SOW - DOMEX DRAFT.pdf

STATEMENT OF WORK

Expeditionary Exploitation Unit ONE (EXU-1) Expeditionary Document and Media Exploitation (DOMEX) Procurement, Sustainment, and Training

1.0 SCOPE

Naval Surface Warfare Center Indian Head Division (NSWC IHD) Expeditionary Exploitation Unit ONE (EXU-1) has a unique mission that requires Non-standard Pre-deployment training currently not offered by traditional Navy EOD units.

DOMEX refers to the capability to digitally extract data from media containing systems that can be analyzed for critical information then pushed to decision-making leadership.

DOMEX used by DOD military is only used in operations outside the U.S. This will upgrade EXU-1 DOMEX capability to meet Combatant Command (COCOM) requirements in data extraction from developing tech in mobile devices and unmanned systems in all battle spaces.

2.0 APPLICABLE DOCUMENTS

1) 29 CFR 1910 subpart Z, section 1910.1450, appendix A.

2) ATP 3-90.15 Site Exploitation (SE)

3) ATP 3-39.12 Law Enforcement Investigations

4) OPNAVNOTE 5450.

5) NAVSEANOTE 5450.134.

6) EO-12333

7) DoDD-5148.13 or DoDD 5240.01/.1-R.

8) DoDD 5240.01

9) DoDD 5240.1-R

10) SECNAV Instruction 3820.3E

3.0 REQUIREMENTS

3.1 Purchase and Procurement of DOMEX Kits.

1) The Contractor will provide up to eight (8) DOMEX kits in the base year with option of procuring up to 2 additional Kits in Option year 1 and Option year 2. All kits will be sent to EXU-1 prior to being fielded the contents of one (1) kit are as follows. No substitutions are acceptable:

• One (1) Pelican Case large enough to hold all contents.

• One (1) PC Laptop, (minimum i7, 32GB ram, 1TB internal Hard drive).

• One (1) Digital Intelligence UltraKit v5 write blocker/Protector kit.

• Magnet Forensics Software

i. One (1) GRAYKEY (Mobile/Offline) with associated hardware and a one

(1) year license.

ii. One (1) Axiom with associated hardware and a one (1) year license.

• MSAB Software

i. One (1) XRY Pro - Office with associated hardware and one (1) year license.

• Detego Software

i. Ballistics Imager with associated hardware and a one (1) year license.

• V2 Forensics Software.

i. One (1) Disero with associated hardware, analysis software, and a one (1) year license.

3.2. Sustainment

Sustainment of the DOMEX kit refers to the required maintenance for each kit. The maintenance will be for the 12 DOMEX kits in total. (8 in the base year plus option year kits). This shall include license renewal for all software, updates for all software, parts replacement, and part updates required by the contractor. Software version control updates and license renewal will require manual download via physical external device during scheduled sustainment evolutions.

License updates shall be provided by the Contractor within 60 calendar days of the license expiration for all EXU-1’s licenses. Software updates for V2 Forensics, Detego, Magnet, and MSAB shall be sent to EXU-1 by the Contractor in the form of an executable file which contains encoded instructions that can be executed on and by the Windows Operating System, as updates are available for all EXU-1’s kits. Hardware updates shall be provided before the first training week of each calendar year for all EXU-1’s kits to the EXU-1’s Electronics Engineering Department for installation.

3.3 DOMEX and Unmanned System Data Collections and Analysis Training.

1) Each DOMEX and Unmanned System Data Collections and Analysis Course of

Instruction (COI) shall be conducted at EXU-1 located at NSWC IHD 3341 Strauss Avenue Bldg. 900, Indian Head, MD, 20640, with practical instruction for up to (12) twelve participants per course. The Training curriculum shall be designed to support with maximum of 8 hours of instruction per training day for a total of 80 Hours.

As part of the EXU-1 Optimized Fleet Response Plan (OFRP), these advanced COI are specifically designed to educate, train and prepare EXU-1 personnel in the collection, analysis and exploitation of collected exploitable materials (CEM) to generate actionable intelligence. This training enables the EXU-1 Technical Exploitation Platoons (TXP) to meet COCOM required needs, providing leaders at all echelons with intelligence about enemy forces, their plans and intentions, and their tactics, techniques and procedures

(TTP) through the rapid and accurate analysis of CEM. CEM includes (but is not limited

to) cell phones, computers, digital storage devices, video and audio storage device, Global Positioning systems (GPS), and other media and materials. CEM also includes (but is not limited to) Unmanned Underwater Vehicles (UUV), Unmanned Surface Vehicles (USV), Unmanned Air Vehicles (UAV).

Additionally, these training courses teach the TXP team members the International Standards of how to identify, collect, and handle data extracted from CEM to maintain the technical value. These skills are critical due to the importance of providing Theater Commanders with timely and accurate intelligence that potentially leads to targeting and prosecution, defense system Research and Development (R&D), and updates to current TTP’s.

