IDAS-CUI-Guide_-_Final.pdf

Distribution A: Approved for Public Release: distribution unlimited

Controlled Unclassified Information Guide

Program: Intent-Defined Adaptive Software (IDAS)

Program Manager: Mr. Jacob Torrey

Program Security Officer: Ms. Denice Holden

Date: June 5, 2019

Version: 1.0

1 Background

The IDAS program seeks to research and develop a new approach to engineering software that enables rapid adaptation of software to changes in requirements and/or computational resources, by automatically synthesizing new source code and binaries to address such changes. In practice, these changes are a common occurrence. The program will develop new methods for representing the intent of the software and its abstract constraints separately from its concrete instantiation. This will reduce development and maintenance costs by at least an order of magnitude, enabling DoD to sustain and improve operational capabilities dependent on software.

2 Purpose This guide identifies those aspects of the program that performers must handle as Controlled Technical Information (CTI). In addition, each performer must determine and assert the export controls (either Export Administration Regulations or International Traffic in Arms Regulations) relevant to their project, and communicate that assertion to their contracting agent and to the DARPA Program Manager.

Questions concerning the content and interpretation of this guide and/or recommendations for changes due to current conditions, progress made in program research, scientific technological developments, advances in state of the art, or other factors should be directed to the DARPA Program Manager. All users of this guide are encouraged to assist in improving its currency and adequacy.

3 Definition of Controlled Technical Information for the Program DOD considers “technical information” to be technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software code. Note that such technical information may or may not be controlled (i.e., CTI), depending on whether it has military or space application.

Controlled Technical Information (CTI) is defined as technical information with military or space application that is subject to controls on its access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. The term CTI does not include information that is lawfully publicly available without restrictions.

For the IDAS Program, DARPA considers that all documentation, system outputs, test results and work products related to the application of any program-developed algorithm, technique, or capability to a militarily relevant platform to be minimum CTI. Such detailed technical information could reveal sensitive or even classified capabilities and/or vulnerabilities of that military platform.

4 Safeguarding & Marking CTI The Contractor shall not release CTI to anyone outside the Contractor’s organization or to a Foreign National, regardless of medium (e.g. file, tape, and document), pertaining to any part of this contract or any program related to this contract, unless DARPA has provided prior written approval. Please submit requests for release of CTI to both the Program Manager and Program Security Officer.

Contractor information systems shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. “Protecting Controlled Unclassified

Information in Nonfederal Information Systems and Organizations”. DARPA can provide guidance on how to implement 800-171 controls.

CTI is to be marked “DISTRIBUTION C. Distribution authorized to U.S. Government agencies and their contractor; Critical Technology; December 2017. Other requests for this document shall be referred to DARPA, I2O,” in accordance with Department of Defense Instruction 5230.24, "Distribution Statements on Technical Documents."

Material that does not contain CUI does not require marking. The lack of distribution statement does not automatically approve the information for public release. DARPA unclassified information must be reviewed for public release IAW with the performer’s contract.

As part of their efforts on this program, TA2 performers will devise non-CTI surrogate evaluation problem sets derived from representative DoD systems, and therefore must be able to meet all CTI safeguarding requirements. TA2 performers shall therefore deliver to DARPA a detailed plan for abstracting the core technical requirements changes that led to the current state of selected DoD systems without any associated sensitive characteristics, therefore not divulging any CTI or classified information. This plan must describe procedures for abstracting system requirements and failures, and constructing test cases that replicate these failures without recourse to data or information specific to the military platform under test. TA2 performers must submit this plan to DARPA no less than 90 days prior to commencing work on a militarily relevant platform, to allow sufficient time for discussion with the Government team and the completion of any necessary revisions.

5 Aspects of the Program that Will Not Generate CTI DARPA considers that the algorithms developed on this program will constitute advances to the state of the art and are not CTI when realized in source code or executable formats, or when documented in written reports. The outputs and work products resulting from application of algorithms to non-militarily relevant target platforms are not considered CTI. In this context, the term algorithm is defined as the representation of a sequence of abstract logical and/or mathematical operations performed on data.

Any algorithm that must be trained on or configured with respect to particular sets of data to achieve its intended functionality is not CTI in its pre-trained form, but instances of that algorithm that have been trained on or configured by CTI data must be treated as CTI. For example, the algorithms required to train and run a neural network are not considered CTI, but the resulting neural network would be CTI if it were trained on a CTI dataset.

TA2 performers will coordinate with the DARPA PM to make available to all other performers unclassified target platforms that are not militarily relevant, to facilitate technology development.

Specifically by Technical Area, the following work products are not CTI:

5.1 TA1 Automated software generation

• Algorithms to develop tools and workflows to enable software engineers to develop adaptive software through a deferred-concretization methodology

• Algorithms to develop a design workflow that allows developers to work at a higher level of abstraction

• Algorithms for automated concretization and verification processes

• Developed software in source and binary formats that satisfies the unclassified challenge sets

5.2 TA3 Evaluation problem set generation

• Developed of sets of requirements and environments (evaluation sets) that represent real

DoD systems over time without the security sensitivities that may be present on the actual DoD systems

• Abstract problem set requirements and environmental constraints that makes no reference to systems other than the unclassified non-militarily relevant target platform

5.3 TA3 Integrated test and evaluation

• Test plans for unclassified non-militarily relevant target platforms

• Evaluation metrics for TA1 and TA4 specific to the unclassified challenge sets

• Component and system tests of the integrated solutions

• Evaluation approaches for maximizing test coverage of unclassified challenge sets

• The modification of surrogate challenge sets that map back to DoD use cases, but temporally compressed into a challenge period in order to test the ability of TA1 and TA4 performers

5.4 TA4 Transition and experimental control

• Employment of current industry best practices vis-à-vis software engineering

• Operation of TA1 capabilities in order to measure the learning curve specific to the unclassified non-militarily relevant target platforms

• Developed software in source and binary formats that satisfies the unclassified challenge sets

6 Publication All performers must follow the publication guidelines outlined in their contract. Performers requiring pre-publication review must submit any request through DARPA’s DISTAR Process.

6 Publication