Attachment_1_-_PWS_Cellebrite_Training.pdf

Performance Work Statement (PWS)

Technical Instructor Services for

Cellebrite Training and Certification

Midwest Counterdrug Training Center (MCTC) Overview: The Midwest Counterdrug Training Center (MCTC) is one of five National Guard Counterdrug training programs that provides relevant curriculum focused on counternarcotics and counter transnational organized crime (CTOC). MCTC provides courses that support National Drug Control Strategies and positively impact the performance of Federal, state, and local law enforcement agencies (LEA), community based organizations (CBO), and military professionals. Course curriculum focuses on illicit narcotics interdiction, disruption of drug trafficking organizations, intelligence and analysis, narco-terrorism, homeland security, civil operations, and anti-drug coalition fundamentals. Each course is designed to support the objectives of the DASD-CN, Office of National Drug Control Policy (ONDCP), National Northern Border, National Southwest Border, and Caribbean Border counternarcotics strategies and increase national security. MCTC supports Federal, state, and local agencies with current and relevant training maximized by the experiences of subject matter experts in their field. All training events are designed to not only offer world class instruction, but to break down jurisdictional barriers and offer a unique opportunity for officials across the law enforcement and prevention spectrum to network and share ideas in person.

MCTC is located at the Camp Dodge Joint Maneuver Training Center (CDJMTC) in Johnston, Iowa, and features state of the art classrooms and tactical training environments. With a training region that encompasses major international trafficking routes and national border ports of entry, MCTC’s courses strive to impact the illicit flow of drugs throughout the nation. Traditionally two-thirds of the course iterations are conducted throughout the primary training area using mobile training teams, while the remainder of the courses are taught using state of the art technology housed in classrooms located at CDJMTC. The training offered at MCTC is enhanced by access to a wide variety of military tactical training facilities such as weapons ranges, urban training areas, and a medical simulation training center located on CDJMTC to give the students realistic instruction and hands-on experience.

Requirement: MCTC has a requirement to provide Cellebrite training and certification to Military and Civilian analysts. The Cellebrite device is an advanced mobile forensic hardware and software extraction tool that assists analysts in the field with the decoding, analysis and reporting of actionable data from thousands of mobile devices, enabling them to analyze and evaluate activities of drug trafficking organizations (DTO) and transnational criminal organizations (TCO).

The Cellebrite Courses will deepen criminal analysts’ understanding of the Cellebrite Universal Forensic Extraction Device (UFED) and provide them with the necessary tools and skills needed to detect illegal drug trafficking criminal activities through their most common methods of communication by use of their cellular telephones. The purpose of the Cellebrite course is to

ATTACHMENT #1 Solicitation # W912LP-16-T-0005 train analysts in advanced analytic techniques so they can determine the vulnerabilities of DTOs and TCOs and identify opportunities to disrupt their activities.

This course should focus on enhancing the analysts’ ability to develop forensic investigative methods through the use of the Cellebrite device, and present analytic findings through the use of link analysis to various audiences. Upon completion of this course analysts should have a more in-depth understanding of the Cellebrite UFED, functions, and legal ramifications concerning cell phone forensics.

MCTC requires Cellebrite’s Commercial-off-the-shelf (COTS) training course that will include the Cellebrite Mobile Forensic Fundamentals (CMFF) course, the Cellebrite Certified Logical Operator (CCLO) course, Cellebrite Certified Physical Operator (CCPA) course, and the Certified Mobile Examiner Certification (CCME). This course shall begin on a Wednesday and run through the following Thursday, with no instruction scheduled for the weekend.

Student-centered, experiential, and facilitated learning. Hands-on, practical exercises, recent real-world scenarios, and relevant intelligence examples, as well as Socratic methods of facilitation/instruction, shall be used to the greatest extent possible.

Course Content:

Day 1 (Wednesday): CCFM (Cellebrite Mobile Forensic Fundamentals) Course

The Cellebrite Mobile Forensic Fundamentals (CMFF) Course provides the fundamental knowledge to comprehend and investigate incidents involving mobile devices. Participants are introduced to baseline concepts to ensure they gain the prerequisite knowledge to understand issues surrounding the handling of mobile devices as evidence and to attend the next in the series of the Cellebrite’s UFED Certification Training Series.

1. The Cellebrite Mobile Forensic Fundamentals (CMFF) course shall include the following blocks of instruction:

a. Introduction. This block shall deepen the analysts’ understanding of the Cellebrite UFED device.

b. Mobile device technology review

c. Mobile device forensic process

d. Seizure of mobile devices

e. Acquisition of mobile devices

f. Analysis of mobile devices

g. Verification and validation of findings

h. Summary

Day 2-3 (Thursday- Friday): CCLO (Cellebrite Certified Logical Operator) Course

The Cellebrite Certified Logical Operator (CCLO) Course builds on the concepts imparted in the CMFF course and exposes students to the fundamentals of mobile device investigations, logical extraction of user data, and analysis of mobile devices. Operation of the Cellebrite UFED product to perform a number of hands-on logical extractions on various mobile devices with a variety of operating systems is a key component of this class. Skill sets also include creating Safety SIMs and extracting evidentiary data from SIM cards. Participants also create reports on findings and are exposed to the free UFED Reader and how to use that to multiply investigative efforts.

