D15PC00205_-_JOFOC_FAR_6.302-For_Posting.pdf

United States Department of the Interior

INTERIOR BUSINESS CENTER

Washington, DC 20240

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION AUTHORITY:

FAR 6.302, 41 U.S.C. 253(c)

CONTRACT #D15PC00205

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by FAR 6.3 and in accordance with the requirements by FAR 6.303-1, the use of the statutory authority under FAR 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

1. Identification of the agency and the contracting activity, and specific identification of the document as a “Justification for other than full and open competition.”

This document is a justification for other than full and open competition for the Department of the Interior (DOI), Interior Business Center (IBC), Acquisition Services Directorate (AQD), Division IV (D4), in support of the Department of Homeland Security (DHS), Science and Technology (S&T), Mission Capability Support (MCS) requirements.

2. Nature and/or description of the action being approved.

This action will result in a modification to extend Contract #D15PC00205 by 24 months. The Contract was awarded under DHS Broad Agency Announcement (BAA) BAA-14-R-B0005 for a three (3) year cost reimbursement (no fee) research and development project. While the BAA allowed for the possibility that the developed software may be tested in real-world scenarios, funds were not available for the potential effort at that time. The original contract only required lab testing. However, lab testing does not allow for the evaluation of the software under realistic attacks.

Under Contract #D15PC00205, the Contractor, Colorado State University, developed technology to detect and mitigate Distributed Denial of Service (DDoS) attacks at very high speeds. DDoS attacks continue to be one of the top-5 problems Internet Service Providers (ISPs) face today. Commercial solutions to this problem are expensive, may require Internet-wide tampering with global routing, and may cause collateral damage. The reason is that such solutions focus on the network being attacked and do not share information across networks to mitigate attacks deeper into the network and close to the source of the attack. Moreover, commercial solutions are closed systems that are hard to compare and evaluate. This Contractor is one of three (3) awarded a research and development contract attempting to mitigate DDoS attacks. Each of these Contractors are entering into the piloting phase.

In contrast to commercial solutions, the technology developed under #D15PC00205 is open-source. Since it is distributed, it pushes mitigation deeper into the network, which avoids collateral damage and does not require changes to the global Internet routing. Moreover, the contractor’s technology, NetBrain, uses machine learning to create traffic models to minimize false positives and negatives.

This Contract action is for follow-on effort to pilot test the previously developed technology in real world scenarios. The testing will add scope, time, and funding to Contract #D15PC00205. The pilot program will deploy the technology across three (3) ISPs. It will require the Contractor to procure the necessary information technology equipment to build the infrastructure needed for pilot testing this Contractor’s developed technology as well that of two (2) other Contractors.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value).

The work to be performed during this additional period includes the deployment of the Contractor’s previously developed technology in a pilot program across three (3) ISPs. The Agency requires adding a cost reimbursement (no fee) period of 24 months for the pilot effort to evaluate the technology in real-world environments.

The pilot program will deploy the technology across three (3) ISPs. Each ISP will allow the installation of equipment to:

(a) capture traffic at 100 Gigabits per second (Gbps);

(b) summarize traffic into conversations called flows that include only the source IP, destination IP, port number (application), and a timestamp;

(c) use the flow information to detect an attack;

(d) construct rules (filters) that can be installed at ISPs to mitigate the attack;

(e) collect statistics about the attack and the success of mitigation; and

(f) if available, compare the success of detection/mitigation with any existing commercial solutions.

In addition to the above technology evaluation, the Contractor shall procure the necessary equipment to build the capture/summarization infrastructure for the pilot project at all three (3) ISPs. The Contractor will be responsible for configuring, connecting and maintaining the equipment for the duration of this project. The equipment shall be used by two other Contractors to deploy and test their technology under similar pilot programs. The Contractor shall be responsible for managing access to the equipment and data deployed at all three (3) ISPs.

This modification will result in an additional 24 months of performance under the existing contract, for an estimated cost increase of $ . The estimated contract cost increase will bring the total estimated contract value to $ .

4. An identification of the statutory authority permitting other than full and open competition.

The statutory authority within FAR 6.302-1 - Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements, as cited in 41 U.S.C. 3304(a)(1), permits other than full and open competition.

(ii) Supplies may be deemed to be available only from the original source in the case of a follow-on contract for the continued development or production of a major system or highly specialized equipment, including major components thereof, when it is likely that award to any other source would result in --

(A) Substantial duplication of cost to the Government that is not expected to be recovered through competition

5. A demonstration that the proposed contractor’s unique qualifications or the nature of the acquisition requires use of the authority cited.

