ASM Research

DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.

Decision

Matter of:  ASM Research

File:  B-412187

Date:  January 7, 2016

DIGEST

Protest is sustained where agency failed to reasonably consider a potential conflict of interest that would be created by the awardee evaluating under one task order the performance of third-party mobile applications developed for a cloud environment which would have been developed, implemented, and deployed by the awardee under another task order.

ASM Research, of Fairfax, Virginia, protests the Department of Veterans Affairs’ (VA) issuance of a task order to Booz Allen Hamilton, of McLean, Virginia, under request for task execution plans (RTEP) No. T4-0671, for operation and maintenance support of cloud enclaves and associated environments, as well as the infrastructure software contained within each enclave.  ASM asserts that Booz Allen has an unmitigatable organizational conflict of interest (OCI) that renders Booz Allen ineligible to receive the task order.

We sustain the protest.

BACKGROUND

The RTEP, issued to contract holders under the Transformational Twenty-One Total Technology (T4) multiple-award, indefinite-delivery/indefinite-quantity (ID/IQ) contract program, provided for the issuance of a fixed-price task order, with a 12‑month base period and two 12-month option periods, for Mobile Infrastructure Services (MIS).[1]  The task order was to be issued to the offeror whose proposal represented the best value to the government considering three evaluation factors:  technical, past performance, and price. 

The agency is seeking to provide services to veterans through the use of medical mobile devices, and towards that end is arranging for the development and delivery of mobile applications (app).[2]  Contracting Officer’s Statement of Facts (COSF) at 2.  As part of this effort, VA’s Office of Information and Technology partnered with VA’s Connected Health Office (CHO) to establish VA’s MIS platform.  The overall goal of the VA MIS effort is to further the development, production implementation, and use of web hosted and mobile apps, both internally to VA clinicians, and externally directly to veterans.  See MIS Performance Work Statement (PWS) § 1.0, Background.  The MIS platform currently hosts the following four enclaves:  the Enterprise Mobility Management (EMM) platform for managing the mobile devices that are provided to home-bound veterans, field clinicians, nurses, and physicians, and utilized by VA staff; the Mobile Application Environment (MAE) for web and mobile app development; the VA Mobile Framework, which is the production environment for web and mobile apps; and the External Cloud Environment (ECE), which operates outside of VA for mobile app demonstrations and software development without the need for connectivity to VA’s network.  The MAE enclave is the focus of this protest.

The MIS task order will provide the hosting and maintenance of the infrastructure, platforms, and tools that house the development, testing, and production environments for mobile apps so they can be developed, tested, and released to veterans and their caregivers.  COSF at 2.  The MIS task order contractor will be responsible for providing a cloud hosting platform and its underlying infrastructure, with multiple enclaves and environments, as well as for ensuring the platform is maintained so as to meet service level agreement requirements (such as those concerning availability) set forth in the MIS PWS.  See generally, MIS PWS § 3.0, Scope of Work.

Only ASM and Booz Allen submitted proposals in response to the RTEP.  Proposals were evaluated as follows:

Factor	ASM	Booz Allen
Technical	Acceptable	Acceptable
Past Performance	8.23 out of 10	6.44 out of 10
Price	$98,310,218.10	$87,410,248.12

Agency Debriefing at 15.  The agency issued the MIS task order to Booz Allen on September 14, 2015, and this protest followed.[3]

DISCUSSION

ASM asserts that Booz Allen has an impaired objectivity OCI, where the PWS for the MIS task order here would require Booz Allen to monitor its own performance under two task orders‑‑the Software Quality Assurance and Certification Support (SQA) task order, and the Independent Verification and Validation (V&V) task order ‑‑previously awarded to Booz Allen in May 2015 (SQA) and July 2015 (V&V).[4]  Protest at 6-7.  In this regard, as a general matter, the Federal Acquisition Regulation (FAR) requires that contracting officers avoid, neutralize or mitigate potential significant OCIs.  FAR § 9.504(a). 

