SOW.pdf

Request for Proposal HSSS01-13-R-0028

DHS, USSS, CID Page 3

Cell Phone Forensic Facility Research Associate Program

BLANKET PURCHASE AGREEMENT

STATEMENT OF WORK (SOW)

OVERVIEW: THE United States Secret Service (USSS), along with the other agencies of the Treasury Computer Forensic Training Program, the Department of Homeland Security, Homeland Security Investigations, and the Internal Revenue Service, require support assistance with their respective electronic crimes programs in the form of research associates. The USSS intends to establish a Blanket Purchase Agreements(s) for cell phone forensic services.

BACKGROUND: The U.S. Secret Service operates a facility housed on the campus of the University of Tulsa. The facility has a three-pronged mission: (i) training law enforcement agents and officers in embedded device forensics; (ii) developing novel hardware and software solutions for extracting and analyzing digital evidence from embedded devices; and (iii) applying the hardware and software solutions to support criminal investigations conducted by the U.S. Secret Service and its partner agencies.

OBJECTIVE: Obtain cell phone forensic services support for the tasks listed below.

CONTRACT TYPE: A Blanket Purchase Agreement (BPA) with firm fixed price labor hour labor rates. Negotiated Time and Material Task Orders (TO) will be placed against this agreement as needed to support this project.

SCOPE: On an as needed basis, the Contractor shall provide cell phone forensic services support for the tasks as outlined below. The tasks will be conducted at the location specified in the Place of Performance section. The Offeror shall designate a Project Manager as the designated point of contact through which requests can be communicated by the USSS personnel.

Task 1: Cell Phone Forensic Analysis:

The nature of this work involves the examination of cell phone devices that cannot be processed through vendor purchased software. This can occur for reasons that may include password protection, damage, and manufacturer induced limitations.

Decapsulation processes – development of a process to ablate material away from a microcontroller in order to gain access to internal bond wires.

Wire bonding – establish mechanical connections to trace bond wires inside microcontrollers.

Reading - Probe microcontrollers to determine proper communication standards / protocols.

Interpretation - decoding of raw physical extractions taken from embedded device FLASH memory stores.

Pin out discovery – determine the pin-out of various FLASH EEPROM to provide the ability to create bit for bit images of the data on the chip.

Task 2: Credit Card Skimmer Examination:

The nature of this work involves the forensic examination of devices that capture the data stored on credit and debit cards.

Imaging - Identify hardware components on skimming devices and determine the most efficient process of extracting data from the devices.

Interpretation - decoding / demodulating / and decrypting the extracted data from credit card skimmers.

DHS, USSS, CID Page 4

Note: Tasks 1 and 2 will be performed at the USSS Cell Phone Forensic Facility located in Tulsa, OK. Work is typically completed with Python scripting, IDA Pro decompiler software, as well as various custom Linux based tools. Strengths in these software examples are required.

Task 3: Computer coding:

The nature of this work requires a strong background and proficiency in the following programming languages: HTML5, Java, C+, and C++. Additionally, associates must have familiarity with the Mac OSX operating system and HFS file system.

Note: Task 3 will be performed at the Department of Homeland Security, Homeland Security Investigations, Fairfax, VA.

Task 4: Windows Systems Programming:

The nature of this work requires a strong coding background and proficiency with Microsoft Windows programming experience, most notably the use of C++ programming. Additional Windows Administration and technical writing/documentation experience is preferred.

Note: Task 4 will be performed at the Internal Revenue Service, Electronic Crimes, Technology and Support Center, Springfield, VA.

CONTRACTOR PERSONNEL:

The Contractor shall provide one or more personnel necessary to accomplish the various tasks that may arise.

All contractor employees are required to adhere to USSS IT Rules of Behavior, Privacy Policies as well as comply with other reasonable security-related requirements as may arise from time to time.

Contractor employees shall present a professional appearance at all times and their conduct shall not reflect discredit upon the United States and the Department of Homeland Security.

The Contractor shall not employ any person who is an employee of the United States Government if that employment would, or would appear to cause a conflict of interest.

All proposed substitutes shall possess qualifications equal to or superior to those as described in the BPA labor category description/profile.

