Statement of Work - Undercover Online Operations Training - final 9-6-2025.docx

FDA Office of Criminal Investigations (OCI) Statement of Work (SOW) Undercover Online Operations Training Background The Food and Drug Administration (FDA) is responsible for regulating products to ensure the safety of foods, prescription and over-the-counter drugs, biological products such as vaccines and blood, medical devices, cosmetics, radiation-emitting products, and more. Since 1993, Office of Criminal Investigation (OCI) has investigated thousands of criminal schemes involving the distribution of potentially dangerous FDA-regulated products. These products include prescription drugs; dietary supplements; tobacco; medical devices; blood and biologics; vaccines; cosmetics; radiation-emitting products; animal and veterinary medicines; and foods. OCI’s investigations have involved a wide variety of criminal conduct, including street level distribution of counterfeit, unapproved, and designer drugs, major organized illicit diversion of prescription drugs, fraudulent schemes involving ineffective AIDS, cancer, and Alzheimer cures, large scale product substitution conspiracies, application and clinical investigator fraud, and health frauds involving harmful FDA-regulated drugs and medical devices. As FDA’s criminal law enforcement arm, OCI protects the American public by conducting criminal investigations of illegal activities involving FDA-regulated products, arresting those responsible, and bringing them before the Department of Justice for prosecution.

Suspects involved in the illegal sale of FDA regulated products have become very adept at hiding on the internet while carrying out their criminal activity and victimizing United States citizens. Many OCI cases involve suspects illegally selling FDA regulated products online both domestically and internationally. The identity of these suspects is often unknown and difficult to ascertain. To increase OCI’s ability in identifying and obstructing rogue online sellers of FDA regulated products, OCI required contractor services to provide advanced online undercover (UC) operations training to enhance the online investigative skills of OCI’s Cybercrime Investigations Unit (CcIU).

Objectives The objective of this acquisition it to procure technical training to seasoned cybercrime criminal investigators to further its ongoing efforts to counter the widespread illicit trafficking and/or marketing of FDA-regulated products over the Internet. The training course shall enable specialized OCI agents to operate safely and effectively online when conducting undercover (UC) investigations as well as teach how to identify digital assets utilized by the suspect/s and how to seize such assets. The overall goal of this training is to improve OCI’s ability to identify suspects that are illegally selling FDA regulated products on any platform (surface/deep/dark web, social media, apps), determine the scope of their operation, engage with targets to identify their needs/weaknesses and gain the suspects confidence while working on a way to lure the suspect for arrest/identification and or to seize their assets.

The objectives of the training course shall include:

· how to identify targets and how/when to properly initiate contact and build relationships

· creating, building, and maintaining long term UC identities, known as legends

· how to properly collect evidence as leads are developed, and conversations initiated

· how to exploit avenues of digital transactions in order to follow the flow of funds for seizure and suspect identification including collecting payments and paying for supporting services using cryptocurrency and other digitally based monetary instruments (CashApp, Venmo, PayPal, etc)

· how to best maintain UC accounts such as social media, blogging, shell companies and websites that can be put to use as field cases dictate.

· on targeted suspect websites, how to conduct penetration testing, find site vulnerabilities, and undertake netflow analysis.

Scope The Contractor shall facilitate an advanced undercover online operations training course provided over the course of five (5) full days for up to sixteen (16) OCI training participants.

Training Course Requirements Length of Course: The training shall be eight (8) hours per day, Monday through Friday for five full (5) days.

Number of Participants: maximum of 16 participants Location of Training: Training shall be held in-person at location to be determined (TBD) at a later date Contractor-Furnished Materials:

Required Instructional Materials The Contractor shall provide comprehensive instructional materials that demonstrate readiness to deliver effective training. Required materials shall include:

• Course outline with detailed learning objectives for each day/module, including measurable outcomes and assessment criteria

• Lesson plans with time allocations showing how content will be delivered within the five (5)-day timeframe, including interactive activities, discussions, and practical exercises

• Instructor guides and presentation materials (slides, handouts, reference materials) that align with FDA training goals

• Assessment tools and evaluation methods including quizzes, case studies, or practical demonstrations to measure participant comprehension

• Resource lists and supplementary materials such as materials used in supporting class instruction.

• Instructor qualifications documentation demonstrating subject matter expertise and teaching experience relevant to the course content Review Timeline and Process Initial Review Period: 15 business days from receipt of complete materials submission Review Process:

1. Technical content review

1. Instructional design review

1. Compilation of feedback and approval recommendation Revision Procedures

• If revisions are required, the Contractor will receive detailed written feedback within the initial review period

• Revision deadline: 10 business days from receipt of feedback

• Secondary review: seven (7) business days for revised materials

• Materials requiring substantial revision may necessitate additional review cycles at the discretion of the approval authority Final Approval Authority Primary Approval Authority: Jacob Ellis Director of Training and Development] Secondary Approval Required for: Sean Grillo, Senior Operations Manager Cybercrime Investigations Unit.