An impaired objectivity OCI, as addressed in FAR subpart 9.5 and the decisions of our Office, arises where a firm’s ability to render impartial advice to the government would be undermined by the firm’s competing interests.  FAR § 9.505(a); Diversified Collection Servs., Inc., B‑406958.3, B-406958.4, Jan. 8, 2013, 2013 CPD ¶ 23 at 5‑6.  The concern in such impaired objectivity situations is that a firm’s ability to render impartial advice to the government will be undermined by its relationship to the product or service being evaluated.  PURVIS Sys., Inc., B‑293807.3, B‑293807.4, Aug. 16, 2004, 2004 CPD ¶ 177 at 7.

We review the reasonableness of a contracting officer’s OCI investigation and, where an agency has given meaningful consideration to whether a significant conflict of interest exists, we will not substitute our judgment for the agency’s, absent clear evidence that the agency’s conclusion is unreasonable.  See TeleCommunication Sys. Inc., B‑404496.3, Oct. 26, 2011, 2011 CPD ¶ 229 at 3-4. In this regard, the identification of conflicts of interest is a fact-specific inquiry that requires the exercise of considerable discretion.  Guident Techs., Inc., B-405112.3, June 4, 2012, 2012 CPD ¶ 166 at 7; see Axiom Res. Mgmt., Inc. v. United States, 564 F.3d 1374, 1382 (Fed. Cir. 2009).  A protester must identify “hard facts” that indicate the existence or potential existence of a conflict; mere inference or suspicion of an actual or potential conflict is not enough.  TeleCommunication Sys. Inc., supra at 3; see Turner Constr. Co., Inc. v. United States, 645 F.3d 1377, 1387 (Fed. Cir. 2011); PAI Corp. v. United States, 614 F.3d 1347, 1352 (Fed. Cir. 2010).

Here, ASM asserts that Booz Allen, as part of its cloud hosting responsibilities as the MIS contractor, makes a meaningful contribution to the development of launch-ready mobile applications, and that in the testing of those applications (developed by other contractors) as part of Booz Allen’s performance under the SQA and V&V task orders, Booz Allen would have reason to assign responsibility for any issue with app performance to the apps themselves, rather than to the cloud for which Booz Allen is responsible and which hosts the apps.  The agency maintains that the contracting officer reasonably determined that the performance of Booz Allen’s MIS task order would not create an impaired objectivity OCI on the part of Booz Allen in the performance of its other previously issued task orders.  COSF at 6.

We conclude that the VA’s determination that Booz Allen’s performance of the MIS task order does not give rise to a significant, unmitigatable OCI is unreasonable in that it is based on assumptions as to the requirements under the task orders which are at variance with the terms of the actual PWSs.  We find in this regard that Booz Allen, as the SQA contractor, will play a significant role in the testing of apps that will be hosted in the cloud and enclaves for which Booz Allen, as the MIS contractor, will be responsible.  As a result, the record indicates that a potential impaired objectivity OCI exists if an app fails to perform as anticipated.  Booz Allen, as the SQA contractor, would be left with the choice of assigning responsibility for the failure to itself, as the MIS infrastructure contractor, or to the third party app developer.  In reaching this conclusion, we consider ASM’s and VA’s differing views on the following, each of which is critical in order to assess whether the agency’s determination that Booz Allen does not have an unmitigatable OCI was reasonable:  (1) the nature of the cloud and its enclaves, including the role of the MIS contractor in build management support for the app review process; and (2) the role of the software quality assurance contractor in the app review process.

MIS Contactor and the Cloud and Its Enclaves

ASM and the agency offer fundamentally different characterizations of the scope of the MIS task order.  The difference is critical.  If the cloud is analogous to a utility, such as for electricity, and the MIS contractor’s role with respect to apps is not significant, as the agency argues, there is less potential that cloud deficiencies (in creation or function) might be manifested in the performance of the apps themselves.  The more significant the cloud’s contribution to the mobile app development process, the more likely that an evaluation of mobile apps could entail an evaluation of the role that the cloud and the cloud contractor played in app development.

