Pilot IRS Crypto RFP FINAL.pdf

Request for Proposal 2032H8-20-R-00500

Background and Summary:

Internal Revenue Service, Criminal Investigation (IRS-CI) is the largest Federal law enforcement agency in the United States Department of the Treasury, consisting of sworn law enforcement Special Agents and support personnel focused solely on matters related to criminal violations of law. IRS-CI is responsible for investigating potential criminal violations of the U.S. Internal Revenue Code and related financial crimes. IRS-CI is a global leader in cyber criminal investigations involving cryptocurrency and has played a lead or key role in the takedown of numerous major Dark Net Marketplaces and other transnational criminal organizations facilitating identify theft, narcotics trafficking, money laundering, terrorist financing, sex trafficking, and child prostitution.

The use of privacy coins is becoming more popular for general use, and is also seeing an increase in use by illicit actors. For example, in April 2020 a RaaS (Ransomware as a Service) group called Sodinokibi (a former affiliate with the GrandCrab RaaS group) stated that future ransom request payments will be in Monero (XMR) rather than Bitcoin (BTC) due to transaction privacy concerns.

Regarding Layer 2 protocols, Lightning Labs has developed a monitoring app, Lndmon, for the Bitcoin LN and has released the code on GitHub with no current resources developed for LNs on other distributed ledgers (e.g., Litecoin blockchain), Raiden Network (on the Ethereum platform), etc. IRS- CI has the need to be able to investigate illicit activity on these networks. The number of nodes on the LN has grown to nearly 10,000 since the initial release in March 2018, close to the number of full nodes on the Bitcoin mainchain.

Currently, there are limited investigative resources for tracing transactions involving privacy cryptocurrency coins such as Monero, Layer 2 network protocol transactions such as Lightning Labs, or other off-chain transactions that provide privacy to illicit actors.

Introduction and Goals1 Introduction:

The federal government struggles at times with identifying ways to test, purchase, and deploy innovative technology solutions. A large function of this is how long it takes to not only purchase the actual solution, but also test it, provide feedback, and ultimately decide how (and whether) to deploy the solution. In other words, this is not simply a ‘how quickly can we buy it’, but also a ‘how do we test it and decide whether or not to fund it for deployment’. There are also times when the federal government prescribes a specific approach to a solution, and then asks who can do it best, and for the lowest price. This can limit innovation, and is often not the best approach when looking for emerging technologies and how their inclusion can benefit the government.

Goals:

Pilot IRS has three goals: 1) to promote innovative responses to challenges; 2) to broadly communicate areas of interest in the innovative solutions and technologies arena; and, 3) to create a streamlined progression from concept to prototype, testing, and limited deployment that allows for incremental funding decisions for promising solutions and technologies.

1 A significant portion of the text included in this section applies to the overarching Pilot IRS approach, and has been included in previous documents. It is being provided again, with minor edits for the current SC, to support those who may not be familiar with the concept.

Goal 1 - Promote Innovative Responses to IRS Challenges

Pilot IRS is predicated on the concept that a major hurdle to doing business with the federal government is a perceived (or otherwise) lack of pertinent information and a lack of direct and near-term feedback on technologies and proposals. In order to promote innovative responses to the challenges that the government faces, Pilot IRS will focus on providing information throughout the process regarding its requirements (to include direct engagement with various end-users), and providing direct feedback on proposals in a matter of weeks rather than months.

Goal 2 - Broadly Communicate Challenges and Technologies that Interest IRS

Prior to any funding decisions, Pilot IRS will broadly communicate the challenges it is facing, as well as any initial thoughts on promising solutions/technologies/approaches. Because of its mission, the federal government cannot share all of the information about how it addresses these challenges.

Goal 3 - Streamlined Progression from Concept to Prototype, Testing, and Limited Deployment

A frequent problem within the federal government occurs, ironically, when a pilot technology/solution has been particularly successful within an agency. Federal procurement rules preclude (with some exceptions) identifying a particular technology or firm for funding based on a previous, separate contractual arrangement, regardless of how successful it may have been. By identifying streamlined submission/evaluation procedures and a structured progression from concept to prototype, testing, and limited deployment using phases, Pilot IRS seeks to avoid many of these issues.

