SOW for DOMEX Media Training 20-31 JULY 2020.doc

Naval Surface Warfare Center Indian Head Explosive Ordnance Disposal Technology Division Expeditionary Exploitation UNIT ONE (NSWC IHEODTD, EXU-1)

Statement of Work (SOW) For

DOMEX Media Training 18 February 2020

STATEMENT OF WORK

Naval Surface Warfare Center Indian Head Explosive Ordnance Disposal Technology Division Expeditionary Exploitation UNIT ONE (NSWC IHEODTD, EXU-1) Media Training 1.0

SCOPE

Naval Surface Warfare Center Indian Head Explosive Ordnance Disposal Technology Division (NSWC IHEODTD) Expeditionary Exploitation UNIT ONE (EXU-1) has a unique mission that requires Non-standard Pre-deployment training currently not offered by traditional Navy EOD units.

This Statement of Work (SOW) defines training to be presented to NSWC IHEODTD EXU-1 personnel in Media Training.

As part of the EXU-1 Optimized Fleet Response Plan (OFRP) this advanced course of instruction (COI) is specifically designed to educate, train and prepare EXU-1 personnel in the collection, analysis, and exploitation of captured equipment, and media to generate actionable intelligence. This training will provide leaders at all echelons with intelligence about enemy forces, their plans and intentions, and their tactics, techniques and procedures (TTP) through the rapid and accurate extraction, exploitation, and analysis of acquired cell phones, computers and digital storage devices, video and audio tapes, and other media and materiel. This capability is a critical element of target exploitation, especially as it relates to actions on the objective during site exploitation performing triage analysis of a collected digital device, fundamental principles and best practices of device forensics and the analysis process and collect volatile data.

2.0

APPLICABLE DOCUMENTS

1) OPNAVNOTE 5450.

2) NAVSEANOTE 5450.134.

3) JROCM 128-08.

4) EXU-1 SORM – INST 3120.1.

5) EXU-1 TRAMAN – 3502.1B

3.0

REQUIREMENTS

1) The Contractor shall provide all instructors, labor, training aids necessary to instruct and train EXU-1 Personnel in the areas specified in this SOW.

2) The Contractor shall provide one COI with classroom with wireless internet (Wi-Fi) capability and practical instruction for a up to 15 participants per course. The training curriculum will be designed to support a ten day COI with maximum of 10 hours of instruction per training day. The Contractor shall provide both classroom and practical training with a focus on the following areas:

Properly capture digital evidence at a dynamic location and perform an analysis of a suspected device.

Capture passwords Image digital devices using Windows and Linux based tools.

Use preview devices to view data collected.

Gather "low hanging fruit" for Intelligence.

Report collected Intelligence to respective chain of command.

Understand mobile device forensics fundamentals

Understand the cell phone analysis process

Understand the basics of data access/acquisition from an android phone Access/Acquire data from an android phone using various tools

Analyze/Interpret data acquired from an android phone using various tools

Understand the basics of data access/acquisition from an android phone

Properly teardown a cellphone

Report findings of the examination Teach EXU-1 equipment in depth (equipment listed below)

· UFED 4PC with Chinex, Physical Analyzer, Reader

· XRY with Pinpoint, XAMN, Horizon, Reader, SIMEX

· Magnet AXIOM

· FTK with imager, PRTK, Registry Viewer

· Passware

· Viking / Autopsy

· DC3 Advanced Carver

· SMIRK

· Ditto II

· Tableau Write Protectors

· CFID (Compact Forensic Imaging Device)

· Icy Dock / SATA connectivity cable

· Faraday Bags

3) The Government shall provide the EXU-1 issued DOMEX equipment.

4) A detailed Schedule of Events (SOE) shall be developed and approved by EXU-1 Training Department, 5 business days prior to beginning of this COI. The Contractor shall provide course feedback evaluation forms that allow participants to comment on the primary blocks of instruction and make recommendations for this improvement. (CDRL A001). Any changes to the SOE shall be provided to the Contract Buyer and EXU-1 Training Department for approval.

5) The Contractor shall provide an After Action Report (AAR) to be delivered to the Contract Buyer and EXU-1 Training Department within two weeks following completion of each course of instruction. Any changes to the course will be discussed between the Contracts Department, EXU-1 Training Department and the Contractor as necessary.

3.1

CONTRACTOR CERTIFICATIONS / QUALIFICATIONS

1) The Contractor shall have previous active duty military experience. They must be familiar with rank structure and proper customs and courtesies warranted for each.

2) Familiarity with and working relationship with DOMEX industry

a. To include Encryption key downloads

b. Update downloads

3) Must be affiliated with an accredited university

4) Extensive hands on experience and working knowledge with the DOD issued DOMEX equipment listed above.

5) Instructors must have up to SECRET clearance and access to SIPR network.

6) Must have working knowledge and access to DON ISIS and SOFEX portal

3.2

PERIOD AND PLACE OF PERFORMANCE

The Contractor shall have a curriculum ready to deliver training for the anticipated dates and locations as follows:

Training Location

NSWC IHEODTD, EXU-1 (Stump Neck Annex, Indian Head, MD) Waldorf/La Plata , Maryland area Dates 20-31 July 2020

3.3 CONTRACT OPTION YEAR

The base year covers the first year of Domex training.

One-year option for the subsequent year shall be included in the Domex training contract.

3.4

EVALUATIONS AND CERTIFICATIONS

1) The Contractor shall provide course feedback evaluation forms that allow participants to comment on the primary blocks of instruction and make recommendations for improvement this feedback will be provided in the After Action Report (AAR).

2) The Contractor shall deliver participant certificates upon completion of the course that state at a minimum the name and rank of each participant, hours of instruction, and course title and dates.

4.0

DEFINITIONS

1) CONTRACTOR. A supplier or vendor having a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2) CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

3) CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

4) SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

5) TRAINING AREA OR FACILITY. Classrooms and or conference room, non-explosive/non- live fire buildings.