McAfee, Inc. v. United States

In the United States Court of Federal Claims
No. 13-198C
(Filed Under Seal: July 12, 2013)
(Reissued: July 17, 2013)
**********************************
) Pre-award bid protest; jurisdiction; standing;
MCAFEE, INC., ) brand-name, sole-source procurement;
) Competition in Contracting Act, 41 U.S.C.
Plaintiff, ) § 3301; 10 U.S.C. § 2304(a)(1); factors
) governing equitable relief; interests of
v. ) national defense and national security; 28
) U.S.C. § 1491(b)(3)
UNITED STATES, )
)
Defendant. )
)
**********************************
Richard J. Conway, Dickstein Shapiro LLP, Washington, D.C., for plaintiff. With him
on the briefs were Charlotte Rothenberg Rosen and Adele H. Lack, Dickstein Shapiro LLP,
Washington, D.C.
K. Elizabeth Witwer, United States Department of Justice, Washington, D.C., for
defendant. With her on the briefs were Stuart F. Delery, Acting Deputy Assistant Attorney
General, Jeanne E. Davidson, Director, and Deborah A. Bynum, Assistant Director, Commercial
Litigation Branch, Civil Division, United States Department of Justice, Washington, D.C. Of
counsel were Richard Bean, Attorney Advisor, and Frank Yoon, Lt. Col., Trial Attorney, United
States Air Force.
OPINION AND ORDER1
LETTOW, Judge.
In this pre-award bid protest, plaintiff, McAfee, Inc. (“McAfee”) complains of an alleged
brand-name, sole-source procurement performed by the United States through United States
Department of the Air Force (“Air Force”) in violation of the Competition in Contracting Act
1
Because this opinion and order might have contained confidential or proprietary
information within the meaning of Rule 26(c)(1)(G) of the Rules of the Court of Federal Claims
(“RCFC”) and the protective order entered in this case, it was initially filed under seal. The
parties were requested to review this decision and to provide proposed redactions of any
confidential or proprietary information. The resulting redactions are shown by brackets
enclosing asterisks, e.g., “[***].”
(“CICA”), 41 U.S.C. § 3301. McAfee alleges that in a quest to reconfigure and strengthen its
network security technology, the Air Force made what amounts to a sole-source selection
without the requisite justification. McAfee seeks injunctive relief against the Air Force to
prevent the alleged enterprise-wide standardization. Compl. ¶ 5.
FACTS2
McAfee is a wholly owned subsidiary of Intel Corporation, AR 15-535 [***],3 organized
under the laws of Delaware and having its principal place of business in Santa Clara, California,
Compl. ¶ 7. It is a software developer and manufacturer, focusing on computer and network
security software and hardware products. Id. ¶¶ 7-8. McAfee software has been used by the Air
Force for network security (in concert with software from other companies) over the last fifteen
years up to the present day. Id. ¶ 7. If the Air Force’s present network-security standardization
plans go forward, McAfee effectively will be barred from competing for Air Force network-
security contracts because it does not manufacture a program compatible with the Air Force’s
network-security infrastructure that is tied to a particular sole source.
A. Air Force Cyber Security Architecture
Air Force network security is managed by the Combat Information Transport System
(“CITS”), established in the 1990s “as a ground infrastructure modernization program to support
the day-to-day information transport needs at fixed base Air Force installations world-wide.”
AR 8-329 (AFNet Life Cycle Management Plan). Through CITS, the Air Force implements
various discrete programs to achieve satisfactory network security throughout the entirety of its
systems. One such program is the Air Force Network Increment 1 program (“AFNet”),4 which
manages system integration, modernization, support, commercial-off-the-shelf equipment
purchase, and interim contract support. Id. at 328 to -29.
Under the AFNet program, the Air Force periodically redesigns and upgrades its
“network management capabilities, network security and defense capabilities.” AR 51-2113
2
The recitations that follow constitute findings of fact by the court drawn from the
administrative record of the procurement and the parties’ evidentiary submissions related to
prejudice and equitable relief. See Bannum, Inc. v. United States, 404 F.3d 1346, 1356 (Fed. Cir.
2005) (specifying that bid protest proceedings “provide for trial on a paper record, allowing fact-
finding by the trial court”).
3
All citations to an administrative record refer to the Amended Administrative Record
filed on May 8, 2013. The record in this case is paginated sequentially and also divided into
tabs. When citing to the Amended Administrative Record, the court will first designate the tab in
which the cited material can be found, followed by the page number. For example, “AR 8-329”
refers to page 329, which is located in Tab 8 of the Amended Administrative Record.
4
AFNet was formerly titled “CITS Block 30 Foundation Spiral and Spiral 1,” and as such,
any references to the latter will be treated as equivalent to the former in this opinion. See AR 8-
328 (AFNet Life Cycle Management Plan).
2
(AFNet Sufficiency Review). As a “key component of reducing [Air Force] vulnerability to
cyber threats,” AFNet constantly enhances the Air Force’s security technology for its
unclassified and classified networks. Id. at 2121. This security is achieved in large part by
focusing on securing various “gateways” in the Air Force network system, each gateway
representing a potential point of ingress for cyber threats from outside the Air Force. See Def.’s
Mot. to Dismiss, or in the Alternative, Mot. for Judgment Upon the Admin. Record (“Def.’s
Mot.”) at 5 n.2.
During the early 2000s and before, AFNet practiced a “base-centric” form of security,
meaning that network security was managed primarily through securing individual base
boundaries. See AR 51-2114 (AFNet Sufficiency Review). The resulting structure was one
where each base had its own network boundary that had to be individually secured, amounting to
104 unique access points to the Air Force network. See AR 8-326 (AFNet Life Cycle
Management Plan). As time went on and technology shifts occurred, it became apparent that the
high number of access points and lack of standardization across bases made the base-centric
approach unwieldy, engendering a shift towards an Air Force-centric structure. See id. at 344.
This new approach was determined to have benefits that included “minimiz[ing] the entry points
to the [Air Force] Intranet; provid[ing] central management of policy, control and monitoring of
the [Air Force] network; and [feeding] into and complement[ing] the [Department of Defense
network] architecture.” Id. at 343. The shift reduced the number of primary network access
points from 104 to sixteen. Id. at 326. Now, to reach individual base networks, a threat must
first pass through one of the sixteen Air Force gateways. Under the new, less exposed system,
“[e]ach squadron has the capability to provide continuity of operations for the other.” Id. at 344.
When AFNet shifted to Air Force-centric security, it relinquished primary control over
the base boundaries. See AR 38-1652 to -53 (AFNet Gateway Technical Requirements
document (“TRD”) (Apr. 4, 2012)). Eventually, another program within CITS entitled the
Enclave Non-Classified Internet Protocol Firewall and Automated Security Incident
Measurement Sustainment (“ENFAAS”)5 assumed responsibility for shoring up the base
boundaries; however, ENFAAS was not fully functional until several years after AFNet shifted
to gateway security. See AR 45-1758 (Request for Proposal (“RFP”) for ENFAAS (Feb. 11,
2013)). Although AFNet now managed a first-wave line of defense against external threats at
the gateways, base boundaries still acted as a second line of defense against external assaults, as
well as a primary check against threats originating from within the Air Force network (which
never have to pass through any of the sixteen Air Force gateways because their points of origin
are inside those gateways). See Def.’s Mot. at 6-7.
To employ use funds appropriated for “products and services associated with the design,
engineering, integration, installation and configuration of Air Force networks and network
infrastructure,” CITS programs must expend those funds through a standing Indefinite
Delivery/Indefinite Quantity (“IDIQ”) contract group of system integrators, termed Network
Centric Solutions (“NETCENTS”). AR 1-1 (NETCENTS Memorandum (Jan. 27, 2005)). The
Department of the Air Force issued a mandatory use policy in January 2005, setting out the
5
The parties also refer to the base boundary management program as “AFNet 2,” but the
court will refer to it as ENFAAS going forward.
