HR001123S0028-Amendment-01.pdf

Broad Agency Announcement

Compartmentalization and Privilege Management (CPM)

INFORMATION INNOVATION OFFICE

HR001123S0028

April 4, 2023

Amendment 1

April 13, 2023

Summary of Amendment 1 Changes:

The purpose of this amendment is to add updated information in the Technical Areas. The following section has been amended and changes are highlighted in yellow:

1. PART II. FULL TEXT OF ANNOUNCEMENT; I. Funding Opportunity Description; A.

Program Overview; Technical Areas

TABLE OF CONTENTS

PART I: OVERVIEW INFORMATION

PART II: FULL TEXT OF ANNOUNCEMENT

I. Funding Opportunity Description II. Award Information

A. General Award Information B. Fundamental Research

III. Eligibility Information A. Eligible Applicants B. Organizational Conflicts of Interest C. Cost Sharing/Matching D. Other Eligibility Criteria

IV. Application and Submission Information A. Address to Request Application Package B. Content and Form of Application Submission

V. Application Review Information A. Evaluation Criteria B. Review of Proposals

VI. Award Administration Information A. Selection Notices and Notifications B. Administrative and National Policy Requirements C. Reporting D. Electronic Systems E. DARPA Embedded Entrepreneurship Initiative (EEI)

VII. Agency Contacts VIII. Other Information

IX. APPENDIX 1 – PROPOSAL SUMMARY SLIDE

PART I: OVERVIEW INFORMATION

Federal Agency Name – Defense Advanced Research Projects Agency (DARPA), Information Innovation Office (I2O) Funding Opportunity Title – Compartmentalization and Privilege Management (CPM) Announcement Type – Initial Announcement Funding Opportunity Number – HR001123S0028 Catalog of Federal Domestic Assistance Numbers (CFDA) – 12.910 Research and

Technology Development Dates o Posting Date: April 4, 2023 o Abstract Due Date and Time: April 18, 2023, 12:00pm Eastern Time (ET) o Abstract Feedback Provided: May 2, 2023 o FAQ/Questions Due Date: May 25, 2023 o Proposal Due Date and Time: June 6, 2023, 12:00pm ET o Solicitation Closing Date: October 3, 2023

Program Objective: The objective of the CPM program is to develop a set of analysis tools, along with supporting hardware and software infrastructure, to automatically compartmentalize large legacy software systems into performant, limited-privilege, fine-grained compartments that prevent initial penetrations from turning into successful cyber-attacks.

Anticipated individual awards – Multiple awards are anticipated.

Types of instruments that may be awarded – Procurement contract, grant, cooperative agreement, or other transaction.

Agency contact o Points of Contact The BAA Coordinator for this effort can be reached at:

Email: CPM@darpa.mil

DARPA/I2O

ATTN: HR001123S0028

675 North Randolph Street Arlington, VA 22203-2114 mailto:CPM@darpa.mil

PART II: FULL TEXT OF ANNOUNCEMENT

I. Funding Opportunity Description

This publication constitutes a Broad Agency Announcement (BAA) as contemplated in Federal Acquisition Regulation (FAR) 6.102(d)(2) and 35.016 and 2 CFR § 200.203. Any resultant award negotiations will follow all pertinent law and regulation, and any negotiations and/or awards for procurement contracts will use procedures under FAR 15.4, Contract Pricing, as specified in the BAA.

The Defense Advanced Research Projects Agency (DARPA) is soliciting innovative proposals in the following technical areas: automated compartmentalization, privilege enforcement, and evaluation support. Proposed research should investigate innovative approaches that enable revolutionary advances in science, devices, or systems. Specifically excluded is research that primarily results in evolutionary improvements to the existing state of practice.

A. Program Overview

Introduction

A successful cyber-attack is typically a multistep process. For cyber attackers to achieve their ultimate goals they must conduct a “campaign,” which typically includes a sequence of exploits in which they move from initial system penetration, through steps of privilege escalation and lateral motion, until reaching their ultimate target. An initial penetration, whether achieved by exploiting an inattentive user or a software/system vulnerability, is followed by steps to increase the attacker’s privilege level and to enable lateral movement within the compromised system.

Ultimately, the attacker’s goal is to use the unauthorized privileged access to locate and exfiltrate sensitive information or to disrupt normal operations. Traditional defenses have focused on keeping an attacker out (perimeter defenses) and eliminating exploitable bugs in code. The CPM program focuses on blocking privilege escalation and lateral movement even if there has been a successful initial penetration.

The objective of the CPM program is to develop a set of tools, along with supporting hardware and software infrastructure, to automatically restructure legacy complex software systems into performant limited-privilege compartments that prevent initial penetrations from turning into successful cyber-attacks. CPM technology will provide the capability to restructure a system into one that would prevent such campaigns from moving beyond their initial penetration.

