Justification for Other Than Full and Open Competition FINAL.pdf

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

In Accordance with FAR 13.501 & CAM 1306.70

DISCLOSURE AVOIDANCE RESEARCH AND QUALITY ASSURANCE

U.S. CENSUS BUREAU

1. Identification of the agency and the contracting activity, The United States Census Bureau (USCB), Acquisition Division proposes to procure without using full and open competition for Disclosure Avoidance Research and Quality Assurance in accordance with Federal Acquisition Regulation (FAR) 13.5 for Simplified Procedures for Certain Commercial Products and Commercial Services.

2. Nature of and/or description of the action being approved This justification outlines the facts and requests approval for the award of a sole source contract with Galois, Inc. for continued support of the Census Bureau’s long-term research, methodology and development work. This follow-on contract is for support related to the areas of research and implementation of unique differential privacy and disclosure avoidance methods. The emergent and innovative nature of this research and the resulting operational implementation requires a long-term relationship that allows for consistent access to a diverse and skilled set of experts in a broad range of the following technical backgrounds (i.e., code auditing and assurance, detailed knowledge new formal privacy techniques being developed by the Census, implementation of complex statistical applications, and formal verification tools for software systems). These unique skills that are provided by Galois resources have expertise across this broad range of capabilities, especially a strong track record in building formal verification tools, which most of their competitors lack.

The Census Bureau requires implementation of new disclosure avoidance methods pursuant to complying with a mandate from USCB’s Research and Methodology Directorate’s (ADRM) Center for Enterprise Dissemination (CED), that are transparent to the internal and external stakeholders (i.e., users of the data). Therefore, code used to implement a specific disclosure avoidance method to a specific data product must be made available for review and use and, all code must undergo an independent assessment and be available as part of the data product release. Without this review, USCB would be unable to provide a data product or disclosure avoidance service.

Based on the data product release schedule of the 2010 Decennial data products, the Census Bureau is behind on the release of these 2020 Decennial data products. This delay has occurred due to impacts from the COVID-19 pandemic and various litigations involving the inclusion of citizenship information. It is critical that USCB avoids data obsolescence where the late delivery of the 2020 Decennial data products would be deemed useless by internal and external stakeholders and would mean work and funding could be considered a significate waste of taxpayer dollars on the development of unusable data. Galois, Inc. is the sole source capable of providing the required disclosure avoidance methods that USCB requires including independent assessments of data and unique code development. Additionally, contracting with any another vendor would lend to having a learning curve that would be too great and detrimental to the value of the data if release is not safe and prompt. Therefore, competing the Disclosure Avoidance Research and Quality Assurance requirement would not be in the best interest of the Government.

3. Description of Services Required:

The Census Bureau’s mission is “to serve as the leading source of quality data about the nation’s people and economy.” To further this mission, the Census Bureau is undergoing a transformation in the way it disseminates data by making data more accessible and flexible. In providing these data products, the Census Bureau must also adhere to its mission to serve as the leading source of quality data about the nation’s people and economy as well as honor the privacy of its respondents (i.e., those that provide the confidential data needed to create the data products). United States Code Title 13 provides the authority to conduct censuses and surveys as well as provide strong protections for information collected from individuals and businesses.

This is also true for data that falls under the purview of United States Code Title 26.

To meet this mission, the Census Bureau is working on the research and implementation of new methods of disclosure avoidance that can be applied for the purpose of protecting confidentiality of the respondent-provided information while continuing to provide quality (i.e., useful) data.

These methods of disclosure avoidance have evolved from the simple suppression of information on unique observations to complex statistical methods affecting a large amount of the information collected. The growth in the level of sophistication of disclosure avoidance must mirror the expansion of technology that could potentially permit people to circumvent the protection process. It is the responsibility of the Census Bureau’s Center for Enterprise Dissemination (CED) to conduct research, develop, and support implementation of these new disclosure avoidance methods to ensure that the Census Bureau effectively disseminates the maximum amount of quality data about the nation’s people, housing, and economy while fully meeting the Census Bureau’s legal and ethical obligation to protect the confidentiality of respondents and the information they provide.

To date, the Census Bureau has been working on the implementation of the following emerging disclosure avoidance methods to meet requirements for producing data products that protect respondent data and are usable by data researchers:

• Differential Privacy – Differential privacy is a branch of mathematics that allows the privacy loss associated with a statistical release of a data set to be measured and controlled. CED is supporting the implementation of a system based on the theories of differential privacy as part of the privacy protection system for the 2020 census known as the Disclosure Avoidance System (DAS).

• Synthetic Data Validation - Synthetic data is a disclosure avoidance technique that prevents reidentification by replacing some or all features with synthetically generated values that fit the same original data schema. If only some variables are synthesized in each record, or only some of the records are synthesized, the data is referred to as "partially synthetic"; if all variables in every record are synthesized, the data is referred to as "fully synthetic".

