FY24-00330 - PSVP PET.pdf

U.S. Department of Homeland Security Office of the Chief Procurement Officer

Justification and Approval for Other Than Full and Open Competition Version 3.4

October 2022 Page 1

FY24-00330

JUSTIFICATION AND APPROVAL FOR OTHER THAN FULL AND OPEN

COMPETITION

(41 U.S.C. 3304(a)(7))

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.3 and in accordance with the requirements of FAR 6.303-1, the justification for the use of the statutory authority under FAR Subpart 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

1. Agency and Contracting Activity. The Department of Homeland Security, Office of Procurement Operations, proposes to enter into a contract on a basis other than full and open competition.

2. Nature and/or Description of the Action being Approved.

(a) Nature of action: The Department of Homeland Security (DHS) Science and Technology

Directorate (S&T) intends to procure on a sole source basis research services by OpenMined to conduct research on the use of privacy enhancing technologies (PETs) and drivers to online radicalization in support of the Christchurch Call and the Christchurch Call Initiative on Algorithmic Outcomes (CCIAO).

(b) Name and address of the contractor.

OpenMined 154 W 14th Street New York, NY 10011

(c) Contract type: Firm Fixed Price Milestones

(d) Estimated total value (including options).

(e) Type of funding - I2 (FY2022 5 Year Funds)

(f) Year of funding: Fiscal Year 2024.

(g) Solicitation number: TBD

(h) Background information about the requirement.

On 15 March 2019 a terrorist attacked two mosques in Christchurch, New Zealand, killing 51 people and injuring 50. The horrific event was livestreamed by the terrorist for 17 minutes and was viewed over 4,000 times before being removed. This terrorist attack once again made clear the harms that can be caused by terrorist and violent extremist content online. It highlighted an issue that transcends borders and platforms, and it required a global solution.

It was the catalyst for global action.

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 2

On 15 May 2019 New Zealand Prime Minister Jacinda Ardern and French President Emmanuel Macron brought together Heads of State and Government and leaders from the technology sector to adopt the Christchurch Call. The Christchurch Call is a commitment by Governments and online service providers to eliminate terrorist and violent extremist content (TVEC) online. It rests on the conviction that a free, open, and secure internet offers extraordinary benefits to society. Respect for freedom of expression is fundamental.

However, no one has the right to create and share TVEC online.

Specifically, by signing to support the Christchurch Call, Governments commit to:

• Counter the drivers of terrorism and violent extremism.

• Ensure effective enforcement of applicable laws.

• Encourage media outlets to apply ethical standards.

• Support frameworks, such as industry standards.

• Consider appropriate action.

By signing to support the Christchurch Call, Governments and Online Service Providers collectively commit to the below objectives. More specifically, OpenMined has continued supporting the CCIAO with research and development (R&D) to better understand the impact of algorithms in social media platforms which can help local efforts to prevent the spread of terrorist and violent content online, while protecting individual privacy data rights:

• Work with civil society to promote community-led efforts.

• Develop effective interventions.

• Accelerate research into and development of technical solutions.

• Support research and academic efforts to better understand, prevent and counter

TVEC online.

• Ensure appropriate cooperation with and among law enforcement.

• Support smaller platforms as they build capacity to remove TVEC.

• Collaborate, and support partner countries, in the development and implementation of best practice.

• Develop processes allowing governments and online service providers to respond rapidly, effectively and in a coordinated manner to the dissemination of TVEC following a terrorist event.

• Respect, and for Governments protect, human rights.

• Recognize the important role of civil society in supporting work on the issues and commitments in the Call.

• Affirm our willingness to continue to work together.

• Develop and support a range of practical, non-duplicative initiatives to ensure that this pledge is delivered.

• Acknowledge that governments, online service providers, and civil society may wish to take further cooperative action to address a broader range of harmful online content, such as the actions that will be discussed further during the G7 Biarritz Summit, in the G20, the Aqaba Process, the Five Country Ministerial, and a range of other fora.

On 07 May 2021, the White House Press Secretary announced that the United States would join the Christchurch Call to Action to Eliminate Terrorist and Violent Extremist Content Online. On 22 September 2022, Christchurch Call announced the Christchurch Call Initiative on Algorithmic Outcomes (CCIAO), between the Government of New Zealand, the U.S.

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 3

Government, Twitter, and Microsoft to invest in an initiative under the banner of the Christchurch Call that will support the creation of new technology to understand the impacts of algorithms on people’s online experiences.

