IBM Corporation

Decision

Matter of:  IBM Corporation

File:  B-415798.2

Date:  February 14, 2019

DIGEST

1.  Protest that the awardee violated the procurement integrity provisions of the Office of Federal Procurement Policy Act, 41 U.S.C. §§ 2101-07, is dismissed as legally and factually insufficient where the protester’s allegations, even if unrebutted, fail to establish a violation of law by the agency. 

2.  Protest challenging contracting officer’s determination that exclusion of the awardee from the competition was not warranted to protect the integrity of the procurement system is denied where the protest effectively constitutes a challenge to the agency’s affirmative responsibility determination, and the protester fails to demonstrate that the agency unreasonably failed to consider pertinent information.

IBM Corporation, of Reston, Virginia, protests the issuance of a task order to Accenture Federal Services, LLC, of Arlington, Virginia, by the Department of Homeland Security (DHS), Transportation Security Administration (TSA), under task order request for proposals (TORP) No. HSTS02-17-R-OIA053, issued under DHS’s Enterprise Acquisition Gateway for Leading Edge Solutions II indefinite-delivery, indefinite-quantity (IDIQ) contract, to acquire a full range of information technology services to support the TSA Secure Flight system.  IBM, the incumbent contractor, previously filed a protest with our Office alleging, among other grounds, that TSA failed to undertake a reasonable investigation of an alleged violation of the integrity provisions of the Office of Federal Procurement Policy Act, 41 U.S.C. §§ 2101-07 (hereinafter, the Procurement Integrity Act or PIA).  Based on TSA’s initiation of an investigation, we dismissed IBM’s PIA allegations as premature, and denied the remainder of IBM’s protest allegations.  IBM Corp., B-415798, Mar. 27, 2018, 2018 CPD ¶ 130 at 8-9.  Following the completion of its investigation, TSA again selected Accenture for award.  IBM now challenges the adequacy of TSA’s PIA investigation, and the reasonableness of the agency’s decision to proceed with an award to Accenture.

We deny the protest in part and dismiss it in part.

BACKGROUND[1]

Relevant here, the crux of IBM’s PIA allegations, both in its previous protest and this current protest, is that an identified employee (hereinafter, John Doe) of an IBM subcontractor on the incumbent effort obtained IBM’s bid and proposal information from a restricted-access TSA website used by the IBM team in performance of the incumbent requirements, and provided that information to Accenture, resulting in a violation of the PIA.  Specifically, IBM alleges that John Doe was a network architect on the IBM-led team performing the incumbent requirements who had access to the government server in performance of his contractual responsibilities, and also assisted in IBM’s proposal effort.  IBM alleges that John Doe misappropriated IBM staffing information, specifically team member identities, roles, and “non-public” contact information, as well as providing his own assessments of those team members based on his interaction with the incumbent team, and provided that information to Accenture.

Additionally, the protester contends that John Doe misappropriated and provided to Accenture other confidential IBM materials, including information about IBM’s software development and transition approaches.  IBM further alleges that Accenture knew, or reasonably should have known, that John Doe was subject to a non-disclosure agreement (NDA) prohibiting the disclosure of confidential IBM information to competitors, and that John Doe was in violation of the NDA when he provided IBM’s confidential information to Accenture.  Based on its receipt of such unlawfully obtained and disclosed information from John Doe, IBM argues that Accenture violated the PIA’s prohibition on knowingly obtaining contractor bid or proposal or source selection information.  See, e.g., Protest (B‑415798.2) at 2; IBM Comments at 5-9.

As noted above, based on the agency’s representation of its intent to conduct an investigation of the protester’s allegations, we dismissed the PIA protest allegations.  IBM Corp., supra.  The record reflects that, consistent with its representations, the TSA Office of Inspection conducted an investigation of IBM’s PIA allegations.  In addition to conducting interviews with several relevant persons, including from TSA, IBM, and Accenture, TSA also reviewed approximately 15.8 gigabytes worth of data from John Doe’s TSA-issued laptop.  Agency Report (AR), Tab 29, TSA Investigative Report, at 1225-1402; Tab 31, TSA Memo. Regarding Procurement Integrity Act Review of John Doe’s Electronic Records, at 1409‑17.[2]  Additionally, the Secure Flight & Crew Vetting Program Management Branch Manager prepared a memorandum based on his review of IBM’s allegations and whether the information allegedly misappropriated by John Doe and provided to Accenture was incorporated into Accenture’s proposal.  AR, Tab 30, Memo. Regarding Procurement Integrity Act Allegations, at 1403-08.  The U.S. Attorney’s Office for the District of Maryland requested a written investigative report, and the TSA investigators subsequently provided the requested report.  The U.S. Attorney’s Office declined to take prosecutorial action, and the investigation report was forwarded to the contracting officer.  AR, Tab 29, TSA Investigative Report, at 1228.

