HR001117S0051-Amendment-01.pdf

Broad Agency Announcement Harnessing Autonomy for Countering Cyber-adversary Systems

(HACCS)

HR001117S0051

August 3, 2017

Amendment 1

Amended on August 23, 2017

Defense Advanced Research Projects Agency Information Innovation Office 675 North Randolph Street Arlington, VA 22203-2114

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 2

Table of Contents

I. Funding Opportunity Description

A. Background

B. Program Scope

C. Program Structure

D. Technical Areas

E. Program Phases and Metrics

F. Schedule and Milestones

G. Deliverables

H. Government-Furnished Property/Equipment/Information

I. Intellectual Property

J. Security Clearance Requirements

II. Award Information

A. Awards

B. Fundamental Research

C. Disclosure of Information and Compliance with Safeguarding Covered Defense Information Controls

III. Eligibility Information

A. Eligible Applicants

B. Organizational Conflicts of Interest

C. Cost Sharing/Matching

D. Other Eligibility Requirements

IV. Application and Submission Information

A. Address to Request Application Package

B. Content and Form of Application Submission

C. Submission Date and Time

D. Funding Restrictions

E. Other Submission Requirements

V. Application Review Information

A. Evaluation Criteria

B. Review and Selection Process

VI. Award Administration Information

A. Selection Notices

B. Administrative and National Policy Requirements

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 3

C. Reporting

VII. Agency Contacts

VIII. Other Information

A. Frequently Asked Questions (FAQs)

B. Collaborative Efforts/Teaming

C. Proposers Day

D. Submission Checklist

E. Associate Contractor Agreement Clause (ACA)

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 4

PART I: OVERVIEW INFORMATION

Federal Agency Name: Defense Advanced Research Projects Agency (DARPA), Information Innovation Office (I2O)

Funding Opportunity Title: Harnessing Autonomy for Countering Cyber-adversary Systems (HACCS)

Announcement Type: Initial Announcement

Funding Opportunity Number: HR001117S0051

Catalog of Federal Domestic Assistance Numbers (CFDA): Not Applicable

Dates o Posting Date: August 03, 2017 o Proposers Day: July 31, 2017 o Proposal Due Date: October 1 September 29, 2017, 12:00 noon (ET) o BAA Closing Date: October 1 September 29, 2017, 12:00 noon (ET)

Anticipated Individual Awards: There are multiple technical areas (TAs) for this solicitation. Currently, DARPA anticipates multiple awards in TA1, TA2 and TA3; and a single award for TA4.

Types of Instruments that May be Awarded: Procurement contracts

Agency Contacts o Technical POC: Dr. Angelos Keromytis, Program Manager, DARPA/I2O o BAA Email: HACCS@darpa.mil o BAA Mailing Address:

DARPA/I2O

ATTN: HR001117S0051

675 North Randolph Street Arlington, VA 22203-2114 o I2O Solicitation Website: http://www.darpa.mil/work-with-us/opportunities mailto:HACCS@darpa.mil http://www.darpa.mil/work-with-us/opportunities

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 5

PART II: FULL TEXT OF ANNOUNCEMENT

I. Funding Opportunity Description

DARPA is soliciting innovative research proposals in the area of automated techniques and software tools for neutralizing cyber-adversary infrastructure. The goal of the Harnessing Autonomy for Countering Cyber-adversary Systems (HACCS) program is to develop technologies for accurately identifying malicious cyber-adversary infiltrated networks, generating reliable software exploits for large numbers of known (n-day) vulnerabilities, and creating effective autonomous software agents that can be inserted in the compromised networks via the n-day exploits to safely and reliably neutralize cyber-adversary software agents.

Proposed research should investigate innovative approaches that enable revolutionary advances in science, devices, or systems. Specifically excluded is research that primarily results in evolutionary improvements to the existing state of practice.

This Broad Agency Announcement (BAA) is being issued, and any resultant selection will be made, using procedures under Federal Acquisition Regulation (FAR) 6.102(d)(2) and 35.016.

Any negotiations and/or awards will use procedures under FAR 15.4. Proposals received as a result of this BAA shall be evaluated in accordance with evaluation criteria specified herein through a scientific review process.

DARPA BAAs are posted on the Federal Business Opportunities (FBO) website (https://www.fbo.gov/).

The following information is for those wishing to respond to this BAA.

A. Background

Malicious actors are currently able to compromise and use with impunity large numbers of devices owned and operated by third parties. Such collections of compromised and conscripted devices, commonly referred to as botnets, are used for criminal, espionage, and computer network attack purposes (often a combination of all three). Recent examples of botnets and similar malicious code include Mirai, Hidden Cobra, WannaCry, and Petya/NotPetya. The potential scale of their effects make such malware a national security threat. The May 11, 2017, Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure specifically identifies botnets as a high priority national security issue.