The CCIAO identified the need to develop and test ground-breaking privacy enhancing software infrastructure to address challenges identified in the Christchurch Call and CCIAO to move forward work under the Call. As the first project under this initiative, the participants worked together to build and test a set of PETs. Once tested, replicated, and validated, these technologies would form the basis for an infrastructure to support independent study of impacts of algorithms and their interactions with users, including across multiple platforms and types of platforms, and would dramatically lower the barriers to doing this work. If successful, these technologies would be made available to the Christchurch Call Community, to include the homeland security enterprise, and would help support independent research that fulfils the collective Call Commitments, potentially opening wider applications and new fields of responsible artificial intelligence (AI) research beyond the Call itself.

Phase 1 of the CCIAO began in September 2022 and was focused on developing and field testing PySyft. PySyft is a privacy enhancing technology that allows for third-party researchers to access and analyze data that is fully anonymized from technology companies.

This allows for scientific analysis with complete protection of the privacy of people that are represented in those data. Initially developed by OpenMined as an open-source software, this capability was part of an effort with Twitter’s Machine Learning Ethics, Transparency, and Accountability team. They were testing a range of privacy enhancing technologies for researcher access at that time. PySyft is now a platform based on privacy enhancing technologies that allows independent researchers to ask and answer useful questions using proprietary data and systems without accessing the full data within those systems.

In September 2022 participants of the CCIAO agreed to contribute research funding for OpenMined to further develop PySyft. OpenMined continued work with the three platforms and third-party researchers to demonstrate the full proof of function. New Zealand contributed funding to OpenMined in October 2022 to support Phase 1. During this Phase, the contractor overcame obstacles that researchers faced when accessing data from major technology companies. In Phase 1, the PySyft was built, and put through multiple, rigorous proof-of-function tests. Tests thus far have demonstrated that the technology can mitigate privacy, security, legal, intellectual property, and reputational risks associated with third party research using sensitive data. PySyft has gone through an end-to-end multi-stage proof of function test at each of the three online service provider participants, using both synthetic and real data. It successfully completed this first phase of testing in August 2023.

3. Description of Supplies/Services.

The requirement for Phase 2 is to integrate lessons from Phase 1 into the existing software infrastructure while scaling up and delivering new system components. For this sole source, the contractor will build upon the auditing software that was previously developed under the CCIAO, that is integrated into the contractor’s “PySyft” open-source software library. Through the CCIAO, OpenMined has received over $2.2 million in funding from Twitter/X, Microsoft, the Center for Security and Emerging Technology at Georgetown University, and from the New

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 4

Zealand Department of Prime Minister and Cabinet (DPMC). This funding has facilitated several pilots and significant research and development enhancements to better understand and mitigate the spread of SDTVEC online. For Phase 2 of the PET development project, DHS will be leveraging investments previously made by industry and government entities, to advance the maturity of the PySyft software. In Phase 2, over the next 2-3 years, the CCIAO participant funders expect to:

• Establish a governance framework that supports multistakeholder outreach and fulfilment of the Call Commitments and principles;

• Build an agreed ethics framework that supports researcher access, enables better understanding of human/AI interactions, and research for public good;

• Investigate funded research partnerships with specialist experts, data custodians, and interested communities of practice;

• Investigate methods for assessing AI risk relating to terrorist and violent extremist content;

• Investigate a regulatory use case, as part of the European Union Digital Services Act;

• Continue to grow the number of contributors and the supporting infrastructure, with the aim of creating a global network of AI transparency tools for the public good.

The long-term vision is for a broad network of CCIAO and similar technologies to be available across multiple institutions/entities, with a responsible governance framework that allows accredited researchers globally to analyze data in a privacy-protected way, across platforms. The network will be governed by an ethics and accredited user framework to enable safe, effective, access consistent with the shared objectives of the contributors and the Call Community.

These components, once built, tested, scaled, and deployed together, will help the U.S. and international participants develop a comprehensive cybersecurity framework that ensures integrity, confidentiality, and availability of the system with appropriate regulations and legal compliance, access controls, protection and recovery measures, testing and oversight to ensure the CCIAO project’s success. OpenMined shall conduct research and development on how PETs could aid in the study of online radicalization, by building upon previous versions of PySyft. This will result in updates to be made on the software through iterative development sprints that adds functionality (e.g., version 0.9.5-0.9.7). This software will continue to be made available for access with the general public through GitHub and PyPi, with version 0.9.0 currently available.

