FBI To Ramp Up Social Media Surveillance

https://www.fbo.gov/index?s=opportunity&mode=form&id=fe943e551236e0e62ee0843d5803781e&tab=core&_cview=0

https://www.fbo.gov/utils/view?id=7b823d00244ef86237237563ab22a90e

Below is text of the attached pdf

Public Source Program Office
for the
Office of the Chief Information Officer
Social Media Alerting
Statement of Objectives
Request for Proposal
Number
DJF194750PR0000369
07/8/2019
Page 1 of 11FEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
1 Scope
This Statement of Objectives (SOO) describes the Federal Bureau of
Investigation's (FBI, or
“the Bureau”) requirements to proactively identify and reactively
monitor threats to U.S.
National interests, through means of online sources.
2 Background
The Public Source Program Office (PSPO) is a group within the Enterprise
License
Agreement Management Unit of the Office of the Chief Information Officer,
which manages
public records contracts, facilitates training and establishes guidelines
for usage and
account management.
This PSPO’s public records contract is in response to an increasing
number of threats to
U.S. national interests that are identifiable, with ever-greater
frequency, through social
media platforms. It is an acknowledged fact that virtually every incident
and subject of FBI
investigative interest has a presence online. Consequently, law
enforcement gaining lawful
access (i.e., access that is authorized, appropriate, and consistent with
applicable law and
policy) to this data will result in early detection and/or containment of
the magnitude of
any harm caused by these threats.
To protect US citizens, a method employed by the FBI is the acquisition of
subscriptions
granting access to tools. These allow for the exploitation of lawfully
collected/acquired
from social media platforms and stored, vetted and formatted by a vendor.
The mission-
critical exploitation of social media enables the Bureau to proactively
detect, disrupt, and
investigate an ever growing diverse range of threats. More specifically,
the Bureau
provides real-time situational awareness of indicators and warnings of
emerging social
media incidents.
All FBI Headquarters Divisions and Field Office personnel (government and
support
contractor) may receive the benefit of the information that is produced
under the instant
procurement action, should they require access to relevant data as part of
their duties and
responsibilities.
The need for social media, although identified as Enterprise wide in terms
of location,
stems from specific groups of users. Within each division and field
office, users from
various career paths are set on a Social Media Exploitation mission to
address a broad
range of threats. Specific mission groups that call for such a capability
include the
following:
Operations centers and watch floors. These are the groups within the
Headquarters and
Field Offices that ensure news and events are identified, vetted and
swiftly reported to the
appropriate action group. The functions of most value by these individuals
is early
notification, accuracy of information, and the ease by which information
is disseminated.FEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
Fusion centers. Operations-driven tactical teams that are deployed as soon
as an incident is
validated by the Operations center. The functions of most value by these
individuals is
early notification, the provision of accurate geo-locations, and the
mobility of the needed
capability.
Legal attaches. FBI personnel are deployed internationally and sometimes
in areas of press
censorship. A social media exploitation tool with international reach and
paired with a
strong language translation capability, can become crucial to their
operations and more
importantly their safety. The functions of most value to these individuals
is early
notification, broad international reach, instant translation, and the
mobility of the needed
capability.
Command posts. These are teams composed of power users assigned to the
proactive
monitoring of large events in a preventive stance, or deployed to a
theatre of operations in
a reactive stance. The function of most value to these individuals is
multi-layered geo-
fencing, strong analytical and prioritization algorithms, and analysis
with historical data
accessibility.
2.1 Accessibility
Bureau personnel and their authorized support-contractor personnel shall
be able to gain
access to the required information via web browser and through multiple
devices, to
include desktop and FBI-issued mobile devices hosting
contractor-maintained applications
downloaded onto the FBI device. Some mobile devices will require the
download of an
application. The latter can only be made available after thorough vetting
by the Mobility
program. The offer must include a technical a description, in the form of
a Contractor
Statement of Work (CSOW) to allow for initial assessment and evaluation of
compatibility.
3 Objectives
3.1 Program Objective
The objective of the PSPO is to centralize the acquisition of
subscriptions services to a
social media early alerting tool in order to mitigate multifaceted
threats, while ensuring all
privacy and civil liberties compliance requirements are met.
3.2 Contract Objective
The objective of this procurement-action is to acquire access to the data
needed for the FBI
to conduct social-media-alerting and related analysis.