Improving the security posture of Department of Defense (DoD) networks alone is insufficient to counter such threats to national security, as the majority of botnet nodes reside in neutral networks (“gray space”). Current incident response methods are too resource- and time-consuming to address the problem at scale. Active defense methods are insufficiently precise and predictable in their behavior, posing a risk that they may cause processing issues or other side effects. What is needed is the ability to identify and neutralize botnets and other large-scale malware from compromised devices and networks in a scalable, timely, safe, and reliable manner, in accordance with appropriate privacy and other legal authorities. To achieve the necessary scale and timeliness, such a capability must be effective even if the owners of botnet-conscripted networks are unaware of the infection and are not actively participating in the neutralization process.

https://www.fbo.gov/

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 6

B. Program Scope

The HACCS program will investigate the feasibility of creating safe and reliable autonomous software agents that can effectively counter malicious botnet implants and similar large-scale malware. The program will do so by developing a quantitative framework and established parameters for their safe, reliable, and effective use. HACCS performers will develop the techniques and algorithms necessary to measure the accuracy of identifying botnet-infected networks, the accuracy of identifying the type of devices residing in a network, and the stability of potential access vectors. The program will take an experimental approach to verify the implementation of such autonomous agents and the rules under which they operate, and to measure the effectiveness of denying, degrading, and disrupting botnets and individual botnet implants without affecting the systems and networks on which they reside.

The program seeks to:

Accurately identify and fingerprint botnet-conscripted networks to determine the presence of botnet implants, the number and types of devices present on said networks, and the software services running on these devices with sufficient precision to infer the presence of known vulnerabilities (also referred to as “n-day” vulnerabilities);

Generate non-disruptive software exploits for a large number of known vulnerabilities that can be used to establish initial presence in each botnet-conscripted network without affecting legitimate system functionality; and

Create high-assurance software agents that safely, reliably, and autonomously navigate within botnet-conscripted networks, identify botnet implants, and neutralize them or otherwise curtail their ability to operate, while minimizing side effects to these neutral systems and infrastructure.

C. Program Structure

Proposers may only submit one proposal as lead institution to the HACCS program. Each proposal may cover one or more technical areas (TAs). Proposers may include extra pages for each additional TA addressed in the technical approach (See Section IV.B.1.a).

The program is divided into four TAs that will be working in parallel, starting at program kickoff, and will span three 16-month phases. TA1 performers will develop technologies for accurately finding and fingerprinting botnet infrastructure. TA2 performers will develop technologies for non-disruptive autonomous agent(s) insertion into botnet-conscripted or otherwise compromised networks. TA3 performers will focus on the generation of verifiably safe and reliable autonomous agent(s). TA4 performers will focus on system integration.

The selected HACCS performers are required to collaborate with each other. The Government has determined that an Associate Contractor Agreement (ACA) is necessary to help facilitate an open exchange of information and ensure complete compatibility between software components, the system architecture, equipment, data and other program elements to prevent unnecessary duplication of effort, and to maximize commonality to guarantee appropriate coordination and integration of work. All selected performers will be required to have their ACAs in place prior to the program kick-off meeting.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 7

The Government will assess performer progress with regular technology evaluations and adversarial engagements driven by specific operational scenarios. The operational scenarios may incorporate red teams, U.S. Government cyber operators, and other elements. DARPA encourages technical efforts that allow for flexibility in testing and evaluation, to take advantage of opportunities to access data sets under time constraints, while permitting long-term research and development.

Proposers addressing TA1, TA2, or TA3 are not required to hold or obtain security clearances, but having personnel with Top Secret clearances that are eligible for Sensitive Compartmented Information (SCI) will be viewed positively. It is preferable (but not required) that the Principal Investigator in each TA1, TA2, and TA3 proposal be cleared at that level. Academic and small company participation is explicitly encouraged, regardless of possession of a security clearance.

At the time of proposal submission, all proposers wishing to submit proposals under TA4 must have some personnel with a Top Secret clearance that are eligible for SCI. It is preferable (but not required) that the Principal Investigator in TA4 proposals be cleared at that level.

D. Technical Areas

There are four TAs within the HACCS program:

Find and Fingerprint Botnet Infrastructure (TA1) Insert Autonomous Agents into Gray Networks (TA2) Identify and Neutralize Botnet Implants (TA3) Integration (TA4)

Find and Fingerprint Botnet Infrastructure (TA1):

TA1 performers will develop techniques and systems for identifying the command-and-control (C2), attack, and other activity traffic of botnet nodes and other compromised networks. Such activities and C2 traffic may be stealthy or evasive in nature. TA1 performers will also develop techniques for fingerprinting botnet-conscripted networks to determine the number and types of devices on those networks, and the version(s) of software running on these devices. The latter is expected to be used by transition partners to identify unpatched or misconfigured software that could be used to gain access to the botnet-conscripted networks.

