Cyber Accelerator Decision Brief October 2010

Gap in Cycle Time, Innovation, Access $32B: Commercial Software/Internet R&D Cycle Time Gap: Commercial IT enterprises out-invest all DIB enterprises, and it shows in cycle time Commercial IT cycle < 20 months DIB IT cycle > 50 months 2008 IR&D as percent of Revenue $22B: All Aerospace and Defense R&D IT Product Cycle (months) $5.6B: Later-Stage 2Q08-1Q10 Private Investment in Internet = $7.3B Innovation Gap: Private investment in new technologies, business models, and markets > 10x CNCI R&D component $1.7B: 515 New Startups FY10-FY11 USG Cyber R&D = $721M Total Venture Funded Jobs = 7380 Access gap: USG venture investment touches < 1% of cyber startups; More “reach” into cyber startups is essential Aug 2010 Cyber Startup Employment Opportunities In-Q-Tel Funded Jobs = 59 (0.8%) Sources: Booz and Company, House Armed Services Committee, PricewaterhouseCoopers, National Science and Technology Council, StartUpHire Search Controlled Unclassified Information

Fill Gap in Private and Public Business Models Moore’s Law: Every 24 months, 4x improvement (2x performance at ½ price) 24 mo 4x 48 mo 16x 72 mo 64x 96 mo 256x 120 mo 1024x Traditional DIB IT Model Obtain funding: 24 months Funding to ops: 81 months (DIB avg) Total: 105 months Need/POM/ Budget Acquire Develop Transition to Ops Idea Source: William Lynn/DepSecDef Controlled Unclassified Information

Fill Gap in Private and Public Business Models Moore’s Law: Every 24 months, 4x improvement (2x performance at ½ price) 24 mo 4x 48 mo 16x 72 mo 64x 96 mo 256x 120 mo 1024x Traditional DIB IT Model Obtain funding: 24 months Funding to ops: 81 months (DIB avg) Total: 105 months Need/POM/ Budget Acquire Develop Transition to Ops Invest, Innovate Integrate, Transition to Ops In-Q-Tel: accesses commercial innovation, doesn’t provide integrated commercial capabilities and transition incentives Government-focused Alternative Models Attempts to address the gap Idea Innovate, Transition NSA “90-day spin”: provides continuous innovation and transition, doesn’t access commercial technology well, and not incentivized to adopt or integrate it Source: William Lynn/DepSecDef Controlled Unclassified Information

Fill Gap in Private and Public Business Models Moore’s Law: Every 24 months, 4x improvement (2x performance at ½ price) 24 mo 4x 48 mo 16x 72 mo 64x 96 mo 256x 120 mo 1024x Traditional DIB IT Model Obtain funding: 24 months Funding to ops: 81 months (DIB avg) Total: 105 months Need/POM/ Budget Acquire Develop Transition to Ops Invest, Innovate Integrate, Transition to Ops In-Q-Tel: accesses commercial innovation, doesn’t provide integrated commercial capabilities and transition incentives Government-focused Alternative Models Attempts to address the gap Idea Innovate, Transition NSA “90-day spin”: provides continuous innovation and transition, doesn’t access commercial technology well, and not incentivized to adopt or integrate it Invest, Innovate, Market Commercial Model: bring innovation to scalable market in one Moore’s Law cycle; Example: iPhone in 24 months Requirement for New Cyber Model Align with commercial model Idea to transition in 24 months Innovate, Integrate, Transition Cyber Accelerator: sponsor commercial innovation, fund scalable integration projects, balance private and public incentives for more effective transitions Source: William Lynn/DepSecDef Controlled Unclassified Information

Accelerator: Investor, Incubator, Integrator Vision: Reconnect the entrepreneurial community to national missions and requirements – starting with cybersecurity – and strengthening U.S. capabilities in both the public and private sectors. Mission: Accelerate the delivery of unique commercial offerings into both DoD/DHS and commercial cybersecurity markets, delivering speed and innovation through a commercial business model, and creating a more diversified cyber industrial base. Value Propositions Differentiated Operating Model Identify and advocate for commercial technologies that create sustainable U.S. advantages – both DoD/DHS and commercial. Provide high-leverage, low-dilution funding for these dual-use commercial innovations. Incubate new functionality and/or integrate commercial companies in new channel partnerships within twelve months. USG gains privileged mission-level access to these commercial capabilities, without compromising private intellectual property. Enable the commercial partners and the USG to develop relationships in an open market, without the exclusive deals or competing equities of traditional DIB integrators. Facing government sponsors, deliver new mission capabilities as an integrator, but one without internal equities or incentives. Facing entrepreneurs, operate as an incubator, accelerating their product roadmaps and opening new markets. Facing private investors, operate as a non-dilutive co-investor, increasing the return on their investment. Controlled Unclassified Information

