DRAFT_Statement of Work_NDCAC CIP Engineering Program.pdf

Last updated Feb 14, 2025, 06:44 PM UTC

UNCLASSIFIED

UNCLASSIFIED

FEDERAL BUREAU OF INVESTIGATION

NDCAC CIP Engineering Program

Requisition Number: SHOP-PR-25-000552

Division(s): Operational Technology Division

Statement of Work

Background

A background statement defines the historical circumstances which led to the conception of the requirement described in this document.

The Federal Bureau of Investigation’s background statement is detailed below.

Background Statement

The FBI’s mission is to protect and defend the United States against terrorist and foreign intelligence threats, to uphold and enforce the criminal laws of the United States, and to provide leadership and criminal justice services to federal, state, municipal, and international agencies and partners; and to perform these responsibilities in a manner that is responsive to the needs of the public and is faithful to the Constitution of the United States.

The Communications Assistance for Law Enforcement Act (CALEA) was enacted to ensure that after law enforcement (LE) obtains the appropriate legal authority, telecommunications carriers have the necessary capability to assist LE regardless of their specific telecommunications technology or service. The Attorney General delegated the authority for CALEA to the Federal Bureau of Investigations (FBI). The FBI’s responsibility for CALEA rests within the NDCAC/CIP.

Section 103 of CALEA sets forth the technical assistance capability requirements that telecommunications carriers need to support LE’s ability to conduct lawfully authorized electronic surveillance (ELSUR). CALEA directs the telecommunications industry to design, develop, deploy, and maintain solutions that meet certain assistance capability requirements. Specifically, carriers must be able to: (1) expeditiously isolate all wire and electronic telecommunications of a target transmitted by the carrier within its service area; (2) expeditiously isolate call-identifying information of a target; (3) provide intercepted telecommunications and call-identifying information to LE; and (4) carry out intercepts unobtrusively, so targets are not made aware of the ELSUR, and in a manner that does not compromise the privacy and security of other communications. CALEA contains various other provisions that require technical subject matter expertise with a multi-disciplinary focus on program management;

characterization of LE’s ELSUR needs; contributions to industry’s technical standards organizations; verification that industry-developed technical solutions meet the requirements of publicly available standards; research of emerging services and technologies with the potential to impact LE’s conduct of ELSUR; fiscal resource planning; and legislative and regulatory policy planning, development, and implementation.

LE is increasingly unable to access, intercept, collect and process wire or electronic communications and stored communications information to which they are lawfully authorized. In order to attempt to lessen the capability gap, the FBI and the LE community have developed a National ELSUR Strategy commonly known as “Lawful Access.”

Lawful Access affects all LE agencies. There was no centralized point of contact to provide coordinated technical assistance; no way to leverage research and development efforts between agencies; and no seamless mechanism to make solutions available to the LE community. To assist in mitigating the effects of the Lawful Access problem on LE, the FBI worked with the Department of Justice (DOJ) (to include DOJ component agencies) and representatives of state and local law enforcement agencies from across the U.S. to develop a strategy to make existing and emerging technical capabilities more widely available across the law enforcement community. A central component of this strategy was the establishment of the NDCAC by the DOJ. The NDCAC leverages the research and development efforts of local, state and federal law enforcement with respect to technical capabilities, facilitates the sharing of technology between law enforcement agencies, and seeks to build more effective relations with the communications industry.

The mission of NDCAC focuses broadly on challenges with lawfully authorized electronic surveillance, evidence collection from communications services and devices, and technical location capabilities. Specifically, the NDCAC coordinates Federal, State, local, and tribal law enforcement efforts to address those challenges; leverages and exchanges technical information and support

DRAFT

UNCLASSIFIED

tools among law enforcement agencies; provides technical expertise, training, and advanced capabilities to aid in agencies’ collection of communications evidence for criminal investigations; assists in the development of consistent, uniform practices and processes regarding lawful requests for service provider information; facilitates relationships between law enforcement and the communications industry to include leveraging existing relationships and developing new private/public partnerships; and identifies and tracks trends and developments with existing and emerging communications services and technologies.

Scope

A scope provides a broad description of the intended use of the services and/or products to be acquired in relation to the requirement described in the document.

The Federal Bureau of Investigation’s scope is detailed below.

