EFX and DOMEX SOW REV 1 20240522.pdf

Expeditionary Exploitation Unit ONE

Statement of Work (SOW) For

Document and Media Exploitation (DOMEX) Collection Expeditionary Forensics eXploitation (EFX)

And Document and Media Exploitation (DOMEX) Analytics

5 April 2024

Table of Contents

1.0 SCOPE 3

2.0 APPLICABLE DOCUMENTS 3

3.0 REQUIREMENTS 4

4.0 COURSE DELIVERABLES 6

5.0 CONTRACTOR CERTIFICATIONS AND QUALIFICATIONS 7

6.0 PERIOD AND PLACE OF PERFORMANCE 8

8.0 DEFINITIONS 9

9.0 ACRONYMS 9

STATEMENT OF WORK

Expeditionary Exploitation Unit ONE Expeditionary Forensics eXploitation Training and DOMEX Training

1.0 SCOPE

Naval Surface Warfare Center Indian Head Division (NSWC IHD) Expeditionary Exploitation Unit ONE (EXU-1) has a unique mission that requires Non-standard Pre-deployment training currently not offered by traditional Navy EOD units.

This Statement of Work (SOW) defines three training requirements to be presented concurrently over a two week period to NSWC IHD EXU-1 personnel:

1. Document and Media Exploitation (DOMEX) Collection

2. Expeditionary Forensics eXploitation (EFX)

3. Document and Media Exploitation (DOMEX) Analytics

The Courses of Instruction (COI) are to be ran concurrently over a two week period with DOMEX Collection week one (1), EFX week (2a) and when applicable DOMEX Analytics week (2b).

As part of the EXU-1 Optimized Fleet Response Plan (OFRP), these advanced courses of instruction (COI) are specifically designed to educate, train and prepare EXU-1 personnel in the collection, analysis and exploitation of collected exploitable materials (CEM) to generate actionable intelligence. This training enables the EXU-1 Technical Exploitation Platoons (TXP) to meet COCOM required needs, providing leaders at all echelons with intelligence about enemy forces, their plans and intentions, and their tactics, techniques and procedures (TTP) through the rapid and accurate analysis of CEM. CEM includes (but is not limited to) cell phones, computers, digital storage devices, video and audio tapes, and other media and materials.

Additionally, these training courses teach the TXP team members the International Standards of how to identify, collect, handle, preserve, document and package CEM to maintain the forensic and technical value. These skills are critical due to the importance of providing Theater Commanders with timely and accurate intelligence that potentially leads to targeting and prosecution.

2.0 APPLICABLE DOCUMENTS

1) 29 CFR 1910 subpart Z, section 1910.1450, appendix A.

2) ATP 3-90.15 Site Exploitation (SE)

3) ATP 3-39.12 Law Enforcement Investigations

4) The Fingerprint Sourcebook (www.nij.gov)

5) TSD’s Execution Check List (ECL)

6) OPNAVNOTE 5450.

7) NAVSEANOTE 5450.134.

8) JROCM 128-08.

9) EXU-1 SORM – INST 3120.1.

10) EXU-1 TRAMAN – 3502.1(series)

3.0 REQUIREMENTS

3.1 DOMEX Media Collections Training.

1) The Contractor shall provide one COI with classroom with wireless internet (Wi-Fi) capability and practical instruction for up to (15) fifteen participants per this course. The training curriculum will be designed to support a five-day COI with maximum of 8 hours of instruction per training day. The Contractor shall provide both classroom and practical training with a focus on the following areas:

Properly capture digital evidence at a dynamic location and perform an analysis of a suspected device.

Capture passwords

Image digital devices using Windows and Linux based tools.

Report collected Intelligence to respective chain of command.

Understand mobile device forensics fundamentals

Understand the cell phone analysis process

Understand the basics of data access/acquisition from an android phone

Access/Acquire data from an android phone using various tools

Understand the basics of data access/acquisition from an android phone

Properly teardown a cellphone

Report findings of the examination

Teach EXU-1to collect digital forensics using the following equipment:

UFED 4PC with, Physical Analyzer, XRY, XAMN, AAL

Magnet Acquire FTK with imager, PRTK, Registry Viewer Ditto II Tableau Write Protectors CFID (Compact Forensic Imaging Device) Icy Dock / SATA connectivity cable Faraday Bags

* EXU-1 may modify equipment list as operational requirements change*

1) The Government shall provide and deliver EXU-1 DOMEX kits that will include the hardware, software, licenses, Equipment needed to conduct the training outlined in section 3.2.1 of this document.

