SOW_GrayKey License_PR20158647.pdf

Statement of Work Department of Homeland Security U.S. Customs & Border Protection

GrayKey License

1. Background

The U.S. Customs and Border Protection (CBP) San Diego Field Office (SDFO) regularly conducts law enforcement related searches and investigations of electronic devices to identify violations of law relating to trade and travel.

CBP enforces numerous laws concerning material that may be in paper or electronic format. 18 United States Code (U.S.C.) § 2252 makes it a crime to transport in foreign commerce child pornography. Similarly, 19 U.S.C. § 1305 prohibits, among other things, the importation of material that is obscene, that contains any threat to take the life of or inflict bodily harm upon any person in the United States, or that is treasonous or seditious. Trademark and copyright laws directed at protecting written material, among other things, are also enforced at the border. In today’s digital world CBP faces challenges at enforcing such laws as devices get smaller and data storage capacity expands. It is CBP’s mission to enforce US law while facilitating lawful international trade and travel as expeditiously and efficiently possible.

GrayKey is a mobile device forensic tool that enables lawful access to extract from encrypted or inaccessible data on electronic devices. The GrayKey software, which is approved for OFO use in the TRM, requires an annual license to function. GrayKey requires an annual license to provide support and maintenance coverage. Support and Maintenance includes the provision of Updates or Upgrades (software releases from GrayShift) to the Software including, without limitation, enhancements to the Software; commercially reasonable efforts to correct any defects in the Software which prevent the Software from operating in accordance with its specifications (including the provision of Updates or Upgrades where necessary to correct a defect in the Software which prevents the Software from operating in accordance with its specifications) and Guidance on software failure diagnoses and suggestions for Software error correction.

2. Scope of Work

The Contractor shall:

• Provide all hardware and licenses required for GrayKey Advanced service (1 year) o Unlimited Consent and BFU Extractions o 125 AFU, Instant Unlock or Brute Force Advanced actions o 125 Action credits o 2 Excursion credits o GrayKey License – Preserve o 1 GrayKey Preserve Unit o 1 Magnet GrayKey Unit o All licenses shall include software updates, new cables/adaptors, and software/equipment maintenance. Software/equipment maintenance shall support failure free operation of all tools, accessories and peripherals. Any additional features/capabilities granted through updates to software, that require additional hardware or physical perpherals, shall be included as part of the tool delivery.

3. Specific Tasks The contractor shall complete the following tasks as required to comply with this SOW.

3.1 Documentation

The contractor shall be responsible for issuing existing documents as requested by CBP.

4. Place of Performance

Forensic iOS and Android extractions will be conducted at the San Diego Field Office CBP Laboratory

5. Period of Performance

- TBD

6. Security The security classification for this equipment is “Law Enforcement Sensitive” (LES) due to the mission critical criminal investigations and intelligence operations that utilize this software. PLEASE do not post or share this publicly outside FirstSource II posting or on other public sites.

7. Deliverables

• Data The contractor shall provide copies of the documents listed below. One copy of the data shall be delivered in paper form and one copy in electronic form. The electronic form shall be in MS Word format or Adobe Acrobat PDF. The documents are deliverables under the contract and shall be delivered to the COTR/COR no later than thirty days after contract award:

a. Completed invoicing

b. License Key Documentation and Software Download Link

• Shipping Address Electronic delivery of the software and consolidated license keys is acceptable in lieu of a physical shipment of media. Electronic delivery shall include both a software download link and a file consisting of all the consolidated license numbers. The list of delivered consolidated license numbers shall be transmitted to Joseph Natividad per dates as indicated in this SOW. Electronic delivery of a file consisting of all the consolidated licenses shall be sent to the following email addresses: joseph.c.natividad@cbp.dhs.gov,.

Electronic delivery of consolidated licenses shall be made in accordance with the delivery schedule. If the government purchases any physical goods and hardware, CBP will provide a shipping address.

mailto:jennifer.a.mcgill@cbp.dhs.gov

8. Other/Meetings

8.1 No changes to this SOW or cost shall be incurred without prior approval of the

Contracting Officer (CO) and coordinated by the Contracting Officer’s Representative (COR). The CO is the only individual with the authority to amend this contract. Any changes or cost increases will not take effect until the CO executes a written modification. Only the CO has the authority to represent the Government in cases where the task order requires a change in the terms and conditions, delivery schedule, scope of work and/or price of the products and/or services under this task order.

8.2 Points of Contact

Contracting Specialist Jesus Solis Jesus.solis@cbp.dhs.gov

Contracting Officer’s Representative Alena Pena Sellari 619-662-2217 Alena.l.penasellari@cbp.dhs.gov

Technical POC Joseph Natividad 619-690-8829 Joseph.c.natividad@cbp.dhs.gov