Approval Confirmation: Written approval must be received before course delivery

Description of Training: Training shall include topic areas such as, but not limited to:

· Operate safely online- managed attribution

· Understanding of the internet

· Picking the correct virtual private network (VPN)/proxy

· How to access the internet based on target/objectives (VPN, wi-fi, Nfusion)

· What we expose when we operate online (refer to Managed Attribution below)

· Pretty Good Privacy (PGP)

· Use of Undercover (UC) phone

· Best Operation Security (OPSEC)

· Usage of apps

· Evidence collection

· Use of emulators

· Logging into UC accounts via emulator

· Cellphone activity to PC Virtual Machine’s

· Legend building

· Develop legend/credible and maintaining

· New or already used identity

· Benefits to new/preexisting identity

· Creating communication accounts (email, SMS, chat services)

· Creating payment mechanisms that can assist in identifying the suspects assets

· Overcoming two-factor authentication (2FA) requirements when setting up accounts

· Creating and maintaining social media accounts (keep open, active accounts)

· Followers

· Posts

· Locations

· Pictures/photographs

· Creating and maintaining business accounts

· Buildout long term UC

· Establish businesses, licensing, etc

· Supporting website/SM

· Yearly requirements

· Establishing necessary banking to support the business and trace funds

· Creating and maintaining other online accounts

· Reddit

· Blog sites

· Operating safely and efficiently on

· Social Media platforms

· Surface/Deep/Dark web

· Utilizing/investigating encrypted chat platforms (messaging and email)

· Identifying and tracing suspects and assets online

· Finding evidence left online by suspects

· Utilization of multi search engines and available software

· Identification of online suspects (finding true ID)

· Advanced research online (surface/deep/dark/social media/apps)

· How to collect attribution on clear/darknet site administrators by exploiting their website development and/or site vulnerabilities

· Targeting the flow of illegal assets

· Types of digital assets (Crypto, Payment apps, etc)

· How to identify those in use by the criminal organization

· Methods to trace and seize the illegally obtained digital assets

· Capturing evidence online

· Collecting evidence from websites (to include meta data)

· Collecting Communications (both UC chat and that left online by suspect)

· Recording UC operations (buys, communication, etc)

· Evidence recovery on both desktop and mobile applications

· Capturing intel on digital assets in use

· Managed attribution (MA)

· Discussion of what is exposed when visiting websites and managing online digital footprint

· How does MA work and what is it

· Device attributes plus IP, cookies, plugins

· Behavioral Footprint- What is out there about us

· Level of OPSEC needed for each target

· Do we need a VPN and other covert measures or will that be problematic (case specific)

· Operational browsing, only visiting sites that mesh up with your online legend

· Are you visiting sites that are related to your backstop and mission

· Use of Virtual Machines (VMs)

· Building out individual windows to support each case/legend

· Setting up each VM window for case specific need

· Engaging with online sellers (end game of lure or fake business partnership/gain trust)

· Recon on suspect prior to attempted connection

· Identifying suspects needs/weaknesses

· Includes making payments in order to follow the flow of assets

· Best practices when engaging with a target in an undercover capacity online

· Honey Pot

· Data analytical experience (i.e.penetration testing, site vulnerabilities, netflow analysis, etc.)

· Build-out a marketplace and/or onion site with the intent of collecting data on potential suspects

· Websites selling pill presses/dies

· Onion marketplaces

· PGP Encryption (sending encrypted and receiving/decrypting messages)

· Other supporting services we can provide the suspect that can initiate payments

· Identity takeover

· Taking the suspects ID

· Taking over victim ID

Required Contractor Experience:

· Extensive experience with online undercover operations targeting sellers of illegal products. This experience should include engaging both individual and commercial sellers running illicit sales and scams to carry out their criminal operations.

· Extensive experience engaging online sellers of illicit products, posing as buyer or sellers to collect evidence and identify the targeted suspects. This experience shall include instances where undercover operations were able to convince the target to expose details about their operations that aided in their identification (social media accounts, payment mechanisms, alternate methods of contact, etc). Experience shall also include knowledge in identifying a suspect’s motives and weaknesses in order to develop a plan of engagement.

· Extensive experience in setting up different types of payment mechanisms that are most advantageous to making payments to the suspect for illicit products and in identifying their finances and money laundering operations.

· Extensive experience developing and maintaining online personas to include social media accounts, websites, undercover businesses, etc with the purpose of building a legend and using it to backstop online undercover activities. This experience shall include work- arounds to setting up these accounts and their continued usage.

· Experience using both old (cell phone, IM chats, etc) and new (encrypted chat platforms such as Signal, Telegram, etc), clear web, social media messaging, and dark web forums such as Dread as well as other communication platforms to interact with suspects.

· Experience in evading counter-intelligence by suspects on law enforcement officer (LEO) operations. Managing background/s, payments, communications, and overall operations to avoid exposure of LEO true identity and/or undercover operations by federal law enforcement (LE).

Delivery

Government-Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI) See FAR 45 for specific requirements about providing Government-furnished property. To support the training, OCI training participants will be provided with a government-furnished covert computer with VM and cellphone.

Travel Travel is not anticipated for this contract. However, Offerors may propose travel costs in their proposal along with appropriate explanation and justification for the costs. Travel costs omitted in the offeror’s proposal will not be included in the final award or reimbursed.

Place of Performance Training shall be held in-person at a location TBD. All preparations prior to the facilitation of the training may occur at the Contractor’s facility.

Period of Performance The period of performance of this contract shall be six (6) months. The dates of the training course shall be established in coordination with the COR after the project plan and training curriculum is approved and accepted by the Government. Training course shall be completed within the contract period of performance.