Redacted - EFOJ - Open Source Web Based Solution.pdf

Justification Review Document for an Exception to Fair Opportunity – FAR 16.505(b)(2)(i)(B)

Program/Equipment: The U.S. Army Criminal Investigation Division, Protective Services Field Office, and Protective Intelligence Branch has a requirement for worldwide access to an Advanced Open Source Intelligence Web-Based Solution Tool- Kit.

Authority: 10 United States Code 2304c (b)(2) as implemented in Federal Acquisition Regulation 16.505(b)(2)(i)(B), “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

Amount: $600,000.00, inclusive of one 12-Month Base Year and three additional 12- Month Option Years.

Prepared by:

Typed Name: Patrick T. Lyons DSN: 562-2776 Title: Contract Specialist Date: 29 August 2022 E-mail: Patrick.t.lyons9.civ@army.mil

Contracting Officer:

Typed Name: Christopher R. Trotman DSN: 562-8099 Date Reviewed: 1 Sep 2022 E-Mail: Christopher.r.trotman.civ@army.mil

Technical Representative:

Typed Name: CW2 Michael J. McCaffrey DSN: 456-8176

Title: Chief, Open Source Team Date Reviewed: 1 Sep 2022

Requirements Representative:

Typed Name: CW2 Michael J. McCaffrey DSN: 456-8176

Title: Chief, Open Source Team Date Reviewed: 1 Sep 2022 mailto:Patrick.t.lyons9.civ@army.mil

CUI//SP-SSEL//FEDCON

Control Number:

CUI//SP-SSEL//FEDCON

SEP 2021

Reviews

I have reviewed this justification and find it adequate to support the justification for an exception to fair opportunity.

Program Manager Name: CW2 Michael J. McCaffrey

DSN: 456-8176

Date: 1 Sep 2022 Signature: //SIGNED//

Branch Chief Eric Wagner

DSN: 724-2177

Date: 2 Sep 2022 Signature: //SIGNED//

Division Chief Name: Kenneth MacFarlane

DSN: 562-7268

Date: 07 Sep 2022 Signature: //SIGNED//

Legal Counsel Name: Paul L. Harris, Esq.

DSN: 562-5741

Date: 6 Sep 2022 Signature: //SIGNED//

CUI//SP-SSEL//FEDCON

SEP 2021

Justification for an Exception to Fair Opportunity Under FAR 16.505

1. Contracting Activity: U.S. Army Contracting Command - New Jersey

2. Description of Action: The U.S. Army Criminal Investigation Division (USACID), Protective Services Field Office (PSIFO), and Protective Intelligence Branch (PIB) requests a new Firm-Fixed Price Delivery Order to be issued against National Aeronautics and Space Administration (NASA) and Space Administration Solutions for Enterprise-Wide Procurement (SEWP) multiple award Government-Wide Acquisition Contract (GWAC) for an Advanced Open Source Intelligence Web-Based Solution Tool- Kit. Projected award is September 2022 and fiscal year 2022 Operations and Maintenance, Army funds will be used.

3. ;: USACID, PSIFO, and PIB requires worldwide web-based access to a reliable social media threat mitigation service, also referred as the “tool-kit”, for use in criminal investigations, open source intelligence research and the other missions conducted by the PSIFO/PIB. The PSIFO/PIB needs an Open-Source Web based Tool-kit with advanced capabilities to collect publicly available information. This Tool Kit will house various tools under one location and act as the housing and backbone which will provide the anonymity and security needed to conduct publicly accessible information research through misattribution by curating user agent strings and using various egress points globally to mask their identity.

The tool-kit must provide web-based access to advanced open source intelligence applications that leverage global physical infrastructure for proxy network access to support the following critical open source intelligence functions: Virtual Machine (VM), Virtual Private Network (VPN) tunneling, and Traffic pathing capabilities to support Managed Attribution and Secure Browsing operations from specified egress locations around the world; Multi-source, User-driven, Streaming collection of Publicly Available Information (PAI) that reflects the same Cyber Security posture; End-User Applications to support threat detection, monitoring, and over watch of global mentions and hyperlocal events in PAI using advanced Artificial Intelligence/Machine Learning (AI/ML)-enabled visualizations, collaboration, alerts, and reporting.

