Osprey JA final 6232020.pdf

Justification and Approval Template FAR Part authority

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

(Cite authority, e.g., 41 U.S.C. 3304(a)(1-7))

Pursuant to the requirements of the Competition in Contracting Act (CICA) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.3 and in accordance with the requirements of FAR 6.303-1, the justification for the use of the statutory authority under FAR Subpart 6.3 is justified by the following facts and rationale required under FAR 6.303-2 as follows:

1. Agency and Contracting Activity. The Transportation Security Administration (TSA) Intelligence & Analysis (I&A), Executive Directorate of Intelligence (EDI) and the Contracting and Procurement (C&P) office propose to enter into a contract on the basis of other than full and open competition. The procurement request number is 2120200OIA090 and the Office of C&P J&A tracking number is JA- 2020-02-0522.

2. Nature and/or Description of the Action Being Approved.

(a) The TSA I&A, EDI and CP office propose to enter into a contract on the basis of other than full and open competition. The procurement being sought is OSPREY Flight Solutions’ analysis tool that is designed to support aviation risk analysis information and alerts.

The OSPREY Flight Solutions tool arms threat analysts, security operators, and incident responders to rapidly link and reveal unknown threats and risk. Implementing proprietary data-led risk management techniques, delivered through an intuitive interface designed to reduce the burden on analyst that are assigned to process this real-time information.

(b) Name and address of the contractor: OSPREY FLIGHT SOLUTIONS, INC.

200 CONTINENTAL DR STE 401

NEWARK, DE. 19713-4337

(c) Contract type: Firm Fixed Price

(d) Estimated total value (including options). Provide breakdown as shown below:

Period Qty Unit Price Base Year 12 months 500 $400,000.00 Option Year 1 12 months 500 $412,309.00 Option Year 2 12 months 500 $424,678.00 Total $1,236,987.00

(e) Type of funding: Operations and Maintenance Funds

(f) Year of funding: 2020

(g) Solicitation number:70T02020R9NOIA090

(h) Background information about the requirement:

TSA I&A’s Risk and Threat Analyst, as well as Warning and Indication Analyst, are an essential part of the EDI mission. They are required to research, analyze and report any and all aviation threats and risk throughout the world. Collecting, sorting, analyzing and reporting this data is an extremely labor intensive task. Doing so in a timely fashion is even more difficult; especially when more than one threat event is taking place at the same time. OSPREY’s Flight Solution’s subscriptions looks at hundreds of thousands of sources in just a few seconds, gathering millions of data points, then filtering, validating and corroborating that data to ensure that a very accurate, clean and complete data set of open source information is available to the analysts.

OSPREY’s Flight Solution tool uses computing power to achieve the very necessary aspects of understanding threat and risk that the limited capacity of a human constrains. The aviation and flight data gathered by their system, guides and supports the analysis, removing the reliance on assumptions that is inherent in a human based system. The value is to save time by using computing power to understand and accurately measure risk, assign a risk score to identified aviation threat vectors, and actively update those scores based on new data. Osprey Flight Solutions is the only provider in the industry to take this approach to risk management.

3. Description of Supplies/Services.

The requirement is to provide TSA I&A (500) OSPREY Risk Management Subscriptions at a total cost of $1,237,987.00. The TSAI&A has a requirement to enhance its ability to forecast and assess aviation threats, overflight risk(determines when an aircraft crosses certain borders or no-fly area), and provide additional threat intelligence and alerting for aviation incidents. Using OSPREY’s FlightBoard (this is a module within the tool), I&A will have access to terabytes worth of processed data, extractions from human-readable output of over 200,000 sources in over 60 languages, which are filtered and validated, allowing patterns and trends that may be invisible to a purely human system to be identified. This large amount of data is needed in order to make the more accurate assessments, making judgements, assessments, or forecast with only a few data points create unnecessary when additional data is available.

This will also allow TSA I&A to integrate this data with any flight planning software; providing a visual of the common operating picture at any moment in time.

Other services within the OSPREY FlightBoard and Alerting (modules within the tool) include published email alerts from Osprey’s Analysis Team on emerging incidents that could threaten the aviation security environment, or where an incident reinforces Osprey’s advice and recommendations for an overflight risk area, airport or country. Rolling alerts are regularly issued with updates on major incidents that cause severe disruption, have a significant impact on the aviation industry or where the situation precipitates industry-wide visibility.

4. Identification of Statutory Authority Permitting Other Than Full and Open Competition.

The statutory authority permitting other than full and open competition is 41 U.S.C.3304(a)(1) implemented by the FAR Subpart 6.302-1 entitled “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.”

5. Demonstration that the Nature of the Acquisition Require Use of the Authority Cited.

(a) Osprey Flight Solutions is the only solution provided in the mission space that provides a “full scope” solution with regard to flight data, alerts, threat and risk metrics, and real-time reports aligned to aviation security.

