SOW- Specialized OSINT Tools IDIQ.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

STATEMENT OF WORK

Open-Source

Specialized Tools IDIQ

Federal Bureau of Investigation (FBI)

Statement of Work (SOW)

SPECIALIZED OSINT TOOLS IDIQ

For the Directorate of Intelligence

March 25, 2026

Specialized OSINT Tools IDIQ

Contents

1. Scope

2. Introduction

2.1 Services/CLINs Requested

2.2 CLINs

3. Requirements

3.1 CLIN 1: Financial/Banking Information

3.2 CLIN 2: Deep/Dark Web

3.3 CLIN 3: US Business Data

3.4 CLIN 4: International Business Data

3.5 CLIN 5: Vehicle history and technical information

3.6 CLIN 6: Historical internet data

3.7 CLIN 7: Terrorism related information

3.8 CLIN 8: Image Information

3.9 CLIN 9: Video information

3.10 CLIN 10: Identity Records

3.11 CLIN 11: Property and land records

3.12 Licensing, Definitions, and Exclusions

3.12.1 Licensing:

3.12.1.1 Base Pricing (Evaluated)

3.12.1.2 Tiered Pricing (For Future Orders)

3.12.2 Definitions and Exclusions

3.12.2.1 PAI and CAI:

3.13.2.2 Exclusions:

4. Key Personnel

5. Place of Performance

6. Deliverables

6.1 Monthly Report:

6.2 Training Aids and Materials:

6.3 Attending Status Meetings:

7. Government Furnished Equipment or Information

8. Personnel Availability

9. Security Requirements

10. Government Representatives

10.1 Contracting Officer Representative

10.2 Contracting Officer

11. Travel and Other Direct Costs

12. On and Off Ramp

1. Scope

This is a contract to provide an Indefinite Delivery Indefinite Quantity (IDIQ) contract for Open-

Source Intelligence (OSINT) tools of various specific types and categories to the Federal Bureau of Investigation (FBI) Directorate of Intelligence (DI). This is a non-personnel services contract.

All tools provided under this IDIQ must be a Software as a Service (SaaS) available through the internet.

This contract is managed by the FBI’s DI Social Media Program (SOMEP). The SOMEP is housed in the Intelligence Technology Section (ITS) and provides enterprise tools for users across the FBI to use for Social Media and Publicly Available Information (PAI) data to be used in investigations. All Headquarters Divisions and every Field Office require multiple specialized tools in order to find critical details and in-depth data relating to investigative topics, persons, activities, and documentation. This contract is to provide tools that are Specialized, focused, unique, niche, hereinafter referred to as specialized, and allow in-depth views into the types of data that are being sought.

2. Introduction

The FBI’s Social Media Program provides tools and training to assist Headquarters Divisions and Field Offices in conducting lawful research and searches against Commercially Available

Data (CAI) and Publicly Available Information, which entail Social Media data that is publicly available. The DI SOMEP also ensures users complete privacy and civil liberties legal training to perform open-source searches in accordance with applicable federal laws, regulations, and policy.

The growing use of the internet has created significant opportunities for people to create, share, and exchange information, but also opportunities for threat actors to engage in a variety of criminal activities. As access to virtual mediums is increasing and diversifying, terrorists, violent extremists, malicious cyber actors, and foreign adversaries take advantage by having greater opportunities to make criminal threats, traffic individuals and drugs, commit fraud, and execute cyberattacks. Estimates show that approximately 5.24 billion people worldwide use social media in some fashion, which is 64% of the total population. Identifying threat-related data relevant to an authorized law enforcement purpose can be challenging. However, efficiently identifying, organizing, and analyzing lawfully collected PAI and CAI data is paramount to preventing, investigating, and defeating threats to our nation and American interests abroad. Tools that capture such relevant information are important in helping the FBI solve the complexities of this multifaceted problem.

In order to evaluate and stay informed of threats to personal safety, property, and law enforcement, and to conduct on-line research for important investigations, the FBI requires professional service Contractors with expertise in open-source intelligence software, to include

PAI and CAI platform offerings.

The FBI has a crucial need for accessible data sources and deep-dive capabilities to provide a diverse and reliable range of collections across internet-based platforms. The ability to segment and customize data collection capabilities is important for tools to align with authorized law-enforcement usage. There are specialized tools that focus on specific areas of the internet and provide in-depth data discovery and specialized coverage of the topics they provide. More detailed requirements for such specialized tools are found below. In all cases, the FBI is seeking new and cutting-edge capabilities in these systems.

2.1 Services/CLINs Requested

This acquisition strategy is a multi-award IDIQ to allow for various options for Specialized Open

Source Intelligence Tools, to serve multiple investigative threat types and use cases, and to meet the needs of a diverse user base in accordance with law, regulation, and policy. The FBI intends to develop a storefront of approved specialized tools by leveraging the Indefinite Delivery

Indefinite Quantity type of contract vehicle containing resources that align with the needs, requirements, and specifications of the FBI.