3
scope of NETCENTS contracts in a “Mandatory Use Decision Matrix.” AR 1; AR 2
(NETCENTS Mandatory Use Decision Matrix). Eight concerns had already been selected in
2004 through a competitive solicitation process for NETCENTS eligibility: General Dynamics
Information Technology, Inc., Centech Group, Inc., Harris IT Services Corporation, Northrop
Grumman Information Technology, Inc., NCI Information Systems, Inc., Booz Allen Hamilton,
Inc., Lockheed Martin Integrated Systems, Inc., and Telos Corporation. See Air Force
NETCENTS-1 Documents, www.netcents.af.mil/contracts/netcents-1/documents/index.asp (last
visited July 8, 2013). Because the NETCENTS group is the mandatory “primary source for
acquiring voice, video, and data communications hardware and software,” AR 1-1, both AFNet
and ENFAAS projects fall under the scope of NETCENTS, and are therefore required to
purchase through the NETCENTS IDIQ. McAfee is not, nor apparently has it ever been, a
qualified NETCENTS concern. However, it has frequently and successfully participated as a
subcontractor to NETCENTS concerns in the past. See, e.g., AR 57-2742 (General Dynamics
Response to AFNet RFP (Dec. 8, 2011)).
B. Next Generation Firewall Selection
Very recently, a new cyber-security technology has appeared on the market, called “next
generation firewall” (“nextgen firewall”) technology. See AR 15-526 ([***]). Nextgen firewalls
were pioneered by a company called Palo Alto Networks, and other tech companies have since
followed suit. AR 15-536. Whereas classic firewalls are designed to “detect and block . . .
attacks” attempting to penetrate network barriers, nextgen firewalls can also “enforce granular
security policy at the application (versus port and protocol) level.” Id. at AR 15-527. Thus,
while a classic firewall might detect a threat as it passes through a gateway, a nextgen firewall
could also detect a threat after it has breached the gateway, in this instance moving within Air
Force network space. Before nextgen firewall technology came onto the market, users looking
for this combination of security would have had to install a separate intrusion prevention system
in addition to a traditional firewall. After the advent of nextgen firewall technology, users could
achieve the same level, or higher, of security by using a single, sole-source nextgen program
instead. At no point during the relevant periods does it appear that McAfee offered a fully
integrated nextgen firewall product. See AR 72-3036 ([***]).
1. AFNet modifications.
Prior to the advent of nextgen firewalls, the Air Force employed firewalls and intrusion
prevention systems in tandem. This was the case in 2009, when AFNet began an upgrade of the
Air Force gateways. In September of 2009, the Air Force awarded General Dynamics
Information Technology, Inc. (“General Dynamics”) a delivery order for implementation of the
AFNet gateway update project. AR 7 (“AFNet Update 1 delivery order”). The AFNet Update 1
delivery order was not competed; the Air Force awarded the delivery order to General Dynamics
under one of the fair-opportunity exceptions in 48 C.F.R. [(Federal Acquisition Regulation
(“FAR”)] § 16.505(b)(2)(i). See AR 3-15 to 16 (Fair Opportunity Exception Justification, 2009)
(“The current [Air Force] security boundary is inadequate to face the increasingly sophisticated
cyber-attacks being detected. . . . The Air Force need for the [AFNet] configuration is so urgent
that providing a fair opportunity would result in unacceptable delays. . . . [General Dynamics]
4
. . . possesses a complete understanding of the current [AFNet] sites and knowledge of site-
specific conditions that no other contractor has at the present time.”).
As early as 2011, the Air Force had become aware of emerging nextgen technology and
was investigating its capabilities. See AR 36-1570 (Engineering Change Proposal (Sept. 19,
2012)). In February of 2011, the Air Force put out a Request for Information (“RFI”), soliciting
software vendors for information about their most recent cyber security products which could be
used on AFNet. See AR 52-2240 (2011 RFI). Specifically, that RFI inquired about devices
“which provide for the integration of both Firewall and Intrusion Detection/Prevention System
(IDPS) capabilities.” AR 52-2240. McAfee and Palo Alto both responded to the RFI, among
others. See AR 53-2335 to -2362 (McAfee’s Responses to RFI); AR 70-2989 to -3002
(Merlin/Palo Alto’s Response to RFI). In the meantime, Air Force networks continued to run
separate firewall and intrusion prevention software.
Somewhat later in 2011, AFNet’s systems were once again due for a routine upgrade and
modernization. Again, the Air Force determined that General Dynamics should receive the
award based upon a fair-opportunity exception. See AR 11-446 (Fair Opportunity Exception
Justification, 2011) (“Currently, [General Dynamics] is the only firm that possesses a complete
understanding of the ‘as installed’ AFNet Increment 1 System and has in-depth technical
knowledge of site-specific conditions necessary for continued support.”).
As the Air Force was preparing to issue the delivery order for the second AFNet update
(the “AFNet Update 2 delivery order”), it received alarming information from one of its
technical advisors, MITRE Corporation: MITRE predicted that due to increased network traffic,
AFNet gateway security would experience total failure by April 12, 2012. See AR 18-566 (Final
Price Negotiation Memorandum Addendum for Modification 2 to General Dynamics’s
NETCENTS Contract (Jan. 26, 2012)); see also AR 55 (MITRE Predicted Failure Timeline
(Sept. 1, 2011)). The AFNet Update 2 Delivery Order was modified to reflect an expedited
completion date of March 6, 2012, and included a requirement for both an updated firewall and
an updated intrusion prevention system. AR 54-2370, 2377 (AFNet Update 2 Delivery Order).
The AFNet Update 2 delivery order was awarded in December 2011. Id. at 2363. Prior to
AFNet Update 2, the sixteen Air Force gateways were using intrusion prevention software from
McAfee, namely the [***]. See AR 57-2742 (General Dynamics Response to AFNet RFP (Dec.
8, 2011)). The firewall in use at the time was designed by another software company, [***]. See
AR 24-823 (Modification Proposal, (Mar. 9, 2012)). General Dynamics recommended that in
light of the expedited schedule, the fastest and best way to upgrade the Air Force network would
be to install the newest version of the same software already in use. AR 57-2742. The Air Force
adopted this recommendation and incorporated it as modification of the delivery order that
ultimately issued. See AR 19 (Modification 02 to Delivery Order No. RSFB (Feb. 9, 2012)).
2. Trouble at the base level.
As AFNet was coping with the expedited update schedule on the Air Force gateways in
2011 and 2012, base level network security was experiencing its own difficulties. Because
AFNet abandoned direct management of the base boundaries, the Air Force had secured them in
part by using a device called the Automated Security Incident Measurement Sensor (“the
5
sensor”). See AR 71-3004 (Modification Proposal (Mar. 9, 2012)). Due to “failing equipment,
[sensor] overload and labor intensive management of the current system,” the sensor had to be
removed from the base boundaries, leaving them unacceptably vulnerable. See AR 63-2868 (E-
mail between Air Force personnel (Jan. 18, 2012)). The decision to decommission the sensor
was set to be implemented in April 2012. AR 36-1570 (Engineering Change Proposal (Sept. 19,
2012)).6 The Air Force had been using Generic Routing Encapsulations (“GREs”) as a band-aid
over the failing sensor, but it had concerns over the steep cost of continuing to purchase GREs in
light of the sensor’s deteriorating condition. See AR 12-497 (E-mail between Air Force
personnel (Aug. 20, 2011)).
With the impending sensor decommission looming over the base boundaries, the Air
Force scrambled to prevent network shut-down by increasing security elsewhere. ENFAAS
(then referred to as the Enclave Control Node) was only just coming into being, and would not
be ready in time to manage the base boundaries’ security gaps by April 2012. See AR 24-823
(Modification Proposal (Mar. 9, 2012)). An interim solution was required until ENFAAS could
take over administration of the base boundaries. Id. In search of a solution, the Air Force’s
Integrated Product Team held weekly meetings to explore emerging technologies, including
nextgen firewalls, which could be implemented at the AFNet gateway to compensate for
increased vulnerability at the base level. See AR 36-1570 (Engineering Change Proposal (Sept.
19, 2012)). Around August 2011, it appears that some of the internal conversations concerning
how to cope with the base boundaries touched on the possibility of a sole-source, brand-name
acquisition. See AR 12 (E-mail chain between Air Force personnel (Aug. 2011)).7
6
The actual date of decommission is not apparent from the administrative record. An Air
Force memorandum written on September 19, 2012 dates the sensor decommission to April
2012. See AR 36-1570. Similarly, the proposed modification dated March 9, 2012 states that
“[the sensor] was decommissioned on 31 March 2012,” AR 24-823, even though the reference
was to a future, not a past date. In all events, it is evident that the sensor was decommissioned at
some point during the spring of 2012, around the same time as AFNet Update 2 was adopted.
