IDVRS SOW Draft 04.30.26.pdf

DRAFT // NOT FINAL

DEPARTMENT OF HOMELAND SECURITY

Incident-Driven Video Recording Systems (IDVRS)

Statement of Work (SOW)

1. Requiring Organization

The Department of Homeland Security (DHS)

2. Introduction

DHS has a programmatic requirement to purchase hardware and software for the various Incident-Driven Video Recording Systems (IDVRS) and body-worn camera (BWC) programs.

IDVRS is comprised of BWCs, docking stations, and digital evidence management system (DEMS) software and cloud storage licenses.

2.1 Applicable Documents

The following applicable documents support DHS’s requirement for IDVRS:

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision No. 5.1;1

Department of Homeland Security, DHS 4300A Sensitive Systems Handbook;2 and, Department of Homeland Security, DHS Directive No. 140-01 Revision No. 2.3

The documents listed above are not all-inclusive. Other regulations, guidance, and applicable laws may apply now or in the future for tasks that are enacted throughout the duration of the program.

3. Background

DHS identified the need for IDVRS technology through several component-specific, comprehensive evaluations and studies, thorough requirements analysis, and extensive market research. IDVRS incorporates hardware and software for incident-driven recording of interactions not captured by current DHS fixed camera systems. The primary technology used to record these interactions is the BWC, utilized across the nation by state, local, and tribal law enforcement operations. IDVRS includes BWCs, docking stations, DEMS, cloud-based storage licenses, and supporting hardware and software accessories.

1 National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision No. 5.1, https://nvd.nist.gov/800-53, Published December 10, 2020.

2 Department of Homeland Security, “DHS 4300A Sensitive Systems Handbook,” dhs.gov/publication/dhs-4300a-sensitive-systems-handbook, Published November 15, 2015.

3 Department of Homeland Security, DHS Directive No. 140-01 Revision No. 2, Published May 5, 2017, https://www.dhs.gov/sites/default/files/publications/mgmt/information-and-technology-management/mgmt-dir_140- 01-info-tech-security-program_revision-02.pdf

4. Requirements

4.1 Product Specifications

The below outline requirements for various products in support of the IDVRS system, including the requirements for non-hardware and non-software needs for CBP officers/agents and other personnel.

4.1.1 BWC Requirements

4.1.1.1 The physical dimensions of the camera shall not exceed 3 inches (L) by 2 inches

(W) by 4 inches (H).

4.1.1.2 The camera’s weight shall not exceed 8 ounces.

4.1.1.3 The camera shall survive a 6-foot drop to a hard surface and remain functional.

4.1.1.4 The camera shall be accompanied with mounting system(s) that keep the camera securely attached to the uniform of the LEO.

4.1.1.5 The camera shall allow users to manually start and stop recording.

4.1.1.6 The camera shall provide a minimum of 30 seconds and up to at least 2 minutes of pre-event recording (“buffering”). The pre-event recording shall be automatically saved whenever the camera is powered on and activated.

4.1.1.7 The camera’s battery life shall be at least 10 hours when constantly recording audio/video.

4.1.1.8 The camera’s storage capacity (memory) shall store a minimum of 12 hours of recorded audio/video footage.

4.1.1.9 The camera shall capture video at a minimum resolution of 720p high-definition.

4.1.1.10 The camera shall have a field of view of at least 120 degrees.

4.1.1.11 The camera shall be able to focus on all objects from approximately one foot away to 20 feet away. Continuous autofocus or fixed focus may be employed for usability. Use of manual settings shall not be required to adjust the camera focus.

4.1.1.12 The camera’s water resistance shall be equivalent to or higher than ingress protection (IP) rating IP67 – submersion up to one meter deep for 30 minutes.

4.1.1.13 The camera shall be able to withstand exposure to: saltwater, freshwater, sun, wind, dust, water, and other environmental conditions encountered by LEOs in their various operational environments.

4.1.1.14 The camera shall maintain an audit log of all activity. The logged activity must include, but is not limited to any button selections, battery status changes, recording start/stop events and the trigger mechanism, and configuration changes.

4.1.1.15 The camera footage and associated metadata shall automatically upload to a cloud-based DEMS and shall charge the BWC when connected to a docking station.