The technologies developed by TA1 performers may use a combination of active, passive, and indirect device enumeration and traffic analysis techniques, along with existing relevant data sets (commercially available or open source). Of particular interest are techniques that associate specific versions of software with corresponding uniquely identifiable, network-observable activity. Also of interest are techniques for fingerprinting a “black box” device (i.e., one for which the software/firmware itself is not directly available or known). Proposers are also expected to address issues relating to the use of Network Address Translation (NAT, including Carrier-Grade NAT), Virtual Private Networks (VPNs), and Internet Protocol version 6 (IPv6).

The primary challenges for TA1 are the accuracy, scale, and speed of botnet identification and device characterization. DARPA will facilitate access to relevant data sources by leveraging both commercial and USG relationships and data exchange agreements. Proposers are encouraged to propose their own data sources and methods, and to identify their data needs

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 8 concretely.

TA1 proposals should at a minimum address the following topics:

1. Botnets often contain evasive and/or covert command and control channels. Proposers should discuss how their solutions would identify and consistently uncover such command and control channels. Proposers should describe how their approach would detect a new botnet and identify all of its nodes.

2. Botnets are most effective when they have the largest distributed footprint. Proposers should discuss how their solutions will identify appropriate datasets used in identifying botnet infrastructure, and validate the ability to detect coordinated and distributed activities conducted by botnets.

3. The malicious effects of a botnet are often employed over a short period of time necessitating the detection of an attack in real-time or near real-time. Proposers should discuss how their solutions will achieve rapid identification of the botnet nodes.

4. Depending on the applicable rules of operation for the TA3-generated autonomous agent, certain types of networks or devices may be deemed out of bounds. Proposers should discuss how they can provide the necessary information for enabling autonomous agents to abide by such rules of operation.

5. Accuracy of botnet detection and device fingerprinting are essential to the success of the program. Proposers should discuss how they will evaluate their proposed technologies, and their plan to meet the targets for each program phase (see Section I.E).

Insert Autonomous Agents into Gray Networks (TA2):

TA2 performers will develop techniques and systems for generating non-disruptive exploits using available information about known (n-day) vulnerabilities. These exploits will be used to insert TA3-generated autonomous agents into botnet-infected networks, and to enable the lateral movement and operation of these agents within these networks.

This information may be limited to an English-language description of the vulnerability, a semi-structured entry in a database, or a piece of software or input for testing the presence of such a vulnerability. The vulnerability descriptions found in the National Vulnerability Database (NVD) are a good starting point for considering techniques responsive to the requirements of this TA. The primary challenges for TA2 will be scaling vulnerability discovery and exploit generation to complex software running on real operating systems, extending software reasoning systems and technologies to support analysis of classes of vulnerabilities beyond memory corruption, and accurately characterizing the stability and potential side effects of the generated exploits. Types of bugs and classes of vulnerability beyond memory corruption that are of interest include, but are not limited to, web and mobile application vulnerabilities, privilege confusion and/or escalation, and credential reuse. Proposers should describe the classes of vulnerability that they will investigate and justify their selection in the context of the broader program.

TA2 proposals should at a minimum address the following topics:

1. Vulnerability information is often made available in the form of unstructured data.

Proposers should describe how their solutions would extract semantic meaning from

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 9 public repositories of such information.

2. Techniques for identifying vulnerabilities unique to botnet implants will be essential for neutralizing such malware. In addition, embedded computing devices co-resident with botnet-conscripted devices can provide unique vantage points for countering malicious botnet implants. Proposers should explain how their proposed solution would develop autonomous agent insertion techniques specific Internet of Things (IoT) devices. Also of interest are techniques that leverage the use of cloud computing by co-resident devices as a means of inserting autonomous agents on said devices.

3. Proposers should explain how their technologies will generate insertion techniques (e.g., exploits) that are stable, safe, reliable, and non-disruptive, even in the presence of devices that are incorrectly fingerprinted. Of particular interest are techniques for measuring the effect of exploits on inserted software.

Identify and Neutralize Botnet Implants (TA3):

TA3 performers will develop techniques and systems for generating autonomous agents that can safely, reliably, and autonomously navigate within partially known or fully unknown networks toward each device controlled by a malicious botnet implant. TA2-generated n-day exploits will enable the insertion of these agents. TA2-generated n-day exploits, or other bugs (e.g., credential reuse) may also facilitate the lateral movement of the agents within the botnet-conscripted network. The agent may be able to gain access to the infected device(s), or achieve a vantage point from which to suppress the network traffic (e.g., command-and-control activity) of the malicious implant. Strong proposals will address techniques for guaranteeing the correct and safe operation of the agents, and for enabling the clean termination of such agents when their task is completed or when they determine that the network they were inserted in is botnet-free.

