Defense Advanced Research Projects Agency, Cyberspace Operations Research and Development , August 28, 2017. Unclassified.
National Security Archive
DARPA’s 2017 cyber RFI reveals how the U.S. moved from reactive defense to an offensive, research‑driven cyber strategy.
Source: Defense Advanced Research Projects Agency, Cyberspace Operations Research and Development , August 28, 2017. Unclassified. Date: Aug 28, 2017 Archive: FedBizOpps Collection: Cyber Vault Additions Sep 6, 2017
Editorial Analysis
Original analysis by the DriftSeas editorial desk. The complete primary-source document, transcribed from the National Security Archive scan, appears in full below.
DARPA’s 2017 Cyber RFI: A Window into the Agency’s Post‑Stuxnet Push
The August 28 2017 Request for Information (RFI) issued by DARPA’s Information Innovation Office (I2O) is more than a bureaucratic call for contractors; it marks a decisive moment in the United States’ effort to institutionalize cyber‑warfare as a core military capability. Drafted in the wake of high‑profile cyber incidents—Stuxnet (2010), the Russian‑linked DDoS attacks on the Ukrainian power grid (2015), and the 2016 U.S. election interference—the RFI reflects a shift from ad‑hoc, intelligence‑driven cyber projects to a sustained, research‑oriented pipeline.
The document’s preamble frames cyberspace as a “new domain of human endeavor and conflict,” echoing the language of Joint Publication 3‑121 (2014) that officially recognized cyber as an operational domain. By invoking DoD joint publications, DARPA signals that its solicitation is not an isolated technology push but part of a broader doctrinal integration. The agency’s explicit aim—to keep an up‑to‑date roster of potential performers capable of handling classified work—reveals a concern that the U.S. research base was lagging behind adversaries in both talent and infrastructure.
The Strategic Context: From Reactive Defense to Offensive Innovation
Between 2015 and 2017 the Pentagon re‑organized its cyber enterprise, creating U.S. Cyber Command (USCYBERCOM) as a unified combatant command and establishing the Army’s Cyber Center of Excellence. Concurrently, DARPA’s I2O, launched in 2015, was tasked with “disruptive” cyber technologies that could give the military an asymmetric edge. The RFI fits squarely within this agenda: it solicits entities that already possess security clearances or can obtain them quickly, indicating that DARPA intended to tap into the private sector’s cutting‑edge expertise while maintaining operational secrecy.
Notably, the RFI lists specific DoD publications (JP 2‑0, 3‑0, 3‑121, 3‑13) as background, underscoring the agency’s desire for proposals that align with joint doctrine on cyber operations, targeting, and kinetic‑cyber integration. This points to a research focus that goes beyond defensive tools toward capabilities that could be employed in kinetic‑cyber missions—e.g., rapid development of exploit‑generation platforms, autonomous network‑penetration systems, or resilient command‑and‑control architectures.
Who the RFI Targets and What Their Responses Reveal
The solicitation explicitly calls for “potential performers currently holding security clearances and facilities cleared to receive, store, and process CSO information at multiple levels of classification,” as well as those “eligible to receive clearances.” This dual track reflects DARPA’s awareness that the most innovative cyber work often resides in start‑ups, university labs, and niche defense contractors that lack existing clearances. By offering a pathway for eligibility, DARPA hoped to broaden its talent pool without compromising security.
The detailed submission format—cover page, personnel listings, facility descriptions, and prior government experience—forces respondents to lay bare their classified capabilities. While the agency promises only a receipt acknowledgment, the very act of collecting such granular data suggests DARPA was building a classified “who’s‑who” of cyber talent, likely to be cross‑referenced with internal R&D pipelines such as the Cyber Grand Challenge (2016) and the DARPA Safe Genes program’s cyber‑security off‑shoots.
Significance and Legacy
The 2017 RFI foreshadows several high‑profile DARPA cyber initiatives that followed, including the “Cyber‑Physical Systems” program and the “Artificial Intelligence Exploration” (AIE) track, both of which leveraged private‑sector expertise under strict security regimes. Moreover, the emphasis on rapid development and multi‑level clearance readiness prefigures the modern “fast‑track” acquisition models now used for cyber tools, where prototypes move from lab to operational testing in months rather than years.
In hindsight, the RFI also illustrates the growing bureaucratic tension between openness and secrecy in U.S. cyber policy. By publishing the solicitation unclassified, DARPA signaled transparency, yet the underlying goal was to funnel classified work to a select, vetted community. This paradox continues to shape debates over how to harness civilian innovation for national security without stifling the open research culture that birthed many of today’s foundational cyber technologies.
For historians, the document is a rare, unredacted glimpse into the procedural mechanics of America’s cyber arms race during a period when the nation was grappling with the reality that future conflicts would be fought as much in code as on the battlefield.