4.1.1.16 The camera shall offer advanced audio technology to reduce noise distortion from environmental factors (e.g., wind, vehicular traffic, running water, etc.).

4.1.1.17 The camera shall not allow operators to edit, modify, or delete recorded data stored on the camera unit, except for edits or modifications to metadata through mobile applications as outlined in Section 4.1.9.

4.1.2 Docking Station and Wireless Upload Requirements

4.1.2.1 The physical dimensions of the docking station shall not exceed 18 inches (W) by 8 inches (H) by 9 inches (L).

4.1.2.2 The docking station shall charge the camera automatically upon docking the camera.

4.1.2.3 The docking station shall initiate automatic footage upload immediately upon docking of the camera.

4.1.2.4 In addition to docking station upload, the camera shall support secure wireless upload capabilities through Wi-Fi and/or Long Term Evolution (LTE) cellular networks. Wireless upload shall allow footage and associated metadata to be uploaded when the camera is within range of an authorized Wi-Fi network or has access to LTE connectivity.

4.1.2.5 Wireless upload features (Wi-Fi and/or LTE) shall be configurable and may be enabled or disabled based on agency operational determinations.

4.1.2.6 All upload methods (docking station, Wi-Fi, and LTE) shall utilize secure transmission protocols to align with the data security requirements (see Section 4.1.7).

4.1.3 Automatic Activation Sensor Requirements

4.1.3.1 The system shall support automatic activation of nearby BWCs via external sensors that automatically activate the BWC when the sensor is activated.

4.1.3.2 Each automatic activation sensor shall be configurable to activate a single BWC.

4.1.3.3 Each automatic activation sensor shall be configurable to allow automatic activation of multiple BWCs simultaneously based on a defined group and/or proximity.

4.1.3.4 Each automatic activation component shall adhere firmly to standard DHS issued equipment without impeding the use or function of the equipment.

4.1.3.5 Automatic activation via sensor shall be recorded in the audit log referenced in

Section 4.1.4.

4.1.4 DEMS Requirements

4.1.4.1 The DEMS shall be available as a cloud-based application that connects to dedicated cloud storage space.

4.1.4.2 The DEMS shall be the only means of storing and sharing data from the recording device or otherwise sharing footage whether via docking cameras on the docking station or through associated and approved systems.

4.1.4.3 The DEMS shall restrict footage downloads so that footage is only viewable and shareable by either using the DEMS (using active directory single sign-on) or through a secure link created by the DEMS.

4.1.4.4 The DEMS shall allow LEOs to categorize video files.

4.1.4.5 The DEMS shall allow users to set retention periods for footage based on user-assigned categories. The DEMS shall retain footage in alignment with the appropriate System of Records Notice (SORN) and records retention schedule as stipulated by the federal government, DHS, and applicable DHS components.

4.1.4.6 The DEMS shall allow users to search recorded data using either wildcard or filter search corresponding to each manually assigned category.

4.1.4.7 The DEMS shall allow authorized users to redact footage without exporting to additional software.

4.1.4.8 The DEMS shall log all user activity, retaining the audit log files indefinitely.

4.1.4.9 The DEMS shall allow administrators to define user roles with different levels of access (e.g., permission to view videos uploaded by users, permission to redact video, etc.).

4.1.4.10 The DEMS shall allow DHS personnel to install and manage the software on secure DHS networks and systems.

4.1.4.11 The DEMS shall have dedicated training and testing instances separate from the operational DEMS environment. The training and testing instances shall mirror the production environment in functionality and support all requirements outlined in Section 4.1.4.

4.1.4.12 The DEMS shall be scalable to accommodate increased volume and size of audio/video recording files with no negative impact on DHS operations if the program deploys to more locations.

4.1.4.13 The DEMS shall include a cold storage capability for any data stored in the DEMS for three years or longer. Authorized users must be able to retrieve data from cold storage within 72 hours of request. The system shall log all access and retrieval activity for audit purposes.

4.1.4.14 The DEMS shall be able to group evidence into case folders within the DEMS to allow for sharing multiple pieces of evidence associated with a single case at once.