Background

The principle of least privilege, that a software component acting on behalf of a user should only have access to the specific data and resources needed to complete its task, has been known by software developers since the early 1970s. While the principle is accepted, until very recently the reality has been that processor hardware could not efficiently enforce privilege management policies, while software enforcement solutions were slow, memory-intensive, and prone to the same bugs that seem to plague all software.

The abstract model of compartmentalized privilege management underlying the CPM program (included for explanatory purposes) is illustrated in Figure 1. In this model, the hardware enforces access control rules that specify which Principals have the privileges required to perform some set of operations on the data and resources accessible within a compartment. A Principal can be viewed as an entity acting in a specific role (e.g., “the file system acting on my behalf”).

Y

Y Y Y

Principal-1

Principal-2

Principal-3

Principal-n

C-1

C-2

C-3

C-4

C-5

C-nLoad

Y

Y

Y

Y trap trap trap trap traptraptrap trap trap trap trap traptraptraptrap

Y

Compartment Collection of data with a specific purpose

Principal An entity acting in a specific role

Access rules

• For each compartment and each principal, a matrix specifying which operations are legitimate

• Collectively forms a policy restricting flow of data between compartments and integrity of data within each compartment

• Principal changes are controlled with “gate calls”

• Everything, including data, code, Principals and Compartments, are represented as objects within a compartment

• Each executing thread has a Principal (who it’s acting for and in what role) trap A trap is a hardware generated interrupt of the running process, indicating that something has gone wrong (e.g., a Principal attempting to access a resource for which it lacks permission. Control is diverted to a software “trap handler” that can either fix what’s wrong or terminate the program.

Figure 1 CPM abstract model

Changing Principals in order to access resources in a different compartment that requires different privileges is mediated through a “gate call” (Figure 2) that invokes a sub-routine which changes the Principal for the dynamic extent of the called routine. Gate calls are themselves subject to access control rules, thus limiting the allowed transitions within a given context. In contrast to traditional models (e.g., kernel-mode vs user mode, or rings of protection) a gate call does not strictly increase privilege, but may reduce the privilege level with respect to some objects while increasing the privilege level with respect to other objects (for example, when the file system is invoked by a user to create a file, the privileges with respect to that user’s data are decreased while access to the internal structure of the file system is increased).

Figure 2 Gate calls

Hardware features that address some of the vulnerabilities that are exploited to achieve privilege escalation and lateral movement (e.g., spatial memory violations, control flow hijacking) have been implemented in commercial and research hardware. Commercial examples include No-execute bits (supported by several processor architectures), Arm’s Pointer Authentication Code (PAC) and Memory Tagging Extensions (MTE), and Intel’s Control-flow Enforcement Technology (CET). Research hardware implementations include Capability Hardware Enhanced Reduced Instruction Set Computer Instructions (CHERI), the Dover inherently secure processor, and Air Force Research Laboratory’s T-CORE processor. While these hardware enhancements are performant and address particularly problematic and widespread vulnerabilities, they do not address the full scope of vulnerabilities that could be mitigated by implementing and enforcing least privilege policies.

Recent research has demonstrated the viability of coupling privilege-centric compartmentalization with new hardware features. Roessler and DeHon’s SCALPEL work targeted the PIPE architecture and developed a technique to automatically implement compartmentalization strategies that tradeoff between performance and excess privileges (in the sense of exceeding least privilege objectives) accessible within the compartments. The Hardware-Assisted Kernel Compartmentalization (HAKC) work of McKee et al. used the Arm architecture’s new PAC and MTE instructions to provide runtime enforcement of kernel compartments.

Some form of compartmentalization is required to implement enforceable privilege management policies. Compartment boundaries, where privileges change, are required in order to put the least back into least privilege. Virtual machine (VM) technologies are examples of a compartmentalization technique that relies on hardware features for performance and enforcement. The performance cost of switching between VMs using current technologies is high, which means VM-based isolation is restricted to use with very coarse-grained compartments and is not suitable for enforcing least-privilege constructs. Software container technology, while faster than VMs, can be compromised via vulnerabilities in the underlying operating system on which the containers are deployed.

There are programming languages such as Rust, and programming paradigms such as formal methods for developing provably correct software, that make it possible to develop much more secure software than is the norm for legacy code bases written in languages such as C and C++.

These legacy operating systems and applications, comprising hundreds of millions of lines of code, will be used for a very long time. Recreating this code base from scratch in secure languages is not a viable option. Another approach is needed to secure the large legacy of unsecure code.

The CPM program’s focus is on securing the vulnerable legacy code base. Complementary software and hardware solutions are sought that will make it economically viable to compartmentalize legacy software around least-privilege principles while also demonstrating a hardware roadmap that enables performant implementation. Full solutions are anticipated to require new hardware support, though software-only solutions that can meet performance expectations are in-scope for the program.