Contract Type

Firm Fixed Price

Scope Statement

The OPERATIONAL TECHNOLOGY DIVISION Division(s) of the The Federal Bureau of Investigation require(s) the following products/services:

Science & Technology Consulting

In support of program management support, engineering services, technical support, general technical and programmatic analysis and strategic development support, stakeholder engagement, website content support, testing and analysis, marketing, and logistical/planning services for the NDCAC/CIP effort. It is the intent of the Government to incrementally fund this contract. All surge positions shall be priced separately.

Objectives

Each objective describes a desired outcome to be achieved during the contract lifecycle.

Corresponding tasks, each which describe what work should be performed in order to achieve the referenced objective(s), are listed accordingly.

The Federal Bureau of Investigation’s objectives are listed below.

Objective 1

NDCAC/CIP has a requirement to support its mission with a variety of specialized experts to support programmatic, technical, operational, legislative, testing, and regulatory initiatives. The Contractor shall have a reach back capability and provide personnel with experience in ELSUR in a law enforcement environment, experience with CALEA implementation; and challenges and techniques associated with communications services in support of criminal investigations at the time of award. The objectives of this effort include:

Providing technical support through the formulation of LE or ELSUR or related evidence gathering requirements (e.g., standards participation) as they apply to communications systems and services within and outside the scope of CALEA applicabilityVerification that industry-developed technical solutions meet the operational needs of LE and requirements of publicly available standards (or in the alternative meet the assistance capability requirements of Section 103 of CALEA) and other lawful intercept capabilities.Research of emerging communications services and technologies, assessment of their respective impact on law enforcement’s ability to gather evidence and conduct ELSUR, and development of solution strategies to mitigate any

UNCLASSIFIED

Task 2

Task 1 identified impact;Program management and legislative and regulatory assessments;Contributions to both CALEA and Lawful Intercept implementation, and NDCAC policy development, oversight, and execution; intra-government business, operational support, and provision of decision-making support services;Internal and external briefing assistance and special report generation;Contributions to content development of the NDCAC Internet and intranet websites;Lawful Access support services;

Augmentation of the NDCAC Technical Resource Group (TRG) in limited situations where the call volume exceeds the capability of the Call Center;Administration of tests to ensure effective ELSUR capabilities and technical solutions exist among the law enforcement community;Tests of solutions developed for use by communication service providers (CSPs) to identify the deficiencies and capabilities of these CALEA and other Lawful Intercept solutions;Testing of CSPs developed and/or implemented strategic and ad-hoc intercept solutions for services;Analysis and evaluation of smart phone and Operating System (OS) applications, Internet of Things (IoT) devices, infotainment systems and any other services or products that fall within the mission of the NDCAC to familiarize and inform LE on their functionality; andAssistance to NDCAC/CIP Government personnel in support of all NDCAC program and in their interactions with CSPs.

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The NDCAC has a requirement to provide program support across multiple functional areas and task requirements for the NDCAC management. Responsibilities include the below tasks: - Provide technical and other support, as requested by NDCAC /CIP in the development and execution of comprehensive CALEA implementation strategies. The support shall be based on consideration of all pertinent implementation factors, to include, but not be limited to: the legal and technical aspects of the legislation; the implementation responsibilities assigned to the FBI by the Attorney General; divergent interests of effected stakeholders; the concerns of privacy advocates; the delegated implementation responsibilities; the operational realities faced by the LE community; the actions of other government agencies; and specific telecommunications technologies, both existing and emerging, of priority importance to the LE community. Provide program-level support services in the form of budget evaluation, analyses, and data calls.

Assist in the development of project plans and schedules for NDCAC/CIP projects as directed by NDCAC/CIP and compile and review internal and external project reports required by NDCAC/CIP. This includes, but is not limited to, data collection and compilation; analysis of project inter-dependencies; overall risk analysis; development of project timetables and resource implications; and management of individual tasks within the project schedule.Report to NDCAC/CIP the status of each project and how it is furthering the program’s initiatives. In addition, the Contractor shall identify areas that may need to be re-evaluated and perhaps moved up or down the timeline as events warrant.Be conversant with and prepared to contribute to the Committee on Foreign Investment in the United States (CFIUS) and be responsible for drafting appropriate affidavits and documents describing the internal technological aspects of the communications industry, technical standards processes, effects of CALEA requirements on communications infrastructure, or any other topic deemed necessary by CIP.Develop white papers, presentations, and/or other briefing material necessary to assist in the progression of NDCAC/CIP programs, policies, and strategic efforts.Provide and draft appropriate documents describing internal technological aspects of the communications industry, technical standards processes, and effects of NDCAC requirements on communications infrastructure.Manage mission critical tasks across multiple functional areas.Provide program support services in the form of analyses, submissions and associated programmatic justifications.Participate in the NDCAC Working Groups and LE Forums interacting with senior management and providing analysis and reports of meetings and discussions.Assist NDCAC, DOJ, Office of General Counsel (OGC), and Office of Congressional Affairs (OCA) through the development of white papers technical review and presentations to address questions and concerns of Congress as they relate to the functions of the NDCAC and CALEA.Provide expert technical advice and recommendations to NDCAC Director for specific technical direction.Access control for the facility.Coordination of travel and administration associated with NDCAC classes and conferences.