2.2 CLINs

The different tasks under this IDIQ will be organized by Contract Line Item Numbers (CLINs).

Each CLIN will be focused on a type of tool that provides Open-Source information and the ability to collect, capture, process, analyze, and collate that information. The CLINs will be described in detail below:

1. Financial/banking information

2. Deep and Dark Web

3. US business information

4. International business information

5. Vehicle history and technical information

6. Historical internet data

7. Terrorism related information

8. Image information

9. Video information

10. Identity records

11. Property and land records

The Contractor offering a Specialized Tool must state which CLIN(S) above they believe their tool fits into. The Government will choose a maximum of two (2) tools for each of the above

CLINs to populate the IDIQ and meet the operational needs of the FBI.

Once brought on to the IDIQ vehicle, the FBI will put out task orders against the CLINs when

FBI entities wish to receive the services of that CLIN. If there is only 1 Contractor that has been placed on a CLIN, the Contractor must still review the task and ensure they can meet the requirements being requested.

3. Requirements

Requirements must be listed individually for each of the 11 categories listed above, each one representing a CLIN on the IDIQ contract. Many requirements are similar across the CLINs, but some have been tailored to the type of tool requested in each CLIN. See below for more details.

Note: Awarded Companies will be selected for each CLIN and task orders will be competed and awarded within each CLIN.

3.1 CLIN 1: Financial/Banking Information

The tool providing Financial Information must meet all of the following Required criteria, and when possible, must meet any of the Preferred requirements also listed. The Contractor must state which Preferred requirements they meet.

Required Criteria for Financial/Banking Information CLIN:

In accordance with all legal requirements, the Contractor tool must have the ability to rapidly extract, verify, analyze, and visualize financial and banking data. The Contractor tool must provide a financial intelligence framework of capabilities to detect, identify and analyze fraud, money laundering, and illicit finance information, networks, and records.

System/Company Requirements:

Analytics: Contractor must provide the ability to perform analysis of transactional data and financial networks to identify high-risk transactions, detect money laundering, detect fraudulent activities, and conduct anti-money laundering analysis and fraud correlations. The Contractor tool must provide comprehensive data analysis to detect criminal activity through the identification of financial and entity connections, patterns, and anomalies.

Contractor must provide the ability to view people and entity data source(s) and data point connections with the ability to pivot and explore data sources and network node connections.

Examples of data sources and data points include, but are not limited to people, entit ies, friends, associates, and aliases. System must provide the ability to link entities across various platforms, and the ability to view networks in analytical charts and graphs.

Critical and popular data sources: The Contractor must provide rich, global, and multi-language publicly and/or commercially available information (PAI, CAI), including important and well-known internet, regulatory, commercial, and Peer-to-Peer financial network data sources for users to search and pull data from.

The Contractor must be engaged in constant reviewing, updating, and adding to the available data sources. Data sources must provide full detail content where at all possible.

Proper Company Type: The Contractor must be a U.S.-based company or a U.S.-based subsidiary, and must qualify as a small business under the applicable NAICS code.

User-Friendly GUI: The Contractor must provide a coherent, organized, and intuitive Graphic User Interface (GUI) that is easily navigated by non-technical users. The GUI must not be cluttered or confusing and must be able to be understood without needing extensive training.

Searches must be easily configured and launched, and the GUI must allow users to populate and analyze search results without assistance.

Software as a Service (SaaS): The Contractor must provide Software as a Service (SaaS) for FBI users to log into a Contractor website to access the Open Source tool. No software shall be downloaded, installed, or integrated into FBI computers. The Contractor's system must provide capability to access and use the system from various commercial web-browsers, specifically Chrome and Edge, among others.

System Security: The Contractor must ensure their website and system maintain a robust security posture to safeguard usernames, passwords, and FBI usage and search terms. The Contractor must provide the FBI with information in the original proposal regarding the security posture of their system, such as being FedRAMP certified (moderate impact level), 256-bit encryption, and other stringent security measures that are taken to safeguard the user data in the system. The Contractor selected for the contract must provide this same information once a year to the

Government. The Contractor must also inform the FBI in the proposal and yearly how they save/archive FBI user information. No FBI user information must be sold to any third party at any time.

Furthermore, no public release of information regarding this contract with the FBI must be made without the prior written consent of the FBI Office of Public Affairs and the CO. The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications. These obligations do not cease upon completion of the contract.