7
In August 2011, an Air Force contracting official expressed concern about “hand
pick[ing] a contractor” rather than defining capabilities. AR 12-490 (E-mail from Jacqueline
Johnson to Air Force personnel (Aug. 23, 2011)). The contracting officer quoted FAR § 11.105:
Agency requirements shall not be written so as to require a
particular brand name, product, or feature of a product, peculiar to
one manufacturer, thereby precluding consideration of a product
manufactured by another company, unless the particular brand
name or feature is essential to the [g]overnment’s requirements,
and market research indicates that other companies’ similar
products, or products lacking the particular feature, do not meet, or
cannot be modified to meet, the agency’s needs.
Id. She concluded that the Air Force officials were “getting out of their swim lane.” Id.
6
In September 2011, the Air Force decided to acquire Palo Alto nextgen firewall devices
for a proof-of-concept effort. See AR 74-3107 (Prototype Event/Test Report). The record does
not reflect that proofs of concept were undertaken for other systems. The stated purpose of the
proof-of-concept acquisition was to “shorten the overall lead-time” in the event of eventual
implementation of the products. Id. Contemporaneously, Air Force personnel discussed again
the possibility of a sole-source acquisition across the board for gateways and base boundaries,
debating whether “commonality with the enterprise” could support a brand-name justification at
this juncture. AR 13 (E-mail chain between Air Force personnel (Sept. 2011)).8
On December 22, 2011, the Air Force requested a sum of money for the purchase of Palo
Alto equipment for use in this proof of concept, termed an “Operational Requirement
Assessment.” AR 73-3076 (Request for Funding). The funds were authorized on January 12,
2012. Id. at 3078 (Fund Cite Authorization). The proof-of-concept assessment spanned several
months, extending through March of 2012. Id. at 3098 (Modification of Contract (Mar. 30,
2012)). The government represents that, at the end of the proof-of-concept period, the Palo Alto
products were uninstalled. Hr’g Tr. 31:21-25 (June 13, 2013).9
While the proof-of-concept assessment was still ongoing, Air Force personnel were
already discussing ways to integrate the “emerging requirement” of a gateway nextgen firewall
project into the current AFNet delivery order as quickly as possible. See AR 59 (Feb. 2012 e-
mails between Air Force personnel).
On March 9, 2012, the Integrated Product Team issued a set of proposed modifications to
the AFNet Upgrade 2 Delivery Order, which included deployment of nextgen firewalls at AFNet
gateways, with the caveat that the nextgen system must be “tightly integrated with a full packet
capture and forensics system so that security events from the [nextgen firewall] can be used to
directly launch queries within the packet capture system.” AR 24-824 (Proposal for
Modification 06 to Delivery Order No. RSFB (Mar. 9, 2012)). Such a firewall, the team posited,
would meet the interim requirement and prevent network shut-down when the sensors went
offline at the base boundaries. See id. That same day, an Air Force Supervisory Contracting
Officer informed General Dynamics that it should “hold off on purchasing all of the equipment
for [AFNet Update 2],” indicating that further instructions would be forthcoming. AR 25-827
(E-mail from Debbie Hamilton, Supervisory Contracting Officer, Air Force, to Nathan Keller,
General Dynamics).
On March 20, 2012, five courses of action (“COAs”) were presented to Air Force
management. AR 64-2875 to -2892 (COA Presentation Slides). Each of the five COAs included
8
In September 2011, a second Air Force contracting official commented that “[b]rand
[n]ame justifications cannot be supported due to commonality at initial introduction into the
system[;] there needs to be a greater rationale, such as a system is on the network and accredited,
etc.” AR 13-498 (E-mail from Ed Coyne to Jonathan Kelley, Paul McIntyre, and Peter Jenny
(Sept. 30, 2011)).
9
Further references to the transcript of the hearing on the merits held on June 13, 2013,
will omit the date.
7
a nextgen component, but varied over whether and to what extent additional security software
such as McAfee’s would also be employed. COA 5, which detailed a combination of nextgen
firewall, full-packet-capture software, and McAfee’s [***], was the recommended solution at the
March 20 meeting. Id. at 2888, 2891. It was rated as “[b]est value,” “[m]ost cost effective,” and
“[l]owest security risk” of all the proposed COAs. Id. at 2891.
Nonetheless, the Air Force opted not to adopt the recommended COA, and instead chose
to proceed with COA 2. See Hr’g Tr. 119:20-21. COA 2 incorporated a nextgen firewall and a
full-packet-capture system, but [***]. AR 64-2883 (COA Presentation Slides). One of the
[***]. Id. Furthermore, COA 2 was rated “[t]oo expensive,” and predicted to be “[u]nable to
meet target date.” Id. In spite of these drawbacks, the Air Force decided to implement COA 2,
effectively moving Air Force networks to a sole-source security configuration and eliminating
from any potential competition those software companies which did not offer fully integrated
nextgen technology and full-packet capture.10
On April 6, 2012, the Air Force moved to implement COA 2 by issuing an informal
advance Request for Proposal (“RFP”) to General Dynamics, which included an explanation of
the technical requirements the new AFNet Update 2 would need to meet. AR 71 (Advance
RFP). The advance RFP did not contain specific brand-name preferences, but reflected detailed
program requirements comporting with and expanding on those in the March 9, 2012 proposed
modifications to the AFNet Upgrade 2 Delivery Order. Id.
On April 12, 2012, General Dynamics responded to the requirements posited informally
by the Air Force. See AR 27 (Response to TRD). In its response to the informal RFP, General
Dynamics recommended the Palo Alto [***] nextgen firewall, citing to market research
performed in 2011, as well as to particular program features, as the basis for this
recommendation. Id. at 880. General Dynamics referred to the “2011 Magic Quadrant for
Enterprise Network Firewalls,” noting that Palo Alto had been recognized as a leader in the
upper-right quadrant. Id.11 According to General Dynamics, Palo Alto’s software and devices
“me[t] or exceed[ed]” all requirements provided in the RFP. Id. Neither General Dynamics nor
the Air Force held a competitive solicitation for a nextgen firewall provider.
The Magic Quadrant identifies at least one other software company, Check Point
Software Technologies, as a leader in firewall technology with nextgen firewall products. See
AR 72-3021 ([***]). The accompanying [***] McAfee did not have a fully integrated nextgen
product in 2011. See AR 15-535 ([***]).
10
The requirements as issued state that the firewall and full packet capture program must
be “tightly integrated so that security events from the [nextgen firewall] can be used to directly
launch queries within the [full packet capture program].” AR 27-882 (Response to Technical
Requirements Document (“TRD”)). This edict essentially amounts to a requirement that the two
programs be manufactured by the same company, or sole source.
11
The “Magic Quadrant” is a graphic representation of software providers and their
current capabilities, generated annually by Gartner, Inc., a technology research group.
8
On April 16, 2012, the Air Force authorized General Dynamics to proceed with AFNet
Update 2 with the changes as recommended in COA 2, replacing McAfee and [***] software
with the Palo Alto nextgen firewall program. See AR 28 (E-mail from Debbie Hamilton to
General Dynamics). The official RFP was issued on May 3, 2012, incorporating the earlier
TRD, at which point formalities were observed to make the modification to AFNet Update 2
official. See AR 29 (RFP). The parties refer to this step as “modification 6,” and the court will
use this shorthand going forward. The portion of the TRD related to nextgen firewalls does not
contain a specific brand-name requirement. AR 29-934 to -938. It does require that the nextgen
firewall be configured “to perform [sensor] functionality of base [and] . . . to replace [intrusion
prevention software] and [classic firewall] functionality.” AR 29-936. It goes on to specify that
the nextgen firewall must perform “[a]pplication identification,” “content filtering” and “[t]hreat
detection.” AR 29-937. By the time the sensor went offline at the base boundaries, the Air
Force had in place its nextgen firewall contingency plan at the gateway level, and no network
shutdown was required.
3. Bringing the base boundaries up to par.
Although the installation of nextgen firewalls at the Air Force gateways staved off
network failure, the Air Force nevertheless needed to improve security at the base boundaries
after the sensor went offline. To that end, on October 11, 2012, the Air Force requested that
ENFAAS develop a request for proposals “that includes a Next Generation Firewall . . . to secure
the base boundary.” AR 39-1662 (ENFAAS Procurement Directive (Oct. 11, 2012)).