According to the agency, the MIS PWS does not require the contractor to “‘create’ or ‘develop’” the cloud.  Agency Comments, Dec. 10, 2015, at 8.  Rather, the agency asserts, the role of the MIS contractor is “to separate the cloud platform into several enclaves for use by multiple apps developers.”  Id.  In the agency’s view, each of the enclaves is a resource “that can be used in the app development lifecycle, but does not influence the quality or nature of the app that is ultimately developed.”  Id. at 8-9 (emphasis in original).  In other words, according to the agency, “each enclave with the VA MIS task order is analogous to an electrical outlet in a school building; it serves little to no purpose until someone plugs something into the socket,” and “it does not influence the quality/substance of” the work performed utilizing the electricity.  Id. at 9.

The lengthy MIS PWS, however, imposes numerous requirements and responsibilities on the MIS contractor.  In this regard, the PWS requires the contractor to provide suitable connectivity to each of the enclaves.  For example, the MIS contractor will be responsible for establishing and monitoring connectivity between the cloud and the VA’s intranet.  MIS PWS § 5.3.1.2.1.  The MIS contractor shall provide automated monitoring of the cloud, to ensure all aspects of the cloud and the enclaves are operating within service level agreements established by the PWS.  The contractor must provide a “Cloud Test Plan” that describes how the cloud will comply with specific certification, security, functionality, availability, and performance requirements outlined for all enclaves and associated environments.  MIS PWS § 5.3.2.1.  Upon completion of the Cloud Acceptance Test, the contractor shall deliver a “Cloud Implementation Plan outlining implementation and operations for the Cloud.”  MIS PWS § 5.3.3.1 (emphasis added).  After successful completion of the Cloud Acceptance Test, the contractor shall “implement/deploy the Cloud and make [it] fully available for VA use.”  Id. (emphasis added).

Although the agency argues that the MIS contractor does not “develop” the cloud, see Agency Comments, Dec. 10, 2015, at 8, the above PWS requirements indicate that the MIS contractor must implement/deploy the cloud, and develop, implement, and deploy cloud enclaves.  PWS §§ 5.3.3.1, 5.5.1, 5.6.2.  Of particular relevance here, the MIS PWS requires the contractor to “develop” and “implement” the MAE enclave; that enclave includes the six major logical environments “to create, test, and deploy VA mobile applications.”  MIS PWS § 5.5.1 (emphasis added).  As part of that effort, the contractor is required to provide “all source code for custom developed elements of the environment,” and to “deliver flexible, scalable processing, memory, and storage capacity necessary for the operation of each project/initiative environment in this enclave that provides a reconfigurable technical foundation.”  MIS PWS §§ 5.5.1, 5.5.2 (emphasis added).  After successful completion of the Cloud Operational Acceptance test, “the Contractor shall implement/deploy the enclave’s associated environments.”  MIS PWS § 5.6.2 (emphasis added).  That effort includes providing “all programming tools required for app development, testing, configuration control, and release to the production as applicable to each logical environment inside of each of the individual enclaves.”  Id. (emphasis added).  The MIS contractor shall ensure that the delivered enclaves and environments “provide the ability to conduct testing and [software quality assurance] for mobile applications developed inside the MAE.”  MIS PWS  § 5.6.3.4.

The MIS contractor shall provide “Build Management support to include a team of Build Managers (Configuration Managers) that will fully manage and maintain the build management process for the entire lifecycle of web and mobile application development.”  MIS PWS § 5.6.4 (emphasis added).  The MIS PWS further requires the contractor to “provide build management for the entire lifecycle of application development through to production of these applications working along with respective development teams using these enclaves and environments.”  Id.  Thus, while the PWS sometimes describes the requirement as “support,” see, e.g., MIS PWS  § 3.0, in other instances the MIS contractor is tasked with actual build management.  The scope and significance of the MIS contractor’s role, as defined by the PWS, runs directly counter to the VA’s characterization of the contractor’s contribution as mere “ancillary support services.”  Agency Comments, Nov. 20, 2015, at 10.

