Internet Connection Record

Description

Summary of the work The type of research which requires technical support includes, but is not limited to: analysis of new, priority applications and services; trialling, assessment, development, and integration of new tools, techniques and tradecraft; network event analysis capability – both development and exploitation. Expected Contract Length March 2020 Latest start date Wednesday 31 July 2019 Why the Work is Being Done The NCA is developing requirements for the Internet Connection Record National Service to be delivered by Home Office. The ability to require Telecommunications Operators (TOs) to retain limited information about a person/ device’s internet activity came about as a result of passage of the Investigatory Powers Act 2016. As part of developing those requirements and enhancing our understanding of associated risk, issues and dependencies, it is proposed to run a limited ‘live trial’ of ICR capability over a six month period from August 2019, with one or more UK TOs. This trial will run from the NCA. Problem to Be Solved The IDU needs to conduct analysis and enrichment of the data outputs of the ICR trial and provide this to officers for intelligence reporting. There are significant dependencies on the trial for proving the technical achievability, and operational value of ICRs. The service provider must therefore have experience analysing network flow, and be comfortable with a range of analytical tools including Kibana, Tableau, i2, SPSS, Excel, etc. in order to assess the data outputs and transform them into a useable format for officers. Who Are the Users The recipients of the outputs of this work will be the project team for the trial activities Early Market Engagement Enquiries have indicated that the required resource is available from companies on the DOS3 Framework. Work Already Done Significant work has already been invested in ICR service provision by a joint Home Office and NCA team and from which this Live Trial has been developed. Existing Team IDU CCIC staff will support the trial. Current Phase Discovery Skills & Experience • Experience in the security and defence sector - 10 points • Experience performing data analysis, particularly on network flow (and equivalent), and be comfortable using analytical tools including Tableau, i2, SPSS, Excel, etc. - 30 Points • Experience of creating data visualisations using tools such as those specified above - 15 Points • Understanding of IP and URL filtering and categorisation - 15 Points • Experience researching networking protocols including use of Wireshark and other toolsets - 30 Points • Working knowledge of both Elasticsearch and Kibana - 15 Points • Programming experience (must include Python) - 15 Points Nice to Haves • Solution Architecture - 5 Points • Business Analysis - 1 point • Knowledge and experience of Law Enforcement investigative practices and operating models - 8 Points • Stakeholder engagement and communication skills - 5 Points • Preparation of detailed and accurate requirement specification documentation, user interface guides and functional / non-functional specification documents - 3 Points • Working knowledge of Android, iOS, Linux, and Windows operating systems - 5 Points • Relevant knowledge of Investigatory Powers Act capabilities - 2 Points Work Location IDU CCIC, Spring Gardens Estate, London Working Arrangments The researcher service is expected to be provided during standard NCA working hours in support of the operational teams. Security Clearance Minimum SC cleared with NCA Top Up. Additional T&Cs Additional terms will be sent out shortlisted suppliers. These will include FOIA terms as the NCA is not subject to FOI requests. Security terms to include Security aspects letter, information security. Shortlisted suppliers will be required to utilise Bravo during the assement stage. At this stage you will need to create an account on the Bravosolutions E-Sourcing portal. No. of Suppliers to Evaluate 4 Proposal Criteria • Evidence of prior experience of the essential skills above - 15 Points • The proposed approach and methodology - 8 Points • How the approach or solution meets user needs - 5 Points • Other relevant skills and experience which may be of benefit to operational activities - 5 Points Cultural Fit Criteria • Evidence of working with a diverse (multi-organisation) team - 5 Points • Willingness to be flexible to accommodate the needs of the organisation - 5 Points Payment Approach Time and materials Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers 1. What is your allocated budget? Have specified the FTE time required for each role and would expect suppliers to provide at published rate card. 2. Will you support the SC clearance for the successful candidate? Our funding timescales mean that facilitating clearance, which will take several months, is probably not viable. However, if insufficient suitable candidates are forthcoming we may consider accepting the Risk of non cleared resource and supporting that clearance process. 3. Please can you clarify if this work needs to be undertaken at IDU CCIC, Spring Gardens or whether a percentage, or majority, of the work can be delivered remotely. In addition, will the supplier be required to use their own ICT equipment or NCA's when working at Spring Gardens. For the specialist integration resource - all wpork will be at Spring Gardens on NCA supplioed equipment. For the researcher role some limited work could be completed off site but our preference is for on site where collaboration with operational and developer colleagues can be better managed. 4. Can the authority please confirm whether they are happy for suppliers to have SC Cleared staff and to undergo the NCA top up either during contract negotiation or once the contract is awarded? Yes, SC is fine and we will manage risk whilst top ups are carried out. 5. Are you using standard scoring and, if so, how does a supplier achieve a 3 versus a 2 on this opportunity for the essential and nice-to-haves? If you are not using standard scoring, can you please explain your scoring methodology? The NCA will be using the standard scoring card as per the DoS 3 framework guidance but we have provided some clarification below on our interpretation of the scores.0. The response provides information of such a poor standard as to provide no confidence that the service meets the requirement.1. The suppliers response provides some clear strengths but giving some concern.2. A good response where strengths clearly outweigh any minor weaknesses.3. Robust and fully comprehensive response. 6. In question response 3, you talk about an integration resource and a researcher role. Is the Integration resource referring to the Internet Connection Record 2 opportunity? If this opportunity is just for the Researcher role, can you confirm if you are expecting a single resource or multiple resources to deliver. Both resources are aligned to the Internet Enabled Investigation portfolio of work, which includes ICRs. The extent to which the resources will be applied to the ICR work specifically is dependent on how quickly they are engaged amongst - other factors. In order to keep the impact on colleagues in the unit concerned to a minimum, and for security reasons, our preference would be for the same resources to manage the work throughout the contract. 7. You mention in the first question response: "Have specified the FTE time required for each role". For the ICR 2 opportunity, 40 days is mentioned.However, there doesn't appear to be a number of days specified for this opportunity. Are you able to give an indicative number of days for this opportunity? The contract is until end March 2020 at up to five days per week. 8. The NCA would like to confirm that this requirement is being conducted as per the guidance of the DoS 3 framework and as such the evaluation process will be fair, open and transparent. The NCA would like to confirm that this requirement is being conducted as per the guidance of the DoS 3 framework and as such the evaluation process will be fair, open and transparent.