In November 2012, MITRE investigated the possibility of installing non-Palo Alto
nextgen firewalls at the base boundaries, which it assumed would require replacement of the
gateway firewalls as well.12 Specifically, MITRE attempted to calculate the cost of such a
replacement. MITRE determined that the removal of Palo Alto from the gateways and
replacement with a non-Palo Alto software (referred to as the “rip and replace”) would cost
roughly $[***]. AR 41-1685 (E-mail from Jeff D’Amelia, MITRE, to Amy Smith, Air Force
(Nov. 26, 2012)). If the Air Force proceeded with its plan of implementing a common
management component between the gateways and the base boundaries, the rip and replace
would become necessary only if a vendor other than Palo Alto was selected for the base
boundaries. Notably, the court cannot find in the administrative record any indication that either
the Air Force or MITRE seriously considered whether it would be possible to install a second
management platform to run a non-integrated component of the network security system, at least
after the Air Force’s choice of COA 2 in March 2012. Correlatively, other than the MITRE
assessment, the Air Force does not appear to have contemplated any use of a fully integrated
common management platform other than that provided by Palo Alto.
12
MITRE considered that replacement of the gateway Palo Alto firewalls would be
required if a non-Palo Alto system was installed at the boundaries, so that the gateways and base
boundaries could run on the same management platform. AR 41-1683 (E-mail from Jeff
D’Amelia, MITRE, to Amy Smith, Air Force (Nov. 26, 2012)) (indicating that the Air Force was
looking for a “common management component”).
9
In January 2013, ENFAAS issued a Brand Name Justification, stating that it intended to
use a Palo Alto nextgen firewall at the base boundaries. See AR 44-1707 to 1711 (Brand Name
Justification (Jan. 2013)). Under FAR § 16.505(a)(4), procurements may be performed on a
brand-name basis if certain requirements are met, namely that “[t]he contracting officer must
justify restricting consideration to an item peculiar to one manufacturer.” FAR § 16.505(a)(4)(i).
The justification offered by ENFAAS hinged on the fact that “Palo Alto [nextgen firewalls] are
the only devices that can integrate with the existing [AFNet] management system. . . . Without
Palo Alto [nextgen firewalls at the base level,] enterprise management of the [nextgen firewalls]
deployed as part of ENFAAS would not be achievable.” AR 44-1709. The Brand Name
Justification indicates that the Air Force desires “to deploy identical policy configurations,
identical software/firmware updates, identical hot fixes, identical patches, identical application
signature updates, identical threat signature updates and identical custom signatures to all
systems at the [AFNet gateways] and [ENFAAS base boundaries].” Id. To accomplish these
goals, the systems at the gateways and the base boundaries must be controlled by the same
management system. Id. Because the gateways were already operating on a Palo Alto
management system, the base boundaries had to run Palo Alto software to integrate with the
existing infrastructure. Id.
On February 11, 2013, the Air Force issued a Request for Proposal (“RFP”) under
NETCENTS requesting a solution for ENFAAS security comprised of a nextgen firewall which
would be compatible with the system installed by AFNet through modification 6. See AR 45
(ENFAAS RFP).13 This RFP contained a brand-name requirement for Palo Alto nextgen firewall
products. Id. at 1715 (“These brand name items are required, no substitutions are authorized.”).
The ENFAAS task order has not yet been awarded. McAfee filed suit in this court on
March 19, 2013, alleging that the Air Force’s decision to convert to a sole-source system
improperly denies it the opportunity to compete as a subcontractor for such NETCENTS projects
as the pending ENFAAS contract. Compl. ¶ 1. On May 3, 2013, McAfee filed a motion for
judgment on the administrative record, see Pl.’s Mot. for Judgment on the Admin. Record (“Pl.’s
Mot.”), ECF No. 20, and the government concurrently filed a motion to dismiss pursuant to Rule
12(b)(1) of the Rules of the Court of Federal Claims (“RCFC”), or in the alternative, for
judgment on the administrative record, see Def.’s Mot. A hearing was held on June 13, 2013.
JURISDICTION
McAfee predicates the court’s jurisdiction upon the Tucker Act as amended by the
Administrative Dispute Resolution Act, Pub. L. No. 104-320, § 12, 110 Stat. 3870, 3874 (Oct.
19, 1996) (codified at 28 U.S.C. § 1491(b)(1)). Compl. ¶ 6. In pertinent part, that statutory
13
While the accompanying memorandum is dated February 11, 2013, the RFP itself is
dated January 31, 2012. AR 45-1713 to 14. Given the facts that in January 2012, the proof of
concept had not even been completed and that Palo Alto’s system had not yet been implemented
in the AFNet gateways, the court regards the January 31, 2012 date as a typographical error
where January 31, 2013 was meant. The Air Force could not possibly have requested base
boundary security “that can integrate with the existing Air Force . . . [g]ateways management
system,” AR 45-1715, before the gateway management system existed.
10
provision grants the court juridical power
to render judgment on an action by an interested party
objecting to a solicitation by a [f]ederal agency for bids or
proposals for a proposed contract or to a proposed award or
the award of a contract or any alleged violation of a statute
or regulation in connection with a procurement or a
proposed procurement.
28 U.S.C. § 1491(b)(1). The government contests jurisdiction on two grounds: first, that this
court cannot review an in-scope modification of a pre-existing delivery order issued in accord
with an IDIQ contract, such as modification 6, and second that McAfee lacks standing as an
interested party to bring this suit in relation to the ENFAAS solicitation. Def.’s Mot. at 24-33.
When considering a motion to dismiss for lack of jurisdiction, the court will construe
alleged facts in the light most favorable to the pleader. Reynolds v. Army & Air Force Exch.
Serv., 846 F.2d 746, 747 (Fed. Cir. 1988)). Nevertheless, the plaintiff bears the burden of
establishing subject matter jurisdiction by a preponderance of the evidence. McNutt v. General
Motors Acceptance Corp. of Ind., 298 U.S. 178, 189 (1936); Reynolds, 846 F.2d at 748 (citing
Zunamon v. Brown, 418 F.2d 883, 886 (8th Cir. 1969)).
A. Modification 6 of the AFNet Update 2 Delivery Order
The government points out, correctly, that this court has no jurisdiction to review an in-
scope modification of a delivery order issued under a contract that was competitively awarded.
Def.’s Mot. at 25; see AT&T Commc’ns, Inc. v. Wiltel, Inc., 1 F.3d 1201, 1205 (Fed. Cir. 1993)
(“[O]nly modifications outside the scope of the original competed contract fall under the
statutory competition requirement.”). Modification 6 technically is a modification of the AFNet
Update 2 delivery order issued to General Dynamics under the firm’s NETCENTS IDIQ
Contract. See supra pp. 7-9. If McAfee sought the court’s review of modification 6, it would
face the daunting task of demonstrating that modification 6 did more than merely “add[] work to
an existing contract that is clearly within the scope of the contract.” Distributed Solutions, Inc. v.
United States, 539 F.3d 1340, 1346 (Fed. Cir. 2008); see also 41 U.S.C. § 3105(b)(1) (“[A]
contract is a new contract unless the work provided for in the contract is a continuation of the
work performed by the specified entity under a prior contract.”). Furthermore, the government
argues, McAfee cannot challenge the original award of the delivery order because this court does
not have jurisdiction to review such orders, unless the court is presented with “a protest on the
ground that the order increases the scope, period, or maximum value of the contract under which
the order is issued.” Def.’s Mot. at 26 (quoting 10 U.S.C. § 2304c(e)(1)).
Nonetheless, the jurisdictional analysis pertinent here is much less complex than that
postulated by the government. The predicate for McAfee’s claim is not modification 6 of the
AFNet Update 2 delivery order issued to General Dynamics. Rather, what McAfee actually
challenges is the underlying decision by the Air Force to standardize its network security
structure using a sole-source nextgen scheme. See Compl. ¶ 1 (“This action protests the decision
of the [Air Force] to acquire by brand name and without proper competition [Palo Alto
11
products].”) (emphasis added). This decision is not tied to any single solicitation or delivery
order, but encompasses the whole of the Air Force’s procurement of a new network security
structure. McAfee alleges that the Air Force violated 41 U.S.C. § 3301 and 10 U.S.C. § 2304(a)
when it determined, without competition, to move from multiple-source security to sole-source
security, effectively cutting out McAfee and all security providers other than Palo Alto. Pl.’s
Mem. in Support of Mot. for Judgment on the Admin. Record (“Pl.’s Mem.”), ECF No. 21, at 19.