Technical Areas

The first phase of the CPM program will use an open-source Unix-like operating system (OS) (e.g., Linux, FreeBSD) as the target system for testing and evaluation. The choice of target OS is limited to widely used members of the Unix family of operating systems and does not include security-enhanced variants such as SELinux and L4Linux. Given the size of the code base for these operating systems, rather than targeting least-privilege compartmentalization of the entire operating system, the Government will select one or more OS subsystems to be used for measurement and evaluation. The second phase of the program will focus attention on applying the tools and capabilities to securing open-source user-space applications (e.g., web browser, web server, database management system).

To accomplish the program objective, CPM is partitioned into three Technical Areas (TAs): 1) Automated Compartmentalization, 2) Privilege Policy Enforcement, and 3) Evaluation Support.

A new solicitation for a fourth Technical Area, TA4: DoD System Experimentation, is anticipated prior to Phase 2, after the program is well underway. It is referenced in the current solicitation to make potential proposers to this BAA aware of future support expectations and constraints that must be accounted for in proposals.

DARPA anticipates funding multiple technical approaches and performers for TAs 1 and 2 and making a single TA3 award. Each proposal may address any single TA or a combination of TA1 and TA2. Proposers may submit multiple proposals. The Government reserves the right to decide which, if any, are selected for award. If a performer is selected for the TA3 award, that performer cannot be selected for the other TA(s) either as a prime or subcontractor.

TA1 and TA2 performers will be eligible to submit proposals to a subsequent DoD System Experimentation (TA4) solicitation under the CPM program. The selected TA3 performer will not be eligible to propose to a subsequent DoD System Experimentation solicitation.

The individual TAs are elaborated below.

TA1: Automated Compartmentalization

TA1 performers will develop software analysis tools that automatically restructure legacy software systems. The restructured system should contain fine-grained compartments and access control rules that limit privileges to just those needed to perform their task. The restructured system will also restrict the transitions between execution contexts (i.e., Principals) to only those needed.

It should be noted that systems with finer-grained compartments will tend to require more context transitions and will therefore tend to incur more overhead. Larger grained compartments, on the other hand, will incur less overhead but will tend to allow for more privileges than strictly necessary. TA1 tools, therefore, must explore the tradeoffs between producing a system with acceptable overhead and minimal over-privileging. To enable these tradeoffs, TA1 performers will be provided with TA2 simulation models and performance estimates for TA2 instruction set enhancements.

TA1 tools will produce a restructured system and its associated metadata (e.g., specification of compartments, privilege levels, gate calls, etc.) in a form that can be absorbed by the TA2 enforcement systems. A goal of CPM is to develop a common metadata representation. The exact details of how this interchange from TA1 to TA2 systems will be performed will be worked out in collaboration with the TA2 performers. However, in broad outlines, we expect the following to be the case:

TA1 will transfer the restructured program together with its metadata to the TA2 systems.

The restructured program may be either in source or binary format (for example, part of the TA1 system may reside in the compiler). The metadata may be conveyed either in a defined exchange format or in a section of the Executable and Linkable Format (ELF) or similar loadable formats.

TA1 performers should assume they have access to the source code of the legacy systems; they are free to perform dynamic and/or static analysis on both source code and binaries.

TA1 tools can, to a limited extent (see Program Metrics for acceptable limits), utilize user annotations to guide and enhance the analysis and compartmentalization; however, the tool should be able to operate effectively with little or no user annotations.

TA1 performers whose output is in the form of compiled binary code can assume that the TA2 enforcement systems will implement a common instruction set (e.g., X86, Arm, RISC-V) with extensions if required. The TA2 systems may perform additional transformations at load time (and/or compile time if the TA1 format is source code).

Key metrics for evaluating TA1 tools include the degree of over-privileging allowed in the restructured programs, the memory and performance overhead, the effort required for analysis, and the amount of user annotation required.

TA1 performers who will be developing against a Unix variant other than Linux will be expected to make any changes to the TA3 test suite, in consultation with the TA3 performer, that are required for the test suite to work with the TA1-selected OS.

In Phase 2, which will focus on application code running in user space, TA1 performers should be prepared to work on user-space systems of their choosing. These user-space systems must include source code that is freely shareable within a fundamental research program and they must come with an automated test suite. Proposals should identify at least one such system the proposer is prepared to work with.

In Phase 2, TA1 performers will also be expected to work with one or more TA4 performers.

This effort will be focused on providing the tools, necessary training, and support for the TA4 performers to use the TA1 tools.

TA1 proposals must identify one or more TA2 privilege enforcement techniques, or classes of techniques, that the approach will support; and describe and justify how the proposed TA1 approach will achieve relevant program metrics. TA1 performers may be required to provide computation resources for TA3’s execution of program evaluations.

A strong TA1 proposal should:

Develop tools that can target multiple TA2 enforcement systems;

Present a clear path for scaling the proposed approach to very large code bases and to variety of workloads (e.g., programs that are heavily interactive, I/O-intensive, pointer-intensive, etc.);

Describe what sort of manual annotation is anticipated and how the need for manual annotation will be minimized; and, Identify the key technical risks of the proposed approach, describe how they will be tracked, and suggest possible mitigations.

