IG: Task orders awarded were improperly in VA data theft investigation

Department of Veterans Affairs officials improperly awarded several task orders and a blanket purchase agreement after the theft of a laptop computer and hard drive from a VA employee’s home last May, the department’s Office of Inspector General said.In a newly released report, the IG's office said the VA awarded a sole-source task order June 1, 2006, to Internet Security Systems (ISS) to analyze 17 portable media devices that the VA employee had used to transfer data from his office to his home computer.Pedro Cadenas, then associate deputy assistant secretary at the VA’s Office of Cyber and Information Security, wrote the memorandum justifying the sole-source award, saying ISS “is a renowned contractor who has demonstrated global capacity of satisfying this critical demand.”However, the IG found that ISS could not access the data and perform the forensic analysis because it was unfamiliar with the Statistical Analysis System format, despite its claim to the contrary. VA information technology officials converted the data into a format the contractor could read.When Cadenas told acquisition officials the following day to award a second task order to ISS, the contracting officer “questioned the legality of the action, noting that the [Federal Acquisition Regulation] prohibited a sole-source follow-on contract when the original task order was a sole-source award,” the report states.To comply with the FAR, the Acquisition Operations Service (AOS) sent a request for quotations to contractors on the Federal Supply Schedule June 2 at 10 p.m. Vendors had to reply by 1 a.m. on June 3. Two vendors -- ISS and First Advantage -- responded. Their proposals were sent to Cadenas at 2 a.m. But the ISS RFQ was incomplete and the contractor was asked to complete the information by 7 a.m. The IG report found that ISS did not provide the information by the deadline.Nevertheless, Cadenas sent an e-mail message from home at 4 a.m. in which he told the VA contracting officer that “he had performed a technical evaluation of the two proposals and recommended ISS as the best value meeting the needs of the requirement,” the IG said. The contracting officer authorized the work 10 minutes later.On June 6 the contracting officer signed off on a three-year BPA “with a ceiling for all task orders not to exceed $2,679,900,” the report states.The IG’s office said it was unable to interview Cadenas because he resigned three days before he was ordered to appear for an interview. The report adds, “We were unable to obtain records relating to Mr. Cadenas’ administration of the contract; there were no hard copy files and he had used professional software to erase the hard drive on his computer.”The IG recommended remedial actions, including withholding several payments from ISS. That office also called for administrative actions against the AOS director and some contracting employees.In an attachment to the report, VA officials agreed to take all recommended actions.