HSI BITMAP_SOW_20240611 DRAFT.docx

Homeland Security Investigations International Operations

U.S. Department of Homeland Security 500 12th Street, SW Washington, D.C. 20536

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE

HOMELAND SECURITY INVESTIGATIONS

International Operations - BITMAP

STATEMENT OF WORK

Purpose

The purpose of this Statement of Work is for Homeland Security Investigations (HSI) to enter into a Blanket Purchase Agreement (BPA). The proposed BPA and subsequent orders placed against the BPA would be for a one (1) year base plus four (4) one (1) year Options, wherein Vendor X would provide proprietary software and online access, as well as equipment to aid in biometric collection for operational use in accordance with the contract’s agreement.

Background

HSI is the largest investigative arm of the Department of Homeland Security (DHS). It has a critical national security and public safety mission. Within HSI’s Office of International Operations, the Biometric Identification Transnational Migration Alert Program (BITMAP) trains and equips foreign counterparts to conduct targeted collection of biometric and biographic data on suspect individuals via mobile biometric collection devices. BITMAP strives to strengthen criminal investigations, border security and counterterrorism efforts by mitigating criminal and cross border illicit activity though the use of identity intelligence. BITMAP’s focus is to provide specialized technical equipment and advisory support to foreign law enforcement counterparts for the collection of biometric and biographic data from third-country nationals in support of criminal investigations.

Foreign law enforcement partners share their BITMAP information with HSI in a joint effort to identify transnational criminals, “Known or Suspected Terrorists” (KST), gang members and other persons of interest. The strategic vision of the BITMPAP program is to develop a global network of foreign law enforcement partners whose biometric collection and investigative missions are mutually beneficial and inextricably intertwined with HSI’s goal to protect the homeland.

Statement of Work

Vendors will provide exclusive access to their proprietary software that allows for the collection of biographic and biometric data (fingerprints, iris, photos) and online services similar to a cloud service in order for HSI to manage the devices, user accounts, and see/print out the enrollments. This will allow HSI to be an administrator and assign individual managerial rights to various HSI attaché offices throughout the world. Vendors will also provide HSI with user support and any scheduled or unscheduled updates, patches or fixes to the software and their online gateway.

The software and online system will allow HSI to collect and transmit biometric data to support the following mission-essential requirements:

· HSI requires that software and online services be customizable to allow the biometric collection and transmission process to align with current and future DHS biometric technical specification and business process rules.

· HSI requires that software and services be able to interface with current and future Customs and Border Protection (CBP) technical architecture of the Advanced Targeting System – Global (ATS-G) and the Unified Passenger System (UPAX), which is currently used by HSI for processing collections.

· HSI requires that software and services have the ability to conform to HSI’s needs, so any future customization that may be needed will be addressed as expeditiously as possible. For example, BITMAP Program Managers who may desire to generate reports for collection activity specific to certain devices or users could create such a document utilizing the software/services.

This contract with Vendor X would allow HSI to perform BITMAP operations more efficiently and effectively.

PRIVACY REQUIREMENTS FOR CONTRACTOR AND PERSONNEL

In addition to FAR 52.224-1 Privacy Act Notification (APR 1984), 52.224-2 Privacy Act (APR 1984), 52.224-3 Privacy Training – Alternate I (DEVIATION), and HSAR Clauses, the following instructions must be included in their entirety in all contracts.

Limiting Access to Privacy Act and Other Sensitive Information

In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984), and FAR 52.224-2 Privacy Act (APR 1984), if this contract requires contractor personnel to have access to information protected by the Privacy Act of 1974, the contractor is advised that the relevant DHS system of records notices (SORNs) applicable to this Privacy Act information may be found at https://www.dhs.gov/system-records-notices-sorns. Applicable SORNS of other agencies may be accessed through the agencies’ websites or by searching GovInfo, available at https://www.govinfo.gov that replaced the FDsys website in December 2018. SORNs may be updated at any time.

