Oracle_Pre-Award_Protest.pdf

Craig A. Holman

+1 202.942.5722 Direct Craig.Holman@arnoldporter.com

Arnold & Porter Kaye Scholer LLP 601 Massachusetts Ave., NW | Washington, DC 20001-3743 | www.arnoldporter.com

August 6, 2018

CICA STAY REQUIRED

BY ELECTRONIC DELIVERY

U.S. Government Accountability Office Attn: Procurement Law Control Group Office of the General Counsel 441 G Street, N.W.

Washington, D.C. 20548

Re: Pre-award Protest of Oracle America, Inc. Under RFP No. HQ0034-18-R- 0077, Department of Defense Joint Enterprise Defense Infrastructure Cloud

Dear Sir or Madam:

Oracle America, Inc. ("Oracle"),1 by its undersigned counsel, files this pre-award protest challenging (among other things) the decision of the Department of Defense ("Department" or

"DoD") to make a single, potential 10-year, $10 billion Indefinite Delivery Indefinite Quantity

("IDIQ") contract award under Solicitation No. HQ0034-18-R-0077 (the "RFP"). The RFP seeks a Joint Enterprise Defense Infrastructure ("JEDI") Cloud for use by DoD and other entities involved in DoD business. The JEDI Cloud will provide infrastructure as a service ("IaaS") and platform as a service ("PaaS") offerings, in both unclassified and classified environments, to support DoD business and mission operations in the homeland and abroad, including the full range of military operations.

DoD's single awardee IDIQ contract approach is contrary to statutory and regulatory requirements; contrary to the perspective of numerous industry experts that a multi-vendor IDIQ contract offers the most advantageous approach for DoD's near term and long term technology requirements; contrary to the market trend toward multi-cloud environments; and contrary to

DoD's own stated objectives of flexibility, innovation, a broad industrial base, and keeping pace with evolving technology. DoD is a complex, heterogeneous computing environment driven by unique (in many cases, non-commercial) requirements for security, scalability, performance, and government-specific purpose built features. Standardizing on a single cloud today makes no more sense than standardizing on a single on premise computing architecture decades ago.

1 Oracle is located at 1910 Oracle Way, Reston, Virginia, 20190, telephone number 703/478- 9000. All communications concerning this protest should be directed to the attention of undersigned counsel.

U.S. Government Accountability Office Procurement Law Control Group August 6, 2018

Indeed, DoD previously has acknowledged that the diversity of its mission necessitates a multi-cloud environment.

DoD's JEDI single source determination effectively closes a significant market (DOD estimates up to $10 billion) to competition in violation of statutory and regulatory mandates and assuredly (by tying DoD to a single technological cloud vendor for ten years) will frustrate (not foster) the innovation necessary for DoD to operate on technology's leading edge. DoD's mission demands the best technology for the particular task, which, given the dynamic nature of cloud computing services and the ill-defined nature of DoD's needs, cannot be determined as the

RFP is structured. DoD's interests and those of the taxpayer are best achieved thorough the multiple award process Congress has preferred and, in these circumstances, has mandated.

Significantly, the multiple award process tracks best practices of the cloud market today: namely a multi-cloud approach benefiting from differentiated products, varied expertise, and constant competition to encourage both innovation and lower prices. GAO, accordingly, should sustain this protest.

I. INTRODUCTION

The JEDI RFP emanates from a draft solicitation that already has faced substantial

Congressional skepticism and industry criticism related to DoD's intention to limit award of this

10-year, $10 billion IDIQ to a single offeror;2 a decision that violates the law and clashes with the multiple-cloud demographics and best practices of leading enterprises in the commercial

2 Chris Cornillie, Pentagon Releases Second Draft RFP for JEDI Cloud Contract, Bloomberg Government, https://about.bgov.com/blog/pentagon-releases-second-draft-rfp-jedi-cloud-contra ct/ (last visited 8/6/2018) (reporting three major industry concerns including single award strategy); John K. Higgins., DoD Launches JEDI Program Amid Cloud Provider Criticism, E- Commerce Times, https://www.ecommercetimes.com/story/85478.html (last visited 8/6/2018) (reporting on concerns of industry groups for move to single award); Jared Serbu, Deasy takes control of JEDI, but fate of DoD's cloud steering group is up in the air, Federal News Radio, https://federalnewsradio.com/federal-cloud-report/2018/07/deasy-takes-control-of-jedi-but-fate-of-dods-cloud-steering-group-is-up-in-the-air/ (last visited 8/6/2018) (reporting on criticism from both Congress and industry groups of DoD's single award decision); Nike Wakeman, Spending bill questions JEDI cloud acquisition strategy, Washington Technology, https://washingtontech nology.com/blogs/editors-notebook/2018/03/jedi-congressional-requirements.aspx (last visited 8/6/2018) (reporting on Congressional response to significant industry concern regarding single-award strategy).

August 6, 2018 cloud market.3 Contrary to the Memorandum from the DoD Chief Information Officer ("CIO"), the single awardee IDIQ Jedi Contract approach contravenes rather than "employs the best standards of competitive pricing, innovation, and security." (CIO Memo, Ex. K.)

Neither DoD nor commercial technological marketspace leaders can accurately predict where the still nascent cloud computing industry will be or who will lead it five years from now, much less ten. With quantum computing, blockchain, artificial intelligence and machine learning, internet of things, and other technologies actively disrupting a disruptive technology, the only constant is change.4 DoD knows this. Indeed, DoD routinely warns Congress and others about the rapid pace of technological change. Yet, the DoD Determination and Findings

("D&F") oddly intimates that DoD will receive proposals for firm fixed prices to meet DoD's future, unarticulated tactical cloud computing needs (classified and unclassified) for the next ten years and today can determine the single best value cloud computing technological leader over the next ten years when some – if not most – of the impactful technology has yet to be developed. Congress prohibits the use of single source IDIQ contracts in these circumstances.