The following training of personnel shall happen twice per year and up to a maximum of three times per year by Contractor. The Contractor shall include Any required Travel, accommodations, and shipping cost as part of the training course cost.

The Contractor shall provide:

1. Training kits that include:

• One (1) Pelican Case large enough to hold all contents.

• One (1) PC Laptop, (minimum i7, 32GB ram, 1TB internal Hard drive).

• One (1) Digital Intelligence UltraKit v5 write blocker/Protector kit.

• Magnet Forensics Software

i. One (1) GRAYKEY (Mobile/Offline) with associated hardware and a one

(1) year license.

ii. One (1) Axiom with associated hardware and a one (1) year license.

• MSAB Software

i. One (1) XRY Pro - Office with associated hardware and one (1) year license.

• Detego Software

i. Ballistics Imager with associated hardware and a one (1) year license.

• V2 Forensics Software.

i. One (1) Disero with associated hardware, analysis software, and a one (1) year license.

2) Training aids for each student loaded with realistic scenario content and exploitable information relevant to the most recent ten years, to include but not limited to:

• Mobile devices (Cell phone, GPS, Laptops, smart watches, etc.)

• Computers (Laptops, Tablets, etc.)

• Unmanned Systems (Drones, etc.)

• Mass Storage Devices (Thumb Drives, Hard Drive, SSD, SD Cards, etc.)

Training aids shall not include anything restricted by the EO-12333, DoDD-5148.13 or DoDD 5240.01/.1-R.

3) Identical practical training for each student utilizing the aforementioned training kits and training aids, with a focus on the following areas:

• Properly capture digital evidence at a dynamic location and perform an analysis of suspected devices.

• Capture passwords.

• Image digital devices using Windows and Linux based tools.

• Report collected Intelligence to respective chain of command.

• Understand mobile device forensics fundamentals.

• Understand the mobile device analysis process.

• Understand the basics of data access/acquisition from Various mobile devices.

• Access/Acquire data from Various mobile devices using various tools.

• Properly teardown mobile devices.

• Understand the Unmanned Systems analysis process.

• Understand the basics of data access/acquisition from Unmanned Systems.

• Access/Acquire data from Unmanned Systems using various tools.

• Report findings of the examination.

• Access/Acquire data from mass storage devices.

• Analyze/Interpret data acquired using various tools.

• Teach EXU-1 to collect and analyze digital forensics using the following equipment:

• XRY Pro, XAMN

• Magnet GRAYKEY (Mobile/Offline) with data analysis software

• Magnet Axiom

• Detego Ballistic Imager

• Digital Intelligence UltraKit v5 write protectors

• V2 Disero

4.0 Contractor Course Deliverables

The following are required deliverables for each training class and EXU-1 DOMEX kit:

1) The contractor shall provide and maintain a DOMEX Kit Status Report (CDRL A001).

The Report provides EXU-1 DOMEX equipment status to allow update and version tracking to maintain deployable Kits. The report will include (but not limited to) the following information per kit:

• XRY Pro current version, version update required, license renewal date.

• Magnet GRAYKEY (Mobile/Offline) current version, version update required, license renewal date.

• Magnet Axiom current version, version update required, license renewal date.

• Detego Ballistic Imager current version, version update required, license renewal date.

• V2 Disero current version, version update required, license renewal date.

• Part upgrade required and information on new part

2) A detailed Schedule of Events (SOE) (CDRL A002) shall be developed and approved by

EXU-1 Readiness and Training Department 20 business day prior to beginning of each COI. Any changes to the SOE shall be provided to the COR and EXU-1 Readiness and Training Department for approval.

3) The contractor shall provide an After-Action Report (AAR) (CDRL A003) which includes completion of each course of instruction; a pre and post knowledge survey for each training to accurately measure the comprehension and retention of the training with details and Course feedback evaluation forms that allow participants to comment on the primary blocks of instruction and make recommendations for improvements. Any changes to the course will be discussed between the Contracts Department, EXU-1 Readiness and Training Department and the Contractor as necessary.

4) The Contractor shall provide a Software License Requirements List (CDRL A004) and notify EXU-1 DOMEX representatives of software license expiration 60-90 days prior to the expiration date on a Software License Requirements List.

5) The Contractor shall provide COI Completion Certificates (CDRL A005) upon completion of each of the courses that state at a minimum the name and rank of each participant, hours of instruction, and course title and dates.

5.0 OPSEC

The contractor is required to protect critical information associated with this contract to prevent unauthorized disclosure and will observe OPSEC requirements.

6.0 Routine Physical Contractor Access to a Federally-controlled Activity

All contractor personnel employed on the Activity shall become familiar with and obey all Activity regulations including but are not limited to installation access control policy, safety, traffic and security regulations. The contractor in the performance of work requirements must comply with these regulations.