The application of synthetic data requires the development of a validation system that ensures the synthetic data retains utility for analysis (i.e., can the data be used) while preventing reidentification and privacy loss for any real individual’s data. The implementation of these statistically complex methods is relatively new to Census Bureau’s internal and external stakeholders (i.e., users of the data). As such, it is important that the implementation of either method should be independently evaluated to ensure that these methods are properly implemented in accordance with specifications as well as ensuring that most efficient and update statistical a computer programming method are being utilized.

The emergent and innovative nature of this research and the resulting operational implementation requires consistent access to a diverse and skilled set of experts in data integration, statistical analysis, data modeling, and computational optimization to properly address the Government’s need. As such, the Census Bureau desires to retain the current Contractor services to support the CED as it continues with the relevant, forward-looking, and cutting-edge research in statistics and computer science in the application of new methods of disclosure avoidance. The focus of these services will be the conduct of “engagements” that center on the following:

• Conduct of Independent assessment (i.e., audit1) of software that implements a specific disclosure avoidance method such as differential privacy to include verification that software was developed in accordance with approved specifications and provide recommended changes to software code to improve disclosure avoidance accuracy and time to process (i.e., time required to apply the disclosure avoidance method).

• Development of unique code segments that are implemented to support the Census

Bureau’s Synthetic Validation System as well as code that can improve the accuracy and implementation of a specific disclosure avoidance method such as differential privacy.

The period of performance is as follows:

Base Period: September 30, 2022 – September 29, 20223 Option Year 1: September 30, 2023 – September 29, 2024 6-Month Extension: September 30, 2024 – March 29, 2025

The estimated total contract value is $3,436,240.42

The contract type is Firm Fixed Price.

4. Statutory Authority Permitting Other Than Full and Open Competition:

The statutory authorities for this justification are pursuant to sole source under FAR 13.501, where the services required by USCB are available from only one source. This source demonstrates a unique capability to provide the research services proposed. The likelihood of substantial duplication of cost to the Government is high and cannot be recovered through competition and awarding to another source would create unacceptable delays in fulfilling the agency’s requirements. Additionally, the justification is prepared in accordance with 13.501(a)(ii).

1 The CED believes there will be an average of 6 software audit engagements each year. However, the disclosure avoidance methods being used for data products, such as those from the 2020 Decennial, are “bleeding edge” as they are being applied to a specific data product and, thus, require additional changes to the software which, in turn, could require additional audits (i.e., engagements) above what we anticipate. To account for additional engagements, optional CLINs will be used.

5. Demonstration of the Applicability of this Authority:

The continuation of the services currently provided by Galois, Inc. cannot be met by another contractor. Although other contractors can perform “testing” or conduct software audits, there is no other contractor able to perform the unique requirement of independent assessments of disclosure avoidance data and development of unique code.

Galois is a research and development services company focused on the development and assurance of trustworthy computing systems that fulfill important safety, security, and privacy requirements. Galois is a Small Business that takes a unique approach to code reviews, offering an additional process for independent code reviews and code development.

Other vendors only offer the traditional method for reviews which could include the following:

• Review of the operational environment that the software is executed on

• Review of the software operational functionality

• Development of a test plan and procedure (test steps)

• Execute the test procedures

• Create a test report

However, the traditional method of disclosure avoidance is only appropriate for the validation and verification of a software application such as a web site or application used in accounting (i.e., a user interface that provides information dependent on user input). The implementation of such traditional disclosure avoidance methods does not employ a user interface, as these methods are a series of applications that are run as “batch jobs” on a high-performance compute environment with little or no interaction from a user (i.e., a job is submitted, data generated, and results are used). Galois employs a unique method to replicate the execution code, compare results and prove equivalent outcomes. Galois engages in a distinct way of approaching code verification and doing statistical work that is rare in this industry but is also critical to meet the specific needs of USCB’s research-focused requirement. The following rationale provides insight into USCB’s unique requirement for disclosure avoidance beyond the traditional methods and how the manner in which Galois conducts code reviews meet this requirement:

Analysis techniques for sensitivity and privacy requires a unique skill set and research background, which Galois, Inc possesses. Galois has of extensive publications and research regarding the development disclosure avoidance methods and improving upon traditional methods. No other contractor has resources with the same depth of expertise and qualifications that USCB requires.

• To evaluate whether a system provides sufficient formal privacy guarantees for a particular use case, Galois meets the requirement for addressing four fundamental concerns: (1) whether the core privacy-preserving mechanisms satisfy differential privacy in theory; (2) whether those mechanisms are correctly implemented; (3) whether the mechanisms are used correctly; and (4) whether any data is inadvertently released via a non-private channel. For each of these concerns, Galois works to identify critical design requirements and components that must be reviewed, maximizing on the assurance that USCB must provide in the system. These are methods that no other vendor has the capability to perform.

• Census Bureau requires a broad range of technical backgrounds, namely code auditing and assurance, formal privacy techniques, statistics, and formal verification tools for software systems. Galois is unique in staffing principal investigators and engineers with expertise across this broad range of capabilities, especially a strong track record in building formal verification tools used in the assessment of complex mathematical applications, such as the DAS, which other vendors lack.

