USSOCOM Digital Forensics Tactical Document and Media Exploitation (DOMEX) Event 2016 Request for Information This Request for Information (RFI) is not a solicitation for proposals, proposal abstracts, quotations or obligation on the part of the Government to acquire any products or services, but for planning purposes only. This RFI is to gain knowledge of potential qualified sources and to explore industry capabilities. Your response to this RFI will be treated as information only. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of submission to this announcement or the Government use of such information. The information provided may be used by the United States Special Operations Command (USSOCOM) in developing its acquisition strategy, statement of work/statement of objectives, and performance specifications. Interested parties are responsible for adequately marking proprietary or competition sensitive information contained in their response. The Government does not intend to award a contract on the basis of this request for information or to otherwise pay for the information submitted in response to this RFI. Responses to this RFI will be used by the United States Special Operations Command (USSOCOM) Special Operations Forces Acquisition, Technology and Logistics (SOF AT&L), the Program Executive Office - Special Reconnaissance, Surveillance and Exploitation (PEO - SRSE), specifically the Program Manager - Sensitive Site Exploitation (PM-SSE) to identify potential sources to participate in the assessment event of digital forensic devices capable of document and media exploitation in May of 2016 in the Tampa, Florida area. All hardware/equipment submitted for testing shall be production models and capable of executing document and media extraction from a variety of electronic media devices. While prototypes that meet the majority of the capabilities listed in Attachment 1 are allowed, the expectation is that all devices will be final product versions and meet the capabilities detailed in the Attachment 1 Planning Document. Device assessment will consist of two independently conducted events: A. Technical assessment to confirm the quality and accuracy of device performance and output. B. Operator input to determine usability and suitability for SOF personnel. The preliminary schedule of events (subject to change) is as follows: NLT 1 Feb 2016- Interested Manufacturer's/Vendor response to this RFI. Responses should include identification of the primary point(s) of contact with phone and e-mail information, proposed existing or near term hardware and/or software meeting the digital forensics tactical DOMEX event device requirements outlined in Attachment 1, and preferred TILO date to present the devices via the Technology and Industry Liaison Office (TILO) at USSOCOM (please see the next item below). 8-12 Feb 2016- TILO presentations: this is a pre-assigned window for interested Vendors to present their proposed equipment to meet the Attachment 1 capabilities. These presentations will be coordinated with the Technology Industry Liaison Office (TILO) at USSOCOM. The POC is Ms. Shelvin Watts at 813-826-9482. 17 Feb 2016 (optional)- Optional follow-on pre-coordinated TILO Vendor presentation dates. Please note, any follow-on TILO presentations will be at HQ USSOCOM's discretion. 22 Feb 2016- Invitation to Vendors to participate in the assessment event. HQ USSOCOM will provide feedback to all vendors who participated in the TILO presentations. Those with devices that USSOCOM judges to have the best potential to meet the Attachment 1 capabilities will be invited to participate in the DOMEX event and asked to agree to a vendor loan agreement (VLA) for the use of their devices. 26 Feb 2016- Deadline for Vendors to notify USSOCOM SOF AT&L, SRSE, PM-SSE of their intent to participate in the digital forensics DOMEX event and return the completed VLAs for their devices and any associated items. 15 Mar 2016- Vendors deliver (on-loan) five fully functional devices and associated items for technical assessment (part A. above). 21 - 25 Mar 2016- Vendors train USSOCOM testers and Subject Matter Experts (SMEs) on the use of their device(s). Training location will be in the Tampa, Florida area. Training will be limited to eight hours per device and must include proper use of the device and troubleshooting. Vendors are expected to train the USSOCOM testers to the point where the testers can operate the devices during the technical event. 28 Mar - 25 Apr 2016- Conduct of the digital forensics DOMEX Event. Vendors will not participate in the actual events conducted jointly by USSOCOM and the Joint Interoperability Test Command (JITC), but may be asked to address questions or issues by phone or e-mail during the event. Vendor equipment will be retained by USSOCOM for operator use during the Limited User Assessment in May 2016. 9 -20 May 2016- Limited User Assessment conducted by JITC at a site in Tampa, Florida. Vendors are encouraged to provide an eight hour block of instruction to the operators on the use of their devices. 3 Jun 2016- All Vendor equipment and hardware returned no later than this date. Once the information is received, USSOCOM may publish a synopsis requesting further information and industry comments on a refined set of requirements along with a draft acquisition strategy and milestone schedule. All responses shall be submitted to the Test Directors, Charles A. Colletti,