4.1.4.15 The DEMS shall be able to transcribe audio captured and store the transcription files within the DEMS.

4.1.4.16 The DEMS shall accommodate new file formats, operating systems, and other advancements as these technologies are released without significant modifications to existing DHS systems.

4.1.4.17 The vendor shall provide help desk support for hardware and software 24 hours per day, 7 days per week, and 365 days per year (24/7/365).

4.1.4.18 The DEMS will accommodate third party data upload through the DEMS. NOTE:

DHS defines third party data as any data generated by devices not owned by the DEMS vendor (e.g., exogenous uploads).

4.1.5 Interoperability Requirements

4.1.5.1 The camera and associated hardware shall be compatible with any DEMS that meets the data security requirements specified in Section 4.1.7, supporting automatic upload functionality as specified in Section 4.1.3, and comply with all specifications outlined in Section 4.1.4.

4.1.5.2 The DEMS shall be compatible with any camera and associated hardware that meets the specifications outlined in Sections 4.1.1, 4.1.2, and 4.1.7.

4.1.5.3 The vendor shall participate in all efforts related to integration testing with DHS as part of the system acceptance testing process at no additional cost to the government.

4.1.5.4 The BWC solution shall implement full interoperability with existing DHS law enforcement systems as designated by the federal government. The solution shall allow for secure transfer and access to video, audio, and associated metadata. The vendor shall provide documentation of supported integrations and describe the process for integrating with DHS law enforcement systems as required.

4.1.6 Data Transition Requirements

4.1.6.1 The DEMS shall have an open architecture that allows any video, audio, and associated metadata to be extracted or imported via an Automated Programming Interface or equivalent means.

4.1.6.2 The DEMS shall allow all data to be extracted in a platform-agnostic format (e.g., mp4 for video files).

4.1.6.3 The vendor shall conduct a data transition test with DHS at no additional cost to the government as part of the system acceptance testing.

4.1.6.4 In the event of a data transition to a new DEMS, the data transition shall be completed within six months after the purchase of the new DEMS has been finalized.

4.1.6.5 In the event of a data transition to a new DEMS, the vendor owning the prior DEMS shall provide a list and description of all metadata fields collected by the prior DEMS within 30 days of receiving notice of transition.

4.1.7 Data Security Requirements

4.1.7.1 The vendor’s cloud-based DEMS application shall be authorized through the Federal Risk and Authorization Management Program (FedRAMP) at the “moderate” level or higher.

4.1.7.2 All vendor applications shall use Personal Identification Verification (PIV) single sign-on (SSO); cryptographic operations supporting PIV SSO shall be compliant with Federal Information Processing Standards (FIPS) 140-3.

4.1.7.3 Access to all vendor applications shall be controlled by active directory security grouping.

4.1.7.4 All vendor hardware and software applications shall be compliant with:

NIST SP 800-53,

DHS 4300A Sensitive Systems “moderate” impact level, and DHS Management Directive 140-01, Information Security Program.

4.1.7.5 All vendor hardware and software applications shall be compliant with:

Encryption for all data states (at-rest and in-motion) at National Security

Agency (NSA) Type 2 or Type 1 level, FIPS 140-3 Level 4 validation, and NIST-approved algorithms, with Advanced Encryption Standard 256-bit key length (AES-256) as the minimum standard.

4.1.7.6 DHS shall own and control access to all data housed on vendor systems in perpetuity.

4.1.7.7 DHS shall own and control access to all intellectual property rights to any unique codes or scripts developed by the vendor specifically for DHS requirements.

4.1.7.8 All data centers supporting the DEMS (storage, backup, etc.) shall be located exclusively in the contiguous United States (CONUS).

4.1.7.9 Interconnectivity between DHS and non-DHS systems shall be established only by approved service providers through the Trusted Internet Connection (TIC) or other DHS-authorized secure connectivity solutions in accordance with current DHS cybersecurity policies and standards.