Controlled Unclassified Information No current entity balances the investor, incubator, and integrator roles Current DoD/DHS providers (USG agencies, USG-sponsored institutes, DIB contractors) operate around internal equities This initiative requires a fresh charter and governance model Entrepreneurs and investors do not trust USG/DIB as partner Too conflicted/opaque, too political/inconsistent, too limiting Cyber accelerator value propositions offer attractive proof points Entrepreneurs signed up for test case Early and late-stage investors see upside Infrastructure providers see novel opportunity Incentives guide behavior and results, and must be used to align the USG sponsors with the cyber accelerator participants Take lessons from, but don’t just create one more legacy entity Sources: Discussions with cited companies Controlled Unclassified Information

Analysis of Alternatives Private sector based models offer the best opportunity to engage private sector innovation Value propositions Effective alternatives Comprehensive list of alternatives New private sector for-profit, non-profit, or VC fund Legacy considerations Ineffective alternatives New structure considerations Regulations/authorities Continued accountability Risk of adverse lobbying Effective incentives NSA/CYBERCOM, DARPA, GOCO, FFRDC, UARC Models that look and feel like USG and/or business as usual will fail; VC statement: “We haven’t funded a company focused on the public sector” Sources: RAND Corporation (list of alternatives), Discussions with cited companies Controlled Unclassified Information

Continuity + Commitment + Relationships How to connect USG with innovators Critical sponsor decisions Continuity Five+ year period of performance, pre-negotiated termination liability, no option years VC Fund Duration = 10 years Startup to IPO = 8 years Pilot = 1 year Ensure that the cyber accelerator can support a commercial partner beyond the pilot program Commitment OTA/Technology Investment Agreement (10 USC 2371) is tailor-made for cyber accelerator Reliable, apolitical accelerator, capable of protecting its partners’ intellectual property Traditional contracting is suboptimum for USG (no APIs or IP escrow) – USG needs better access to innovation Relationships “You get one chance per decade”; “Current players are opaque and conflicted”; Traditional competition = legacy organizations = failure Sole-source, to a new, focused private entity – this is the gut check between for-profit and non-profit Understand that for entrepreneurs, opportunities follow people, not contractors or agencies Controlled Unclassified Information

Creating the Accelerator Ecosystem OSD Entrepreneurs Sponsor T10 User Rep VC, legal, and banking interfaces to source projects Create witting for-profit to isolate projects that must be disassociated from USG Create channel partner/DIB interfaces Attract private co-investor(s) Panel Chair Transition T10/T6 projects Leverage USG outreach (DARPA, Enduring Security Framework, DeVenCI) to source areas of interest Transition T50 projects Cyber Accelerator Integration Panel Legal/ Banking Observer T10 Acq Rep CEO Participants Outside VC Outside Entrepreneur USG Observer Sponsor OSD/CIO USD(I) USD(P) STRAT/J5 DISA/IA DHS/NCSD Observer Board Observers VC/PE T6 User Rep Outreach DIB T6 Acq Rep Ensure accelerator, sponsor, and integration panel are not conflicted Balance mission and IT membership on USG integration panel Balance entrepreneur community membership on accelerator board Build-out additional elements of the ecosystem Controlled Unclassified Information

Metrics and Incentives USG Accelerator Incentive Commercial Performance: are capabilities developed and integrated in a commercial business model? X Performance bonus Acceleration: meaningful results demonstrated in less than 12 mo? Partner incentives Transition: are users receiving capabilities in less than 24 mo? Dual-use: is capability scalable in commercial markets? Long-term equity Return on USG investment (requires credible ICE models) Assessed near end of 5-yr PoP Industrial base: is the DIB becoming more diversified? Controlled Unclassified Information

Controlled Unclassified Information Key Take-Aways Not a “band-aid” to an existing IT acquisition model or organization Sponsor with OTA/TIA authorities Dual-use model requires cyber accelerator to act commercially, unlike existing DIB or USG organizations Incentives matter Cannot report to a conflicted organization or agency Requires shared incentives between USG and cyber accelerator Must attract and excite entrepreneurs, both in cyber accelerator and its commercial partners Vision: Reconnect the entrepreneurial community to national missions and requirements – starting with cybersecurity – and strengthening U.S. capabilities in both the public and private sectors. Mission: Accelerate the delivery of unique commercial offerings into both DoD/DHS and commercial cybersecurity markets, delivering speed and innovation through a commercial business model, and creating a more diversified cyber industrial base. Controlled Unclassified Information

Controlled Unclassified Information Timeline and Actions 1QFY11 2QFY11 3QFY11 4QFY11 Decision tree (key study deliverable) Legal/authorities review complete Cyber accelerator entity established TIA authorities granted to sponsor Processes in-place Accelerator core staffing complete Accelerator FY10 contract end Accelerator tasks FY11 Technology Investment Agreement start Integration Panel staffing complete Sponsor tasks Portfolio/CID Decision Reviews CID-1 Incremental Demonstrations CID-1 complete Controlled Unclassified Information