FALCON Operations

U.S. Immigration g_l and Customs Enforcement FALCON Operations and Maintenance Services, Including Accommodation of the Addition of and EID-Related Data Sets Limited Source Justification (LSJ) This acquisition is conducted under the authority of the Multiple Award Schedule Program, Title of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 3102, et seq), Title 40 U.S.C. 501, Services for Executive Agencies, and is justified by the following facts and rationale under FAR and FAR 1). 1 Agency and Contracting Activity Department of Homeland Security (DHS) Immigration and Customs Enforcement (ICE) Office of Acquisition Management (OAQ) Information Technology Architecture and Development (ITAD) 801 I Street NW Washington, DC 20536 2 Nature and/or Description of the Action Being Approved This requirement is for brand name licenses and operations support and maintenance from Palantir Technologies (located at 100 Hamilton Avenue, Suite 300, Palo Alto, CA 94301) as the single available source and brand name under the authority of the Multiple-Award Schedule Program. This task order modification to HSCETC-13-F-00030 entails a irm--Fixed price General Services Administration (GSA) Schedule 70 purchase that includes Palantir perpetual licenses and armual support and maintenance services. This LSJ lays out the requirement for a modification of the existing FALCON front-end interface. A FALCON-DARTTS (Data Analysis and Research for Trade Transparency System) extension to the existing interface will allow the Trade Transparency Unit (TTU) of ICE to manipulate and analyze a very large data set of information related to international trade. The TTU currently utilizes a stand-alone, legacy system named DARTTS to analyze trade-related data sets; however, the contract to maintain DARTTS expires on December 31, 2013. The data heretofore contained within DARTTS will be migrated under a separate contract to the Authoritative ICE Data Warehouse however, will be temporarily stored within the FALCON system until the AIDW is fully operational. The AIDW contract has been awarded; however, it is not anticipated to be fully operational to handle DARTTS until March 2014. The plarmed extension of FALCON's existing front-end interface will act as a workflow management module that will support the management and sharing of information regarding international trade transactions. It will allow employees of the TTU and their foreign partners to continue to analyze trade and financial data to identify statistically anomalous transactions that may warrant investigation for money laundering or other import-export crimes. This extension of the existing FALCON interface will

also allow HSI agents and outside the TTU to access financial and trade-related data which, until now, has only been available to the employees of the TTU. This increased information sharing will significantly enlarge the universe of data available to and agents working investigations and operations outside the TTU's purview but related to financial transactions and trade, increasing the overall effectiveness of HSI's operations and investigations. Additionally, during the first option year of the task order another large data set of considerable value to ICE Special Agents and intelligence will be migrated under a separate contract to the AIDW and made available to FALCON users. This is the Enforcement Integrated Database (EID), a large set of data related to the investigation, arrest, booking, detention, and removal of persons encountered during immigration and criminal law enforcement investigations and operations conducted by ICE and U.S. Customs and Border Protection (CBP). As with the DARTTS-related data set, additional Palantir Gotham perpetual licenses/server cores need to be procured to maintain the existing performance levels of the FALCON system while FALCON users are accessing this newly available, very large EID data set. The value of Palantir Gotham as a product is the logical linkage, which can be made between various bits of data (information about persons, locations, events, vehicles, and other items of law enforcement interest) residing in vast data sets that would otherwise be unconnected. The utility of the system and the value it adds to law enforcement investigations increases exponentially as more data sets are added. 3 Description of Supplies/Services The base Period of Performance for the current task order will entail the extension of the existing FALCON front-end interface to incorporate a new view, FALCON-DARTTS. This extension to FALCON will allow TTU employees to continue to analyze and manipulate very large sets of international trade-related data previously accessed via DARTTS. The extension to the FALCON front-end will enable a workflow management process to support the management and sharing of information regarding international trade transactions. Additionally, it will allow employees of the TTU and their foreign partners to analyze trade and financial data to identify statistically anomalous transactions that may warrant investigation for money laundering or other import-export crimes. HSI Agents and assigned to the TTU must understand the relationship between importers and exporters and the financing for a set of trade transactions to determine which transactions are suspicious and warrant investigation. Palantir Technologies includes software customization work performed on their Gotham software product in the twelve months of Operations and Maintenance services that are included in the price of a Palantir Gotham perpetual license/server core, as well as Operations and Maintenance support services sold for subsequent one-year increments. Purchases of an additional 176 Gotham perpetual licenses/server cores are required in order to maintain the existing levels of performance of the FALCON system once FALCON users begin accessing this newly available, very large DARTTS-related data set. By way of comparison, the data sets currently ingested within FALCON total approximately 300 million data records; however, the DARTTS-related data set comprises approximately 3 billion data records/obj ects, or ten times the amount of data currently ingested within FALCON. Trying to access the DARTTS-related data set utilizing the 56 server cores/Gotham perpetual licenses currently deployed would overwhelm the existing installation's capacities and would significantly slow down the search times for data; hence the requirement for 176 additional server cores. Though the 3 billion data records/obj ects will have some

