Cyber Defense eMagazine December Edition for 2021

GAO’s decision in L-3 Services, Inc. 3 , demonstrates how a subcontractor’s existing contractual
relationships can cause an OCI for a prime contractor. The bid protest involved a contract to consolidate
operations and maintenance requirements for networks at seven operating bases. The protester argued
that the awardee had an unequal access to information OCI and a biased ground rules OCI because
another company affiliated with the awardee’s subcontractor had provided technical guidance for the
protested requirement and had access to unredacted copies of contracts, core communications
requirements, internal agency information about upgrading communications and IT infrastructure, and
proprietary information of other companies.
After the protest was filed, the agency argued there was no unequal access to information OCI because
(i) the information was not competitively useful and (ii) the information used to develop the solicitation
was disclosed to all offerors. GAO rejected these arguments, finding neither the contractor nor the
agency had tracked what information the affiliated company had access to over the course of
performance. GAO surmised that the affiliated company likely had access to nonpublic information the
agency was not aware of and that was never disclosed to offerors. Notably, in overturning the award,
GAO did not base its decision on whether or not the prime awardee actually had access to the
information. Instead, GAO held that access by an affiliate of a subcontractor was sufficient to create an
OCI.
GAO also held there was a biased ground rules OCI because although the subcontractor’s affiliate did
not draft the specifications, the affiliated company participated in the business/mission case development.
GAO also noted the affiliated company’s research became part of the source information used to develop
the requirement. GAO sustained the protest, recommended the awardee’s subcontractor be excluded
from the completion, and recommended the procuring agency conduct a new OCI investigation and
determination.
Mitigating an OCI
As the cases discussed above illustrate, an OCI can be devastating for a company. However, in many
situations, the adverse effects of an OCI can be avoided by proactively implementing an OCI mitigation
plan. To be effective, a mitigation plan must be tailored to a specific contract opportunity and the
circumstances that give rise to the actual or potential OCI(s). Nonetheless, there are some general
principles that may guide the development of a plan:
• An unequal access to information OCI is the easiest type of OCI to mitigate. The objective is to
limit access to and dissemination of competitively useful nonpublic information. Mitigation
techniques include nondisclosure agreements, firewalls, document controls, and restricting
personnel assignments.
• An impaired objectivity OCI is more difficult to mitigate. A firewall or other types of information
controls will not mitigate an impaired objectivity OCI. Using a separate division to perform
problematic tasks will not mitigate the OCI. Instead, an impaired objectivity OCI may be mitigated
by using a firewalled subcontractor who reports directly to the government or using objective
3 L-3 Services., Inc., B-400134.11, B-400134.12, Sept. 3, 2009, 2009 CPD 171.
Cyber Defense eMagazine – December 2021 Edition 90
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.