1. The 2-day Cellebrite Certified logical Operator (CCLO) shall include the following blocks of instruction:

a. Mobile Device Technology Overview

b. Mobile Device Trends

c. Forensic Handling of Mobile Devices

d. UFED Technology Overview and Extractions

i. Logical Extraction

ii. Password Extraction

iii. SIM Extraction

iv. SIM Cloning (Safety SIMs)

e. Logical Analyzer Overview

i. Instant Search

ii. Filtering

iii. Advanced Filtering

iv. Bookmarking

v. Watch Lists (Keyword Searching)

vi. Project Analytics

vii. Malware Scanning

viii. Timeline Analysis

f. Reporting on Technical Findings

g. UFED Reader

h. Written Exam

i. Practical Exam

Day 4-6 (Monday-Wednesday): CCPA (Cellebrite Certified Physical Analyst) Course

The Cellebrite Certified Physical Analyst (CCPA) Course focuses on the use of Cellebrite’s UFED to perform file system extractions, physical extractions, password bypasses and the advanced analysis of evidentiary items using the UFED Physical Analyzer software.

1. The 3-day Cellebrite Certified Physical Analyst (CCPA) course shall include the following blocks of instructions

a. File Systems and Media Encoding

b. UFED Technology Overview

a. File System Extractions

b. Physical Extractions

c. Password Bypass

c. UFED Physical Analyzer Overview

a. Data Carving

b. Watch Lists (Keyword Searching)

c. Timeline Analysis

d. Project Analytics

e. Malware Scanning

f. Instant Search

g. Filtering

h. Advanced Filtering

d. Advanced Search Techniques

a. Find (Strings, Bytes, Dates, SIM)

b. Regex (GREP)

c. 7 Bit SMS PDU

d. Pattern

e. Code

f. Manual extractions from Unallocated Space

e. Verification and Validation of Findings

a. Hand Scroll Analysis

b. Database Verification

c. 3 Party Tools

f. Reporting on Technical Findings

g. Plug-in Chain Manager

h. Smart Device Overview and Challenges

Day 7 (Thursday): CCME (Cellebrite Certified Mobile Examiner) Examination

The Final Day of the course will include a review and preparation workshop to assist the students in preparing to successfully complete the CCME Examination; which will be given in the afternoon on site. The CCME examination consist of two parts:

Part I – Knowledge Examination is a timed examination that consists of 50 questions. The students will have 75 minutes to complete this portion of the CCME Examination.

Part II - Practical Examination is a timed practical examination. The students will have 135 minutes to complete this portion of the CCME Examination. It will includes 3 sections – one examination each on the Android, iPhone and Blackberry images. The students will have 45 minutes to complete each section of the Practical Examination. The students will be using Cellebrite's Physical Analyzer software to load and analyze three mobile device image extractions (one each for iOS, Android and Blackberry). Each device OS specific section of Part II is timed.

Target Audience:

Up to 20 National Guard Counterdrug Criminal Analysts or Law Enforcement Officers to include local, state and federal law enforcement; with an emphasis on NGB Counterdrug members, or Law Enforcement officers whose primary job involves the use of a Cellebrite Device.

Minimum Equipment and Role Players Provided by Contractor to each Student:

1. Student manual

a. Job aids and take-aways shall be provided wherever possible, particularly on intelligence tools, systems, and databases, so students have guides they can quickly and easily refer to in their workspaces.

b. Professionally and thoroughly researched and developed

c. Comprehensive, current, and relevant

d. Professionally organized, assembled and securely bound

2. CD / thumb drive. Optional, but if used, must be provided to each student.

3. All materials or equipment required to conduct the course, except those specifically indicated as provided by MCTC, shall be provided by the contractor.

Minimum Equipment Provided by MCTC:

MCTC will provide a classroom of adequate size to accommodate the number of students registered for each iteration of the course. Classroom will be equipped with Audio-Visual Equipment, and have internet capabilities.

Offeror/ Instructor Qualifications:

Cellebrite instructors will play an integral role in the success of this course and should be professional internal forensic training staff that have been vetted and approved as Cellebrite Certified instructors. Cellebrite instructors must have successfully completed the rigorous screening and instructor development process to have achieved the credential of Cellebrite Certified instructor from Cellebrite.

Course Evaluation Questionnaire:

The Government Facilitator for the course will provide students with an end of course evaluation. The evaluation, along with the COR observations, will be used to evaluate the quality of the course presentation/deliverables.

Periods / Places of Performance:

1. One base period (award date through 30 September 2016) that will include two (2) iterations with dates and locations to be determined by MCTC and coordinated with vendor.

2. Three (3) one-year option periods running 1 October through 30 September, with first option starting 1 October 2016 and last option terminating 30 September 2019; option periods will include up to three (3) course iterations each, dependent on funding and need determined by MCTC. Class location and dates will be determined by MCTC and coordinated with vendor.

3. The MCTC service area covers the 54 states and territories, and class iterations may be conducted at any location within this area. Most courses are conducted at the MCTC main campus at Camp Dodge, Johnston, Iowa or other locations within the continental United States.

Expenses:

1. All travel, lodging and meal expenses of the instructors will be incurred by the contractor.

2. All expenses related to printing and delivery of course materials are the responsibility of the contractor.

Homeland Security Presidential Directive-12 (HSPD-12) Considerations:

1. Routine access to Government-controlled facilities is not required.

2. Routine access to Government Information Systems (IS) is not required.

3. NACI or other security check is not required.

4. Government-issued identification and/or building passes are not required.

5. Contractor personnel do not require Government escort while performing work on a

Government installation.

6. Contractor is not required to provide employee and/or vehicle information for an Entry

Authorization List (EAL).