RFI - Prisoner Biometric Identification Software Development Kit (SDK).docx

Request for Information (RFI) – Prisoner Biometric Identification Software Development Kit (SDK)

1.0 Background and Scope

The Justice Prisoner and Alien Transportation System (JPATS) is a division of the U. S. Marshals Service (USMS), which is a component of the Department of Justice (DOJ). JPATS coordinates logistics and transports prisoners for the U.S. Marshals Service, Bureau of Prisons (BOP), and for state and local jurisdictions. JPATS’ mission is to provide effective scheduling and safe/reliable transportation of Federal, State, Local, and military prisoners providing the best value to our customers and the taxpayer.

The JPATS supports the federal judiciary by scheduling and transporting prisoners to courts and detention facilities around the country, including sentenced prisoners who are in the custody of the BOP. For fiscal year 2019, JPATS scheduled and performed 257,354 prisoner movements with 103,563 being air movements.

A network of aircraft, cars, vans, and buses accomplish these coordinated movements. JPATS operates a fleet of aircraft which moves prisoners over longer distances more economically and with higher security than commercial airlines. Nearly all air movements are done aboard USMS owned or chartered aircraft. On average, JPATS operates three large and one small sized aircraft per day, most of which follow a regular schedule. In addition to federal prisoners, JPATS aircraft transport non-federal prisoners as well. Military and civilian law enforcement agencies use JPATS to shuttle their prisoners between different jurisdictions at about 25 percent of commercial cost. They comprise the only government-operated, regularly-scheduled passenger airline in the nation. JPATS routinely serves approximately 40 cities, plus every other major city in the United States on an as-required basis. Detailed itineraries are required to ensure that each prisoner appears in court at the designated time. The JPATS centralized scheduling function is located in Kansas City MO. Air fleet operations are located in Oklahoma City (OKC), OK with an additional hub in: Las Vegas, NV. JPATS Dispatch, located in OKC, creates and publishes flight packets to the Federal Aviation Administration (FAA) and JPATS pilots providing details of stateside and international flights.

Transportation and custody exchange of prisoners may be required for only a few prisoners at a given stop to over 300 prisoners being exchanged at large airport and ground transportation hubs. At airports custody exchanges occur all year around and are almost always outdoors at various times of day with variant levels of available light. Custody exchanges take place in all types of whether, hot, cold, sunshine, rain and/or snow. The speed of prisoner exchange is critical to timely and successful missions and to remain cost effective.

1.1 Current and Future Mobile Technology

Currently, JPATS employs a native iOS application (app) on USMS mobile devices to assist operational personnel, Aviation Enforcement Officers (AEOs) and Medics with prisoner movement. The JPATS Management Information System (JMIS) Mobile iOS Application is an iOS native application running on USMS government furnished mobile devices and packaged with configuration policy settings consistent to meet federal cyber security compliance. The app connects to JMIS servers and downloads the flight/trip schedule, prisoner manifest, prisoner photo and information, and highlights significant medical, security/intelligence information, as well as provides the ability to add mission comments, incidents and record mission times. The JMIS Mobile iOS Application caches the information providing an offline copy for use by the AEO and Medical personnel. Additionally, the mobile app provides the AEO-in-Charge (AEOIC) the ability to disseminate an operations log of the daily activities to individuals, teams and the central operations systems.

In the near future, prisoner transports will have access to prisoner biographic, security and medical data as well as their photo in advance of prisoner movement through web-based and mobile apps. Presently each prisoner requires a packet of paperwork during transport and exchange of custody. JPATS is in the process of deploying the Movement Packet (MPAC) application which will automate an electronic travel packet for prisoner movement operations replacing physical paperwork with digital documentation. The current MPAC application is web-based for use within law enforcement offices and jail facilities. A mobile app that parallels the JMIS Mobile iOS application is being developed for BOP. The MPAC mobile app is expected to be an Android native app that will run on BOP government purchased and issued mobile devices. Additionally, both the USMS and BOP mobile apps will provide capabilities to retrieve and display MPAC digital documentation from the same central source systems and services.

2.0 Purpose

The basis for this RFI is to request information related to the addition of biometric verification capabilities to the JMIS Mobile iOS App and the MPAC Mobile Android App. JPATS is seeking a Software Development Kit (SDK) to be used by in-house development staff to add the biometric verification component within our current and future custom native apps.