This is an ongoing PSIFO/PIB requirement to provide global protective services for senior Department of Defense (DoD) officials, adequate security in order to mitigate online threats (direct, indirect, and veiled), the identification of fraudulent accounts and positive or negative sentiment relating specifically to our senior high-risk personnel. The PIB’s Open Source Intelligence Team requires additional programs to detect direct and indirect threats to PSB Protectees including the Secretary of Defense, Deputy Secretary of Defense, Chairman of the Joint Chiefs of Staff, Vice Chairman of the Joint Chiefs of Staff, Secretary of the Army, Army Chief of Staff, Chief of the National Guard Bureau, and the Former Secretary of Defense. PSIFO mission is unique as executive agency for the DoD Criminal Investigative Task Force which is tasked with the investigation of alleged war crimes and acts of terrorism committed against U.S. interests.

SEP 2021

The period of performance for this action is one 12-Month Base Year, and three additional 12-Month Option Years, with a total estimated value of $600,000.00.

4. Authority Cited: 10 United States Code 2304c (b)(2) as implemented in Federal Acquisition Regulation 16.505(b)(2)(i)(B), “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Reason for Authority Cited: SEWP Solutions, LLC provides worldwide web-based access to advanced open source intelligence applications that leverage global physical infrastructure for proxy network access to support the following critical open source intelligence functions: Virtual Machine, VPN tunneling, and Traffic pathing capabilities to support Managed Attribution and Secure Browsing operations from specified egress locations around the world; Multi-source, User-driven, Streaming collection of PAI that reflects the same Cyber Security posture; End-User Applications to support threat detection, monitoring, and overwatch of global mentions and hyperlocal events in PAI using advanced AI/ML-enabled visualizations, collaboration, alerts, and reporting.

SEWP Solutions, LLC is the only vendor that allows USACID the ability to tunnel into specific countries/cities like Moscow, Russia or Beijing, China and come out on a host nation internet domain. The other vendors either have regions or proxy IPs built into their system that allow them to place a use in a geographical region. PIB users need to be able to pinpoint locations based on threat or visibility of mission to our principals to properly protect them while on mission. The biggest example is the Proxy/VM egress point being specific to a latitude/longitude “geographical location – what we need” versus a “geographical region – what other vendors only offer”.

SEWP Solutions, LLC’s VMs allow a user to process and pass data back and forth between commercial and government networks. Other vendor’s similar technology is only able to process information to the Government network and not back to the commercial network (one way vs two ways). Additionally, SEWP Solutions, LLC provides access to capabilities such as webcams, CCTVs, and global radio stations.

These capabilities are unique to SEWP Solutions, LLC and are needed for PSIFO protective services for senior DoD officials in providing adequate security in order to mitigate online threats, the identification of fraudulent accounts and positive or negative sentiment relating specifically to their senior high-risk personnel. The PSIFO unique mission as executive agency for the DoD Criminal Investigation Task Force (CITF) would be in jeopardy if these capabilities are not procured. There is a risk to their investigation of alleged war crimes and acts of terrorism committed against US interests if these capabilities are not met.

SEWP Solutions, LLC also utilizes two different virtual machines providing a backup solution if one solution was to fail and has an unmatched Egress/Proxy service which allows to tunnel in to almost any city across the globe and come out as the host country egressed in to. This is a very important capability needed by PSIFO, as their role in global protective services to detect and mitigate online threats, the identification of

CUI//SP-SSEL//FEDCON

SEP 2021

fraudulent accounts and positive or negative sentiment relating specifically to senior high-risk personnel require users to be able to pinpoint exact locations based on threat or visibility of mission to their principals to properly protect them while on mission.

Failure in obtaining this capability would negatively impact USACID’s mission as the premier Military Criminal Investigative Organization within the DoD and fail their ability to conduct global protective service missions for senior DoD officials. Egress/Proxy service is necessary for mission execution, as the ability to pinpoint the exact location of threats will successfully mitigate potential issues as the PSIFO can respond to threats accurately and faster which will protect national safety. PSIFO’s mission would be in jeopardy by not securing the required Egress/Proxy service because it would not provide the exact pinpoint location to accurately detect and mitigate direct and indirect threats to U.S. interests and PSB Protectees, including the Secretary of Defense, Deputy Secretary of Defense, Chairman of the Joint Chiefs of Staff, Vice Chairman of the Joint Chiefs of Staff, Secretary of the Army, Army Chief of Staff, Chief of the National Guard Bureau, and the Former Secretary of Defense.