redundancy, these redundancies will take time to rectify. Even after the redundancies have been cleaned up, the increased data records would still continue to overwhelm the system if only the current 56 server cores/Gotham perpetual cores/Gotham perpetual licenses currently deployed were used. The TTU examines U.S. and foreign trade data to identify anomalies in trade transactions that may indicate trade-based money laundering or other import-export crimes that ICE is responsible for investigating. Maintaining the current, standalone DARTTS, with its trade and financial data separated in its own silo and not accessible to ICE Agents and outside the TTU, impedes the effectiveness of other ICE investigations and operations outside the TTU's purview. During the base Period of Performance, the contractor shall replicate the functionalities of the existing DARTTS in a new FALCON-DARTTS module, which will be an extension of FALCON's existing front-end interface. This module will consist of two workflow applications, one accessible by ICE employees of the TTU, and the other will be a more limited workflow application accessible by the TTU's foreign partners and Agencies of foreign Governments that are involved in the investigation and prosecution of trade-based crime. Additionally, data currently contained within the existing DARTTS will be made accessible with appropriate access controls to the larger user base of FALCON-SA (Search and Analysis). For expediency's sake, DARTTS data will initially be stored and accessed using Palantir's big data environment, named Phoenix. Ultimately, this data will reside within the AIDW Big Data Environment (BDE). Once DARTTS data has been migrated to AIDW, it shall be indexed, but not stored, on FALCON servers. During the Option Years of this task order, should the options be exercised, the contractor shall extend the functionality of FALCON-DARTTS beyond the capabilities inherent in the existing DARTTS. Although employees of the TTU and their partners in foreign governments will continue to analyze and manipulate the DARTTS-related data set in their accustomed fashion after the transition to FALCON as their analytical tool, the DARTTS-related data will also be made available, for the first time, for the analytical, investigative, and operational needs of the larger group of HSI Special Agents and intelligence (over 6,000 and growing) who utilize ALCON-SA (Search and Analysis) and the web-accessible versions of ALCON. The Gotham software upon which FALCON is based does not segregate data contained within individual data sets when searches are performed or charts or other products are created (unless user access rules require this for a particular individual user or subset of users). Rather, if a user searches on a particular Person, Event, or Object, all records connected to that Person, Event, or Object which are accessible to FALCON are called up. Thus, if "John Doe" has records which originate in the DARTTS-related data set, the TECS data set, the SEACATS data set, and the TLS data set (all once-separate data sets which have either been ingested into or made accessible to FALCON), should a FALCON user Search for "John Doe," a multitude of records and information will appear on a single screen or linkage chart, bits of information which were formerly separated into their own data silos. This is the primary benefit of using a single, consolidated analytic tool such as ALCON, rather than asking Special Agents and intelligence to search multiple, separate data silos using multiple, separate analytic tools. Also, as various users build linkages between "John Doe" and all of "John Doe's" associated Persons, Events, and Objects, those linkages will be visible to other users who search for "John Doe" in the future. None of these investigative and analytic advantages would be available to users if they were forced to utilize a