The biometric verification capabilities should allow expedited identification of prisoners with automatic dynamic display of their associated prisoner information throughout the custody exchange process. The solution should match associated system information and display prisoner identification data for the mobile device user with a response time of less than one second for delivery to the mobile device after the request is initiated. The user must be able to verify successful verification of the prisoner on the mobile device screen and be able to immediately proceed to identify the next prisoner in a fully automated multi-transactional session and preferably without a user initiated manual trigger event. It is estimated that when fully implemented there will be approximately 1,000 mobile devices that will have this application installed and can perform dynamic and concurrent biometric verification during the prisoner transportation multi-process custody exchange.

JPATS is seeking information from industry on options that will allow the organization to identify and assess technologies, applications, software development kits (SDKs) and/or systems that leverage biometric recognition as a means to perform touchless prisoner biometric verification from a distance during the transportation process. The product(s)/solution should be comprehensive and capable of being developed and integrated for both Android and iOS mobile device applications. The solution should support a common operating picture (COP) for central operations visibility and awareness. The solution should have the ability to continue to function offline as connection services are disrupted during the custody exchange process.

The product(s)/solution must provide a customizable development framework that enables an on device biometric recognition matching capability from a collection of preprocessed downloaded library of front facing prisoner identification booking photos. In some cases there may be several photos for each prisoner which should be used for matching. The product(s)/solution should be capable of using the onboard mobile device camera to detect and capture a photo of a prisoner being transported and provide a local match on the mobile device in less than one second from the pre-processed library. The mobile application matched result shall then be able to retrieve locally stored identity, profile and record information on the matched prisoner in a single response summary view. “Matching thresholds” should be configurable as well as provide user with a result that can return multiple photo matching options when thresholds are not met. The matching thresholds should maintain an error rate lower than 85% during the custody exchange process.

Biometric verification will only be used for retrieving the photo and biographic data for the known set of prisoners in the prisoner transportation network pipeline. The AEO and other operational staff will perform final face-to-face identification by reviewing displayed data and photo. On average the prisoner transportation network has 7,000 prisoners in its pipeline to move at any given time. It has not been determined whether all preprocessed photos will be downloaded to the mobile device or just the set of prisoners known to be on the current mission/trip.

Information provided by responsive industry experts and offerors will be used to further develop the JPATS’ specifications for any potential proof-of-concept, pilot, or solution solicitation materials. The specific questions outlined below should be answered by vendors, including describing:

a. Required software, application, mobile application program interface (API) and/or web user interface(s) needed for functionality including details on any browser limitations, or required service dependencies, and

b. Technical policy settings for the configuration specifications necessary for the function of the capabilities and to support the solution proposed, and

c. Centralized services, software, or equipment needed for the mobile functionality including specification if infrastructure requirements exist, and

d. Connection requirements at the local, global and ecosystem levels, and

e. Power requirements, including impact to the mobile device, and

f. How the proposed solution meets federal regulatory and legal compliance with notation for any element of the proposed solution that cannot fully meet compliance.

A response that simply states that the proposed solution is compatible with the specified requirement(s), where a narrative response is required, will be considered non-responsive for that question.

3.0 Requirements

The system should address the following requirements (please describe how your solution meets the requirement in a federally compliant and efficient approach): The solution must meet established Defense Information Systems Agency (DISA), DHS, DOJ, CJIS, and USMS security and operating requirements, and must operate and be compatible with Android and iOS devices and applications. The solution must be capable of undergoing routine penetration and vulnerability scanning assessments. Provide details of the technical specification and applicable federal and legal standards for which the solution complies. Provide information on third party or independent evaluations including who performed the assessment and what was assessed? Is this assessment available to USMS? And from whom does the request for the assessment need to be addressed? The solution must be able to undergo operational upgrades, patching, incorporate capability updates, and integrate maintenance to meet the minimum security and vulnerability assessment(s) requirements. Please provide information on the solutions operational upgrade approach where monthly patching, major release updates occur routinely, and vulnerability management is the organizational standard? The solution must include the ability to create a biometric signature on a mobile or back-end centralized system using prisoner photos from source systems that can be used to accurately detect, and verify prisoner identity on mobile devices. The biometric signature must allow for audit and log event reporting. The solution should have the ability to download biometric signatures while connected, but process prisoner identification without Wi-Fi or cellular connectivity or access. The solution must be able to utilize multiple photo biometric signatures of a prisoner to match/identify each prisoner with reasonable accuracy and consistently during the custody exchange process.

3.1 The solution should be able to integrate with onboard cameras, voice/audio functions, video/photo functions and location awareness functions on the mobile devices.

3.2 The solution should be able to accurately perform biometric identification from a variety of angles, facial expressions, and postures.

3.3 The solution must have the ability to accurately perform biometric identification in a variety of light levels, in outdoor climates and weather at varied distance intervals and angles.

