FastNICs_CUI_Guide__-_Final.pdf

Version: August 2018 Distribution A: Approved for Public Release: distribution unlimited

Controlled Unclassified Information Guide

Program: Fast Network Interface Cards (FastNICs)

Program Manager: Dr. Jonathan Smith

Program Security Officer: Denice Holden

Date: August 20, 2019

Version: 1.0

1 Background FastNICs will speed up applications such as the distributed training of machine learning classifiers by 100x, through the development, implementation, integration, and validation of novel, clean-slate network subsystems. The program objective is to overcome the gross mismatches in computing and network subsystem performance. Specifically, computer network interface performance lags the performance of other computer subsystems (RAM, CPU, etc.) by 3 to 4 orders of magnitude.

2 Purpose This guide identifies those aspects of the program that performers must handle as Controlled Technical Information (CTI). In addition, each performer must determine and assert the export controls (either Export Administration Regulations or International Traffic in Arms Regulations) relevant to their project, and communicate that assertion to their contracting agent and to the DARPA Program Manager.

Questions concerning the content and interpretation of this guide and/or recommendations for changes due to current conditions, progress made in program research, scientific technological developments, advances in state of the art, or other factors should be directed to the DARPA Program Manager. All users of this guide are encouraged to assist in improving its currency and adequacy.

3 Definition of Controlled Technical Information for the Program DOD considers “technical information” to be technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software code. Note that such technical information may or may not be controlled (i.e., CTI), depending on whether it has military or space application.

Controlled Technical Information (CTI) is defined as technical information with military or space application that is subject to controls on its access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. The term CTI does not include information that is lawfully publicly available without restrictions.

For the FastNICs Program, DARPA considers that all documentation, system outputs, test results and work products related to the application of any program-developed algorithm, technique, or capability to a militarily relevant platform to be minimum CTI. Such detailed technical information could reveal sensitive or even classified capabilities and/or vulnerabilities of that military platform.

The application programming interfaces (APIs) user interfaces, and assembled systems will constitute CTI if the APIs, user interfaces, or assembled systems directly incorporate material from CUI or CTI sources. The evaluation planning, performance results, and user observation or testing results based on CUI transition partner data will also constitute CUI. The datasets and other materials prepared for FastNICs will constitute CTI if they directly incorporate material from CUI or CTI sources. In addition, datasets or other information received from transition partners will constitute CTI if the originator of the dataset or the FastNICs PM designates it as such.

4 Safeguarding & Marking CTI The Contractor shall not release CTI to anyone outside the Contractor’s organization or to a Foreign National, regardless of medium (e.g. file, tape, and document), pertaining to any part of this contract or any program related to this contract, unless DARPA has provided prior written approval. Please submit requests for release of CTI to both the FastNICs Program Manager and Program Security Officer.

Contractor information systems shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”. DARPA can provide guidance on how to implement 800-171 controls.

CTI is to be marked “DISTRIBUTION C. Distribution authorized to U.S. Government agencies and their contractor; Critical Technology; December 2017. Other requests for this document shall be referred to DARPA, I2O.”, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements on Technical Documents."

Material that does not contain CUI does not require marking. The lack of distribution statement does not automatically approve the information for public release. DARPA unclassified information must be reviewed for public release IAW with the performer’s contract.

Performers that are identified supporting activities requiring the use of CTI data must be able to meet all CTI safeguarding requirements. Therefore they shall deliver to DARPA a detailed plan for providing feedback to other performers regarding the performance of their systems without divulging any CTI or classified information. Performers must submit this plan to DARPA no less than 90 days prior to commencing work on a militarily relevant platform, to allow sufficient time for discussion with the Government team and the completion of any necessary revisions.

5 Aspects of the Program that Will Not Generate CTI DARPA considers that the designs and algorithms developed on this program will constitute advances to the state of the art and are not CTI when realized in source code or executable formats, or when documented in written reports. The outputs and work products resulting from application of algorithms to non-militarily relevant target platforms are not considered CTI. In this context, the term algorithm is defined as the representation of a sequence of abstract logical and/or mathematical operations performed on data. Any algorithm that must be trained on or configured with respect to particular sets of data to achieve its intended functionality is not CTI in its pre-trained form, but instances of that algorithm that have been trained on or configured by CTI data must be treated as CTI. For example, the algorithms required to train and run a neural network are not considered CTI, but the resulting neural network would be CTI if it were trained on a CTI dataset.

Performers will coordinate with the DARPA PM to make available to all other performers unclassified target platforms that are not militarily relevant, to facilitate technology development. Specifically by Technical Area, the following work products are not CTI:

5.1 TA1 Network Subsystem Hardware and Software

• Operational context-driven system models for target platforms that are not militarily relevant

• Designs, models, simulations, APIs, source-code, hardware, scripts, tools, regression unit tests, and documentation that makes no reference to systems other than unclassified non-militarily relevant target platforms

5.2 TA2 Applications

• Models, simulators and/or distributable prototypes and related APIs developed under the program and specific to unclassified non-militarily relevant target platforms

• Simulation algorithms for exploring target platforms to elicit anticipated behaviors

• Algorithms, scripts, regression unit tests, and documentation that makes no reference to systems other than the unclassified non-militarily relevant target platform

5.3 TA3 Independent Test and Evaluation

• Test plans for unclassified non-militarily relevant target platforms

• Evaluation metrics for TA1 and TA2 specific to the unclassified non-militarily relevant target platforms

• Component and system tests of the combined integrated solution

• Evaluation approaches for maximizing test coverage of unclassified non-militarily relevant target platforms

6 Publication All performers must follow the publication guidelines outlined in their contract. Performers requiring pre-publication review must submit any request through DARPA’s DISTAR Process.

6 Publication