HR001117S0009-Amendment-01.pdf

Amendment 0001 to DARPA BAA HR001117S0009, Secure Handhelds on Assured Resilient networks at the tactical Edge (SHARE)

The purpose of Amendment 0001 to DARPA BAA HR0001117S0009, SHARE is to make the following changes:

A. Add the following sentence on page 10 in section 1.1.1:

Original:

The Phase 1 events and milestones are listed in Table 2. At the end of Phase 1, at a minimum, performer(s) are expected to demonstrate the ability of their individual technical elements to achieve the program objectives as identified in Table 1 and the metrics in Table 11.

Revised:

The Phase 1 events and milestones are listed in Table 2. At the end of Phase 1, at a minimum, performer(s) are expected to demonstrate the ability of their individual technical elements to achieve the program objectives as identified in Table 1 and the metrics in Table 11. Team(s) selected for award will work independently, but may share information at their discretion.

B. Add the following sentence on page 13 in section 1.1.3:

Original:

Performers will be expected to provide at least 50 handheld devices for this demonstration, plus any supporting commercial network and server equipment.

Revised:

Performers will be expected to provide at least 50 handheld devices for this demonstration, plus any supporting commercial network and server equipment. The performer may choose the make and model of the commercial off-the-shelf (COTS) devices used in their demonstration.

C. Correct Figure 2 on page 14 in section 1.1.3 of the BAA to the following:

Original:

Revised:

D. Add the following sentence on page 17 in section 1.2.1:

Original:

At the end of each Phase, the SHARE program Government Team will help assess the performance of the performer’s solution. The SHARE Government Team will comprise technical representatives from multiple Government agencies with a vested interest in the transition of the SHARE program. Each assessment will independently validate the performer’s data and benchmark solution performance. The SHARE Government Team will also conduct user trials to independently assess the usability of applications.

Revised:

At the end of each Phase, the SHARE program Government Team will help assess the performance of the performer’s solution. The SHARE Government Team will comprise technical representatives from multiple Government agencies with a vested interest in the transition of the SHARE program. Each assessment will independently validate the performer’s data and benchmark solution performance. The SHARE Government Team will also conduct user trials to independently assess the usability of applications. Assessments will be done using the performer’s software and hardware – no additional SHARE systems are required to perform testing.

E. Distribute SHARE Proposers Day slides dated January 31, 2017.

F. All other original DARPA BAA HR001117S009 data remains unchanged.

G. Incorporate Questions and Answers (see below).

SHARE Questions and Answers

1. What is the difference between interruptible store and forward versus DTN (Delay Tolerant Networking)?

ANSWER: None. Interruptible store and forward is one of the features needed in a resilient network as described in Section 1.1, (page 7) of the BAA.

2. Section 1.1 (page 6) of the BAA says operating systems must support multiple security levels. Are these distinct security levels running independently concurrently?

ANSWER: Performers should address this question in their proposal and describe how their chosen solution will meet/exceed the program metrics.

3. The BAA mentions Named Data Networking (NDN). Is this an example or a suggestion to leverage this networking technology?

ANSWER: While NDN is provided as an example, and has been studied in order to validate the use of Future Internet Architectures (FIAs) as a solution to SHARE technical risks, any solution can be chosen as long as it fully addresses the goals of Focus Area 2 as stated in Section 1.1 (page 7) of the BAA. Additionally, as stated on page 8 of the BAA, the goal of the SHARE program is to provide an ability to sustain, adapt, and integrate new capabilities and that performers should describe how their software will live beyond the DARPA funded effort.

4. Is the utilization of current military tactical radios a requirement as opposed to other forms of RF connectivity?

ANSWER: Refer to the revised Figure 2 in Amendment 0001 for the notional final demonstration objective, which shows the use of COTS devices as well as military radios.

5. For cross-domain transfers, is it assumed that any of the trusted groups will require manual review?

ANSWER: See Section 1.1, page 6 of the BAA: “Management of data security levels by both manual and automated methods…is desired.”