OpenMined is the only technical partner working on constructing the global network of privacy-enabled software infrastructure within the CCIAO. OpenMined has developed and established nodes that have undergone proof of function tests within three major platforms (Twitter/X, DailyMotion, and Microsoft). Continuing this development with OpenMined will leverage previous investments from bilateral participants, including the New Zealand DPMC, and continue to develop and scale the needed capability for third party researchers. Building upon the Phase 1 CCIAO work provides a cost savings to DHS since research and development under Phase 1 will be utilized to scale up the proof of concept in Phase 2.

4. Identification of Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is 41 U.S.C.3304(a)(1)

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 5 implemented by the FAR Subpart 6.302-1 entitled “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.”

5. Identification of Exception to the Buy American Statute. N/A there are no materials or supplies being procured.

6. Demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

(a) Rationale for using the authority cited in Section 4 of the J&A: The United States

Government joined the Christchurch Call on 07 May 2021 along with 55 other international governments. On 22 September 2022, the Christchurch Call announced the CCIAO between the government of New Zealand, the U.S. Government, Twitter, and Microsoft to invest in an initiative under the banner of the Christchurch Call that will support the creation of new technology to understand the impacts of algorithms on people’s online experiences. The international nature of the CCIAO (including key social media stakeholders) requires cooperation and coordination of funding in order to achieve technological goals in an efficient manner. The Christchurch Call participants and the CCIAO funding participants recognize the need to implement technological solutions in a reasonably prompt manner because of the potential for violent actors to use social media and aggravate the injury and damage to civil society.

The CCIAO aligns with objectives identified in the National Strategy for Countering Domestic Terrorism. The Strategy sites a requirement to address the role of the internet in influencing individuals to commit acts of domestic terrorism through continued participation of the United States Government (USG) in nongovernmental and multilateral efforts to understand and respond to terrorist content and activities online. In addition, the National Security Council has been a supporting partner of the CCIAO since this partnership addresses requirements supporting national security research and development objectives to advance the U.S.

Government’s and the public’s understanding of factors that influence domestic terrorism and extremism.

(b) Details covering what events lead to the situation requiring use of other than full and open competition procedures including whether any portion of the work can be segregated to allow for competition: As the initial funder of the CCIAO and leader of the Christchurch Call, in September 2022, the New Zealand DPMC issued a grant award on behalf of the CCIAO to OpenMined, utilizing third party technical expertise in its evaluation and selection process.

Third party expertise was provided through Government and industry subject matter experts who are actively engaged in the Christchurch Call. OpenMined was the first organization with the expertise, capability, and willingness to undertake this project, to include pitching the project for funding. The award issued by DPMC underwent legal review and was deemed in accordance with DPMC’s Procurement Policy.

No work can be segregated for competition, as OpenMined is the only company partnered with the Christchurch Call and CCIAO to complete requirements and objectives identified in the CCIAO on PETs. The contractor has received funds from NZ DPMC to develop the proof-of-concept infrastructure through the creation of a network of ‘nodes’ that has been established and undergone proof of function tests at three major platforms. In Phase 1, the first external researcher was granted access and successfully performed user queries on datasets from two

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 6 of those large platforms. By leveraging this existing infrastructure, S&T is able to leverage not only the capital already provided to develop this proof of concept, but also leverage the partnerships already built and sustained under the CCIAO, to support a precedent-setting initiative – the first time an access tool using a single integrated set of advanced PETs that has been tested and verified on multiple participating platforms.

(c) Summarize alternatives considered and why they will not work: Alternative organizations or sources will not work for Phase 2 of CCIAO implementation, because OpenMined is the only performer partnered with the Christchurch Call to complete requirements and objectives identified in the CCIAO. Pursuing alternative solutions will require more funding to develop the proof of concept, in addition to solidifying engagement from multilateral bodies, which requires additional time, effort, and cost. It is not in the U.S. Government’s best interest to duplicate the expense and effort already conducted to initiate Phase 1 of the CCIAO. This requirement makes up only a portion of Phase 2 for the CCIAO and as such, must be fully integrated with the rest of the Phase 2 work which will be performed by OpenMined.

