Amendment 1 RFI IC Data CoOp 20 Aug_Clean v.1.pdf

UNCLASSIFIED

(U) Request for Information (RFI): Intelligence Community (IC) Data Co-op (ICDC)

RFI: ODNI-RFI-24-07

Agency: Office of the Director of National Intelligence (ODNI) Office: Office of Economic Security and Emerging Technologies (OESET), Office of the Intelligence Community Chief Data Officer (IC CDO), and Office of the Open Source Intelligence (OSINT) IC Executive

(U) Introduction

(U) On behalf of the ODNI, Office of Economic Security and Emerging Technologies (OESET) , IC CDO, and OSINT IC Executive (hereafter referred to as the Sponsor), Respondents are hereby invited to submit white papers responsive to the problem set described below for the IC Data Co-op effort. The Sponsor anticipates using the responses to identify sources for potential award of a Prototype Other Transaction (OT) Agreement(s) under the authority described in 10 U.S.C. § 4022 as modified by 50 U.S.C. § 3024(n)(5).

(U) Action: Submittal of White Paper(s) due by 09/10/2024 12:00pm EST. White Papers shall address capabilities that may scale to support complex data requirements. See White Paper Submission Instructions section for more details.

(U) Problem Statement

(U) The Sponsor seeks to leverage a data co-op model to reduce the aggregate cost of Commercially Available Information (CAI) and Publicly Available Information (PAI) and accelerate and improve the IC’s acquisition of and access to CAI and PAI, while providing quality data management and maintaining adherence to legal and policy requirements for the acquisition and handling of that data. The operator would also be responsible for ensuring that the terms and conditions governing the use of the data comply with the intellectual property requirements of the various suppliers and developing an automated way to ensure potential government users are aware of those restrictions at ingestion.

(U) A new CAI/PAI data acquisition approach is needed for the IC to overcome the acquisition and technical limitations of the current model’s rigid and siloed approach.

(U) Problem Background

(U) IC elements are unable to rapidly and efficiently vet and acquire data due to the growing volume of data available for purchase and the increasing number of private sector vendors that sell their own and third-party data. The phenomenon of vendors reselling the same or similar data while implementing unique techniques to aggregate data makes it difficult for the IC to determine the differentiated value offered by each vendor. The Sponsor seeks an approach based on a repeatable data management1 plus civil liberties and privacy best practices to help integrate CAI/PAI data for the entire IC and make it available to the mission users in a more cohesive and effective manner by avoiding duplicative purchases and reducing the overall cost of acquiring, processing (including extracting, loading, transforming, structuring, and cleaning), enriching, and sharing the data. The Sponsor seeks an enterprise approach to integrate information from commercial datasets and publicly available information by establishing a government-funded data co-op, which will serve as a clearinghouse for IC

1 Data Management Maturity Model https://talkabout.cia/datamaturity/the-agency-data-management-maturity-model/ data requirements, a single focal point in negotiations with vendors, a compliance vehicle to ensure the IC’s use of the data complies with owners’ terms and conditions, and a mechanism to pool agency funds to gain access to targeted commercial data sets.

(U) Significant challenges include:

• Establishing agile acquisition processes and supporting governance to purchase CAI/PAI for the whole of the IC

• Increasing understanding of the current and evolving CAI/PAI data ecosystems

• Increasing expertise and improving processes to evaluate the data providers, data quality, and cost value of the data being provided

• Shortening acquisition speed while reducing the aggregate cost of acquiring CAI/PAI across the

IC

• Protecting intellectual property rights of the suppliers

• Establishing and monitoring a low-side data environment to host and transform raw data at scale using modern techniques to illuminate gaps and provide intelligence while ensuring proper data handling, security and privacy protections of any sensitive data

(U) Project Goals

(U) The data co-op operator should have established processes and infrastructure for receiving, structuring, enriching, sharing, and disposing of data. Desired experience includes the following:

• Working with the IC and Department of Defense or similar large consumers like federal, State or Local governments

• Navigating the breadth of commercial data providers

b. Identifying and vetting data vendors and evaluating data quality

a. Potential commercial data providers should follow the Risk Management Framework (RMF), and when conducting the analysis of PII confidentiality impact level necessary to identify the applicable Privacy Overlays.

Leverage the ODNI’s Guidance for Intelligence Community Professionals: Properly Obtaining and Using Publicly Available Information.

• Establishing and managing current and future vendor relationships

• Negotiating and managing data acquisition and ensuring compliance with terms and conditions for use

• Establishing and managing an encryption secured and privacy enabled low-side data environment that is accessible by IC low and high side platforms

• Understanding the public sector to creatively negotiate the acquisition of the data to ensure best value at the lowest cost

• Grow and sustain repeatable experience in data acquisitions and life cycle management to properly accommodate the needs of the IC (i.e., the detail and coverage of the data being acquired enables the IC to answer their intelligence questions).