Stealthy operation is not a priority for the TA3-generated agents.

The primary challenges for TA3 will be enabling safe and effective autonomy of the agents, and providing correct-by-construction or equivalent assurances to agent generation and operation, with particular attention paid to avoiding or minimizing-and-quantifying disruption of the systems and networks infected by malicious botnet implants.

TA3 proposals should at a minimum address the following topics:

1. Agents must be capable of autonomous lateral movement, operation, and short-term persistence in partially known or fully unknown heterogeneous environments. Proposals should describe methods for achieving such autonomy.

2. Accurate evaluation of the overall effectiveness, safety, and reliability of agent autonomy will be essential. Strong proposals will describe metrics that will enable evaluation.

3. Proposals should address correctness of agent implementation, and correctness of rules of operation, including lateral movement boxing and terminating conditions for agents.

Integration (TA4):

TA4 performers will provide the unifying framework (or integrate into an existing one) for the components developed by the performers in the first three TAs, and will implement other necessary capabilities such as the actual neutralization effects that will be used against the

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 10 malicious botnet implants. The integrator will also act as the Voice-of-the-Offense for the program, and will coordinate testing and evaluation of the system components and the integrated system, possibly in conjunction with existing DoD cyber exercises. DARPA anticipates the integrator to primarily act in the Voice-of-the-Offense role during the first half of the program, with the bulk of the integration work occurring in the second half. DARPA strongly encourages proposers to offer up to two successive 12-month options for integration work that will take place beyond the 4-year research and development portion of the program.

TA4 proposals should at a minimum address the following topics:

1. The final HACCS system will likely require seamless access to multiple public, commercial, and/or Government-generated sources of information. Proposals should describe how such potentially heterogeneous sources would be integrated.

2. Exercises and close interaction with transition partners will be an essential element of the HACCS program. Proposals should discuss approaches for enabling participation in relevant cyber exercises and supporting potential transition partner interactions.

3. As the Voice-of-the-Offense, the TA4 Integration performer will be ultimately responsible for the quantitative as well as qualitative evaluation of the HACCS system.

Strong proposals will discuss meaningful metrics and methods for evaluating the overall effectiveness of this effort.

E. Program Phases and Metrics

The HACCS program is divided into three 16-month phases. TA4 proposals should include two optional, successive, 12-month option phases beginning at the end of Phase 3, which will allow time for transition efforts expected to continue past the official program end date. All proposers should expect to work in parallel with an increasing level of realism and scale.

Provided below are metrics indicative of expected progress. Proposers are encouraged to provide additional metrics, as appropriate for their technical approach and methodology.

Technical Area 1 Phase 1 Characterize 5% of the global IP address space

80% accuracy of botnet detection and network fingerprinting Phase 2 Characterize 25% of IP address space

90% accuracy Phase 3 Characterize 80% of IP address space

95% accuracy

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 11

Technical Area 2 Phase 1 10 n-day exploit instances

1 additional vulnerability class Phase 2 100 n-day exploit instances

2 additional vulnerability classes Phase 3 1,000 n-day exploit instances

2 additional vulnerability classes

Technical Area 3 Phase 1 Demonstrate lateral movement and effect in 10 computer-simulated topologies 30% of autonomous agent code verified

Phase 2 1,000 computer-simulated topologies 75% of autonomous agent code verified Formally specified Rules of Operation

Phase 3 10,000 computer-simulated topologies 95% of autonomous agent code verified Formally verified Rules of Operation

Technical Area 4 Phase 1 Voice-of-the-Offense Phase 2 Design and implement integration framework Phase 3 Demonstrate system in DoD exercise

F. Schedule and Milestones

For each year of the effort, there will be quarterly meetings with the DARPA technical team, which include two site visits and two Principal Investigator (PI) meetings. During these reviews, DARPA will assess progress toward solution via performer briefings, technical discussions, demonstrations, and informal end‐of‐phase evaluations based on the target goals of each phase.

PI meetings will focus on open technical exchange that includes discussion of difficulties encountered and possible solutions. The goals of the PI meetings will be to: (a) review and share innovations/accomplishments of the program; (b) review and discuss plans and options for technology demonstrations and prototypes; (c) review and discuss results from meetings and events conducted prior to the tests and evaluations; (d) demonstrate prototypes; and (e) plan for the next six‐month period.

The Government will specify the locations for the technical interchanges, PI meetings, and other events. For budgeting purposes, assume the locations of the two PI meetings held each year will be in the Washington, D.C. metro area. In addition to site visits, regular meetings are encouraged to enhance communication and collaborations, as required, among the performers.