The contractor shall provide TASK A1 – Legal and Regulatory Support

Apart from its technical core, CALEA is legislation that establishes a regulatory regime for both LE and the communications industry. The FCC has interacted with the FBI regarding such CALEA-related issues as the Government’s petition of deficiency claiming an industry technical standard did not meet CALEA’s capability requirements and its definition of “telecommunications carrier” under CALEA section 102. As part of its holistic support, the Contractor shall provide documentation and presentation of information on technical issues and developments that impact CIP’s legal and regulatory efforts:

Provide documentation of published standards’ deficiencies to CIP and work in tandem with the FBI’s OGC to foster its understanding of the technical and legal implications of capabilities that shall be absent from an industry specification.Provide appropriate analyses of critical technical issues that may not have been addressed under current NDCAC/CIP legal policy.

Develop technical materials to educate the NDCAC/CIP legal and policy staff or others within the FBI, DOJ, or FCC of new technologies or services and their respective implications on ELSUR.Assist NDCAC/CIP, OGC, and the OCA DOJ through the

UNCLASSIFIED

Task 4

Task 3 development of white papers technical review, presentations, and other written material to address questions and concerns of Congress as they relate to the continuing implementation of CALEA and/or any legislative effort designed to lessen LE’s capability gap.

The contractor shall provide TASK B – Lawful Access Support Services

The above-mentioned SMEs, Analysts, and Paralegal from Tasks A shall also provide support for Lawful Access by working closely with NDCAC/CIP management and project leaders to provide recommendations for specific courses of action. The Contractor shall be conversant with and prepared to contribute to Lawful Access efforts including, but not limited to FBI executives, the DOJ Interagency Working Groups; National Security Council’s Deputies Committee, Executive Offices of the President, and other aspects of the National ELSUR Strategy.

Examples of tasks associated with Lawful Access are:

Provide legal and technical recommendations on the technical aspects as it relates to LE’s continued ability to obtain lawful access on communications services.

Develop white papers, presentations, press releases and/or other briefing and written material necessary to assist in the progression of Lawful Access and related strategic efforts.Assist Lawful Access efforts through research and documentation of emerging services and technologies that may adversely impact LE’s ability to conduct ELSUR and gather case examples and strategies that demonstrate the impact of increasing challenges to Lawful Access.Assist in the development of policies regarding operational technology and evidence collection practices.Provide research on regulatory changes and challenges, court rulings, and pending or completed legislative action.Assist OGC in its legal representation before the Congress, courts and regulatory bodies that support the NDCAC, CALEA Implementation and/or the Lawful Access Program.

The contractor shall provide Task C - Stakeholder Engagement

Communication between NDCAC/CIP and the LE community is imperative to provide awareness of the benefits NDCAC provides to LE; develop requirements towards the NDCAC mission; and present and gather feedback on CIP’s position regarding CALEA implementation. The implementation of CALEA is a lengthy, protracted effort that requires extensive interaction to facilitate information exchange and cooperation among Federal, state, and local LE.

The Government anticipates the Contractor shall provide one (1) Liaison Specialist and one (1) Advertising/Marketing Program Analyst along with all labor categories assigned to Task A to support this task. The Contractor shall provide similar support across this task as defined in the SOW.

The Contractor shall provide LE collaboration support services through the dissemination of information affecting the implementation of CALEA through the preparation of informational input documents made available to LE community stakeholders of CALEA implementation. The dissemination of information shall also take the form of white papers, briefings, press releases, information for CALEA/NDCAC websites and responses to questions submitted by LE. The Contractor shall assist in the coordination of LE partnership through the outreach and training of LE personnel. Outreach will consist of communicating the mission of the NDCAC with new and existing partners in the LE community and industry leaders that assist with services to the LE community. Training will consist of training members of the LE community through courses offered by the

NDCAC.