TA2: Privilege Policy Enforcement

TA2 performers should develop processor architectures and system software that will, with low overhead, enforce compartment and privilege management protocols discovered by TA1 tools to prevent initial penetrations from propagating into successful cyber-attacks.

TA2 efforts are expected to involve novel processor architectures (at both the macro- and micro-architectural levels) but software-only solutions that meet the performance goals of the program are allowable. To reduce cost, novel processors may be implemented in Field Programmable Gate Arrays.

It is up to the TA2 performers to decide how to implement the abstract model described earlier in this BAA. A new processor architecture (or software-only solution) may directly mirror the abstract model but the architecture may be structured in a different way as long as it can enforce one or more TA1 privilege management systems efficiently and pervasively.

As mentioned above, in order to ease the interfacing between TA1 and TA2 tools, the TA2 systems should execute a widely used instruction set (with possible extensions). TA2 solutions are expected to utilize a novel micro-architecture. That micro-architecture might include extra registers, caches and logic. All of these additions will increase the size of the hardware. Key measures for TA2 solutions are the increase in hardware size over the non-modified processor (e.g., number of gates and size of internal memories) and power consumption.

TA1-restructured systems, running on TA2 processors, will be evaluated in terms of execution overhead, increase in memory footprint, and the percent of attacks developed by the TA3 performer in the automated test suite that are blocked. TA2 performers may be required to provide computation resources, including any custom hardware, for TA3’s execution of program evaluations.

A strong TA2 proposal should include:

Early simulated performance numbers for use by TA1 in determining optimal compartmentalization and privilege management strategies;

Plans for incorporating feedback from TA1 into the processor design and analysis process;

Hardware instantiations of the proposed processors that allow realistic, hardware-in-the-loop measurements of end-to-end systems that can be conducted by the end of each program phase;

Descriptions of assumptions and/or limitations of the proposed approach to different workloads (e.g., frequent privilege policy changes, pointer-intensive, large vs small memory allocations, etc.); and, Identify the key technical risks of the proposed approach, describe how they will be tracked, and suggest possible mitigations.

TA3: Evaluation Support

The TA3 performer will be expected to prepare evaluation systems, develop a library of open-source attack campaigns that can be used as test cases against those systems, and conduct or supervise evaluations to measure the effectiveness of the technologies and performance of systems compartmentalized and protected by technologies developed under TA1 and TA2. While CPM technologies are likely to mitigate many vulnerabilities that are used by attackers to initially compromise a system, eliminating individual vulnerabilities is not the focus of the program. Rather, the primary focus of CPM is on preventing an attacker from leveraging an initial penetration into a larger-scale compromise of a system. Thus, CPM test cases should use multi-step attack campaigns in which the focus of the test is containing an attack so it cannot achieve its broader objectives, even after an initial successful penetration.

Attack campaigns and test cases should be constructed to enable measurement of TA1-modifed systems, executing on TA2-developed hardware, against the CPM program metrics described in Program Metrics section below. For the automated compartmentalization metrics, the TA3 performer will work with TA1 performers to develop measurement procedures.

During Phase 1 of CPM, development and testing efforts will focus on a Unix-like operating system. It is likely that the TA3 performer will need to select, in consultation with DARPA, a subset of the OS that balances limiting the amount of code TA1 performers need to analyze and compartmentalize against TA3’s need to have meaningful attack campaigns.

Phase 2 research will extend to order of magnitude larger code bases and should add user-space applications to the mix of target systems. TA1 performers may propose specific open-source user space applications, which must include existing regression test suites. TA3 will identify and/or adapt attacks that target these user-space applications as well as applications introduced by TA4 performer(s).

The TA3 performer is not expected to provide compute resources to other TAs. When conducting program evaluations, the TA3 performer may either observe tests running on other performers’ systems or run the tests on TA3-controlled resources.

A strong TA3 proposal should:

Describe how all of the program metrics will be measured, including those metrics that do not involve vulnerability testing;

Present a methodology for finding or creating vulnerable open-source systems (i.e., victim systems) and unclassified, non-sensitive attacks campaigns that are known to exploit victim system vulnerabilities. The victim system includes user-space applications as well as a Unix-like OS;

Include an automated testing procedure for executing attack campaigns against victim systems and reporting outcomes; and, Identify the key technical risks of the proposed approach, describe how they will be tracked, and suggest possible mitigations.

B. Program Structure

CPM is planned as a 48-month program with a 30-month Phase 1 and an 18-month Phase 2.

Phase 1 will focus on technology development, specifically using a Unix-like OS such as Linux as the test and evaluation suite. Phase 2 will focus on scaling the technologies and will add user-space programs to the test and evaluation suite.

The overall tentative program schedule, including important milestones and events, is shown in Figure 3. Baselining experiments will be conducted at month 12 (for OS) and month 34 (for user-space applications). Formal test and evaluation activities are anticipated to take place at months 24, 30, 38, and 47.

Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1

Program-wide

Automated Compartmental-ization

(TA1)

Privilege Enforcement

(TA2)

Evaluation

(TA3)

DoD System Experimentation

(TA4)

Baselining Evaluation

Phase 1 Phase 2

FY24 FY25 FY26 FY27 FY28

OS

Compartment

-alization

Kickof

Phase 2 End

PI PI PI PI PI PI PI PI

Initial Prototype Initial challenge experiments

Incorporate performance data

Start

Simulation Model

Performance Estimate

Initial Design FPGA

Updated Design &

FPGA

Initial OS Challenge

Set

Final OS Challenge

Set Initial App Challenge

Set OS Evaluation

Final App Challenge

Set App Evaluation

Technology Showcase

BAA

Awards

Preliminary Results

Final Results

Red arrows indicate dependencies between tasks

App challenge experiments

App Compartment

-alization

Figure 3 Program Schedule

C. Program Metrics

To evaluate the effectiveness of proposed solutions in achieving the stated program objectives, the Government intends to use the following metrics, shown in Table 1 below, as the basis for measuring progress of the program as well as individual performers. Although the following program metrics are specified, proposers should note that the Government has identified these goals with the intention of bounding the scope of effort, while affording the maximum flexibility, creativity, and innovation in proposing solutions to the stated problem.

Proposals should cite the quantitative and qualitative success criteria that the proposed effort will achieve by the time of each Metric Evaluation (indicated by the red boxes in Figure 3).

Table 1 Program Metrics

Capability Metric Phase 1 -- OS Phase 2 -- Applications

Performant

% attacks blocked > 50% > 85%

CPU overhead < 15% < 5%

Memory overhead < 50% <25%

Fine-grained, limited-privilege

Compartment size Individual function Individual function

Over privilege ratio < 2% < 1.5%

Automated compartmentalization

Analysis time < 1 week < 1 day % Lines of manual annotation < 2% < 0.2%

D. Government-furnished Property/Equipment/Information

None. Performers should propose any computational resources necessary to execute the program.

E. Intellectual Property

As a fundamental research program, a goal of CPM is to develop new technologies that seed additional research and facilitate rapid innovation by providing a base for future users or developers of related technologies. To the maximum extent possible, creating open-source software is strongly encouraged. The Government recognizes that some processor implementations are proprietary, though research into extensions to these Instruction Set Architectures (ISA)s need not be. Thus, to the maximum extent possible, creating open-source hardware is also strongly encouraged. At a minimum it is desired that all noncommercial software (including source code), software documentation, hardware designs and documentation, and technical data generated by the program be provided as deliverables to the Government, with a minimum of Government Purpose Rights (GPR).

II. Award Information

A. General Award Information

Multiple awards are anticipated under TA1 and TA2. A single award is anticipated for TA3. The amount of resources made available under this BAA will depend on the quality of the proposals received and the availability of funds.

The Government reserves the right to select for negotiation all, some, one, or none of the proposals received in response to this solicitation and to make awards without discussions with proposers. The Government also reserves the right to conduct discussions if it is later determined to be necessary. If warranted, portions of resulting awards may be segregated into pre-priced options. Additionally, DARPA reserves the right to accept proposals in their entirety or to select only portions of proposals for award. In the event that DARPA desires to award only portions of a proposal, negotiations may be opened with that proposer. The Government reserves the right to fund proposals in phases with options for continued work, as applicable.

The Government reserves the right to request any additional, necessary documentation once it makes the award instrument determination. Such additional information may include but is not limited to Representations and Certifications (see Section IV.B.3.d, “Representations and Certifications”). The Government reserves the right to remove proposers from award consideration should the parties fail to reach agreement on award terms, conditions, and/or cost/price within a reasonable time, and the proposer fails to timely provide requested additional information. Proposals identified for negotiation may result in a procurement contract, grant, cooperative agreement, or other transaction, depending upon the nature of the work proposed, the required degree of interaction between parties, whether or not the research is classified as Fundamental Research, and other factors.

In all cases, the Government contracting officer shall have sole discretion to select award instrument type, regardless of instrument type proposed, and to negotiate all instrument terms and conditions with selectees. DARPA will apply publication or other restrictions, as necessary, if it determines that the research resulting from the proposed effort will present a high likelihood of disclosing performance characteristics of military systems or manufacturing technologies that are unique and critical to defense. Any award resulting from such a determination will include a requirement for DARPA permission before publishing any information or results on the program. For more information on publication restrictions, see the section below on Fundamental Research

B. Fundamental Research

It is DoD policy that the publication of products of fundamental research will remain unrestricted to the maximum extent possible. National Security Decision Directive (NSDD) 189 defines fundamental research as follows:

‘Fundamental research’ means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons.