508 Compliance: The Contractor must ensure their system is 508 Compliant, or working towards

508 Compliance, including acceptable color-blind accommodations. The Contractor must provide a 508 compliance scorecard yearly, showing progress in making their system 508

Compliant. If providing hosting services for electronic content provided by the FBI, the contractor must not implement the hosting service in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 Standards (36 C.F.R. Part

1194). Throughout the life of the contract the agency reserves the right to perform testing on a

Contractor or Contractor’s hosted solution to verify conformance with this requirement.

Exporting data: The Contractor must provide data export capability in structured and text-based data formats, to include .xlsx, .pdf, .json, .txt, etc.

Statistics/Metrics: The Contractor must provide tracking, auditing, and statistics on tool usage by FBI personnel, upon request. Basic statistics required must include total number of accounts, number of searches monthly, number of persistent and ad hoc searches. Also reports must include duration of use, last login of users. Usage reports for these statistics must be provided in the Monthly Report in .csv or .xlsx format.

System Reliability: The Contractor must ensure their system is available 24/7 for use by the FBI.

The Contractor must provide notice of planned upgrades and modifications to the system. This notification must be provided 30 days prior to implementation for the FBI to review the changes and ensure that all legal constraints and ease-of-use requirements will be met by the changes.

The FBI will not bear the cost for any testing of new or existing products and/or solutions.

Contractors must indicate whether the FBI will be invited to participate in any beta testing of new solutions that may be of benefit to the organization. The invitation must be provided through the FBI Contracting Officer’s Representative (COR).

Emergency or critical system upgrades or modifications must be communicated within 5 business days of implementation. The Contractor must be ready to modify, within reason, their system for legal reasons if required, for instance, for Privacy and Civil Liberties purposes.

Artificial Intelligence (AI) Description and Compliance: The Contractor must provide reports and details of all AI functionality in their system upon request. The Contractor must share with the Government details of how their AI is trained and how bias is managed. If new AI is introduced, the Contractor must inform the Government before adding that capability.

Helpdesk: The Contractor must provide a POC or helpdesk to answer system related questions and troubleshoot issues. This POC or helpdesk must be available 24/7. The helpdesk must be able to respond to customers’ calls or emails within five (5) minutes.

Accounts: The Contractor must provide unique accounts and usernames for each user that doesn’t reveal the user’s identity or affiliation. The Contractor must conduct user account management and maintenance, to include deleting and /or archiving unnecessary accounts as requested by the FBI. These accounts must not reveal the user’s identity or affiliation. New account requests shall be created within 1 business day of the Contractor receiving the account request notification.

Training on the System: Users must be given access to training and training material for tool usage. The Contractor must provide live virtual training in addition to self-paced on-demand training modules that users can access from any location. Closed captioning must be available on all training videos to ensure access to hearing impaired personnel. Training must be available to accommodate various time zones. Contractor must have training ready to deliver upon contract execution. The Contractor must provide examples of the training materials to the Government before training begins for users, to include screen shots of the virtual training as well as the self -paced modules. Whenever a new release is developed, contractor must provide training material beforehand to present the new capabilities or fixes.

Anonymity of Searches: All searches within the Contractor tool must ensure anonymity for FBI personnel within the system. The Contractor must provide protections so that data sources do not receive detailed information regarding FBI searches.

Ad Hoc Searches: The Contractor system must provide the user the ability to enter search criteria and conduct ad hoc searches. Search capabilities must be robust to include, but not limited to common terms, names, phrases, and identifiers. The system must provide sorting and filtering capabilities of data. The system must provide timestamps and original URL or data source information.

PREFERRED REQUIREMENTS

The Contractor must state which of the following Preferred Criteria their tool can provide.

In-system Tracking and Collaboration: The Contractor must provide robust collaboration capabilities within the system. Examples of collaboration features include but are not limited to sharing data streams and filters with other users, ability to flag, tag, color-code, comment, and annotate data returns.

Artificial Intelligence (AI) Capabilities: The Contractor must provide artificial intelligence-based analytics to include, natural language processing (NLP) and/or machine learning (ML) analytic capabilities. Useful AI features include, but are not limited to, Sentiment Analysis capabilities

(e.g., violence indicator, emotion analysis), event timelines and event tracking.

Foreign Language Translation: The Contractor must have embedded translation capabilities for large and common languages and the ability to perform automated translation of text. The translation capability must provide embedded translation (i.e., translation must be performed within the tool and must not be sent externally to process via an open-source capability, such as Google Translate).

3.2 CLIN 2: Deep/Dark Web

The tool providing Deep/Dark Web Information must meet all of the following Required criteria, and when possible, must meet any of the Preferred requirements also listed. The Contractor must state which Preferred requirements they meet.