Market research identified four additional vendors for this requirement under NASA

SEWP GWAC Groups A, B, C, and D: Four LLC, ATPGOV, NexTech, and Cobwebs.

However, none of the identified vendors were able to meet all of the specifications listed in the Statement of Work (SOW). The Market Research section below provides details of why each vendor is not capable of meeting PSIFO’s requirements.

6. Efforts to Obtain Competition: In accordance with FAR 5.202(a)(6), “The contracting officer need not submit the notice required by 5.201 when the proposed contract action is an order placed under subpart 16.5. This acquisition shall be issued to SEWP Solutions, LLC under their National Aeronautics and Space Administration (NASA) and Space Administration Solutions for Enterprise-Wide Procurement (SEWP) multiple award Government-Wide Acquisition Contract (GWAC) in accordance with FAR subpart 16.5 and therefore not required to be synopsized.

a. Effective competition. The Government does not anticipate competition under this requirement, as only one vendor is capable of providing the supplies required at the level of quality required because the supplies ordered are unique and highly specialized.

b. Subcontracting competition. Subcontracting competition will be in accordance with FAR 52.244-6 as well as FAR 52.219-8 “Utilization of Small Business Concerns” as incorporated into SEWP Solutions, LLC basic contract NNG15SC19B.

7. Actions to Increase Competition: This is the first instance the authority at FAR 16.505(b)(2)(i)(B) is being utilized for this requirement, therefore the requirements at DFARS 216.505(b)(2) and PGI 216.505 to supply the previous justification to exception of fair opportunity do not apply. While Full and Open Competition is not possible at this time, USACID will continue to monitor the market for Advanced Open-Source Intelligence Web-Based Solution Tool-Kits that can offer all of the required capabilities

CUI//SP-SSEL//FEDCON

SEP 2021

needed in protective services. In addition, the Government will conduct market research to ascertain if there are any changes in the marketplace which will enable future actions to be competed.

8. Market Research:

USACID PIB Open-Source Intelligence Team Chief, CW2 Michael McCaffrey, conducted Market Research as follows:

From April - May 2021 CW2 McCaffrey reviewed free and publicly available tools on the internet. It was identified the available tools were not sufficient to properly locate and deter threats to protect its principals.

Between May 2021 -September 2021 CW2 McCaffrey conducted several demos/trials with various tools/programs to identify the best program to package into a tool kit. The testing was conducted in several stages. First, Advanced Open-

Source Intelligence Web-Based Solution Tool-Kits available for publicly accessible information collection were reviewed online. Next, CW2 McCaffrey contacted several Other Government Agencies to ask about tool kits they currently had or were looking to purchase. During this period, several tools were identified that may meet USACID requirements as part of this toolkit. CW2 McCaffrey contacted Air

Force PAI Program Management Team and the Army Open-Source Office to identify what larger DOD entities were using. It was determined that most tools do not meet the full requirements necessary to meet the PSIFO mission. After contacting several other Agencies like the State Department, West Virginia Fusion

Cell, National Football League, Nation Joint Terrorism Task Force, Joint Special

Operations Command, United States Marine Corps OSINT Cell, US Army North

OSINT Cell, SOUTHCOM OSINT Cell, and the New Jersey State Police Cyber and

OSINT Cell, CW2 McCaffrey determined specific programs were being used for several requirements and that an entire tool kit needed to be built to meet the required mission and full scope.

CW2 McCaffrey received several vendor demos to determine if the recommended tools would meet requirements by building an Advanced Open Source Intelligence

Web-Based Solution Tool-Kit. Tools observed were SCRAAWL, ARGOS, C5RDO, FiveCast, Echosec, Beacon, Nexus Xplore, Flashpoint, Babel, Recorded Future, Maltego, Social Net, Recorded Futures, ZeroFox, Zignal, Blue Stone Analytics, Athena, Gemini, SILO, OpenlO, and Dun and Bradstreet Investigations. Based on these demos, CW2 McCaffrey and his team of analysts tested several tools such as

SCRAAWL, Nexus Xplore, SILO, Open 10, FIVECAST, Flashpoint, Babel, Gemini, Athena, Maltego, Echosec, and Beacon. From the demos and trials, several areas were identified as being needed to properly complete the required mission. PSIFO needs a tool kit that has a virtual machine with proxy/egress capability. Within that virtual machine, PSIFO needs to have access to a Person Investigation/Social media Cross-Platform tool, Persona/Case Management tool, PAI

CUI//SP-SSEL//FEDCON

SEP 2021

Alert/Aggregation/Monitoring tool, Deep/Dark Web access tool, and Link Analysis/ tool.

