Cellebrite_J&A_November_2018.pdf

Control No:

Program/Equipment: Cellebrite Software License Renewals

Version – September 2018 FOR OFFICIAL USE ONLY Page 1 of 9

JUSTIFICATION REVIEW DOCUMENT

FAR PART 6 JUSTIFICATION AND APPROVAL FOR OTHER THAN

FULL AND OPEN COMPETITION

Program/Equipment: The United States Army Criminal Investigation Command (USACIDC) has a requirement for brand name Cellebrite Universal Forensic Extraction Devices (UFED) for

Personal Computers (4PC) Software, Desktop Analytics Software and Physical Analyzer

Software.

Authority: 10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1(a)(2) and 6.302-1(c), Only one responsible source and no other supplies or services will satisfy agency requirements, and brand name descriptions.

Amount: $874,934.00

Prepared by: Ashley Gesicki DSN: 562-2775

Contract Specialist Date: 06 Nov 2018

Email: Ashley.n.gesick.civ@mail.mil

Contracting Officer: Bradley Borek DSN: 562-3390

Contracting Officer Date: 16 Nov 2018

Email: bradley.r.borek.civ@mail.mil

Technical: Daniel M. Quinn DSN: 240-4004

Chief of Staff

USACIDC, MCB Quantico Date: 14 Nov 2018

Email: daniel.m.quinn6.civ@mail.mil

Requirements: Daniel M. Quinn DSN: 240-4004

Chief of Staff

USACIDC, MCB Quantico Date: 14 Nov 2018

Email: daniel.m.quinn6.civ@mail.mil

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager:

Typed Name: SA Gregory N. Norman

DSN: 240-4475

Signature: //signed// Date: 14 Nov 2018

Legal Counsel:

Typed Name:

DSN:

Signature: Date:

Version – September 2018 FOR OFFICIAL USE ONLY Page 2 of 9

Center Director:

Alex J. Matejka

DSN: 562-2631

Signature: //Signed// Date: 16 NOV 2018

Deputy Director:

Typed Name: Suzanne M. Anderson

DSN: 562-3844

Signature: Date:

Version – September 2018 FOR OFFICIAL USE ONLY Page 3 of 9

FAR Part 6 Justification and Approval for Other than

Full and Open Competition

1. Contracting Activity: U.S. Army Contracting Command-New Jersey

2. Description of Action: The U.S. Army Criminal Investigation Command (CID) requests a new

Firm-Fixed Price Contract for brand name Cellebrite UFED4PC Software, Desktop Analytics

Software and Physical Analyzer Software. The Cellebrite Universal Forensic Extraction Device

(UFED) is the only approved mobile forensic system for use by the U.S. Army Criminal

Investigation Command (USACIDC) per Criminal Investigation Regulation 195-1, Chapter 13-

7.The Government projects award for December 2019; fiscal year 2019 Operations and

Maintenance, Army (OMA) funds will be used.

3. Description of Supplies/Services: CID requires the replacement of sixty three (63) Cellebrite

UFED Touch 1 Logical devices and thirty one (31) UFED Ultimate devices. Cellebrite UFED devices and associated software have been mission essential for the extraction of data from cell phones and mobile devices that may be critical in criminal investigations. CID needs to replace the obsolete devices with Cellebrite UFED for Personal Computer (PC) (UFED4PC) software. In addition to replacing the UFED Touch 1 devices, CID must renew licenses for Cellebrite Desktop

Analytics and Physical Analyzer, and purchase additional copies of UFED4PC Ultimate, Desktop

Analytics and Physical Analyzer.

Period of Performance: 18 December 2018 to 17 December 2019

Contract Line Item

Number (CLIN)

CLIN Description Quantity

0001 UFED4PC Logical version with trade-In of CID’s 63 obsolete UFED

Touch 1 Logical devices.

0002 UFED4PC Logical version license renewals

0003 UFED4PC Ultimate version with trade-In of CID’s 31 obsolete UFED

Touch 1 Ultimate devices.

0004 UFED4PC Ultimate version license renewals

0005 New licenses of UFED4PC Ultimate 8

0006 Relicense of Desktop Analytics and software.

0007 New licenses with support of Desktop

Analytics

0008 Relicense Physical Analyzer (PA)

Dongles

0009 PA Dongles 16

0010 Academic copies of UFED4PC

Logical Software

0011 UFED Touch 2 Ultimate devices 5

Version – September 2018 FOR OFFICIAL USE ONLY Page 4 of 9

Total Value: $874,934.00

4. Authority Cited: 10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1(a)(2) and 6.302-1(c), Only one responsible source and no other supplies or services will satisfy agency requirements, and brand name descriptions.

5. Reason for Authority Cited: As described at FAR 6.302-1(a)(2), when the supplies or services required by the agency are available only from one responsible source, or for the

Department of Defense (DoD), National Aeronautics and Space Administration, and the Coast

Guard, from only one or a limited number of responsible sources, and no other types of supplies or services will satisfy agency requirements, full and open competition need not be provided for.