suite of separate analytic tools accessing a variety of separated data silos, rather than using a single analytic tool with a consolidated warehouse of data or consolidated index of data elements. Option Year 1 of this task order will entail the integration of an additional large data set, the Enforcement Integrated Database (EID). EID is an ICE-owned shared common database repository for several DHS law enforcement and homeland security applications. EID captures and maintains information related to the investigation, arrest, booking, detention, and removal of persons encountered during immigration and criminal law enforcement investigations and operations conducted by ICE and U.S. Customs and Border Protection (CBP). This data set currently resides within the AIDW. Palantir Technologies will ensure that the EID data can be remotely accessed and searched by users of the FALCON system and that end users will not experience any significant degradation of performance while searching/manipulating data accessed remotely versus searching/manipulating data ingested directly into the FALCON system. Purchases of an additional 80 Gotham perpetual licenses/server cores are required in order to maintain the existing levels of performance of the FALCON system once FALCON users begin accessing this newly available, very large EID-related data set. By way of comparison, the data sets currently ingested within FALCON total approximately 300 million data records; however, the EID-related data set comprises approximately 100 million complex data records/objects, including hundreds of thousands of photographs. Trying to access the EID- related data set utilizing the 56 server cores/Gotham perpetual licenses currently deployed would cause significant performance degradation to the FALCON system; hence the requirement for an additional 80 server cores. Option Years 2-4 of this task order will entail the integration of potentially 20 other, smaller data sets, each of which must be approved by the FALCON Integrated Program Team (IPT) for inclusion in the FALCON system before those data sets may be made accessible to FALCON users. These smaller data sets may reside within the AIDW, within the ICE BDE, or may be ingested within the FALCON system itself. Palantir Technologies will ensure that these data sets, if not directly ingested within the FALCON system, can be remotely accessed and searched by users of the FALCON system, and that end users will not experience any significant degradation of performance while searching/manipulating data accessed remotely versus searching/manipulating data ingested directly into the FALCON system. Initial analysis of these other potentially added data sets indicates that they can be accommodated Within FALCON without causing significant performance degradation, so long as additional performance space within already installed server cores is recovered through a process of elimination of duplicate records of data which is both already ingested within FALCON and contained within the DARTTS-related data set, and the optional purchases of 8 additional server cores/Gotham perpetual licenses already incorporated into the base contract are exercised. The additional data sets are listed below. Human Smuggling and Trafficking Center (HSTC) data Student Exchange Visitor Information System (SEVIS) Law Enforcement Support Center (LESC) data National Security Entry and Exit Regulation System (N SEERS)

Arrival and Departure Information System (ADIS) Automated Targeting System National Crime Information Center (N CIC) Border Crossings from Treasury Enforcement Computer System (TECS) . Consular Consolidated Database (CCDI) 10. Computer Linked Application Information Management Systems (CLAIMS) 11. TECS Images 12. ICE Gangs Database 13. Exodus Accountability Referral System 14. United States Visitor and Immigrant Status Indicator Technology (US-VISIT) 15. I-94 data 16. data from Intelligence Fusion System (IFS) disposition The base period of performance for FALCON-DARTTS is from September 14, 2013 through March 13, 2014 with four (4) option periods of 1 year each. The option to extend services, per FAR 52.217-8, will be evaluated at time of award. The Independent Government Cost Estimate (IGCE) value, based on the current GSA contract pricing with discounts proposed by the vendor in order to accommodate the sunsetting, replication, and enhancement of an existing systems, is as follows: Base (6 months) .. $1,218,374.08 Option year 1 .. $3,632,591.52 Option year 2 .. $3,672,696.32 Option year 3 .. $3,672,696.32 Option year $3,672,696.32 FAR 52.217-8 (6-month $1,836,348.16 Total .. $l7,705,402.72 The total estimated value of the task order, to include FALCON Operations and Maintenance services, training services, and the accommodation of DARTTS-related and EID-related data sets in the FALCON system is $33,049,177.98. 4 Identification of Statutory Authority Permitting Other Than Full and Open Competition ICE requires software licenses peculiar to Palantir Technologies IAW 41 U.S.C. 3102 et. seq, as implemented under Federal Acquisition Regulation (FAR) Subpart FAR 8.405- 6(b)(l ICE also requires software maintenance services, services, and training, on existing software from Palantir Technologies IAW 41 U.S.C. 3102 et. seq., as implemented in FAR 8.405- only one source is capable of providing the supplies or services required because the supplies or services are unique or highly specialized. Since its inception in 2011, FALCON has served as ICE HSI's primary, unified data analysis system, providing data search, data deconfliction, intelligence analysis, charting and graphing, geospatial tracking, and field operation support services. FALCON is intended to supersede the