As such, McAfee’s complaint falls under the third prong of Section 1491(b)(1), concerning an
alleged “violation of statute or regulation in connection with a procurement or a proposed
procurement.” 28 U.S.C. § 1491(b)(1); see also Rothe Dev., Inc. v. United States Dep’t of Def.,
666 F.3d 336, 338 (5th Cir. 2011) (“[T]he Court of Federal Claims now retains exclusive
jurisdiction over ‘action[s] by an interested party’ ‘objecting to . . . any alleged violation of
statute or regulation in connection with a procurement or a proposed procurement.’” (citing 28
U.S.C. § 1491(b)(1))).
The third prong of Section 1491(b)(1) is “very sweeping in scope.” Angelica Textile
Servs., Inc. v. United States, 95 Fed. Cl. 208, 215 (2010) (citing RAMCOR Servs. Group, Inc. v.
United States, 185 F.3d 1286, 1289 (Fed. Cir. 1999)). “[A] procurement ‘includes all stages of
the process of acquiring property or services, beginning with the process for determining a need
for property or services and ending with the contract completion and closeout.’” Id. (quoting 41
U.S.C. § 403(2), now codified at 41 U.S.C. § 111); see also Distributed Solutions, 539 F.3d at
1346 (“[For jurisdiction, a ‘procurement’] involves a connection with any stage of the federal
contracting acquisition process, including the process for determining a need for property or
services.”) (internal quotations omitted); OTI America, Inc. v. United States, 68 Fed. Cl. 108, 117
(2005) (holding that the “broad language” of Subsection 1491(b) demonstrated “Congress’s
expressed intent that the Subsection encompass the entire procurement process”).
The Air Force began the process of determining its need for a new generation of network
security services long before it issued the delivery order for AFNet Update 2, let alone modified
it. The original AFNet Update 2 delivery order to General Dynamics, structured in a non-sole-
source manner, was issued on December 9, 2011. See AR 54 (AFNet Update 2 delivery order).
Considerably earlier than that, in February 2011, ten months prior to the original AFNet Update
2 order, the Air Force had begun to inform its eventual decision to switch to nextgen technology
by issuing the Request for Information. See AR 52 (2011 RFI). By the time modification 6
occurred, the Air Force was far along in the decision-making process, indeed, nearly finished
with it. Modification 6 was but one further step in a series of moves that had already been taken
by the Air Force to implement its decision to shift the entire network to sole-source security. As
such, McAfee’s complaint does not turn on modification 6, and, to establish jurisdiction, McAfee
need not demonstrate any change in scope from the original AFNet Update 2 delivery order to
the modified delivery order. See RAMCOR, 185 F.3d at 1289 (Ҥ 1491(b) . . . does not require
an objection to the actual contract procurement. . . . As long as a statute has a connection to a
procurement proposal, an alleged violation suffices to supply jurisdiction.”).14
14
The government also makes the argument that McAfee as a subcontractor lacks privity
of contract with the Air Force and thus may not sue the government directly. Def.’s Mot. at 30.
As explained above, McAfee does not premise jurisdiction either on the AFNet Update 2
delivery order or on the NETCENTS IDIQ contracts, so privity of contract is not at issue.
12
B. The ENFAAS Solicitation
The government challenges this court’s jurisdiction over the brand-name restriction in the
ENFAAS task order (which has not yet been awarded) on the same statutory grounds as it
challenges jurisdiction over modification 6 to the AFNet Update 2 delivery order. Specifically,
the government argues that this court does not have jurisdiction over the delivery order itself and
thus cannot consider McAfee’s arguments here. Def.’s Mot. at 31. For the same reasons as
those described above in relation to modification 6, this objection is unavailing. McAfee does
not challenge the delivery order in and of itself, but rather the decision made by the Air Force to
standardize its entire network security scheme. The ENFAAS solicitation is but another stepping
stone in the culmination of this challenged decision.
The government additionally attacks McAfee’s standing to raise a sole-source challenge.
McAfee, the government argues, is not an “interested party” to the ENFAAS solicitation, and
consequently cannot protest the bidding or lack thereof on that solicitation. Def.’s Mot. at 31
(citing 28 U.S.C. § 1491(b)(1)). It argues that because McAfee is not a NETCENTS contractor,
it could not possibly have submitted a bid on the ENFAAS solicitation. Id. at 32.
To qualify as an interested party to a bid protest under section 1491(b)(1), a party must be
an “actual or prospective bidder[] or offeror[] whose direct economic interest would be affected
by the award of the contract or by the failure to award the contract.” American Federation of
Gov’t Emps., AFL-CIO v. United States, 258 F.3d 1294, 1302 (Fed. Cir. 2001), modified in
another respect by Weeks Marine Inc. v. United States, 575 F.3d 1352, 1359-62 (Fed. Cir. 2009);
see also Rex Serv. Corp. v. United States, 448 F.3d 1305, 1307 (Fed. Cir. 2006) (noting that the
term “interested party” has the same meaning in both Section 1491(b)(1) and in CICA). McAfee
is neither an actual nor a prospective bidder on the ENFAAS contract. Even if there had been no
brand-name requirement for the ENFAAS solicitation, McAfee could not have competed directly
for the award due to its lack of NETCENTS qualification. At best, McAfee could have been a
subcontractor to a NETCENTS awardee, which NETCENTS concern would have been the
primary contractor with the government. As a mere subcontractor, McAfee would not possess
standing to challenge the terms of the solicitation. See Distributed Solutions, 539 F.3d at 1344(noting that mere “disappointed subcontractors” do not have standing in a bid protest).
Again, however, the government misses the thrust of McAfee’s complaint with this
standing argument. McAfee objects to the fact that the entire Air Force network scheme is
premised on a sole source of fully integrated nextgen technology. Pl.’s Mem. at 1-2. The
ENFAAS solicitation, much like modification 6 of the AFNet Update 2 delivery order,
represents one incremental step towards the Air Force’s ultimate goal: complete control over the
entirety of network security via a single management system. The affirmative decision to
standardize the entire network system was made when the Air Force adopted COA 2 rather than
COA 5. See supra p. 8. Had the Air Force pursued COA 5 (or any of the non-standardized
COAs), McAfee would have been eligible to compete, as would a number of other network-
security providers, some with fully integrated systems and some with add-ons. COA 2, however,
precluded all manufacturers who did not offer a specific type of fully integrated single-source
nextgen solution, i.e., any system other than that produced by Palo Alto, from competing for Air
13
Force network-security procurements. But for the decision to standardize with Palo Alto,
McAfee would have had a substantial chance of continuing in its role as a security services
provider for the Air Force.
The court’s reasoning in Savantage Fin. Servs., Inc. v. United States, 81 Fed. Cl. 300(2008), is instructive on the question of standing. In Savantage, the Department of Homeland
Security determined to standardize its financial systems application software by selecting a
particular program without competition, issuing a Brand Name Justification, and then conducting
a solicitation for implementation services only. 81 Fed. Cl. at 302-03. The implementation task
order was open to prospective offerors from a specific IDIQ only. Id. The plaintiff was not a
member of the IDIQ, and furthermore could not offer the services requested by the solicitation;
however, it did provide a financial software at the time which could have served the
government’s needs. Id. at 306.
The court in Savantage determined that the government’s standardization decision
qualified as a “procurement” through which the plaintiff could establish jurisdiction. 81 Fed. Cl.
at 305 (“[D]efendant has not identified any competitive process through which [the government]
decided to standardize to Oracle and SAP financial systems application software. The failure to
make that determination through a competitive process is exactly what [plaintiff] is protesting.”).