4.1.7.10 The vendor shall operate a Security Operations Center (SOC) located in CONUS and provide 24/7/365 security services including firewall management, intrusion detection, anti-malware, and patch management services in alignment with current DHS cybersecurity frameworks. Vendor security operations shall include:

Design, configuration, implementation, maintenance, and operation of all firewalls within DHS architecture;

Design, configuration, implementation, maintenance, and operation of sensors and hardware required to support the Network Intrusion Detection System

(NIDS);

Design, implementation, monitoring, and management of a comprehensive anti-malware service;

Monthly submission of continuous monitoring data (see Section 4.2) to the federal government via a security dashboard (raw data shall also be provided to allow independent federal government review as necessary); and, Provide patch management services and enable DHS personnel to manage firmware upgrades prior to any patch releases.

4.1.7.11 The vendor shall have a Cyber Security Incident Response Team (CSIRT) available to support DHS as needed with personnel qualified to respond to cybersecurity incidents in accordance with DHS and federal standards. The CSIRT shall be available 24/7/365 and capable of providing remote or onsite support as required.

4.1.7.12 The vendor shall partner with DHS to conduct monthly vulnerability assessments of all connections between vendor and DHS networks, operating systems, and applications. Assessments shall include both automated and manual methods and shall be performed after any significant system changes. The vendor shall report identified vulnerabilities, propose mitigations, and track remediation progress in accordance with DHS cybersecurity standards. The vendor shall collaborate with DHS personnel to review findings and ensure timely resolution.

4.1.7.13 If vendor personnel require access to the DEMS or other DHS government systems, these personnel shall receive DHS Public Trust clearance prior to receiving DEMS or other system access.

4.1.8 Human System Integration Requirements

4.1.8.1 All cameras, docking stations, and DEMS instances shall maintain a common look and feel in accordance with Part 5 of American National Standards Institute / Human Factors and Engineering Society 200.

4.1.8.2 All cameras, docking stations, and other equipment shall be accessible to operators, accommodating individuals from the 5th percentile female to 95th percentile male.

4.1.8.3 The vendor shall provide necessary documentation (electronic manuals) covering the usage and maintenance of all hardware and software.

4.1.9 Mobile Compatibility Requirements

4.1.9.1 The vendor shall provide a mobile application, mobile-enabled website, or other mobile capability for LEOs to view and assign retention categories to footage captured on their own BWCs from their federal government mobile device.

4.1.9.2 The mobile capability shall give Supervisors the ability to use their federal government mobile device to view and assign retention categories to footage captured on the BWCs worn by LEOs they supervise.

4.1.9.3 The mobile capability shall comply with federal government information security requirements for certificate-based authentication and support SSO.

4.1.10 Associate Contractor Agreement Requirements

4.1.10.1 The vendor shall enter into Associate Contractor Agreements (ACA) for any portion of the contract requiring joint participation in the accomplishment of the federal government's requirement. The federal government shall be solely responsible for determining whether joint participation is required to accomplish a requirement. The agreements shall include the basis for sharing information, data, technical knowledge, expertise, and/or resources essential to the integration of existing IDVRS-related hardware or software in use at DHS, which shall ensure the greatest degree of cooperation for the development of the program to meet the terms of the contract. ACAs shall include the following general information:

4.1.10.1.1 Identify the program involved and the relevant federal government contracts of the associate contractors.

4.1.10.1.2 Describe the associate contractor interfaces by general subject matter.

4.1.10.1.3 Specify the categories of information to be exchanged or support to be provided.

4.1.10.1.4 Include the expiration date (or event) of the ACA.

4.1.10.1.5 Identify potential conflicts between relevant federal government contracts and the ACA; include agreements on protection of proprietary data and restrictions on employees.

4.1.10.1.6 A copy of such agreement shall be provided to the Contracting Officer for review before execution of the document by the cooperating contractors.

4.1.10.1.7 The Contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms because of a failure to resolve a disagreement with an associate contractor.

4.1.10.1.8 Liability for the improper disclosure of any proprietary data contained in or referenced by any agreement shall rest with the parties to the agreement, and not the federal government.

4.1.10.1.9 All costs associated with the agreement are included in the negotiated cost of this contract. Agreements may be amended as required by the federal government during the performance of this contract.

4.1.11 Ordering Requirements

4.1.11.1 Prior to any Task Order award, the vendor shall confirm the Administrative

Contracting Officer (ACO) or the DHS Executive Agent Contracting Officer’s Representative (COR) has approved the pricing, quantity, and Contract Line Item Numbers (CLINs) included in the Request for Quotation (RFQ) submitted to the vendor.