7.0 Security Badges and On-Site Contractor Personnel

Security badges will be issued by the Government only to those contractor personnel who require access to NAVSEA, Naval Surface Warfare Center, Indian Head division (NSWC IHD), Naval Support Activity South Potomac (NSASP) in connection with work to be performed under this contract. Contractors must be registered into the Trusted Associate Sponsorship System (TASS) by a Trusted Agent (TA) through the Contracting Officer’s Representative (COR) or Contracting Officer. Once the TA has enrolled you in TASS, the TA will provide the contractor employee with a user ID and password. The contractor employee must log into TASS within seven days of the application's approval and must complete the application for a CAC within 30 days of the initial login. The TA will review the application and either approve or deny it. Once approved, the contractor employee must go to a Real-Time Automated Personnel Identification System (RAPIDS) site for final verification and processing (https://idco.dmdc.osd.mil/idco/locator).

The Contractor shall maintain a register of employees currently authorized access to NAVSEA, NSWC IHD, NSASP. This does not include badges temporarily authorized for contractor visitors to NAVSEA, NSWC IHD, NSASP. Furthermore, the contractor shall maintain a current register of contractor personnel with full or part-time work or office space located on board the Naval Support Activity South Potomac. This register will be made available upon request of the Contracting Officer. The contractor shall follow station security procedures in this regard.

8.0 Voluntary Protection Program

In August 2006, Naval Surface Warfare Center Indian Head Division (NSWC IHD) was nominated to participate in the DoD Voluntary Protection Program Center of Excellence Implementation Initiative of the Defense Safety Oversight Council (DSOC). The Voluntary Protection Program (VPP) was established by the Occupational Safety and Health Administration (OSHA) in 1982 to recognize and promote effective worksite-based safety and health management systems. NSWC IHD, through the utilization of VPP, desires to be a model of safety and health excellence. VPP's emphasis on trust and cooperation between OSHA, the employer, employees, employees’ representatives, and contractors’ complements the Agency's enforcement activity but does not take its place. All parties, including Contractors, are to work together to identify and resolve any safety and health problems that may arise, yet obtain Contracting Officer approval of any changes that would impact the terms of the contract. NSWC IHD as the VPP participant develops and implements systems to effectively identify, evaluate, prevent, and control occupational hazards so that injuries and illnesses to employees and contractors are prevented. Contractor and sub-contractor personnel are subject to occupational safety and health oversight. This oversight will be accomplished by NSWC IHD personnel and Contracting Officers. Contractors, sub-contractors, and their employees, while in performance of a contractual action on-site within the geographical boundaries of Naval Support Facility (NSF) Indian Head, shall be subject to the requirements of the NSWCIHEODTDINST 5100.22H, “Safety Manual” regardless of the type or duration of the contract. Chapter 13 of the NSWCIHEODTDINST 5100.22H, “Safety Manual”, entitled “Contractor Safety” is provided as Attachment XX Appendix 13-A, of the chapter 13 entitled “Contractor Safety Requirements When Performing Work at the Naval Support Facility (NSF) Indian Head, MD” shall be signed by the Contractor prior to commencement of services on-site at NSF Indian Head. The Contractor shall maintain one signed copy for future reference in educating its personnel and sub-contractors. A second signed copy shall be provided to the Contracting Officer to be maintained in the contract file. If an occupational safety or health related injury or illness occurs during the performance or as a result of this contractual action, the Contractor shall notify the Contracting Officer Representative (COR) as soon as practicable, who will notify the Safety Office and the Contracting Officer.

2. In support of VPP and in compliance with Chapter 13 of the Safety Manual, entitled “Contractor Safety,” all Contractors performing on-site at NSF Indian Head shall comply with the following:

a. Public Law 91-596 (and Amendments), also known as the Occupational Safety and Health Act of 1970, establishes that all employers, including Contractors, are responsible, as far as possible, for providing every employee a safe and healthful working environment. All employers, including Contractors, shall conform to the standards as issued by OSHA. Contractors are responsible for complying with safety requirements specified in the contract as well as all Federal, State, and local safety and security regulations. Non-compliance may be cause for the removal of a Contractor or any Contractor employee from the activity and such non-compliance may form the basis for contractual action, up to and including termination for default.

b. Contractor personnel shall participate in basic safety awareness and hazard identification training offered by the Government activity at the work area they are supporting. Contractors performing on-site shall attend area weekly safety meetings and annual safety stand-downs, as determined by the COR.

3. The best Safety and Health Programs involve every level of the organization, instilling a safety culture that reduces accidents for workers and improves the bottom line for managers.

When Safety and Health are part of the organization and a way of life, everyone wins. NSWC IHD is committed to safety excellence.

10.0 ACRONYMS

AAR - After Action Report COI – Course of Instruction DOD - Department of Defense DON - Department of Navy EOD – Explosive Ordnance Disposal FRP - Fleet Response Plan IHD – Indian Head Division NSWC - Naval Surface Warfare Center ORM - Operational Risk Management SOE - Schedule of Events SOW - Statement of Work

TTP – Tactics, Techniques, and Procedures UUV – Unmanned Underwater Vehicle USV – Unmanned Surface Vehicle UAV – Unmanned Air Vehicle

Expeditionary Exploitation Unit ONE (EXU-1)