The court held that the plaintiff had standing, even though it was not eligible to receive the only
actual task order issued in relation to the matter: “Because plaintiff currently supplies a
competitive . . . software system to [the government], it clearly could have competed for the
contract if [the government] had bid it out. Furthermore, defendant has failed to point to any
reason why plaintiff would not have been a qualified bidder to supply such a system. Therefore,
plaintiff has standing to protest [the government’s] decision.” Id. at 306; see also Myers
Investigative & Sec. Servs., Inc. v. United States, 275 F.3d 1366, 1370 (Fed. Cir. 2002) (“To
have standing, the plaintiff need only establish that it ‘could compete for the contract’ if the bid
process were made competitive.” (quoting Impresa Construzioni Geom. Domenico Garufi v.
United States, 238 F.3d 1324, 1334 (Fed. Cir. 2001)).
The government argues that McAfee is in a position similar to that of the plaintiff in
DataMill, Inc. v. United States, 91 Fed. Cl. 740 (2010). Def.’s Mot. at 27-30. In DataMill, an
incumbent contractor objected to the award of a delivery order to a competitor under an already-
existing Navy contract held by the competitor. 91 Fed. Cl. at 751. The court determined that
there was no jurisdiction, even though the incumbent contractor attempted to characterize its suit
as a protest of the decision not to conduct a competition and instead to issue the delivery order.
Id. at 755. Because the DataMill plaintiff had “not alleged that the delivery order in this case
exceeded the scope, period, or maximum value of the [c]ontract,” its objection to the delivery
order itself could not be salvaged by framing it in terms of the decision to proceed without
competition. Id. at 762.
The present case is distinguishable from DataMill. As the court noted in Bayfirst
Solutions, LLC v. United States, 104 Fed. Cl. 493 (2012), “it may be that each protest requires a
fact-intensive inquiry as to the agency’s decision-making process, and a careful analysis of the
connectedness of each challenged procurement decision to the issuance or proposed issuance of a
task order.” Id. at 503. In the instant case, the protested decision is not directly connected to the
14
award of any particular delivery order. McAfee protests a decision made by the Air Force to
standardize an entire system — a decision connected to the procurement process, but not to a
specific delivery order. Both modification 6 and the ENFAAS solicitation are simply natural
consequences of the decision, but neither comprises the jurisdictional basis of this protest.
McAfee is in a position comparable to that of the Savantage plaintiff. Although it may
have been a subcontractor at best to any NETCENTS contractor, the government cannot escape
its obligation to conduct competition by delegating the task of source selection to a competitively
selected primary contractor. See Distributed Solutions, 539 F.3d at 1346 (“While the
government ultimately decided not to procure software itself from the vendors, but rather to add
that work to its existing contract with [a primary contractor], the statute does not require an
actual procurement.”). McAfee complains of the decision to pursue a sole-source course of
action, which the Air Force considered as an alternative to at least four other courses of action
which involved a variety of potential software vendors, including McAfee. See AR 64 (COA
Presentation Slides). The Air Force made the decision to implement COA 2, and General
Dynamics as the designated NETCENTS contractor was implementing the Air Force’s decision
through modification 6 of the AFNet Update 2 delivery order and the ENFAAS solicitation.
Thus, McAfee has demonstrated that it is an interested party to the procurement decisions made
by the Air Force in relation to its cyber security needs.
The court has jurisdiction to consider McAfee’s suit under 28 U.S.C. § 1491(b)(1).
DISCUSSION
A. Standard for Decision
The primary standard for decision in a bid protest is specified in 28 U.S.C. § 1491(b)(4)
(“In any action under this [S]ubsection, the courts shall review the agency’s decision pursuant to
the standards set forth in [S]ection 706 of title 5.”). Under the Administrative Procedure Act
(“APA”), the court may set aside an agency’s procurement decision if it is “arbitrary, capricious,
an abuse of discretion, or otherwise not in accordance with law,” 5 U.S.C. § 706, subject to
satisfying the criteria for equitable relief, see PGBA, LLC v. United States, 389 F.3d 1219, 1224-
28 (Fed. Cir. 2004). In other words, to rescind a procurement decision, the court must find that
the “decision lacked a rational basis; or . . . the procurement procedure involved a violation of
regulation or procedure.” Impresa Construzioni Geom. Domenico Garufi, 238 F.3d at 1332; see
also Superior Helicopter, LLC v. United States, 78 Fed. Cl. 181, 187 (2007). The court may not
“substitute its judgment for that of the agency” during its analysis. Keeton Corrs., Inc. v. United
States, 59 Fed. Cl. 753, 755 (2004) (quoting Citizens to Preserve Overton Park, Inc. v. Volpe,
401 U.S. 402, 416 (1971), abrogated in part by Califano v. Sanders, 430 U.S. 99, 105 (1977)
(abrogating Overton Park to the extent it reorganized the APA as an independent grant of subject
matter jurisdiction). To afford relief, it must find a that the procurement decision was not “based
on a consideration of the relevant factors,” or that there has been a “clear error of judgment.”
Overton Park, 401 U.S. at 416. The plaintiff must show this clear error or violation of relevant
statute or regulation by a preponderance of the evidence. Gentex Corp. v. United States, 58 Fed.
Cl. 634, 648 (2003) (citing Information Tech. & Applications Corp. v. United States, 51 Fed. Cl.
340 (2001), aff’d 316 F.3d 1312 (Fed. Cir. 2003)).
15
B. Analysis
McAfee alleges that the Air Force violated CICA, 41 U.S.C. § 3301, as well as 10 U.S.C.
§ 2304(a), and certain provisions of the FAR, when it failed to conduct a competition or provide
appropriate justification prior to its decision to shift to a sole-source network security scheme.
Compl. ¶¶ 22-25; Pl.’s Mem. at 19. McAfee also characterizes the Air Force’s exclusive
selection of Palo Alto products as arbitrary and capricious. Compl. ¶¶ 26-27.
1. Improper procurement.
The statutory underpinnings of the governmental procurement process require
competition in almost every conceivable scenario. CICA states that for public contracts, with
only narrow, specific exceptions,
an executive agency in conducting a procurement for property or services shall—
(1) Obtain full and open competition through the use of competitive procedures
in accordance with the requirements of this division and the [FAR]; and
(2) Use the competitive procedure or combination of competitive procedures that
is best suited under the circumstances of the procurement.
41 U.S.C. § 3301(a). Almost identical language is reiterated in specific reference to
procurements conducted by the Armed Forces in 10 U.S.C. § 2304(a). Both statutes indicate that
procurements must be conducted “in accordance with the [FAR].” 41 U.S.C. § 3301(a); 10
U.S.C. § 2304(a).
The administrative record manifestly demonstrates that the Air Force did not conduct an
open competition for its network security needs prior to selecting COA 2. It did not issue a
direct solicitation, nor did it instruct any of its NETCENTS contractors to hold one. Yet, with
the selection of COA 2 in 2012, the entirety of the Air Force’s network security infrastructure
was directed towards a sole-source standardization.
The enumerated exceptions to the statutory directives for competition are narrow and do
not apply here. The first such exception is whether “the property or services needed by the
agency are available from only one responsible source or only from a limited number of
responsible sources and no other type of property or services will satisfy the needs of the
agency.” 10 U.S.C. § 2304(c)(1). At the point in time when the Air Force decided to pursue
sole-source network security software, it was fully aware of other sources or combinations of
sources which could have provided network security. See AR 64-2875 to -2892 (COA
Presentation Slides). However, even before the COA presentation in March 2012, the Air Force
had expressed its preference for a sole-source plan. See AR 64-2883 (noting as the only “pro”
for COA 2 that it “[m]eets [the Air Force’s] original request”). The Air Force cannot claim that
there were no other options available but to pursue the sole-source procurement, and cannot
justify its failure to evaluate other options competitively. See Savantage, 81 Fed. Cl. at 308
(“[S]o long as there is more than one source competent to perform the contract, [the government]
must evaluate the merit of each offeror’s product through the competitive lens.”).
16
The second enumerated exception to competitive procurement arises where “the agency’s
need for the property or services is of such an unusual and compelling urgency that the United
States would be seriously injured unless the agency is permitted to limit the number of sources
from which it solicits bids or proposals.” 10 U.S.C. § 2304(c)(2). Yet COA 2, the sole-source
option, was not the fastest course of action presented to the Air Force in 2012. In fact, COA 1 is
listed as the “[f]astest COA,” belying any possible assertion that a compelling urgency mandated
the selection of COA 2 instead. AR 64-2882 (COA Presentation Slides).