The specific approach/process for each SC and its respective phases will vary, but in general, each phase will build on the previous one, and funding amounts and durations may increase or decrease as phases progress. Most SCs will include an initial brief written proposal. Rough scopes of work and funding ceilings for all phases will be proposed during the initial response, with the understanding that additional clarity will be established at the end of each preceding phase. In other words, the specifics of the requirements/cost for Phase 2 will be established as part of the work completed in Phase 1.

Depending on results and mission priorities, the government will decide to fund all, some, or none of the project at each phase.

For those who are familiar with traditional government procurements, Pilot IRS will appear substantively different from how the government normally buys technology.

To be fair, it is.

This type of approach is more often used in research and development environments, but there are existing regulations that allow federal agencies to buy commercial items in a manner similar with how the private sector would. Pilot IRS will aggressively pursue a streamlined and cost-effective approach to testing and deploying technology solutions that will have an immediate impact on the government’s mission.

Thank you for your interest, and welcome aboard.

Solution Challenge (SC) Three – Cyber Crimes Privacy Cryptocurrency Tools and Support

IRS-CI is seeking a solution with one or more Contractors to provide innovative solutions for tracing and attribution of privacy coins and Layer 2 off-chain transactions, such as expert tools, data, source code, algorithms, and software development services to assist their Cyber Crimes agents in carrying out their mission as it relates to cryptocurrency privacy technologies. These should support one of the outlined initiatives on Monero or Layer 2 network protocol transactions, or other cryptocurrency obfuscation technologies.

Under the overall direction of the Director of Cyber Crimes or their designee, the Contractor shall provide weekly status reports of progress to include major accomplishments, upcoming tasks, and issues or concerns. The Contractor shall work with CI Cyber Crimes personnel, Cyber Special Agents;

business and functional points of contact; and other personnel, including other contractors, to gather and synthesize data and other inputs as needed. All documentation, data, source code, and software developed shall be provided to IRS-CI.

The primary goals of this solution challenge are:

1) Provide information and technical capabilities for CI Special Agents to trace transaction inputs and outputs to a specific user and differentiate them from mixins/multisig actors for Monero and/or Lightning Layer 2 cryptocurrency transactions with minimal involvement of external vendors

2) Provide technology which, given information about specific parties and/or transactions in the Monero and/or Lightning networks, allows Special Agents to predict statistical likelihoods of other transaction inputs, outputs, metadata, and public identifiers with minimal involvement of external vendors

3) Provide algorithms and source code to allow CI to further develop, modify, and integrate these capabilities with internal code and systems with minimal costs, licensing issues, or dependency on external vendors

All solutions must support cryptocurrency transactions that occurred in 2020. All solutions for the must support open standards for interoperability (common file formats, REST APIs, etc. as appropriate) to facilitate easy integration into internally developed IRS-CI cryptocurrency analytic systems and data.

When responding, please keep the three above goals in mind. We are looking for solutions which provide the best results for tracing obfuscated cryptocurrency transactions using Monero and/or Lightning, however all three goals are important and a solution that produces good statistical likelihoods of transaction parties but does not provide easy to integrate source code will not be rated as highly as one that provides both source code that can be integrated with CI systems and produces good statistical likelihoods of transaction parties. Contractors may choose to submit solutions to address Monero or Lightning transactions, or both as all approaches will be considered. The exact method of solving these problems is unspecified as many different approaches may be viable. We expect contractors will offer solutions in the form of software development and source code, data feeds, standalone tools, or some combination of these, but these are not the only types of solutions that will be considered. Solutions that require extensive vendor involvement such as consulting services to trace cryptocurrency for each case (as opposed to general development services to built tools for CI) will likely not fully address these three goals. If proprietary tools are part of the proposed solution, contractors shall include details on any ongoing licensing and/or maintenance costs and information about APIs or other interoperability with CI's internal cryptocurrency tracing systems.

Phases, Funding Levels and Deadlines:

Phases - There will be two (2) Phases for this SC, as set forth below. It is important to note that the amounts/durations set forth below are Not to Exceed (NTE) amounts/durations. Additionally, the specific efforts and amounts for subsequent phases will be defined at the end of the current phase. In other words, the proposed duration and amount for Phase 2 will be part of the deliverables due at the end of Phase 1.