6. The BAA mentions that DARPA expects multiple awards. How many awards are anticipated?

ANSWER: As stated on page 3 in Part I, Overview Information, of the BAA, DARPA anticipates multiple awards. Further, as stated in section 2, Award Information, on page 18, “The amount of resources made available under this BAA will depend on the quality of the proposals received and the availability of funds.” The Government does not have additional information aside from what is stated in the BAA.

7. Will universities be encouraged to perform fundamental research as a subcontractor for this program or will publication rights need to be mediated via other means?

ANSWER: Please refer to Section 2.1 (pages 18-19), Fundamental Research, which provides detailed information and guidance. As stated in this section, “As of the date of publication of this BAA, the Government expects that program goals described herein either cannot be met by proposers intending to perform fundamental research or the proposed research is anticipated to present a high likelihood of disclosing performance… critical to defense.” Further, “Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not…” This section also states (paraphrased), “…it is the awardee’s responsibility to explain in their proposal why its subawardee’s effort is fundamental research.”

8. What is the Phase 3 demo location: OCONUS or CONUS?

ANSWER: Section 1.1.3 (page 13) of the BAA states the performer should budget for a demonstration in either the EUCOM or the PACOM areas of operations.

9. The BAA states that the Government will arrange and provide funding for access to Government facilities. What will this cover?

ANSWER: Section 1.1.5 (page 16) of the BAA lists the Government Furnished Equipment, Information, and Resources. With respect to the statement in this section that the “Government will arrange and provide funding for access and facilities”, this includes access to a military facility for demonstration purposes.

10. Are the performers supposed to deliver two SHARE systems – one to permit Government evaluation?

ANSWER: Only one SHARE system is required. See Amendment 0001.

11. Will the Government provide Tactical Assault Kit (TAK) software in source code form as

GFE?

ANSWER: As stated in Section 1.1.5 (page 16) of the BAA, “Government off-the-shelf (GOTS) application software to be specified during the program” will be provided. If necessary, this will include TAK software.

12. What is the emphasis on the network architecture – peer-to-peer or infrastructure?

ANSWER: Refer to Figure 2 in Amendment 0001 for the notional final demonstration objective.

The figure shows that both peer-to-peer and infrastructure should be used in the final demonstration.

13. Are foreign nationals allowed to participate in the program?

ANSWER: As stated in Section 3.1 (page 20), Eligible Applicants, “Non-U.S. organizations and/or individuals may participate to the extent that such participants comply with any necessary nondisclosure agreements, security regulations, export control laws, and other governing statutes applicable under the circumstances.”

14. What is considered export controlled/ITAR in this program?

ANSWER: As stated in Section 1.1 (page 8) of the BAA, “The SHARE program must endeavor to ensure releasability to multiple coalition partners. Therefore, the ability to mitigate the risks and impact of International Trade and Arms Regulations (ITAR) is critical. Proposers should describe how they will meet program objectives while maintaining hardware and software functionality, e.g., by adhering to preferred open system modular development processes that are in compliance with or do not invoke ITAR restrictions.” The performer is responsible for identifying parts of their solutions that may be ITAR restricted and should note how they plan to mitigate this restriction as noted on page 8. Further, as stated in Section 4.2.3, Restrictive Markings on Proposals, “All proposals should clearly indicate limitations on the disclosure of their contents.”

15. Should the performers provide the equipment (base stations, etc.) for the demonstrations?

ANSWER: Yes.

16. How does DARPA view teaming with Small Businesses?

ANSWER: As stated in Section 3.4, Collaborative Efforts, of the BAA, “Collaborative efforts/teaming are encouraged.” As stated in Section 5.1 (page 34) of the BAA, “Proposals will be evaluated using the following criteria, listed in descending order of importance: 5.1.1 Overall Scientific and Technical Merit; 5.1.2 Potential Contribution and Relevance to the DARPA Mission; 5.1.3 Cost and Schedule Realism.”

17. How does DARPA view the use of multiple virtual machines (VMs) versus other solutions?

How is a path to accreditation viewed as opposed to technical innovation?

