Redacted JA.pdf

UNITED STATES MARINE CORPS

MARINE CORPS INSTALLATIONS NATIONAL CAPITAL REGION

MARINE CORPS BASE QUANTICO

3250 CATLIN AVENUE

QUANTICO VIRGINIA 22134 5001

V1.3, 15 March 2023

JUSTIFICATION AND APPROVAL (J&A)

FOR ORDER UNDER A BASIC ORDERING AGREEMENT (BOA) – FAR 16.302-1

1. Contracting Activity.

Marine Corps Installations National Capital Region - Regional Contracting Office (MCINCR-RCO), 2010

Henderson Road, MCB Quantico, VA 22134-5000

2. Description of the Action Being Approved.

The Marine Corps Intelligence Activity (MCIA) requires the renewal of an existing Authentic8 Silo Toolbox licensure of a managed attribution platform for its OSINT teams. This software must be a cloud-based, rapidly scalable virtual browser that supports managed attribution collection through the use of foreign exit points and customizable user agent strings for the purpose of obfuscation. This tool must have a built-in functionality to capture video files, collect and mark-up images/websites all within the framework of a cloud web browser. A secure virtual browser that extends to the Enterprise the ability to directly control the security configurations related to uploading/downloading of files, cut/paste functions into and out of the browser, supports CaC authentication for DoD users. It also must also the ability to provide a complete enterprise log trace for all user functions and allows agencies to encrypt logs with a private key (restricting visibility of log file information to specific government personnel) and offloading of log information to other systems.

3. Description of the Supplies/Services.

Facilitate access to relevant Publicly Available Information (PAI) while safeguarding MCIA personnel and networks from adversary observation, identification, collection and exploitation. MA is defined by MCRP 2-

10A.3 as “the use of hardware, software, and techniques to obscure user interest in information that is available through the internet.” According to DoDD 3115.18, “(MA) solutions and other security measures appropriate for the activity” will be used “to mitigate risk and protect personnel, equipment, facilities, organizations, activities, mission equities, and programs”.

This is a follow-on contract M00254-23-F-0199-Order Number. Main BOA Contract (HHM40220G0002).

Source or Brand Name: Authentic8, Inc.

The Government intends to issue a single Firm Fixed Price (FFP) order with FFP CLINs.

This requirement is for a 12-month period. The support period for this requirement is 3 July 2024 through 2

July 2025.

Brand Name Authentic8 Silo Toolbox Software as follows:

CLIN Brand Name /

Manufacturer

Item / Description Manufacturer

Part Number

Quantity

0001 Authentic8, Inc.

A8 Cloud Storage Extra GBs

Support Coverage: 7/3/24- 7/2/2025

A8-002-SST-X 235 EACH

MARINE CORPS BASE QUANTICO

0002 Authentic8, Toolbox Premium Support

A8-001-TB-PS 235 EACH

0003 Authentic8, Toolbox

A8-001-TB

235 EACH

0004 Authentic8, Toolbox Dark Web

A8-001-TBDW 10 EACH

0005 Authentic8, ToolboxDW Premium Support

A8-001-TBDW-PS 10 EACH

0006 Authentic8, Analyst Pack

A8-001-TB-APK 10 EACH

0007 Authentic8, Inc.

Silo Transcription/Translation -

Hour Blocks One (1) block of

3,000.

A8-001-STT 1 LOT

0008 Authentic8, A8 Cloud Storage (First GB)

A8-002-SST 235 EACH

0009 Authentic8, A8 Cloud Storage (First GB)

A8-002-SST 10 EACH

4. Statutory Authority Permitting Other Than Full and Open Competition.

To execute the justification and approval addressed at FAR 6.302 entitled, “Circumstances Permitting Other Than

Full and Open Competition

5. Rationale Justifying Use of Cited Statutory Authority.

This is a follow-on contract M00254-23-F-0199-Order Number. Main BOA Contract (HHM40220G0002).