As of the date of publication of this solicitation, the Government expects that program goals as described herein may be met by proposers intending to perform fundamental research and does not anticipate applying publication restrictions of any kind to individual awards for fundamental research that may result from this solicitation. Notwithstanding this statement of expectation, the Government is not prohibited from considering and selecting research proposals that, while perhaps not qualifying as fundamental research under the foregoing definition, still meet the solicitation criteria for submissions. If proposals are selected for award that offer other than a fundamental research solution, the Government will either work with the proposer to modify the proposed statement of work to bring the research back into line with fundamental research or else the proposer will agree to restrictions in order to receive an award.

University or non-profit research institution performance under this solicitation will include effort categorized as fundamental research. In addition to Government support for free and open scientific exchanges and dissemination of research results in a broad and unrestricted manner, the academic or non-profit research performer or recipient, regardless of tier, acknowledges that such research may have implications that are important to U.S. national interests and must be protected against foreign influence and exploitation. As such, the academic or non-profit research performer or recipient agrees to comply with the following requirements:

(a) The University or non-profit research institution performer or recipient must establish and maintain an internal process or procedure to address foreign talent programs, conflicts of commitment, conflicts of interest, and research integrity. The academic or non-profit research performer or recipient must also utilize due diligence to identify Foreign Components or participation by Senior/Key Personnel in Foreign Government Talent Recruitment Programs and agree to share such information with the Government upon request.

i. The above described information will be provided to the Government as part of the proposal response to the solicitation and will be reviewed and assessed prior to award. Generally, this information will be included in the Research and Related Senior/Key Personnel Profile (Expanded) form (SF-424) required as part the proposer’s submission through Grants.gov.

1. Instructions regarding how to fill out the SF-424 and its biographical sketch can be found through Grants.gov.

ii. In accordance with USD(R&E) direction to mitigate undue foreign influence in DoD-funded science and technology, DARPA will assess all Senior/Key Personnel proposed to support DARPA grants and cooperative agreements for potential undue foreign influence risk factors relating to professional and financial activities. This will be done by evaluating information provided via the SF-424, and any accompanying or referenced documents, in order to identify and assess any associations or affiliations the Senior/Key Personnel may have with foreign strategic competitors or countries that have a history of intellectual property theft, research misconduct, or history of targeting U.S. technology for unauthorized transfer. DARPA’s evaluation takes into consideration the entirety of the Senior/Key Personnel’s SF-424, current and pending support, and biographical sketch, placing the most weight on the Senior/Key Person’s professional and financial activities over the last 4 years. The majority of foreign entities lists used to make these determinations are publicly available. The DARPA Countering Foreign Influence Program (CFIP) “Senior/Key Personnel Foreign Influence Risk Rubric” details the various risk ratings and factors. The rubric can be seen at the following link:

https://www.darpa.mil/attachments/092021DARPACFIPRubric.pdf

iii. Examples of lists that DARPA leverages to assess potential undue foreign influence factors include, but are not limited to:

https://www.darpa.mil/attachments/092021DARPACFIPRubric.pdf

1. Executive Order 13959 “Addressing the Threat From Securities Investments That Finance Communist Chinese Military Companies”:

https://www.govinfo.gov/content/pkg/FR-2020-11-17/pdf/2020-25459.pdf

2. The U.S. Department of Education’s College Foreign Gift and Contract Report: College Foreign Gift Reporting (ed.gov)

3. The U.S. Department of Commerce, Bureau of Industry and Security, List of Parties of Concern: https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern

4. Georgetown University’s Center for Security and Emerging Technology (CSET) Chinese Talent Program Tracker:

https://chinatalenttracker.cset.tech

5. Director of National Intelligence (DNI) “World Wide Threat Assessment of the US Intelligence Community”: 2021 Annual Threat Assessment of the U.S. Intelligence Community (dni.gov)

6. Various Defense Counterintelligence and Security Agency (DCSA) products regarding targeting of US technologies, adversary targeting of academia, and the exploitation of academic experts: https://www.dcsa.mil/

(b) DARPA’s analysis and assessment of affiliations and associations of Senior/Key Personnel is compliant with Title VI of the Civil Rights Act of 1964. Information regarding race, color, or national origin is not collected and does not have bearing in DARPA’s assessment.

(c) University or non-profit research institutions with proposals selected for negotiation that have been assessed as having high or very high undue foreign influence risk, will be given an opportunity during the negotiation process to mitigate the risk. DARPA reserves the right to request any follow-up information needed to assess risk or mitigation strategies.

i. Upon conclusion of the negotiations, if DARPA determines, despite any proposed mitigation terms (e.g. mitigation plan, alternative research personnel), the participation of any Senior/Key Research Personnel still represents high risk to the program, or proposed mitigation affects the Government’s confidence in proposer’s capability to successfully complete the research (e.g., less qualified Senior/Key Research Personnel) the Government may determine not to award the proposed effort. Any decision not to award will be predicated upon reasonable disclosure of the pertinent facts and reasonable discussion of any possible alternatives while balancing program award timeline requirements.