Phase 1 – Proof of Concept and Initial Working System, One or more of: Software Development, Data Feeds, Tools (NTE $500K / 8 months)

=> Phase 1 will consist of a demonstration of the proof of concept and an initial working system that should reliably produce useful results on a variety of real-world CI cryptocurrency investigations involving Monero and/or Lightning, as well a clear plan documenting how it can be enhanced or expanded in further phases. It will also include initial user feedback for the developed system. This user feedback may be obtained from users from different agencies.

=> If selected, a contract action for Phase 1 funding will be provided no more than 30 calendar days after selection. Specific deliverables for Phase 1 funding will be based upon the proposed solution, but a standard deliverable for all Phase 1 actions will be a Phase 2 proposal.

Phase 2 - Testing and Pilot/Initial Deployment: One or more of: Software Development, Data Feeds, Tools (NTE $125K / 120 days)

=> Phase 2 will consist of an expansion to add additional functionality and improve the accuracy of the system developed in Phase 1. This could include but is not limited to, support for handling additional obfuscation methods, broader cryptocurrency support, additional statistical modeling techniques, integration of additional data, and/or other enhancements to the functionality and accuracy of the system. Return on investment (ROI) will be evaluated during initial deployment.

Specifics of the Phase 2 efforts, duration, and amount will be required at the end of Phase 1.

=> Selections and funding for Phase 2 will be made within 5 calendar days from the end of Phase 1.

Deadlines –Proposals are due Wednesday September 16, 2020 at 08:00 EDT. No late submissions will be accepted or considered or evaluated. IRS expects to provide approximately $1M in FY20 funding across all solutions (based on the maximum duration of 8 months for Phase 1, this will not include funding for Phase 2). Proposals are due to marcela.a.almeida@irs.gov by the state due date.

=> Responses to the call will be evaluated as follows, contractor shall submit a written proposal (no more than 10 pages in length) and should address the following questions:

1. Describe in detail, the proposed approach for tracing Monero or other anonymity-enhanced cryptocurrency, or Lightning or other Layer 2 off-chain cryptocurrency protocols including at least some of the following features:

a. Trace transaction inputs and outputs to a specific user and differentiate them from mixins/multisig actors

b. Identify details about specific transactions such as date/time; amount; the parties in a user group (e.g. ring), behind a ring signature or participants in an off-chain transaction, and CT and statistical probabilities

c. Given information about specific transactions in the network, provide statistical likelihoods of other transaction inputs and outputs mailto:marcela.a.almeida@irs.gov

d. Associate the public address of each user from the stealth address or aggregated addresses and provide statistical probabilities

e. Defeating attempts at obfuscation through churning or cycling

f. Develop an application for tracing transactions on Layer 2 off-chain protocols

2. Provide a description of the approach what if any standard deliverable would be provided and cadence for these to be submitted throughout Phase 1.

3. In the approach describe and address if your team or company has experience in tracing cryptocurrency, particularly privacy-focused coins and/or Layer 2 off-chain protocols that are relevant to significant Federal financial criminal investigations.

Proposals will be evaluated in terms of technical aspects and price, relative to how they address the goals of this SC. Technical and price proposals must be submitted as two separate documents/volumes. Acceptable formats are PDF, Word, and Excel. The 10-page proposal limit applies only to the Technical portion of the proposal. Price proposals must include pricing for all contract phases/periods identified within this solicitation and do not count against the 10-page limit.

The pricing proposal shall address individual category submissions or any combination of categories such as, but not limited to; Software development services to provide on-premise tools with source code to CI, data feeds (frequency of data feeds and minimum fields), and Commercial-Off-the-Shelf or web-based tools which can be used by CI employees via a graphical interface and which include API access.

