This article is an excerpt from the 2020 edition of The Art of Tendering: A Global Due Diligence Guide, which is available for purchase.
In its July 2019 decision in Oracle America, Inc. v. The United States, the United States Court of Federal Claims upheld the award of a large cloud computing contract to a single supplier. The protest involved a multi-billion-dollar Department of Defense (DoD) Joint Enterprise Defense Infrastructure (JEDI) cloud procurement. Oracle America, Inc. challenged the process, arguing that a single award, as opposed to multiple awards, was a violation of law, and that the technical security requirements were an unfair restriction on competition. Oracle also claimed that the process was compromised by conflict of interest since former government staff who were involved in the planning stages of the process had subsequently accepted jobs with a competing bidder. The Court rejected all three grounds. It found that the technical security standards were valid and that those security requirements justified the award to a single contractor. It also found that the conflicts had no material adverse impact on the fairness of the evaluation and award process.
While it agreed that some aspects of the technical security requirements were driven by the government’s desire to award to a single supplier, the Court ultimately found that those standards were primarily based on the minimum security standards needed for the proper processing and storing sensitive military information:
In substance we agree, at least with respect to Gate Criteria 1.2. While Oracle may well be correct that some aspects of the gate criteria are driven by the agency’s insistence on using a single provider to manage an immense amount of data, one critical aspect of the gate criteria is not connected to the choice of a single provider: data security. The security concern is explicit in Gate Criteria 1.2. The security component of Gate Criteria 1.2 is based on DoD’s “minimum security requirements for processing or storing DoD’s least sensitive information.”
In fact, the Court found that if the government had allowed for multiple awards, those security requirements would have increased rather than decreased, which rendered the single award scoping issue moot since the complainant was unable to meet the existing security requirements, let alone more stringent ones:
In other words, although this criteria presumes a single award, the only logical conclusion is that, if multiple awards were made, the security concerns would ratchet up, not down. They are, indeed, minimally stated. If Oracle cannot meet Gate Criteria 1.2 as currently configured, it is thus not prejudiced by the decision to make a single award. The agency’s needs would not change, so Oracle would not stand a better chance of being awarded this contract if the agency determined that the procurement must be changed to multiple award.
Turning to the conflict of interest complaint, the Court agreed that there were inappropriate organizational conflicts since some government staff who had participated in the planning stages of the procurement project had subsequently accepted employment opportunities with a competing bidder. However, the Court ultimately agreed with the internal government contracting officer’s (referred to as the CO in the decision) determination that the conflicts were peripheral and insufficient to impact the fairness of the process since the staff in question had little influence on project planning and were unable to provide any information to their new employer that resulted in an unfair advantage over other bidders:
We think that the conclusion the CO in effect asks us to draw, that these individuals were bit players in the JEDI Cloud project, is correct. They were not members of the Cloud Executive Steering Group, the Cloud Computing Program Office, the Joint Requirements Oversight Council, or the Cost Assessment and Program Evaluation, and that is only a partial list of the many DoD offices and officials who had a role in the structure of this procurement. See, e.g., AR Tab 64, 91, 94. Nor were they acting as the CO, Under Secretary, the Chief Information Officer, the Deputy Chief Management Officer, or other official who developed or signed off on challenged components of this procurement. While they should not have had the opportunity to work on the JEDI Cloud procurement at all, or at least for certain periods of time, nevertheless, their involvement does not taint the work of many other persons who had the real control of the direction of the JEDI Cloud project.
After noting that Oracle had conceded that it could not meet the threshold security requirements and that it could not “demonstrate prejudice as a result of any other possible errors”, the Court dismissed the complaint.
While this bid protest challenge was ultimately unsuccessful, this case underscores how the scoping and technical threshold decisions made in high-profile and high-value projects remain subject to a high degree of scrutiny and to potential legal challenge. Purchasing institutions should therefore ensure that these project design decisions are made through defensible and well documented procedures and are free from any material conflicts of interest.