(d) Failure of the academic or non-profit research performer or recipient to reasonably exercise due diligence to discover or ensure that neither it nor any of its Senior/Key Research Personnel involved in the subject award are participating in a Foreign Government Talent Program or have a Foreign Component with an a strategic competitor or country with a history of targeting U.S. technology for unauthorized transfer may result in the Government exercising remedies in accordance with federal law and regulation.

https://www.govinfo.gov/content/pkg/FR-2020-11-17/pdf/2020-25459.pdf https://sites.ed.gov/foreigngifts/ https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern https://www.bis.doc.gov/index.php/policy-guidance/lists-of-parties-of-concern https://chinatalenttracker.cset.tech/ https://www.dni.gov/index.php/newsroom/reports-publications/reports-publications-2021/item/2204-2021-annual-threat-assessment-of-the-u-s-intelligence-community https://www.dni.gov/index.php/newsroom/reports-publications/reports-publications-2021/item/2204-2021-annual-threat-assessment-of-the-u-s-intelligence-community https://www.dcsa.mil/

i. If, at any time, during performance of this research award, the academic or non-profit research performer or recipient should learn that it, its Senior/Key Research Personnel, or applicable team members or subtier performers on this award are or are believed to be participants in a Foreign Government Talent Program or have Foreign Components with a strategic competitor or country with a history of targeting U.S. technology for unauthorized transfer , the performer or recipient will notify the Government Contracting Officer or Agreements Officer within 5 business days.

1. This disclosure must include specific information as to the personnel involved and the nature of the situation and relationship. The Government will have 30 business days to review this information and conduct any necessary fact-finding or discussion with the performer or recipient.

2. The Government’s timely determination and response to this disclosure may range anywhere from acceptance, to mitigation, to termination of this award at the Government’s discretion.

3. If the University receives no response from the Government to its disclosure within 30 business days, it may presume that the Government has determined the disclosure does not represent a threat.

ii. The performer or recipient must flow down this provision to any subtier contracts or agreements involving direct participation in the performance of the research.

(e) Definitions

i. Senior/Key Research Personnel

1. This definition would include the Principal Investigator or Program/Project Director and other individuals who contribute to the scientific development or execution of a project in a substantive, measurable way, whether or not they receive salaries or compensation under the award. These include individuals whose absence from the project would be expected to impact the approved scope of the project.

2. Most often, these individuals will have a doctorate or other professional degrees, although other individuals may be included within this definition on occasion.

ii. Foreign Associations/Affiliations

1. Association is defined as collaboration, coordination or interrelation, professionally or personally, with a foreign government-connected entity where no direct monetary or non-monetary reward is involved.

2. Affiliation is defined as collaboration, coordination, or interrelation, professionally or personally, with a foreign government-connected entity where direct monetary or non-monetary reward is involved.

iii. Foreign Government Talent Recruitment Programs

1. In general, these programs will include any foreign-state-sponsored attempt to acquire U.S. scientific-funded research or technology through foreign government-run or funded recruitment programs that target scientists, engineers, academics, researchers, and entrepreneurs of all nationalities working and educated in the U.S.

2. Distinguishing features of a Foreign Government Talent Recruitment Program may include:

a. Compensation, either monetary or in-kind, provided by the foreign state to the targeted individual in exchange for the individual transferring their knowledge and expertise to the foreign country.

b. In-kind compensation may include honorific titles, career advancement opportunities, promised future compensation or other types of remuneration or compensation.

c. Recruitment, in this context, refers to the foreign-state-sponsor’s active engagement in attracting the targeted individual to join the foreign-sponsored program and transfer their knowledge and expertise to the foreign state. The targeted individual may be employed and located in the U.S. or in the foreign state.

d. Contracts for participation in some programs that create conflicts of commitment and/or conflicts of interest for researchers. These contracts include, but are not limited to, requirements to attribute awards, patents, and projects to the foreign institution, even if conducted under U.S. funding, to recruit or train other talent recruitment plan members, circumventing merit-based processes, and to replicate or transfer U.S.-funded work in another country.

e. Many, but not all, of these programs aim to incentivize the targeted individual to physically relocate to the foreign state. Of particular concern are those programs that allow for continued employment at U.S. research facilities or receipt of U.S. Government research funding while concurrently receiving compensation from the foreign state.

3. Foreign Government Talent Recruitment Programs DO NOT include:

a. Research agreements between the University and a foreign entity, unless that agreement includes provisions that create situations of concern addressed elsewhere in this section,

b. Agreements for the provision of goods or services by commercial vendors, or

c. Invitations to attend or present at conferences.

iv. Conflict of Interest

1. A situation in which an individual, or the individual’s spouse or dependent children, has a financial interest or financial relationship that could directly and significantly affect the design, conduct, reporting, or funding of research.

v. Conflict of Commitment

1. A situation in which an individual accepts or incurs conflicting obligations between or among multiple employers or other entities.