Given the plain language of the MIS PWS, including the PWS requirements that the MIS contractor implement/deploy the cloud, and develop, implement and deploy the MAE, which is the critical cloud enclave in which mobile apps will be developed and tested, and given the requirement that the MIS contractor fully manage and maintain the build management process for the entire lifecycle of web and mobile application development, the VA’s conclusion that the MIS contractor will have little or no role in developing the cloud, or in app development, is not supported by the MIS PWS.

The Nature of the App Review Process

VA and the protester also disagree on whether Booz Allen under its other task orders has a significant role in the app review process.  While the agency again suggests that Booz Allen will have only a limited support and management role, Agency Report (AR) at 14, the SQA PWS supports the protester’s assertion that Booz Allen, at least insofar as it serves as the SQA contractor, will play a not insignificant role in the app review process. 

In this regard, the contracting officer acknowledges that other task orders performed by Booz Allen require testing of mobile applications during the course of their development and launch.  Specifically, the contracting officer notes that the SQA PWS provides that software quality assurance testing “is performed to verify [that] the mobile application will meet compliance gate reviews such as end to end, functional, information assurance, regression, and integrated performance and load tests.”  COSF at 7, citing SQA PWS § 3.0.  The contracting officer further notes that “[e]nd to end testing under the SQA [task order] involved ensuring that all components of a mobile application are both working together and functioning correctly as a unit.”  Id. at 8.  The contracting officer also notes that “[i]ntegrated performance and load testing under the SQA task order will involve testing break level and load degradation levels of the mobile applications.”  Id. at 9.  Likewise, notes the contracting officer,

Information Assurance (IA) testing under the SQA [task order] involves ensuring that a particular mobile application provides appropriate security regarding sensitive information that may be transmitted to and from the VA to a mobile application while it is being viewed/used on a mobile device.

Id. at 9.  In addition to the above requirements referenced by the contracting officer, the SQA PWS states that the SQA contractor is required to “establish a process with the Government to prioritize applications for completion within SQA, taking into account attributes such as complexity, system access, support required, schedule, and resource availability,” and to provide “a schedule and resource estimate for each Application assigned as part of the Master Test Plan.”  SQA PWS § 4.3.  The SQA contractor is also required to “[m]anage and update the Operational Readiness Review process (ProPath/PMAS),” and to “perform activities related to the Operational Readiness Review process, as defined by VA process.”  Id. § 5.6.

The agency, however, seeks to minimize the role played by Booz Allen as the SQA contractor in the above tests by asserting that the SQA tests are “managed” by VA’s Connected Health Office (CHO), COSF at 7, and that an Operational Readiness Review “is not actually required under the SQA task order.”  Supplemental AR at 11 (emphasis in the original). 

The terms of the SQA PWS do not support the agency’s narrow interpretation of the SQA contractor’s role in testing apps.  In this regard, the SQA PWS provides that “[t]he Contractor shall provide all support services, products, materials, and incidentals necessary to accomplish the tasks and associated deliverables.”  SQA PWS § 3.0.  The PWS further provides that:  “The Contractor shall provide and execute testing services defined in Table 1 - Testing Activities to support the continued development, enhancement, and deployment of applications within the Agile development methodology.”  SQA PWS § 5.2.  Among the “testing services” listed in Table 1 of the SQA PWS which the SQA contractor, Booz Allen, is required under the PWS to “provide and execute,” are such testing activities as “End to End” testing:

Perform testing to ensure functionality, interoperability, and data validation across distributed components from the start to end of the business processes.  End to End Testing shall also include Infrastructure testing. This testing includes items such as database persistence, web services connectivity, and/or validation of data transfer between systems to verify technical solution requirements have been met.

