SoURCE_CODE_BAA_QnA_ROUND2 - 01192024_C.pdf

SoURCE CODE Program

IARPA-BAA-24-02

Industry Questions and Government Responses Round 2

NOTE: Numbering sequencing continues from Round 1 Response submissions.

41. "With regards to the BAA Section 1.D. Specifically, the BAA states: “Many types of malware will be considered within the datasets, which may include packed malware or malware with other obfuscation techniques.”

Are performers required to address both obfuscated code (malicious or otherwise) and benign code or is it sufficient to address one and not the other? Given the differences between obfuscated and unobfuscated code, our concern is that supporting both forms would skew performance numbers (especially accuracy)."

Answer 41. Throughout the execution of the program, performers will be made aware of any datasets that may contain such confusers so there is sufficient time to accomplish any challenges that are given to performers. Datasets selected are meant to be challenging and we are aware that different datasets may cause a skew in performance numbers - this will be accounted for in test and evaluation. We are looking for unique and innovative approaches to work through such challenges to ensure we can accomplish forensic evaluation with a variety of data types.

42. With reference to Page 6, 1.A.2.a, does “…using inputs of both source code and binary representations” imply that proposals must address both source code and binary representations? Or can we propose feature extraction, similarity and explainability for either source code OR binaries.

Answer 42. Proposals must address both source code AND binary representations. We are looking for innovative approaches and Phase 2 will move to source to binary and binary to source.

43. Does the Government anticipate that work performed under SoURCE CODE will be fundamental research and appropriate for being released as open-source software? Or will program-developed software be considered CUI/CTI and thus require enhanced storage and processing restrictions. Similarly, will TA1 GFI data be deemed CUI and therefore subject to enhanced storage requirements? We note that the answer to these questions impact proposed collaboration approaches, as some community resources (e.g., GitHub and AWS) are not amenable to processing CUI data.

Answer 43. TA1 is unclassified, without caveat. IARPA will not deem research as "fundamental research" for the purpose of the research qualifying for the fundamental research exclusion for export controls. Please refer to BAA Section 6.B.6 Export Control.

44. We've sent documentation to receive the classified addendum of the program and have not received the addendum yet. When can we expect to understand the status of the submission and/or receive the classified addendum?

Answer 44. The security packages are currently being reviewed. No offerors have received the classified addendum to date. We will allow offerors a minimum of 30 days after release of the classified addendum for proposal submission. (This may mean the current deadline will be extended further as we await security approvals).

45. "Reference: - IARPA-BAA-24-02, Amendment 001 – General Information, 7. 3. Are responses to

TA-01 (only) for this BAA due on the original date (1/22/2024) or on the date listed on

Amendment 001 (2/16/2024)?"

Answer 45. The due date for submission of TA-01 ONLY proposals is hereby amended to 16

February 2024. The due date for submission of TA-01, T-02, & TA-03 proposals is hereby amended to 01 March 2024, but may be extended to allow at least 30 days for proposal submission.

46. "Reference: IARPA-BAA-24-02 – Section 4. A. 2., Question: Request that the Government provide

POC information for Booz Allen Hamilton, Crimson Phoenix, SiteWorks, and Navstar Inc. to the offerors in order to initiate NDAs with each firm."

Answer 46. All IARPA Contractor personnel that would have access to proposal information have completed appropriate NDAs. If you do not want contractors to have access to your proprietary data, see BAA Section 4.A.2 Proposal Information for further instructions.

47. "Reference: IARPA-BAA-24-02 – Section 4. B.1.b., Question: Will the Government allow offerors to include an acronym list within their Technical and Management Proposal that will not count against the 25-page limitation?"

Answer 47. Commonly accepted, technical acronyms may be included in an addendum, which does not count account against the 25-page limit. Uncommon and/or proprietary acronyms

(technical or otherwise) shall be fully written out within the Offerors proposal and counted against the 25-page limit.

48. "Reference: IARPA-BAA-24-02 – Section 4.B.1.c (i). Research Data Management Plan (RDMP) and

Attachment 11 Research Data Management Plan (RDMP), Question: The RDMP is required in

Section 2.0 and also as Attachment 11. Given the 25-page limitation for the Technical and

Management Volume, is it sufficient for offerors to point to the information provided in the completed Attachment 11 when addressing the RDMP requirement in Section 2.0? This would allow for more information to be included in our technical response by increasing available page space, rather than providing duplicate information in the volume."

Answer 48. It is sufficient for offerors to point to the information provided in the completed

RDMP, Attachment 11 within their proposal to address the Section 4.0 RDMP requirement. The

BAA will be amended to state that Attachment 11 will not count against the Offerors 25-page limit. Also, the BAA will be clarified to tie the RDMP, Attachment 11 to BAA Section 4.B.1.c.

Section 3: Detailed Proposal Information. Please ensure all requested information is addressed accordingly.

49. How is Section 3.L (BAA p. 28) of the proposal different than Attachment 11 (BAA p. 32)?

Answer 49. Section 3.L provides definitions and explanations for what a RDMP is and what must be addressed within the offeror's RDMP submission. Attachment 11 provides offerors with a

RDMP template for their use during proposal submission.