ANSWER: As stated in Section 1.1 (page 8) of the BAA, it is not expected that the system will be accredited within the short time frame of this program. Noting this, the proposal should balance the proposed solution, whether it is the use of Virtual Machines or another solution, with the program timeframe in order to meet the requirements of the program and have a readily transitionable system. For example, the proposal should identify risks and reasonable solutions to achieve operational accreditation beyond the end of Phase 3.

18. Are there transition partners identified?

ANSWER: While official transition partners have not been formally identified, the performer is encouraged to consider our many partner and coalition operations where the system might be applicable. As stated in Section 1.1 (page 8) of the BAA, “SHARE will attempt to identify transition partners early in the program…” Further, as stated in Section 1.1.2 (page 11), “Continued engagement with the user community throughout Phase 2 will identify transition partners and aid in enabling and assessing the desired operational impact.”

19. Should performers show an approach to maintaining a program lifecycle for the COTS equipment as technology matures?

ANSWER: Yes. As stated in Section 4.3.1 (page 29) of the BAA, this proposal “should address mitigation of life-cycle and sustainment risks associated with transitioning intellectual property for U.S. military applications."

20. Section 4.2.2 of the BAA states: “The typical proposal should express a consolidated effort in support of one or more related technical concepts or ideas.” Does this mean performers can bid to a single focus area?

ANSWER: No. As stated in Section 1.1 (page 5) of the BAA, “This BAA solicits responses from proposers that address all three phases of the program. Within the three phases of the program, there are three technology focus areas, and each proposal submitted for consideration under this BAA shall address all focus areas.”

21. Are proposers advised to treat all metrics in these tables as “shall” requirements or can we trust the language of the text to identify which are considered absolute/mandatory requirements and which are not?

ANSWER: The metrics identified in Section 1.2 (page 17) of the BAA are the stated goals of the program and all proposals should identify a path to meeting these objectives.

22. What is the anticipated start date of the program?

ANSWER: The start date depends on a number of factors so an exact date is not known at this time. However, the Government anticipates a notional start date of late FY17.

23. Figure 2 in the BAA is different from the figure on slide 20 of the Proposers Day slides.

Which is the correct version?

ANSWER: See Amendment 0001 for the correct figure. It is also reprinted below for completeness.

24. What assistance can the contractor expect to receive from the Government in seeking the necessary approvals to test and demonstrate the system using classified data on a resulting contract? Is DARPA going to sponsor the project to go through the Risk Management Framework (RMF) with DISA’s CIO? Is DARPA going to be the customer advocate for interfacing with NSA and start the process for a new Protection Profile?

ANSWER: DARPA anticipates working with the contractor to address accreditation issues.

25. Will the Government will also accept commercially developed software if licensing conditions would not add licensing costs to the current program or transition – and still provide for future extensibility?

ANSWER: All proposals will be evaluated against the Evaluation Criteria listed in Section 5.1.

The BAA states on page 35 that “the evaluation will take into consideration the extent to which the proposed intellectual property (IP) rights will potentially impact the Government’s ability to transition technology. The Government encourages proposals that, to the greatest extent possible, are free of IP and data rights restrictions as this will allow for future extensibility and an easier transition at the conclusion of the program.”

26. Who will develop the characteristics of the Phase 3 exercise demonstration?

ANSWER: The Phase 3 demonstration characteristics will be created in conjunction with the performer and the transition partner.

27. Does the Government have specific types of actions in mind for audit? Will the Government require the contractor to supply functionality to search and/or analyze these logs?

ANSWER: While DARPA is not seeking specific audit functions in this BAA, proposers should address the security functions they deem critical to their proposed solution.

28. Does the Government have a more specific measure than “reliable” for communications that occur under conditions of 10% packet loss rate?

ANSWER: All metrics are listed in Section 1.2 of the BAA. There are no additional metrics for “reliable” communications.

29. Approximately how many handheld devices are expected to be provisioned in each trust group?

ANSWER: Section 1.1.3 (page 13) of the BAA states that “performers will be expected to provide at least 50 handheld devices for this demonstration…” The performer will decide allocation among trust groups.

