INCAS_CUI_Guide_Approved_DISTAR.pdf

Version: August 2018 Distribution A: Approved for Public Release: distribution unlimited

Controlled Unclassified Information Guide

Program: INCAS

Program Manager: Brian Kettler

Program Security Officer: Denice Holden

Date: 8 October 2020

Version: 1

1 Background The INfluence Campaign Awareness and Sensemaking (INCAS) program will develop techniques and tools that enable analysts to detect, understand, and track geopolitical influence campaigns with quantified confidence. INCAS tools will enable analyst-guided campaign analysis using automated influence detection. In contrast to current social media tools, INCAS tools will directly and automatically detect implicit and explicit indicators of geopolitical influence in multilingual online messaging to include author’s agenda, concerns (wedge issues, moral values), and emotion. To explain and anticipate population response to influence messaging, INCAS tools will dynamically segment the responding population and identify psychographic attributes relevant to geopolitical influence. Psychographic attributes, such as worldviews, morals, and sacred values, are hypothesized to correlate more strongly with geopolitical influence topic response than the personality and demographic attributes used for marketing. Novel psychographic attributes will be extracted using analysis of text and online behavior and correlated with influence indicators in messaging that the population segment responds to.

INCAS tools will support analyst-guided linking of influence indicators and population response over time and across multiple platforms to capture dynamic, evolving influence campaign models. Rich campaign models will combine machine-surfaced influence indicators and messaging and population response with analyst-provided campaign elements, including campaign tactics, objectives, actors, and events. Quantified confidence assessment will enable analysts to mitigate biases through INCAS automation that curates, elicits, combines, and organizes confidence intervals, evidence, alternative hypotheses, and supporting information. Integrated support of quantified confidence assessment represents another advance by INCAS over the current state of the art.

2 Purpose This guide identifies those aspects of the program that performers must handle as Controlled Technical Information (CTI). In addition, each performer must determine and assert the export controls (either Export Administration Regulations or International Traffic in Arms Regulations) relevant to their project, and communicate that assertion to their contracting agent and to the DARPA Program Manager.

Questions concerning the content and interpretation of this guide and/or recommendations for changes due to current conditions, progress made in program research, scientific technological developments, advances in state of the art, or other factors should be directed to the DARPA Program Manager. All users of this guide are encouraged to assist in improving its currency and adequacy.

3 Definition of Controlled Technical Information for the Program DOD considers “technical information” to be technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software code. Note that such technical information may or may not be controlled (i.e., CTI), depending on whether it has military or space application.

Controlled Technical Information (CTI) is defined as technical information with military or space application that is subject to controls on its access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. The term CTI does not include information that is lawfully publicly available without restrictions.

For the INCAS Program, DARPA considers that all documentation, system outputs, test results and work products related to the application of any program-developed algorithm, technique, or capability to a militarily relevant dataset to be minimum CUI. Such detailed information could reveal sensitive or even classified information relevant to military mission and plans.

4 Safeguarding & Marking CUI/CTI The Contractor shall not release CUI/CTI to anyone outside the Contractor’s organization or to a Foreign National, regardless of medium (e.g. file, tape, and document), pertaining to any part of this contract or any program related to this contract, unless DARPA has provided prior written approval. Please submit requests for release of CUI/CTI to both the INCAS Program Manager and Program Security Officer.

Contractor information systems shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”. DARPA can provide guidance on how to implement 800-171 controls.

CUI/CTI is to be marked “DISTRIBUTION C. Distribution authorized to U.S. Government agencies and their contractor; Critical Technology; December 2017. Other requests for this document shall be referred to DARPA, I2O.” in accordance with Department of Defense Instruction 5230.24, "Distribution Statements on Technical Documents."

Material that does not contain CUI does not require marking. The lack of distribution statement does not automatically approve the information for public release. DARPA unclassified information must be reviewed for public release IAW with the performer’s contract.

As part of their efforts on this program, TA4 performers will apply TA3- and TA4-developed capabilities to one or more militarily relevant problems/datasets, and therefore must be able to meet all CUI/CTI safeguarding requirements. TA4 performers shall therefore deliver to DARPA a detailed plan for providing feedback to other performers regarding the performance of their systems without divulging any CUI/CTI or classified information. TA4 performers must submit this plan to DARPA no less than 90 days prior to commencing work on a militarily relevant data, to allow sufficient time for discussion with the Government team and the completion of any necessary revisions.