Required Criteria for Deep/Dark Web CLIN:

In accordance with all legal requirements, the Contractor must provide Deep/Dark Web publicly and/or commercially available information (PAI, CAI), data and network information such as

TOR, I2P, FreeNet, ZeroNet, Hyphanet, data breach sites, leaked data sites, and other fringe, hard target, or non-standard internet sites. The Contractor must provide the ability to browse, collect, and analyze data from high-risk web, deep web, darknet, and darknet adjacent sites.

System/Company Requirements:

Analytics: Contractor must provide the ability to view people and entity data source(s) and data point connections with the ability to pivot and explore data sources and network node connections. Examples of data sources and data points include, but are not limited to social media accounts, people, entities, friends, associates, aliases, usernames, avatars, PGP keys, cryptocurrency wallets, and various other identifiers. System must provide the ability to identify and track digital fingerprints and virtual breadcrumbs, link entities across various platforms and networks, and the ability to view networks in analytical charts and graphs.

Contractor tool must provide the ability to de-anonymize criminal actors through criminal actor monikers and the ability to search and compile evidence about persons, victims, and subjects of interest to include usernames, aliases, network information and internet activity. Contractor must provide the capability to conduct cross-platform link analysis between various social networks to identify relationships between entities and correlate an entity’s engagement across platforms and or networks.

Critical and popular on-line data sources: The Contractor must provide rich, global, and multi-language publicly and/or commercially available information (PAI, CAI) from high-risk web, deep web, darknet, and darknet adjacent sites, for users to search and pull data from.

The Contractor must be engaged in constant reviewing, updating, and adding to the available data sources to include obscure darknet and darknet adjacent sites. Data sources must provide full content where at all possible, along with entity and or usernames and other ancillary data about the entity, user, and network.

Proper Company Type: The Contractor must be a U.S.-based company or a U.S.-based subsidiary, and must qualify as a small business under the applicable NAICS code.

User-Friendly GUI: The Contractor must provide a coherent, organized, and intuitive Graphic

User Interface (GUI) that is easily navigated by non-technical users. The GUI must not be cluttered or confusing and must be able to be understood without needing extensive training.

Searches must be easily configured and launched, and the GUI must allow users to populate and analyze search results without assistance.

Software as a Service (SaaS): The Contractor must provide Software as a Service (SaaS), for FBI users to log into a Contractor website to access the Open Source tool. No software must be downloaded, installed, or integrated into FBI computers. The Contractor's system must provide capability to access and use the system from various commercial web-browsers, specifically Chrome and Edge, among others.

System Security: The Contractor must ensure their website and system maintain a robust security posture to safeguard usernames, passwords, and FBI usage and search terms. The Contractor must provide the FBI with information in the original proposal regarding the security posture of their system, such as being FedRAMP certified (moderate impact level), 256-bit encryption, and other stringent security measures that are taken to safeguard the user data in the system. A Contractor selected for the contract must provide this same information once a year to the

Government. The Contractor must also inform the FBI in the proposal and yearly how they save/archive FBI user information. No FBI user information must be sold to any third party at any time.

Furthermore, no public release of information regarding this contract with the FBI must be made without the prior written consent of the FBI Office of Public Affairs and the CO. The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications. These obligations do not cease upon completion of the contract.

508 Compliance: The Contractor must ensure their system is 508 Compliant, or working towards 508 Compliance, including acceptable color-blind accommodations. The Contractor must provide a 508 compliance scorecard yearly, showing progress in making their system 508 Compliant. If providing hosting services for electronic content provided by the FBI, the contractor must not implement the hosting service in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 Standards (36 C.F.R. Part 1194). Throughout the life of the contract the agency reserves the right to perform testing on a

Contractor or Contractor’s hosted solution to verify conformance with this requirement.

Exporting data: The Contractor must provide data export capability in structured and text-based data formats, to include .xlsx, .pdf, .json, .txt, etc.

Statistics/Metrics: The Contractor must provide tracking, auditing, and statistics on tool usage by

FBI personnel, upon request. Basic statistics required must include total number of accounts, number of searches monthly, number of persistent and ad hoc searches. Also reports must include duration of use, last login of users. Usage reports for these statistics must be provided in the Monthly Report in .csv or .xlsx format.

System Reliability: The Contractor must ensure their system is available 24/7 for use by the FBI.

The Contractor must provide notice of planned upgrades and modifications to the system. This notification must be provided 30 days prior to implementation for the FBI to review the changes and ensure that all legal constraints and ease-of-use requirements will be met by the changes.

The FBI will not bear the cost for any testing of new or existing products and/or solutions.

Contractors must indicate whether the FBI will be invited to participate in any beta testing of new solutions that may be of benefit to the organization. The invitation must be provided through the FBI Contracting Officer’s Representative (COR).

Emergency or critical system upgrades or modifications must be communicated within 5 business days of implementation. The Contractor must be ready to modify, within reason, their system for legal reasons if required, for instance, for Privacy and Civil Liberties purposes.

