More and more often, the U.S. Government (USG) is entering into third-party hardware and software agreements to get access to commercially available IT tools. The more common approach is for the USG to rely on a pre-vetted, multi-award, government acquisition contract (GWAC) with a designated contractor. The contractor brokers a license for the USG to use the hardware or software with the actual owner of the hardware or software. As the de facto middle man, the GWAC-holder will negotiate the best rates for the USG agency based on its specific needs and will generally be responsible for overseeing the rollout to government users. The GWAC-holder will also be responsible for ensuring that government users do not overuse the license – either in use time, number of authorized users, or corresponding customer service.
In a recent Civilian Board of Contract Appeals (CBCA or the Board), an interesting question resulted from a software and support contract. In Force 3, LLC v. U.S. Department of Health and Human Services, CBCA 6654 (April 27, 2021), Force 3 LLC (Force 3 or Contractor), a GWAC-holder, negotiated and secured access to FireEye appliances, software, and support services for use by the Department of Health and Human Services (HHS). The contract was for one base year with two option years, beginning May 2016.
To take advantage of the best pricing, Force 3 signed a three-year subscription for FireEye's support services, software rights, and maintenance. Notably, FireEye's standard commercial use terms and conditions require at least one year of service and do not permit refunds for early termination. Force 3 integrated FireEye's terms and conditions into its agreement with HHS, as well as Force 3's standard terms and conditions which included a requirement that HHS — not Force 3— discontinue use, delete, and disable all FireEye software.
In May 2018, HHS choose not to exercise the second option, allowing Force 3's contract with FireEye to expire. In July and August 2018, FireEye informed Force 3 that HHS was continuing to use FireEye's software and customer support. HHS asked FireEye, through Force 3, for a shorter term, but FireEye would not adjust its standard terms and conditions.
The contracting officer (KO) was aware of the continued use, the expired license, and the unexercised option. In fact, she maintained that the services had not been ordered, requested, authorized, or required by HHS. She instructed Force 3 to discontinue the use. Force 3 could not do so because it had executed a three-year service agreement with FireEye.
At the same time, HHS users continued to use the FireEye applications, software, and support services - including contacting FireEye customer support as late as January 2019 and operating FireEye appliances as late as March 2019. HHS took no affirmative steps to delete the FireEye applications or unplug them from internet access, change configurations, or any other of a number of mechanisms available to ensure that HHS users discontinued their unauthorized use of FireEye applications.
Force 3 filed a claim for $1.3 million for the value of the third year of the subscription with FireEye. Not surprisingly, the KO denied the claim.
The CBCA examined and determined a couple of important issues. First, Force 3 entered the three-year agreement at its own risk – the USG never has an obligation to exercise options. And, the USG cannot exercise an option by anything other than express actions, in strict compliance with the contract terms. In other words, options cannot be constructively exercised.
Second, the Board found that the KO actually implicitly ratified Force 3's commitment to using the third year of support services because HHS continued to use the support services at no cost and with the KO's knowledge. The KO had a duty to stop the unauthorized use and failed to stop it once she was aware. Further, she took no actions to have the agency remove, delete, or disable the existing FireEye hardware or software. The Board held that, by allowing that unauthorized use to continue and not taking any steps to inhibit the continued use of the hardware and software, the KO implicitly ratified its continued use. As such, the contractor was allowed to recover.
For Force 3, its saving grace was that its standard terms and conditions required HHS, the USG customer, to actually remove FireEye's hardware and software. HHS did not do that – even though, as the Board found, there were numerous ways for HHS to have done so. Force 3 was entitled to recover $1.3 million, the cost of the third year of the subscription.
The key takeaways: (i) the USG is never required to exercise an option and an option cannot be exercised constructively; and (ii) the KO's knowledge of HHS' continued use allowed the Board to decide that, by her doing nothing to stop HHS' use, she ratified HHS' decision to use FireEye for another year. It seems like splitting hairs. It is. Force 3 was only able to recover FireEye's annual license fee because HHS continued to use the hardware and software, made no attempts to remove it, and the KO was aware of these facts.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