Schedule, attend, participate in and document outreach meetings and events and establish a two-way dialogue. Coordinate with other NDCAC programs based on points of discussion with topics to include, but not limited to: development of requirements for tools and techniques, evaluation of law enforcement portals, coordination of collaborative training/education for both law enforcement and service providers, lawful compliance processes and procedures and mutual expectations; utilization of the NDCAC as a conduit for provider information, best practices, and templates for legal process.

Present NDCAC SMEs as viable resources for Industry and provide forums for the ongoing exchange of information on new services, technologies, statutory requirements and other issues.Provide information on existing and emerging services and technologies as a result of research of public source documentation; discussions with service providers and manufacturers of communications equipment; attendance and participation at industry sponsored conferences and seminars; and collaboration with LE entities.

The Contractor shall provide administrative and logistical planning and support towards the preparation and execution of the LE Technical Forum (LETF) and the Lawful Access and Emerging Technologies Intergovernmental Committee (LAETIC) or any other NDCAC/CIP established LE group.The contractor shall produce and design marketing materials aimed at increasing awareness of the NDCAC among U.S. law enforcement agencies, associations, and relevant industry providers.The contractor shall actively promote NDCAC’s tools and resources to U.S. law enforcement agencies through targeted communications, UNCLASSIFIED

Task 5 including but not limited to emails, pamphlets, and brochures.The contractor shall provide responsive customer service by handling inquiries from law enforcement agencies regarding information about industry providers, ensuring timely and accurate responses.The contractor shall assist in liaison activities between NDCAC and industry providers, facilitating communication, collaboration, and information sharing that supports law enforcement.

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

CALEA Section 107(a)(1) requires the Attorney General, in coordination with other Federal, State, and local LE agencies, to consult with appropriate industry organizations to ensure the efficient and industry-wide implementation of the capability requirements. These responsibilities have been delegated to CIP. Standards development is a multi-year endeavor that can span several industry organizations and involve multiple domestic and international LE agencies as well as individual industry participants. CIP simultaneously plays a large role in the industry’s adoption of technical standards as well as the education of the industry with respect to LE’s technical ELSUR needs and statutory constraints. In order to meet their 107(a)(1) obligations and assure the effective implementation of LE’s needs, CIP’s technical standards support services include planning, strategizing, updating, briefing, reporting, and providing analyses of CALEA standards, ELSUR, and Lawful Intercept activities as it moves through various stages of implementation.

The Government anticipates the Contractor shall provide three (3) Standards Engineers and three (3) Telecommunications[BAF ((1] Engineer to support this task. The Government reserves the right to reduce or add three (3) Standards Engineers and two

(2) Junior Telecommunication Engineers either later in the base year or any of the option years as the work increases within the CIP based on this SOW. All surge positions shall be priced separately.

The contractor shall develop and attend domestic and international standards-based meetings which includes carrier-specific meetings. Contractor shall also participate in conference calls to provide technical expertise and recommendations regarding the development and submission of technical contributions for the program. In furtherance of CIP's Lawful Intercept technical standards support services, the Contractor shall:

Develop a detailed strategy, in coordination with NDCAC/CIP, for the dissemination and implementation of CALEA and Lawful Intercept capability requirements by assessing organizational structure, industry and LE participants, maturity of the technology, and other relevant factors for each standards group in which CIP is engaged.

Formulate service-specific needs documents for the set of critical services identified by CIP (such as Lawful Intercept needs for 5G communication services). The documentation of LE's ELSUR needs shall be obtained from: formal and informal discussions with the LE community; NDCAC/CIP's legal and policy staff, the NDCAC, Data Intercept Technology Unit (DITU), Telecommunications Intercept & Collection Technology Unit (TICTU), OGC, other Federal, State, and local LE agencies and other groups identified. The Contractor shall develop an outline for the service-specific needs documents and be the primary contributor and editor in the development of text for the service-specific needs documents. After having gained the concurrence of CIP, documents developed by the Contractor shall serve as the technical position of LE's needs for surveillance of the particular service, Utilize various communication methods to disseminate information about CIP's approach to technologies and services relevant to LE's assistance capability requirements. Entities to be communicated with include, but are not limited to, other Government agencies, standards-setting organizations, service providers, suppliers and equipment manufacturers, the LE community, and industry groups.