Therefore, this protest challenges the failure to use the Congressionally preferred multiple award approach to the "maximum extent practicable," the flawed D&F, and several related anti-competitive aspects of the JEDI RFP, each of which will frustrate fair and meaningful competition in this significant market. 5

First, the United States ("U.S.") Code and Federal Acquisition Regulation ("FAR") envision two separate steps for award of IDIQ contracts over $112 million: (i) a contracting

3 See RightScale State of the Cloud Report, https://assets.rightscale.com/uploads/pdfs/RightScale -2018-State-of-the-Cloud-Report.pdf ("81% of respondents have a multi-cloud strategy.") (last visited 8/5/2018); Kim Weins, Cloud pricing comparison: AWS vs. Microsoft Azure vs. Google Cloud vs. IBM Cloud, InfoWorld https://www.infoworld.com/article/3237566/cloud-computing /cloud-pricing-comparison-aws-vs-azure-vs-google-vs-ibm.html?page=2 ("Developing a multi-cloud strategy is a critical component of cloud cost management efforts.") (last visited 8/4/2018).

4 Heraclitus of Ephesus.

5 Oracle raises this challenge to the single source determination out of an abundance of caution to the extent GAO finds that the publication of the D&F triggers the 10-day timeliness rule.

Oracle is continuing to review the RFP; accordingly, Oracle reserves its right to assert any other challenges to the RFP prior to the deadline for receipt of proposals in accordance with 4 C.F.R. § 21.2(a)(1).

August 6, 2018 officer determination at the acquisition planning stage; and (ii) an agency head determination in connection with any single source IDIQ award. As related to the former, FAR 16.504(c)(1)(i) provides that "the contracting officer must, to the maximum extent practicable [i.e., to the greatest degree possible], give preference to making multiple awards of indefinite-quantity contracts under a single solicitation for the same or similar supplies or services to two or more sources." (emphasis added). As related to the latter, FAR 16.504(c)(1)(ii)(D) provides: "No task or delivery order contract in an amount estimated to exceed $112 million (including all options) may be awarded to a single source unless the head of the agency determines in writing that – . . . The contract provides only for firm fixed price (see 16.202) task or delivery orders for . . . Services for which prices are established in the contract for the specific tasks to be performed." FAR 16.504(c)(1)(ii)(D) (emphasis added); see also 10 U.S.C. § 2304a(d)(3)

(containing similar prohibition).

The RFP lacks any indication that the Contracting Officer complied with the clear mandate to give preference to competing multiple award IDIQ contracts to the maximum extent practicable, as part of the acquisition planning process. Although the RFP attaches the later-required D&F, the Contracting Officer's acquisition planning obligations differ both in focus and expected considerations. The FAR requires a documented contracting officer's decision considering a number of specific factors that DoD appears to have missed. FAR

16.504(c)(1)(ii)(A), (B). Both the Government Accountability Office ("GAO") and the U.S.

Court of Federal Claims have made clear that this is a significant requirement, particularly given the "maximum extent practicable" language that Congress employed. On what basis has the

Contracting Officer selected this single source approach? Has the Contracting Officer fully and properly considered each of the FAR factors? Why not compete with the possibility of multiple contracts? Indeed, the DoD CIO states in his Memorandum for JEDI Cloud Industry Partners that "[w]ith the diversity of DoD's mission, DoD will always have a multiple cloud environment." (CIO Memo, Ex. K.) Yet, inexplicably, DoD seeks to award a potential 10-year, $10 billion IDIQ contract to a single cloud provider. Unanswered questions abound.

August 6, 2018

Separately, the law requires an additional step for agencies to issue a single-award IDIQ contract exceeding $112 million; specifically, an agency head determination that the award meets one of the few specific statutory exceptions that permit award to a single contractor. In an attempt to meet this requirement, the D&F announces that the solicited JEDI Cloud Contract will only permit firm fixed price task orders involving "services for which prices are established in the contract for the specific tasks to be performed." (D&F at 3, Ex. J.) Trying to fit a square peg into a round hole, the D&F declares that offerors will provide a commercial catalog at the time of award "cover[ing] the full potential 10 years" and will submit a "single, fixed unit price for delivery of that particular cloud service." (Id. at 2.) These statements, however, directly contradict the premise of the JEDI RFP to stay on the leading edge of technology and have no resemblance to what the JEDI RFP actually contemplates.

Instead, the JEDI RFP expects that the awardee will regularly port its new commercial offerings onto the JEDI Cloud and will work with DoD to develop new classified offerings – none of which offerors in the JEDI competition will specify or price. Tacitly acknowledging that the JEDI RFP competition will not cover the evolving services solicited, the D&F goes on to state: "Moreover, to achieve commercial parity over time, the contract contemplates adding new or improved cloud services to the contract . . . the [contract] includes mechanisms to ensure the fixed unit price for the new service cannot be higher than the price that is publicly available in the commercial marketplace in the continental United States." (Id. at 3 (emphasis added).) The

D&F, on its face, thus evidences that the very exception identified does not apply. In this way, the D&F itself acknowledges that it is not possible today to run a competition for future technology that does not yet exist. Under the RFP, the JEDI offerors will not price, and DoD will not compete, many of the services solicited across the next ten years – many of the particular cloud services are not even known.