• Galois’ previous experience working with the Census Bureau demonstrates a clear understanding of USCB CED’s mission and needs. To date, Galois’ has provided a value-added service in the conduct of engagements that have identified errors or opportunities for improvement in a range of critical components of the system, including the privacy mechanism’s core sampling routines, use of cryptography libraries, and configuration architecture. Achieving these results required Galois’ thorough approach of first identifying key system properties and design rationale, understanding the system architecture and code organization, reproducing the execution environment, and validating results against expectations, and focusing detailed review and additional experiments on the most critical components.

6. Market Research and Efforts to Solicit Potential Sources:

The Market Research Team conducted a thorough review via Internet and government-database searches including SAM.gov and the General Services Administration (GSA) eLibrary. This search included providing technical services under the NAICS codes of 541511-Custom Computer Programming Services; 541519 – Other Computer Related Services; 541715 – Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology); and 541990- All Other Professional, Scientific, and Technical Services. The team also conducted a historical review of the original acquisition for disclosure avoidance methods. Acquisition of these services were previously competed as a total small-business set-aside issued on FedBizOpps (now SAM.gov) with six (6) small businesses submitting offers in response to the solicitation. For that acquisition, a best value evaluation was conducted resulting in Galois was not only rated as the most qualified offeror, providing the best value for the services required, but Galois was also the only offeror that had the experience necessary for testing algorithms, conducting independent assessments, and developing unique code as required.

To try and further identify available sources capable of performing the required services for the prospective contract, USCB posted a Request for Information (RFI) on SAM.gov five (5) small business responding to the request. All vendor responses to the RFI provided a good overall description of providing project and contract management with each providing requesting information such as verification of being a small business and appropriate NACIS codes. However, no offeror except for Galois, Inc identified the capabilities, and technical background to perform specific tasks critical to the disclosure avoidance research and quality assurance that USCB requires.

The RFI responses only further supported that Galois Inc. is uniquely qualified, possessing specific resources and experience in the development of complex statistical systems. for conducting independent reviews of the disclosure avoidance code and developing code segments specific to disclosure avoidance and synthetic validation. Galois also has intimate experience, primarily supporting the Department of Defense (DOD), providing expert services in the research and development of new technologies that solve the most difficult problems in computer science. Therefore, the Market Research Team determined that only Galois offers the required services to satisfy USCB’s disclosure avoidance research requirements.

7. Fair and Reasonable Cost to the Government:

Determination of price reasonableness will be conducted in accordance with FAR

12.209 and 13.106-3. The anticipated price of this contract action to the Government will be determined to be fair and reasonable based on input/evaluation from the project office, historical data, and the independent government cost estimate (IGCE).

8. Other Facts Supporting the Use of Other Than Full and Open Competition:

The application of differential privacy to the 2020 Decennial census has been both effective and challenging as this was the first time this method of disclosure avoidance had been applied to such a large and complex data set. Work has centered on how best to employ its TopDown Algorithm (TDA) (dynamic programming analysis) in a manner that produces the most accurate and protected data while keeping processing time and computer resource utilization as minimal as possible. This work has included but is not limited to the application of an improved random number generator and the use of Discrete Gaussian method as well as the development of a processing dashboard that provides valuable run time information such as computer node availability, run time statistics, and run time errors. This application of differential privacy has evolved into multiple code sets designed to apply protection to the various 2020 Decennial data products which include the release of the 2020 redistricting data (i.e., PL94-171) and eventually the following:

• Demographic and Housing Characteristics File (DHC) which includes many of the demographic and housing tables previously included in the 2010 Census Summary File 1

• Detailed DHC which provides population counts, as well as demographic and housing statistics for detailed racial and ethnic groups such as American Indian and Alaska Native tribes and village groups.

9. Interested Sources:

USCB posted an RFI on June 22, 2022, with responses due July 5, 2022. Five (5) responses were received in response to this request. The following is the list of respondents:

1. Chenega Defense & Aerospace Solutions, LLC

2. Galois, Inc.

3. Navancio, LLC

4. Paradyme Management, Inc.

5. PD4 Solutions, LLC

JOHN

FATTALEH

Digitally signed by JOHN

FATTALEH

Date: 2022.09.26 17:12:34 -04'00'

10. Subsequent Actions to Remove or Overcome Barriers to Competition:

USCB continually reviews available research solutions in relation to availability in the commercial marketplace. In the future, USCB seeks to identify potential sources that can provide the necessary services as technologies evolve and business may expand service offerings. If USCB identifies other potential sources, in the future, the effort will be developed and conducted in such a manner to provide for competition.

11. Technical Certification I certify that the data and information forming the basis for this justification are accurate and complete to the best of my knowledge and belief.

Technical/Program/Project Manager Date

12. Contracting Officer Certification

I certify that this justification is accurate and complete to the best of my knowledge and belief.

09/26/2022

Contracting Officer Date

Approval

Based on the above justification, I hereby approve accomplishment of this acquisition by means other than using full and open competition.

Census Competition Advocate Date