2. Common conflicts of commitment involve conflicting commitments of time and effort, including obligations to dedicate time in excess of institutional or funding agency policies or commitments. Other types of conflicting obligations, including obligations to improperly share information with, or withhold information from, an employer or funding agency, can also threaten research security and integrity and are an element of a broader concept of conflicts of commitment.

vi. Foreign Component

1. Performance of any significant scientific element or segment of a program or project outside of the U.S., either by the University or by a researcher employed by a foreign organization, whether or not U.S. government funds are expended.

2. Activities that would meet this definition include, but are not limited to:

a. Involvement of human subjects or animals;

b. Extensive foreign travel by University research program or project staff for the purpose of data collection, surveying, sampling, and similar activities;

c. Collaborations with investigators at a foreign site anticipated to result in co-authorship;

d. Use of facilities or instrumentation at a foreign site;

e. Receipt of financial support or resources from a foreign entity; or

f. Any activity of the University that may have an impact on U.S.

foreign policy through involvement in the affairs or environment of a foreign country.

3. Foreign travel is not considered a Foreign Component.

vii. Strategic Competitor

1. A nation, or nation-state, that engages in diplomatic, economic or technological rivalry with the United States where the fundamental strategic interests of the U.S are under threat.

Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not. While proposers should clearly explain the intended results of their research, the Government shall have sole discretion to determine whether the proposed research shall be considered fundamental and to select the award instrument type. Appropriate language will be included in resultant awards for non-fundamental research to prescribe publication requirements and other restrictions, as appropriate. This language can be found at http://www.darpa.mil/work-with-us/additional-baa.

http://www.darpa.mil/work-with-us/additional-baa

For certain research projects, it may be possible that although the research to be performed by a potential awardee is non-fundamental research, its proposed subawardee’s effort may be fundamental research. It is also possible that the research performed by a potential awardee is fundamental research while its proposed subawardee’s effort may be non-fundamental research.

In all cases, it is the potential awardee’s responsibility to explain in its proposal which proposed efforts are fundamental research and why the proposed efforts should be considered fundamental research.

III. Eligibility Information

A. Eligible Applicants

All responsible sources capable of satisfying the Government's needs may submit a proposal that shall be considered by DARPA. Historically Black Colleges and Universities, Small Businesses, Small Disadvantaged Businesses and Minority Institutions are encouraged to submit proposals and join others in submitting proposals; however, no portion of this announcement will be set aside for these organizations’ participation due to the impracticality of reserving discrete or severable areas of this research for exclusive competition among these entities.

1. Federally Funded Research and Development Centers (FFRDCs) and Government Entities

a) FFRDCs FFRDCs are subject to applicable direct competition limitations and cannot propose to this solicitation in any capacity unless they meet the following conditions. (1) FFRDCs must clearly demonstrate that the proposed work is not otherwise available from the private sector. (2) FFRDCs must provide a letter, on official letterhead from their sponsoring organization, that (a) cites the specific authority establishing their eligibility to propose to Government solicitations and compete with industry, and (b) certifies the FFRDC’s compliance with the associated FFRDC sponsor agreement’s terms and conditions. These conditions are a requirement for FFRDCs proposing to be awardees or subawardees.

b) Government Entities Government Entities (e.g., Government/National laboratories, military educational institutions, etc.) are subject to applicable direct competition limitations. Government Entities must clearly demonstrate that the work is not otherwise available from the private sector and provide written documentation citing the specific statutory authority and contractual authority, if relevant, establishing their ability to propose to Government solicitations and compete with industry. This information is required for Government Entities proposing to be awardees or subawardees.

c) Authority and Eligibility At the present time, DARPA does not consider 15 U.S.C. § 3710a to be sufficient legal authority to show eligibility. While 10 U.S.C.§ 4892 may be the appropriate statutory starting point for some entities, specific supporting regulatory guidance, together with evidence of agency approval, will still be required to fully establish eligibility. DARPA will consider FFRDC and Government Entity eligibility submissions on a case-by-case basis; however, the burden to prove eligibility for all team members rests solely with the proposer.

2. Other Applicants Non-U.S. organizations and/or individuals may participate to the extent that such participants comply with any necessary nondisclosure agreements, security regulations, export control laws, and other governing statutes applicable under the circumstances.

B. Organizational Conflicts of Interest

FAR 9.5 Requirements

In accordance with FAR 9.5, proposers are required to identify and disclose all facts relevant to potential OCIs involving the proposer’s organization and any proposed team member (subawardee, consultant). Under this Section, the proposer is responsible for providing this disclosure with each proposal submitted to the solicitation. The disclosure must include the proposer’s, and as applicable, proposed team member’s OCI mitigation plan. The OCI mitigation plan must include a description of the actions the proposer has taken, or intends to take, to prevent the existence of conflicting roles that might bias the proposer’s judgment and to prevent the proposer from having unfair competitive advantage.