CBCA 6654

THIS OPINION WAS INITIALLY ISSUED UNDER PROTECTIVE ORDER AND IS BEING PUBLICLY RELEASED IN ITS ENTIRETY ON APRIL 27, 2021 GRANTED: April 14, 2021 CBCA 6654 FORCE 3, LLC, Appellant, v. DEPARTMENT OF HEALTH AND HUMAN SERVICES, Respondent. Joseph J. Petrillo and Karen D. Powell of Smith Pachter McWhorter PLC, Washington, DC, counsel for Appellant. Terrius Greene, Office of the General Counsel, Department of Health and Human Services, Washington, DC, counsel for Respondent. Before Board Judges BEARDSLEY, SHERIDAN, and KULLBERG. BEARDSLEY, Board Judge. This matter is before us on the Department of Health and Human Services’s (HHS) motion to dismiss for failure to state a claim upon which relief could be granted, and cross-motions for summary judgment. For the reasons set forth below, Force 3, LLC’s (Force 3) motion for summary judgment is granted. HHS’s motion to dismiss and motion for summary judgment are denied. CBCA 6654 2 Statement of Undisputed Facts In May 2016, HHS placed a fixed-price delivery order under a multiple-award government-wide acquisition contract with Force 3 for FireEye support services for certain appliances previously purchased by HHS.1 The FireEye appliances, software, and support services together made up a computer security system that protected HHS data systems from malware such as viruses, ransomware, and other attacks. The parties contracted for a base year and two one-year option periods. The base year of the contract ran from May 5, 2016, to May 4, 2017. HHS exercised the first option year, which extended the period of performance to May 3, 2018. HHS did not exercise the second option year. Each contract year had a price of $1,130,000, which included FireEye’s per-year cost plus Force 3’s margin (indirect costs and profit). Force 3 purchased, in advance, a three-year subscription to the FireEye support services, including software rights and maintenance, in order to offer HHS competitive pricing. FireEye provided license keys to HHS for the support services on June 16, 2016. An email from FireEye to HHS indicated that the end date for the licenses was March or May 2019. FireEye’s standard practice is not to sell support services for less than one year and not to provide refunds to customers that want to discontinue services before the end of the purchased term. The HHS order incorporated the terms and conditions of Force 3’s May 11, 2016, proposal by express reference. The proposal’s terms and conditions stated that, “[a]fter the date of expiration, non-renewal or termination of the contract, the Government shall certify in writing that it has deleted or disabled all files and copies of the software from the devices on which it was installed and is no longer in use by [sic] Government.” In July and August 2018, FireEye notified Force 3 and Force 3 notified HHS that HHS “continued to download software updates and security updates” and to seek technical support after the delivery order expired. HHS had also failed to certify that it had deleted or disabled 1 The support services purchased by Force 3 from FireEye enabled HHS to obtain from FireEye (1) continuous intelligence (security) updates; (2) content packages; and (3) software updates. Security updates provided new security signatures and detection capabilities; content packages included updates to virtual machine guest images and associated security information; and software updates provided access to new software releases and emergency fixes. The order also included a subscription to an upgraded form of security updates and content packages called Advanced Threat Intelligence (ATI) that provided updated and contextual information about malware and other threats, and 24x7x365 technical support by FireEye by live chat, phone, email, and web. CBCA 6654 3 all files and copies of the software from the FireEye devices. The parties then unsuccessfully attempted to negotiate a payment for the services. Force 3 proposed payment of the full option period with no reinstatement penalties. HHS asked for a six-month quote. Force 3 responded that FireEye would not provide renewals for less than twelve months.