(d) Impact to the mission that would result if the J&A is not approved and, consequently, the product or service not provided: If this J&A is not approved, and consequently the research services are not provided, the U.S. Government will not be able to provide the support it promised as a signatory to the Christchurch Call as a joint initiative leader in the completion of the CCIAO. In addition, S&T would not be able to fully meet the requirements identified in the National Strategy for Countering Domestic Terrorism nor U.S. Department of Homeland Security’s Strategic Plan for Fiscal Years 2020-2024, Goal 1: Counter Terrorism and Homeland Security Threats. The National Strategy highlights how one of the major, national goals of the United States that we share with many of our international participants is to open the data collected by major technology companies to examination and inquiry by independent researchers while fully protecting the privacy of people from whom the data were collected. This larger goal will be supported by the requirements identified in this sole source.

(e) Rationale for use of the nonavailability exception to the Buy American statute, including detailed information explaining why the particular articles, materials, or supplies of the class or kind to be acquired, either as end items or components, are not mined, produced, or manufactured in the United States in sufficient and reasonably available commercial quantities and of a satisfactory quality. N/A, No materials or supplies are involved in this procurement.

• If using “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements” as your authority, also include the following:

o Details on the specific requirements (not what the equipment, process, or service is capable of doing);

o Information on why only one contractor is capable of fulfilling the requirements;

o Why other proposed contractors are unable to meet the requirements;

o Unique capabilities or qualifications of the contractor that form the basis for the justification; and o Information on why and description of the extent to which the Government will be harmed if the supply or service is not acquired from that vendor.

As stated above, this work is part of Phase 2 of the CCIAO, with Phase 1 completed by

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 7

OpenMined in November 2023 and other Phase 2 work being performed in parallel to and subsequent to this PySyft capability improvement. OpenMined is the only contractor working with the Christchurch Call on CCIAO work. This requirement makes up only a portion of Phase 2 and must be fully integrated with the rest of the Phase 2 work which will be performed by OpenMined. If this J&A is not approved, and consequently the research services are not provided, the U.S. Government will not be able to provide the support it promised as a signatory to the Christchurch Call as a joint initiative leader in the completion of the CCIAO.

Additionally, researchers and Christchurch Call participants will not gain the expected functionality in the PySyft software, impacting their ability to develop a comprehensive cybersecurity framework that ensures integrity, confidentiality, and availability of the system with appropriate regulations and legal compliance, access controls, protection and recovery measures, testing and oversight to ensure the CCIAO project’s success.

7. Description of Efforts Made to Ensure that Offers are Solicited from as Many Potential Sources as is Practicable.

A synopsis was posted to SAM.gov on September 4, 2024.

8. Determination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable.

Anticipated costs to DHS have been deemed fair and reasonable. Anticipated costs for these requirements were reviewed by DHS S&T Senior Advisor for Social and Behavioral Sciences and considering the development of software enhancements to PySyft and the maintenance of the open-source library on GitHub and PyPi, the anticipated costs are appropriate.

9. Description of Market Research.

Market Research was conducted to determine if there were other companies working with the Christchurch Call and if other companies could serve as viable alternatives to the identified contractor.

DHS S&T met with research representatives from the Five Research and Development (5RD) Countering Violent Extremism Network (CVEN), in addition to the policy representatives to the Five Country Ministerial (FCM) CVE Working Group, some of whom also represent their Governments within the Christchurch Call. It was determined that while there are other companies working in the PET space, none are working with the Christchurch Call and could not serve as a viable alternative to OpenMined.

10. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

This research effort will support National Security Council objectives in advancing research and partnerships to eliminate TVEC online, as evident through National and Departmental Strategies.

11. A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the Acquisition.

A synopsis was issued on SAM.gov on September 4, 2024, requesting that parties express their

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 8 interest in writing to the Contracting Officer. No responses were received.

12. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Barriers to Competition Before Any Subsequent Acquisition for Supplies or Services Required.

Alternative sources for this requirement may be considered following the completion of the three Phases outlined in the CCIAO initiative by OpenMined. This work is, at present, a non-recurring requirement intended to create a capability for independent researchers which would not allow for competition as it is ongoing work that is part of the larger CCIAO effort. However, should other privacy enhancing technologies or companies work in this space in coordination with the Christchurch Call and the CCIAO, the US Government may determine the need for additional work on a more competitive basis.

(Remainder of this page left blank intentionally)

Justification and Approval for Other Than Full and Open Competition

October 2022 Page 9

13. Contracting Officer’s Certification. I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

/s/ Contracting Officer

14. Technical/Requirements Personnel Certification. I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

/s/ Technical Representative

APPROVAL:

/s/ Contracting Officer