The remaining exceptions to competitive procurement are no less availing for the
government. The third allows non-competitive procurements if needed to maintain suppliers
during a national emergency, if a nonprofit or federally funded research center must be
established or maintained, or if services are required for litigation. 10 U.S.C. § 2304(c)(3). The
fourth and fifth exceptions concern situations where international treaties or express statutes
mandate other than competitive procedures. Id. § 2304(c)(4)-(5). The sixth exception allows an
agency to dispense with competition if disclosing the needs in an open solicitation would
compromise national security. Id. § 2304(c)(6). Finally, the seventh exception to competitive
procurements requires simply that it be “necessary in the public interest” to use non-competitive
procedures; however, in such a case, the head of the agency must notify Congress in writing of
such a determination “no less than 30 days before the award of the contract.” Id. § 2304(c)(7).
None of these situations apply here.
The government contends that its discrete procurement actions (modification 6 and the
ENFAAS solicitation) violate neither CICA nor the FAR. Def.’s Mot. at 34-44. The
government emphasizes that in-scope modifications are insulated from significant oversight and
that the ENFAAS solicitation was accompanied by a Brand Name Justification. However, these
particular actions cannot be considered in isolation. The cited actions are but steps taken to
implement a broader scheme of standardization and sole-source procurement. The fact that the
government may have taken ostensibly insulated steps to accomplish an improper goal does not
redeem the government’s actions. Rather, the court looks to the predicate decision to adopt a
sole-source infrastructure. In that respect, the government’s arguments are severely undercut by
the commentaries of two Air Force contracting officials in August and September 2011
expressing concern about moving to a sole-source system without demonstrated justification.
See supra nn.7-8. Given that there were known, additional, responsible, multiple-source options
available to the Air Force at the time the key decision was made, its decision to use a sole-source
security system without competition does not accord with CICA and its counterpart for the
Department of Defense, 10 U.S.C. § 3204. See Savantage, 81 Fed. Cl. at 308; ATA Def. Indus.,
Inc. v. United States, 38 Fed. Cl. 489, 502 (1997) (“[T]he contracting officer reasonably was on
notice that . . . certain of the products and services purchased under the contract on a sole source
basis [were] available competitively. . . . The contracting officer’s decision to purchase on a sole
source basis $193,060 worth of goods and services that could have been purchased on the open
market was an abuse of his discretion and not in accordance with law.”), abrogated on other
17
grounds as recognized by Baltimore Gas and Elec. Co. v. United States, 290 F.3d 734 (4th Cir.
2002).15
2. Prejudice.
Relief in a bid protest is contingent not only upon the finding of an error in the
procurement process, but also upon a showing that the error prejudiced the protestor. See Data
Gen. Corp. v. Johnson, 78 F.3d 1556, 1562 (Fed. Cir. 1996). To establish that it has been
prejudiced by the Air Force’s improper procurement, McAfee must demonstrate a “substantial
chance it would have received the [or a] contract award, but for the alleged error in the
procurement process.” Gentex, 58 Fed. Cl. at 653 (citing Information Tech. & Applications, 316
F.3d at 1319); see also Alfa Laval Separation, Inc. v. United States, 175 F.3d 1365, 1367 (Fed.
Cir. 1999); Data Gen., 78 F.3d at 1562.
McAfee has demonstrated that it was prejudiced by the Air Force’s inappropriate
procurement selection. Had the Air Force competed a solution to its network security needs,
McAfee could have offered its products as discrete pieces of a bundle or composite compiled by
a primary NETCENTS contractor precisely as it had done in the past. Furthermore, McAfee’s
[***] program, already in use on the network, was an integral part of the recommended COA 5
considered by the Air Force. See AR 64-2888. Given these circumstances, McAfee has shown
that it had “greater than an insubstantial chance of securing [a] contract” once it succeeded on the
merits of its protest. Information Tech., 316 F.3d at 1319.
C. Relief
McAfee requests injunctive relief which would prohibit the Air Force from moving
forward with any sole-source network security procurement. Pl.’s Mem. at 39. To grant
permanent injunctive relief, the court must consider “whether (1) the plaintiff has succeeded on
the merits, (2) the plaintiff will suffer irreparable harm if the court withholds injunctive relief, (3)
the balance of hardships to the respective parties favors the grant of injunctive relief, and (4) the
public interest is served by a grant of injunctive relief.” Centech Grp., Inc. v. United States, 554
F.3d 1029, 1037 (Fed. Cir. 2009) (citing PGBA, LLC v. United States, 389 F.3d at 1228-29.
1. Success on the merits.
McAfee has succeeded on the merits of its case by showing that the Air Force
improperly, and without competition, selected a sole-source network security framework.
Accordingly, the first factor weighs in favor of the plaintiff.
15
Although McAfee does not appear to have had a comparable nextgen firewall product
at the time of these determinations, see AR 72.1-3036 ([***]); AR 15-535 ([***]), it represents
that it had available a combination of programs capable of providing the same service, see AR
53-2279 (McAfee’s Response to RFI). It may be that this combination approach would have
ultimately proved less effective than a unified nextgen system; however, the court does not have
that information before it, as the Air Force never competed the two solutions against one another.
Other vendors were also potential competitors because they did have fully integrated systems.
18
2. Irreparable harm.
McAfee argues that it will suffer irreparable harm in the form of an “organizational lock-
in” on the Air Force’s network security needs, citing Google, Inc. v. United States, 95 Fed. Cl.
661 (2011). Pl.’s Opp’n to Def.’s Mot. for Judgment on the Admin. Record and Mot. to Dismiss
(“Pl.’s Opp’n”) at 25-27, ECF No. 32. In Google, the Department of the Interior attempted to
acquire, without competition, Microsoft software to run e-mail and collaboration services. 95
Fed. Cl. at 662-63. The court held that Google had suffered irreparable harm because the
acquisition of such e-mail services created organizational lock-in such that Google could not
conceivably compete to provide that service then or in the future. Id. at 679. By standardizing
network security, McAfee argues, the Air Force has similarly precluded McAfee and all other
potential competitors from not only the opportunity to provide network security now, but also
“the opportunity to compete to provide future versions and upgrades of its products.” Pl.’s
Opp’n at 26.
The government counters that no such organizational lock will result from the present
procurement strategy. Instead, the Air Force represents that it intends to conduct a “refresh”
three years after implementation of Palo Alto nextgen products at the base boundaries. Def.’s
Mot. at 46. The government argues that, unlike the messaging software at issue in Google,
cybersecurity solutions by their very nature must change, at times drastically, from one
implementation to the next. See Hr’g Tr. 133:6 to 134:10.
On its facts, Google is instructive for this case but it does not mandate a particular result
insofar as equitable relief is concerned. The court in Google noted that organizational lock-in
would occur upon implementation of a Microsoft Office program as an across-the-board e-mail
service at the Department of the Interior. 95 Fed. Cl. at 678. That lock-in was held to constitute
immediate and irreparable harm to the plaintiff, which would lose any prospect of present or
future competition once migration of the agency’s e-mail system had been completed. Id. at 679.
While McAfee may be in a similar position respecting immediate harm,16 future competition
may not be foreclosed.
Network security by its very nature is susceptible to drastic changes from one year to the
next. See Hr’g Tr. 133:18 to 134:4. While Palo Alto’s nextgen software may be the Air Force’s
preferred program this year, by the time the “refresh” occurs, advances in “hacking” and other
offensive means may likely require a defensive move towards a completely different type of
security program. Where e-mail programs serve finite, relatively predictable functions, cyber-
security programs must adapt to a host of unique and unpredictable situations.
16
McAfee will undoubtedly suffer an immediate harm in the form of lost contracts and
orders which it might have been received in the near future had the Air Force chosen a option
other than a sole-source provider for its current network security needs. Because a bid protest
plaintiff cannot recover lost profits, this court has held that such losses constitute irreparable
harm in the context of a bid protest. See KWV, Inc. v. United States, 108 Fed. Cl. 448, 457
(2013); Hospital Klean of Tex, Inc. v. United States, 65 Fed. Cl. 618, 624 (2005).