As further described in FAR 6.302-1(c), an acquisition or portion of an acquisition that uses a brand-name description or other purchase description to specify a particular brand-name, product, or feature of a product, peculiar to one manufacturer does not provide for full and open competition, regardless of the number of sources solicited; and shall be justified and approved in accordance with FAR 6.303 and 6.304. CID has been using brand name Cellebrite UFED devices and software since 2008. The software has been used as a record of work at CID and it is utilized to produce evidence for criminal proceedings. This software provides the ability to extract and analyze data from cell phone and mobile devices which is a critical capability in order to obtain data is that of evidential value in criminal investigations.

The Cellebrite UFED4PC Software is the only forensic software application at present time that will provide CID with the functionality it requires and offers complete backward compatibility of the software’s proprietary file format. In appellate cases, CID Agents and Digital Forensics

Examiners’ work can be challenged and require review by other forensic experts. In order to meet the need for the possible review of past digital evidence cases, CID must maintain its capability to re-examine or review these past cases and the only way to do that is to continue to maintain Cellebrite UFED4PC as one of its primary forensic software applications. In the case of new evidence, new proceedings, or judicial rulings, CID must have the capability to access old case files and review or conduct a re-examination if necessary.

CID agents require the ability to perform an immediate triage of cell phones and mobile devices to pursue time sensitive aspects of an investigation. Part of the ability to conduct an immediate triage is the ability to extract data while on site at a crime scene. Being able to extract data immediately upon seizing the device is absolutely critical to ensuring the data can be obtained as evidence if the data is encrypted and the mobile device is pass code protected.

CID has been using Cellebrite devices and software as the primary investigative and forensic tool for the extraction and analysis of data from mobile devices since 2008. All 1,418 CID agents are required to use Cellebrite hardware and are trained by the U.S. Army Military Police School during a 40 hour block of instruction in the CID Special Agent Course (CIDSAC). After students attend the 40 hour block of training, they practice with Cellebrite hardware during the Crime

Scene block of instruction on mock evidence they collect. Other companies have data extraction capability; however, it is estimated that it would take 24 months to develop and get approved a new Plan of Instruction for a new mobile extraction device or method. Additionally, it is

Version – September 2018 FOR OFFICIAL USE ONLY Page 5 of 9 estimated that it would take 12 months and $2.75 million to retrain the entire CID Agent workforce which is schedule and cost prohibitive. The backlog of digital evidence would grow and cause a catastrophic effect on CID's ability to complete criminal investigations. The conversion to any new forensic analysis software would render the CID record of work obsolete and the capability to access old case files and review or conduct a re-examination would be lost.

Failure to procure this software will jeopardize the operation of the entire CID investigative mission. Furthermore, if CID is unable to conduct criminal investigations in a timely manner; the affected military unit could be inoperable until the criminal matter is resolved. The Cellebrite devices and software are mission critical for the extraction of data from cell phones and mobile devices by CID agents and DFEs. CID needs to replace its current inventory of UFED devices with software, renew the licenses for all associated software and purchase additional forensic software to ensure CID is able to maintain this critical investigative and forensic capability.

6. Efforts to Obtain Competition: The Contracting Officer shall publish the notices required by

FAR 5.201 and any bids or proposals received shall be considered.

a. Effective Competition: Effective competition will be achieved as there are several authorized resellers of Cellebrite products.

b. Subcontracting Competition: Subcontracting competition will not be achievable for this type of effort.

7. Actions to Increase Competition: USACIDC routinely attends conferences and technical expositions to identify vendors and maintain awareness of available products. The USACIDC has established a relationship with the Defense Cyber Crime Institute (DCCI) that ensures the

Department of Defense Criminal Investigative Organizations are aware of newly released products that have been forensically validated and the current re-validation of products. The

USACIDC may also submit new products to Defense Computer Forensic Laboratory and DCCI for the purpose of validation which would encourage competition.

CID will continue to monitor the market for mobile device forensic extraction and analysis software in order to identify any applications that would offer backward compatibility with the

Cellebrite file format. In addition, the Government will continue to conduct market research to ascertain if there are any changes in the marketplace which will enable future actions to be competed.

8. Market Research: Initial market research was conducted from March through June 2018, and consisted of reviews of current CID requirements; online research of various websites pertaining to forensic software; monitoring of the International Association of Computer Investigative

Specialists list-servers; and coordination with other military criminal investigative organizations on the latest in the forensic software tool marketplace.

In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 205.205-71, DFARS 206.302-1(d), and DFARS Procedures, Guidance and Information (PGI) 206.302-1(d), a

Request for Information (RFI) was issued on the Federal Business Opportunities (FBO) website and General Services Administration (GSA) website from 20 September 2018 through 08 October

2018. A total of three responses were received from the FBO website. Two of the vendors, Version – September 2018 FOR OFFICIAL USE ONLY Page 6 of 9

Paraben Corporation and MSAB Inc., submitted capability statements offering alternative solutions. The third, Avail Forensics, responded to the FBO posting confirming their interest as an authorized reseller of Cellebrite. Zero responses were received on the GSA RFI posting.