Work with international LE partners to identify opportunities to leverage existing interception solutions to address CALEA capability requirements and other identified LE requirements. In addition, the Contractor shall identify areas where working with the international LE community will further NDCAC/CIP's mission and objectives, Consult with other units within the FBI and other law enforcement agencies which have operational experience with conducting lawfully authorized ELSUR, as directed by CIP, to assure that industry's implementation of CALEA and other lawfully authorized ELSUR solutions will facilitate their mission and objectives. Issues identified during these exchanges shall be analyzed and presented to CIP for consideration. The Contractor shall provide recommendations which mitigate the operational impact to the law enforcement community.

Represent LE in several national and international industry/standards groups that address interception capabilities for packet telecommunications services. The list of standards group the contractor shall participate in includes, but is not limited to: Packet Cable, Internet Engineering Task Force (IETF), Telecommunications Industry Association (TIA), American National Standards Institute (ANSI), Committee T1, Third Generation Partner Project (3GPP), the Wireless Internet Service Provider Association (WISPA), the Open Mobile Alliance (OMA), Alliance for Telecommunication Industry Standards (ATIS), and the European Telecommunications Standards Institute (ETSI).

Monitor industry activities and developments and recommend potential additional standards organizations that should be incorporated into NDCAC/CIP's standards development strategy.

Develop presentations, at CIP's direction, which profile the organization and identify the benefits of CIP participation.

Produce technical contributions and meeting reports that address CALEA's assistance capability requirements or other related LE requirements defined in standards developed by the industry.

Assess the validity and accuracy of industry conclusions, recommendations, and reports through an established review

UNCLASSIFIED

Task 7

Task 6 process.

Provide semi-annual interim status reports for all standards in which CIP is engaged. These summary reports should include an identification of the state of the standard (e.g., definition of scope and structure, content development, draft, ballot), identification of significant outstanding issues, and an estimated completion date.

Evaluate and provide an assessment report for packet surveillance standards that have been published by industry standards groups; and assist the OGC in formulating deficiency petitions to be filed before the FCC.

Through involvement in several standards setting organizations, provide NDCAC/CIP with information on emerging services and/or technologies that may be a threat to LE's ability to conduct lawfully authorized ELSUR, collect evidence from communication devices and services, and determine location With input and direction from NDCAC/CIP, identify critical services that require a more detailed assessment and develop presentations that consist of ad-hoc material requested on short notice or planned several weeks in advance.

Coordinate with other NDCAC Programs by identifying potential areas of NDCAC interest, recommending specifications, and sharing expertise, industry contacts, and relevant documents.

Develop LE requirements for applicable criminal investigative techniques Provide subject matter expertise to Government personnel in their interaction with Industry.

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

This task shall deliver valuable information to law enforcement by creating relevant content and robust, intuitive and engaging user experiences for NDCAC clients on the secure website. Examples of tasks associated with Advanced Communication Technologies are:

Create periodic publications highlighting emerging technologies research in telecommunications and related analysis regarding the impacts on law enforcement.Create a prioritization process to manage content development and maintenance. Contractor shall work with the Government to identify and monitor prioritization criteria. Generate quarterly reporting on the related content progress resulting from the prioritization analysis.Create content for NDCAC usage and the NDCAC secure website based on research analysis, and Industry coordination in various forms of documentation to include but not limited to whitepapers, website content, pamphlets, brochures, job aids, and responses to questions submitted by LE.Evaluate, recommend, and develop user requirements for robust and intuitive user experiences that engage clients and help them navigate the information on the NDCAC secure website. Work in conjunction with the NDCAC Website Team to implement user experiences based on Government approval.Compile a list of relevant topics for Content Development to include criminal investigative techniques, communications technology and services, and impacts to law enforcement.

The Government anticipates the Contractor shall provide one (1) SME, one (1) Telecommunications Engineer, and two (2) Technical Writers to support this task with an option to add one (1) Content Development Analyst, two (2) Telecommunications Engineers, and two (2) Technical Writers as the work increases based on the SOW either later in the base year or in any of the option years of the contract. The surge positions shall be priced separately.