Should important issues arise between program reviews, the Government team will be available to support informal interim meetings and teleconferences.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 12

Proposals should include a detailed schedule that is consistent with the maturity of their approaches and the risk reduction required for their concepts, and their program plan. These schedules will be synchronized across performers, as required, and monitored and revised as necessary, throughout the program’s period of performance. A start date of April 2, 2018, should be assumed for budgeting purposes. Subject to the availability of funding, the program is intended to last for four (4) years.

G. Deliverables

Performers are responsible for providing, at a minimum, the following deliverables, as applicable:

Slide Presentations – Annotated slide presentations will be submitted within two weeks after program kick‐off meeting and after each review.

Monthly Coordination Reports – A monthly technical coordination report describing progress made, resources expended, and any issues requiring the attention of the Government team will be provided within 10 days after the end of each month. Monthly expenditure reports and uploading of required deliverables to the DARPA TFIMS-2 reporting system are required by all program performers.

Software – All computer software developed or delivered under the program shall be delivered as source (including entire version control history) and as object (executable) code. Include the source listings and source code for the target computer systems.

Delivered software under this effort is to be completely maintainable and modifiable with no reliance on any non‐delivered computer programs or documentation.

Software Documentation – Software documentation shall be provided within one month after the end of each phase documenting source code, algorithm description documentation, hardware description language specifications, system diagrams, part numbers and other data necessary to maintain and to produce copies of the software.

Hardware – At the conclusion of the last phase, all hardware procured or developed under the program shall be delivered. The delivery is to include sufficient documentation so as to be completely operable, maintainable and modifiable with no reliance on any non‐delivered hardware or hardware documentation developed or procured under the program.

Final Technical Report – The final report, due at contract completion, will concisely summarize the effort conducted and provide any lessons learned during the development of the technology.

H. Government-Furnished Property/Equipment/Information

Proposals should clearly state any assumptions regarding the use of proposed Government test facilities and capabilities, as well as any proposed Government Furnished Equipment (GFE) used as part of their development, test, and evaluation approach. The Government does not guarantee availability of any proposed GFE, so proposers should address alternatives to prepare for any eventuality.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 13

I. Intellectual Property

The program will emphasize creating and leveraging open source technology and architecture.

Intellectual property rights asserted by proposers are strongly encouraged to be aligned with open source regimes.

A key goal of the program is to establish an open, standards-based, multi-source, plug-and-play architecture that allows for interoperability and integration. This includes the ability to easily add, remove, substitute, and modify software and hardware components. This will facilitate rapid innovation by providing a base for future users or developers of program technologies and deliverables. Therefore, it is desired that all noncommercial software (including source code), software and algorithm description documentation, hardware designs and documentation, and technical data generated by the program be provided as deliverables to the Government, with a minimum of Government Purpose Rights (GPR), as lesser rights may adversely impact the lifecycle costs of affected items, components, or processes. See Section VI.B.2 for more details on intellectual property.

J. Security Clearance Requirements

See Section III.D.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 14

II. Award Information

A. Awards

Multiple awards are anticipated. The level of funding for individual awards made under this solicitation has not been predetermined and will depend on the quality of the proposals received and the availability of funds. Awards will be made to proposers whose proposals are determined to be the most advantageous and provide the best value to the Government, all factors considered, including the potential contributions of the proposed work, overall funding strategy, and availability of funding. See Section V for further information.

The Government reserves the right to:

select for negotiation all, some, one, or none of the proposals received in response to this solicitation;

make awards without discussions with proposers;

conduct discussions with proposers if it is later determined to be necessary;

segregate portions of resulting awards into pre-priced options;

accept proposals in their entirety or to select only portions of proposals for award;

fund proposals in increments and/or with options for continued work at the end of one or more phases;

request additional documentation once the award instrument has been determined (e.g., representations and certifications); and remove proposers from award consideration should the parties fail to reach agreement on award terms within a reasonable time or the proposer fails to provide requested additional information in a timely manner.

Proposals selected for award negotiation will result in a procurement contract. No other types of contract vehicle will be considered.

In all cases, the Government contracting officer shall have sole discretion to select award instrument type, regardless of instrument type proposed, and to negotiate all instrument terms and conditions with selectees. DARPA will apply publication or other restrictions, as necessary, if it determines that the research resulting from the proposed effort will present a high likelihood of disclosing performance characteristics of military systems or manufacturing technologies that are unique and critical to defense. Any award resulting from such a determination will include a requirement for DARPA permission before publishing any information or results on the program. For more information on publication restrictions, see the section below on Fundamental Research.

B. Fundamental Research

It is DoD policy that the publication of products of fundamental research will remain unrestricted to the maximum extent possible. National Security Decision Directive (NSDD) 189 defines fundamental research as follows:

‘Fundamental research’ means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 15 community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons.