pre-existing, non-optimal situation of data sets separated in their own data silos, each having its own analytic front end. In the previous situation, HSI Special Agents and intelligence needed to log onto multiple, incompatible systems to do searches on separated data sets and an analysis of interrelated records from these separate data sets had to laboriously be performed manually. FALCON, as a unified analytic platform, greatly increases the efficiency and effectiveness of law enforcement--related data analysis in HSI. The value of FALCON to HSI increases with each new data set that is made available to the FALCON user base. FALCON is based upon Palantir Gotham, a proprietary Commercially Available, Off-the-Shelf (COTS) software product produced and sold solely by Palantir Technologies. Currently, has approximately 1600 plus agents and using the FALCON system for numerous on-going investigations and workflow applications. Another 4,500 Special Agents utilize a slimmed-down, web-accessible version of FALCON called FALCON to perform searches of the data ingested in or accessed by the full FALCON system. Palantir Gotham has been modified for ICE's specific requirements and has been internally renamed as FALCON. The extension of the existing FALCON front-end interface with a FALCON- DARTTS module and the addition of financial/trade data to the universe of data already ingested or accessed by FALCON will allow agents and employed by the TTU to share vital information with agents and working investigations and operations outside of TTU's purview but related to financial transactions and trade, increasing the overall effectiveness of HSI's operations and investigations. Adding access to the EID data set will give FALCON users the ability to call up over 100 million records and photographs related to HSI's and CBP's encounters with and arrests of immigration offenders and to link that data with data contained in complementary data sets already ingested in or accessed by FALCON. The value of Gotham as a product is the logical linkage that can be made between various bits of data (information about persons, locations, events, vehicles, and other items of law enforcement interest) residing in vast data sets that would be otherwise unconnected. The utility of the system and the value it adds to law enforcement investigations increases exponentially as more data sets are added. Beyond the base Period of Performance and Option Year One, the additional server cores/Gotham perpetual licenses purchased in order to accommodate the analysis of DARTTS- related and EID-related data sets will require Operations and Maintenance support. Continued software maintenance support (Software Maintenance as a Service, which is priced in the GSA Schedule per installed server core) is needed for the underlying Palantir software. Without updates to the software, there is an increased risk that the FALCON system could stop working properly or could be made unstable or compromised by invasive software viruses or other malware. In addition, failure to acquire Software Maintenance as a Service would severely limit HSI's ability to access additional data sets that have been requested by the ICE user base and limit the FALCON system's utility as an investigative tool. Use of Palantir Gotham and the FALCON system is intended to increase over the life of the order. The FALCON Integrated Program Team (IPT) is currently vetting requests from the HSI user base for the addition of a dozen more ICE, CBP, and law enforcement-related data sets to FALCON. DARTTS was approved by the FALCON IPT as a major data set to be added to the system. Growth in the numbers of users of the full application, number of data sets ingested within FALCON, and use of the Phoenix service to access remote data sets (due to the fact that