The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from the Government facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under any BPA TO awarded. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

Project Manager:

The Project Manager shall be the primary point of contact for the Contracting Officer (CO) and Contracting Officer’s Representative (COR). The Project Manager shall be responsible for providing quotes to the COR within 48 hours of request and for keeping the COR abreast of changes made in estimates and/or services. The Project Manager or designee shall be available to the COR or designated representative via telephone during normal business hours and shall respond within 1 hour of notification for discussion and resolution of technical problems.

Minimum Qualifications

High school diploma (or the equivalent) and not less than one year of experience in contract management.

DHS, USSS, CID Page 5

The following are the correlating labor categories that are necessary to accomplish the various tasks identified above:

Cell Phone Forensic Analyst:

Minimum Qualifications

High school diploma (or the equivalent) and not less than one year of experience with hardware and software reverse engineering to include debugging interfaces, standards, and protocols.

Experience with micro chip decapsulation.

Experience with embedded file systems and memory mappers.

Credit Card Skimmer Examiner:

High school diploma (or the equivalent) and not less than one year of computer programming experience using scripting languages to include, but not limited to, Python.

Computer coder:

High school diploma (or the equivalent) and not less than one year of experience in programming languages to include, but not limited to, HTML, Java, C+, and C#.

Experience in programming within the Mac OSX operating system and HFS file systems.

Windows Systems Programmer:

High school diploma (or the equivalent) and not less than one year of experience of programming within the Windows operating system and technical administration.

Technical writing experience required

PERIOD OF PERFORMANCE: The period of performance for this BPA is anticipated to be for a base period of ONE (1) year, plus FOUR (4) option years if exercised for a total performance period of five (5) years.

PLACE OF PERFORMANCE:

Tasks 1 and 2 will be performed at: U.S. Secret Service, Cell Phone Forensic Facility, Tulsa, OK.

Task 3 will be performed at the Department of Homeland Security, Homeland Security Investigations, Fairfax, VA.

Task 4 will be performed at the Internal Revenue Service, Electronic Crimes, Technology and Support Center, Springfield, VA.

HOURS OF OPERATION:

The tasks listed above are to be completed Monday – Friday, between the hours of 9:00 AM and 5:00 PM, with the exception of federal holidays.

Recognized Federal Holidays:

New Years Day, Martin Luther King’s Birthday, President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving, Christmas Day, and any other day designated by Federal Statute, Executive Order and/or Presidential Proclamation.

DHS, USSS, CID Page 6

INSPECTION AND ACCEPTANCE:

In the absence of other agreements outlined and/or negotiated with respect to time provided for Government review, deliverables will be considered accepted if no comments are made within 30 days of deliverable due date.

DELIVERABLES:

Deliverables of these tasks may be in the form of hardware, software, or documented (repeatable and verifiable) processes.

Certification by the Government of satisfactory services provided shall be contingent upon the contractor performing in accordance with their resumes and final order.

The USSS representative and the contracting entity representative may be encouraged to meet bi-weekly at the place of performance to discuss performance and the deliverables:

Monthly Project Status report in Electronic Format due 10th workday of every work month. Report should include:

Accomplishments, planned activity, assistance needed, issues/problems and amount of time and money expended.

Final Report in Electronic Format due within 10 days of end of each contract year

All Contractor developed processes and procedures and other forms of intellectual property developed under TOs issued against this BPA shall be considered Government property.

All documentation, photography, and electronic data and information collected by the Contractor and entered into or generated in support of TOs issued against this BPA shall be considered Government property, and shall be returned to the Government at the end of the performance period.

ORDERS AGAINST BPA: Upon receipt of a Task Order Request (to include task number(s) and period of performance) the Contractor’s Project Manager is required to provide documentation detailing the type of service to be provided, the proposed estimate of work (quote) and the resume of the proposed candidate within 48 hours of request. The Program Manager shall also provide a monthly invoice in accordance with the terms and conditions of this BPA which includes all tasks for the billing period that have been completed and accepted.

CONTRACTING OFFICER’S REPRESENTATIVE (COR):

As a representative of the CO, the COR is responsible for the administration of the contract/task order and for assuring compliance by the Contractor with the requirements of the contract/task order.