On November 15, 2018, the contracting officer emailed IBM to inform the company that he had completed his review of the alleged PIA violation in accordance with Federal Acquisition Regulation (FAR) § 3.104-7(a).  Specifically, the contracting officer represented that he:  (i) reviewed the interviews, witness statements, and documents included in the Report of Investigation conducted by the TSA Office of Investigations; (ii) reviewed the proposals submitted by IBM and Accenture, as well as other documentation that they submitted to TSA with respect to the PIA allegations; (iii) reviewed the forensic capture and analysis of relevant electronic records; (iv) obtained advice from the TSA Chief Counsel; and (v) reviewed his determination with, and obtained the concurrence of, his supervisors with TSA Contracting & Procurement.  Based on this review, the contracting officer concluded that the evidence presented did not establish that a PIA violation had occurred.  Therefore, he affirmed the award to Accenture.  AR, Tab 34, Email from Contracting Officer to IBM (Nov. 15, 2018, 12:25 PM), at 1; see also AR, Tab A, Contracting Officer’s Determination of Alleged Procurement Integrity Act Violations, at 0001-0018; Tab 33, Intelligence Analysis & Screening Branch Chief Memo. Concurring With Contracting’s Officer PIA Determination, at 1687.  IBM subsequently filed this protest with our Office.[3]

DECISION

IBM asserts three primary bases of protest.  First, IBM challenges the agency’s conclusion that there was no violation of the PIA based on Accenture’s alleged receipt of IBM’s proprietary information that was improperly obtained by John Doe in violation of his NDA with IBM’s subcontractor.  Second, the protester challenges the adequacy of TSA’s PIA investigation, alleging, among other alleged inadequacies, that the agency should have compelled testimony from certain relevant witnesses and requested sworn testimony from certain IBM witnesses.  Third, IBM alleges that TSA was required to exclude Accenture from the competition based on its alleged receipt of IBM’s misappropriated proprietary information in order to protect the integrity of the procurement system, as required by FAR § 3.101-1.

TSA and Accenture request dismissal or denial of IBM’s protest.  The agency and intervenor primarily argue that none of IBM’s asserted protest grounds state legally or factually sufficient bases of protest.  The crux of their arguments is that IBM’s allegations, even if proven, are insufficient to establish a violation of the PIA where the protester does not allege any improper conduct or involvement on the part of the government, or current or former government personnel.  TSA and Accenture argue that, at worst, IBM’s allegations present a private dispute that our Office does not consider as part of its bid protest function.  They further argue that, in the absence of any cognizable PIA violation, the protester’s remaining grounds of protest either fall outside of our bid protest jurisdiction, or otherwise fail to state legally and factually sufficient grounds of protest.  Alternatively, TSA and Accenture argue that IBM’s protest constitutes a challenge to the agency’s affirmative responsibility determination, and should be denied because the contracting officer’s determination was reasonable and considered all pertinent information bearing on the question of Accenture’s present responsibility.

The requirements of 4 C.F.R. §§ 21.1(c)(4) and (f) that a protest include a detailed statement of the legal and factual grounds of protest require either evidence or allegations sufficient, if uncontradicted, to establish the likelihood that the protester will prevail in its claims of improper agency action.  Midwest Tube Fabricators, Inc., B‑407166, B‑407167, Nov. 20, 2012, 2012 CPD ¶ 324 at 3.  For the reasons that follow, we find that IBM’s PIA allegations fail to state legally or factually sufficient bases of protest, and therefore we dismiss those allegations.  We further find that IBM’s challenges to the agency’s determination not to exclude Accenture from the competition are tantamount to a challenge to the agency’s affirmative responsibility determination, and, based on the adequacy of the agency’s consideration of Accenture’s present responsibility, we find no basis on which to sustain the protest.