(b) Access to this unique alerting and risk management tool affords TSA early warning of aviation security events in real-time. When the data from Osprey is combined with other TSA data holdings, TSA is given the full “common operating picture” required to make informed and measured decisions in real-time, vice post incident. Osprey is the primary flight data tool used by the Federal Aviation Administration (FAA) and many other federal and civil aviation stakeholders. As TSA continues working closely with the FAA on flight routes, and aviation security measures, it is imperative that TSA does so using the same common operating picture used by the FAA and other aviation security stakeholders

(c) TSA considered various vendors to include Control Risk, FSB Ops Group, Horizon Intelligence, HIS Markit, and MedAire. While these vendors did offer some of these capabilities (outlined in specific details below), only Osprey offered the full package and a data driven methodology that addresses TSA’s operational data needs.

(d) Without this tool, TSA must wait upwards to several hours after an event has occurred before actionable information begins to come in from the field, and additional risk can be measured.

Delays in alerting also interrupt the identification of risk mitigation strategies associated with that event and potential follow on events.

If using “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements” as your authority, also include the following:

• TSA I&A requires a web-based solution that will provide intelligence analyst with real-time, aviation-based, threat and risk analysis alerts and warnings. This information should be scoped so that the analyst has the ability to narrow information down to the airline, air-platform, airport, flight path, altitude, geographic, and threat or risk specific topic.

• To date, Osprey’s is the only fully inclusive risk management system for the aviation industry. It takes into account a range of technical criteria to holistically analyze threats to aviation at three altitude intervals (or flight levels (FLs)): 0 - FL100, FL100 - FL260 and above FL260 to cover security threats to all aircraft from rotary to wide bodied aircraft, at all stages of flight; this later fact is key when looking at passenger, cargo, and hybrid air platforms.

• Without this service, TSA I&A will not have real-time risk scores and assessments available to make operational decisions while removing the reliance on assumptions. This tool will allow TSA I&A to save time by using computing power to understand and accurately measure risk, assign a risk score to identified aviation threat vectors, and actively update those scores based on new data. Osprey Flight Solutions is the only provider in the industry to take this approach to risk management.

6. Description of Efforts Made to Ensure that Offers Are Solicited from as Many Potential Sources as is Practicable.

In accordance with FAR 5.2 Synopsis of Proposed Contract Actions, on May 8 2020 the Contract specialist posted a synopsis on beta.SAM.gov for 14 days to inform the public of TSA’s intent to award a contract using other than full and open competition. The synopsis asked any potential vendors to notify the government if their capabilities could meet the synopsized requirements. However, no vendors provided a response during the 14 days.

7. Determination by the Contracting Officer that the Anticipated Cost to the Government will be Fair and Reasonable.

The Contracting Officer will ensure that proposed pricing will be evaluated to determine fair and reasonableness through price/cost analysis techniques in accordance with FAR 15.404-1 prior to award.

In order to determine fair and reasonable pricing, the Contracting Officer anticipates using comparable market pricing. Although there are no license subscriptions that are comparable is exact function, there are subscriptions that are similar in functionality that can be comparable in pricing.

The Contracting Officer’s Representative (COR) and the Project Manager (PM) will review the proposed market mix to ensure that they are appropriate for comparison. The market price comparison will be evaluated and found technically acceptable based on the requirements in the Statement of Work.

8. Description of Market Research.

Research was performed on other vendor’s offerings utilizing internet research, commercial stakeholder use cases, and recommendations from other federal agency users including DHS mandated Strategic Sourcing contract vehicles as explain further below in the table. The table below is the result of the research.

• Other service providers were considered, however those vendors only provided a portion of the overall requirement. These other providers included:

Company Aviation Specific Data

Instantaneous Reports Airport;

Airspace;

Country

Instant and automated flight risk assessments (dynamic whole-network risk profile monitoring)

Pushed Alerts

Data Driven Methodology

Control Risk No No5 No Yes No FSB Ops Group

Yes Yes4 No Yes N/A8

Horizon Intelligence

No No No Yes Yes

IHS Markit No No No Yes No MedAire No Yes3 No Yes No Osprey Yes1 Yes2 Yes6 Yes Yes7

I&A has determined these requirements are critical for operation based on what aviation security questions from Federal Policy makers, DHS leadership, the TSA administrator, and stakeholders are asked.

1. Osprey Flight Solutions provides risk management support only to the aviation industry bringing significant sector specific expertise.

2. Osprey’s reports are both instantaneously created (from the most up to date data in Osprey’s database) and instantaneously available through Osprey’s software platform for any country, any airport (currently 51,000 in the database) or any region of airspace in which there is an assessed threat or risk to aviation.

3. MedAire has a limited number of manually created airport reports (appx. 500 total) which are instantly available, but which could have been written days, weeks or even months previously. Their country reports are provided by the travel security division of the company and are therefore not aviation specific and do not take aviation concerns into account. MedAire does have a number of manually created airspace reports that are available through email request. Any reports that are not already created take 72 hours to deliver.