GOVERNMENT PROPERTY:

Contractor personnel working on-site at USSS shall be provided with office space and standard office equipment.

Contractor personnel working off-site shall be expected to furnish whatever property is necessary to perform the contract, unless expressly provided otherwise in the contract.

INVOICING:

All invoices must include the following information or it may result in your invoice being classified as improper and it may be returned, thus delaying payment.

Vendor Name, Vendor Address, Vendor Telephone Number, Vendor Tax Identification Number (TIN), Contract/Purchase order number, Invoice date, Invoice number, Invoice amount, Description of goods or services provided/Line number of contract or purchase order, Period of performance (if applicable).

Invoice Submission

Electronic Invoicing (Recommended Method)

DHS, USSS, CID Page 7 o Submit the invoice as a PDF or Microsoft product attachment to an email. The email should be forwarded to the following addresses:

ebilling@usss.dhs.gov, COR's email, siobhan.mullen@usss.dhs.gov

Invoicing Via Mail

1. Submit (1) invoice to the following address:

COMMUNICATIONS CENTER (FMD)

ATTN: COMML & GOVT PAYMENTS

P. O. BOX 6500

SPRINGFIELD, VA 22150

2. Submit a SECOND (duplicate) invoice to the following address:

COMMUNICATIONS CENTER (___)

ATTN: ___________

P. O. BOX 6500

SPRINGFIELD, VA 22150

3. Submit a THIRD (duplicate) invoice to:

COMMUNICATIONS CENTER (PRO)

ATTN: Siobhan Mullen

P. O. BOX 6500

SPRINGFIELD, VA 22150

Invoice Payment In the absence of discount terms, the Secret Service processes invoices in accordance with the Prompt

Payment Act. Payment will be made within 30 days of receipt of a correct invoice or delivery of the goods or services, whichever is later.

It may take approximately 30 days to receive payment. If after 30 days, you do not receive payment, please contact the Financial Payments Branch, Financial Management Division at 202-406-5232.

SECURITY:

This contract is unclassified. Due to the sensitivity of information to be collected, all KEY contractor personnel performing this work shall be United States citizens with no dual citizenship. KEY Contractor personnel must undergo a security background check by the USSS. The contractor shall provide personnel who successfully pass the background investigation. The USSS shall provide facility access and required systems access in order to perform the duties. This access shall be in accordance with existing USSS facility access security procedures. The contract shall not start until all individuals performing on the contract have been cleared by the USSS. Any delay of commencement due to security reasons is not considered an “Excusable Delay” and may not otherwise extend the delivery times noted.

Contractor personnel will be required to be United States citizens and shall meet the USSS suitability requirements, which may or may not include record or index checks such as Local, State or Federal Criminal Justice agencies, credit bureaus, consumer reporting agencies, collection agencies, retail businesses, or other sources of information.

All contractor personnel requiring access to USSS facilities shall complete the following forms which shall be provided by the USSS:

o SSF 3230a - Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act o SSF 3237 - Contractor Personnel Access Application o SSF 4024 - Conditional Access To Sensitive But Unclassified Information Non-Disclosure Agreement

DHS, USSS, CID Page 8 o SSF 4087 - Non USSS Employee Certification

Use of non-USSS computers or networks to work on or transfer documents, files, or other media that would identify any aspect of the USSS (i.e. IP address schemes, server naming conventions, location of resources, etc.) shall not be used unless authorized by the USSS.

LIMITATION OF FUTURE CONTRACTING:

The DHS HSAR Clause 3052.209-73 LIMITATION OF FUTURE CONTRACTING (JUN 2006) is applicable in regards to organizational conflict of interest applies. The contractor shall sign permanent non-disclosure agreements and procurement integrity certifications as required by the Contracting Officer upon award of the contract. All personnel assigned to this contract shall immediately notify the Contracting officer in writing of any potential conflicts of interest that may be perceived through their performance. The Contracting Officer will determine if the particular individual or group of individuals will be excluded from any acquisition/project. In the event such a determination is made, the CO will provide immediate oral notification (followed by written notification within five days thereafter) of the individuals and the situation that precludes their performance under the resulting contract. The Contractor shall immediately (within five days after receipt of oral notification) remove the individual(s) from the resulting BPA and identify their replacement.