Alleged Violation of the PIA

TSA and Accenture first argue that IBM’s protest, even if uncontradicted, would fail to establish a violation of the PIA occurred because the protest is devoid of any allegation that the government improperly disclosed any contractor bid or proposal or source selection sensitive information, or otherwise was involved in the alleged misconduct.  The agency and intervenor argue that a viable PIA allegation must demonstrate that the alleged violation has some nexus to improper government conduct, and that IBM’s protest exclusively alleges misconduct on the part of private parties, specifically a former employee of an IBM subcontractor and Accenture.  Accenture alternatively argues that a PIA violation could not have occurred because IBM voluntarily disclosed the alleged proprietary information to its subcontractor, and thus to John Doe, who in turn allegedly violated his NDA with IBM by disclosing the information to Accenture.  The intervenor argues that the PIA expressly does not apply to such voluntary disclosures, and therefore IBM’s allegations would implicate a private dispute between private parties, which our Office does not review as part of our bid protest function.

IBM contests dismissal of its protest, arguing that its allegations state legally and factually sufficient grounds to establish a violation of the PIA.  Specifically, the protester interprets the PIA’s requirement for a government nexus to only apply to the provision prohibiting the disclosure of contractor bid or proposal or source selection sensitive information.  IBM argues that the PIA’s prohibition on knowingly obtaining such information contains no such requirement to establish a government nexus to the alleged violation.  The protester also argues that the voluntary disclosure provision relied upon by Accenture is inapplicable because IBM never voluntarily disclosed the information in question to the intervenor.

Relevant to the issues in the protest, the PIA includes two provisions restricting the disclosure and knowing obtainment of contractor bid or proposal information or source selection sensitive information before the award of a procurement contract to which the information relates.  First, the PIA provides that, except as provided by law, (i) a present or former official of the federal government, or a person acting or that has acted for or on behalf of, or who is advising or has advised the federal government with respect to, a federal agency procurement, and (ii) by virtue of that office, employment, or relationship has or had access to contractor bid or proposal information or source selection sensitive information, is prohibited from disclosing such information.  41 U.S.C. §§ 2102(a)(1), (3).  The PIA further provides that, except as provided by law, “a person shall not knowingly obtain” such information.  Id. at (b).  The PIA also includes “savings provisions,” which, among other exceptions, provides that ­­­­the PIA does not “restrict a contractor from disclosing its own bid or proposal information or the recipient from receiving that information.”  41 U.S.C. § 2107(2).

This protest presents facts and arguments similar to those addressed by our Office in The Geo Grp., Inc., B-405012, July 26, 2011, 2011 CPD ¶ 153, and that were then subsequently addressed by the United States Court of Federal Claims in Geo Grp., Inc. v. United States, 100 Fed. Cl. 223 (2011).  In those protests, the protester alleged that a former employee, who managed the protester’s incumbent effort, simultaneously, and unbeknown to the protester, also was the chief executive officer and sole owner of another company.  While still employed by the protester, the former employee began to forward confidential protester information to his other company, and the other company subsequently won the recompete for the requirements that the former employee had previously managed on behalf of the protester.  Both our Office and the Court ultimately found that the protester’s allegations did not fall within the PIA.

Our Office concluded that the protester’s PIA allegations were legally insufficient because of the PIA’s savings provision relating to voluntary disclosures.  Specifically, we found that the protester had voluntarily provided its confidential information to its former employee in the course of his employment with the protester.  Although the alleged conduct may have violated his fiduciary obligations or other obligations to maintain the secrecy of the protester’s confidential information, such allegations did not negate the application of the savings provision.  In this regard, we specifically recognized that our decisions have routinely explained that the PIA’s savings provision applies notwithstanding the fact that voluntarily provided information is subsequently misused or not properly safeguarded.  We concluded that the protester’s allegations presented a dispute between private parties that we would not consider absent evidence of government involvement.  The GEO Grp., Inc., supra, at 4-5.