Artificial Intelligence (AI) Description and Compliance: The Contractor must provide reports and details of all AI functionality in their system upon request. The Contractor must share with the Government details of how their AI is trained and how bias is managed. If new AI is introduced, the Contractor must inform the Government before adding that capability.

Helpdesk: The Contractor must provide a POC or helpdesk to answer system related questions and troubleshoot issues. This POC or helpdesk must be available 24/7. The helpdesk must be able to respond to customers’ calls or emails within five (5) minutes.

Accounts: The Contractor must provide unique accounts and usernames for each user that doesn’t reveal the user’s identity or affiliation. The Contractor must conduct user account management and maintenance, to include deleting and /or archiving unnecessary accounts as requested by the FBI. These accounts must not reveal the user’s identity or affiliation. New account requests shall be created within 1 business day of the Contractor receiving the account request notification.

Training on the System: Users must have access to training and training material for tool usage.

The Contractor must provide live virtual training in addition to self-paced on-demand training modules that users can access from any location. Closed captioning must be available on all training videos to ensure access to hearing impaired personnel. Training must be available to accommodate various time zones. Contractor must have training ready to deliver upon contract execution. The Contractor must provide examples of the training materials to the Government before training begins for users, to include screen shots of the virtual training as well as the self -paced modules. Whenever a new release is developed, contractor must provide training material beforehand to present the new capabilities or fixes.

Anonymity of Searches: All searches within the Contractor tool must ensure anonymity for FBI personnel within the system. The Contractor must provide protections so that data sources do not receive detailed information regarding FBI searches.

Ad Hoc Searches: The Contractor system must provide the user the ability to enter search criteria and conduct ad hoc searches. Search capabilities must be robust to include, but not limited to common terms, names, phrases, and identifiers. The system must provide sorting and filtering capabilities of data. The system must provide timestamps and original URL or data source information.

Safe Browsing: The Contractor tool must provide the ability to browse external websites and capture open-source information from within the Contractor's platform or through a VPN connection or other means to provide anonymity and security. The Contractor tool must not expose users of the system to malware and must prohibit identification by targets through the use of a browser-based single session virtual machine or similar anonymization technique. This allows investigators and analysts to anonymously access information from TOR, I2P, and

Hyphanet sites where they can visit dark web marketplaces or collect content for operational and evidentiary purposes. The Contractor tool must provide the ability to safely navigate data with the option to blur or omit or not present harmful or illegal images from the dark web.

Foreign Language Translation: The Contractor must have embedded translation capabilities for large and common languages and the ability to perform automated translation of text. The translation capability must provide embedded translation (i.e., translation must be performed within the tool and must not be sent externally to process via an open-source capability, such as Google Translate).

PREFERRED REQUIREMENTS:

The Contractor must state which of the following Preferred Criteria their tool can provide.

In-system Tracking and Collaboration: The Contractor must provide robust collaboration capabilities within the system. Examples of collaboration features include but are not limited to sharing data streams and filters with other users, ability to flag, tag, color-code, comment, and annotate data returns.

Artificial Intelligence (AI) Capabilities: The Contractor must provide artificial intelligence-based analytics to include, natural language processing (NLP) and/or machine learning (ML) analytic capabilities. Useful AI features include, but are not limited to, Sentiment Analysis capabilities (e.g., violence indicator, emotion analysis), event timelines and event tracking.

Geospatial capabilities: The Contractor must provide the ability to search data by city, county, state, region, country, and user defined geo-fencing capabilities. This capability must include map visualizations.

Geo-Inference: The Contractor must provide capabilities of geo-locating posts and returns when the data allows, such as pulling geographic references from posts, analyzing images for location information, pulling IP addresses and other metadata that might indicate geolocation, etc.

Image Capture: The Contractor must provide image search and review capabilities. The Contractor must provide image search capabilities that include reverse image search, Optical

Character Recognition (OCR) of text (in large and common languages) in images, and object identification. The Contractor must provide verification of image authenticity.

Voice to Text: The Contractor must provide automated audio transcription capabilities and a platform to process audio data at scale, to include automated translation of large and common languages.

Video Capture: The Contractor must provide video reviewing capabilities. The Contractor must provide ability to analyze video. The Contractor must provide video search abilities. The

Contractor must provide video analysis to include Optical Character Recognition (OCR) of text (in large and common languages) in video. The Contractor must provide video authenticity verification. The Contractor must provide automated and multi-lingual video transcription capabilities.

Historical Information: The Contractor must provide historical data source capabilities to include historical darknet archives.

3.3 CLIN 3: US Business Data

The tool providing US Business Data Information must meet all of the following Required criteria, and when possible, must meet any of the Preferred requirements also listed. The

Contractor must state which Preferred requirements they meet.

