Justification_and_Approval_-_Redacted.pdf

DEPARTMENT OF THE NAVY

NAVSUP FLEET LOGISTICS CENTER NORFOLK

700 ROBBINS AVENUE – BUILDING 2B

PHILADELPHIA, PA 19111-5083

J&A Number: 18-073

JUSTIFICATION AND APPROVAL (J&A)

FOR USE OF SOLE SOURCE

1. IDENTIFICATION OF AGENCY AND CONTRACTING ACTIVITY: The requiring activity is Naval Criminal Investigative Service (NCIS); the contracting activity is Naval Supply Systems Command (NAVSUP)

Fleet Logistics Center (FLC) Norfolk Contracting Department, Philadelphia Office.

2. DESCRIPTION OF THE ACTION BEING APPROVED: Award of a sole source (brand-name), firm, fixed price (FFP) purchase order for items manufactured solely by Cellebrite Inc. (CAGE: 4C9Q7). Cellebrite Inc. is the sole distributer of the required items, as it does not have any authorized resellers for the items listed in Section 3.

3. DESCRIPTION OF SUPPLIES/SERVICES: The proposed acquisition is to procure Forensic Data Extraction

Devices and Licenses – more specifically, Universal Forensic Extraction Device (UFED) data devices. The following devices and licenses satisfies NCIS needs as a mobile forensics solution in support of investigations and operations that are critical to the agency's mission:

Item: Part Number: Quantity:

UFED Touch2 Ultimate Software License Renewal A-SOW-07-023 43

Trade-in of UFED Touch1 to UFED Touch2 F-UFD-03-009 87

UFED Touch2 Ultimate Software License A-SOW-07-023 87

UFED 4PC Ultimate Software License Renewal A-SOW-11-003 1

Independent Government Estimate (IGE):

This proposed acquisition will be funded with annual appropriations (FY18 – Operation and Maintenance

Navy – O&MN).

The required delivery date is on or before 28 September 2018 (and coverage will extend through 15

September 2019).

4. STATUTORY AUTHORITY PERMITTING SOLE SOURCE: The statutory authority permitting the use of other than full and open competition is 41 USC 1901(e)(2) - a sole source acquisition using simplified acquisition procedures for certain commercial items (SAP-CI), as implemented by FAR 13.501(a).

5. RATIONALE JUSTIFYING USE OF CITED STATUTORY AUTHORITY: The proposed acquisition is to acquire the items identified in Section 3 above, which are commercially available. The existing inventory used by NCIS includes one hundred thirty (130) Cellebrite portable data extraction devices and one (1) personal computer

(PC) version – totaling one hundred thirty-one (131). These devices are used to assist NCIS in Criminal, Counter

Intelligent (CI), and Counter Terrorism (CT) investigations around the world. The items outlined in Section 3 will provide and maintain up-to-date software upgrades to these existing devices, along with the replacement of eighty-seven (87) UFED data devices. Cellebrite Inc. is the sole developer and manufacturer of the UFED Mobile

Forensics solution.

The existing inventory (and items outlined in Section 3) is used for quick extraction and analysis of cell phones, smartphones, and Personal Digital Assistant (PDA) devices to meet both operational and investigative needs to examine digital evidence on a wide variety of make and model of cell phones and similar devices. These devices operate under license agreements and the licenses must be renewed to receive the latest upgrades and maintain maximum operational capability and security. The non-renewal of the current software maintenance license would cause great degradation on NCIS capabilities to perform its duties as the Law Enforcement Agency, as well as hinder its CI and CT investigations. The items outlined in Section 3 are the only items that are compatible with the existing inventory used by NCIS. In turn, no other source offers products that can satisfy the Government’s minimum requirement; and therefore, the proposed acquisition can only be fulfilled by items manufactured (and distributed) solely by Cellebrite Inc.

6. DESCRIPTION OF EFFORTS MADE TO SOLICIT OFFERS FROM AN MANY OFFERORS AS

PRACTICABLE: The requiring activity, through their in-depth knowledge of the market, has determined that the only items that meet the Government’s minimum requirement are manufactured (and distributed) solely by

Cellebrite Inc. The requiring activity’s knowledge stems from first-hand knowledge of somewhat similar products available in the commercial marketplace, a thorough examination and testing of products currently being used NCIS agents stationed throughout the world, on-line research, and various trade conferences. The contracting office conducted an on-line research which included a review of the System for Award Management (SAM) and Past

Performance Information Retrieval System (PPIRS) websites. The contracting office’s market research resulted in the same conclusion that the only items that meet the Government’s minimum requirement are the items listed in

Section 3 – which are manufactured (and distributed) solely by Cellebrite Inc.

In an effort to inform industry of the proposed acquisition (and identify potential sources), the contracting office posted a Request for Information (RFI)/Sources Sought (SS) synopsis to the Navy Electronic Commerce Online

(NECO) website. This notice was posted on 06 September 2018 (with a response date of 10 September 2018). As a part of this notice, industry was provided the Government’s minimum requirements – which are as follows:

Solution must unlock/bypass brute force password protected Apple devices from iPhone 4S to iPhone X, iPads, and iPod Touch devices with latest iOS 11.4.1, to include when devices have USB Restricted Mode is enabled.