Following our denial of the protest, the protester pursued a protest and request for injunctive relief with the Court of Federal Claims.  In rejecting the protester’s request for injunctive relief, the Court concluded that the protester’s allegations failed to indicate a violation of the PIA, and thus the protester could not establish likelihood of success on the merits.  Specifically, the Court found that the PIA’s prohibition on knowingly obtaining protected information, as with the prohibition on disclosing such information, requires a government nexus, that is, there must have been some improper conduct on the part of the government or someone acting at the government’s direction.  Specifically, the Court explained that:

Read in context, however, [41 U.S.C. § 2102(b)], like other provisions in section [2102], appears to apply only to current or former officials of the United States or persons who are acting or have acted on such an individual’s behalf.  As plaintiff is quick to point out, that conclusion is not apparent from the statutory language, which merely refers generically to a “person.”  But, this conclusion is supported by the overall structure of the statute, including the definitions therein of “bid and proposal information” and “source selection information,” both of which talk in terms of specific information obtained by a Federal agency.  Here, of course, [the protester’s former employee] did not obtain the information in question from [the procuring agency] or any other government source, but rather from [the protester] itself.  The conclusion, moreover, that [§ 2102(b)] applies only to government employees and their agents derives support from the legislative history of the statute, which refers to the provision in question as applying to “present and former federal employees,” and from the [FAR] that implement this provision.

GEO Grp., Inc., supra, at 227 (internal citations omitted).

We find persuasive and well-reasoned the Court’s holding that allegations devoid of any alleged government involvement in the enumerated acts prohibited by the PIA fail to set forth a viable allegation of a PIA violation.  The PIA was enacted to mitigate against the corrosive impacts on the procurement system arising from improper conduct on the part of government officials or those acting on the government’s behalf, as well as those who would induce or otherwise benefit from such improper government conduct.  Pikes Peak Family Hous., LLC v. United States, 40 Fed. Cl. 673, 681 n.15. (1998).  As discussed by the Court in GEO Grp., Inc., the legislative history refers to the PIA’s prohibitions applying to “present or former employees,” specifically providing that:  “[t]he provision would prohibit, except as provided by law, present or former federal employees from knowingly obtaining or disclosing such information before the award of a contract to which the information relates.”  H. Conf. Rep. 104-450, at 969 (1996).

In contrast, IBM’s allegations fail to make any credible allegation of government misconduct, or misconduct by a person who was acting for or on behalf of the government.  See 41 U.S.C. § 2102(a)(3).  Rather, the allegations involve a private dispute between private parties that is not for our consideration as part of our bid protest function.  See, e.g., University of Maryland, B‑416682, Oct. 24, 2018, 2018 CPD ¶ 366 at 4-5 (dismissing for failing to state a valid basis of protest an allegation that a competitor obtained access to the protester’s confidential information in the absence of any alleged government involvement); Ellwood Nat’l Forge Co., B‑402089.3, Oct. 22, 2010, 2010 CPD ¶ 250 at 3-4 (same, where information was obtained by a former employee and consultant of the protester who subsequently became a consultant to the awardee); American Native Med. Transport, L.L.C., B‑276873, Aug. 5, 1997, 97-2 CPD ¶ 73 at 7 n.7 (same, where protester alleged the awardee had misappropriated its proposal through industrial espionage).  Thus, pursuant to the persuasive reasoning of Geo Grp., Inc., we find that IBM’s protest fails to allege any wrongdoing on the part of the government, and therefore fails to state a legally sufficient allegation of a PIA violation.

While we apply the Court’s persuasive holding that an alleged PIA violation that fails to identify any government involvement is legally insufficient, we similarly conclude that the same result would occur if we utilized the “savings provision” analysis that we previously employed in The Geo Grp., Inc.  We have repeatedly found that the PIA’s savings provision applies even where voluntarily provided information is subsequently misused or improperly safeguarded.  See, e.g., DynCorp Int’l LLC, B‑408516 et al., Oct. 29, 2013, 2013 CPD ¶ 243 at 6 (finding savings provision precluded PIA allegation where the awardee allegedly used the protester’s proprietary information obtained under previous teaming arrangements between the awardee and the protester); Telephonics Corp., B‑401647, B-401647.2, Oct. 16, 2009, 2009 CPD ¶ 215 at 7 (same, where a corporate affiliate of a member of the awardee, a joint venture, failed to properly safeguard the information of the protester, with the result being that the awardee improperly obtained the information).  Here, there is no question that John Doe obtained access to IBM’s alleged confidential information solely by virtue of his employment by an IBM subcontractor.