3.3 Functional Objectives
Delineated below are the expected Outcomes (Critical Success Factors) to
be achieved by
the Contractor, along with associated Standards by which the Contractor is
to abide when
delivering the Outcomes (Key Performance Indicators) relative to the
Government’s access
to a social-media-alerting and analysis tool.FEDERAL BUREAU OF
INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
The Standard applicable to the achievement of any and all Objectives is
that any
information obtained and made available to the Government is lawfully
obtained.
3.3.1 Alerting
3.3.1.1 Outcome: The FBI receives advanced notifications of
mission-relevant incidents.
3.3.1.2 Standards
3.3.1.2.1 Information constituting advanced notification is derived from
constant
monitoring of social media platforms based on keywords relevant to
national security and
location.
3.3.1.2.2 Notifications are sent via email to either a team account or
individual user
accounts based on real time threat, incidents as they tie to the
geolocation of interest.
Selected tool must allow for customization of delivery frequency, content
of interest and
geographical layers by the user directly.
3.3.1.2.3 Content filtering supports prioritization; specific subjects,
identifiers, geographic
location, keywords, photographic tagging.
3.3.1.2.4 Users are able to select to monitor the development of a
notification-of-interest, as
well as seek relevant historical social media traffic for further analysis.
CONTINUED ON NEXT PAGEFEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
3.3.2 Analysis, display and sourcing
3.3.2.1 Objective: The FBI accesses historic data to identify profiles and
ramifications to
derogatory groups.
3.3.2.2 Standards:
3.3.2.2.1 Obtain the full social media profile of persons-of-interest and
their affiliation to
any organization or groups through the corroboration of multiple social
media sources.
3.3.2.2.2 Items of interest in this context are social networks, user IDs,
emails, IP addresses
and telephone numbers, along with likely additional account with similar
IDs or aliases.
3.3.2.2.3 Any connectivity between aliases and their relationship must be
identifiable
through active link analysis mapping.
3.3.2.2.4 The analytical mapping process is depicted through active links
between visual
data points (e.g., not just showing two entities are connected, but
showing key items of
connection when hovering over the link).
3.3.2.2.5 The data presented must be reliable, accurate and consistent.
3.3.2.2.6Users can perform individual queries, as well multiple queries at
once through
batching by uploading a spreadsheet of identifiers at once. Individual
query process is not
automated and requires user input of a single or multiple search criterion.
3.3.3 Geo Location, keywords and timeframe
3.3.3.1 Objective: The FBI exploits data in a real-time context, in both a
proactive and
reactive stance, based on location.
3.3.3.2 Standards
3.3.3.2.1 Online media is monitored based on location, determined by the
users’ delineation
or the import of overlays from existing maps (neighborhood, city, county,
state or country).
These must allow for customization as AOR sometimes cross state or county
lines.
3.3.3.2.2 Traffic on area types described in 3.3.3.2.1 is filterable and
customizable by
keywords related to special or significant identifiers (keywords,
usernames, handles).
3.3.3.2.3 Geolocation and keywords presented in 3.3.3.2.1, 3.3.3.2.2 allow
for specific
timeframe query with start and end fields that can be populated with date
and time. This
allows for monitoring and filtering directly after or as the significant
event develops.
3.3.4 Security
3.3.4.1 Objective: The FBI receives immediate notification and support by
the contractor for
any possible computer security breach incidents exposing FBI information.
3.3.4.2 StandardsFEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
3.3.4.2.1 The FBI is notified of possible, potential and currently
occurring incidents
impacting the vendor’s interface.
3.3.4.2.2 The Contractor provides the FBI with technical points of contact
and supporting
technical documentation (i.e., systems configurations, related security
files, contingency
plan and recovery process) with its notification as well as the assessed
magnitude of FBI
user information exposed.
3.3.5 Queries
3.3.5.1 Objective: Any information inputted or provided by FBI personnel
for input into the
vendor’s interface remains protected.
3.3.5.2 Standards
3.3.5.2.1 Searches conducted on the Contractor’s interface by FBI
personnel remain
untraceable under Blind Login.
3.3.5.2.2 Entries, activities such as saved searches and links activated
remain untraceable
and cannot be stored by the offeror or used to create alert profiles
presented or used by
other agencies, without the FBI’s consent.
3.3.5.2.3 Searches remain non-attributable.
3.3.6 Reporting
3.3.6.1 Objective: The FBI is informed of any potential or actual computer
security incidents
involving or potentially involving FBI information or users.