Required Criteria for US Business Data CLIN: In accordance with all legal requirements, the Contractor must provide US business data and records to included company ownership, company firmographics, corporate hierarchy and linkage, company financials, principals and contacts, public filings, and sanctions. The Contractor must also provide data and records for supply chain entity linkage and intermodal and multimodal transport.

System/Company Requirements:

Analytics: The Contractor must provide the ability to view business, people, and entity data source(s) and data point connections with the ability to pivot and explore data sources and network node connections. Examples of data sources and data points include, but are not limited to businesses, people, entities, associates, and aliases. System must provide the ability to link entities across various platforms and networks, and the ability to view networks in analytical charts and graphs.

The Contractor must provide a robust ability to identify and analyze private and public business firmographics, business hierarchy and linkages, business relationships, brand relationships, investments, and financials. The Contractor must provide the ability to identify business principals and contacts. The Contractor must provide data about public filings such as registrations, suits, liens, bankruptcies and other filings. The Contractor must provide the ability to conduct analysis of these data points and data sets to detect and identify shell networks, money laundering, illicit transactions, and to identify hidden connections between entities and transactions.

Critical and popular on-line data sources: The Contractor must provide rich, global, and multi-language publicly and/or commercially available information (PAI, CAI), including important and well-known internet data sources for users to search and pull data from.

The Contractor must provide, at a minimum, business data in the following areas: Business-to-

Business (B2B), Business-to-Consumer (B2C), Consumer-to-Consumer (C2C), Consumer-to- Business (C2B), Direct-to-Consumer (D2C/DTC), Business-to-Business-to-Consumer (B2B2C), Small Business Financial Exchange data, government filings, public filings, and industry databases.

The Contractor must be engaged in constant reviewing, updating, and adding to the available data sources. Data sources must provide full content where at all possible.

Proper Company Type: The Contractor must be a U.S.-based company or a U.S.-based subsidiary, and must qualify as a small business under the applicable NAICS code.

User-Friendly GUI: The Contractor must provide a coherent, organized, and intuitive Graphic User Interface (GUI) that is easily navigated by non-technical users. The GUI must not be cluttered or confusing and must be able to be understood without needing extensive training.

Searches must be easily configured and launched, and the GUI must allow users to populate and analyze search results without assistance.

Software as a Service (SaaS): The Contractor must provide Software as a Service (SaaS), for FBI users to log into a Contractor website to access the Open Source tool. No software must be downloaded, installed, or integrated into FBI computers. The Contractor's system must provide capability to access and use the system from various commercial web-browsers, specifically Chrome and Edge, among others.

System Security: The Contractor must ensure their website and system maintain a robust security posture to safeguard usernames, passwords, and FBI usage and search terms. The Contractor must provide the FBI with information in the original proposal regarding the security posture of their system, such as being FedRAMP certified (moderate impact level), 256-bit encryption, and other stringent security measures that are taken to safeguard the user data in the system. A Contractor selected for the contract must provide this same information once a year to the

Government. The Contractor must also inform the FBI in the proposal and yearly how they save/archive FBI user information. No FBI user information must be sold to any third party at any time.

Furthermore, no public release of information regarding this contract with the FBI must be made without the prior written consent of the FBI Office of Public Affairs and the CO. The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications. These obligations do not cease upon completion of the contract.

508 Compliance: The Contractor must ensure their system is 508 Compliant, or working towards 508 Compliance, including acceptable color-blind accommodations. The Contractor must provide a 508 compliance scorecard yearly, showing progress in making their system 508 Compliant. If providing hosting services for electronic content provided by the FBI, the contractor must not implement the hosting service in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 Standards (36 C.F.R. Part 1194). Throughout the life of the contract the agency reserves the right to perform testing on a

Contractor or Contractor’s hosted solution to verify conformance with this requirement.

Exporting data: The Contractor must provide data export capability in structured and text-based data formats, to include .xlsx, .pdf, .json, .txt, etc.

Statistics/Metrics: The Contractor must provide tracking, auditing, and statistics on tool usage by FBI personnel, upon request. Basic statistics required must include total number of accounts, number of searches monthly, number of persistent and ad hoc searches. Also reports must include duration of use, last login of users. Usage reports for these statistics must be provided in the Monthly Report in .csv or .xlsx format.

System Reliability: The Contractor must ensure their system is available 24/7 for use by the FBI.

The Contractor must provide notice of planned upgrades and modifications to the system. This notification must be provided 30 days prior to implementation for the FBI to review the changes and ensure that all legal constraints and ease-of-use requirements will be met by the changes.

The FBI will not bear the cost for any testing of new or existing products and/or solutions.

Contractors must indicate whether the FBI will be invited to participate in any beta testing of new solutions that may be of benefit to the organization. The invitation must be provided through the FBI Contracting Officer’s Representative (COR).