# Request for Information
## Cyberspace Operations Research and Development
DARPA-SN-17-66
August 28, 2017
DARPA
Defense Advanced Research Projects Agency
Information Innovation Office
675 North Randolph Street
Arlington, VA 22203-2114
Request for Information (RFI)
Cyberspace Operations Research and Development (CSO R&D)
I. Introduction
Cyberspace has emerged as a new domain of human endeavor and conflict. Information, communication, and networking technologies drive the productivity gains essential to U.S. economic competitiveness. However, networked information systems create new vulnerabilities and opportunities for attack. Adversaries seek asymmetric advantage through actions in cyberspace. The U.S. military recognizes cyberspace as an operational domain.
Research and development (R&D) to advance the state of the art in cyberspace operations (CSO) requires specialized knowledge, skills, and experience. Often, these projects are classified and can only be solicited from a limited number of sources. The Defense Advanced Research Projects Agency (DARPA) must maintain up-to-date knowledge about potential performers to maximize the number of sources that can be solicited for classified, highly specialized, CSO R&D initiatives. DARPA seeks information regarding such potential performers. Ideally, respondents will include both potential performers currently holding security clearances and those who may be granted clearances based on technical capabilities and eligibility.
Additional background information is available in Department of Defense Joint Publications 2-0, 3-0, 3-121, and 3-13.
II. Request For Information
The DARPA Information Innovation Office (I2O) requests information on potential performers for classified CSO R&D. Specifically, this RFI seeks information on potential performers who have the capability to rapidly develop state-of-the-art CSO technologies responsive to current and emerging cyber threats, and who have either of the following:
* personnel¹ currently holding security clearances and facilities² cleared to receive, store, and process CSO information at multiple levels of classification, or
* personnel and facilities eligible to receive clearances.
Depending on the nature of the information to be provided, responses may be classified or unclassified. Classified materials must be submitted in accordance with the guidelines outlined herein.
DARPA does not plan to respond to submissions other than to confirm receipt. However, in some cases, DARPA may request additional information and/or facilitate exchanges on a particular area of CSO. If classified discussions are necessary, DARPA will contact the applicable Point(s) of Contact identified on the response to make arrangements.
---
¹ http://www.dss.mil/psmo-i/ps_faqs.html
² http://www.dss.mil/isp/fac_clear/per_sec_clear_proc_faqs.html
DARPA-SN-17-66 CSO R&D RFI 2
Respondents to previous versions of this RFI (e.g., DARPA-SN-16-42), who satisfy the requirements listed above, are encouraged to respond to this RFI to ensure that DARPA possesses current information.
III. Submission Format
Submissions shall be formatted for printing on 8-1/2 by 11 inch paper with font size not smaller than 12 point in Microsoft Word or Adobe PDF format. Font sizes as small as 8 point may be used for figures, tables, and charts. Submissions containing proprietary data should have the cover page and each page containing proprietary data marked appropriately.
1. Unclassified Submissions
Each white paper shall consist of the following sections:
a. Cover Page (1 page)
- Organization
- Technical point of contact (name, address, phone and fax number, and email address)
- Administrative point of contact (name, address, phone and fax number, and email address)
- If applicable, security point of contact (name, address, phone and fax number, and email address)
- If applicable, Commercial and Government Entity (CAGE) code³
- If applicable, sensitive compartmented information facility identification number(SCIF ID)
b. Presentation of Capability (limited to 4 pages)
- Personnel: provide a list of current personnel with CSO experience, their clearances (if any), and a narrative description of their knowledge, skills and abilities relevant to CSO.
- Facilities: provide a description of your facilities and assets available for CSO R&D. If facilities have been approved for classified storage, processing and discussion, indicate the level of classification. Describe any available contingencies for the expansion or upgrade of your secure facilities including spaces that are built to specification but are not accredited.
- Organizational Experience: Describe previous accomplishments or ongoing work in this research area, including identification of any Government sponsors. Descriptions must include the Agency/Office, Program Name and Program Manager.
³ A CAGE Code identifies companies doing or wishing to do business with the Federal Government. See http://www.dlis.dla.mil/cage_welcome.asp.
DARPA-SN-17-66 CSO R&D RFI 3
2. Classified Submissions
Each white paper shall consist of the following sections:
a. Cover Page (1 page)
- Organization
- Technical point of contact (name, address, phone and fax number, and email address. Include classified contact information, as applicable.)
- Administrative point of contact (name, address, phone and fax number, and email address. Include classified contact information, as applicable.)
- Security point of contact (name, address, phone and fax number, and email address. Include classified contact information, as applicable.)