3.3.6.2 Standards
3.3.6.2.1 The FBI is informed of any potential or actual computer security
incidents as soon
as the Contractor becomes aware of the issue. The Contractor notifies the
FBI immediately
in the event of a breach of FBI information involving personally
identifiable information of
FBI personnel (e.g. First and/or last name, email, phone number, location).
3.3.6.2.2 Logging of FBI personnel queries are limited to the collection
of numeric metrics
for usage monitoring (Occasionally, the FBI may require data logging for
the purposes of
internal investigations, testing, debugging or usage monitoring. This will
only be done
through the explicit written permission of the FBI and with specific
limitations).
3.3.7 Training and Testing
3.3.7.1 Outcome: FBI personnel receive training on the Contractor’s
related tools and
techniques.
3.3.7.2 Standards
3.3.7.2.1 Holders of newly created accounts receive initial training when
first gaining
access credentials to the Contractor’s tool.FEDERAL BUREAU OF
INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
3.3.7.2.2 Refresher trainings is provided whenever a new release of the
Contractor’s tool is
released.
3.3.7.2.3 Material conveying changes and/or enhancements are made
available to each
user.
3.3.7.2.4 Training material is accessible via the Contractor’s interface
and/or video-sharing
platform, in compliance with standards set forth in Section 508 of the
Rehabilitation Act of
1973.
3.3.7.2.5 For written online material, soft copies undergo review and
obtain validation after
each major release.
3.3.7.2.6 Two one-hour monthly online training sessions are made available
for each user.
3.3.7.2.7 One of the monthly training sessions is directed to new users
and introduce the
capability, where to find resources, basic trouble shooting steps,
helpdesk structure, and
POCs.
3.3.7.2.8 The second monthly training session is focused on new features,
system upgrades,
and best practices derived from usage.
3.3.7.2.9 A course outline is provided to the PSPO Training Coordinator
for review and
approval prior to dissemination.
3.3.8 Helpdesk
3.3.8.1 Outcomes: FBI personnel with access or other issues obtain support
from designated
helpdesk personnel.
3.3.8.2 Standards
3.3.8.2.1 Designated helpdesk personnel are familiar with the
sensitivities of government
and law enforcement.
3.3.8.2.2 A specific email address is established and maintained for FBI
personnel and
authorized support contractor personnel to seek assistance.
3.3.8.2.3Requests for helpdesk assistance are acknowledged within 60
minutes.
3.3.8.2.4 Helpdesk personnel adequately protect the confidentiality of
inquiries by users.
3.3.8.2.5 Helpdesk personnel adequately ensure the legitimacy of the call
recipient.FEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
4 Contract POCs
For daily operations the PSPO will be the direct counterpart to the
Contractor’s
management personnel and will provide guidelines for communication.
Announcements
and general notifications will be conveyed to users through the PSPO,
unless the selected
offeror is responding to a direct helpdesk inquiry.
No communication pertaining to new capabilities, business development,
surveys or
contract notification are to be addressed by the Contractor directly to
the users, without
the approval of coordination of the PSPO staff.
4.1 Contracting Officer (CO)
The CO is the appointed authority to bind the Government to the extent of
the authority
delegated. Direction that will modify the scope, schedule, terms and
conditions, funding, or
any other action that may modify the agreement, as originally entered into
with the
Government, must be given only by the CO.
Name: Garland Crosby
Title: Contracting Officer
Phone: (202) 324-9013
E-mail address: GLCrosby@fbi.gov
4.2 Contracting Officer Representative
The COR will be identified via letter of COR delegation authority issued
by the Contracting
Officer (CO) for this contract. The COR is responsible, as applicable,
for: receiving all
deliverables; inspecting and accepting the supplies or services provided
hereunder, in
accordance with the terms and conditions of this contract; providing
direction to the
Contractor which clarifies the contract effort, filling in details or
otherwise furnishing
information necessary to accomplish the SOO; evaluating performance; and
certifying all
invoices/vouchers for acceptance of the supplies or services furnished for
payment.
