Ho-olaulima Government Solutions, LLC
Highlights
Ho'olaulima Government Solutions, LLC (HGS), of San Antonio, Texas, protests the Department of the Navy's notice of intent to award a sole-source contract to Epsilon, Inc. to provide classified information technology (IT) services, a classified data center, and office space to support the F-35 Lightning II Joint Program Office (JPO). HGS asserts that the agency unreasonably concluded that only Epsilon is able to meet the agency's requirements. Protest at 12-22.
DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.
Decision
Matter of: Ho-olaulima Government Solutions, LLC
File: B-421958; B-421958.2
Date: December 19, 2023
John C. Dulske, Esq., Alyssa Isenberg, Esq., and Evan Janc, Esq., Steptoe & Johnson, PLLC, for the protester.
James W. Norment, Esq., and Hugh R. Overholt, Esq., Ward and Smith, PA, for Epsilon, Inc., the intervenor.
Tricia A. Nicewicz, Esq., Brooke N. Didier, Esq., and Caroline H. Cobb, Esq., Department of the Navy, for the agency.
Glenn G. Wolcott, Esq., and Christina Sklarew, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.
DIGEST
1. Protest challenging agency’s intent to award on a sole-source basis is denied where the agency reasonably concluded, based on its market research, that only one potential offeror was capable of meeting the agency’s stated requirements, and similarly reasonably determined that the protester failed to demonstrate such capability.
2. Protester is not an interested party to protest the agency’s notice of intent to award a sole-source contract where the agency reasonably concluded that protester failed to demonstrate its ability to meet the agency’s needs.
DECISION
Ho’olaulima Government Solutions, LLC (HGS), of San Antonio, Texas, protests the Department of the Navy’s notice of intent to award a sole-source contract to Epsilon, Inc. to provide classified information technology (IT) services, a classified data center, and office space to support the F-35 Lightning II Joint Program Office (JPO).[1] HGS asserts that the agency unreasonably concluded that only Epsilon is able to meet the agency’s requirements. Protest at 12-22.[2]
We deny the protest.
BACKGROUND
The agency states that the F-35 program is currently supported by a classified data center housed in a building in Arlington, Virginia, which is leased by the Department of Defense, Washington Headquarters Services (WHS), on behalf of JPO and other government agencies. COS/MOL at 3. In May 2022, WHS advised JPO that this lease will expire in September 2025 and will not be renewed. Id.; see Agency Report (AR) Exh. 13, Memorandum Regarding Lease Termination Plan at 1-2. Accordingly, the agency began to review alternative facilities that might meet its requirements to support the F‑35 program.[3] At the outset of this review, WHS identified a privately-owned classified data center in [DELETED][4] that appeared to meet the F-35 program requirements. COS/MOL at 4; AR, Exh. 6, Market Research Report at 1-3.
In March 2023, consistent with the requirements of FAR part 10, Market Research, the agency published two requests for information (RFIs), along with draft statements of work, to determine if there were other facilities that could meet the F-35 program requirements. Among other things, the RFIs stated: “The contractor shall provide and lease [a] classified data center and classified office space on behalf of the government within 45 miles of the Pentagon,” and further provided that the data center must: “meet or exceed ICD [Intelligence Community Directive] 705 standards”;[5] require no “construction cost[s] or modifications”; and be “move-in . . . ready.”[6] AR, Exh. 4, Second RFI at 43. In response to the RFIs, the agency received several submissions, including those of Epsilon and HGS. AR, Exh. 10, Epsilon RFI Response (March 6, 2023); Exh. 11, HGS RFI Response (March 28, 2023).
In its response, Epsilon identified the location of its facility;[7] provided specific information demonstrating that the existing data center was ICD 705 compliant, SAP (special access program) accredited, and immediately available. AR, Exh. 10, Epsilon RFI Response at 1-9. More specifically, Epsilon’s response provided detailed descriptions and schematics of its data center, noting its compliance with both ICD 705 and “ANSI/TIA-942 standard for data centers.”[8] Id. Finally, Epsilon provided a letter from [DELETED] stating that [DELETED] and Epsilon [DELETED] in responding to the agency’s requirements. Id. Based on Epsilon’s submission, the agency concluded that Epsilon had demonstrated its ability to meet the agency’s requirements.