4.1.11.2 The vendor shall confirm receipt of order sent by the Government within 48 business hours.

4.1.11.3 The vendor shall deliver all equipment no longer than six (6) weeks following the award of a task order.

4.1.11.4 The vendor shall provide shipping confirmation notice to the Government at least 48 hours prior to delivery.

4.1.11.5 The vendor shall provide a notice of equipment delivery to the Government immediately upon completion of delivery.

4.1.12 Training Requirements

4.1.1.1 The vendor shall provide training in all necessary technical aspects and usage of the hardware, and the DEMS. Training shall consist of, but not be limited to (if necessary): classroom, supplemental materials, and online/video training. The training courses should be provided during the initial use of IDVRS, refresher courses (at least once every two years), and at subsequent times as requested by the federal government.

4.1.1.2 Using the “train-the-trainer” approach, the vendor shall provide training upon request at any DHS site on the use of the hardware and DEMS to IDVRS Coordinators and LEOs. Training shall be conducted at a DHS facility. The vendor shall supply training materials, instructions and product manuals, and supplemental video training.

4.1.1.3 Vendor shall provide materials to include hardware/DEMS instruction manual, installation manual, quick start guide, frequently asked questions (FAQs), or troubleshooting guide for each location deploying IDVRS.

4.1.1.4 The vendor shall provide a downloadable video (e.g., .mp4 format) that demonstrates the proper use of the hardware and the DEMS. At a minimum, the videos shall include directions on how to use all the features and specifications referenced in Section 4.1 of this SOW. The vendor may propose an alternative file format for consideration, including appropriate justification.

4.2 Data Outputs

The vendor shall provide each DHS component agency’s IDVRS point of contacts (POCs) with various data points on the DEMS on a frequent basis as needed. This dataset includes, but is not limited to:

BWC Asset Identification (ID) Number: Unique identifier for each body worn camera that allows the IDVRS Program Manger to identify which body worn camera was used to record the footage

File ID Number: Unique identifier for each file stored on the DEMS Date of Video: Date of the recording of footage stored on DEMS

Duration of Video: Total time of video in seconds Size of Video in Megabytes (MB): Total size of video footage stored on DEMS Video Categories: Categories assigned to video footage within DEMS to describe interactions recorded including, but not limited to, Arrest/Apprehension, Accidental Activation, Non-Evidentiary/Non-Categorized, Seizure, Evidentiary/Non-Categorized, Casual Encounter, Vehicle Stop, and Training.

Shift Assignment Categories: Categories assigned to video footage within DEMS to describe the operational environment of the footage including, but not limited to, Check Point Operations, Roving Patrol, Line Watch, All-Terrain Vehicle (ATV), Port of Entry (POE), Airport, Air Operations, Sea Port, and Marine Operations

Primary user: Unique identifier for authorized user of BWC (e.g., DHS HASH ID #) Local Time BWC Powered On: Local time when the BWC is powered on stored on

DEMS

Local Time BWC Powered Off: Local time when the BWC is powered off stored on

DEMS

Local Time Start of Video: Local time at the start of video recording stored on DEMS Local Time End of Video: Local time at the end of the video recording stored on DEMS Local Time Start of Upload: Local time when BWC footage starts being uploaded to

DEMS

Local Time End of Upload: Local time when BWC footage is completed being uploaded to DEMS Duration of Upload: Total time in seconds it takes to upload BWC footage to DEMS Local Time of BWC Undocking: Local time when the BWC is removed from the docking station to begin shift Local Time of BWC Re-Docking: Local time when the BWC is returned to the docking station at the end of the shift

The vendor shall provide raw data in various file formats. The vendor shall sustain a download speed of 100 Mega bytes per second (Mbps) per user connection for all raw data downloads, except where the end user’s network connection is a limiting factor. Generally, DHS will use data in a Microsoft Excel format for download and analysis, however this shall not limit the federal government from requesting and using other data formats.

All data generated by IDVRS during the duration of the program is and will remain the property of the U.S. Federal Government.