Gartner reports that the pace of cloud change is so rapid that major providers add 40 to 50 new offerings each month.6 The JEDI RFP does not price these future services. Instead, the

6 Hidden Cloud Opportunities for Technology Service Providers (June 20, 2018) at https://www.

August 6, 2018

RFP attempts to peg the new offering prices to the awardee's future commercial catalogs – as if this somehow equates to the "established price" the U.S. Code and FAR require. The FAR, however, provides "[t]he fact that a price is included in a catalog does not, in and of itself, make it fair and reasonable" – much less competitive. FAR 15.403-3(c). Moreover, technology refreshment and price reduction clauses targeted to take advantage of falling prices and new technology do not offer a valid substitute for task order competition. To the contrary, the use and reliance on such provisions is the very reason Congress passed the single source restriction in the first place: "Before FASA, many agencies relied on long-term ID/IQ and umbrella contracts with technology refreshment and price reduction clauses to take advantage of falling prices and new technology. Even with these clauses, the government had to negotiate in a sole-source environment and was often unable to realize the economies and efficiencies afforded by vigorous competition among vendors in the marketplace." OFPP, Best Practices for Multiple

Award Task And Delivery Order Contracting, at https://www.gsa.gov/cdnstatic/BestPractices

MultipleAward.pdf (last visited 8/3/18). The JEDI RFP involves the precise circumstance for which Congress has directed agencies to use multiple award IDIQ contracts. The only lawful and reasonable approach is multi-vendor task order competitions over time.

Second, unless a procuring agency intends to award multiple IDIQ contracts and evaluate price as part of the task order process, the agency must perform a meaningful price evaluation for the base contract award. 10 U.S.C. § 2305(a)(3). To do so, the RFP must reflect the services that the Department expects to purchase across the entire contract. Here, the Department has elected to use a limited scenario approach under which an offeror can select from any of its many current cloud offerings to fulfill the scenario. The absence of detail as to what the offerors must provide in the scenarios most assuredly will leave the Department with no basis to meaningfully compare even the scenario proposals. Moreover, DoD intends to add the entirety of each offerors' cloud catalog to the contract. The RFP does not contemplate any comparative evaluation for most of the catalog items or the thousands of pricing permutations possible under gartner.com/smarterwithgartner/7-hidden-cloud-growth-opportunities-for-technology-service-providers/ (last visited 8/4/2018).

https://www.gsa.gov/cdnstatic/BestPracticesMultipleAward.pdf

August 6, 2018 such a contract. (RFP at 93-95, Ex. C.) Moreover, the prices for future technology offerings will not be competitively priced. Finally, because IaaS and PaaS offerings are not a commodity like a pencil, and cloud service providers offer differing features and functions, which Cloud Service

Provider will offer the most cost effective solution will vary depending on the ultimate function, work requirements, and applications. Absent a multiple award approach, this type of pricing evaluation falls far short of the statutory bar.

Third, the RFP contemplates a single best value award. But the RFP reflects substantial uncertainty as to the essential characteristics of IaaS, PaaS, Cloud Support Package, and

Portability services the potential JEDI Cloud users may need. The RFP does not specify which

IaaS and PaaS offerings an offeror must propose, or the specific tasks the JEDI Cloud end users

– DoD agencies, the U.S. Coast Guard, the Intelligence Community, countries with which the

U.S. has collective defense arrangements, and federal government contractors – will require.

(Statement of Objectives ("SOO") at 2, Ex. D.) Instead, the RFP directs each offeror to provide its own Performance Work Statement that describes the services the offeror proposes to achieve the SOO Performance Requirements and any "Desired Capabilities" set forth therein. (RFP at

77, Ex. C.) A single award approach necessarily requires greater specificity regarding the services DoD solicits for the JEDI Cloud Contract over the 10-year period of performance in order to assess the best value offeror.

DoD developed the SOO "to maximize Offeror flexibility in proposing and delivering solutions to meet DoD's needs" (id. at 1) and intends to rely on the JEDI Cloud contract as a

"pathfinder", "to learn how to most effectively use cloud at the enterprise level." (RFP Cover

Letter at 2, Ex. B.) Such a "pathfinder" concept directly conflicts with a single award approach, especially one that is potentially for 10 years and $10 billion. DoD can best achieve its

"pathfinder" goal through a multiple award approach that leverages the evolving technology of multiple vendors rather than locking into one Cloud Service Provider.

In sum, the Department seeks a cloud marketplace of unspecified IaaS, PaaS, Cloud

Support Package, and third party software offerings, for use all over the world, by those

August 6, 2018 performing DoD business and missions, to advance DoD's capabilities and meet current and future warfighting needs, but DoD wants to restrict that market and DoD's learning about how to most effectively use the cloud to a single company. This anti-competitive RFP violates law and regulation, and creates significant risk that DoD will award a 10-year, $10 billion contract to a company that will not offer the best value for all the potential JEDI Cloud user's current and future cloud service needs. GAO should sustain this protest.

II. ORACLE IS AN INTERESTED PARTY, THE PROTEST IS TIMELY, AND THE

COMPETITION IN CONTRACTING ACT REQUIRES A STAY OF AWARD.

As a prospective offeror under the RFP and a company with significant experience delivering cloud services to the federal government and other customers, Oracle is an interested party with economic interests directly impacted by the single source determination and other defective RFP terms. See 4 C.F.R. § 21.0(a)(1). GAO maintains authority to resolve this protest pursuant to 31 U.S.C. §§ 3551-56 (2018) and 4 C.F.R. Part 21 (2018).