Solution must unlock/bypass passwords on older generation Apple devices including iPhone 4, iPad 1, and below.

Solution must perform logical extraction of BlackBerry OS 4, 5, 6, 7, 8, 9, 10, BB10 Backup acquisition and decryption, and physical extraction of BlackBerry 7xxx/8xxx/9xxx devices.

Solution must perform physical extraction while bypassing lock for Nokia Lumia Windows Phone 7/8 devices, File System extraction for Nokia Lumia devices running Windows Phone 8/10, and logical and physical extraction of Windows Mobile devices.

Solution must perform physical and File System extractions of USB mass storage devices and media cards, to include MicroSD.

Solution must perform physical and File System extraction of TomTom, Garmin, and MIO GPS devices and smartphones.

Solution must be capable of non-invasive means to bypass locks, overcome encryption and perform physical and full file system extractions on Huawei device models that use HiSilicon Kirin chipsets (620, 650, 655, 658, 659, 930, 935, 950, 955, and 960). This includes phone models such as the P10, Mate 10 and P9.

Solution must be able to perform physical extractions by leveraging the Emergency Download Mode on encrypted Android devices when the device is in boot loader mode, which must be forensically sound. The solution must be able to effectively bypass the user lock and decrypts the extraction on the fly resulting in an unencrypted data set. This must work with devices that are manufactured by Asus, Samsung, ZTE, Xiaomi, VIVO, Huawei, Motorola, Kyocera, Orange (SPV), CAT, Alcatel, and Vertu. This must also work effectively on Qualcomm chipsets 8917, 8937, 8940, and 8953.

Solution must be able to perform extractions of internal SD cards present in Drones, to include DJI Inspire

2, Mavic Pro, Phantom 3, and Phantom 4 via USB cable extraction.

Solution must be able to disable User Lock for Samsung Android devices to include Galaxy S4/S5/S6/S7, Galaxy A3/A5/A7/A8/A9, and Galaxy J1/J2/J3/J5/J7. The solution must not be limited to a specific chipset, it must work effectively on both Qualcomm and Exynos based devices.

Solution must be able to perform decrypted physical extractions from unlocked Android devices of the latest generation running OS versions 6.0 to 8.0, to include Asus, Zenfone, Alcatel, BLU, Chinese Android

Phones: LeEco Le X622, BQ Aquaris U Plus, Coolpad, HTC, Huawei, Kyocera, Lenovo, Vertu, LG

CDMA, LG GSM, Motorola CDMA, MyPhone, Nokia, OnePlus, Oppo, Sony (SonyEricsson), Tablets:

TB-X704A Tab 4, TB-X704V Tab 4 10 Plus, CT9223W97 Pro 12, Tecno, Xiaomi, ZTE CDMA, ZTE

GSM, and Wiko.

Interested parties were requested to provide a capabilities statement displaying the contractor’s solution to provide iems that meet the Government’s minimum requirement.

This notice resulted in one (1) inquiry from industry – which is detailed below:

On 06 September 2018, reached out to the contracting office (via email) to request an extension to the RFI/SS synopsis response date/time to allow them adequate time to provide a response.

The contracting office accommodated this request and extended the response date/time to 1600 (EST) on 13

September 2018. On 10 September 2018, informed the contracting office

(over the phone) that they did not offer products that could fulfill the Government’s minimum requirement;

however, they were interested in providing an official response to the RFI/SS synopsis to outline the products and services they provide. The contracting office informed that any such submission(s) – offering products and services that do not meet the Government’s minimum requirement – would be reviewed by both the requiring activity and contracting office solely for market research purposes. To date, has not provided an official response to the RFI/SS synopsis.

7. DETERMINATION OF FAIR AND REASONABLE COST: The NAVSUP FLC Norfolk Contracting

Department, Philadelphia Office Procuring Contracting Officer (PCO) will determine that the anticipated cost to the

Government of the support covered by this J&A will be fair and reasonable.

8. ACTIONS TO REMOVE BARRIERS TO FUTURE COMPETITION: In accordance with DFARS

213.501(a) and based on the reasons outlined in Section 5, NAVSUP FLC Norfolk Contracting Department, Philadelphia Office will handle future requirement on a case-by-case basis. Pursuant to DFARS 213.501(a), the approving official has reviewed the previous J&A (17-044) – for similar items procured in fiscal year (FY) 17 – and has determined that the planned actions to remove any barriers to competition were completed. However, at this time, circumstances have not changed and no other source offers products that can meet the Government’s minimum requirement. However, if another potential source emerges, NAVSUP FLC Norfolk Contracting Office, Philadelphia Office will assess whether competition for future requirements is feasible.

Potential sources for the proposed acquisition will have another chance to express their interest in the requirement via the following postings to the NECO website:

Combined Synopsis/Solicitation (which will be made available after approval of the pre-solicitation clearance)

Justification and Approval (J&A) (which will be included as part of the combined synopsis/solicitation in accordance with FAR 13.501(a)(1)(iv))

9. CONTRACTING POINT OF CONTACT: The point of contact at NAVSUP FLC Norfolk Contracting

Department, Philadelphia Office is Mr. Joseph Caltagirone (Code 280.3G) who may be reached at 215-697-9687 or joseph.caltagirone@navy.mil.

mailto:joseph.caltagirone@navy.mil