The Contractor, Colorado State University, provided the design, research, engineering, and development for the NetBrain technology contemplated for pilot testing. The University has successfully demonstrated the effectiveness of this technology in the lab environment under synthetic attacks. This follow-on pilot testing will demonstrate effectiveness under real-world conditions needed to further the commercialization of the technology. The Contractor is uniquely qualified to perform the pilot testing for the following reasons:

(a) the Contractor developed the original technology and is thus intimately familiar with it;

(b) given its position as the original developer, the Contractor has specialized software expertise and development capabilities to improve the software based on user feedback that other Contractors do not possess;

(c) the Contractor has demonstrated 40Gbps capture in the lab under Contract #D15PC00205, and has presented evidence that the same technology will scale to the desired 100Gbps;

(d) the Contractor possesses unique capabilities to select and configure the necessary equipment for the pilot program because it successfully filled a similar requirement during the original project under Contract #D15PC00205.

6. A description of efforts made to ensure that offers are solicited from as many potential sources as is practicable, including whether a notice was or will be publicized as required by Subpart

5.2 and, if not, which exception under 5.202 applies.

Synopsis under FAR Subpart 5.2, Synopses of Proposed Contract Actions, of individual contract actions based upon proposals received under the BAA is not required. The notice published pursuant to paragraph

(c) of that section fulfills the synopsis requirement.

Pilot testing, the subject of this action, was contemplated by the Government in BAA-14-R-B0005 but was not priced or funded at the time of the original award. The Contracting Officer (CO) will not publicize the proposed additional Contract action as required by FAR 5.201 because the CO determined that the action is made under the terms of an existing Contract that was previously synopsized in sufficient detail to comply with the requirements of FAR 5.207, in accordance with the exception at FAR 5.202(a)(11).

This justification will be posted to FedBizOpps after award in accordance with FAR 6.305.

7. A determination by the contracting officer that the anticipated cost to the Government will be fair and reasonable.

A full cost and price analysis using historical prices paid and current market rates for the same or similar work will be performed to ensure that the final agreed to price is fair and reasonable. Furthermore, a price analysis of proposed other direct costs comparing the proposed equipment to market costs will be performed.

8. A description of the market research conducted (see Part 10) and the results or a statement of the reason market research was not conducted.

In accordance with FAR 35.016 – Broad Agency Announcement, Market research for this action is not required or necessary because the original proposal received from the Contractor was in response to the BAA. Proposals received were evaluated in accordance with evaluation criteria specified therein through a peer or scientific review process. The primary basis for selecting proposals for acceptance were technical factors, importance to agency programs, cost reasonableness, and funds availability, as appropriate. There is no reason to believe that conducting market research for this requirement would yield different results.

9. Any other facts supporting the use of other than full and open competition; such as:

The original Contract effort, solicited as part of a BAA, was intended to develop open technology to address the problem of DDoS attacks. Open technologies are preferred by the government because they lower costs and encourage competition. The BAA opened a competition where the best performer that could develop such technology and reference model was selected.

The reasons for continuing this work with the same Contractor are outlined above in Section 2 - Nature and/or Description of the action being approved. Moreover, bringing in another Contractor at this stage would cause significant delays while the new Contractor familiarized itself with the specifications and forged relationships with the three ISPs to allow the technology to be field-tested. After the technology is tested in the real world and the design has matured, new vendors can compete to create installations based on the open reference implementation, which will provide the Government with the opportunity to select the best implementation.

Commercial solutions are not appropriate for this pilot because they are not flexible enough to accommodate an experimental deployment. Commercial solutions are also expensive because they include the cost of polished user interfaces (UIs), which are not needed in a prototype.

The costs of competing a new contract and bringing on another Contractor at this stage in the project would be high and competition would not likely generate any cost savings.

The Contractor has agreed that the technology will be an open, public standard and will it will provide open-source, free reference and implementation guides to the public.

10. A listing of the sources, if any, that expressed, in writing, an interest in the acquisition.

There was no interest from any other vendors to undertake this research and development work.

11. A statement of any actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the supplies or services required.

Upon completion of this pilot program, the Government does not anticipate any barriers to competition, thus it will become open-source to allow all OEMs to install and adapt this technology.

Concur

Digitally signed by ERIC

LOVERIDGE

Date: 2019.01.03 22:53:36 -07'00'

GLEN SAVORY

Digitally signed by GLEN

SAVORY

Date: 2019.01.07 08:01:56 -05'00'