As of the date of publication of this BAA, the Government expects that program goals as described herein may be met by proposers intending to perform fundamental research and proposers not intending to perform fundamental research or the proposed research may present a high likelihood of disclosing performance characteristics of military systems or manufacturing technologies that are unique and critical to defense. Based on the nature of the performer and the nature of the work, the Government anticipates that some awards will include restrictions on the resultant research that will require the awardee to seek DARPA permission before publishing any information or results relative to the program.

Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not. While proposers should clearly explain the intended results of their research, the Government shall have sole discretion to select award instrument type and to negotiate all instrument terms and conditions with selectees. Appropriate clauses will be included in resultant awards for non-fundamental research to prescribe publication requirements and other restrictions, as appropriate. This clause can be found at www.darpa.mil/work-with-us/additional-baa.

For certain research projects, it may be possible that although the research being performed by the awardee is restricted research, a subawardee may be conducting fundamental research. In those cases, it is the awardee’s responsibility to explain in their proposal why its subawardee’s effort is fundamental research

C. Disclosure of Information and Compliance with Safeguarding Covered Defense Information Controls

The following provisions and clause apply to all solicitations and contracts; however, the definition of “controlled technical information” clearly exempts work considered fundamental research and therefore, even though included in the contract, will not apply if the work is fundamental research.

DFARS 252.204-7000, “Disclosure of Information” DFARS 252.204-7008, “Compliance with Safeguarding Covered Defense Information Controls” DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting”

The full text of the above solicitation provision and contract clauses can be found at http://www.darpa.mil/work-with-us/additional-baa#NPRPAC.

Compliance with the above requirements includes the mandate for proposers to implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see https://doi.org/10.6028/NIST.SP.800-171r1) that are in effect at the time the BAA is issued, or as authorized by the Contracting Officer, not later than December 31, 2017.

http://www.darpa.mil/work-with-us/additional-baa http://www.darpa.mil/work-with-us/additional-baa#NPRPAC https://doi.org/10.6028/NIST.SP.800-171r1

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 16

For awards where the work is considered fundamental research, the contractor will not have to implement the aforementioned requirements and safeguards; however, should the nature of the work change during performance of the award, work not considered fundamental research will be subject to these requirements.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 17

III. Eligibility Information

A. Eligible Applicants

DARPA welcomes engagement from all responsible sources capable of satisfying the Government's needs, including academia (colleges and universities); businesses (large, small, small disadvantaged, etc.); other organizations (including non-profit); entities (foreign, domestic, and government); FFRDCs; minority institutions; and others.

DARPA welcomes engagement from non-traditional sources in addition to current DARPA performers.

1. Federally Funded Research and Development Centers (FFRDCs) and Government Entities

a. FFRDCs FFRDCs are subject to applicable direct competition limitations and cannot propose to this BAA in any capacity unless they meet the following conditions: (1) FFRDCs must clearly demonstrate that the proposed work is not otherwise available from the private sector. (2) FFRDCs must provide a letter on official letterhead from their sponsoring organization citing the specific authority establishing their eligibility to propose to Government solicitations and compete with industry, and their compliance with the associated FFRDC sponsor agreement’s terms and conditions. This information is required for FFRDCs proposing to be awardees or subawardees.

b. Government Entities Government Entities (e.g., Government/National laboratories, military educational institutions, etc.) are subject to applicable direct competition limitations. Government entities must clearly demonstrate that the work is not otherwise available from the private sector and provide written documentation citing the specific statutory authority and contractual authority, if relevant, establishing their ability to propose to Government solicitations.

c. Authority and Eligibility At the present time, DARPA does not consider 15 U.S.C. § 3710a to be sufficient legal authority to show eligibility. While 10 U.S.C.§ 2539b may be the appropriate statutory starting point for some entities, specific supporting regulatory guidance, together with evidence of agency approval, will still be required to fully establish eligibility. DARPA will consider FFRDC and Government entity eligibility submissions on a case-by-case basis; however, the burden to prove eligibility for all team members rests solely with the proposer.

2. Foreign Participation Non-U.S. organizations and/or individuals may participate to the extent that such participants comply with any necessary nondisclosure agreements, security regulations, export control laws, and other governing statutes applicable under the circumstances.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 18

B. Organizational Conflicts of Interest

FAR 9.5 Requirements In accordance with FAR 9.5, proposers are required to identify and disclose all facts relevant to potential OCIs involving the proposer’s organization and any proposed team member (subawardee, consultant). Under this Section, the proposer is responsible for providing this disclosure with each proposal submitted to the BAA. The disclosure must include the proposer’s, and as applicable, proposed team member’s OCI mitigation plan. The OCI mitigation plan must include a description of the actions the proposer has taken, or intends to take, to prevent the existence of conflicting roles that might bias the proposer’s judgment and to prevent the proposer from having unfair competitive advantage. The OCI mitigation plan will specifically discuss the disclosed OCI in the context of each of the OCI limitations outlined in FAR 9.505-1 through FAR 9.505-4.