The SME shall oversee a multi-faceted program area to include:

Development of strategic integrated telecommunications subject matter product and service strategy.Support to the NDCAC by sustaining successful cross-team management structure capable of providing a range of subject matter support services.Meet regularly with government program managers to discuss performance, propose initiatives, and establish priorities.Lead strategic planning and communication initiatives in specified program area.Perform the functions of a technical expert in the relevant scientific field in support of major programs or system development.Apply expertise in defining and resolving telecommunications issues, performing analysis, and developing plans and requirements in the subject-matter area.Coordinate and manages the preparation of analysis, evaluations, and recommendations. Collaboration with law enforcement personnel.

This program shall require consultation with NDCAC management at each stage of development.

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

There exist a number of manufacturer-developed intercept solutions for which the NDCAC/CIP have not gained access, had the opportunity to review, nor tested. When un-reviewed or un-tested technical intercept solutions are introduced, they have the potential to have a substantial negative impact on LE when this information remains unknown until interception orders are used in the course of an investigation. Also, service providers have developed or are developing robust, interactive internet portals and services, through-which law enforcement must access, to submit legal process. The NDCAC may also develop, in conjunction with service providers, non-CALEA based capabilities, in support of LE legal process. A more proactive SolVer Testing Program is needed to identify the deficiencies and capabilities of these CALEA solutions and internet portals/services before they have a negative impact on LE’s ability to perform ELSUR. [P(1] The Contractor shall develop action plans to address the future capabilities of the SolVer Testing Program.

UNCLASSIFIED

Task 8

The Government anticipates that this Contract shall require the use of one (1) Testing Analyst, two (2) Network Engineers, one

(1) Software Engineer, and one (1) Senior Systems Engineer to support this task. The Government reserves the right to reduce and/or add two (2) Systems Engineers and two (2) Network Engineers and two (2) Testing[M(2] Analysts either during the base year or option years as the work increases based on the SOW. The surge positions shall be priced separately. The Senior Systems Engineer shall be designated as the Team Lead on this task.

The Contractor shall provide services in the general SolVer Testing process which involves the following:

Research manufacturer specific ELSUR and prepare an Acceptance Test Plan (ATP) addendum (subset of the entire ATP for testing a specific platform),Execute test plan addendum either on-site or remote for Standards and Operational Testing,Collect and analyze test data,Quantify issues with ELSUR technical solutions (i.e., identify problems with the ELSUR technical solutions that would impact LE),Verify that ELSUR technical solutions developed in accordance with the assistance capability requirements of CALEA, the applicable industry standard, and/or the manufacturer’s Feature Specification Document,Verify ELSUR technical solutions meet LE’s requirements,Recommend corrective action to the ELSUR technical solution manufacturers based on test results,[P(1] Support NDCAC/CIP negotiations with manufacturer/service provider for closure of identified ELSUR technical solution issues,Develop test plans,Archive test data and develop ELSUR technical solution documentation (i.e., issued list(s)), Test Results Assessment Report, CALEA Solution Feature Reference Guide,Generate test results reports within a two-week timeframe from the completion of the solution assessment and document in the FBI’s record keeping system.Collaborate with the Operational Technology Division (OTD) Operational Units, the NDCAC and other LE agencies, when appropriate, to ascertain and share information that may impact operations/compliance.Brief CIP personnel on ELSUR test results and analysis; discuss any issues and/or concerns with results.

The Contractor shall provide support for operational and standards testing of industry intercept solutions:

ELSUR Operational Solutions Testing: The evaluation of a carrier’s interception solution against the current and anticipated operational needs as executed under a court order. This testing would include the evaluation of a pen register/trap and trace solution as well as full content intercept solution. This testing may be based on a standard used by the provider or a proprietary solution developed by the provider. However, operational requirements shall drive the scope of testing, rather than the scope of the capabilities described in the standard. For example, an assessment of the provider’s provisioning and/or security may be included in this testing.Issue Resolution Testing: The focused testing of a particular issue identified by LE or the provider in a provider’s interception solution. This testing should include confirming the existence of the issue, isolating the issue’s cause, and identifying potential solutions for the issue. Potential solutions would then be shared with the provider and LE for resolution.