Emergency or critical system upgrades or modifications must be communicated within 5 business days of implementation. The Contractor must be ready to modify, within reason, their system for legal reasons if required, for instance, for Privacy and Civil Liberties purposes.

Artificial Intelligence (AI) Description and Compliance: The Contractor must provide reports and details of all AI functionality in their system upon request. The Contractor must share with the Government details of how their AI is trained and how bias is managed. If new AI is introduced, the Contractor must inform the Government before adding that capability.

Helpdesk: The Contractor must provide a POC or helpdesk to answer system related questions and troubleshoot issues. This POC or helpdesk must be available 24/7. The helpdesk must be able to respond to customers’ calls or emails within five (5) minutes.

Accounts: The Contractor must provide unique accounts and usernames for each user that doesn’t reveal the user’s identity or affiliation. The Contractor must conduct user account management and maintenance, to include deleting and /or archiving unnecessary accounts as requested by the FBI. These accounts must not reveal the user’s identity or affiliation. New account requests shall be created within 1 business day of the Contractor receiving the account request notification.

Training on the System: Users must have access to training and training material for tool usage.

The Contractor must provide live virtual training in addition to self-paced on-demand training modules that users can access from any location. Closed captioning must be available on all training videos to ensure access to hearing impaired personnel. Training must be available to accommodate various time zones. Contractor must have training ready to deliver upon contract execution. The Contractor must provide examples of the training materials to the Government before training begins for users, to include screen shots of the virtual training as well as the self -paced modules. Whenever a new release is developed, contractor must provide training material beforehand to present the new capabilities or fixes.

Anonymity of Searches: All searches within the Contractor tool must ensure anonymity for FBI personnel within the system. The Contractor must provide protections so that data sources do not receive detailed information regarding FBI searches.

Ad Hoc Searches: The Contractor system must provide the user the ability to enter search criteria and conduct ad hoc searches. Search capabilities must be robust to include, but not limited to common terms, names, phrases, and identifiers. The system must provide sorting and filtering capabilities of data. The system must provide timestamps and original URL or data source information.

PREFERRED REQUIREMENTS

The Contractor must state which of the following Preferred Criteria their tool can provide.

In-system Tracking and Collaboration: The Contractor must provide robust collaboration capabilities within the system. Examples of collaboration features include but are not limited to sharing data streams and filters with other users, ability to flag, tag, color-code, comment, and annotate data returns.

Artificial Intelligence (AI) Capabilities: The Contractor must provide artificial intelligence-based analytics to include, natural language processing (NLP) and/or machine learning (ML) analytic capabilities. Useful AI features include, but are not limited to, Sentiment Analysis capabilities

(e.g., violence indicator, emotion analysis), event timelines and event tracking.

Geospatial capabilities: The Contractor must provide the ability to search data by city, county, state, region, country, and user defined geo-fencing capabilities. This capability must include map visualizations.

Foreign Language Translation: The Contractor must have embedded translation capabilities for large and common languages and the ability to perform automated translation of text. The translation capability must provide embedded translation (i.e., translation must be performed within the tool and must not be sent externally to process via an open-source capability, such as Google Translate).

Geo-Inference: The Contractor must provide capabilities of geo-locating posts and returns when the data allows, including pulling geographic references from posts, analyzing images for location information, pulling IP addresses and other metadata that might indicate geolocation, etc.

Image Capture: The Contractor must provide image search and review capabilities. The Contractor must provide image search capabilities that include reverse image search, Optical

Character Recognition (OCR) of text (in large and common languages) in images, and object identification. The Contractor must provide verification of image authenticity.

3.4 CLIN 4: International Business Data

The tool providing International Business Data Information must meet all of the following Required criteria, and when possible, must meet any of the Preferred requirements also listed.

The Contractor must state which Preferred requirements they meet.

Required Criteria for International Business Data CLIN: In accordance with all legal requirements, the Contractor must provide International, global business data and records to included company ownership, company firmographics, corporate hierarchy and linkage, company financials, principals and contacts, public filings, and sanctions. The Contractor must also provide data and records for supply chain entity linkage and intermodal and multimodal transport.

System/Company Requirements:

Analytics: The Contractor must provide the ability to view business, people, and entity data source(s) and data point connections with the ability to pivot and explore data sources and network node connections. Examples of data sources and data points include, but are not limited to businesses, people, entities, associates, and aliases. System must provide the ability to link entities across various platforms and networks, and the ability to view networks in analytical charts and graphs.