Agency Supplemental OCI Policy In addition, DARPA has a supplemental OCI policy that prohibits contractors/performers from concurrently providing Scientific Engineering Technical Assistance (SETA), Advisory and Assistance Services (A&AS) or similar support services and being a technical performer.

Therefore, as part of the FAR 9.5 disclosure requirement above, a proposer must affirm whether the proposer or any proposed team member (subawardee, consultant) is providing SETA, A&AS, or similar support to any DARPA office(s) under: (a) a current award or subaward; or (b) a past award or subaward that ended within one calendar year prior to the proposal’s submission date.

If SETA, A&AS, or similar support is being or was provided to any DARPA office(s), the proposal must include:

The name of the DARPA office receiving the support;

The prime contract number;

Identification of proposed team member (subawardee, consultant) providing the support; and An OCI mitigation plan in accordance with FAR 9.5.

Government Procedures In accordance with FAR 9.503, 9.504 and 9.506, the Government will evaluate OCI mitigation plans to avoid, neutralize or mitigate potential OCI issues before award and to determine whether it is in the Government’s interest to grant a waiver. The Government will only evaluate OCI mitigation plans for proposals that are determined selectable under the BAA evaluation criteria and funding availability.

The Government may require proposers to provide additional information to assist the Government in evaluating the proposer’s OCI mitigation plan.

If the Government determines that a proposer failed to fully disclose an OCI; or failed to provide the affirmation of DARPA support as described above; or failed to reasonably provide additional information requested by the Government to assist in evaluating the proposer’s OCI mitigation plan, the Government may reject the proposal and withdraw it from consideration for award.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 19

C. Cost Sharing/Matching

Cost sharing is not required; however, it will be carefully considered where there is an applicable statutory condition relating to the selected funding instrument (e.g., OTs under the authority of 10 U.S.C. § 2371).

D. Other Eligibility Requirements

1. Ability to Receive Awards in Multiple Technical Areas - Conflicts of Interest While proposers may submit proposals for all four technical areas, proposers selected for TA4 cannot be selected for any portion of the other three technical areas, whether as a prime, subcontractor, or in any other capacity from an organizational to individual level. This is to avoid OCI situations between the technical areas. The decision as to which proposal to consider for award is at the discretion of the Government.

2. Ability to Support Classified Development Proposers addressing either TA1, TA2, or TA3 are not required to hold or obtain security clearances. Future TA1, TA2, and TA3 performers may benefit from having a Principal Investigator that has a Top Secret clearance and is eligible for Sensitive Compartmented Information (SCI), but it is not required and having or not having cleared personnel will not be considered during TA1-3 evaluations. Academic and small company participation is explicitly encouraged, regardless of any possession of a security clearance.

At the time of proposal submission, all proposers wishing to submit proposals under TA4 must have some personnel with a Top Secret clearance that are eligible for SCI. It is preferable (but not required) that the Principal Investigator in TA4 proposals be cleared at that level.

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 20

IV. Application and Submission Information

A. Address to Request Application Package

This document contains all information required to submit a response to this solicitation. No additional forms, kits, or other materials are needed except as referenced herein. No request for proposal (RFP) or additional solicitation regarding this opportunity will be issued, nor is additional information available except as provided at the Federal Business Opportunities website (https://www.fbo.gov), or referenced herein.

B. Content and Form of Application Submission

1. Proposals Proposals consist of Volume 1: Technical and Management Proposal (including mandatory Appendix A, optional Appendix B, and optional classified Appendix C); Volume 2: Cost Proposal; and the Level of Effort Summary by Task Excel spreadsheet.

All pages shall be formatted for printing on 8-1/2 by 11-inch paper with 1-inch margins, single-line spacing, and a font size not smaller than 12 point. Font sizes of 8 or 10 point may be used for figures, tables, and charts. Document files must be in .pdf, .odx, .doc, .docx, .xls, or .xlsx formats. Submissions must be written in English. All pages of Volume 1 should be numbered.

A summary slide of the proposed effort, in PowerPoint™ format, should be submitted with the proposal. A template slide is provided as a new attachment to the BAA. Submit this PowerPoint™ file in addition to Volumes 1 and 2 of your full proposal, and the Level of Effort Summary by Task Excel™ spreadsheet. This summary slide does not count towards the total page count.

Reminder – Proposals may address any combination of technical areas.

