JA_FAR_Part_6_GrayKey_ACC-NJ_Fv2(REDACT).pdf

Control No:

Version – September 2018 FOR OFFICIAL USE ONLY

JUSTIFICATION REVIEW DOCUMENT

FAR PART 6 JUSTIFICATION AND APPROVAL FOR OTHER THAN

FULL AND OPEN COMPETITION

Program/Equipment: United States Army Criminal Investigation Command (USACIDC) procurement of GrayKey Non Geo-located Device Unlock Software and Devices.

Authority: 10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1(a)(2) and 6.302-1(c), Only one responsible source and no other supplies or services will satisfy agency requirements, and brand name descriptions.

Amount:

Prepared by:

2019JUN18

Contracting Officer:

Technical:

Requirements:

Reviews: I have reviewed this justification and find it adequate to support other than full and open competition.

Program Manager:

Branch Chief:

Division Chief:

Legal Counsel:

Version – September 2018 FOR OFFICIAL USE ONLY

FAR Part 6 Justification and Approval for Other than Full and Open Competition

1. Contracting Activity: U.S. Army Contracting Command - New Jersey

2. Description of Action: USACIDC requests a firm-fixed-price new contract with GrayShift, LLC, 1475 Lake Forest Lane, McDonough, GA 30253-5592. The Government projects award for July 2019 and fiscal year 2019 Operations and Maintenance, Army funds will be used.

3. Description of Supplies/Services: GrayKey is a forensic product developed by GrayShift, LLC that has the ability to auto-discover 4 and 6 number passcodes to unlock iOS devices, to recover deleted information, and to do full data extractions of the devices. USACIDC has a requirement for one GrayKey Non Geo-located Device Unlock Software – one year term, six Geo-located Device Unlock Software – one year term, six GrayKey connection units and for maintenance support of the software.

Period of Performance:

Base Period: 17 July 2019 through 16 July 2020 Value: $ Option Period 1: 17 July 2020 through 16 July 2021 Value: $ Option Period 2: 17 July 2021 through 16 July 2022 Value: $

Total: $

4. Authority Cited: 10 U.S.C. 2304(c)(1), as implemented by FAR 6.302-1(a)(2) and 6.302-1(c), Only one responsible source and no other supplies or services will satisfy agency requirements, and brand name descriptions.

5. Reason for Authority Cited: As described at FAR 6.302-1(a) (2), when the supplies or services required by the agency are available only from one responsible source, or for Department of Defense (DoD), NASA and the Coast Guard, from only one or a limited number of responsible sources, and no other types of supplies or services will satisfy agency requirements, full and open competition need not be provided for. As further described in FAR 6.302-1(c), an acquisition or portion of an acquisition that uses a brand-name description or other purchase description to specify a particular brand-name, product, or feature of a product, peculiar to one manufacturer does not provide for full and open competition, regardless of the number of sources solicited; and shall be justified and approved in accordance with FAR 6.303 and 6.304.

The proposed Original Equipment Manufacturer (OEM) for this effort is GrayShift, LLC.

GrayShift, LLC has one authorized reseller/partner of GrayKey software, Magnet Forensics.

USACIDC has a specific need for GrayKey produced by GrayShift, LLC to unlock warranted iOS devices, and do full data extractions of those devices in order to obtain evidence in criminal investigations. USACIDC currently receives approximately devices annually as evidence in criminal investigations. These devices need to be unlocked to obtain data that is critical evidence in several criminal investigations ranging in offenses from drug trafficking to sexual assault/rape and murder.

Only one other company has been identified to have the same capability, confirmed that they do not provide the software to unlock iOS devices, but that they provide unlock support by sending the devices physically to their locations. USACIDC has been using GrayKey’s offline version of extraction software for approximately a year, and have found it critical in obtaining evidential data from iOS devices. USACIDC’s use of multiple forensic software has resulted in the determination that more data can be extracted from iOS devices using GrayKey than with any other forensic tool. GrayKey is able to recover deleted data from iOS devices that is not recoverable by any other known forensic process. Currently, offers no forensic tools or software capable of extracting the same data that GrayKey can extract.

only offers a service that requires the shipment of the devices to extract data.

USACIDC’s primary forensic analytic software tool that is integrated in their forensic systems is Magnet Axiom. Magnet Axiom is capable of reading a GrayKey extraction more thoroughly than another forensic software. Over the last year, using GrayKey in combination with Magnet Axiom, USACIDC has been able to obtain critical evidential data, particularly in sexual assault cases, that could not be obtained using other forensic tools. Due to the high volume of devices USACIDC receives as evidence for high level cases every year, it is mission critical that USACIDC have the ability to do a full extract of the devices on site. USACIDC has a need to expand its inventory of this service to other offices in order to reduce the time it takes to process extractions of iOS devices, and obtain critical evidence needed for actionable leads in criminal investigations. Shipping the phones out to the few USACIDC offices that have the GrayKey software causes significant delays in the timeliness of the investigation and reporting. The minimum delay will be at least 14 days just for registered mail time and could be as long as 60 days waiting for processing at the U.S. Army Crime Lab or the Computer Crime Investigative Unit. The delay could result in the loss of actionable leads, or the possible destruction of unknown evidence by deletion or removal from the device. As stated above, GrayShift, LLC and Magnet Forensics are the only known sources for GrayKey.