Prohibition on Performing Work Outside a Government Facility/Network/Equipment The Contractor shall perform all tasks on authorized Government networks, using Government-furnished IT and other equipment and/or Workplace as a Service (WaaS) if WaaS is authorized by the statement of work. Government information shall remain within the confines of authorized Government networks at all times. Except where telework is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and Government information shall remain within the confines of authorized Government facilities at all times. Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of telework authorizations.

Prior Approval Required to Hire Subcontractors

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Separation Checklist for Contractor Employees

Contractor shall complete a separation checklist before any employee or Subcontractor employee terminates working on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposal of sensitive personally identifiable information (PII), in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access to sensitive PII.

In the event of adverse job actions resulting in the dismissal of an employee or Subcontractor employee, the Contractor shall notify the Contracting Officer’s Representative (COR) within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of employment or work on the contract.

As requested, contractors shall assist the ICE Point of Contact (ICE/POC), Contracting Officer, or COR with completing ICE Form 50-005/Contractor Employee Separation Clearance Checklist by returning all Government-furnished property including but not limited to computer equipment, media, credentials and passports, smart cards, mobile devices, PIV cards, calling cards, and keys and terminating access to all user accounts and systems.

Contractor’s Commercial License Agreement and Government Electronic Information Rights

Except as stated in the Performance Work Statement and, where applicable, the Contractor’s Commercial License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and are considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

Privacy Lead Requirements

If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy documentation, the Contractor shall assign or procure a Privacy Lead, to be listed under the SOW or PWS’s required Contractor Personnel section. The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Lead shall work with personnel from the program office, the ICE Privacy Unit, the Office of the Chief Information Officer, and the Records and Data Management Unit to ensure that the privacy documentation is kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

The Privacy Lead:

· Must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and the ability to synthesize information from a variety of sources.

· Must have excellent verbal communication and organizational skills.

· Must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

· Must be knowledgeable about the Privacy Act of 1974 and the E-Government Act of 2002.

· Must be able to work well with others.

If a Privacy Lead is already in place with the program office and the contract involves IT system builds or substantial changes that may require privacy documentation, the requirement for a separate Private Lead specifically assigned under this contract may be waived provided the Contractor agrees to have the existing Privacy Lead coordinate with and support the ICE Privacy POC to ensure privacy concerns are proactively reviewed and so ICE can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance if required. The Contractor shall work with personnel from the program office, the ICE Office of Information Governance and Privacy, and the Office of the Chief Information Officer to ensure that the privacy documentation is kept on schedule, that the answers to questions in any privacy documents are thorough and complete, that all records management requirements are met, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

APPLICABLE DOCUMENTS

PERIOD OF PERFORMANCE

This proposed BPA will remain in effect from the date of award through one (1) base year and four (4) one (1) year options if exercised, as follows:

PLACE OF PERFORMANCE

Devices are loaned to foreign law enforcement partners through HSI BITMAP; therefore, all or part of the work will be performed outside of the United States.

INTELLECTUAL PROPERTY

The General Law Attorney will involve a DHS Intellectual Property Attorney, as needed.

SECTION 508 COMPLIANCE

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

COMPLIANCE WITH DHS SECURITY POLICY TERMS AND CONDITIONS

All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy and DHS 4300A Sensitive Systems Handbook. For example, interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be authorized at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnection security agreements.

GOVERNMENT FURNISHED RESOURCES

The Government will not furnish any resources to the Contractor in support of this contract.

GOVERNMENT ACCEPTANCE PERIOD

The Contracting Officer Representative (COR) will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

Recommendation

For HSI to enter into a BPA with Vendor X for a one (1) year base plus four (4) one (1) year options if exercised, wherein Vendor X would provide proprietary software and online access, as well as equipment to aid in BITMAP’s global operations upon receipt of orders place against the BPA.

image1.png image2.png