Mr. Greg Norman of CID review and evaluated the material sent from each company. His evaluation found both alternative solutions to be unacceptable as they do not compare to

Cellebrite devices/software capabilities. Mr. Norman noted that Avail Forensics is an authorized reseller of Cellebrite.

In addition, in accordance with Army Regulation 25-1 and Department of the Army Policy memorandum dated 04 May 2009, the Computer Hardware, Enterprise Software and Solutions

(CHESS) contract vehicle is the primary source for commercial information technology hardware, software, and associated items. Purchasers of commercial hardware and software must satisfy their information technology requirements by utilizing CHESS contracts and DoD Enterprise

Software Initiative agreements first, regardless of the dollar value. CHESS Statement of Non-

Availability Request No. 216736819 was received on 3 Aug 2018 confirming that Cellebrite

Software is not on its contract vehicle and the IT Approval System Waiver No.

20180806178797249 was approved 9 Sep 2018.

9. Interested Sources: The Contracting Officer shall publish the notices required by FAR 5.201 and any bids or proposals received shall be considered.

10. Other Facts:

a. Procurement History.

1. Contract W15QKN-13-P-0043 with Root9B, LLC. had a period of performance from 31 Aug

2013 through 31 Aug 2014.

Competitive Status: Unrestricted.

2. Contract W15QKN-14-C-0071 with Root9B, LLC. had a period of performance from 30 Sep

2014 through 30 Sep 2015.

Competitive Status: Set Aside – Small Business.

3. Contract W15QKN-15-C-0130 with Digital Shield, Inc. had a period of performance from 18

Oct 2015 through 18 Oct 2016.

Competitive Status: Set Aside – Small Business.

4. Contract W15QKN-16-C-0102 with Axxera, Inc. was awarded 21 Sep 2016 and terminated 25

Oct 2016 because Axxera was not an authorized reseller of Cellebrite products and could not deliver the required products.

Competitive Status: Set Aside – Small Business

Version – September 2018 FOR OFFICIAL USE ONLY Page 7 of 9

5. Contract W15QKN-17-C-0020 with Digital Shield, Inc. had a period of performance from 19

Dec 2016 through 18 Dec 2018.

Competitive Status: Set Aside – Small Business, authorized resellers of Cellebrite.

The cited authority on the previous justifications was FAR 6.302-1(a)(2) “Only one or a limited number of responsible sources, and no other type of supplies or services will satisfy agency requirements”.

b. Other Facts:

1. It would be cost prohibitive to retrain the entire CID Agent workforce in a different mobile data extraction and analysis tool, which detrimentally affect CID’s ability to conduct timely and thorough criminal Investigations.

2. CID must maintain its current capability to re-examine or review past cases and the only way to do that is to continue to maintain Cellebrite Software as its primary forensic software application. As a result of new evidence, new proceedings, or judicial rulings, CID must have the capability to access old case files and review or conduct a re-examination if necessary.

Furthermore, CID needs to be able to link data recovered from former cases with new data extracted in present day cases. This is done using Cellebrite Desktop Analytics. Cellebrite

Desktop Analytics is the only application that is assured to allow linking of former data and present evidential data that has been extracted using Cellebrite devices and software.

Version – September 2018 FOR OFFICIAL USE ONLY Page 8 of 9

11. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Typed Name: Daniel M. Quinn Date:

Title: Chief of Staff

USACIDC, MCB Quantico Signature:

12. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

Typed Name: Daniel M. Quinn Date:

Title: Chief of Staff

USACIDC, MCB Quantico Signature:

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable.

Fair and reasonable price will be determined by a cost/price analysis and a comparison of proposed prices with the Independent Government Estimate and historical pricing of similar requirements.

As a part of this basis, certified cost or pricing data will not be required, in accordance with FAR

15.403(b)(3), as this procurement is deemed commercial.

Typed Name: Bradley Borek Date:

Title: Contracting Officer Signature:

14. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Typed Name: Bradley Borek Date:

Title: Contracting Officer Signature:

Version – September 2018 FOR OFFICIAL USE ONLY Page 9 of 9

Approval

Based on the foregoing justification, I hereby approve the procurement of Cellebrite UFED4PC, Desk Analytics Software and Physical Analyzer Software for the estimated amount of

$874,934.00 on another than full and open competition basis pursuant to the authority of 10

U.S.C.2304(c)(1) as implemented by FAR 6.302-1(a)(2) and 6.302-1(c), Only one responsible source and no other supplies or services will satisfy agency requirements, and brand name descriptions, subject to availability of funds, and provided that the services or property herein described have otherwise been authorized for acquisition.

BETH-ANN MENDELL Date:

Advocate for Competition

Army Contracting Command – New Jersey