6. Efforts to Obtain Competition: The Contracting Officer shall publish the notices required by FAR 5.201 and any bids or proposals received shall be considered.

a. Effective Competition: Effective competition will be achieved. This requirement shall be solicited under a brand name restriction, 100% Small Business Set-Aside.

b. Subcontracting Competition: Due to the nature of the requirement, the Government does not anticipate subcontracting opportunities. GrayShift, LLC and Magnet Forensics are identified as small businesses.

7. Actions to Increase Competition: In an effort to increase competition, the requirement was reviewed to determine the capability of other vendors aside from the OEM. It was determined that the OEM holds the proprietary source code for their software, and only has one current reseller.

As part of Market Research, this requirement was posted to the Federal Business Opportunities (FBO) website on 31 May 2019 seeking out potential interested and capable sources. The posting yielded no responses besides identifying Magnet Forensics as a reseller. The Government will continue to conduct market research to ascertain if there are any changes in the marketplace that would enable future actions to be competed without excluding sources. USACIDC will periodically monitor the market.

8. Market Research: USACIDC technical personnel are continually monitoring the marketplace.

Market research was conducted by the , HQ USACIDC. The market research was conducted in February 2019, and consisted of reviews of current USACIDC requirements, coordination with other law enforcement agencies, notifications in blogs of any potential new unlocking service that could compete with Advanced Unlocking and Extraction Services (CAS). The results were that GrayKey is the only known new product that came on the market in March 2018, and is the first competitor to CAS which had been the only service available to law enforcement to unlock iOS Devices. GrayShift, LLC’s GrayKey is the only product that could meet USACIDC’s current needs.

In accordance with Army Regulation 25-1 and Department of the Army Policy memorandum dated 04 May 2009, Computer Hardware, Enterprise Software and Solutions (CHESS) is the primary source for commercial information technology hardware, software and associated items.

Purchasers of commercial hardware and software must satisfy their information technology requirements by utilizing CHESS contracts and DoD Enterprise Software Initiative agreements first, regardless of the dollar value. A search on the CHESS website determined that there were no vendors that could satisfy the GrayKey requirement. Therefore, CHESS statement of non-availability number 216743902 was granted on 01 March 2019, and IT Approval System Waiver 20190306110621085 has been approved on 26 March 2019.

In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 205.205-71, DFARS 206.302-1(d), and DFARS Procedures, Guidance and Information (PGI) 206.302-1(d), a request for information, pre-solicitation notice was posted to the open market on FBO on 31 May 2019 for 18 days and the results were as follows:

from GrayShift, LLC provided email confirmation that Magnet Forensics is now a certified partner of GrayShift, LLC and able to provide GrayKey products. also provided a letter certifying that they now have one licensed reseller of GrayKey, however are subject to GrayShift, LLC’s approval.

Magnet Forensics verified that they are a certified partner of GrayShift, LLC and able to provide GrayKey products. of Magnet Forensics provided email confirmation that Magnet Forensics would provide a letter that would exclusively state they have a partnership with GrayShift, LLC. A review of Magnet Forensics website states that they are partnered with GrayShift, LLC.

provided email confirmation that would need to have the phones physically shipped to their forensic lab to perform this requirement, and that they do not provide software that can meet the requirement.

9. Interested Sources: See Paragraph 8 for the synopsis information. In response to the FBO notice, Magnet Forensics was identified as a certified partner of GrayShift, LLC.

10. Other Facts:

a. Procurement History:

(1) W15QKN-18-P-0053 was awarded on 11 July 2018.

(2) The previous action was competed as full and open (See (5) below).

(3) No authority was previously cited.

(4) Justification was not applicable.

(5) There were only two known contractors able to provide a forensic extraction solution, GrayShift, LLC and confirmed that they did not provide software for extraction, and only provided extraction as a service. did not participate in the solicitation.

(6) No unusual patterns.

(7) Justification was not applicable.

11. Technical Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

12. Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

13. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable. Fair and reasonable price will be determined by a price analysis, and comparative analysis to the independent government cost estimate as well as published market prices.

As a part of this basis, certified cost or pricing data will not be required, in accordance with FAR 15.403(b)(3), as this procurement is deemed commercial.

14. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.