Defense Exportability ` Defense Exportability Update Frank Kenlon Professor of Int’l Acquisition (Intermittent) Frank.Kenlon@dau.mil June 2015

International Acquisition & Exportability (IA&E) New in DoDI 5000.02 (Jan 2015) Defense Exportability Sales & Transfers Technology Security & Foreign Disclosure International Cooperative Programs

The Dilemma Provide required capabilities quickly to allies and friends Protect the “crown jewels” of U.S. defense technology Will the new Defense Exportability Features (DEF) initiative help?

Designing for Exportability Launch customer paid for technology security modifications to DoD configuration Expensive and time consuming mods inhibit foreign sales No authority to use appropriated funds for exportability design Past Present Defense Exportability Features (DEF) Pilot Program authorized by Congress in FY11 and subsequent Nat’l Defense Authorization Acts OSD and the MILDEPs have selected 15 programs to participate as DEF Pilot Programs Authorizes expenditure of DoD funds to evaluate exportability and facilitate planning; industry shares cost Facilitates incorporation of program protection features in systems with high export potential during system development Improves protection of Critical Program Information (CPI) and critical functions using Anti-Tamper (AT)/Cyber measures Reduces overall DoD and foreign program protection costs Makes our equipment available earlier to Allies and Friends Why

Defense Exportability Activities IOC A C B LRIP Technology Maturation & Risk Reduction. Production & Deployment DRFPRD Materiel Solution Analysis CDD-V CDD ICD Draft Operations & Support Materiel Development Decision FRP Sustainment Disposal FOC Engineering & Manufacturing Development CDR CPD PDR Exportability Assessment Projected sales Technology complexity Exportability Feasibility Studies Conducted with program contractor Included in TMRR contract Funded by program or DEF PE Industry provides 50% Exportable Designs Funded by program, cooperative program or customer, or industry (or combination) May be multiple configurations Exportable Version Production Funded by customer Exportable Version Depot & Spares Activities Require MDA Approval

Systems Engineering Protect Critical Technology Enhance the Exportability of Defense Systems Facilitate International Cooperative Programs Promote Allied and Friendly Nation Interoperability

System Security Engineering Integrating process for mitigating and managing risks to advanced technology and mission-critical system functionality Provides the functional discipline within SE to ensure that security requirements are included in the engineering analysis Should include an assessment of security criteria that sets limits for: International Cooperative Programs Foreign Military Sales Direct Commercial Sales From this assessment; engineering, hardware, and software alternatives (i.e. export variants and anti-tamper provisions) should be identified that would permit such transactions

Critical Program Information DoD CPI Policy: Protect CPI to maintain U.S. warfighter operational and technological advantages Identify CPI early (and reassess periodically) to implement CPI protection and countermeasures throughout RDT&E programs’ lifecycles Ensure horizontal CPI protection measures (anti-tamper, exportability features, security) are consistently and efficiently applied across RDT&E programs Integrate and synchronize CPI protection measures in Program Protection Plans (PPPs) Definition of CPI : “U.S. capability elements that contribute to the warfighters’ technical advantage, which if compromised, undermines U.S. military preeminence. U.S. capability elements may include, but are not limited to, software algorithms and specific hardware residing on the system, its training equipment, or maintenance support equipment.” DoDI 5200.39 (May 2015) New

DoDI 5000.02 (Enclosure 3, paragraph 13) New Program Protection “Program protection also supports international partnership building and cooperative opportunities objectives by enabling the export of capabilities without compromising underlying U.S. technology advantages.” Program managers will describe in their [Program Protection Plan] PPP the program’s critical program information and mission-critical functions and components … [including] planning for exportability and potential foreign involvement. Countermeasures should include anti-tamper, exportability features, security … and other mitigations …” DoDI 5000.02 (Enclosure 3, paragraph 13) New

Program Protection Plan (PPP) -- DAG Chapter 13.2. -- System development document focused on identification and protection of CPI as well as mission critical functions and components Milestone A and B PPPs should include areas such as: Program’s potential for ICP efforts (including S&T) and future foreign sales Initial TSFD and defense exportability activities including: Candidate CPI identification for domestic and export configurations Potential defense exportability system security design risk mitigation measures (anti-tamper, differential capabilities) Summaries of threats/risks/cost using format contained in OUSD(AT&L) Memo of July 18, 2011 S&T Community may participate in system development-related: IAC and ICP S&T activities that support system development objectives Defense Exportability Features (DEF) feasibility study efforts Since S&T community members may be asked to help system development Program Managers and their Integrated Product Team (IPTs) prepare PPPs, we have included a chart on this subject in this presentation. Per DoD 5000 series policy, an initial PPP must be prepared for Milestone A. This initial PPP should be refined and updated the program moves forward through subsequent system development Milestones. Chapter 13.2 of the DAG provides specific guidance on PPP preparation, including hyperlinks to these two documents: AT&L’s guidance memo on PPPs: http://www.acq.osd.mil/se/docs/PDUSD-ATLMemo-Expected-Bus-Practice-PPP-18Jul11.pdf PPP format: http://www.acq.osd.mil/se/docs/PPP-Outline-and-Guidance-v1-July2011.pdf DoDI 5200.39, Critical Program Information (CPI) Protection within the Department of Defense, defines CPI as elements or components of a Research, Development, and Acquisition (RDA) program that, if compromised, could cause significant degradation in mission effectiveness; shorten the expected combat-effective life of the system; reduce technological advantage; significantly alter program direction; or enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability. If tasked to do so, S&T community members should assist PMs/IPTs in identifying potential CPI and critical technology components using the criticality analysis approach contained in the PPP guidance documents cited above.