30. Does the Government expect that the Phase 1 teams will work together at all during that phase, or does the Government expect all teams to operate independently?

ANSWER: The team(s) selected for award will work independently, but may share information at their discretion. See Amendment 0001.

31. Does the Government have requirements around the types of data that will be shared in the architecture? In particular, should this data include content that requires higher bandwidth and QOE/QOS (e.g. video)?

ANSWER: Section 1.1.2 (page 12) of the BAA states that the system should have the “ability to support the inclusion of multiple and new applications,” which may include video.

32. Should the 50 handheld devices used in the exercise demonstration be identical make/model?

ANSWER: It is up to the selected performers to choose the hardware for this demonstration.

See Amendment 0001.

33. Can the Government be more specific regarding the extent to which it requires interoperability with existing cross-domain solutions?

ANSWER: Section 1.1.2 (page 12) of the BAA states that desired capabilities in Phase 2 include the “extent to which the system complies with existing cross-domain solutions (e.g. those used by US BICES).” The performer will work with the Government in identifying any additional cross-domain solutions with which the SHARE system would benefit from being compatible.

34. Is all $30.5 million of the advertised budget anticipated to be for Phase 1-3 development contracts or does that budget also include SETA and other program expenses?

ANSWER: Page 3 of the BAA states that the total amount of money to be awarded under this BAA is $30.5 million. This does not include Government team expenses.

35. Is a data-at-rest implementation expected under this effort?

ANSWER: As stated in Section 1.1 (page 6) of the BAA, “performers should also address data-at-rest risks associated with devices supporting multilevel secure architectures.”

36. Is cross-domain accreditation for operational use a goal of this effort, and if so, is the goal to be “Accreditation Ready” at the end of phase 3 or elsewhere?

ANSWER: See question 17.

37. Are SELinux/SEAndroid combined with Linux/Android containerization protections considered sufficient for accreditation of the multi-level data on the device for the SHARE effort?

ANSWER: See question 17.

38. Is it preferable to leverage the much stronger security guarantees afforded by virtualization for accreditation of the multi-level data on the device, which appears to be a direction heavily promoted by NSA in its commercial solutions for classified (CSfC) capability packages and NIAP protection profiles?

ANSWER: See question 17.

39. Will a component of this effort include working with NSA to expand their existing CSfC capability packages to support non-IPSEC networking components for data-in-transit?

ANSWER: It is up to the performer to determine their solution to this problem.

40. Is data / cyber security of a captured device a priority in this effort, and If so what level of protection should be targeted? For example, assuming a sophisticated attacker, how long should the device / data reasonably resist attack?

ANSWER: It is up to the performer to determine their solution to this problem.

41. Without requiring connectivity to the datacenter at all times, is it implied that there must be a cross-domain data guard available on the devices for data transfer between domains that require it?

ANSWER: It is up to the performer to determine their solution to this problem.

42. For Phase 1 is targeting one make/model of handheld mobile device acceptable, if not what should the number be? What about Phase 2 and 3?

ANSWER: See question 32.

43. Who will determine the location of the Phase 3 exercise demonstration? How should this be priced?

ANSWER: See question 8.

44. Can the Government be more specific about what ITAR concerns it is referring to? Is the Government implying that all solutions should be EAR-99, or are there ECCN designations for export that would be acceptable? Can there be different, interoperable versions of the system for US and foreign users?

ANSWER: See question 14.

45. How many Phase 1 awards are contemplated? How many Phase 2 options does the Government anticipate awarding? Is it correct to assume that only one Phase 3 award is anticipated?

ANSWER: See question 6.

46. Are there limitations to non-US persons working on aspects of the project when export control and security clearances are determined to not be a concern (e.g., academic research staff)?

ANSWER: See question 13.

47. In Focus Area 1, page 7, the BAA states that “the performer’s multilevel security approach should support four or more simultaneous security enclaves per device…” Has a maximum number of such enclaves been determined or estimated and if so, what is that maximum number?

ANSWER: See question 2.

48. Can a Canadian University-based, startup submit a proposal?

ANSWER: See question 13.