[email protected], and Luther Lancaster,
[email protected] and the Deputy Program Manager - Sensitive Site Exploitation, Ms. Jessica Fritz,
[email protected]. This announcement is a request for information/comment only and does not constitute a Request for Proposals (RFP). An RFP may be posted on Fed Biz Ops at some future time. However, the Government does not guarantee any action beyond this RFI. Attachment 1: USSOCOM Digital Forensics Tactical Document and Media Exploitation (DOMEX) Planning Document Introduction: SOF requires a means of rapidly extracting and analyzing data from electronic media in support of digital forensics activities, including, but not limited to computers, tablets, and smart phones, using portable devices that while configured for transport, do not obviously reveal their function. SOF should be able to accomplish all tasks with eight hours or less of training, and require no more than eight hours annual refresher training to maintain basic proficiency. This analysis does not include cellular exploitation other than media. This event will assess the accuracy of Vendor provided devices to meet or exceed the following Special Operations Forces (SOF) Capability Requirement for data analysis and should yield results contributing to the following intelligence tasks: • Intelligence Task 1. Support Operational Preparation of the Environment. • Intelligence Task 2. Link people, places, events/activities, and materials/devices collected. • Intelligence Task 3. Provide insight into adversary organization, communications, and plans. System Testing Requirements: Requirement 1: The Vendor shall deliver five devices for assessment including any required software or peripherals. Requirement 2: Extraction devices and aids must be trainable to a basic level of proficiency for individuals familiar with forensic software and hardware within eight hours. Requirement 3: Operator level interface should be intuitive, guided by on board operating aids or wizards. Requirement 4: In 30 minutes or less, using on-board power and no external communications, the capability of the device should be able to fulfill the following prioritized digital forensics requirements: Note: System testing requirements are different than system requirements. System requirements are defined by the program office and the user. Testing requirements are functions that are required to conduct the testing and may be lesser requirements than those of the program office. Capability prioritization: • Produce a forensically sound image of the target device, • Extract file and user-created metadata such as filenames, hash numbers, date-time stamps, etc. and compare to an onboard watchlist, • Locate and extract personal identifying information (PII) such as names, addresses, telephone numbers, e-mail addresses, chat user names, social media user names, etc. and compare to an onboard watchlist, • Examine, extract internal file content for key words and phrases in pre-defined items of interest and compare to an on-board or data-linked watchlist, • Extract files, including documents, images, e-mail, calendar entries, messaging tools, and social media files identified as pertinent to a specified examination, • Examine user-configuration settings, • Extract memory device characteristics such as directory structure, file sizes and locations, • Identify software used to embed and recover messages in finished products, draft files, or other human or machine-interpretable files, • Identify software used to conceal or delete activity, • Identify unknown file types and correlate to supporting applications, • Display in detail what has been collected from a device, • Create an operator-configurable output that is interoperable with standard MS Office applications (i.e., Word, Excel, .txt, .rtr, .csv), • Device should save all captured data in the event of interruption (rapid disconnect), • Device should survey digital media and acquire properties associated with memory drives and devices. Note: Vendor provided devices will be cleaned/ wiped of any test data prior to the return to the Vendor after the conclusion of the test. The Vendor is requested to provide extraction software to completely clean/wipe all devices used for testing.