The Contractor must provide a robust ability to identify and analyze private and public international business firmographics, business hierarchy and linkages, business relationships, brand relationships, investments, and financials. The Contractor must provide the ability to identify business principals and contacts. The Contractor must provide data about public filings such as registrations, suits, liens, bankruptcies and other filings. The Contractor must provide the ability to conduct analysis of these data points and data sets to detect and identify shell networks, money laundering, illicit transactions, and to identify hidden connections between entities and transactions.

language publicly and/or commercially available information (PAI, CAI), including important and well-known internet data sources for users to search and pull data from.

The Contractor must provide, at a minimum, international business data in the following areas:

Business-to-Business (B2B), Business-to-Consumer (B2C), Consumer-to-Consumer (C2C), Consumer-to-Business (C2B), Direct-to-Consumer (D2C/DTC), Business-to-Business-to-

Consumer (B2B2C), government filings, public filings, and industry databases. The Contractor must provide international records of hard to access data to include public records, corporate registries, foreign media, and others.

The Contractor must be engaged in constant reviewing, updating, and adding to the available data sources. Data sources must provide full content where at all possible.

Proper Company Type: The Contractor must be a U.S.-based company or a U.S.-based subsidiary, and must qualify as a small business under the applicable NAICS code.

User-Friendly GUI: The Contractor must provide a coherent, organized, and intuitive Graphic

User Interface (GUI) that is easily navigated by non-technical users. The GUI must not be cluttered or confusing and must be able to be understood without needing extensive training.

Searches must be easily configured and launched, and the GUI must allow users to populate and analyze search results without assistance.

Software as a Service (SaaS): The Contractor must provide Software as a Service (SaaS), for FBI users to log into a Contractor website to access the Open Source tool. No software must be downloaded, installed, or integrated into FBI computers. The Contractor's system must provide capability to access and use the system from various commercial web-browsers, specifically

Chrome and Edge, among others.

System Security: The Contractor must ensure their website and system maintain a robust security posture to safeguard usernames, passwords, and FBI usage and search terms. The

Contractor must provide the FBI with information in the original proposal regarding the security posture of their system, such as being FedRAMP certified (moderate impact level), 256-bit encryption, and other stringent security measures that are taken to safeguard the user data in the system. A Contractor selected for the contract must provide this same information once a year to the Government. The Contractor must also inform the FBI in the proposal and yearly how they save/archive FBI user information. No FBI user information must be sold to any third party at any time.

make every effort to review proposed publications in a timely manner to accommodate these and other publications. These obligations do not cease upon completion of the contract.

508 Compliance: The Contractor must ensure their system is 508 Compliant, or working towards 508 Compliance, including acceptable color-blind accommodations. The Contractor must provide a 508 compliance scorecard yearly, showing progress in making their system 508 Compliant. If providing hosting services for electronic content provided by the FBI, the contractor must not implement the hosting service in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 Standards (36 C.F.R. Part 1194). Throughout the life of the contract the agency reserves the right to perform testing on a

Contractor or Contractor’s hosted solution to verify conformance with this requirement.

Exporting data: The Contractor must provide data export capability in structured and text-based data formats, to include .xlsx, .pdf, .json, .txt, etc.

Statistics/Metrics: The Contractor must provide tracking, auditing, and statistics on tool usage by

FBI personnel, upon request. Basic statistics required must include total number of accounts, number of searches monthly, number of persistent and ad hoc searches. Also reports must include duration of use, last login of users. Usage reports for these statistics must be provided in the Monthly Report in .csv or .xlsx format.

System Reliability: The Contractor must ensure their system is available 24/7 for use by the FBI.

The Contractor must provide notice of planned upgrades and modifications to the system. This notification must be provided 30 days prior to implementation for the FBI to review the changes and ensure that all legal constraints and ease-of-use requirements will be met by the changes.

The FBI will not bear the cost for any testing of new or existing products and/or solutions.

Contractors must indicate whether the FBI will be invited to participate in any beta testing of new solutions that may be of benefit to the organization. The invitation must be provided through the FBI Contracting Officer’s Representative (COR). Emergency or critical system upgrades or modifications must be communicated within 5 business days of implementation. The Contractor must be ready to modify, within reason, their system for legal reasons if required, for instance, for Privacy and Civil Liberties purposes.

Artificial Intelligence (AI) Description and Compliance: The Contractor must provide reports and details of all AI functionality in their system upon request. The Contractor must share with the Government details of how their AI is trained and how bias is managed. If new AI is introduced, the Contractor must inform the Government before adding that capability.

Helpdesk: The Contractor must provide a POC or helpdesk to answer system related questions able to respond to customers’ calls or emails within five (5) minutes.

Accounts: The Contractor must provide unique accounts and usernames for each user that doesn’t reveal the user’s identity or affiliation. The Contractor must conduct user account management and maintenance, to include deleting and /or archiving unnecessary accounts as requested by the FBI. These accounts must not reveal the user’s identity or affiliation. New account requests shall be created within 1 business day of the Contractor receiving the account request notification.

Training on…