In contrast, HGS’s response did not identify any particular “move-in ready” facility but, rather: presented conclusory assertions that HGS was “capable” of meeting the requirements; maintained that it had “space” available “for a data center”; and stated that it “intends to partner with [DELETED],” indicating that [DELETED] would be responsible for providing a facility. AR, Exh. 11, HGS RFI Response at 1-11. After reviewing HGS’s response, the agency was concerned that HGS intended to offer a building that it intended to subsequently modify to comply with the data center requirements. Accordingly, the agency engaged in a meeting with HGS personnel, attempting to gain clarity regarding HGS’s submission. Following that meeting, the agency concluded that HGS’s RFI response reflected an intent to provide an office building--not a “move-in ready” data center--and that the response did not demonstrate a capability to meet the agency’s immediate needs. AR, Exh. 12, Affidavit of JPO Chief Information Officer (CIO) at 2-3.
Based on its review of all the RFI responses, the agency concluded that only one respondent, Epsilon, was capable of meeting the agency's needs. AR, Exh. 6, Market Research Report at 1-8. Accordingly, on August 14, the agency posted a final synopsis of its requirements and a Notice of Intent (NOI) to award a sole-source contract to Epsilon, based on the authority of Federal Acquisition Regulation (FAR) section 6.302‑1, which authorizes this action when only one responsible source will satisfy the agency’s requirements. AR, Exh. 7, NOI; see FAR 6.302-1(b)(1)(ii).
Among other things, the NOI reiterated the “move-in ready” requirement by specifically stating that the agency required “immediate” classified IT services. The NOI also listed the following requirements:
1. 6000 square feet of data hall space in a federal, classified only ANSI/TIA-942 Tier 3+ data center facility[[9]] within a K12 fence line providing 1.5 megawatts of power.
2. 3,000 square feet of classified office space co-located inside the federal classified data center.
3. Classified IT mitigation services to procure, buildout, migrate, and sustain the JPO’s global classified IT footprint.
4. TEMPEST[[10]] and ICD 705 compliance.[[11]]
AR, Exh. 7, NOI at 3.
On August 28, HGS submitted an “updated capabilities statement”[12] which, in large part, repeated its RFI response and, again, failed to identify any specific location of a “move-in ready” data center.[13] Protest, attach. 3, HGS Capability Statement at 1-11.
The agency reviewed HGS’s submission and, again, determined that HGS “does not have an immediate, move-in ready, designated TIA-942 data center that is ICD 705 compliant.” Agency Dismissal Request at 5; see AR, Exh. 12, Affidavit of JPO CIO at 2‑3. Specifically, the agency concluded that, although HGS’s final submission again included “vague and general statements that it could meet all requirements,” HGS failed to provide sufficient information to support those statements and appeared to be offering an office building that it intended to subsequently convert into a classified data center. AR, Exh. 12, Affidavit of JPO CIO at 2-3.
On August 31, in response to HGS’s questions, the agency advised HGS that:
The technical team reviewed your capabilities statements in addition to the information that you provided through discussions while we have been in the market research phase. [HGS] has been determined not capable of meeting all of the requirements and specifically did not demonstrate being capable in the following areas:
1. Designated as an ANSI/TIA-942 Tier 3+ facility within a k12 fence line;
2. Provide a dedicated substation on controlled/secured premise (within a k12 fence line);
3. Provide redundant power feeds to datacenter from substation;
4. Provide dedicated 2.25 MW [megawatt] generator;
5. Provide dedicated 1.5 MW UPS [uninterruptible power source] block;
6. Provide a hot swappable backup generator available in case of generator failure;
7. Provide power redundancy of 2N+1 at distribution larger and N+1 at UPS layer;
8. Provide expansive capacity to 45MW active power presence with DISA [Defense Information Systems Agency], Azure [Microsoft Azure], AWS [Amazon Web Services.]
AR, Exh. 9, Email Chain Between Agency and HGS at 8.
Thereafter, HGS filed this protest.[14]
DISCUSSION
HGS asserts that it was unreasonable for the agency to conclude that HGS did not adequately demonstrate its ability to meet the stated requirements and, therefore, unreasonably concluded that only one respondent, Epsilon, was capable of meeting the agency’s needs.[15] More specifically, HGS characterizes its final submission as a “comprehensive capability statement” that “confirm[ed]” its ability to meet the agency’s stated requirements and “provide[d] information” regarding those requirements. Protest at 7. In support of this assertion, HGS refers to the portion of its submission that restates, verbatim, the requirements listed in the NOI along with HGS’s statement: “We confirm our capability to meet and/or exceed all the requirements,” followed by statements about its corporate experience. Id. at 7-10; Protest attach. 3, HGS Capability Statement at 4. On this record, HGS asserts that its submission provided “sufficient” information to demonstrate its capability to comply with the agency’s requirements and that the agency’s conclusion to the contrary was unreasonable. Id.