TA5 performers will conduct the evaluation of TA1-TA4 techniques, tools and procedures. Selected performers will be subject to CUI restrictions and actions for the handling or collection of CUI. TA5 performers shall therefore deliver to DARPA a detailed plan for providing feedback to other performers regarding the performance of their systems without divulging any CUI/CTI or classified information. TA5 performers must submit this plan to DARPA no less than 90 days prior to commencing work on a militarily relevant data, to allow sufficient time for discussion with the Government team and the completion of any necessary revisions.

5 Aspects of the Program that Will Not Generate CUI/CTI

DARPA considers that the algorithms developed on this program will constitute advances to the state of the art and are not CUI/CTI when realized in source code or executable formats, or when documented in written reports. The outputs and work products resulting from application of algorithms to non-militarily relevant data are not considered CTI. In this context, the term algorithm is defined as the representation of a sequence of abstract logical and/or mathematical operations performed on data. Any algorithm that must be trained on or configured with respect to particular sets of data to achieve its intended functionality is not CUI/CTI in its pre-trained form, but instances of that algorithm that have been trained on or configured by CUI/CTI data must be treated as CUI/CTI. For example, the algorithms required to train and run a neural network are not considered CUI/CTI, but the resulting neural network would be CUI/CTI if it were trained on a CUI/CTI dataset.

TA4 performers will coordinate with the DARPA PM to make available to all other performers unclassified data that are not militarily relevant, to facilitate technology development. Specifically by Technical Area, the following work products are not CUI/CTI:

5.1 TA1 Influence Indicator Detection

� Pre-trained algorithms to automatically detect influence indicators � Technical reports that describe pre-trained algorithms � Algorithms trained and/or configured using non-CUI data to automatically detect influence indicators � Technical reports that describe algorithms trained and/or configured using non-CUI data � Algorithms for obtaining contextual data from non-CUI sources � Pre-trained algorithms for providing confidence assessment information � Algorithms trained and/or configured using non-CUI data for providing confidence assessment information � Algorithms, scripts, regression unit tests, and documentation that makes no reference to systems other than unclassified non-militarily relevant target platforms

5.2 TA2 Population Response Characterization

� Pre-trained algorithms for population segmentation and characterization � Technical reports that describe pre-trained algorithms � Algorithms trained and/or configured using non-CUI data for population segmentation and characterization � Technical reports that describe algorithms trained and/or configured using non-CUI data � Algorithms for correlating non-CUI population response data with non-CUI population responses to influence messaging � Pre-trained algorithms for providing confidence assessment information � Algorithms trained and/or configured using non-CUI data for providing confidence assessment information � Algorithms, scripts, regression unit tests, and documentation that makes no reference to systems other than the unclassified non-militarily relevant target platform

5.3 TA3 Influence Campaign Modeling

� Campaign data models that do not reference CUI data � Data visualization algorithms and techniques � Algorithms and methods for interacting with campaign data model elements � Algorithms for influence campaign analytics � Pre-trained algorithms for analyzing confidence assessment information � Algorithms trained and/or configured using non-CUI data for analyzing confidence assessment information � Algorithms, scripts, regression unit tests, and documentation that makes no reference to systems other than the unclassified non-militarily relevant target platform

5.4 TA4 Data and Testbed Development

� Data provisioning algorithms

� API specifications � Algorithms for analyzing images � Natural language processing algorithms � Data storage specifications � Data enrichment algorithms and techniques

5.5 TA5 Program Evaluation

� Test plans for unclassified non-militarily relevant target platforms � Evaluation metrics for TA1, TA2, TA3, and TA4 specific to the unclassified non-militarily relevant target platforms � Component and system tests of the combined integrated solution � Evaluation approaches for maximizing test coverage of unclassified non-militarily relevant target platforms

6 Publication All performers must follow the publication guidelines outlined in their contract. Performers requiring pre-publication review must submit any request through DARPA’s DISTAR Process.

6 Publication