Id.  Also, the SQA contractor shall “provide and execute” “Functional” testing as follows:

Conduct functional testing that tests the front and back-end functionality of the code to ensure that all the data entry, user interface, and application calculations are working correctly. Functional testing of the application shall be done in such a way as to provide independence and provide a validation and verification that the testing results are not influenced by other groups.

Id.  In addition, the SQA contractor shall “provide and execute” “Information Assurance (IA)” testing as follows:

Conduct all testing in a manner that considers IA concerns with regard to the application’s operation and user interaction so that any potential IA issues with regards to application’s functionality or a user using the application can be highlighted early.

Id.Further, the SQA contractor shall “provide and execute” “Integration” testing as follows:

Perform testing to ensure interoperability of components, internal and external, and ensure interface compliance and integrity.

In addition, the SQA contractor shall “provide and execute” Integrated Performance and

Load Testing as follows:

Administer, set up, script, execute and report on integrated performance and load testing of the MAE that identifies system break level and load degradation levels.

 The testing shall identify failures due to load/volume.

Id.  Also, the SQA contractor is required under the PWS to “[m]anage and update the Operational Readiness Review process.”  SQA PWS § 5.6(e).[5]

Conclusion

Thus, the SQA PWS indicates that Booz Allen as the SQA contractor will play a significant role in the testing of apps that will be hosted in the cloud and enclaves for which Booz Allen as the MIS contractor will be responsible.  As discussed above, however, the record further indicates that in considering the potential for an impaired objectivity OCI, VA has proceeded under a view of Booz Allen’s role under these two task orders that appears inconsistent with the terms of the two PWSs.

Further, ASM has provided several examples of potential situations in which Booz Allen’s judgement could be impaired as a result of its responsibilities under the two task orders.  For example, ASM asserts that as additional functionality is developed and introduced into an application’s source code, the MIS infrastructure may be required to provide additional processing power, memory, and/or storage capacity to support the change.  If the MIS contractor fails to provide sufficient resources at runtime, the application likely will fail.  Protester’s Comments, Dec. 2, at 21-22.  Booz Allen as the SQA contractor in this circumstance would be left with the choice of assigning responsibility for the app’s failure to perform as anticipated to itself as the MIS infrastructure contractor, or to the third party app developer.  Such a potential conflict in roles raises the impaired objectivity concerns which the OCI rules are intended to mitigate or avoid. 

In sum, the agency’s OCI analysis was premised on a view of Booz Allen’s responsibilities under the MIS and SQA contracts which appears inconsistent with, and unduly limited relative to, the terms of the PWS for each task order.[6]  Further, the record indicates that given the extensive responsibilities Booz Allen would have under these task orders, and in particular the extent to which these responsibilities would affect and impact VA’s effort to develop and deploy apps to meet the health care needs of veterans, there were “hard facts” indicating the existence or potential existence of an impaired objectivity conflict of interest.  Given the serious shortcomings in the agency’s OCI analysis, we have no basis to conclude that the agency meaningfully considered this potential OCI created by Booz Allen’s dual roles as the MIS contractor and the SQA contractor.[7]

RECOMMENDATION

We recommend that the agency meaningfully reconsider, evaluate, and document its findings about whether Booz Allen would have an OCI arising from its performance of the MIS task order and its prior task orders.[8]  In the event the agency identifies an OCI, it should also consider requesting OCI mitigation plans from Booz Allen, or requesting an OCI waiver.  See FAR §§ 9.503, 9.504.  We also recommend that the protester be reimbursed its costs of filing and pursuing the protest, including reasonable attorneys’ fees.  4 C.F.R. § 21.8(d)(1).  The protester should submit its certified claim, detailing the time expended and costs incurred, directly to the contracting agency within 60 days of receiving this decision.  4 C.F.R. § 21.8(f)(1).

The protest is sustained.

Susan A. Poling
General Counsel

---