Interception Recovery Testing: Carriers experience issues and failures with their interception solutions that require significant time and effort to correct. It can be difficult for LE to confirm when a carrier’s solution has become operational without the generation of test data in the affected markets. This testing would involve coordinating with the operational units to deploy small teams to the affected markets of high operational priority to generate data. This data would be used to confirm the carrier’s solution is operational rather than relying on target traffic for this purpose.Regression Testing: Carriers frequently modify or upgrade their networks to provide new or improved services to their customers. These changes may have a significant effect on the provider’s interception solution. Regression testing involves revisiting the provider’s interception solutions at regular intervals to ensure that the modifications the providers have made to their network have not negatively impacted their interception solutions. Given the number of providers and solutions, regression testing should be conducted with key providers as identified in consultation with the operational units.ELSUR Operational Solution Assessment: If, through consultation with the operational units, it is determined that a particular provider/service is of low priority, the Telecommunications and Broadband Testing Program would conduct a streamlined assessment of the provider’s intercept solution without conducting testing. This assessment would involve interviewing the carrier to collect information about the provider’s intercept solution. The goal of the assessment would be to have information about the provider’s solution prior to conducting an intercept on its network.Extensive Data Analysis: The high volume of ever changing communication data requires the Telecommunications and Broadband Testing Program to look deeper into the data traffic received during a test. It is no longer sufficient to only look at standards mapped data, the program now has to evaluate, decipher and analyze all the data received in an intercept stream and determine its possible impact on a Lawful Intercept.

The contractor shall provide Task G - Technical Analysis Program (TAP)

There are a wide range of mobile applications (apps) and Internet of Things (IoT) devices that can be used to communicate with other users, in lieu, of using traditional telecommunications services. Unfortunately, most of these apps/IoT do not have a CALEA compliance requirement, so it is unknown what information is available to law enforcement to further their investigations. The Contractor shall develop a plan to identify and prioritize apps/IoT which should be evaluated under this task. The plan will be provided to the Government PM for review and approval.

The Government anticipates that one (1) Senior Software Engineer, one (1) Senior Network Engineer and one (1) Network Engineer are required to fulfill this requirement. One of the senior engineers shall be designated as the Team Lead. The Government reserves the right to increase or decrease personnel either later in the base year or during any of the exercised

UNCLASSIFIED

Task 9 option years. The increase shall not be more than one (1) Software Programmer and two (2) Network Engineers with the requirements as below. The surge positions shall be priced separately.

Engineering services could include but are not limited to:

Create custom tools necessary to evaluate mobile apps and IoT devicesEvaluate the feasibility of intercepting communication services,Evaluation of smart phones applications / IoT devices to familiarize LE with specifics regarding their interaction with CSP networks and infotainment systems,Assist state and local LE with the establishment of NDCAC hosted or supported services, Familiarization with the functionalities and evidentiary results produced by commercial or proprietary LE digital forensics systems, Assess Industry forms and/or portals,Document evaluation results on the NDCAC website and create documents such as whitepapers, power points, and articles that illustrate the findings from the evaluations..This Task can be separated into the following subtasks[P(1] :

Lawful Intercept Application and Processing: Carriers develop standard operating procedures (SOP) for the submission of Court Orders to carry out a lawful intercept. These step-by-step procedures could include carrier developed forms and/or Internet Portals. Testing the process and interface in which a LE Agency would submit Legal Authority for an intercept provides the Carrier and LE the feedback necessary to successfully complete such a task. This task also includes testing of LE legal process capabilities developed by the NDCAC. The goal of the assessment would be to have information on all steps involved in serving Legal Authority on a carrier and give feedback on any issues and/or concerns identified with the task, as well as, provide feedback on any issues and/or concerns identified regarding NDCAC developed LE legal process capabilities.

Application/IoT Research and Familiarization – The Contractor shall develop a list of apps/IoT to be evaluated for each evaluation cycle. The Contractor shall create and provide an Evaluation Cycle Report (ECR) documenting the necessary background information for an application to be tested, to include, a review of capabilities, as described in the applicable store for the version of the app to be downloaded, infotainment compatibility, and anticipated law enforcement impacts. The Contractor shall also develop standard operating procedures (SOP) to ensure that the findings from previously evaluated apps/IoT are kept up-to-date. The SOP will be provided to the government PM for review and acceptance. Law Enforcement requests for app/IoT evaluation submitted via TRG or the NDCAC secure website shall be treated as priority and evaluated immediately upon approval by the government PM. The Contractor shall develop standard operating procedures to ensure these evaluation requests are addressed within 3 business days 90% of the time. While it is anticipated that most app evaluation will take place within the Washington DC – Fredericksburg area, in some circumstances it may require travel to other markets and may vary from 1-5 days.