This pre-award challenge to the Department's decision to make a substantial IDIQ contract award to a single awardee and other defective RFP terms is timely under both (i) 4

C.F.R. § 21.2(a)(1), as Oracle files this protest prior to the September 17, 2018 deadline for receipt of proposals, and (ii) 4 C.F.R. § 21.2(a)(2) as Oracle files this protest within 10 days of the Department publicizing on July 26, 2018 the D&F that provides its rationale for restricting the award of this $10 billion IDIQ contract to a single source.

The Contracting Officer for this procurement is Chanda Brooks. (RFP at 67, Ex. C.)

Oracle files this protest through GAO's Electronic Protest Docketing System. The system automatically generates an email notifying the procuring agency that an interested party has protested the procurement. Upon such notice, the Competition in Contracting Act of 1984

("CICA") requires the Department to stay award under the RFP. See 31 U.S.C. § 3553(d); FAR

33.104(b).

August 6, 2018

III. BRIEF FACTUAL BACKGROUND

A. The Parties

1. Oracle is a global provider of enterprise cloud computing. http://www.oracle.

com/us/corporate/oracle-fact-sheet-079219.pdf. More than 500 government organizations take advantage of the flexibility and cost savings provided by the Oracle Cloud to engage with constituents and modernize government services. https://www.oracle.com/industries/public-sector/index.html.

2. DoD's Washington Headquarter Services provides services to the Office of the

Secretary of Defense ("OSD"), DoD agencies, and offices in the National Capital Region, enabling economies of scale for delivering essential administrative services to fulfill the DoD mission. http://www.whs.mil/our-organization. The Department Acquisition Directorate is the

Single Enterprise Contracting Office, providing acquisition services to all OSD components. Id.

B. The Solicitation

3. The Department issued the JEDI Cloud RFP on July 26, 2018, and the FBO notice states that DoD is conducting the procurement in accordance with the streamlined procedures of

FAR 12.6. (July 26, 2018 FBO Notice, Ex. A.) The Cover Letter explains that the final RFP captures the totality of the JEDI Cloud requirement, and states that the Department intends to use the JEDI Cloud Contract "to learn how to most effectively use cloud at the enterprise level."

(RFP Cover Letter at 1, Ex. B.) The Department states: "The JEDI Cloud will act as a pathfinder for us to understand how we can best achieve security, governance, and architectures at the enterprise level in a modern, relevant manner." (Id. at 2.)

4. RFP Section B includes multiple Contract Line Items by ordering period of performance. (RFP at 2-12, Ex. C.) The RFP contemplates a potential 10-year performance period based on the following ordering periods:

Base Ordering Period (2 years) April 17, 2019 - April 16, 2021

Option Ordering Period 1 (3 years) April 17, 2021 - April 16, 2024

Option Ordering Period 2 (3 years) April 17, 2024 - April 16, 2027

Option Ordering Period 3 (2 years) April 17, 2027 - April 16, 2029 http://www.oracle.com/us/corporate/oracle-fact-sheet-079219.pdf http://www.oracle.com/us/corporate/oracle-fact-sheet-079219.pdf https://www.oracle.com/industries/public-sector/index.html https://www.oracle.com/industries/public-sector/index.html http://www.whs.mil/our-organization

August 6, 2018

(Id. at 17.)

5. The RFP sets the maximum contract limit at $10 billion and the minimum guaranteed amount at $1 million. (RFP at 13.)

6. The RFP does not dictate what IaaS, PaaS, and Cloud Support Package services each offeror proposes. Instead, the RFP directs each offeror to provide its own Performance

Work Statement describing the services the offeror proposes to achieve the SOO Performance

Requirements and any "Desired Capabilities" set forth therein, and to offer catalog pricing for each proposed service. (RFP at 77.) The Department developed the SOO "to maximize Offeror flexibility in proposing and delivering solutions to meet DoD's needs." (SOO at 1, Ex. D.) The

RFP advises offerors not to interpret the SOO "as limiting any functionality within the proposed solution." (Id. at 2.)

7. The SOO evidences a massive scope for the JEDI Cloud contract. Users will include all of DoD, and others performing "DoD business and mission operations," including the

U.S. Coast Guard, the Intelligence Community, countries with which the United States has collective defense arrangements, and Federal government contractors. (SOO at 2, Ex. D.) The

SOO also requires the contractor to offer JEDI Cloud Services "at all classification levels, across the homefront to the tactical edge, including disconnect and austere environments, and closed loop networks." (Id.) The RFP defines the tactical edge to include "[e]nvironments covering the full range of military operations…." (JEDI Cloud Definitions at 6, Ex. M.)

8. The RFP requires the Cloud Service Provider to meet the Cyber Security Plan security requirements for the unclassified services within 30 days of contract award, the Secret-level security requirements within 180 days of contract award, and the security requirements for all other classified services including Top Secret, SCI, and SAP within 270 days of contract award. (SOO at 4, Ex. D; see also RFP Cover Letter at 1 ("There is no requirement for offerors to have accredited classified environments at the time of proposal."), Ex. B.)

9. The RFP contains two types of Outside the Continental U.S. ("OCONUS") requirements: (1) OCONUS tactical edge requirements, including the static, modular, rapidly

August 6, 2018 deployable data centers for use on military controlled locations; and (2) point of presence requirements, i.e., interface point between communicating entities. (JEDI Cloud Q&A Matrix at

No. 1360, Ex. E.) In response to questions about the OCONUS tactical edge requirements, DoD states that the "Government, not the JEDI Cloud contractor, is responsible for establishing appropriate facilities to support tactical edge capabilities." (Id. at No. 1371.)