3.4 The solution must comply with the current version of the FBI CJIS Security Policy, DOJ IT Security Standards and PGD15-03, security requirements found in the Federal Information Security Management Act of 2014 (“FISMA”), Federal Risk and Authorization Management Program (“FedRAMP”) requirements, use TAA compliant elements with Supply chain risk management controls, use FBI’s Certified Product List or able to be certified and added in a timely period.

The solution shall have the capability to protect data at rest and data in motion with Device/Hard Drive encryption at rest where data in motion controls must follow the Federal Information Processing Standard Publication 140-2 9FIPS PUB 140-2), comply with Personally Identifiable Information (or PII) requirements related to a covered system accessing, collecting, storing, processing, maintaining, using, sharing, retrieving, disseminating, transmitting, or disposing of (hereinafter collectively, “processing, storing, or transmitting”) Information, shall be capable of IPV6 and IPV4 network address interconnection functionality support. Any proposed solution using wireless, Bluetooth or mobile technology connections shall meet NIST SP 800-124 Guidelines for Managing the Security of Mobile Devices in the Enterprise, June 2013; NIST SP 800-121 Rev 2 with updates, May 2017, Guide to Bluetooth Security, The solution must provide or be compliant with Multifactor authentication and certificate based authentication methods for access and connections. JPATS is only interested in solutions that satisfy the above requirements and are readily available as a Commercial Off-The-Shelf (COTS) solution. JPATS does not fund technology research and development.

4.0 Questions

Please provide narrative responses to the questions below:

4.1 Has your company provided a similar biometric solution to a federal, state or local agency? And/or provided the technical and operational administration support for a federal, state or local agency service?

4.1.1 Describe the agency, function and scope of solution and use.

4.1.2 Provide references or operational use cases of proven functionality in a production environment.

4.2 Has your company provided a solution in a transportation, logistical, and/or law enforcement environment?

4.2.1 Describe the organizational environment and scope of deployments related to that type of organizational functionality.

4.2.2 Provide references or operational use cases of proven functionality in a production environment.

4.3 If your solution experience is not within transportation or law enforcement, describe the prior experience or scope of services including the environment and geographic deployment (e.g. corporations, hospitals, events, etc.) functionality.

4.4 Describe the components contained within the SDK to include: software, APIs, licenses, toolsets, source libraries and any other integrated technology/software.

4.5 Describe SDK mobile device requirements, minimum source file resolution required to generate biometric verification files, and operating systems and mobile hardware requirements.

4.6 Can the SDK be upgraded as technologies change or evolve?

4.6.1 How long does it take to upgrade the system?

4.6.2 What steps are required to upgrade a system?

4.7 What are the performance specifications and projections?

4.7.1 i.e. yaw, roll, and pitch, conformance with ISO/IEC 19794-5, Biometric data interchange formats - Part 5: Face image data. ANSI/NIST-ITL 1-2011: Update 2015 and Mobile ID Best Practice Recommendations v2.1, image capture requirements.

4.7.2 How are the results derived (actually measured or assumed)? Are there dependencies to achieve those results and if so please specify?

4.7.3 What organization independently validated the specifications?

4.8 What is the solution's minimum and maximum detection distance for modal recognition?

4.9 Describe how the solution compensates for external factors and if distance is a factor in the validity of the results please specify the parameters:

4.9.1 Sunlight and artificial light

4.9.2 Weather

4.9.3 Shadows

4.9.4 Facial hair, tattoos, piercings, etc.

4.9.5 Facial expressions and angles

4.10 Is the product/solution currently commercially available?

4.10.1 If not, when will your product/solution be available for acquisition (COTS)?

4.11 What is the SDK’s estimated initial purchase cost, cost of installation, cost of upgrades, costs of operations, maintenance, and warranties to deploy to use the biometric verficiation solution enterprise-wide on mobile devices based on the background provided in this RFI?

4.12 What training and familiarization is required to configure, integrate and operate the solution?

4.13 Are there any support services, renewable licenses, or maintenance/warranty requirements once the service is deployed?

4.13.1 What are the hours of support availability?

4.13.2 How is support provided (telephonic, web based, in-person, remote access, etc.) and are there any limitations related to the support?

While a complete system that provides all of these capabilities is desirable, JPATS may consider solutions that can deliver partial capabilities or subsystem(s) that provide one or a few of the capabilities. All Offerors and industry subject matter experts with applicable technology (either a completely or partially compliant solution) option are invited to submit a response with detailed specifications. Please include equipment specification sheets and product literature in the responsive materials as applicable.

JPATS may schedule an onsite, follow-up demonstration at their Kansas City and/or Oklahoma City locations and/or a field site of select systems options, so that more detailed information and display system/solution functionality might be assessed.

image1.gif