During the dates of 24 June 2021 to 01 April 2022, CW2 McCaffrey Conducted

Market Research and posted a Request for Quote (RFQ) and a subsequent amendment to the RFQ within the US Army Computer Hardware, Enterprise

Software and Solutions (CHESS) program, which resulted in no vendors capable of providing the aforementioned toolkit.

CW2 McCaffrey then looked on GSA.gov and posted on the National Aeronautics and Space Administration (NASA) Space Administration Solutions for Enterprise-

Wide Procurement (SEWP). SEWP Solutions, LLC was the only vendor that responded with interest and capability to provide a quote.

In accordance with Army Regulation 25-1 and Department of the Army Policy memorandum dated 4 May 2009, Defense Federal Acquisition Regulation

Supplement Part 208.74 and Army Federal Acquisition Regulation Supplement Part

5139.101, Army CHESS is the mandatory source for commercial Information

Technology (IT) hardware and software. Purchasers of commercial hardware and software must satisfy their IT requirements by utilizing CHESS contracts and

Department of Defense Enterprise Software Initiative agreements first, regardless of dollar value. CHESS Statement of Non-Availability Request Number 216783765 was received on 10 June 2022 confirming that Advanced Open Source Intelligence Web-

Based Solution Tool-Kit is not on its contract vehicle and the Information Technology

Approval System Waiver number 20220610293407231 was approved on 19 August

2022.

ACC-NJ issued a Request for Information (RFI) to NASA SEWP Government-Wide

Acquisition Contract (GWAC) Group A, NAICS Code 334111 and Group B, C, and D, NAICS Code 541519 on 04 August 2022 to see if any other vendors were capable of providing the Advanced Open Source Intelligence Web-Based Solution Tool-Kit. Four vendors, Four LLC, ATPGOV, NexTech, and Cobwebs, responded from Group B, C, and D, and one vendor, SEWP Solutions, LLC responded from Group A, by the closing date of 11 August 2022.

CW2 McCaffrey reviewed the capability statements submitted by the interested vendors and conducted a capability assessment to confirm whether they could provide the requirements. Four LLC, ATPGOV, NexTech, and Cobwebs could not meet all of the specifications listed in the Statement of Work (SOW). CW2 McCaffrey documented the results and explained how they cannot meet all of the required specifications in a

Statement of Vendor Requirement Suitability Memorandum for Record, which is located in the official contracting file. A summary of the assessment is as follows:

CUI//SP-SSEL//FEDCON

SEP 2021

Four LLC cannot meet Statement of Work (SOW) Section 2.1, Requirement 2, “The toolkit must have access to the following tools: Person Investigation/Social media

Cross-Platform, Persona/Case Management, Deep/Dark Web access, and Link-

Analysis tools,” and uses SILO. Four LLC does not have Section 2.2, “Person

Investigation/Social Media Cross-Platform Tool” or Section 2.3, “Persona/Case

Management Tool.” Additionally, Four LLC cannot meet SOW Section 2.3, Requirement

2, “Must offer a universal search selector that allows analysts and collectors to effortlessly search across multiple open-source platforms at once to rapidly discover and assess masses of online data,” as their proposed tool does not have a universal search selector and uses connections to link data that the end user is unable to manipulate on his or her own. Four LLC also does not have the capability to meet SOW

Section 2.4, “PAI Alert/Aggregation/Monitoring Tool” or SOW Section 2.5, Requirement

4, “Must provide a single-pane view Dashboard of information and display data to help mitigate exposure and risk with access to signal-rich discussions from illicit threat-actor communities and access to around-the-clock conversations within threat-actor channels to monitor and gain insights across threat-actor communities, enable access to openly shared research, data leaks, and other plain text files frequently used by both anonymous sources and threat actors to share malicious activity, providing a broader view into open web data.” Lastly, Four LLC does not have all of the required Egress locations such as Moscow or Beijing needed in SOW Section “8.1, Egress Points (Table

1).”