Phoenix builds indexes that will reside on FALCON servers) will require the purchase of additional server cores/Palantir Gotham Perpetual Licenses. These additional licenses will also require annual Maintenance and Support services to allow for updates to the Gotham software, software patches to prevent malicious code/security incidents, and provision of Help Desk and desk-side support services for the user base (Maintenance and Support for the initial year/year of purchase is included in the purchase of a Palantir Gotham Perpetual License). Additional software licenses to support the increase in users and data sets can only be purchased by Palantir. Palantir is the only supplier that can provide the licenses since only they have access to the system's source components. The additional Palantir Gotham licenses will allow ICE to maintain and update current databases with the most accurate information for the additional end users. Since the Palantir software products are proprietary, Palantir has stated that only Palantir is the authorized seller and distributor of its software products and provider of any required maintenance services for its software. Palantir has also not authorized any other vendor to provide training services on Palantir or FALCON. Therefore, HSI is seeking approval to acquire additional brand name licenses and operations support and maintenance from Palantir as the single available source under the authority of the Multiple-Award Schedule Program. 5 Determination by the Ordering Activity Contracting Officer that the Order Represents the Best Value In accordance with FAR 8.404(d) Use of Federal Supply Schedules --PricingLsupplies offered on the schedule are listed at fixed prices. Services offered on the schedule are priced either at hourly rates, or at a fixed price for performance of a specific task (2. g. training, installation, maintenance, and repair). GSA has already determined the prices of supplies and fixed-price services for Palantir Software, under Palantir schedule GS-3 SF-0086U, to be fair and reasonable. Therefore, ordering activities are not required to make a separate determination of fair and reasonable pricing, except for a price evaluation as required by FAR By placing an order against a schedule contract using the procedures in FAR 8.405, the ordering activity has concluded that the order represents the best value (as defined in FAR 2.101) and results in the lowest overall cost alternative (considering price, special features, administrative costs, etc.) to meet the Government's needs. Although GSA has already negotiated fair and reasonable pricing, the Office of Acquisition (OAQ), Information Technology Architecture and Development (ITAD) division shall seek additional discounts prior to placing an order. An evaluation of previous and current support maintenance pricing on Contract F-00010 and HSCETC-13-F-00030 have shown that the estimated support maintenance pricing outlined in paragraph 3 above is fair and reasonable. Additionally, GSA has determined that the pricing outlined on Palantir's GSA Schedule 70 is fair and reasonable. Therefore, it has been determined that the pricing for each period of performance and for the overall contract period of performance (to include the option to extend services per FAR 52.217-8) has been deemed fair and reasonable.

6 Efforts to Obtain Competition and Market Research The market research techniques used included: 0 Reviewed internal ICE documentation (previous contract, PWS, and market research) 0 Researched to see if other Federal Agencies used the same system we did. It was determined that CBP and the FBI use FALCON 0 Internet research of products, standards, and industry practices (Google, DHS sites) 0 support for services to an installation of Palantir Government Licenses 0 Researched the General Services Administration (GSA) e-Library Market research revealed that Palantir is the Original Equipment Manufacturer (OEM) and owner of the source code information of the original Palantir licenses being utilized by ICE. Palantir is the only manufacturer that can provide the required annual maintenance support for these licenses. Palantir is not sold by third party resellers; therefore does not offer any additional discounts or special pricing through third party resellers. Additionally, as part of the contract process, OAQ has issued sources sought notices that detailed program requirements for a comprehensive software solution and related support and requested that interested vendors submit technical capability documentation in response. As a result of these sources sought notices, Palantir software was undertaken with the results of a fixed price award HSCETE-11-F-00125 followed by a maintenance support bridge contract award number HSCETC-13-F-00010. Both of these contracts were highly successful. A new contract, HSCETC-13-F-00030, with Palantir was awarded on June 14, 2013. The purpose of this limited source justification is to ensure the extension of the FALCON system's functionality for current users and new users in the TTU by making DARTTS and EID data available for analysis purposes to the full FALCON user base and by providing workflow functionality within the existing FALCON front-end user interface to employees of the TTU and their counterparts in foreign governments. In keeping with the requirements of the FAR, a sources sought notice was issued on August 6, 2013 outlining the additionally requirement of DARTTS-related and EID-related data sets to FALCON. Responses to the sources sought notice were due by 12:00 PM on August 13, 2013. Three vendors, Palantir, SRA Intemational, and Visionary Integration Professionals, LLC provided responses. These responses were forwarded to the program office for evaluation. Based on the evaluation of the responses, it was determined that only Palantir provided clear and convincing evidence of their ability to meet the Government's requirement. The responses provided by SRA and VIP showed a lack of detail necessary to meet all of the Government's requirements. In accordance with FAR 5.201, OAQ will synopsize this requirement to the Federal Business Opportunities (FBO) website, which is the Government-wide Point of Entry (GPE). The synopsis will include a copy of the approved LSJ.