The COR does not have the authority to alter or modify the Contractor's
obligations,
contract terms, conditions, specifications, or cost. If as a result of
technical discussions, it is
in the Government’s best interest to alter/change contractual
obligations or the SOW, the
CO will issue such changes:
Name: TO BE ANNOUNCED AT THE TIME OF AWARD
Title:
Phone:
E-mail address: j
4.3 Program Manager
The program manager is responsible for all day-to-day operations of the
program, as well
as maintaining its history for auditing purposes, and defining the way
ahead that will
ensure full exploitation of the acquired capabilities. The program manager
will establish
and coordinate the quality control, training deployment, and user account
administration
as his/her team will serve as the liaison between the offerors and the end
users. TheFEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
program manager will coordinate, attend, and report on the mandatory
monthly meetings
held with awarded offerors.
Name: TO BE ANNOUNCED AT THE TIME OF AWARD
Title:
Phone:
E-mail address:
5 User account management
Access to public records data must remain within the investigative
confines, and
therefore, must be internally closely monitored. The offeror must provide
account
and username management. Since users span across all Field offices and
Resident
Agencies (RAs) as well as HQ Divisions, the monitoring of accounts along
with usage
will require different levels of administrative rights.FEDERAL BUREAU OF
INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
5.1
Public Source Program Office Administrative accounts
5.1.1 Structure
5.1.1.1 Outcome: Autonomous user administration by the FBI
5.1.1.2 Standard
5.1.1.2.1 Social Media SMEs are present within each Field Office and
division and serve as
local user administrators. Administrative rights accounts allow for local
creation,
maintenance and deletion of user accounts within their respective Field
Offices and HQ
Divisions.
5.1.1.2.2 Administering their local users is a collateral function as
these SMEs are heavily
embedded in their area of mission expertise. Therefore they need system as
well as
administrative access rights.
5.1.1.2.3 At the Program level, Super Admin accounts allow for the
creation, maintenance
and deletion of the administrative accounts described in 5.1.1.2.1. Super
administrative
accounts do not require system access or user view as their purpose is
solely
administrative.
5.2
Monitoring and reporting
5.2.1 Reports
5.2.1.1 Outcome: The FBI must be able to monitor usage to assess the
operational value
gained from the capability.
5.2.1.2 Standard:
5.2.1.2.1 Monthly reports are received by the 10th of each month.
5.2.1.2.2 These monthly reports are distributed via email to the
aforementioned FBI
Contracting Officer and Contracting Officer’s Representative (COR). Any
additional
recipient must be approved by the COR.
5.2.1.2.3 Monthly reports are delivered in an excel file format. The
monthly report includes
all the below:
 Activities, Accomplishments, and Issues reports
 Monthly Summary and Detailed Usage reports (metrics only, no content)
o individual account
o team account
o batching
 Monthly Account Listing reports broken down by field office
o New accounts
o Deleted accounts
o Transferred accounts
 Completed training sessions broken down by locations, subject and list
of attendeesFEDERAL BUREAU OF INVESTIGATION
Social Media Alerting
Statement of Objectives – ATTACHMENT TWO
5.2.2 Monthly Meeting
5.2.2.1 Outcome: The purpose of these meetings is to review the monthly
activities presented
in the monthly report, address any issues reported to the program and
monitor the
contract progress.
5.2.2.2 Standard:
5.2.2.2.1 Meetings occur every month and can be held via conference call,
but occur in
person at least once every quarter with the COR/PM in attendance.
The standard agenda is below but can be modified as needed
- Contract
o Invoice status
- Reports
o Usage (Previous Month and Current Fiscal year to date)
o Account maintenance activity
- Training
o Completed trainings to date (current FY)
o Upcoming trainings
- System upgrades/changes
o Release notes
o Impact on users
- Vendor’s new capabilities and recommendations
o Presentation
o Pricing model (license/account/usage)
6 Release of information
The FBI specifically requires that Contractors shall not exploit for
interface development,
disclose information or produce material acquired as a result of, or
derived from
operational activities of FBI personnel on their interface.
For purposes of this Clause, "Information" shall include, but is not
limited to: in any media
or all media including on the web or websites, publications, studies,
books, theses,
photographs, films or public announcements, press releases, describing any
part of the
subject matter of this contract or any phase of any program hereunder,
except to the extent
such is:
(i)
Already known to the Contractor prior to the commencement of the contract.
(ii)
Required by law, regulation, subpoena or government or judicial order to be
disclosed, including the Freedom of Information Act.
No release of information shall be made without the prior written consent
of the Office of
Public Affairs and the Contracting Officer. The contractor and author are
warned that
disclosure is not without potential consequences. The FBI will make every
effort to review
proposed publications in a timely manner to accommodate these and other
publications.
These obligations do not cease upon completion of the contract.