Proposals not meeting the format prescribed herein may not be reviewed.

a. Volume 1: Technical and Management Proposal The maximum page count for Volume 1 is 30 pages with a required minimum of 10 technical pages (Technical Approach section), including all figures, tables and charts but not including the cover sheet, table of contents, references, or appendices. A proposal responsive to more than one technical area may include 10 additional technical pages per additional technical area (e.g., a proposal for two technical areas has a maximum allowed page count of 40 pages). Each technical area submission must be able to stand on its own merit and be evaluated independently, with its own statement of work. DARPA may select individual components from a proposal, and thus the technical work and cost breakdown must be clearly delineated along technical area boundaries within each proposal. A submission letter is optional and is not included in the page count. Appendix A does not count against the page limit and is mandatory.

Appendix B does not count against the page limit and is optional. Additional information not explicitly called for here must not be submitted with the proposal, but may be included https://www.fbo.gov/

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 21 in the bibliography in Appendix B. Such materials will be considered for the reviewers’ convenience only and not evaluated as part of the proposal.

Appendix C does count against the page limit and is optional. Appendix C must arrive at DARPA via appropriate channels by the proposal due date.

Volume 1 must include the following components:

i. Cover Sheet: Include the following information.

Label: “Proposal: Volume 1” BAA number (HR001117S0051) Technical Area(s) Proposal title Lead organization (prime contractor) name Type of organization, selected from the following categories: Large Business, Small Disadvantaged Business, Other Small Business, HBCU, MI, Other Educational, or Other Nonprofit

Technical point of contact (POC) including name, mailing address, telephone, and email

Administrative POC including name, mailing address, telephone number, and email address

Security POC including name, mailing address, telephone number, and email address and Commercial and Government Entity (CAGE) code (if different than proposing entities CAGE)

Award instrument requested: procurement contract (specify type) Total amount of the proposed effort Place(s) and period(s) of performance Other team member (subcontractors and consultants) information (for each, include Technical POC name, organization, type of organization, mailing address, telephone number, and email address)

Proposal validity period (minimum 120 days) Data Universal Numbering System (DUNS) number1 Taxpayer identification number2 Commercial and Government Entity (CAGE) code3 Proposer’s reference number (if any)

ii. Table of Contents

iii. Executive Summary: Provide a synopsis of the proposed project, including 1 The DUNS number is used as the Government's contractor identification code for all procurement-related activities. Go to http://fedgov.dnb.com/webform/index.jsp to request a DUNS number (may take at least one business day). For further information regarding this subject, please see www.darpa.mil/work-with-us/additional-baa for further information.

2 See http://www.irs.gov/businesses/small/international/article/0,,id=96696,00.html for information on requesting a TIN. Note, requests may take from 1 business day to 1 month depending on the method (online, fax, mail).

3 A CAGE Code identifies companies doing or wishing to do business with the Federal Government. For further information regarding this subject, please see www.darpa.mil/work-with-us/additional-baa.

http://fedgov.dnb.com/webform/index.jsp http://www.darpa.mil/work-with-us/additional-baa http://www.darpa.mil/work-with-us/additional-baa http://www.irs.gov/businesses/small/international/article/0,,id=96696,00.html http://www.darpa.mil/work-with-us/additional-baa

HR001117S0051 HARNESSING AUTONOMY FOR COUNTERING CYBER-ADVERSARY SYSTEMS (HACCS) 22 answers to the following questions:

What is the proposed work attempting to accomplish or do?

How is it done today, and what are the limitations?

Who or what will be affected and what will be the impact if the work is successful?

How much will it cost, and how long will it take?

The executive summary should include a description of the key technical challenges, a concise review of the technologies proposed to overcome these challenges and achieve the project’s goal, and a clear statement of the novelty and uniqueness of the proposed work.

iv. Innovative Claims and Deliverables: Describe the innovative aspects of the project in the context of existing capabilities and approaches, clearly delineating the uniqueness and benefits of this project in the context of the state of the art, alternative approaches, and other projects from the past and present. Describe how the proposed project is revolutionary and how it significantly rises above the current state of the art.

Describe the deliverables associated with the proposed project and any plans to commercialize the technology, transition it to a customer, or further the work.

Discuss the mitigation of any issues related to sustainment of the technology over its entire lifecycle, assuming the technology transition plan is successful.

v. Technical Plan: Outline and address technical challenges inherent in the approach and possible solutions for overcoming potential problems. Demonstrate a deep understanding of the technical challenges and present a credible (even if risky) plan to achieve the project’s goal. Discuss mitigation of technical risk. Provide appropriate measurable milestones (quantitative if possible) at intermediate stages of the project to demonstrate progress, and a plan for achieving the milestones.

vi. Management Plan: Provide a summary of expertise of the proposed team, including any subcontractors/consultants and key personnel who will be executing the work. Resumes count against the proposal page limit so proposers may wish to include them in Appendix B below.