7 Other Facts Supporting Limited Source Justification Palantir enables to secure information sharing with other law enforcement agencies in real-time to include Transportation Security Administration (TSA), Custom Border Protection (CBP), the United States Coast Guard (USCG), Federal Bureau of Investigations (FBI), National Counterterrorism Center (N CC), Central Intelligence Agency (CIA) and Defense Intelligence Agency (DIA). This will give ICE an open platform that will be interoperable and have the ability to cross use capabilities such as federated search, mapping and geospatial capability, unstructured search function, visual linking with these agencies and also have the capability to fully scale the solution to enable large entity exchange petabytes of data) between other agencies. Several other Government agencies including the Department of Defense United States Army, Central Intelligence Agency (CIA) and Federal Bureau of Investigation (FBI) use Palantir software for a seamless integration of structured and unstructured data, advanced searching and discovery capabilities, enterprise-wide common operating picture capability, and enterprise-wide collaboration. This ability gives our agents and the ability to conduct consolidated searches and perform quantitative analytics. 8 Statement of Actions, if any, the agency may take to remove or overcome any barriers In order to meet the mission needs of HSI, ICE needs to retain the Palantir capabilities by potentially expanding the functionality and user base of the product. It is the Govemment's intention to eventually develop the in-house capability to provide user consultative support, deliver new user training and extend solution integration independently beyond the life of the contract. This training will involve users and technicians at all levels, to include advanced "train the trainer" and "train the developer" education of ICE agents and While this will limit ICE's reliance on contractor support to some extent, product maintenance support will continue to be available only from the vendor. Information Sharing and Infrastructure Management's (ISIM) shall continue to monitor available software products and review HSI operating procedures to determine if any additional software products become available that more effectively and efficiently meet functional requirements. At the present time, market research reveals that several new companies are beginning to emerge within the technology space previously occupied solely by Palantir. The structure of the existing contract, with its four option periods, each option period containing multiple optional purchases of licenses and services, allows for multiple doorways into altemative procurements as technology evolves and ICE HSI's analytics needs change. ICE's chosen architecture moving forward (the forthcoming use of the Authoritative ICE Data Warehouse, or AIDW, to house the majority of its law enforcement-related data sets, which can potentially be hooked into any of a number of alternative front-end applications) will allow for open competition for an analytics platform when ICE management decides to replace or rework its existing analytics platform, FALCON. ICE HSI will not face a long-terrn situation of "vendor lock" with Palantir Technologies. When the times arrive to exercise options (in March of 2014,

2015. 20l6, and 2017), ICE may either opt to exercise the existing optional purchases or not exercise them and instead open the procurement to full and open competition. 9 CERTIFICATIONS In accordance with FAR 8.404 and FAR 8.405-6. the signatures below certify that a task order resulting from this LSJ represents the best value and results in the lowest overall price alternative to meet the Government's needs. Personnel: main Andrew Fox Technical Representative Contracting Officer: 111isjustification is accurate and complete to the best of my knowledge and belief. 90/ Harold Hondfiger Date Contracting Officer REVIEW: $1 McDaniel Date Deputy Assistant Director REVIEW: 3/331:3 David Sanders Date Acting Competition Advocate [Required for actions over $650,000 but not exceeding $12.5 million] APPROVAL:

2.3 Zorf, Cheryl Tyner 1 Date Acting Head of Contracting Activity [Required for actions over $12.5 million]