19
Any consideration of relief in this case necessarily focuses on an injunction. Because
McAfee was never provided any opportunity to prepare a bid here, it cannot recover bid and
proposal preparation costs — the only monetary recovery available to a bid protest plaintiff. See
28 U.S.C. § 1491(b)(2). In effect, if injunctive relief does not issue, McAfee will suffer an
irreparable economic harm, and in fact will be unable to recover economic losses of any sort,
such that this factor weighs in favor of the plaintiff.17
3. Balance of hardships and public interest.
The court must balance the potential harm to the plaintiff against the potential harm to the
Air Force and to the awardee when considering injunctive relief. Gentex, 58 Fed. Cl. at 654.
Although modification 6 applies to a General Dynamics contract and the ENFAAS solicitation
has yet to be awarded, the court will treat Palo Alto as the sole-source provider of the products
and services being procured. The potential harm to Palo Alto at this juncture is minimal to non-
existent; Palo Alto products have already been purchased through modification 6, and injunctive
relief unwinding that step of the standardization would drastically affect the Air Force’s network
security. Furthermore, every proposed COA included a nextgen firewall component. See AR 64
(COA Presentation Slides). As to the present solicitation for the ENFAAS update, removal of
the brand-name justification would not realistically change Palo Alto’s posture because the Air
Force would still be running its management system.
The most pressing weight in this balancing equation is the potential harm to the Air Force
and, by extension, the American public. The court is required to “give due regard to the interests
of national defense and national security.” 28 U.S.C. § 1491(b)(3). The government argues that
“an injunction would adversely affect national security and would directly impact military
operations worldwide.” Def.’s Mot. at 47. The government and McAfee have submitted several
affidavits which speak to the severity of this impact.18 Air Force officials aver that any delay in
17
The government has argued that such lost profits must rise to a level which “would
significantly damage [plaintiff’s] business above and beyond a simple diminution in profits.”
Def.’s Mot. at 46 (quoting Air Transport Ass’n of Am., Inc. v. Export-Import Bank of the United
States, 840 F. Supp. 2d 327, 336 (D.D.C. 2012)). This argument rests upon decisions that are not
binding on this court, which, as explained above, allows for the classification of general lost
profits as irreparable harm in the bid-protest context. This court does not require that the
plaintiff demonstrate a particular degree of severity in relation to its lost profits.
18
In a bid protest, the parties build a factual record respecting equitable relief that largely
exits independently from the administrative record of the procurement. See Holloway & Co.,
PLLC v. United States, 87 Fed. Cl. 381, 391 n.12 (2009) (“It is the responsibility of th[e] [c]ourt,
not the administrative agency [conducting the procurement], to provide for factual proceedings
directed toward, and to find facts relevant to, irreparability of harms or prejudice to any party or
to the public interest through grant or denial of injunctive [or declaratory] relief.”) (quoting
PGBA, LLC v. United States, 60 Fed. Cl. 567 (2004), aff’d, 389 F.3d 1219 (Fed. Cir. 2004)); see
also AshBritt, Inc. v. United States, 87 Fed. Cl. 344, 366-67 (2009) (“In general, it is appropriate
to add evidence pertaining to . . . the factors governing injunctive relief to the record in a bid
20
obtaining and installing nextgen firewalls would put the network “at severely diminished
capabilities and disadvantage against the average hacker and at a highly vulnerable posture to
defend against any state-sponsored professionals it cannot see.” Decl. of Richard J. DeLeon,
Technical Advisor, 26th Network Operations Group, 67th Network Warfare Wing, U.S. Air
Force (“DeLeon Decl.”), ECF No. 22-1, ¶ 5. The government represents that these diminished
capabilities make the networks susceptible to complete shutdown or infiltration by hostile forces.
DeLeon Decl. ¶ 6. The current classic firewall and intrusion-prevention systems in place at the
base boundaries “render [the] base network defenses obsolete and virtually blind to the new
attack methods” of modern cyber enemies. Id. ¶ 5.
McAfee counters the government’s arguments by averring that they are premised on use
of [***] of McAfee’s older firewall software that is currently installed by the Air Force. Pl.’s
Opp’n at 27. If, McAfee argues, the Air Force upgraded to [***], the firewall’s capabilities
would be on par with those of the Palo Alto products which the Air Force currently intends to
install, and at no additional licensing cost to the Air Force. Id. at 27-28 (citing the declaration of
Scott Montgomery, Vice President of Public Sector Solutions, McAfee (“Montgomery Decl.”),
ECF No. 32-2, ¶¶ 5-7. The Air Force could, in theory, avoid the dire consequences of failure to
install the fully integrated Palo Alto system by instead upgrading to McAfee’s [***].
Montgomery Decl. ¶ 13. However, in making this argument, McAfee overlooks the nature of the
relief it requests. If the court issued an injunction against the Air Force, prohibiting it from
moving forward with its sole-source procurement, the Air Force would be faced with selecting
McAfee’s or another provider’s products once again without competition, albeit on an interim
basis. This likely prospect would frustrate the very process which McAfee has been thus far
fighting to preserve: competitive selection of network security products. See Al Ghanim
Combined Grp. Co. v. United States, 56 Fed. Cl. 502, 521 (2003) (“Plaintiff cannot direct the
court to a vehicle for contracting that could be used to satisfy, during a period of resolicitation,
the [government’s] needs for the . . . services covered under the instant solicitation.”).
Realistically, the court could instruct the Air Force to conduct a competitive procurement
for its network security products and systems according to CICA and the FAR. Enforcing a
competitive procurement process would unavoidably create delay in implementing updated
technology at the base boundaries. The court has no information that any system other than that
provided by Palo Alto has been applied on a proof-of-concept basis. See supra p. 7. Under the
most concordant and harmonious circumstances, the procurement process would take
considerable time to complete.
Bearing in mind that “allegations involving national security must be evaluated with the
same analytical rigor as other allegations of potential harm to parties or to the public,” Gentex
Corp., 58 Fed. Cl. at 655, the court finds that the national security interests at stake here are
overpowering. The court cannot conclude that the government’s attestations of urgent and
protest — not as a supplement to the [administrative record], but as part of this [c]ourt’s
record.”).
The court accordingly admits into the record of the case those declarations that pertain
to prejudice and injunctive relief.
21
present danger in the event of an injunction are without foundation. One need not look very hard
to find very recent examples of cyber espionage.
McAfee has not controverted the government’s assertions that an under-protected
network would leave the Air Force unacceptably vulnerable, nor has McAfee suggested any
methods for conducting a competitive solicitation without negatively affecting network security,
at least for a time. In the absence of evidence to the contrary, the court finds that delay would
damage national security as the government claims. See Al Ghanim, 56 Fed. Cl. at 522 (“In light
of the parties’ inability to provide the court with specific information regarding the impact of
delay, the court must defer to the claim that national security concerns counsel against a grant of
injunctive relief.”). The resulting balance of hardships weighs in favor of the government and
against the issuance of an injunction. See Protection Strategies, Inc. v. United States, 76 Fed. Cl.
225, 236-37 (2007) (weighing national security interests bearing on a shut-down of security
systems at the Nevada Test Site). In this instance, the public’s interest in maintaining national
security outweighs adherence to the competitive procurement mandate in CICA, 41 U.S.C.
§ 3301, 10 U.S.C. § 2304, and the FAR, insofar as injunctive relief is concerned. Id.CONCLUSION
For the foregoing reasons, McAfee’s motion for judgment on the administrative record is
GRANTED. The government’s decision to procure and implement Palo Alto’s network security
system as a sole-source without competition contravenes CICA, 41 U.S.C. § 3301, 10 U.S.C.
§ 2304(a)(1), and the FAR. The government’s motion to dismiss, or in the alternative, judgment
on the administrative record is accordingly DENIED. Nonetheless, in light of the balancing of
factors pertaining to the issuance of equitable relief, McAfee’s request that the court enjoin the
Air Force from moving forward with its procurement of Palo Alto software is DENIED.
Moreover, because McAfee submitted no bid in the procurement at issue, the court may not
award bid preparation and proposal costs under 28 U.S.C. § 1491(b)(2). In effect, this is a
situation in which McAfee has demonstrated a violation by the Air Force of statutes and the
FAR, but no viable remedy is at hand.
The clerk will enter judgment in accord with this disposition.
McAfee is awarded its costs of suit pursuant to RCFC 54(d).
It is so ORDERED.
s/ Charles F. Lettow
Charles F. Lettow
Judge
22