10. The RFP provides no other specific location information for the services covered by the JEDI Cloud Contract. (JEDI Cloud Q&A Matrix at No. 1377 (potential offeror stating that the "Government must identify locations for service as to ensure response, availability and support," and Department responding: "Your comment has been noted.").)

11. CLIN x001 covers unspecified Unclassified IaaS and PaaS offerings, which the

RFP indicates offerors will price by catalog. (RFP at 2, Ex. C.)

12. CLIN x002 covers the unspecified IaaS and PaaS offerings in a classified environment, which the RFP indicates the offerors will price by catalog. (RFP at 2.)

13. CLIN x003 covers an Unclassified Cloud Support Package, which the RFP indicates offerors will price by catalog. (RFP at 2.) The RFP does not define a specific or finite scope of work for the Cloud Support Package service, purportedly to leave flexibility for future

Task Orders:

Unclassified offerings of catalog support to advise and assist with architecture, usage, provisioning, and configuration of IaaS and PaaS, to include homefront to the tactical edge. Package services may advise and assist with integration, aggregation, orchestration, and troubleshooting of cloud services. Package may include training services, materials, and documentation for available services.

This is not a time-and-materials or labor-hour based CLIN.

(Id.; see also SOO at § 3.24, Ex. D.) The SOO advises that if the offeror proposes to constrain the Cloud Support Package by a number of hours available to users, then the offeror must also provide a mechanism (without charge) for users to inquire how many hours have been consumed. (SOO at § 3.24.1.)

14. CLIN x004 covers the Classified Cloud Support Package, which the RFP also indicates offerors will price by catalog. For CLIN x004, the RFP includes the same vague

August 6, 2018 description as CLINs x003 except the series x004 CLIN covers "classified offerings." (RFP at 3, Ex. C.)

15. CLIN x005 covers the Portability Plan for which each offeror must propose a firm fixed price. (RFP at 3.) The Portability Plan is a set of user instructions to "extract all online, nearline, and offline data, including, but not limited to, databases, object and file storage, system configurations, cloud activity logs, source code hosted in a JEDI Cloud code repository, and network configurations" to migrate from JEDI Cloud to another environment. (SOO at § 3.16.1

(emphasis added), Ex. D.) This plan must also evidence the potential offeror's ability "to demonstrate successful erasing, purging or destruction of all system components, as appropriate, and an ability to prevent re-instantiation of any removed or destroyed system, capability

(software or process), data, or information instances once removed from JEDI Cloud." (See id.)

16. CLIN x006 covers a Portability Test demonstrating the portability of data and applications to other hosting environments, for which each offeror must propose a firm fixed price. (RFP at 4.) As with the other CLINs, the RFP does not provide a finite scope of work for the Portability Plan or the Portability Test services.

17. In the bidder questions on an RFP draft, an offeror noted that "[d]eveloping a

Firm Fixed Price for a Portability Plan will require the scope of what is being ported." (JEDI

Cloud Q&A Matrix at No. 1643, Ex. E.) The Department responded that the offerors shall assume that "the scope and complexity of the applications and data described in the Price

Scenarios are illustrative examples" of what the Department intends to port to inform the pricing for the Portability Plan and Test CLINs. (Id.) The RFP cautions, however, that "the

Government is not limited to those illustrative examples in post-award contract execution."

(RFP at 84, Ex. C.)

18. CLIN x007 covers Cloud Computing Program Office Program Management

Support, i.e., the Program Management Office (at least a Program Manager and Deputy Program

Manager), process and tools necessary for the contractor to manage and oversee all contract activities, including, e.g., "facilitating the timely authentication and authorization of JEDI Cloud

August 6, 2018 infrastructure and offerings at all classification levels and coordinating successful integration of the DoD's provisioning tool," monitoring and reporting on contract status and Service Level

Agreements, Quality Assurance activities, and reporting on small business participation. (RFP at

4, 14.) Each offeror must propose a monthly fixed price for the management services covered in

CLIN x007. (Id. at 4.)

19. The RFP contemplates that the contractor will add new or improved IaaS, PaaS, or Cloud Support services to the Contract by (i) advising the Contracting Officer of new services that the vendor has made publicly available in the vendor's CONUS commercial cloud, or (ii) notifying the Contracting Officer of potential new services in advance of availability in the vendor's CONUS commercial cloud. (RFP at 23.)

20. Pursuant to RFP Section H2, the price of any new unclassified services shall not be higher than the price that is publicly available in the commercial cloud plus any applicable discounts, premiums, or fees the Cloud Services Provider proposed in RFP Attachment J-3.

(RFP at 23.) If offered in advance of availability into the commercial marketplace, the

Contracting Officer will make a commerciality determination about the new service and may require cost and pricing date or other than cost and pricing data as required by FAR 15.4. (Id.)

21. For new classified services, RFP Section H2 provides that the "price incorporated into the JEDI Cloud catalog … may include a price premium compared to the unclassified services because of the additional security requirements." (RFP at 23.) That premium, per

Section H2 will be the lesser of the premium applicable to the most comparable classified service at the time of contract award, the classified price premium offered by the Cloud Service Provider in its proposal for Section H2, or the premium proposed by the Cloud Service Provider at the time it offers the new service to the Department. (Id. at 24.)

22. If the Cloud Service Provider eliminates a service from its publicly-available commercial catalog, RFP Section H2 requires the contractor to offer "replacement service(s) with substantially similar functionality," to the Department at a price no higher than the eliminated service. (RFP at 24.)

August 6, 2018

23. RFP Section H3 requires the Cloud Service Provider to match any price reductions in the unclassified JEDI services catalog to those made in the commercial marketplace within 45 days, and to lower the related classified service by the proposed

"percentage of the net value difference for the newly lowered rate for the unclassified service."