(U) The Sponsor is seeking information regarding the considerations that the Government should consider in determining its approach to the acquisition of CAI/PAI, to include:

1. (U) Identify Vendors: Identify commercial data providers who can respond to the IC mission user needs.

2. (U) Vet Vendors: Vet potential vendors and be transparent when sharing with the IC any vendor concerns.

3. (U) Cost Assessment: Assess the cost differences among the vendors.

4. (U) Privacy Assessment: Provide a written assessment as to whether the CAI/PAI contains any personally identifiable information (PII) and the appropriate low, medium or high sensitivity to inform the IC mission users, and provide CLPT and CISO offices with the documentation to apply the “appropriate administrative, technical, and physical safeguards” to protect PII and other sensitive information irrespective of whether the organization maintains the PII as part of a system of records. Source: Committee on National Security Systems Instruction (CNSSI) 1253, Privacy Overlays.

5. (U) Cost Value: Maximize cost efficiency across the breadth of IC data acquisitions via enterprise data acquisitions and improve data management efficiency.

6. (U) Acquire Data: Manage data acquisition while serving as an impartial third-party negotiator with the purchasing power of the entire IC.

a. Data Management Plan: All collection and acquisition of data will need to include an end-to-end data management plan, from the point of collection or acquisition of data through exploitation, dissemination, and disposition, with consideration for its ethical and appropriate use, consistent with law and policy." Per the DNI’s Guidance for Cataloging Commercially Available Information, signed 17 Oct 2023

7. (U) Assess Data Quality: Validate and assess commercial data being provided by the vendors.

Leverages civil liberties and privacy principles that emphasize the importance of objectivity, while maximizes data diversity to avoiding bias and distortion, while testing the output for the quality and reliability of underlying information.

8. (U) Secure, Tag, Catalog Data: Implement Sponsor’s requirements for securing, tagging, and cataloging all data being purchased.

9. (U) License Management: Manage data access licenses and ensure that license use meets terms and conditions of the agreements. Consider.

10. (U) Hosting: Operate an information environment to extract, transform, load, secure, enrich, and access data.

11. (U) Metrics: Provide business analytics, persistent market survey insights, and data usage metrics.

12. Vendor(s) should supply the government with the methodology of they will:

a. Deliver the PAI /CAI that incorporates the Privacy Overlays in compliance with federal privacy requirements.

b. Well-designed, automated access controls (e.g., mandatory access control (MAC), discretionary access control (DAC), role-based access control (RBAC), or attribute-based access control (ABAC)) limit user access to information according to defined access policies, which helps ensure the security and confidentiality of the PII contained in the system.

(U) White Paper Submission Instructions

(U) White Papers shall not exceed 7 pages in length and be unclassified. The White Paper shall be in either Microsoft Word or Adobe PDF file type. The cover page and table of contents do not count against the page limit.

(U) Respondents should effectively present their technical solution in the white paper.

(U) Respondents shall clearly mark all proprietary information included in their submissions. At a minimum, they shall identify proprietary information on the first page of any submission and every subsequent page that includes proprietary information with a label such as “Proprietary.” The Sponsor shall protect against the unauthorized use or release of proprietary information obtained from the Respondent (or derived from information obtained from the Respondent) in response to the Sponsor’s request for White Papers.

(U) Respondents shall submit the White Paper electronically to dni-iarpa-rfi-24-07@iarpa.gov by 12:00pm ET on 09/10/2024. The Sponsor, at its discretion, may or may not consider submissions made after this date.

(U) Questions

(U) Respondents may submit questions until 12PM ET, 09/03/2024, by contacting Michael Shimoff @ Michael.l.shimoff@odni.gov (Sponsoring Officer) at unclassified (301) 243-1581 or Raymond Banks @ Raymond.v.banks@odni.gov or 301-243-1353.

(U) This is an RFI issued solely for information and planning purposes and does not constitute a solicitation or authority to enter negotiations. Respondents are advised that the Sponsor is under no obligation to acknowledge receipt of the information or to provide feedback to respondents with respect to any information submitted under this RFI. Responses to this notice are not offers and cannot be accepted by the Government to form a binding procurement instrument. Respondents are solely responsible for all expenses associated with responding to this RFI. The Sponsor will not provide reimbursement for costs incurred in responding to this RFI. It is the respondent's responsibility to ensure that the submitted material has been approved for public release by the information owner. The Government does not intend to award a procurement instrument on the basis of this RFI or to otherwise pay for the information solicited, nor is the Government obligated to issue a solicitation based on responses received. No classified concepts or information shall be included in the submittal. Any proprietary information shall be marked accordingly. Input on technical aspects of the responses may be solicited by the Sponsor from non- Government consultants/experts who are bound by appropriate non-disclosure requirements.

(U) On behalf of the Sponsor, thank you for your interest and participation in this effort.

mailto:dni-iarpa-rfi-24-07@iarpa.gov mailto:Raymond.v.banks@odni.gov