0800 through 1700 EST

2. Ability to download a log of the support provided within (1) business day to include at minimum, the following:

a. Date of call or online service

b. Ticket number

c. Summary of issues and mitigations

d. Name of Representative

b. Software updates, fixes, releases, upgrades, security alerts, and critical patch updates

1. Able to provide proof of updates, fixes, releases, upgrades, security alerts, and critical patch updates as applicable via email or online portal in the vendor’s chosen format.

c. Training:

1. Provide training and reference material to DCSA regarding set-up, functionality, and use of the tool or technical capability.

2. Provide training to DCSA concerning updates or changes to the tool or technical capability in order to allow users to maintain their technical proficiency.

3. Provide training on an ad hoc basis within 48-hours of Government request.

d. Travel

1. Expenses for travel and other direct costs shall be covered by the vendor and will not be covered by DCSA.

e. Proof of active maintenance subscriptions:

1. Vendor will provide licenses or user accounts for initial set up and throughout any subsequent staffing changes.

2. Vendor will process any changes due to departures or changes of duty for existing accounts within 48-hours of notification.

3. Vendor shall provide proof of active subscriptions via email to the delegated

DCSA Contracting Officer’s Representative (COR) (name to be provided) with the applicable PoP not later than 48-hours following award.

f. Reporting

1. Vendor will deliver PAEI data result and reports based upon DCSA scheduling, queries, and requests.

2. Vendor will promptly deliver all results beginning on the date of the contract performance and throughout the contract life cycle.

3. Monthly invoice must include detailed list of all queries and results provided to DCSA.

4. Platform must include the ability for DCSA users to run ad-hoc reports to capture volume, results, and report driven criteria.

V. Section 508 Compliance:

Information and Communication Technology (ICT) Accessibility Requirements Statement per the Revised Section 508 of the Rehabilitation Act:

ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards. Section 508 requires access to ICT developed, procured, maintained, or used by federal agencies. Examples include computers, telecommunications equipment, multifunction office machines such as copiers that also operate as printers, software, websites, information kiosks and transaction machines, and electronic documents.

The Section 508 Standards, which are part of the Federal Acquisition Regulation, ensure access for people with physical, sensory, or cognitive disabilities.

Vendor shall ensure maintenance upgrades, substitutions, and replacements to software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 Standards at the time of contract award.

Exceptions:

1. E202.2 Legacy ICT - Any component or portion of existing ICT that complies with an earlier standard issued pursuant to Section 508 of the Rehabilitation Act of 1973, as amended (as republished in Appendix D), and that has not been altered on or after January 18, 2018, shall not be required to be modified to conform to the Revised 508 Standards.

2. E202.3 National Security -The Revised 508 Standards do not apply to ICT operated by agencies as part of a national security system, as defined by 40 U.S.C. 1103(a).

VI. Security:

All personnel performing under this order that will come in contact with, or have access to personally identifiable information (PII), must be U.S. Persons and have record of a U.S.

Citizenship verification or be accepted under the FOCI mitigation. Outside of the FOCI mitigation, there is no required level of investigation, but rather U.S. Citizenship verification. Any changes to the eligibility/clearance requirement or investigation requirement will be detailed in the orders. All PII must be handled in accordance with the Privacy Act of 1974.

a. All programs and materials developed at government expense during the performance period of this contract are the property of the U.S. Government.

b. Access to General Protection/Security Policies and Procedures. All Contractor employees, including subcontractor employees stationed or assigned on a U.S. Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the U.S. Government security personnel). The Contractor workforce shall comply with all personal identification verification requirements as directed by DCSA and/or local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Conditions (FPCON) at any individual facility or installation change, the U.S. Government may require changes in the Contractor security processes or procedures.

c. Contractor will not have access to U.S. Government Information Technology (IT);

however, the Contractor and DCSA will exchange PII records.

d. Contractor personnel shall utilize official company e-mail for transmitting official U.S.

Government business. Official U.S. Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, AOL, COMCAST, KNOLOGY, VERIZON, etc.

e. Physical Security. The Contractor shall be responsible for safeguarding all U.S.

Government equipment, information, and property provided for Contractor use.

f. FOCI mitigation. A company is considered to be operating under FOCI whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may adversely affect the performance of classified contracts.

Please refer to the following DCSA site for FOCI mitigation specifics:

https://www.dcsa.mil/Industrial-Security/Entity-Vetting-Facility-Clearances-FOCI/Foreign- Ownership-Control-or-Influence/

The following factors relating to a company, the foreign interest, and the government of the foreign interest are reviewed in the aggregate in determining whether a company is under FOCI:

1. Record of economic and government espionage against U.S. targets.

2. Record of enforcement and/or engagement in unauthorized technology transfer.

3. Record of compliance with pertinent U.S. laws, regulations, and contracts.

4. The type and sensitivity of the information that will be accessed.

5. The source, nature, and extent of FOCI, including, but not limited to, whether a foreign interest holds a majority or substantial minority position in the company, taking into consideration the immediate, intermediate, and ultimate parent companies of the company or prior relationships between the U.S. company and the foreign interest.

6. The nature of any relevant bilateral and multilateral security and information exchange agreements, (e.g., the political and military relationship between the USG and the government of the foreign interest).

7. Ownership or control, in whole or in part, by a foreign government.

8. Any other factor that indicates or demonstrates a capability on the part of foreign interests to control or influence the operations or management of the business organization concerned.

g. General network information. The Contractor shall:

1. Be able to process Controlled Unclassified Information (CUI) in accordance with

NIST Special Publication (SP) 800-171; and,

2. Provide Cyber Security submissions and general network information to the delegated COR within 30 calendar days after award.

VII. Government-Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI):

No GFP, GFM, GFE, or GFI will be provided.

VIII. Payment Schedule:

a. Payments will occur IAW Net 30-day payment terms, upon receipt and acceptance of a proper invoice, IAW the following schedule:

1. 100% after receipt and acceptance by the Government and in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 232.206(f) Solicitation provisions and contract clauses.

2. Invoices shall be submitted in accordance with DFARS 252.232-7006 Wide Area Workflow Payment Instructions.

3. Partial shipments and partial invoices will not be accepted, unless otherwise requested and accepted by the Contracting Officer (KO) prior to award. Any revisions to this payment approach will need to be in writing and approved by the requirements KO.