(RFP at 24.)

24. The RFP includes six pricing scenarios (the "Price Scenarios") to guide both the technical and price evaluation. (Price Scenarios, Ex. H.) For all scenarios, the RFP directs the offerors to make certain assumptions unless stated otherwise, e.g., that the required solution is for an unclassified JEDI Cloud requirement, the service will take place in the offeror's most expensive CONUS region or zone, all services and resources are utilized continuously and all storage and data is retained for the duration of the order, and migration of any application is instantaneous on day 1 of the order. (Id. at 1.)

25. The RFP requires offerors to include a Priced and Unpriced Basis of Estimate

("BOE"), as well as a price build-up, for each of the Price Scenarios. (RFP at 83, Ex. C.)

26. The BOEs must document the "ground rules, assumptions, and drivers used in developing the price estimates, including applicable model inputs, rationale justification for analogies, estimating methods, supporting schedule and other details supporting the price estimates." (RFP at 83.) For each Price Scenario, the BOE must (i) describe the proposed technical solution and the quantities of the applicable IaaS, PaaS, and Cloud Support offerings, and (ii) illustrate how the offeror proposes to use the offerings together to achieve the scenario's requirements and any recurring or non-recurring offerings. (Id.)

27. The Price Build-up must capture the unit prices and quantities of each offering for the solution proposed, consistent with the offered catalog pricing and any proposed discounts, rebates, fees, etc. (RFP at 83-84.)

28. In addition, each offeror must submit four catalogs, one for CLIN x001

Unclassified IaaS and PaaS Offerings, one for CLIN x002 Classified IaaS and PaaS Offerings, one for CLIN x003 Unclassified Cloud Support Package, and one for CLIN x004 Classified

August 6, 2018

Cloud Support Package. (RFP at 84.) The RFP requires offerors to include a worksheet in the catalog for the base period and each option period. (Id.)

29. RFP Section L instructs that the offeror may not price any Cloud Support Package catalog offerings using time and material or labor hour pricing. (RFP at 84.)

30. The RFP provides for the JEDI Cloud IDIQ Contract award to a single offeror deemed the best value. (RFP at 88.) The Department intends to award two task orders concurrently with the base contract award. (Id. at 65.) Task Order 1 relates to CLIN 007, setting up the Cloud Computing Program Office Program Management Support. (PWS for Task Order

1, Ex. F.) Task Order 2 serves as a place holder, obligating to the contract the difference between the guaranteed minimum of $1 million and the price of Task Order 1. (PWS for Task

Order 2, Ex. G.) The awardee will not perform any cloud services under Task Order 2 or submit invoices under this Task Order. (Id.) Rather, upon the issuance of future orders for services, the government will administratively transfer the funds obligated under Task Order 2 to those task orders. (Id.)

31. The RFP requires a multiple-phased evaluation. (RFP at 88, Ex. C.)

32. In Step 1, the Department will perform a pass/fail evaluation against several "Gate

Criteria." (RFP at 88.) The Gate Criteria are:

i. Elastic Usage – the addition of JEDI Cloud unclassified usage will not represent a majority of all unclassified usage in the offeror's commercial cloud (id. at 74, 89);

ii. High Availability and Failover – the Commercial Cloud Offering data centers (no fewer than three physical existing unclassified data centers within the Customs Territory of the United States) are sufficiently dispersed and can continue supporting the same level of DoD usage in the case of catastrophic data center loss (id. at 75, 89);

iii. Commerciality – proposal demonstrates commerciality through revenue information for calendar year 2017 (id. at 75, 89);

iv. Offering Independence – the proposed solution for storage, compute, and network IaaS does not require bundling with any particular PaaS and SaaS product (id. at 75, 89);

August 6, 2018

v. Automation – the Commercial Cloud Offering can meet automation requirements for an existing Application Programming Interface as described in Section L (id. at 76, 90);

vi. Commercial Cloud Offering Marketplace – the proposal shows an easy to use online marketplace (id at 76); and

vii. Data – the proposed solution meets the data requirements specified in Section L. (Id.

at 77, 90.)

33. The RFP identifies eight other factors to determine the best value of those offerors satisfying the Gate Criteria. (RFP at 88, 90-93.) The RFP lists the non-price factors in descending order of importance:

Factor 2 – Logical Isolation and Secure Data Transfer

Factor 3 – Tactical Edge

Factor 4 – Information Security and Access Controls

Factor 5 – Applications and Data Hosting and Portability

Factor 8 – Demonstration

Factor 6 – Management and TO 001

Factor 7 – Small Business Approach

(Id. at 78-83, 88, 90-93.) These factors, when combined, are more importance than Factor 9 –

Price. (Id. at 88.)

34. For Price, the RFP requires the Department to evaluate each offeror's Price

Volume for accuracy and completeness. (RFP at 93.) As related to Task Order 1 the RFP contemplates that the Department will evaluate the price to determine if it is "fair and reasonable, complete and accurate." (Id. at 94.) DoD also must calculate a Total Evaluated Price, which equals the sum of the total proposed prices for Price Scenario 1 through 6, 4 times the Proposed

Unit Price for CLIN 0005, 6 times the Proposed Unit Price for CLIN 1005, 6 times the Proposed

Unit Price for CLIN 2005, 4 times the Proposed Unit Price for CLIN 3005, 4 times the Proposed

Unit Price for CLIN 0006, 6 times the Proposed Unit Price for CLIN 1006, 6 times the Proposed

Unit Price for CLIN 2006, 4 times the Proposed Unit Price for CLIN 3006, 24 times the

Proposed Unit Price for CLIN 007, 36 times the Proposed Unit Price for CLIN 1007, 36 times

August 6, 2018 the Proposed Unit Price for CLIN 2007, and 24 times the Proposed Unit Price for CLIN 3007.