The agency responds by noting that the NOI clearly advised potential offerors that the agency had an “immediate” need for a data center that was TIA-942 and ICD compliant; nonetheless, “after three opportunities,” HDS still failed to demonstrate that it had a move-in ready facility that met the stated need. COS/MOL at 19-20. For example, the agency notes that both TIA-942 and ICD 705 incorporate requirements for uninterruptible backup power and redundant power sources.[16] COS/MOL at 22; see Agency Motion to Dismiss, attach. 1, Excerpts from ICD 705 at 6-7. Yet, nothing in HGS’s submissions identified any particular facility that met these requirements, and the submissions failed to even address them. Id. Accordingly, the agency maintains it reasonably concluded that HGS did not demonstrate an ability to meet the agency’s requirements because it does not have a compliant facility that is currently available. Id.
In contrast, the agency notes that Epsilon’s submission specifically identified the location of its existing data center; provided detailed information demonstrating that it was an existing classified data center that met the TIA-942 and ICD 705 requirements, including an uninterruptible power supply and redundant “voltage switches . . . transformers, and . . . switchgear,” and provided information regarding the relationship between Epsilon and [DELETED] the building owner. COS/MOL at 19; see AR, Exh. 10, Epsilon RFI Response at 8.
Accordingly, the agency maintains that it reasonably determined that Epsilon demonstrated an ability to meet the agency’s needs for a move-in ready, TIA-942 certified, ICD 705 accredited data center, and HGS did not. Further, the agency maintains that, since HGS failed to demonstrate an ability to meet the agency’s needs, it does not qualify as an interested party to further challenge the agency’s actions. We agree.
A contracting agency has the discretion to determine its needs and the best method to
accommodate them. RCR Props., G.P., B-414590, July 21, 2017, 2017 CPD ¶ 231 at 5; General Electrodynamics Corp., B-298698, B-298698.2, Nov. 27, 2006, 2006 CPD ¶ 180 at 3. Section 6.302-1 of the FAR authorizes an agency to make a sole-source award if it reasonably determines that there is only one responsible source capable of meeting its needs. In this context, the agency must give meaningful opportunity to prospective alternative sources to demonstrate their ability to provide what the agency seeks to procure. See M.D. Thompson Consulting, LLC; PMTech, Inc., B-297616, B‑297616.2, Feb. 14, 2006, 2006 CPD ¶ 41 at 4. A protester’s disagreement with the agency’s judgment concerning the agency’s needs and how to best accommodate them, without more, does not show that the agency’s judgment is unreasonable. See USA Fabrics, Inc., B-295737, B-295737.2, Apr. 19, 2005, 2005 CPD ¶ 82 at 5. Finally, only an “interested party” may file a protest. 4 C.F.R. 21.0(a)(1). That is, a protester must be an actual or prospective bidder or offeror whose direct economic interest would be affected by the award of a contract or the failure to award a contract. Bid Protest Regulations, 4 C.F.R. 21.0(a)(1). A protester does not qualify as an interested party if the protester is not eligible for award. See, e.g., RELM Wireless Corp., B‑405358, Oct. 7, 2011, 2011 CPD ¶ 211 at 2-3.
Here, based on our review of the record discussed above, we do not question the reasonableness of the agency’s determination that Epsilon demonstrated its capability to meet the agency’s stated requirements and HGS did not. Further, there is no basis to suggest that HGS was not given a meaningful opportunity to demonstrate its capability. As discussed above, the agency sought and received an RFI response from HGS in March 2023. Thereafter, the agency engaged in discussions with HGS, seeking clarification as to whether its purported capability was based on any currently available facility that complied with the agency’s clearly stated requirements. Finally, HGS was given yet another opportunity to demonstrate its capability following the agency’s issuance of the NOI in August 2023. Yet, the record supports the agency’s conclusion that, notwithstanding these multiple opportunities, HGS failed to identify any particular facility that complied with the agency’s requirements for a currently available TIA-942 and ICD 705 compliant data center. Accordingly, we reject HGS’s assertion that the agency’s negative determination regarding HGS’s capability was unreasonable. Further, in light of the agency’s reasonable determination that HGS is not capable of meeting the agency’s requirements, HGS does not qualify as an interested party to further challenge the agency’s actions.
The protest is denied.
Edda Emmanuelli Perez
General Counsel
[1] The JPO is responsible for providing IT and cyber security (CS) services to support the “life-cycle program management of the F-35A, F-35B, and F-35C [aircraft],” which are described as “the fifth-generation joint strike fighter air system of choice for the U.S. Air Force, U.S. Navy, U.S. Marine Corps, seven international partners, and foreign military sales . . . customers.” Contracting Officer’s Statement and Memorandum of Law (COS/MOL) at 3.