ATPGOV cannot provide a tool inside the VM and is a stand-alone product that does not meet any of the requirements or tools listed in SOW Section 2.1, Requirement 2, “The toolkit must have access to the following tools: Person Investigation/Social media Cross-Platform, Persona/Case Management, Deep/Dark Web access, and Link- Analysis tools. ATPGOV provided a solution called MICROFOCUS IDOL.” Further, they cannot meet SOW Section 2.3, Requirement 2, “Must offer a universal search selector that allows analysts and collectors to effortlessly search across multiple open-source platforms at once to rapidly discover and assess masses of online data” as their tool does not have a universal search selector and uses connections to link data that the end user is unable to manipulate on his or her own.

NexTech does not have the capability to create user strings manually and cannot support specific egress as their capability only pulls from regions and not specific countries, which is a requirement in SOW Section 2.1, Requirement 3, “This capability must have the ability to configure traffic-pathing – by using configuring a user string to further obfuscate the users’ location and identity that will mimic a typical user in each target geographic location, based on prior research of typical web requests and ongoing analyses of web traffic patterns.” NexTech does not have access to Twitter Firehose API, which is needed under SOW Section 2.4, Requirement 5. -This capability must have access to Twitter Firehose API, Telegram, 4Chan, Reddit, YouTube, and VK with access to foreign language feeds with built-in translation of keyword and results while

CUI//SP-SSEL//FEDCON

SEP 2021

monitoring public groups within chat services (Telegram, Discord) and identifying counterterrorism and counter- extremism and radicalization.” Additionally, NexTech does not have all of the required Egress locations such as Moscow or Beijing needed in SOW Section “8.1, Egress Points (Table 1).”

Cobwebs cannot provide CCTV, traffic cams, and Global Radio station data required in SOW Section 2.2, Requirement 3, “Can access thousands of data sources to include but not limited to Public CCTV feeds, global radio stations, macro and hyperlocal news feeds, person records, cyber tools, breached data, IoT sensors (webcams), mobile signal data (Adtech data) and uses visual network analysis to correlate social, mobile, signal data, transport data, and geo-fenced data.” Additionally, Cobwebs does not have all of the required Egress locations such as Moscow or Beijing needed in SOW Section “8.1, Egress Points (Table 1).”

Only one vendor, SEWP Solutions, LLC, is capable of providing the Advanced Open Source Intelligence Web-Based Solution Tool-Kits specifications needed in protective services and investigation of alleged war crimes and acts of terrorism committed against US interests. In accordance with FAR 8.004(a)(1), agencies are encouraged to consider satisfying requirements from or through the non-mandatory sources such as GWACs like NASA SEWP. Therefore, it is the Government’s intent to issue this requirement to SEWP Solutions, LLC on the NASA SEWP GWAC Group A, NAICS Code 334111.

9. Other Facts: Not applicable, this is a new requirement.

10. Technical Certification:

I certify that the supporting data under my cognizance, which are included in the justification, are accurate and complete to the best of my knowledge and belief.

Signature: //SIGNED// Date: 1 September 2022

Typed Name: CW2 Michael J. McCaffrey Title: Chief, Open Source Team

11. Requirements Certification:

I certify that the supporting data under my cognizance, which are included in the justification, are accurate and complete to the best of my knowledge and belief.

Signature: //SIGNED// Date: 1 September 2022

Typed Name: CW2 Michael J. McCaffrey Title: Chief, Open Source Team

12. Fair and Reasonable Cost Determination:

I hereby determine that the anticipated cost to the Government for this contract action will be fair and reasonable. Fair and reasonable price will be determined by a price

CUI//SP-SSEL//FEDCON

SEP 2021

analysis in accordance with FAR 13.106-3(a)(2)(i) comparison to quotes received during market research, FAR 13.106-3(a)(2)(iii) comparison to current price lists, catalogs, or advertisements, and FAR 13.106-3(a)(2) (vi) a comparison to the Independent

Government Estimate.

Signature: //SIGNED// Date: 1 September 2022

Typed Name: Christopher R. Trotman Title: Contracting Officer

13. Contracting Officer Certification:

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Signature: //SIGNED// Date: 1 September 2022

Typed Name: Christopher R. Trotman Title: Contracting Officer

Approval

Based on the foregoing justification, I hereby approve the procurement of Advanced Open Source Web-Based Intelligence Solution with an estimated total value of $600,000.00 on an other than full and open competition basis pursuant to the authority of Title 10 United States Code 2304c (b)(2) as implemented in Federal Acquisition Regulation 16.505(b)(2)(i)(B) subject to availability of funds, and provided that the services and property herein described have otherwise been authorized for acquisition.