(Id. at 94-95.)

35. The RFP does not contemplate any evaluation of the four proposed price catalogs except to confirm the accuracy of any prices used in the Price Scenario build-ups. (RFP at 93-

95.)

36. In Step 2, the RFP requires the Department to evaluate each offeror which passes the Gate Criteria and proposes technical solutions under Factors 2 through 6 by assigning adjectival ratings. The RFP contemplates the evaluation of Factor 9 by calculating the Total

Evaluated Price and evaluating the Task Order 1 price for reasonableness and completeness.

(RFP at 88.)

37. Based on the Step 2 evaluation, the Department will determine a competitive range of not more than four offerors. (RFP at 65, 88.)

38. For Step 3, each competitive range offeror will propose a Small Business

Participation Approach (Factor 7) and complete the Demonstration of the technical solutions proposed for each Price Scenario (Factor 8), and engage in discussions (if the Department initiates discussions). (RFP at 88.) The Department will then evaluate the competitive range offerors against the Factor 7 and Factor 8 criteria, and eliminate from the competitive range any offerors rated marginal or lower for technical capability or high risk. (Id.)

39. In the final step, DoD will invite all remaining competitive range offerors to submit a final proposal revision (which will include the already conducted Factor 8

Demonstration), and evaluate the final proposals against all criteria. (RFP at 88.)

40. RFP Section B3 specifies that the contract type is a "single award ID/IQ contract" and that the Department will only issue firm-fixed price task orders. (RFP at 13.)

C. The D&F

41. DoD issued with the RFP a single source IDIQ D&F signed on July 19, 2018 by the Honorable Ellen Lord, Under Secretary of Defense for Acquisition and Sustainment. (D&F, Ex. J.) The D&F contains seven paragraphs of "findings." The first paragraph describes 10

U.S.C. § 2304(a)(d)(3)(B)(ii). (Id. at 1.)

August 6, 2018

42. The second paragraph describes the rationale for the JEDI Cloud Contract procurement, including the need for modern cloud computing capabilities and to leverage artificial intelligence and machine learning tools for the warfighter. (D&F at 1.)7

43. The third paragraph describes the potential duration and maximum value of the

JEDI Cloud Contract, i.e., "10 years with a maximum dollar value of 10 billion." (D&F at 1.)

44. The fourth paragraph notes that users will place firm-fixed price ("FFP") task orders and specifies the seven CLINs for each ordering period. (D&F at 2.)

45. The fifth paragraph states: "The CLINS for cloud offerings (i.e., IaaS, PaaS, and

Cloud Support Package) will be priced by catalogs resulting from full and open competition, thus enabling competitive forces to drive all aspects of the FFP pricing." (D&F at 2.)

46. The sixth paragraph describes RFP clauses H2 and H3 addressing price reduction triggers and adding new services to the JEDI Cloud Contract. (D&F at 2-3.)

47. The last finding states that the CLINs from which the Cloud Computing Program

Office may order (Portability Plan, Portability Test, and CCPO Management Support) are fixed priced and result from full and open competition. (D&F at 3, Ex. J.)

48. The Determination states:

Based on the above findings, I hereby determine, pursuant to 10 U.S.C. § 2304a(d)(3)(B)(ii) that the ID/IQ contract or JEDI Cloud will provide only for FFP task orders for services which prices are established in the contract for the specific tasks to be performed.

(D&F at 3.)

7 Although not relevant to the determination, the D&F also asserts that artificial intelligence and machine learning require leveraging of a "common environment." (D&F at 1, Ex. J.) Given that the DoD CIO acknowledges that "DoD will always have a multiple cloud environment" (CIO Mem. at K) and that the JEDI Cloud will be a complementary offering to other existing and future cloud contracts, such as milCloud 2.0, the Defense Enterprise Office Solution (DEOS) RFP (see Final Cloud Combined Congressional Report at 8, Ex. I), and other pending awards by the military branches, the assertion of a need for a "common environment" is unfounded. To the extent this statement is relied upon by DoD for the D&F determination, Oracle hereby challenges the Government's assertions as irrational and not relevant to the stated exception.

August 6, 2018

IV. PROTEST GROUNDS

A. The Department's Decision To Restrict The $10 billion, 10-Year JEDI Cloud IDIQ Contract To A Single Awardee Contravenes Statutory And Regulatory Requirements And Otherwise Lacks A Rational Basis.

Procurement law and regulation require DoD to use a multiple award contract approach for the JEDI Cloud RFP. DoD has failed to follow the statutory and regulatory requirements by designing the massive $10 billion, 10-year JEDI Cloud procurement to provide for a single awardee IDIQ contract. Although DoD claims to employ "best standards of competitive pricing, innovation, and security," DoD also has ignored the broad consensus of industry experts that a multi-vendor approach is the most advantageous approach, and has effectively closed a critical government technology market to competition.8

The U.S. Code and FAR establish a preference for awarding multiple IDIQ contracts for the same or similar services to the "maximum extent practicable." 10 U.S.C. § 2304a(d)(4);

FAR 16.504(c)(1)(i). In mandating this preference, Congress determined that multiple award indefinite quantity contracts better protect the government and taxpayer interests than single awardee indefinite quantity contracts:

The Committee believes that indiscriminate use of task order contracts for broad categories of ill-defined services unnecessarily diminishes competition and results in the waste of taxpayer dollars. In many cases, this problem can effectively be addressed without significantly burdening the procurement system by awarding

8 The Federal Information Technology Acquisition Reform Act (FITARA) Scorecard 6.0 (hearing May 25, 2018) (statement of DoD CIO Dana Deasy), https://oversight.house.gov/hearing/the-federal-information-technology-acquisition-reform-act-fitara-scorecard-6-0/ (last visited 8/6/2018) (responding to "What is your opinion on a multicloud environment?" and stating: "It is my belief that in a cloud world there is no such thing as one solution is going to solve for all. You are always going to have a need when you build anything where you're going to have specific requirements that are going to be best served by unique providers. That is no different than has always been the case with technology," and providing response based on his experience in the private sector where Mr. Deasy was Global Chief Information Officer of JPMorgan Chase and CIO for BP, General Motors North America, Tyco International, and Siemens Americas);

Nick Wakeman, DHS CIO wants multi-cloud strategy, Washington Technology, https://washingtontechnology.com/blogs/editors-notebook/2018/05/dhs-cloud-strategy-zangardi.aspx (last visited 8/6/2018) (reporting on DHS industry day announcement by Chief Information Officer to adopt a multi-cloud strategy because "different (DHS) components have different needs").

August 6, 2018 multiple task order contracts for the same or similar services and providing reasonable consideration to all such contractors in the award of such task orders under such contracts. The Committee intends that all federal agencies should move to the use of multiple tasks order contracts, in lieu of single task order contracts, wherever it is practical to do so.

S. Rep. 103-258 at 15 (May 11, 1994); see also S. Rep. 110-77 at 368 (June 5, 2007) ("The provision recommended by the committee would ensure that future contracts of this type provide for the competition of task and delivery orders unless there is a compelling reason not to do so.").

FAR 16.504(c)(1)(i) contains Congress's stated preference for agencies to make multiple award IDIQ contracts and requires contracting officers to favor multiple IDIQ contract awards under a single solicitation "to the maximum extent practicable":

(i) Except for indefinite-quantity contracts for advisory and assistance services as provided in paragraph (c)(2) of this section, the contracting officer must, to the maximum extent practicable, give preference to making multiple awards of indefinite-quantity contracts under a single solicitation for the same or similar supplies or services to two or more sources.

FAR 16.504(c)(1)(i) (emphasis added). The FAR identifies several factors a contracting officer must consider when determining the number of IDIQ contracts to award and also specifies several instances where it is not practicable for a contracting officer to use a multiple award approach. FAR 16.504(c)(1)(ii)(A) and (B). The FAR requires the contracting officer to document the basis for the decision whether or not to use multiple awards. FAR

16.504(c)(1)(ii)(C). GAO reviews such decisions. See Info. Ventures, Inc., B-403321, Sept. 27, 2010, 2010 CPD ¶ 233 (sustaining protest where agency failed to provide maximum practicable preference).

In addition to requiring agencies to award at least two IDIQ contracts to the "maximum extent practicable," the U.S. Code and FAR impose an additional proscription for large IDIQ procurements. For IDIQ contracts estimated to exceed $112 million, the applicable statute and regulation prohibit a single award unless the head of contracting activity (or senior procurement executive for DoD procurements) also determines in a written D&F that complies with FAR Part

August 6, 2018

1.7 that one of four stated exceptions exist. 10 U.S.C. § 2304a(d)(3); FAR 16.504(c)(1)(ii)(D);

DFARS 216.504(c)(1)(ii)(D). Specifically, FAR 16.504(c)(1)(ii)(D) provides:

No task or delivery order contract in an amount estimated to exceed $112 million (including all options) may be awarded to a single source unless the head of the agency determines in writing that—

(i) The task or delivery orders expected under the contract are so integrally related that only a single source can reasonably perform the work;

(ii) The contract provides only for firm fixed price (see 16.202) task or delivery orders for— (A) Products for which unit prices are established in the contract; or

(B) Services for which prices are established in the contract for the specific tasks to be performed;

(iii) Only one source is qualified and capable of performing the work at a reasonable price to the Government; or

(iv) It is necessary in the public interest to award the contract to a single source due to exceptional circumstances.

FAR 16.504(c)(1)(ii)(D) (emphasis added); see also 10 U.S.C. § 2304a(d)(3) (containing similar prohibition).

Regulatory history confirms that that this requirement for the head of contracting activity to make an independent written determination regarding the award of an IDIQ contract worth more than $112 million to a single contractor is in addition to the contracting officer's obligation to maximize the use of multiple-award IDIQs. When the FAR council proposed the initial version of FAR 16.504(c)(1)(ii)(D) to implement Congress's additional restrictions on use of single award IDIQs, several public comments raised concerns regarding an alleged redundancy in the requirement for a contracting officer's determination regarding whether to use a multiple-award IDIQ and the head of contracting authority's determination required to award a single-awardee IDIQ contract above the $112 million threshold. See e.g., Fed. Reg. Vol. 75, No. 52, 13416, 13419 (Mar. 19, 2010) (comment 10).

The FAR Council rejected the comments, noting the statutory requirement for the head of an agency to make a written determination for any single award above the threshold "did not

August 6, 2018 change the contracting officer's determination during acquisition planning as to whether multiple awards are appropriate." Id. (emphasis added). The FAR Council explained:

The contracting officer determination, at the acquisition planning stage, on whether multiple awards are appropriate is required by statute. This determination is separate from the determination by the agency head to award a task- or delivery-order single contract over $100 million, which is required by a different statute.