3.2 Expeditionary Forensics eXploitation (EFX)

1) The Contractor is required to conduct the EFX COI the week immediately following DOMEX Collection

2) The Contractor shall provide at a minimum two instructors, role players, training aids, explosive and, facilities, training vehicles, classrooms, and equipment necessary, to educate, exercise and evaluate personnel in the areas specified in this SOW.

3) The Contractor shall provide one COI (Expeditionary Forensics eXploitation) with classroom, forensic laboratory and practical instruction for a maximum of up to (10) ten participants per course with two EXU-1 personnel attending as Observers. The training curriculum will be designed to support a (5) five day COI with maximum of 8 hours of instruction per training day. The training curriculum shall provide both classroom, and forensic laboratory, with a focus on the following areas.

A) Digital Photography B) Site Documentation and Inventory C) Biological Material Collection Techniques D) Latent Print collection and processing utilizing powder and photography E) Forensic Post Blast Investigation F) Explosives Testing G) Operation of field and/or forensic laboratory equipment H) Communicating relevant data to reach back facilities and resources.

I) Identity criteria and common characteristics of a sensitive site.

J) Describe and practice performing Site Exploitation (SE).

K) Identify key items to recover during SE operations.

L) Describe the steps to consider for collecting information and components found during the SE process.

M) Describe and recognize the differences between Home Made Explosives (HME) lab, chemical lab, biological lab, and drug lab.

4) Instruction on how to use and proper input of evidentiary items into reporting systems.

5) The Contractor must have an Forensic Laboratory will have at a minimum the following equipment :

a. Gemini

b. Color metrics/ETK

c. Improvised for superglue (superglue techniques)

d. Camera Stands/DLSR

e. PPE (safely glasses, gloves as needed, Tyvek suits)

Note: Contractor will maintain enough of the above equipment to meet all training objectives per training class.

The Contractor must use recognized safe chemical laboratory procedures and practices found to be suitable by the Occupational Safety and Health Administration (OSHA) and listed in 29 CFR 1910 subpart Z, section 1910.1450, appendix A.

6) The Contractor shall provide each student with a laminated Exploitation Field Guide with quick steps to the following modalities:

a. Chemistry

b. DNA

c. DOMEX

d. Photography

e. Post Blast

f. Finger Prints

g. Site Lead

3.3 DOMEX Media Analytics Training.

1) When applicable, the Contractor shall additionally provide DOMEX Analytics training, the week immediately following DOMEX Collection training. This COI is to be ran simultaneously and in addition to but independently of EFX training.

2) The Contractor shall provide one COI with classroom with wireless internet (Wi-Fi) capability and practical instruction for up to (5) five participants per this course. The training curriculum will be designed to support a five-day COI with maximum of 8 hours of instruction per training day. The Contractor shall provide both classroom and practical training with a focus on the following areas:

Use preview devices to view data collected.

Gather "low hanging fruit" for Intelligence.

Analyze/Interpret data acquired from an android phone using various tools

Teach EXU-1 to analyze collected digital forensics using the following equipment:

UFED 4PC with Physical Analyzer

XRY, XAMN, AAL

Magnet Acquire FTK with imager, PRTK, Registry Viewer CFID (Compact Forensic Imaging Device) Viking / Autopsy DC3 Advanced Carver

* EXU-1 may modify equipment list as operational requirements change*

1) The Government shall provide and deliver EXU-1 DOMEX kits that will include the hardware, software, licenses, equipment needed to conduct the training outlined in section 3.2.1 of this document.

4.0 Course Deliverables

The following are required deliverables for required for each training class:

1) A detailed Schedule of Events (SOE) (CDRL A002) shall be developed and approved by

EXU-1 Readiness and Training Department 20 business day prior to beginning of each COI. Any changes to the SOE shall be provided to the Contract Buyer and EXU-1 Readiness and Training Department for approval.

2) The Contractor shall administer a pre and post knowledge survey for each training to accurately measure the comprehension and retention of the training provided. The details of the pre and post survey are to be provided in the course After Action Report (AAR)

(CDRL) A001).

3) The Contractor shall provide an After Action Report (AAR) (Contract Data

Requirements List (CDRL) A001 completion of each course of instruction. Any changes to the course will be discussed between the Contracts Department, EXU-1 Readiness and Training Department and the Contractor as necessary.