Program Protection Plan (PPP) Single source document Comprehensive protection Objective: Prevent exploitation of U.S. technology or the development of countermeasures to U.S. defense systems When: As soon as CPI is identified, should be approved at Milestone A; must be updated at subsequent Milestones Responsibility: PM Approval: MDA

PPP Template Per USD(AT&L) Memo of July 18, 2011 … Introduction Program Protection Summary CPI and Critical Components Horizontal Protection Threats, Vulnerabilities & Countermeasures Other System Security Related Plans/Documents Program Protection Risks Foreign Involvement Processes for Mgmt and Implementation of PPP Processes for Monitoring and Reporting Compromises Program Protection Costs Appendices A – E DAG Chap. 13 provides additional guidance on PPP development

Differential Capability DEF Dimensions Differential Capability Design, develop, and test modifications to the DoD configuration that incorporate partner/customer nation unique capabilities and remove (and confirm the removal of) U.S.-only capabilities/CPI to create one or more exportable versions of the system Anti-Tamper (AT) System engineering activities designed into the system architecture to protect CPI against: Unwanted technology transfer Countermeasure development Capability/performance degradation through unauthorized system intrusion/modification Deter, impede, detect, and respond to exploitation of CPI in DoD systems resulting from combat losses or export sales

Anti-Tamper (A-T) A-T and FMS A-T Disclosure Guidelines ATEA coord. on LOR responses for systems containing CPI A-T mechanisms and costs must be included in the LOA Compliance with A-T requirements certified to DSCA ATEA must approve A-T Plan prior to LOA offer Satisfactory V&V testing completed before export A-T Disclosure Guidelines Fact of A-T implementation should be unclassified Advising foreign partners that system contains A-T measures is usually best course of action Measures used to implement A-T will normally be classified and should not be disclosed

Defense Exportability Features (DEF) Pilot Program FY11 NDAA directed SECDEF to “carry out a pilot program to develop and incorporate technology protection features in a designated system during the R&D phase of such system.” Program Scope/Status Identify MDAPs for which there is significant anticipated export demand and whose technical aspects are amenable to DEF Pilot program to provide funding to evaluate exportability and facilitate planning for, design, and incorporation of exportability features during RDT&E AT&L selects candidate programs from MILDEP nominations FY12 NDAA change Industry to share at least half the cost of developing and implementing program protection features FY14 NDAA extended pilot program through October 2020 FY15 NDAA gives SECDEF flexibility to determine cost share Defense Exportability is Part of BBP 2.0

How Many Configurations? Few Simpler design and test Simpler production and logistics Easier upgrades More affordable Many Greater customer choice Treats countries differently Tailored logistics and upgrades More expensive DoD and partner/customer nations must compromise to achieve optimal outcomes for all (easy to say, hard to do)

Developing Exportable Configurations At the Development RFP Release Decision and Milestone B, the MDA should determine if one or more exportable configurations should be developed Informed by feasibility studies; requirements included in RFP Funding sources must be identified Most Programs Employ a Combination of Funding Sources ICP funding (various alternatives) Industry (various alternatives) FMS or DCS customer nation funding DSCA Special Defense Acquisition Fund (SDAF) Title 10 funding (specific authorization & appropriation)

EMD Exportable Design & Development Exportable configurations should be developed during EMD or LRIP if there is a firm commitment such as: One or more signed ICP international agreements One or more signed FMS LOAs A USG-approved export of proposed U.S. industry DCS transactions DSCA use of Special Defense Acquisition Funding (SDAF) in anticipation of FMS cases (under consideration) Title 10 funding specifically authorized/appropriated for exportable D&D work No Standard Approach PMs Should Pursue All Available Alternatives

FY12 DEF Pilot Programs Programs MILDEP Contractor Milestone Joint Proximity/Height of Burst Fusing (HOBF) Army Picatinny Arsenal Non-MDAP Army Integrated Air and Missile Defense (AIAMD) Northrop Grumman Post-B Indirect Fires Protection Capability, Increment 2 – Intercept (IFPC2-I) AoA Pre-A Common Infrared Counter Measures (CIRCM) BAE Systems Pre-B MQ-4C Triton (formerly Broad Area Maritime Surveillance, BAMS) Navy Three Dimensional Expeditionary Long Range Radar (3DELRR) Air Force Raytheon Lockheed Martin 19

FY13-14 DEF Pilot Programs Programs MILDEP Contractor Milestone Next Generation Jammer (NGJ) Navy Source Selection Post-A Air & Missile Defence Radar (AMDR) Post-B P-8A Poseidon Boeing Post-C E2D Advanced Hawkeye Northrop Grumman Post-FRP Small Diameter Bomb II (SDB II) Air Force Raytheon MQ-9 Reaper General Atomics Joint Air-to-Surface Standoff Missile (JASSM) Lockheed Martin Joint Ground to Air Missile (FY14) Army Lockheed Martin (LM) Pre-B Armed Aerial Scout and Ground Combat Vehicle N/A 20

Int’l Acquisition Transactions Looking Forward -- Macro View Add Inquiry, Partnership Discussion or Request for Purchase FMS Export Control Capabilities & Tech Willing to Transfer US Strategy & Policy Initial TSFD & DEF TSFD DCS Int’l Acquisition Transactions ? ICP Desired Capabilities & Tech Foreign Strategy & Policy Other Engage Earlier Defense Acquisition System