[2] Page number citations in this decision refer to the Adobe PDF page numbers in the documents submitted.
[3] The agency states that, in addition to the data center and office space, its requirements include a broad range of services, including “program and performance management, enterprise architecture, emerging capabilities and requirements implementation, life cycle management, operations & maintenance, coalition IT support, data-center relocation, [and] enterprise data management.” AR, Exh. 1, Individual Streamlined Acquisition Plan at 3. The agency further states that, without the timely acquisition of both the IT services and a classified data center, the agency will be unable to provide worldwide support for the F-35 program, noting that an outage of the classified network “would result in catastrophic national security implications to not just the U.S., but to the national security of the JPO’s numerous international partners and FMS [foreign military sales] customers.” Id; COS/MOL at 19. Finally, the agency notes that it needs “a lead integrator and single point of accountability” because distribution of tasks among multiple vendors would likely increase “negative schedule and cost risk to the Government.” AR, Exh. 1, Individual Streamlined Acquisition Plan at 3-4.
[4] The facility is owned by [DELETED] and is currently leased to Epsilon. COS/MOL at 4; see AR, Exh. 6, Market Research Report at 1-3.
[5] ICD 705 establishes standards and technical specifications for construction and management of sensitive compartmented information facilities. COS/MOL at 4; see Agency Dismissal Request, attach. 1, Excerpts from ICD 705.
[6] Although the current lease will not expire until 2025, the agency notes there are multiple “long-lead” activities that must be completed in transitioning to a new facility. COS/MOL at 4. Depending on the status of the new facility, these activities include “installation of shielding cables, firewalls, and other items to meet COMSEC [communications security] requirements.” Id. The agency further notes that “the joint nature of the JPO requires the installation of Department of Navy, Department of the Air Force, and the Defense Information Security Agency classified networks--including senior executive and flag officer approval--which . . . cannot begin until certain aspects of the classified data center accreditation phases are completed.” AR, Exh. 12, Affidavit of JPO Chief Information Officer (CIO) at 2.
[7] The facility is located at [DELETED]. AR, Exh. 10, Epsilon RFI Response at 2.
[8] The Telecommunications Industry Association (TIA) is accredited by the American National Standards Institute (ANSI) as a standards-developing organization for the industry. Agency Dismissal Request at 3. The TIA-942 certification program provides “data centers to be reviewed and certified for conformity to the requirements of the globally-recognized ANSI/TIA-942 standard.” Id.
[9] As noted above the TIA-942 certification program provides “data centers to be reviewed and certified for conformity to the requirements of the globally-recognized ANSI/TIA 942 standard.” Among other things, to achieve a Tier3+ rating, a data center must have redundant power sources. COS/MOL at 24.
[10] TEMPEST “is a U.S. National Security Agency specification referring to spying on information systems through leaking emanations, including unintentional radio or electrical signals, sounds, and vibrations,” and “[m]any of the associated standards are classified.” Agency Dismissal Request at 2 n.2.
[11] As noted above, ICD 705 establishes standards and technical specifications for construction and management of sensitive compartmented information facilities. Agency Dismissal Request, attach. 1, Excerpts from ICD 705. Among other things, ICD 705 requirements include “uninterruptible backup power.” Id. at 6-7.
[12] The NOI permitted submission of any additional capability statements prior to August 29.
[13] In this submission, HGS referred to BAE Systems (without identifying HGS’s relationship to BAE) and stated (without further information) that “BAE Systems has four (4) facilities which . . . exceed the specifications and requirements in the program.” Protest attach. 3, HGS Capability Statement at 4.
[14] The agency notes that, at the time the protest was filed, no award had been made and, consistent with the provisions of FAR section 6.302-1, the agency had not finalized its justification and approval (J&A) for this procurement. In light of the protest, the agency states that it has “paused both the J&A approval and contract award.” COS/MOL at 15.
[15] In its various protest submissions, HGS presents arguments that are variations of, or additions to, those specifically discussed below including, for example, assertions that: the agency’s market research incorporated improper “negotiations” with Epsilon; the agency should have acquired the data center and classified IT services separately; the NOI was defective because it did not identify all of the agency’s requirements; the agency failed to adequately verify Epsilon’s capabilities and, therefore, engaged in disparate treatment; and agency personnel acted in bad faith. We have considered all of HGS’s allegations and find no basis to sustain its protest.
[16] As noted above, an outage of the classified network that supports the F-35 program “would result in catastrophic national security implications to not just the U.S., but to the national security of the JPO’s numerous international partners and FMS [foreign military sales] customers.” COS/MOL at 19.