- CAGE code
- SCIF ID
b. Presentation of Capability (limited to 4 pages)
- Personnel: provide a list of current personnel with CSO experience, their clearances (if any), and a narrative description of their knowledge, skills and abilities relevant to CSO.
- Facilities: provide a description of your facilities/assets available for CSO R&D. Indicate the level of classification approved for storage, processing and discussion. Describe any available contingencies for the expansion or upgrade of your secure facilities including spaces that are built to specification but do not currently have a sponsor for accreditation.
- Organizational Experience: Describe any previous accomplishments or similar efforts completed/ongoing in this or closely related research area, including identification of other Government sponsors, if any. Descriptions must include the Agency/Office, Program Name and Program Manager. For discussion of any efforts classified beyond Secret, see section IV.2.b below.
Classified submissions shall be appropriately and conspicuously marked with the proposed classification level and declassification date. Use classification and marking guidance provided by the DoD Information Security Program Manual (DoDM 5200.01, Volumes 1-4) and the National Industrial Security Program Operating Manual (DoD 5220.22-M). When marking and transmitting classified information derived from an applicable security classification guide (SCG), please cite the SCG appropriately in accordance with DoDM 5200.01, Volume 2. Applicable classification guide(s) must be included with your submission to ensure it is protected at the appropriate classification level, but will not count against the page limitation.
If a respondent believes a submission may contain classified information as defined by Executive Order 13526, but requires DARPA to make a final classification determination, the information must be marked and protected as though classified at the appropriate classification level (as defined by Executive Order 13526).
Submissions requesting DARPA to make a final classification determination shall be marked as follows:
DARPA-SN-17-66 CSO R&D RFI 4
“CLASSIFICATION DETERMINATION PENDING. Protect as though classified [insert the recommended classification level, e.g., Confidential, Secret, or Top Secret].”
IV. Submission Instructions
Responses to this RFI must be submitted via appropriate channels in accordance with the instructions outlined below. Responses may be submitted at any time until August 31, 2018, at 12:00 noon (ET).
- Unclassified Submission
Unclassified responses should be emailed to DARPA-SN-17-66@darpa.mil.
- Classified Submission
a. Confidential and Secret Collateral information must be submitted by one of the following methods:
Hand carried by an appropriately cleared and authorized courier to DARPA. Prior to traveling, the courier shall contact the DARPA Classified Document Registry (CDR) at 703-526-4052 to coordinate arrival and delivery.
or
Mailed by U.S. Postal Service Registered Mail or Express Mail. All classified information must be enclosed in opaque inner and outer covers and double wrapped. The inner envelope shall be sealed and plainly marked with the assigned classification and addresses of both sender and addressee. The inner envelope shall be addressed to:
Defense Advanced Research Projects Agency ATTN: CSO R&D RFI, I2O Program Security Officer Reference: DARPA-SN-17-66 675 North Randolph Street Arlington, VA 22203-2114
The outer envelope shall be sealed without identification as to the classification of its contents and addressed to:
Defense Advanced Research Projects Agency Security & Intelligence Directorate, Attn: CDR 675 North Randolph Street Arlington, VA 22203-2114
b. Higher classification submissions (e.g., Top Secret, Sensitive Compartmented Information) must be coordinated with DARPA via UNCLASSIFIED email to
DARPA-SN-17-66 CSO R&D RFI 5
DARPA-SN-17-66@darpa.mil in order to request instructions on format and transmission. Classification inquiries may also be directed to the I2O Program Security Officer at 571-218-4538.
V. Eligibility
All responsible sources capable of satisfying the Government's needs as outlined herein may submit a response that shall be considered by DARPA.
VI. Disclaimer
This RFI is issued solely for information gathering purposes. This RFI does not constitute a formal solicitation for proposals. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract. DARPA will not provide reimbursement for costs incurred in responding to this RFI. Respondents are advised that DARPA is under no obligation to provide feedback to respondents with respect to any information submitted under this RFI. Response to this RFI is strictly voluntary and is not required to propose to any subsequent solicitations on this topic, if any.
Submissions may be reviewed by: the Government (DARPA and partners); Federally Funded R&D Centers; and Scientific Engineering and Technical Assistance (SETA) contractors. All personnel with access to the submissions will be covered by a legally-binding non-disclosure agreement and hold appropriate clearances.
VII. Point of Contact
Inquiries should be submitted via UNCLASSIFIED email to DARPA-SN-17-66@darpa.mil.
DARPA-SN-17-66 CSO R&D RFI 6
NATIONAL SECURITY ARCHIVE
National Security Archive, Suite 701, Gelman Library, The George Washington University, 2130 H Street, NW, Washington, D.C., 20037, Phone: 202/994-7000, Fax: 202/994-7005, nsarchiv@gwu.edu