This acquisition is to procure Authentic8 Silo software licensing for MCIA. The exception is based on FAR

16.505(b)(2)(i)(B), only one source is capable of providing Silo Toolbox Software. . Fair opportunity will be limited to contract awardees under the VIRGINIA CONTRACTING ACTIVITY COMMUNITY

MANAGED ATTRIBUTE AUTHENTIC8 BASIC ORDERING AGREEMENT (HHM402-20-G-0002)

Community Managed Attribution. Additionally, per the BOA, the tools therein have been identified by DIA’s

Enterprise Software Efficiency Steering Group as the preferred solution, and purchase of alternative capabilities via an alternate contract vehicle require written approval from the Government. DIA’s OSIC office confirmed this statement during the 07 May 2020 OSIC-hosted Managed Attribution Working Group, stating that congressionally-allocated funds provided to Service Intelligence Centers (SICs) were intended solely for the use of Authentic8 SILO.

Silo Toolbox software service is unique and is a highly specialized Cloud Software Service (SaaS) provider for secure web browsing and an anonymizing service at an enterprise scale which will be limited to contract

MARINE CORPS BASE QUANTICO

awardees under the VIRGINIA CONTRACTING ACTIVITY COMMUNITY MANAGED ATTRIBUTE

AUTHENTIC8 BASIC ORDERING AGREEMENT (HHM402-20-G-0002) Community Managed

Attribution.

Additionally, per the BOA, the tools therein have been identified by DIA’s Enterprise Software Efficiency

Steering Group as the preferred solution, and purchase of alternative capabilities via an alternate contract vehicle require written approval from the Government; DIA’s OSIC office confirmed this statement during the 07 May 2020 OSIC-hosted Managed Attribution Working Group, stating that congressionally-allocated funds provided to Services were intended for the use of the BOA to maintain existing access.

Although alternative solutions exist, no currently identified or evaluated alternatives meet all the requirements of MCIA which include:

1. Having a cloud-based, rapidly scalable virtual browser that also supports managed attribution collection through the use of foreign exit points and customizable user agent strings for the purpose of obfuscation.

2. Having a robust collection tool for analysts with built-in functionality to capture video files, collect and mark-up images/website all within the framework of a cloud web browser.

3. Having a secure virtual browser that extends to the Enterprise the ability to directly control the security configurations related to uploading/downloading of files, cut/paste functions into and out of the browser, supports CaC authentication for DoD users.

4. Providing a complete enterprise log trace for all user functions and allows agencies to encrypt logs with a private key (restricting visibility of log file information to specific government personnel) and offloading of log information to other systems.

Additionally, using an alternative solution would drive additional costs and provide decreased effectiveness because:

1. Custom apps and process flows have already been developed for Silo Toolbox and would delay the operations and incur additional cost to the transition.

2. Migrating from Silo Toolbox would require retraining personnel.

3. User experience with formal pilot testing has indicated that alternative solutions are more difficult to use, require a greater intensity and longer duration of training to use at equal levels of effectiveness.

Furthermore, Silo Toolbox is the only solution that moves the browser activity to the cloud, eliminating the risk of foreign adversary detection, or attacks from malicious code.

4. New access control processes and security accreditations would have to be implemented adding time, cost and complexity to the secure browsing program.

5. Operations Security for MCIA functions would be reduced since the users have been known to use less secure, non-enterprise alternatives like traditional web browsers instead of leveraging other anonymous browser solutions which are less user friendly.

Silo Toolbox is currently employed by MCIA and other Marine Corps units, and its use is expanding to other members of the IC and DoD. Expanding the footprint of the existing tools, for which extensive testing of alternatives and operations integration has been performed, and in addition to better meeting the requirements, implementing an alternative solution to run in parallel or replace the current solution would be costly and impact mission operation while users are retrained. If Silo Toolbox is not employed, multiple secure intelligence browser services would be required.

6. Description of Efforts Made to Solicit Offers from as Many Offerors as Practicable.

While competing capabilities exist, Authentic8’s Silo Toolbox was found to be the proposed solution that best fits MCIA’s current requirement needs. This software is available through the VIRGINIA

CONTRACTING ACTIVITY COMMUNITY’s MANAGED ATTRIBUTE AUTHENTIC8 BASIC

MARINE CORPS BASE QUANTICO

ORDERING AGREEMENT (HHM402-20-G-0002) Community Managed Attribution. This has been the subject of extensive evaluation by the functional manager of the discipline and defense community lead; an enterprise-based cost has been negotiated making this a cost-effective solution for MCIA and the government.

As a result, this procurement will be solicited as a sole source utilizing non-competitive procedures.