To the extent John Doe breached his NDA with IBM or other obligations to IBM or IBM’s subcontractor, and Accenture may have committed a tort in inducing such a breach or accepting such allegedly misappropriated information, these matters present private disputes between private parties, which we do not consider as part of our bid protest function.  We have repeatedly found that these types of allegations involving breaches of NDA, confidentiality, contractual, or employment agreements or other improper disclosure of competitive information, without government involvement, constitute private disputes, which we will not consider as part of our bid protest function.  See, e.g., Management Scis. for Health, B-416041, B-416041.2, May 25, 2018, 2018 CPD ¶ 197 at 7-8 (finding allegation that the awardee had an unequal access to information organizational conflict of interest as a result of obtaining the protester’s proprietary information from one of the awardee’s subcontractors, who previously worked with the protester on another related contract, presented “a quintessential private dispute between private parties that our Office will not review”); Mayfield Gov. Inspections, B‑414528, June 13, 2017, 2017 CPD ¶ 189 at 6 (similarly rejecting argument that awardee had an unfair competitive advantage where it used a subcontractor with access to the protester’s pricing information); C&S Corp., B‑411725, Oct. 7, 2015, 2015 CPD ¶ 311 at 3 (similarly dismissing allegation that a former employee of the protester improperly disclosed competitively useful information to the awardee); DynCorp Int’l LLC, supra (similarly dismissing PIA allegation based on subcontractor’s alleged use of protester’s proprietary information obtained under previous teaming agreements).  Therefore, we find IBM’s protest allegations with respect to an alleged violation of the PIA are legally and factually insufficient, and therefore they are dismissed.[4]

Failure to Exclude Accenture

IBM next alleges that TSA failed to reasonably exclude Accenture from the competition in order to protect the integrity of the procurement system pursuant to its responsibility under FAR § 3.101-1.  This section requires that government business be conducted in a manner above reproach and with complete impartiality and with preferential treatment for none.  For the reasons that follow, we find that IBM’s allegation effectively constitutes a challenge to the contracting officer’s affirmative responsibility determination.  Because we find that the agency’s responsibility determination reasonably considered the pertinent information associated with John Doe’s and Accenture’s alleged misconduct, we find no basis on which to sustain the protest.

As an initial matter, it is not apparent that FAR § 3.101-1 creates an independent basis of protest.  See DynCorp Int’l LLC, supra, at 7 n.7 (rejecting argument that a protester’s PIA allegations constituted a separate violation of the FAR’s requirement that agencies reasonably assess potential unfair competitive advantages in a procurement).  As addressed above, we find that IBM has failed to allege legally sufficient allegations that the PIA was violated, but, rather, has presented only allegations pertaining to a dispute between private parties.  IBM fails to identify any decision where our Office has interpreted FAR § 3.101-1 to compel an agency to exclude an offeror from a competition, absent some other underlying violation of applicable procurement law or regulation.[5]  Thus, where we find IBM has not alleged a legally sufficient PIA violation, it is not apparent that FAR § 3.101-1 alone would provide IBM with an independent basis of protest to challenge the agency’s decision not to exclude Accenture.[6]

Nevertheless, although IBM does not expressly challenge the agency’s affirmative responsibility determination for Accenture, we find that IBM’s allegations that Accenture should have been excluded based on its alleged improper conduct are effectively a challenge to the agency’s affirmative responsibility determination with respect to Accenture.  In other cases involving the alleged misappropriation of another firm’s proprietary information or equipment without government involvement, we have routinely determined that, to the extent a firm’s eligibility for award is affected by the alleged improper conduct, it involves a matter of the firm’s responsibility.  See, e.g., Applied Comm’ns Res., Inc., B-270519, Mar. 11, 1996, 96-1 CPD ¶ 145 at 2-3; Secure Eng’g Servs., Inc., B-252270.2, B-252271.2, June 11, 1993, 93-1 CPD ¶ 452 at 5; Concrete Sys., Inc.¸B-243015, Mar. 7, 1991, 91-1 CPD ¶ 258 at 1-2; Bildon, Inc., B‑241375, Oct. 25, 1990, 90-2 CPD ¶ 332 at 1-2; Charleston Auto Processors, Inc., B‑235369, May 11, 1989, 89-1 CPD ¶ 448 at 1; Meldick Servs., Inc., B-231072, May 3, 1988, 88-1 CPD ¶ 433 at 2.[7]

