GAO bid protest on CIA cloud hinges greatly on solicitation ambiguity


The Government Accountability Office's protest decision directing the CIA to reopen a competition for a private cloud infrastructure after awarding a contract worth up to $600 million over 4 years with options for up to 5 more years hinges in great measure on ambiguity within the initial solicitation.

The GAO released earlier this month a June 6 bid protest decision (.pdf) filed by IBM after it lost the best value competition to Amazon Web Services.

As part of the 2012 solicitation, the CIA required proposers to price out a scenario under which they would provide a hosting environment for a large number of orders – 30 such orders in the first year of the contract – each consisting of 100 terabytes of data.

IBM interpreted the scenario to mean that it should price a first-year solution capable of processing 30 single runs of 100 TB, whereas the CIA thought it was asking for what the protest decision calls "continual processing" for each order. IBM told the GAO the latter interpretation amounted to an unstated requirement, an objection that bid protest attorneys say is moot, since IBM failed to raise it with the GAO before proposals were due.

Bid protest regulations say protests about ambiguity in solicitations can't be raised after proposals are submitted.

But, the GAO says that IBM's protest is timely when it comes to what the CIA subsequently did in an attempt to ensure that all proposals were evaluated on a common basis.

Proposal evaluators scaled IBM's single-run price upwards to reflect "one year of continual processing for each order," but lacked information about assumptions Amazon made in its proposals about running 100 TB data sets.

"There was no way from the information available concerning Amazon's solution to ascertain how many 100 TB data runs were included" in the Amazon pricing of the scenario in question, GAO attorneys say.

They also say another IBM objections is valid. After awarding the contract to Amazon, the CIA agreed to limit a requirement that the winner certify that "any software" provided will be virus free to "only software developed and provided" by Amazon. That amounted to a material change, GAO attorneys say.

CIA officials also told auditors that, in retrospect, they didn't consider the full impact of agreeing to the modified language.

For more:
- download the bid protest decision, B-407073.3; B-407073.4; B-407073.5; B-407073.6 (.pdf)

Related Articles:
FedRAMP for cloud brokers would be valuable, say panelists
CBP OIT adjusts to tough times with shared services
DISA says commercial cloud computing middleman function at IOC