4. Flight Services Bureau Ops Group is an instant-messenger based forum platform enabling discussion between users. They provide aviation ops focused alerts and run safeairspace.net, which provides an up to date global picture of advisories/Notice to Airmen (NOTAMs) relating to airspace risk. It does not provide any airport or country reports.

5. Control Risks has some reporting that is available through a number of different software packages, none of which are aviation specific. Any reports on airports or airspace would have to be commissioned as a piece of consultancy.

6. By overlaying flight data drawn from Federal Aviation Administration (FAA), Eurocontrol and Aeronautical Fixed Telecommunications Network (AFTN) feeds, along with API connections to flight planning software onto the open source risk data and assessments, the Osprey platform can automatically and instantaneously risk assess every single flight. This means that users can view a dynamic risk profile for their whole network, understanding where their key risks lie and being able to focus resources efficiently. Any subset of flights can be viewed, for example, all in-bound flights to the US. This is a completely unique capability in the industry.

7. A data driven methodology means using technology to identify and scrape millions of data points from many tens or hundreds of thousands of open sources, creating a large database that can be used in analytics and can be geospatially visualised. This data (rigorously quality controlled) feeds directly into a risk assessment methodology that enables the quantification of likelihood and impact thus enabling automated risk assessment. This end-to-end data driven process is at the core of Osprey’s capability. The only other provider known to make heavy use of data is Horizon Intelligence, but their system does not provide end to end capability (they do not conduct risk assessments) and is sector agnostic, meaning the aviation specific data they pull is not extensive (their last report indicated 4,216 incidents in 2019 – these incidents are covered by just 2 of Osprey’s 22 different aviation specific incident types. Over 27,000 incidents in these two incidents types were added to Osprey’s database in 2019. Almost 250,000 total aviation specific incidents were added to Osprey’s database in 2019).

8. FSB Ops Group does not conduct any assessments/analysis at all and therefore does not have any methodology.

• Based on market research, every effort was made to eliminate barriers to competition, as outlined above. I&A researched and reviewed existing TSA contracts and vendors under the DHS mandated Strategic Sourcing contract vehicles. There are currently no existing TSA contracts with the scope of services to meet this requirement. OSPREY does not use authorized resellers of its products and services.

9. Any Other Facts Supporting the Use of Other Than Full and Open Competition.

(a) An explanation why technical data packages, specifications, statement of work, or purchase descriptions are not suitable for full and open competition is set forth below.

Most of the methods and techniques used by TSA’s Intelligence & Analysis analyst to draft intelligence assessments and reports are at a minimum, sensitive, and in some cases classified.

While the use of many of the tools associated with intelligence are not classified, the tactics, techniques and procedures (TTPs) associated with the data and correlations, and other attributes of these systems could assist adversaries with developing counter-measures to circumvent TSA’s security protocols.

(b) This requirement cannot be modified to enhance competition as explained below.

This requirement directly supports TSA’s Intelligence mission space by providing key data points in real-time that will allow TSA’s leadership make operational decisions while removing the reliance on assumptions. These data points are collected, filtered and validated, allowing patterns and trends that may be invisible to a purely human system to be identified. Any modifications of this system will negate that gained outlined in the above processes.

10. A Listing of the Sources, if Any That Expressed, in Writing, an Interest in the Acquisition.

The service providers outlined on the chart in section 8 were considered, however those vendors only provided a portion of the overall requirements. There were no vendor responses for this requirement after being posted on beta.SAM.gov. There was no formal expressed interest in for this requirement.

11. A Statement of the Actions, if Any, the Agency May Take to Remove or Overcome Any Barriers to Competition Before Any Subsequent Acquisition for Supplies or Services Required.

TSA periodically examines the market to determine if new compliant technologies are available, monitors existing software for end-of-life, and checks if infrastructure architecture modifications require alternate solutions. Should any of these conditions occur in the next year, competition strategies will be considered prior to conducting re-seller competition for Osprey license renewals.

However, at this time the Contract Specialist confirmed with the vendor that there are no re-sellers for the required licenses at this time.

12. Contracting Officer’s Certification. I certify that the data supporting the recommended use of other than full and open competition is accurate and complete to the best of my knowledge and belief.

Contracting Officer Date

13. Technical/Requirements Personnel Certification. I certify this requirement meets the Government’s minimum need and that the supporting data, which forms a basis for this justification, is complete and accurate.

Technical Representative Date

14. Legal Counsel Review. I reviewed this Justification and Approval for Other Than Full and Open Competition in accordance with HSAM 3006.304-70 and find it legally sufficient.

Legal Counsel Date

APPROVAL:

Contracting Officer Date

*NOTE: For TSA, Contracting Officer approval is required when the action exceeds the micro purchase threshold, but is less than or equal to the SAT

APPROVAL:

Division Director Date

*NOTE: For TSA, Division Director approval is required when the action exceeds the SAT threshold, but is less than or equal to 700K

Competition Advocate** Date

**NOTE: For TSA, Competition Advocate approval is required when the action exceeds $700K but is less than or equal to $13.5M