Evaluation of Responses and Basis for Award:

The primary goals of this solution challenge are:

1) Provide information and technical capabilities for CI Special Agents to trace transaction inputs and outputs to a specific user and differentiate them from mixins/multisig actors for Monero and/or Lightning Layer 2 cryptocurrency transactions with minimal involvement of external vendors

2) Provide technology which, given information about specific parties and/or transactions in the Monero and/or Lightning networks, allows Special Agents to predict statistical likelihoods of other transaction inputs, outputs, metadata, and public identifiers with minimal involvement of external vendors

3) Provide algorithms and source code to allow CI to further develop, modify, and integrate these capabilities with internal code and systems with minimal costs, licensing issues, or dependency on external vendors

The Government intends to make more than (1) Firm-Fixed-Price award resulting from this solicitation to the contractor(s) whose offer represents the best value to the Government. Comparative evaluations in accordance with FAR 13.106-2(b)(3) will be used to determine the best value based on: Technical (capability of the solution to meet the primary goals), Past Performance, and Price. For price evaluation purposes, the total evaluated price will include the base period and all option periods as well as ongoing licensing and maintenance costs. Evaluation of option periods does not obligate the Government to exercise the option(s).

Some government procurements will include longer/greater maximum page limits, or adjectival ratings for a series of technical evaluation factors. Pilot IRS uses different, existing authorities in FAR Subparts

12.6 and 13.5 that govern federal procurement. Selections will be made based on realistic solutions that offer the greatest potential ROI, at the lowest potential cost with appropriate consideration given to the Technical, Past Performance, and Price.

Additional Terms and Conditions:

Although this solicitation aims to limit unnecessary terms and conditions, there are some which are part of virtually every federal procurement. Northern American Industry Classification System (NAICS) Code: 511210 Software Publishers. Product Service Code (PSC) is: R423 Support- Professional:

Intelligence.

Internet Protocol IPv6:

The contractor shall ensure all IT products and services are IPv6 compliant as specified by the National Institute of Standards and Technology (NIST) developed “A Profile for IPv6 in the U.S.

Government – Version 1.0 (USGv6)”. This NIST Special Publication 500-267(NIST SP500-267) is available at http://w3.antd.nist.gov/usgv6/index.html.

System for Award Management (SAM):

Successful vendors not already registered in SAM will be required to register prior to award. All awardees shall be registered in SAM prior to award. If contractors are not registered in SAM, they will not be eligible for award. Information regarding SAM registration is available at https://sam.gov.

Reimbursement for Proposal Generation Costs:

The Government will not pay for any direct or indirect costs associated with generating responses to this solicitation.

Compliance:

If a response does not adequately address this SC, or includes elaborate responses or extensive marketing materials that aren’t relevant, the IRS will stop reviewing it and will NOT consider it for award.

Intellectual Property:

Currently, the IRS does not intend to request retention of any intellectual property resulting from or providing the basis for work under this SC, with the exception of the ability to continue using the solutions resulting from government funding and a non-exclusive perpetual royalty-free license to any source code developed with this funding. Notwithstanding, intellectual property terms are negotiable, and the IRS intends to use the results of this effort as broadly as they can, to include potentially working with other Treasury bureaus and Federal agencies to use these capabilities.

Press Releases:

All press releases must be approved by IRS prior to release. IRS will do its best to provide reviews within 2 business days.

Prohibition on Multiple Proposals An Offeror shall submit a maximum of one (1) fully compliant proposal in response to the solicitation.

Recognizing that the IRS is encouraging innovative solutions, the IRS will only consider one solution or combination of solutions per offeror. If an Offeror submits more than one proposal, all proposals will be returned without evaluation since the IRS would have no basis upon which to determine which of the proposals the Offeror desired to have evaluated.

Standard Terms and Conditions:

See Clauses/Provisions attachment. Clauses and Provisions are available publicly at www.acquisition.gov.

Note: Offerors shall submit a completed copy of the following clauses/provisions with their response to this solicitation, this submission of provisions and clauses do not count towards the 5-page limit. If these are NOT received the proposal will NOT be considered for award:

http://w3.antd.nist.gov/usgv6/index.html https://sam.gov/

• 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (Aug 2020)

• 52.209-5 Certification Regarding Responsibility Matters (Aug 2020)

• 52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony

Conviction under any Federal Law (Feb 2016)

• 52.212-3 Offeror Representations and Certifications- Commercial Items (Aug 2020)

• IR1052.209-9002 Notice and Consent to Disclose and Use of Taxpayer Return Information

(May 2018)

• IR1052.232-9001 Electronic Invoicing and Payment Requirements for the Invoice Processing

Platform (IPP) (Jul 2019)

• IR1052.239-9010 Information System and Information Security Control Standards and

Guidelines Applicability (Jun 2020)