4) The Contractor shall provide course feedback evaluation forms that allow participants to comment on the primary blocks of instruction and make recommendations for improvement. This feedback will be provided in the After Action Report (AAR)

(CDRL) A001).

5) The Contractor shall deliver (CDRL) A001) participant certificates upon completion of each of the courses that state at a minimum the name and rank of each participant, hours of instruction, and course title and dates.

5.0 CONTRACTOR CERTIFICATIONS / QUALIFICATIONS

Safety is of the utmost concern to the government and the end user during each COI. It is imperative that instructors facilitating these courses have the highest level of experience and the formal training qualifications possible to ensure the risk to all is mitigated to an acceptable level.

1) The Contractor shall ensure all of the following requirements are met and shall provide at a minimum two (2) on-site instructors whom at a minimum of five years of experience and have the below valid and current qualifications/certifications. The Contractor shall also make available necessary documentation for verification of the required qualifications/certifications for personnel working on this contract. Diplomas, graduation certificates, DD FORM 214, State or Federal Licenses, and past work history documentation as acceptable proof of the required certifications/qualifications. The Contractor shall maintain all certification records for employees working on this contract during the performance period. The government may review said records to verify acceptable records management and current certifications. Certifications and documentation should be included in the proposal.

5.1 SPECIFIC EFX TRAINING CONTRACTOR CERTIFICATIONS

/QUALIFICATIONS:

The following specific Contractor Certifications/Qualifications criteria is required for Expeditionary Forensics eXploitation course of instruction, Certifications and minimum of five years of experience. The documentation should be included in the proposal:

A) The Contractor shall hold an explosives license/permit from the Bureau of

Alcohol, Tobacco, Firearms and Explosives (ATF) This licensing will allows the Contractor to conduct training exercises using a variety of real and simulated explosives.

B) Digital Photography - Certified Evidence Photographer C) Biological Material Collection Techniques - Certificate in Biotechnology D) Latent Print collection and processing - IAI Certified Latent Print Examiner (CLPE) E) Chemistry – Certificate in Forensic Toxicology F) Explosives Testing G) Trace/Bulk Chemistry H) Operation of field and/or forensic laboratory equipment: FTIR, RAMAN, GCMS

5.2 SPECIFIC DOMEX MEDIA CONTRACTOR CERTIFICATIONS

/QUALIFICATIONS:

The following specific Contractor Certifications/Qualifications criteria is required for any Contractor Instructor teaching each of the specific blocks of instruction, certifications and documentation should be included in the proposal.:

A) Familiarity with and working relationship with DOMEX industry

a. To include Encryption key downloads

b. Update downloads

B) Must be affiliated with an accredited university

C) Extensive hands on experience and working knowledge with the DOD issued DOMEX equipment listed.

D) Must have working knowledge and access to DON ISIS and SOFEX portal

6.0 PERIOD AND PLACE OF PERFORMANCE

The Contractor shall provide training location and have a curriculum ready to deliver training for the requested dates and locations as follows:

A) Locations:

All training courses will be held at a vendor provided a training location with a controlled entry to training room on the East Coast of the United States.

TRAINING AREA OR FACILITY. Classrooms and non-explosive/non- live fire buildings or non-explosive/non-live fire training areas.

B) Training Dates:

BASE POP 10-30 AUGUST 2024

OPTION 1 1 FEB 2025-30 MAY 2025

9.0 ACRONYMS

AAR - After Action Report COI – Course of Instruction COR - Contracting Officer Representative DOD - Department of Defense DON - Department of Navy ECL – Execution Check List EFX - Expeditionary Forensics eXploitation EOD – Explosive Ordnance Disposal FRP - Fleet Response Plan FRTP - Fleet Response Training Plan FTIR – Fourier transform infrared spectroscopy GCMS - Gas chromatography–mass spectrometry HME – Home Made Explosives IHD – Indian Head Division KO - Contracting Officer NSWC - Naval Surface Warfare Center OSHA - Occupational Safety and Health Administration ORM - Operational Risk Management

POI - Program of Instruction POP - Period of Performance R&T – Readiness and Training SOE - Schedule of Events SOP - Standard Operating Procedure SOW - Statement of Work SE - Site Exploitation TSD – Technical Support Detachment WEAT – WTI Exploitation Analysis Tool WTI – Weapons Technical Intelligence