As a general matter, the FAR provides that a purchase or award may not be made unless the contracting officer makes an affirmative responsibility determination.  FAR § 9.103(b).  In most cases, responsibility is determined based on the standards set forth in FAR § 9.104-1, and involves subjective business judgments that are within the broad discretion of the contracting activities.  Reyna-Capital Joint Venture, B-408541, Nov. 1, 2013, 2013 CPD ¶ 253 at 2.  For example, the contracting officer must consider, among other factors, whether the putative awardee has “a satisfactory record of integrity and business ethics.”  FAR § 9.104-1(d).  Our Office generally will not consider a protest challenging the agency’s affirmative determination of an offeror’s responsibility.  4 C.F.R. § 21.5(c).  We will only hear a protest challenging an agency’s affirmative responsibility determination where the protester presents specific evidence that the contracting officer may have ignored information that, by its nature, would be expected to have a strong bearing on whether the awardee should be found responsible.  We have further found that the information in question must concern very serious matters, for example, potential criminal activity or massive public scandal, and that allegations involving only matters of dispute between private parties is insufficient to meet this threshold.  See, e.g., The GEO Grp., Inc., supra, at 7 (dismissing challenge to awardee’s affirmative responsibility based on legally insufficient PIA violation allegations and alleged breach of fiduciary duty to the protester); Hendry Corp., B-400224.2, Aug. 25, 2008, 2008 CPD ¶ 164 at 3‑4 (same, based on allegations of an awardee’s alleged violation of a NDA); Applied Comm’ns Res., Inc., supra (same, where former employee allegedly misappropriated the protester’s proprietary information and equipment).  Here, the U.S. Attorney specifically declined to pursue any criminal charges against John Doe or Accenture.  See AR, Tab 29, TSA Investigation Report (Aug. 30, 2018), at 1228.

Additionally, it is apparent that the contracting officer was fully aware of and considered the alleged conduct at issue when he affirmed the award to Accenture.  DynCorp Int’l LLC, B-411126.4 et al., Dec. 20, 2016, 2017 CPD ¶ 333 at 25; The GEO Grp., Inc., supra, at 7.  IBM argues that the contracting officer’s decision not to exclude Accenture was inadequate because the agency failed to compel testimony from certain witnesses or seek sworn declarations from knowledgeable IBM witnesses, and otherwise disagrees with the contracting officer’s ultimate determinations.  We conclude, however, that TSA reasonably met its obligations under the FAR to review Accenture’s alleged misconduct in connection with its receipt of the protester’s information.  As discussed above, the record demonstrates that the contracting officer reviewed and considered, in consultation with legal counsel and his supervisor, the results of the TSA Office of Investigation’s investigative report.  Although IBM argues that the investigation should have been more thorough and the contracting officer’s resulting determinations were not reasonable, it is readily apparent that the contracting officer was aware of and considered the underlying factual and legal predicates for IBM’s allegations.

We have recognized that contracting officers are afforded wide discretion in determining the amount of information that is required to assess an offeror’s responsibility, and therefore a dispute as to the amount of information considered by the contracting officer in making a responsibility determination is generally not a matter that our Office will review.  SumCo Eco-Contracting LLC, B-409434, B-409434.2, Apr. 15, 2014, 2014 CPD ¶ 129 at 5.  Nothing in the arguments raised by IBM concerning the determination of Accenture’s responsibility demonstrate that the contracting officer failed to consider reasonably available, relevant information concerning Accenture’s responsibility.  Similarly, although the protester disagrees with the contracting officer’s judgment regarding Accenture’s responsibility, that disagreement does not provide a basis to challenge the contracting officer’s affirmative responsibility determination.  Precision Standard, Inc., B‑310684, Jan. 14, 2008, 2008 CPD ¶ 32 at 4; Nilson Van & Storage, Inc.¸B-310485, Dec. 10, 2007, 2007 CPD ¶ 224 at 3.  Therefore, we find no basis on which to sustain IBM’s protest.

The protest is denied in part and dismissed in part.

Thomas H. Armstrong
General Counsel