Pre-Evaluation Preparation – The Contractor shall develop a plan to ensure that all app/IoT functionality/capability has been identified and all logistical needs (services, devices, test tools, infotainment systems, etc.) are assigned/available during the evaluation process. The plan to include number of personnel and individual team assignments for an evaluation are subject to Government approval.

Evaluation Execution – The Contractor shall setup all equipment necessary for the evaluation and exercise all capabilities to be evaluated; documenting any discrepancies, nuances, and/or failures regarding functionality. The Contractor shall ensure all relevant network traffic is captured for later analysis. Basic analysis shall be conducted during this phase to ensure that all relevant traffic is captured and identify any issues or nuances which would necessitate a change in the evaluation process to successfully evaluate the application/IoT. For apps that have infotainment and/or telematics functionality, all information available via this functionality will be thoroughly documented at time of execution.

Post-Evaluation Analysis – The Contractor shall thoroughly analyze all network captured traffic and quantify findings with regards to the impact on law enforcement’s ability to successfully gather evidence. The Contractor will document this information in the appropriate Assessment Summary Report. These reports should be completed on a regular basis as the full analysis (to include the Forensics Analysis below) is completed, however all reports are due no later than the end of the evaluation cycle.

Device Forensics Extraction and Analysis – The Contractor shall perform a test forensics extraction of the appropriate devices used for evaluation. The extraction level to be performed will be the most detailed based on the device containing the data to be extracted. The Contractor will add these findings to the appropriate Assessment Summary Report and provide to the government PM for review and acceptance. Once accepted by the government, the Contractor will push the results to the NDCAC secure website.

The contractor shall provide Task I - Training/Demonstrations

The Contractor shall be required to perform demonstrations resulting from the work in the NDCAC/CIP to attendees during tours, training, and conferences. Training shall be conducted onsite or at other Government approved locations throughout the United States. Travel shall be required to other Government approved locations. The Government anticipates the Contractor shall utilize the same contractors that support Tasks A, B, C, D, E, F, and G to support this task.

UNCLASSIFIED

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Task(s)

Deliverable Name

Additional Context

Deliverables

A deliverable is a tangible or intangible good or service which is produced as a result of a contractor’s performance of one or more tasks.

The Federal Bureau of Investigation’s deliverables are listed below.

Deliverable 1

Kick-Off Briefing

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations within five (5) business days of contract award

Briefing; 1 paper copy in Microsoft Word

Deliverable 2

Project Plans and Schedules

UNCLASSIFIED

Task(s)

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Task(s)

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations as required

Presentation or paper copy in word document

Receiving party is COR and PM

Deliverable 3

Develop Presentations

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations

UNCLASSIFIED

Deliverable Submission

Task(s)

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Task(s)

Deliverable Name

Description

Deliverable Format

Deliverable Submission as required

MS PowerPoint

Deliverable 4

Budget formulation, evaluation, analysis and associated documents

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support as required

MS Office

UC

Deliverable 5

LAETIC Documents

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

As required

UNCLASSIFIED

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Task(s)

Deliverable Name

Description

Deliverable Format

MS Office

UC and PM

Deliverable 6

Government Requested Reports

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations

As required

MS PowerPoint presentation or MS Office

UC, COR, and PM

Deliverable 7

Provide minutes and reports associated with Industry

UNCLASSIFIED

Task(s)

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Task(s)

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations within 5 days of the meetings

1 paper copy in MS Office

PM

Deliverable 8

Monthly Status Report

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations

UNCLASSIFIED

Deliverable Format

Deliverable Submission

Task(s)

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Monthly - 5th day of the following month

MS PowerPoint or Word

Deliverable 9

Weekly Project Status Reports

The contractor shall provide TASK A – NDCAC and CALEA Implementation Program Support

The contractor shall provide TASK A1 – Legal and Regulatory Support

The contractor shall provide TASK B – Lawful Access Support Services

The contractor shall provide Task C - Stakeholder Engagement

The contractor shall provide Task D - CIP and NDCAC Technical Standards Support Services

The contractor shall provide TASK E - Advanced Communications Technologies and Content Development

The contractor shall provide Task F - Solution Verification (SolVer) Testing Program

The contractor shall provide Task G - Technical Analysis Program (TAP)

The contractor shall provide Task I - Training/Demonstrations weekly - every Monday

Word document

UNCLASSIFIED

Task(s)

Deliverable Name

Description

Deliverable Format

Deliverable Submission

Task(s)

Deliverable Name

Description

The weekly project status report shall…